Analysis
-
max time kernel
147s -
max time network
159s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
-
submitted
25-04-2024 16:39
General
-
Target
86e17aa882c690ede284f3e445439dfe589d8f36e31cbc09d102305499d5c498.exe
-
Size
194KB
-
MD5
ae811bd6440b425e6777f0ca001a9743
-
SHA1
70902540ead269971e149eaff568fb17d04156af
-
SHA256
86e17aa882c690ede284f3e445439dfe589d8f36e31cbc09d102305499d5c498
-
SHA512
3617d8e77c221525125778cf64f2525136f7958766f5bed0fd7bfe00e7f738017d2840972acc628e4c3471b93cf6d52ccd619f49bdbbcff824c12cac8e1ea88e
-
SSDEEP
3072:a6glyuxE4GsUPnliByocWepiHkZmlkQIQP6fo:a6gDBGpvEByocWeQwLAPm
Malware Config
Signatures
-
Renames multiple (614) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops desktop.ini file(s) 2 IoCs
-
Drops file in System32 directory 4 IoCs
-
Sets desktop wallpaper using registry 2 TTPs 2 IoCs
-
Suspicious use of NtSetInformationThreadHideFromDebugger 5 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Enumerates system info in registry 2 TTPs 3 IoCs
-
Modifies Control Panel 2 IoCs
-
Modifies registry class 5 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: RenamesItself 26 IoCs
-
Suspicious use of AdjustPrivilegeToken 64 IoCs
-
Suspicious use of SetWindowsHookEx 13 IoCs
-
Suspicious use of WriteProcessMemory 11 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\86e17aa882c690ede284f3e445439dfe589d8f36e31cbc09d102305499d5c498.exe"C:\Users\Admin\AppData\Local\Temp\86e17aa882c690ede284f3e445439dfe589d8f36e31cbc09d102305499d5c498.exe"1⤵
- Drops desktop.ini file(s)
- Sets desktop wallpaper using registry
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Modifies Control Panel
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\splwow64.exeC:\Windows\splwow64.exe 122882⤵
- Drops file in System32 directory
-
-
C:\ProgramData\75F2.tmp"C:\ProgramData\75F2.tmp"2⤵
- Checks computer location settings
- Deletes itself
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C DEL /F /Q C:\PROGRA~3\75F2.tmp >> NUL3⤵
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4136 --field-trial-handle=3192,i,2785050981002401924,4037047756083432660,262144 --variations-seed-version /prefetch:81⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc1⤵
-
C:\Windows\system32\printfilterpipelinesvc.exeC:\Windows\system32\printfilterpipelinesvc.exe -Embedding1⤵
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE/insertdoc "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\{707755BB-BF7A-4763-BB0E-65C5C3C0DD7B}.xps" 1335853686991800002⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
129B
MD5d49c5efa7e725dbe23908843ef747870
SHA17947bb56633d7aba82bec93cd054e48fdb7ed5d7
SHA256e5000a0c70ab9c82667841f844bdcf862fe3c9e93308207fd0a173ccb77bed35
SHA512ef46d83ce7cffae9731b577ce014fdfc719ad87a127b606b4b32ec881e61b4c32ed52742948617a2f58a5a4f77c7ee606a53578e24c7b146312c81d69421d7e3
-
Filesize
14KB
MD5294e9f64cb1642dd89229fff0592856b
SHA197b148c27f3da29ba7b18d6aee8a0db9102f47c9
SHA256917e115cc403e29b4388e0d175cbfac3e7e40ca1742299fbdb353847db2de7c2
SHA512b87d531890bf1577b9b4af41dddb2cdbbfa164cf197bd5987df3a3075983645a3acba443e289b7bfd338422978a104f55298fbfe346872de0895bde44adc89cf
-
Filesize
194KB
MD55e320ecf66d54f4b5ae310c70c1c5dcc
SHA1c6f9f78441bec137264e1970d4333a14458e6e00
SHA256d643c64a2b711bb96216a7198b3c4c241da5de6d54a737f60c93b5087acbbcaf
SHA51203bcd503cd6786e1fe7dcdcfa159c321e0e6e944aa0e2f2312b7f6f03cdd10e06182115a5b53af8308e5c85ab83f13ce74fbcc44b7ecdf2738f9773cdf9cdd02
-
Filesize
4KB
MD5cf87b8b2a17c381ba3bab29f94549ef6
SHA1405e76f9ff716d424f1212248702ea7a20b70ed7
SHA25617ea7b85a42db1bb34d16856d8dae42391f742240dcb7730dae230aef1397690
SHA512b02a285c963c31bc5af0633c5fc42aa175115fff7a9eedb52a2e83304297eb29576c1d5d8214d40d2da82cd333298fd1f5f8b77f2f30c110c69dd4248aabc818
-
Filesize
4KB
MD5b5c03a031a7a49b5e7180ec6a2106958
SHA1f013d9676442e8f498ac49fd49652490eca2c687
SHA2568310a25d554e125d60c28a8dfa32b5676329d675e3f3cf339b1bdf500c6f3c1c
SHA512b080834d617963ed80bf1952a0aa79c3ef571082adadd10330783c275ef641458e7823196bc91bb8fa391ccd45b5db7b684aec80ad9c5cbde0b8673d54cdc5f9
-
Filesize
449B
MD5c2f46db865b0ba6ef8f9385cf458a56e
SHA10b2f94fcf38ef15f59bb86a3296b7da514b4ac4e
SHA256c25759e6083dd4bf592a6da2063c45def5adc9a6ef2ed15820128a0d838f70fe
SHA5129927b209ca26e3243fac9f003c6af7663ba84405346fbdb66c6f401387cd20ea3f99d63d0858ebdc76f2e6bc722d41e2a1f599bc6f7d97b0687dba95dea31b39
-
Filesize
129B
MD5d39f1a7c601f34bf1618e473dad0d600
SHA17b0b1168f560d2ab2505ca4543bcd51e905ac214
SHA256173470c8be3b5c590d0ccdc486108b667ccd6a93e3ccadfd612d6e963b241e20
SHA512238ce5f8dc06b527522e01b7a4cde13f0afb1dec3a3dd61881a2fabb7545704ac3497e974a91b6b437cb5152d6f5d918142cb57b70e8f9fe6a08124d551148fe
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
64KB
-
Filesize
64KB