Analysis
-
max time kernel
143s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
-
submitted
26-04-2024 01:00
General
-
Target
062683257386c9e41a1cd1493f029d817445c37f7c65386d54122fa466419ce1.exe
-
Size
194KB
-
MD5
50e5dec57451005668704281688ca55d
-
SHA1
67dd4ac7eb8c193b39149b34d3a0d5bc21c3f200
-
SHA256
062683257386c9e41a1cd1493f029d817445c37f7c65386d54122fa466419ce1
-
SHA512
29ca4a44795c71d3e2b4e3417355ebb93765157d464d6d5a3fe6774056d934d57081c72001fb29e47982da11e5a5ccfdbcc958d05a11fb49bd8bf84e6d0c61ad
-
SSDEEP
3072:66glyuxE4GsUPnliByocWepRGbVZqid91h2ys+tU:66gDBGpvEByocWeubV4inP9B
Malware Config
Signatures
-
Renames multiple (614) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops desktop.ini file(s) 2 IoCs
-
Drops file in System32 directory 4 IoCs
-
Sets desktop wallpaper using registry 2 TTPs 2 IoCs
-
Suspicious use of NtSetInformationThreadHideFromDebugger 5 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Enumerates system info in registry 2 TTPs 3 IoCs
-
Modifies Control Panel 2 IoCs
-
Modifies registry class 5 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: RenamesItself 26 IoCs
-
Suspicious use of AdjustPrivilegeToken 64 IoCs
-
Suspicious use of SetWindowsHookEx 13 IoCs
-
Suspicious use of WriteProcessMemory 11 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\062683257386c9e41a1cd1493f029d817445c37f7c65386d54122fa466419ce1.exe"C:\Users\Admin\AppData\Local\Temp\062683257386c9e41a1cd1493f029d817445c37f7c65386d54122fa466419ce1.exe"1⤵
- Drops desktop.ini file(s)
- Sets desktop wallpaper using registry
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Modifies Control Panel
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\splwow64.exeC:\Windows\splwow64.exe 122882⤵
- Drops file in System32 directory
-
C:\ProgramData\E8D5.tmp"C:\ProgramData\E8D5.tmp"2⤵
- Checks computer location settings
- Deletes itself
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C DEL /F /Q C:\PROGRA~3\E8D5.tmp >> NUL3⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc1⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3696 --field-trial-handle=3192,i,2785050981002401924,4037047756083432660,262144 --variations-seed-version /prefetch:81⤵
-
C:\Windows\system32\printfilterpipelinesvc.exeC:\Windows\system32\printfilterpipelinesvc.exe -Embedding1⤵
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE/insertdoc "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\{592085E5-14D3-426F-B70C-8D96F71FF6B9}.xps" 1335856690175500002⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\$Recycle.Bin\S-1-5-21-3808065738-1666277613-1125846146-1000\CCCCCCCCCCCFilesize
129B
MD51a14375015c76b576240c45caa0e26bf
SHA10bdb59257096d29aa7abd4abd9d9854238eb6d21
SHA256fcc9faab55d5cf43fadc3c133a8a2aff6f0583c4fb3b22f1424dec0e6797cfae
SHA512cf7877637d8567925242c94dc34af0405f69f979ac8191302a49d7d9fce726974379ada4079ba87c77ce46e484d1212cc40b650c8fa884ee23eac1a2747aa8a9
-
C:\ProgramData\E8D5.tmpFilesize
14KB
MD5294e9f64cb1642dd89229fff0592856b
SHA197b148c27f3da29ba7b18d6aee8a0db9102f47c9
SHA256917e115cc403e29b4388e0d175cbfac3e7e40ca1742299fbdb353847db2de7c2
SHA512b87d531890bf1577b9b4af41dddb2cdbbfa164cf197bd5987df3a3075983645a3acba443e289b7bfd338422978a104f55298fbfe346872de0895bde44adc89cf
-
C:\Qs2QSInbk.README.txtFilesize
434B
MD5ad29bd8c66e114ff57c943d16c78f72a
SHA15ab070ee89a36f38facae4dfc8ec5ce3e59af46e
SHA2566fe668fe8bf69158d1fd08e90f3cff60c1df410bf752635bf152853b6112549c
SHA512a53121e2379aa9c3bc52d073498a54f26383834f6d6636b4b3831010565c80bf0da07511907eab7bd92f9796e559958b1c0ebea4c4b0f0d869e95b7deb5da7f1
-
C:\Users\Admin\AppData\Local\Temp\DDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDFilesize
194KB
MD5884795d821773d160b949d0c79ba4893
SHA16d677f317413c0c9d1020e9dcd16e98080d435bb
SHA256340014bcd7a1b2028c5887547f3c94286e8da7876108831422a3be166fec2ba4
SHA512a97b9f0d6ab8809fff8ea585c4440baa3767699d3cc44b3382e75c4ab367d7b018a1145f3b1ed4e174b0e3c89ad0c3eec8697699a71b951fabf176d3a4cf55ef
-
C:\Users\Admin\AppData\Local\Temp\{7244CEAA-8FC6-4E2B-B0A6-03C65BDF0253}Filesize
4KB
MD5a4f205b4324b0231e92a1fecfdb416b0
SHA1bdda7ace045cc78ce1bf30a1f4609608ff8d1777
SHA2560664c1e70df5698448023029e5328914a9cce51e4fc9df64bdbce0e99e2adeb7
SHA5120661474a0aaffb0bbc0a31ad7b7611e252073c756755deeb8a3bf68c9aef26cfb6efd96df4c8b537d2b6196a76a6ca482eed41183afd25b4ab37effaca0773d0
-
C:\Users\Admin\Documents\OneNote Notebooks\My Notebook\Open Notebook.onetoc2Filesize
4KB
MD59528aa1485c57a403bc104d4617c48e4
SHA1297a74001b37b35cc1fbc9f3614a5d96dca5d796
SHA256ca15eedf76a1cf7e2e5616564469a320d08336dbb2d5c8eaa7d40831b0a7fc79
SHA512136a854af14a8cfb6568a198194b9465942380c42d5f621eeb38977d016ee2369819f53cabd840b4c89ccdcd37b70683799f5e7d351459657a08cd5d8315bb86
-
F:\$RECYCLE.BIN\S-1-5-21-3808065738-1666277613-1125846146-1000\DDDDDDDDDDDFilesize
129B
MD5d7bad473fb4e4e332fd8cbad264dd975
SHA14bdcb48e4036f16f1516a6a183751ec062f0cb1c
SHA256e41dd06f7429bc3c4601f47291d327ac40230cb6ea3a6a29e9524e7b55ea9c58
SHA512826d72b97e8b533b6b21ff55fc828e17dfa71522c4c65f9a124c75d667cd9a950475275d608d6e3c77408b39f2e527dad72d6a31fec327944881d99e532b7050
-
memory/2912-2816-0x00007FFEF6070000-0x00007FFEF6265000-memory.dmpFilesize
2.0MB
-
memory/2912-2883-0x00007FFEF6070000-0x00007FFEF6265000-memory.dmpFilesize
2.0MB
-
memory/2912-2806-0x00007FFEB60F0000-0x00007FFEB6100000-memory.dmpFilesize
64KB
-
memory/2912-2807-0x00007FFEB60F0000-0x00007FFEB6100000-memory.dmpFilesize
64KB
-
memory/2912-2809-0x00007FFEB60F0000-0x00007FFEB6100000-memory.dmpFilesize
64KB
-
memory/2912-2808-0x00007FFEF6070000-0x00007FFEF6265000-memory.dmpFilesize
2.0MB
-
memory/2912-2810-0x00007FFEB60F0000-0x00007FFEB6100000-memory.dmpFilesize
64KB
-
memory/2912-2812-0x00007FFEF6070000-0x00007FFEF6265000-memory.dmpFilesize
2.0MB
-
memory/2912-2814-0x00007FFEF6070000-0x00007FFEF6265000-memory.dmpFilesize
2.0MB
-
memory/2912-2815-0x00007FFEF6070000-0x00007FFEF6265000-memory.dmpFilesize
2.0MB
-
memory/2912-2813-0x00007FFEB60F0000-0x00007FFEB6100000-memory.dmpFilesize
64KB
-
memory/2912-2859-0x00007FFEB3C20000-0x00007FFEB3C30000-memory.dmpFilesize
64KB
-
memory/2912-2817-0x00007FFEF6070000-0x00007FFEF6265000-memory.dmpFilesize
2.0MB
-
memory/2912-2818-0x00007FFEF6070000-0x00007FFEF6265000-memory.dmpFilesize
2.0MB
-
memory/2912-2881-0x00007FFEF6070000-0x00007FFEF6265000-memory.dmpFilesize
2.0MB
-
memory/2912-2882-0x00007FFEF6070000-0x00007FFEF6265000-memory.dmpFilesize
2.0MB
-
memory/2912-2858-0x00007FFEB3C20000-0x00007FFEB3C30000-memory.dmpFilesize
64KB
-
memory/3304-2793-0x0000000001100000-0x0000000001110000-memory.dmpFilesize
64KB
-
memory/3304-2795-0x0000000001100000-0x0000000001110000-memory.dmpFilesize
64KB
-
memory/3304-2794-0x0000000001100000-0x0000000001110000-memory.dmpFilesize
64KB
-
memory/3304-1-0x0000000001100000-0x0000000001110000-memory.dmpFilesize
64KB
-
memory/3304-2-0x0000000001100000-0x0000000001110000-memory.dmpFilesize
64KB
-
memory/3304-0-0x0000000001100000-0x0000000001110000-memory.dmpFilesize
64KB
-
memory/4568-2826-0x000000007FE20000-0x000000007FE21000-memory.dmpFilesize
4KB
-
memory/4568-2823-0x000000007FE40000-0x000000007FE41000-memory.dmpFilesize
4KB
-
memory/4568-2824-0x0000000002450000-0x0000000002460000-memory.dmpFilesize
64KB
-
memory/4568-2856-0x000000007FDE0000-0x000000007FDE1000-memory.dmpFilesize
4KB
-
memory/4568-2857-0x000000007FE00000-0x000000007FE01000-memory.dmpFilesize
4KB
-
memory/4568-2825-0x0000000002450000-0x0000000002460000-memory.dmpFilesize
64KB
-
memory/4568-2827-0x000000007FDC0000-0x000000007FDC1000-memory.dmpFilesize
4KB