71bfe1f26a98e152344fe5687db229da90e9ba8475cb3804a78a0f46152ba0bf

General

Target

pack/Decrypter.exe
Size

218KB
MD5

97f3854d27d9f5d8f9b15818237894d5
SHA1

e608608d59708ef58102a3938d9117fa864942d9
SHA256

fac94a8e02f92d63cfdf1299db27e40410da46c9e86d8bb2cd4b1a0d68d5f7a2
SHA512

25d840a7a6f0e88092e0f852690ed9377cf3f38e0f2c95e74f8b2ffea574d83c6154cccdbf94f1756e2bbdcdb33b5106aab946644dedc4ffaefb6bf57a866696
SSDEEP

1536:PJG/sX9Ik6sq2njM9qRYxSKCxly16Pn6RikC:PJG/sX9i2YcRPm16Pn6ckC

Score

7^/10

ransomware spyware stealer

Malware Config

Signatures

Drops startup file 1 IoCs

Processes:

Decrypter.exe

description	ioc	process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini	Decrypter.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Drops desktop.ini file(s) 34 IoCs

Processes:

Decrypter.exe

description	ioc	process
File opened for modification	C:\Users\Admin\Desktop\desktop.ini	Decrypter.exe
File opened for modification	C:\Users\Admin\Pictures\desktop.ini	Decrypter.exe
File opened for modification	C:\Users\Admin\Favorites\Links\desktop.ini	Decrypter.exe
File opened for modification	C:\Users\Admin\Videos\desktop.ini	Decrypter.exe
File opened for modification	F:\$RECYCLE.BIN\S-1-5-21-734199974-1358367239-436541239-1000\desktop.ini	Decrypter.exe
File opened for modification	C:\Users\Admin\Contacts\desktop.ini	Decrypter.exe
File opened for modification	C:\Users\Admin\Downloads\desktop.ini	Decrypter.exe
File opened for modification	C:\Users\Admin\Searches\desktop.ini	Decrypter.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\desktop.ini	Decrypter.exe
File opened for modification	C:\Users\Public\Pictures\desktop.ini	Decrypter.exe
File opened for modification	C:\Users\Admin\Pictures\Camera Roll\desktop.ini	Decrypter.exe
File opened for modification	C:\Users\Admin\Pictures\Saved Pictures\desktop.ini	Decrypter.exe
File opened for modification	C:\Users\Admin\Saved Games\desktop.ini	Decrypter.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini	Decrypter.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\desktop.ini	Decrypter.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SendTo\desktop.ini	Decrypter.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini	Decrypter.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\desktop.ini	Decrypter.exe
File opened for modification	C:\Users\Public\Desktop\desktop.ini	Decrypter.exe
File opened for modification	C:\Users\Admin\Favorites\desktop.ini	Decrypter.exe
File opened for modification	C:\Users\Public\Documents\desktop.ini	Decrypter.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Desktop.ini	Decrypter.exe
File opened for modification	C:\Users\Public\Music\desktop.ini	Decrypter.exe
File opened for modification	C:\Users\Admin\Links\desktop.ini	Decrypter.exe
File opened for modification	C:\Users\Admin\Music\desktop.ini	Decrypter.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini	Decrypter.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\desktop.ini	Decrypter.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini	Decrypter.exe
File opened for modification	C:\Users\Public\Videos\desktop.ini	Decrypter.exe
File opened for modification	C:\Users\Admin\Documents\desktop.ini	Decrypter.exe
File opened for modification	C:\Users\Admin\OneDrive\desktop.ini	Decrypter.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini	Decrypter.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\AccountPictures\desktop.ini	Decrypter.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\desktop.ini	Decrypter.exe

Sets desktop wallpaper using registry 2 TTPs 1 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

Processes:

Decrypter.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-734199974-1358367239-436541239-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\lkae9segr.jpg"	Decrypter.exe

Suspicious behavior: EnumeratesProcesses 19 IoCs

Processes:

Decrypter.exe

pid	process
3992	Decrypter.exe
3992	Decrypter.exe
3992	Decrypter.exe
3992	Decrypter.exe
3992	Decrypter.exe
3992	Decrypter.exe
3992	Decrypter.exe
3992	Decrypter.exe
3992	Decrypter.exe
3992	Decrypter.exe
3992	Decrypter.exe
3992	Decrypter.exe
3992	Decrypter.exe
3992	Decrypter.exe
3992	Decrypter.exe
3992	Decrypter.exe
3992	Decrypter.exe
3992	Decrypter.exe
3992	Decrypter.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

Decrypter.exe

description pid process

Token: SeDebugPrivilege 3992 Decrypter.exe

description	pid	process
Token: SeDebugPrivilege	3992	Decrypter.exe

C:\Users\Admin\AppData\Local\Temp\pack\Decrypter.exe
"C:\Users\Admin\AppData\Local\Temp\pack\Decrypter.exe"
1⤵
- Drops startup file
- Drops desktop.ini file(s)
- Sets desktop wallpaper using registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3992

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

Lateral Movement

Collection

Data from Local System

1

T1005

Exfiltration

Command and Control

Impact

Defacement

1

T1491

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3992-0-0x0000000000D80000-0x0000000000DBC000-memory.dmp

Filesize
240KB

Download
memory/3992-1-0x00007FF8D82B0000-0x00007FF8D8D72000-memory.dmp

Filesize
10.8MB

Download
memory/3992-3-0x00007FF8D82B0000-0x00007FF8D8D72000-memory.dmp

Filesize
10.8MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads