Overview

overview

10

Static

static

10

03db266db5...d1.exe

windows7-x64

10

03db266db5...d1.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    118s
  • max time network
    119s
  • platform
    windows7_x64
  • resource
    win7-20231129-en
  • resource tags

    arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
  • submitted
    07/05/2024, 17:31

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    03db266db5b96223ef42206d57e30fa58c59e70b1d14c017422f097af1560ad1.exe

  • Size

    147KB

  • MD5

    6ac5cd70e043576b82a313273150f0d9

  • SHA1

    2c3b2ed20f1e8e630c61109288bd0ac64b5e0329

  • SHA256

    03db266db5b96223ef42206d57e30fa58c59e70b1d14c017422f097af1560ad1

  • SHA512

    c77a84cc5ae2cf246278a736051baa44d1f15496547a2bfbba2cbd65e207b6e17a6b9fb4a221b4ec4286c4d80fa65709854cbd46d14a4548fbcf9fb72d01def5

  • SSDEEP

    1536:nzICS4AAwczUUf8y8gvMH+1zGSNAojMP95D1xDpAv5wo3Lk6eEVNAhaxlxxFmwUk:YqJogYkcSNm9V7DpKv3L35Sslxx0wT

Score
10/10
ransomwarespywarestealer

Malware Config

Extracted

Path

C:\zpvmjd9JY.README.txt

Ransom Note
~~~AsiriumSquad~~~ >>>> Your data are stolen and encrypted. >>>> What guarantees that we will not deceive you? We are not a politically motivated group and we do not need anything other than your money. If you pay, we will provide you the programs for decryption and we will delete your data. Life is too short to be sad. Be not sad, money, it is only paper. If we do not give you decrypters, or we do not delete your data after payment, then nobody will pay us in the future. Therefore to us our reputation is very important. We attack worldwide and there is no dissatisfied victim after payment. >>>> You need contact us to decrypt file. buy our special decryption software, this software will allow you to recover all of your data and remove the ransomware from your computer.The price for the software is $300. Payment can be made in Bitcoin only. How do I pay, where do I get Bitcoin? Moonpay.com Important!: your pc, your personal life, your liberty is in danger ! take this serius if u dont pay whe Must ruin ur life otherwise no one will pay. Payment informationAmount: 0.004 BTC Bitcoin Address: bc1q07v4dm6q5ln5w3ac93ue8jdvcjmq8tg3tvlmlr Contact us with Your personal DECRYPTION ID and screenshot of PAYMENT at: [email protected] >>>> Your personal DECRYPTION ID: 8D9634EC6DA0FEAA3EDCE183D0274D79 >>>> Warning! Do not DELETE or MODIFY any files, it can lead to recovery problems! >>>> Warning! If you do not pay the ransom we will attack your company repeatedly again!

Signatures

  • Renames multiple (260) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware
  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Drops desktop.ini file(s) 2 IoCs
  • Sets desktop wallpaper using registry 2 TTPs 2 IoCs
    ransomware
  • Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
  • Modifies Control Panel 2 IoCs
    evasion
  • Modifies registry class 5 IoCs
  • Suspicious behavior: EnumeratesProcesses 14 IoCs
  • Suspicious behavior: RenamesItself 26 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\03db266db5b96223ef42206d57e30fa58c59e70b1d14c017422f097af1560ad1.exe
    "C:\Users\Admin\AppData\Local\Temp\03db266db5b96223ef42206d57e30fa58c59e70b1d14c017422f097af1560ad1.exe"
    1⤵
    • Loads dropped DLL
    • Drops desktop.ini file(s)
    • Sets desktop wallpaper using registry
    • Modifies Control Panel
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2028
    • C:\ProgramData\1E2B.tmp
      "C:\ProgramData\1E2B.tmp"
      2⤵
      • Deletes itself
      • Executes dropped EXE
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • Suspicious behavior: RenamesItself
      • Suspicious use of WriteProcessMemory
      PID:3000
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /C DEL /F /Q C:\PROGRA~3\1E2B.tmp >> NUL
        3⤵
          PID:2708
    • C:\Windows\system32\AUDIODG.EXE
      C:\Windows\system32\AUDIODG.EXE 0x14c
      1⤵
        PID:1112

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\$Recycle.Bin\S-1-5-21-3627615824-4061627003-3019543961-1000\desktop.ini
        Filesize

        129B

        MD5

        9e5e0e4357ee0a61a99965a960544424

        SHA1

        adfc5b838855cee957388feba13354a80d9c254a

        SHA256

        3f8bc71766c21dfc536747ecf1bcae69a534c5d5d449c2d7bc45fd7b20fb9417

        SHA512

        0cc2d2afdcadd1e795af2f801401c0ab2492360b2f14aa41a67122733fd11b37a7203963f5e2c65d5e6048dc082c5e9e77e3cb78e4e3e717c247d4b8ddf64775

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\DDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDD
        Filesize

        147KB

        MD5

        41a237e5da64172e06a6081da7bae0f3

        SHA1

        6369e8ba5517a51b5583ead5ac68eb9c09a9d16f

        SHA256

        45faf6dc6626caa509c15cad722ce94d4cdb89993ef051e24455695c1048f958

        SHA512

        04e5f4d0de019a8faaac181228ddad2cdae09fa0444c084d0fc5bc0e8dc25315095e45ba5d7d0cded8d642de4f8321fb4b100099b9926be348c10330f51cb1f4

        Download Submit

      • C:\zpvmjd9JY.README.txt
        Filesize

        1KB

        MD5

        8d9bbd37491d444e0509716059455765

        SHA1

        6657a9ab03b0fd9494baf2e8115504246480e805

        SHA256

        997a7742cabb2089b77a5f3080293ad99413bd215043df2f749667f29fb9fa40

        SHA512

        3c40e8174f4f7a4d1e7b8238deff3491ffb36e1f2ce5afb0f451e1b7fe9b8bd5e218b877308561f7a2572b2a78d21536d28522289ed8dd6b018171182f34536d

        Download Submit

      • F:\$RECYCLE.BIN\S-1-5-21-3627615824-4061627003-3019543961-1000\DDDDDDDDDDD
        Filesize

        129B

        MD5

        b76cf776218cca981fe5e190c0d99ed9

        SHA1

        47427a18216df04d902e6efd5044d586b6517b77

        SHA256

        35b74fbdf48a6b1d89950f8d542350501d8f9b8e957b079ad4d04ceb17762a07

        SHA512

        0bfa1c334dfddf49f0df1904b2fe5963cbeb4f20ee1d100081fb4e863596cce6abc0c6c6a3473c2f4f56456538c04dd690fe27bdf4a2ee394bdfac209afe6719

        Download Submit

      • \ProgramData\1E2B.tmp
        Filesize

        14KB

        MD5

        294e9f64cb1642dd89229fff0592856b

        SHA1

        97b148c27f3da29ba7b18d6aee8a0db9102f47c9

        SHA256

        917e115cc403e29b4388e0d175cbfac3e7e40ca1742299fbdb353847db2de7c2

        SHA512

        b87d531890bf1577b9b4af41dddb2cdbbfa164cf197bd5987df3a3075983645a3acba443e289b7bfd338422978a104f55298fbfe346872de0895bde44adc89cf

        Download Submit

      • memory/2028-0-0x0000000000D30000-0x0000000000D70000-memory.dmp

        Filesize

        256KB

        Download

      • memory/3000-767-0x0000000000401000-0x0000000000404000-memory.dmp

        Filesize

        12KB

        Download

      • memory/3000-769-0x0000000000400000-0x0000000000407000-memory.dmp

        Filesize

        28KB

        Download