Overview
overview
10Static
static
3MalwareRep...00.exe
windows11-21h2-x64
MalwareRep...ng.exe
windows11-21h2-x64
1MalwareRep...hy.exe
windows11-21h2-x64
8MalwareRep...ue.exe
windows11-21h2-x64
MalwareRep...ck.exe
windows11-21h2-x64
MEMZ 4.0 C...an.bat
windows11-21h2-x64
7MEMZ 4.0 C...an.exe
windows11-21h2-x64
1MalwareRep...an.exe
windows11-21h2-x64
6MalwareRep...om.exe
windows11-21h2-x64
7MalwareRep...pe.exe
windows11-21h2-x64
MalwareRep...ya.exe
windows11-21h2-x64
libcrypto-1_1.dll
windows11-21h2-x64
3msvcr120.dll
windows11-21h2-x64
3petya_key.exe
windows11-21h2-x64
1MalwareRep...rk.exe
windows11-21h2-x64
MalwareRep...ue.exe
windows11-21h2-x64
3MalwareRep...od.exe
windows11-21h2-x64
MalwareRep...er.exe
windows11-21h2-x64
1Analysis
- max time kernel
1196s - max time network
1172s - platform
windows11-21h2_x64 - resource
win11-20240419-en - resource tags
arch:x64arch:x86image:win11-20240419-enlocale:en-usos:windows11-21h2-x64system - submitted
12/05/2024, 07:57
Static task
static1
Behavioral task
behavioral1
Sample
MalwareRepository-main/000.exe
Resource
win11-20240508-en
windows11-21h2-x64
Behavioral task
behavioral2
Sample
MalwareRepository-main/BattlePong.exe
Resource
win11-20240426-en
windows11-21h2-x64
Behavioral task
behavioral3
Sample
MalwareRepository-main/Deathy.exe
Resource
win11-20240426-en
windows11-21h2-x64
Behavioral task
behavioral4
Sample
MalwareRepository-main/InfiniteBlue.exe
Resource
win11-20240426-en
windows11-21h2-x64
Behavioral task
behavioral5
Sample
MalwareRepository-main/LogonFuck.exe
Resource
win11-20240508-en
windows11-21h2-x64
Behavioral task
behavioral6
Sample
MEMZ 4.0 Clean/MEMZ-Clean.bat
Resource
win11-20240426-en
windows11-21h2-x64
Behavioral task
behavioral7
Sample
MEMZ 4.0 Clean/MEMZ-Clean.exe
Resource
win11-20240508-en
windows11-21h2-x64
Behavioral task
behavioral8
Sample
MalwareRepository-main/MEMZTrojan.exe
Resource
win11-20240426-en
windows11-21h2-x64
Behavioral task
behavioral9
Sample
MalwareRepository-main/NRansom.exe
Resource
win11-20240419-en
windows11-21h2-x64
Behavioral task
behavioral10
Sample
MalwareRepository-main/NoEscape.exe
Resource
win11-20240508-en
windows11-21h2-x64
Behavioral task
behavioral11
Sample
MalwareRepository-main/Petya.exe
Resource
win11-20240426-en
windows11-21h2-x64
Behavioral task
behavioral12
Sample
libcrypto-1_1.dll
Resource
win11-20240508-en
windows11-21h2-x64
Behavioral task
behavioral13
Sample
msvcr120.dll
Resource
win11-20240426-en
windows11-21h2-x64
Behavioral task
behavioral14
Sample
petya_key.exe
Resource
win11-20240426-en
windows11-21h2-x64
Behavioral task
behavioral15
Sample
MalwareRepository-main/Spark.exe
Resource
win11-20240426-en
windows11-21h2-x64
Behavioral task
behavioral16
Sample
MalwareRepository-main/TrollInfiniteBlue.exe
Resource
win11-20240508-en
windows11-21h2-x64
Behavioral task
behavioral17
Sample
MalwareRepository-main/nepotonod.exe
Resource
win11-20240426-en
windows11-21h2-x64
Behavioral task
behavioral18
Sample
MalwareRepository-main/quantizer.exe
Resource
win11-20240508-en
windows11-21h2-x64
General
- Target MalwareRepository-main/NRansom.exe
- Size 1.2MB
- Sample240512-jtkd2aag78
- SHA256 c89944f9ec704c2b8da3a1acf726699022e7c68334110f72007d762217a9a4a5
- MD5 9a60890fc062d10d826c31d049706ab7
- SHA1 3ae8d97461fb08c4327431c0589322e3cbb1e3de
- SHA512 03de8351ab6ab1e46c4f1792f4caeeaaee4b8a18b407839c1697890032aa813cae9174e1a27cb582ef5286be0b47d23966a71e0b740feb6b1814137b779fcdcc
- SSDEEP 24576:DDSANUv0/NUvKLpkr2dY/aBcjJOBHOBIQBajMtWvoJiLE1+XgRKz89G/4ZSb0FuH:T80/8KLpkr2dY/aBcjJOBHOBIQBajMtA
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 1928 nRansom.exe - Loads dropped DLL 4 IoCs
pid Process 1928 nRansom.exe 1928 nRansom.exe 1928 nRansom.exe 1928 nRansom.exe - Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\B: nRansom.exe File opened (read-only) \??\H: nRansom.exe File opened (read-only) \??\J: nRansom.exe File opened (read-only) \??\Q: nRansom.exe File opened (read-only) \??\R: nRansom.exe File opened (read-only) \??\X: nRansom.exe File opened (read-only) \??\M: nRansom.exe File opened (read-only) \??\N: nRansom.exe File opened (read-only) \??\S: nRansom.exe File opened (read-only) \??\Y: nRansom.exe File opened (read-only) \??\T: nRansom.exe File opened (read-only) \??\A: nRansom.exe File opened (read-only) \??\E: nRansom.exe File opened (read-only) \??\I: nRansom.exe File opened (read-only) \??\K: nRansom.exe File opened (read-only) \??\L: nRansom.exe File opened (read-only) \??\O: nRansom.exe File opened (read-only) \??\P: nRansom.exe File opened (read-only) \??\U: nRansom.exe File opened (read-only) \??\G: nRansom.exe File opened (read-only) \??\V: nRansom.exe File opened (read-only) \??\W: nRansom.exe File opened (read-only) \??\Z: nRansom.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1474490143-3221292397-4168103503-1000\{BD9D05C0-6E2A-4BF7-B226-FEA9E0844F13} nRansom.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 1928 nRansom.exe Token: SeCreatePagefilePrivilege 1928 nRansom.exe Token: 33 4492 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 4492 AUDIODG.EXE Token: SeShutdownPrivilege 1928 nRansom.exe Token: SeCreatePagefilePrivilege 1928 nRansom.exe Token: SeShutdownPrivilege 1928 nRansom.exe Token: SeCreatePagefilePrivilege 1928 nRansom.exe Token: SeShutdownPrivilege 1928 nRansom.exe Token: SeCreatePagefilePrivilege 1928 nRansom.exe Token: SeShutdownPrivilege 1928 nRansom.exe Token: SeCreatePagefilePrivilege 1928 nRansom.exe Token: SeShutdownPrivilege 1928 nRansom.exe Token: SeCreatePagefilePrivilege 1928 nRansom.exe Token: SeShutdownPrivilege 1928 nRansom.exe Token: SeCreatePagefilePrivilege 1928 nRansom.exe Token: SeShutdownPrivilege 1928 nRansom.exe Token: SeCreatePagefilePrivilege 1928 nRansom.exe Token: SeShutdownPrivilege 1928 nRansom.exe Token: SeCreatePagefilePrivilege 1928 nRansom.exe Token: SeShutdownPrivilege 1928 nRansom.exe Token: SeCreatePagefilePrivilege 1928 nRansom.exe Token: SeShutdownPrivilege 1928 nRansom.exe Token: SeCreatePagefilePrivilege 1928 nRansom.exe Token: SeShutdownPrivilege 1928 nRansom.exe Token: SeCreatePagefilePrivilege 1928 nRansom.exe Token: SeShutdownPrivilege 1928 nRansom.exe Token: SeCreatePagefilePrivilege 1928 nRansom.exe Token: SeShutdownPrivilege 1928 nRansom.exe Token: SeCreatePagefilePrivilege 1928 nRansom.exe Token: SeShutdownPrivilege 1928 nRansom.exe Token: SeCreatePagefilePrivilege 1928 nRansom.exe Token: SeShutdownPrivilege 1928 nRansom.exe Token: SeCreatePagefilePrivilege 1928 nRansom.exe Token: SeShutdownPrivilege 1928 nRansom.exe Token: SeCreatePagefilePrivilege 1928 nRansom.exe Token: SeShutdownPrivilege 1928 nRansom.exe Token: SeCreatePagefilePrivilege 1928 nRansom.exe Token: SeShutdownPrivilege 1928 nRansom.exe Token: SeCreatePagefilePrivilege 1928 nRansom.exe Token: SeShutdownPrivilege 1928 nRansom.exe Token: SeCreatePagefilePrivilege 1928 nRansom.exe Token: SeShutdownPrivilege 1928 nRansom.exe Token: SeCreatePagefilePrivilege 1928 nRansom.exe Token: SeShutdownPrivilege 1928 nRansom.exe Token: SeCreatePagefilePrivilege 1928 nRansom.exe Token: SeShutdownPrivilege 1928 nRansom.exe Token: SeCreatePagefilePrivilege 1928 nRansom.exe Token: SeShutdownPrivilege 1928 nRansom.exe Token: SeCreatePagefilePrivilege 1928 nRansom.exe Token: SeShutdownPrivilege 1928 nRansom.exe Token: SeCreatePagefilePrivilege 1928 nRansom.exe Token: SeShutdownPrivilege 1928 nRansom.exe Token: SeCreatePagefilePrivilege 1928 nRansom.exe Token: SeShutdownPrivilege 1928 nRansom.exe Token: SeCreatePagefilePrivilege 1928 nRansom.exe Token: SeShutdownPrivilege 1928 nRansom.exe Token: SeCreatePagefilePrivilege 1928 nRansom.exe Token: SeShutdownPrivilege 1928 nRansom.exe Token: SeCreatePagefilePrivilege 1928 nRansom.exe Token: SeShutdownPrivilege 1928 nRansom.exe Token: SeCreatePagefilePrivilege 1928 nRansom.exe Token: SeShutdownPrivilege 1928 nRansom.exe Token: SeCreatePagefilePrivilege 1928 nRansom.exe - Suspicious use of WriteProcessMemory 5 IoCs
description pid Process procid_target PID 3776 wrote to memory of 4508 3776 NRansom.exe 79 PID 3776 wrote to memory of 4508 3776 NRansom.exe 79 PID 4508 wrote to memory of 1928 4508 cmd.exe 83 PID 4508 wrote to memory of 1928 4508 cmd.exe 83 PID 4508 wrote to memory of 1928 4508 cmd.exe 83
Processes
-
C:\Users\Admin\AppData\Local\Temp\MalwareRepository-main\NRansom.exe"C:\Users\Admin\AppData\Local\Temp\MalwareRepository-main\NRansom.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3776 -
C:\Windows\system32\cmd.exe"C:\Windows\sysnative\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\56CB.tmp\56CC.bat C:\Users\Admin\AppData\Local\Temp\MalwareRepository-main\NRansom.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:4508 -
C:\Users\Admin\AppData\Local\Temp\56CB.tmp\nRansom.exenRansom.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:1928
-
-
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x000000000000049C 0x00000000000004E41⤵
- Suspicious use of AdjustPrivilegeToken
PID:4492
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Microsoft\Media Player\CurrentDatabase_400.wmdb
- Size 256KB
- SHA256 33649cbc2507a370b2f2786b285f55389cad169e521f3237d4063d3972eb5ccc
- MD5 e1295e0d5ae140e77ff71bd337969e0f
- SHA1 9dd1f36deef3361ab29dc56b3c93fae3930f4b16
- SHA512 7ba3a94138aa8cc32d64e5d1e9c6c545e72b1b341bbe87815f416cfefa9093e6e53cec59805c0ec27bb252c02f143c899ff74b76c02c206975d6664a8f12cd64
- SSDEEP 768:bf0aleDxcg7KGVp3zT13VuI61HOdrrA9abhr1vfEwPRzitFrz:b69
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Windows Media\12.0\WMSDKNS.XML
- Size 9KB
- SHA256 cb87767c4a384c24e4a0f88455f59101b1ae7b4fb8de8a5adb4136c5f7ee545b
- MD5 7050d5ae8acfbe560fa11073fef8185d
- SHA1 5bc38e77ff06785fe0aec5a345c4ccd15752560e
- SHA512 a7a295ac8921bb3dde58d4bcde9372ed59def61d4b7699057274960fa8c1d1a1daff834a93f7a0698e9e5c16db43af05e9fd2d6d7c9232f7d26ffcff5fc5900b
- SSDEEP 96:/YkZRAF6zyHUhm77yB1pZYCEnfHrHH7B6xTGH+YCLV3zwULJEYCJWyHBt3zwFRh+:/2FV0bBPCfUdY
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\56CB.tmp\56CC.bat
- Size 35B
- SHA256 5f49ad7e1ca7bc4cb2c94fb89e79ac4a993a27852d150fe22e3d8b6c6172389f
- MD5 47135f10b1e0f478a8a64cae518619b6
- SHA1 bd520aa0b4937f707ea0881232fe1cf10faf2de7
- SHA512 5deed2302097e5be3f1f157480e87bcc0e61939d2215b6fc46b32fd80651a33b35e64b19e613f92964b1cc6f079aafd51af240ee9115a88693b8c344723140ff
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\56CB.tmp\AxInterop.WMPLib.dll
- Size 52KB
- SHA256 7c0d98877a3c3c5e3fdcf716d5456e11e8df60e13cf3236fc7dd2f6168e204cf
- MD5 e07847688ef6e8d206e3eb1f40308cce
- SHA1 733599e59b6af851c67059dd4dc6b079b38add1c
- SHA512 17abe78ab787587bfedd840ef5baa70cd19030fe700710bc254ecab9b8047e528e4428ba2586e0189e7a844f0628bae768586c4a7a3731feaa3d61864684bcc9
- SSDEEP 768:ETiglqcPGmH+BSITBFo+iRdbBFS1WSbfi5qlD+P2mHvaVhXUWdYcXnT:HgvH+oETfiRnFS1WSbfi5qlsaV2WG0T
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\56CB.tmp\Interop.WMPLib.dll
- Size 323KB
- SHA256 33914c07aab0e92bf85e87e2d1be739746693a60ca9961cabaf95f417d2a466f
- MD5 9cc37f967a871e437ee3640f195e1637
- SHA1 5a5855cd4a72118309d2b82276b5f2c7a683135e
- SHA512 884a88e755769b8a444fb59fdb82e384010bbf4198bfaefa047aaf194063a2d20d1376b75a0d13fdc4b6088c9eac31a0e82c4984530e9f7a9f5e4a6ce21b6a08
- SSDEEP 6144:6pkr2dY/aBcjJOBHOBIQBajMtWvoJiLE1+XgRKz89G/4ZSb0Funwh6DsN2PIpCrR:6pkr2dY/aBcjJOBHOBIQBajMtWvoJiL5
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\56CB.tmp\Tools\your-mom-gay.mp3
- Size 594KB
- SHA256 6a0a9638ab66f3a66b38779c20bd91a9d66ff770827b27d95fcfd247918c8984
- MD5 bd85b4d057816c91104df6a123c246e8
- SHA1 0935b746352105d50b6edac8bf9e8464f5a11922
- SHA512 e260b2d8f0853cab48460cf40321db3555c91397167b61ddc4296d23e7db5b63d9e817b09d1d250d8d07dfb2df9709a38cd6b6bc3e781b76ecd17da2ca76480c
- SSDEEP 12288:xLFMES29DV21Prwzuez1zJAO4/rbWKnEXXNtxrHn:FFV21Eae74/rSK6Nzn
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\56CB.tmp\nRansom.exe
- Size 189KB
- SHA256 9e4f9175ef942d0e84f7f9c64dc89505c4c8ffb20787513e02b4eaaf502f5ec4
- MD5 773776263762568ed199228579fe4a54
- SHA1 43986aaefd50cd2006a027939947e34e0633e60a
- SHA512 77956d7b18a1435dcbf837d9924d6fd9733d825811c134c3b5806813a32f127b9b1b67abb729a7dbbcce399e3e2cf099e4ce95b95e9e9fdfc106a662679bedce
- SSDEEP 3072:S1TjKehv3pS6BqK0z7v5HewAxylS+oIvw0eJ/D5TVv/cvtih1TjKehv3pS6BqK0O:SNjKet5/Uv8wwyloZJ7pBcvtMNjKet5a
- MD5 SHA1 SHA512 SSDEEP