Overview
overview
10Static
static
101acfdefd7d...c4.exe
windows7-x64
101acfdefd7d...c4.exe
windows10-2004-x64
1020de026bf4...60.exe
windows7-x64
1020de026bf4...60.exe
windows10-2004-x64
10353b1a5ced...52.exe
windows7-x64
10353b1a5ced...52.exe
windows10-2004-x64
1037a4514026...30.exe
windows7-x64
1037a4514026...30.exe
windows10-2004-x64
1060121ea2ab...3e.exe
windows7-x64
1060121ea2ab...3e.exe
windows10-2004-x64
96ac062d21f...22.exe
windows7-x64
106ac062d21f...22.exe
windows10-2004-x64
76db9f96b1c...da.exe
windows7-x64
106db9f96b1c...da.exe
windows10-2004-x64
1071f510c40f...cf.exe
windows7-x64
1071f510c40f...cf.exe
windows10-2004-x64
1074e40db78f...83.exe
windows7-x64
1074e40db78f...83.exe
windows10-2004-x64
108245c3b357...fe.exe
windows7-x64
108245c3b357...fe.exe
windows10-2004-x64
1099829d5483...fd.exe
windows7-x64
799829d5483...fd.exe
windows10-2004-x64
79d07b89cd6...7e.exe
windows7-x64
109d07b89cd6...7e.exe
windows10-2004-x64
10b8665cf00d...53.exe
windows7-x64
10b8665cf00d...53.exe
windows10-2004-x64
10ce7606cfdf...c3.exe
windows7-x64
10ce7606cfdf...c3.exe
windows10-2004-x64
10da4a56f9db...1a.exe
windows7-x64
10da4a56f9db...1a.exe
windows10-2004-x64
10f1ee32e471...c2.exe
windows7-x64
10f1ee32e471...c2.exe
windows10-2004-x64
10Analysis
-
max time kernel
121s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
16-05-2024 23:05
Behavioral task
behavioral1
Sample
1acfdefd7d823688159e6369f5f32ec4.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
1acfdefd7d823688159e6369f5f32ec4.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral3
Sample
20de026bf4998364c894a00f7a97df60.exe
Resource
win7-20240508-en
Behavioral task
behavioral4
Sample
20de026bf4998364c894a00f7a97df60.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral5
Sample
353b1a5ced1e9c3341cf45160576b852.exe
Resource
win7-20240221-en
Behavioral task
behavioral6
Sample
353b1a5ced1e9c3341cf45160576b852.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral7
Sample
37a4514026f67eeebd5a8f6786a92e30.exe
Resource
win7-20240508-en
Behavioral task
behavioral8
Sample
37a4514026f67eeebd5a8f6786a92e30.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral9
Sample
60121ea2ab380455f7e143cd9438443e.exe
Resource
win7-20231129-en
Behavioral task
behavioral10
Sample
60121ea2ab380455f7e143cd9438443e.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral11
Sample
6ac062d21f08f139d9f3d1e335e72e22.exe
Resource
win7-20240508-en
Behavioral task
behavioral12
Sample
6ac062d21f08f139d9f3d1e335e72e22.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral13
Sample
6db9f96b1c56bcb56bc88904683465da.exe
Resource
win7-20240221-en
Behavioral task
behavioral14
Sample
6db9f96b1c56bcb56bc88904683465da.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral15
Sample
71f510c40fe511bbc6296101698124cf.exe
Resource
win7-20240508-en
Behavioral task
behavioral16
Sample
71f510c40fe511bbc6296101698124cf.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral17
Sample
74e40db78ff482c904336c92e5702683.exe
Resource
win7-20240220-en
Behavioral task
behavioral18
Sample
74e40db78ff482c904336c92e5702683.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral19
Sample
8245c3b357c4dfcce7e058464c58c5fe.exe
Resource
win7-20240221-en
Behavioral task
behavioral20
Sample
8245c3b357c4dfcce7e058464c58c5fe.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral21
Sample
99829d5483ef57c05af928322bd5d6fd.exe
Resource
win7-20231129-en
Behavioral task
behavioral22
Sample
99829d5483ef57c05af928322bd5d6fd.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral23
Sample
9d07b89cd606bf2379ecc25fd4a4667e.exe
Resource
win7-20240215-en
Behavioral task
behavioral24
Sample
9d07b89cd606bf2379ecc25fd4a4667e.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral25
Sample
b8665cf00d32352ee83ceb189595a753.exe
Resource
win7-20240221-en
Behavioral task
behavioral26
Sample
b8665cf00d32352ee83ceb189595a753.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral27
Sample
ce7606cfdfc05f9d4b336df2c78a46c3.exe
Resource
win7-20240221-en
Behavioral task
behavioral28
Sample
ce7606cfdfc05f9d4b336df2c78a46c3.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral29
Sample
da4a56f9db3ccef32e88ad2e5c616a1a.exe
Resource
win7-20240221-en
Behavioral task
behavioral30
Sample
da4a56f9db3ccef32e88ad2e5c616a1a.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral31
Sample
f1ee32e471a4581b7274c00459397cc2.exe
Resource
win7-20240508-en
Behavioral task
behavioral32
Sample
f1ee32e471a4581b7274c00459397cc2.exe
Resource
win10v2004-20240508-en
General
-
Target
6ac062d21f08f139d9f3d1e335e72e22.exe
-
Size
98KB
-
MD5
6ac062d21f08f139d9f3d1e335e72e22
-
SHA1
9e967a759e894a83c4b693e81c031d7214a8e699
-
SHA256
564154a2e3647318ca40a5ffa68d06b1bd40b606cae1d15985e3d15097b512cd
-
SHA512
0a02068f6e22a41f4037d01882e32fc7bacf515818cf4f721960b987393da6b1d32ff4aa1b5fa73d546908cb85ded211061b37f4731ed643b8182909008a6892
-
SSDEEP
1536:0bPX/gJxDFgu02gM+LXbtQ5IxWwbglROAnbFmYVKCKclF:0cxz1gxXSNwbYcYVKhYF
Malware Config
Extracted
C:\PerfLogs\# How to Decrypt Files-P2IW9.html
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
krakentemp0000.exepid process 2364 krakentemp0000.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
6ac062d21f08f139d9f3d1e335e72e22.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Run\Payload = "C:\\Users\\Admin\\AppData\\Local\\Temp\\krakentemp0000.exe" 6ac062d21f08f139d9f3d1e335e72e22.exe -
Looks up external IP address via web service 7 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 6 ipinfo.io 7 ipinfo.io 8 ipinfo.io 2 ipinfo.io 3 ipinfo.io 4 ipinfo.io 5 ipinfo.io -
Drops file in Program Files directory 2 IoCs
Processes:
krakentemp0000.exedescription ioc process File created C:\Program Files\Touch krakentemp0000.exe File created C:\Program Files (x86)\Touch krakentemp0000.exe -
Drops file in Windows directory 1 IoCs
Processes:
krakentemp0000.exedescription ioc process File created C:\Windows\Touch krakentemp0000.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Enumerates processes with tasklist 1 TTPs 1 IoCs
-
Modifies registry class 5 IoCs
Processes:
6ac062d21f08f139d9f3d1e335e72e22.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000_CLASSES\mscfile\shell\open\command 6ac062d21f08f139d9f3d1e335e72e22.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000_CLASSES\mscfile 6ac062d21f08f139d9f3d1e335e72e22.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000_CLASSES\mscfile\shell 6ac062d21f08f139d9f3d1e335e72e22.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000_CLASSES\mscfile\shell\open 6ac062d21f08f139d9f3d1e335e72e22.exe Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000_CLASSES\mscfile\shell\open\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\krakentemp0000.exe" 6ac062d21f08f139d9f3d1e335e72e22.exe -
Runs ping.exe 1 TTPs 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 14 IoCs
Processes:
krakentemp0000.exetasklist.exepid process 2364 krakentemp0000.exe 2364 krakentemp0000.exe 2364 krakentemp0000.exe 2364 krakentemp0000.exe 2364 krakentemp0000.exe 2364 krakentemp0000.exe 2364 krakentemp0000.exe 2364 krakentemp0000.exe 2364 krakentemp0000.exe 2364 krakentemp0000.exe 2364 krakentemp0000.exe 2732 tasklist.exe 2732 tasklist.exe 2364 krakentemp0000.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
krakentemp0000.exetasklist.exedescription pid process Token: SeDebugPrivilege 2364 krakentemp0000.exe Token: SeIncBasePriorityPrivilege 2364 krakentemp0000.exe Token: SeDebugPrivilege 2732 tasklist.exe -
Suspicious use of WriteProcessMemory 19 IoCs
Processes:
6ac062d21f08f139d9f3d1e335e72e22.exeeventvwr.exekrakentemp0000.execmd.exedescription pid process target process PID 308 wrote to memory of 1788 308 6ac062d21f08f139d9f3d1e335e72e22.exe eventvwr.exe PID 308 wrote to memory of 1788 308 6ac062d21f08f139d9f3d1e335e72e22.exe eventvwr.exe PID 308 wrote to memory of 1788 308 6ac062d21f08f139d9f3d1e335e72e22.exe eventvwr.exe PID 1788 wrote to memory of 2364 1788 eventvwr.exe krakentemp0000.exe PID 1788 wrote to memory of 2364 1788 eventvwr.exe krakentemp0000.exe PID 1788 wrote to memory of 2364 1788 eventvwr.exe krakentemp0000.exe PID 1788 wrote to memory of 2364 1788 eventvwr.exe krakentemp0000.exe PID 2364 wrote to memory of 2732 2364 krakentemp0000.exe tasklist.exe PID 2364 wrote to memory of 2732 2364 krakentemp0000.exe tasklist.exe PID 2364 wrote to memory of 2732 2364 krakentemp0000.exe tasklist.exe PID 2364 wrote to memory of 2732 2364 krakentemp0000.exe tasklist.exe PID 2364 wrote to memory of 2760 2364 krakentemp0000.exe cmd.exe PID 2364 wrote to memory of 2760 2364 krakentemp0000.exe cmd.exe PID 2364 wrote to memory of 2760 2364 krakentemp0000.exe cmd.exe PID 2364 wrote to memory of 2760 2364 krakentemp0000.exe cmd.exe PID 2760 wrote to memory of 2568 2760 cmd.exe PING.EXE PID 2760 wrote to memory of 2568 2760 cmd.exe PING.EXE PID 2760 wrote to memory of 2568 2760 cmd.exe PING.EXE PID 2760 wrote to memory of 2568 2760 cmd.exe PING.EXE
Processes
-
C:\Users\Admin\AppData\Local\Temp\6ac062d21f08f139d9f3d1e335e72e22.exe"C:\Users\Admin\AppData\Local\Temp\6ac062d21f08f139d9f3d1e335e72e22.exe"1⤵
- Adds Run key to start application
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\eventvwr.exe"C:\Windows\System32\eventvwr.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\krakentemp0000.exe"C:\Users\Admin\AppData\Local\Temp\krakentemp0000.exe"3⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\tasklist.exe"tasklist" /V /FO CSV4⤵
- Enumerates processes with tasklist
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C ping 127.0.0.1 -n 3 > NUL&&del /Q /F /S "C:\Users\Admin\AppData\Local\Temp\krakentemp0000.exe"4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\PING.EXEping 127.0.0.1 -n 35⤵
- Runs ping.exe
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\PerfLogs\# How to Decrypt Files-P2IW9.htmlFilesize
9KB
MD5b7f55bc2e784a650ff1972593f79a26c
SHA18528a815a4aef7799500b319a2b86dce8adc7108
SHA256a8684972fafa1985deef3a26871863cf1fbdbafb7b480c39b8cf939e03f43d7f
SHA512b83fdddfb26ca5ca9bfed89af85fc406938b72c360fff419f1dc9515edf12dc56ac69f26c9280ddbc1bf0e463ee179fabd56c2a65f4eda2059447c66accfc92f
-
C:\Users\Admin\AppData\Local\Temp\krakentemp0000.exeFilesize
91KB
MD5b8665cf00d32352ee83ceb189595a753
SHA1669605b2968e3eca80c9366f973dc589057227e5
SHA2567e0ee0e707db426eaf25bd0924631db969bb03dd9b13addffbcc33311a3b9aa7
SHA512de6ec58e018a8db2538c0e5ae3942ea3ec370a9724e2f734e5c3898d8867213f25116a7793309e87c04548d1180aeb7d57bda37c0d60c4f3d2fa390e509f1a28
-
memory/308-0-0x000007FEF5E0E000-0x000007FEF5E0F000-memory.dmpFilesize
4KB
-
memory/308-2-0x000007FEF5B50000-0x000007FEF64ED000-memory.dmpFilesize
9.6MB
-
memory/308-5-0x000007FEF5B50000-0x000007FEF64ED000-memory.dmpFilesize
9.6MB
-
memory/2364-6-0x0000000000A90000-0x0000000000AD0000-memory.dmpFilesize
256KB
-
memory/2364-358-0x0000000000A90000-0x0000000000AD0000-memory.dmpFilesize
256KB