e15032dd5c14a1149274faf83ed306ab82fa0d90aa507c982025d4e2d32098c3

General

Target

Venom Software v6/VenomV6.exe
Size

146KB
MD5

3d49478072bf18339ef810c8ea7546b2
SHA1

c1047d72d4cdce21af4bb989ad1bee437edb7f80
SHA256

e3300e30997c5a355f02ca6972711b2ca843d00a393b62c75818a43c27ff128d
SHA512

f47f6a1c51b92cc34a1dc264bc2b151690f1c314c5f97b08530e9efd6929c860985f9410f411cb31e0f3acd75b8969e4791ca9fb080901f6f4cb70322255a91c
SSDEEP

3072:A6glyuxE4GsUPnliByocWepU0DxwbL2LUnPaZw:A6gDBGpvEByocWeTDxOL2LScw

Score

10^/10

ransomware spyware stealer

Malware Config

Extracted

Path

C:\3R9qG8i3Z.README.txt

Ransom Note

~~~ PC Locker 3.0 by Mr.Robot~~~ >>>> Your data are stolen and encrypted To get your files back you will have to pay a one-time fee of $45 in bitcoin or monero. >>>> You need contact us and decrypt one file for free on these platforms with your personal DECRYPTION ID Contact the following account on telegram @mr_robot_unlock or paste this link in your browser https://t.me/mr_robot_unlock >>>> Your personal DECRYPTION ID: 4B75BFA39AA770FC33405A166AE44C89 >>>> Warning! Do not DELETE or MODIFY any files, it can lead to recovery problems! >>>> Warning! If you do not pay the ransom you will not receive you files NO EXCEPTIONS! >>>> Warning! Any attempt to negotiate or you don't want to pay is INSTANT BLOCK! >>>> Advertisement Would you like to earn thousands of dollars $$$ ? We sell mentorship for stealers, DDOS and ransomware. We only work with professionals and people with money DO NOT WASTE OUR TIME.

URLs

https://t.me/mr_robot_unlock

Signatures

Renames multiple (678) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.

Query Registry
T1012

System Information Discovery
T1082

Processes:

1C6D.tmp

description ioc process

Key value queried \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\International\Geo\Nation 1C6D.tmp
Deletes itself 1 IoCs

Processes:

1C6D.tmp

pid process

5344 1C6D.tmp
Executes dropped EXE 1 IoCs

Processes:

1C6D.tmp

pid process

5344 1C6D.tmp
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\International\Geo\Nation	1C6D.tmp

Drops desktop.ini file(s) 2 IoCs

Processes:

VenomV6.exe

description	ioc	process
File opened for modification	C:\$Recycle.Bin\S-1-5-21-1181767204-2009306918-3718769404-1000\desktop.ini	VenomV6.exe
File opened for modification	F:\$RECYCLE.BIN\S-1-5-21-1181767204-2009306918-3718769404-1000\desktop.ini	VenomV6.exe

Drops file in System32 directory 4 IoCs

Processes:

splwow64.exeprintfilterpipelinesvc.exe

description	ioc	process
File created	C:\Windows\system32\spool\PRINTERS\00002.SPL	splwow64.exe
File created	C:\Windows\system32\spool\PRINTERS\PPiy47880j47i4_f85wmlyydi2b.TMP	printfilterpipelinesvc.exe
File created	C:\Windows\system32\spool\PRINTERS\PPcx0w_qzj5n606i4gnxip37qec.TMP	printfilterpipelinesvc.exe
File created	C:\Windows\system32\spool\PRINTERS\PP2pr8_xk7_mwjnaierkjr3sylc.TMP	printfilterpipelinesvc.exe

Sets desktop wallpaper using registry 2 TTPs 2 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

Processes:

VenomV6.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\Desktop\WallPaper = "C:\\ProgramData\\3R9qG8i3Z.bmp"	VenomV6.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\Desktop\Wallpaper = "C:\\ProgramData\\3R9qG8i3Z.bmp"	VenomV6.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 5 IoCs

Processes:

VenomV6.exe1C6D.tmp

pid process

4464 VenomV6.exe
4464 VenomV6.exe
4464 VenomV6.exe
4464 VenomV6.exe
5344 1C6D.tmp
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

ONENOTE.EXE

description	ioc	process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	ONENOTE.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ONENOTE.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	ONENOTE.EXE

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

ONENOTE.EXE

description	ioc	process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	ONENOTE.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	ONENOTE.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	ONENOTE.EXE

Modifies Control Panel 2 IoCs

evasion

Processes:

VenomV6.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\Desktop\WallpaperStyle = "10"	VenomV6.exe
Key created	\REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\Desktop	VenomV6.exe

Modifies registry class 5 IoCs

Processes:

VenomV6.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.3R9qG8i3Z	VenomV6.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.3R9qG8i3Z\ = "3R9qG8i3Z"	VenomV6.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\3R9qG8i3Z\DefaultIcon	VenomV6.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\3R9qG8i3Z	VenomV6.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\3R9qG8i3Z\DefaultIcon\ = "C:\\ProgramData\\3R9qG8i3Z.ico"	VenomV6.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

VenomV6.exe

pid	process
4464	VenomV6.exe
4464	VenomV6.exe
4464	VenomV6.exe
4464	VenomV6.exe
4464	VenomV6.exe
4464	VenomV6.exe
4464	VenomV6.exe
4464	VenomV6.exe
4464	VenomV6.exe
4464	VenomV6.exe
4464	VenomV6.exe
4464	VenomV6.exe
4464	VenomV6.exe
4464	VenomV6.exe
4464	VenomV6.exe
4464	VenomV6.exe
4464	VenomV6.exe
4464	VenomV6.exe
4464	VenomV6.exe
4464	VenomV6.exe
4464	VenomV6.exe
4464	VenomV6.exe
4464	VenomV6.exe
4464	VenomV6.exe
4464	VenomV6.exe
4464	VenomV6.exe
4464	VenomV6.exe
4464	VenomV6.exe
4464	VenomV6.exe
4464	VenomV6.exe
4464	VenomV6.exe
4464	VenomV6.exe
4464	VenomV6.exe
4464	VenomV6.exe
4464	VenomV6.exe
4464	VenomV6.exe
4464	VenomV6.exe
4464	VenomV6.exe
4464	VenomV6.exe
4464	VenomV6.exe
4464	VenomV6.exe
4464	VenomV6.exe
4464	VenomV6.exe
4464	VenomV6.exe
4464	VenomV6.exe
4464	VenomV6.exe
4464	VenomV6.exe
4464	VenomV6.exe
4464	VenomV6.exe
4464	VenomV6.exe
4464	VenomV6.exe
4464	VenomV6.exe
4464	VenomV6.exe
4464	VenomV6.exe
4464	VenomV6.exe
4464	VenomV6.exe
4464	VenomV6.exe
4464	VenomV6.exe
4464	VenomV6.exe
4464	VenomV6.exe
4464	VenomV6.exe
4464	VenomV6.exe
4464	VenomV6.exe
4464	VenomV6.exe

Suspicious behavior: RenamesItself 26 IoCs

Processes:

1C6D.tmp

pid	process
5344	1C6D.tmp
5344	1C6D.tmp
5344	1C6D.tmp
5344	1C6D.tmp
5344	1C6D.tmp
5344	1C6D.tmp
5344	1C6D.tmp
5344	1C6D.tmp
5344	1C6D.tmp
5344	1C6D.tmp
5344	1C6D.tmp
5344	1C6D.tmp
5344	1C6D.tmp
5344	1C6D.tmp
5344	1C6D.tmp
5344	1C6D.tmp
5344	1C6D.tmp
5344	1C6D.tmp
5344	1C6D.tmp
5344	1C6D.tmp
5344	1C6D.tmp
5344	1C6D.tmp
5344	1C6D.tmp
5344	1C6D.tmp
5344	1C6D.tmp
5344	1C6D.tmp

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

VenomV6.exe

description	pid	process
Token: SeAssignPrimaryTokenPrivilege	4464	VenomV6.exe
Token: SeBackupPrivilege	4464	VenomV6.exe
Token: SeDebugPrivilege	4464	VenomV6.exe
Token: 36	4464	VenomV6.exe
Token: SeImpersonatePrivilege	4464	VenomV6.exe
Token: SeIncBasePriorityPrivilege	4464	VenomV6.exe
Token: SeIncreaseQuotaPrivilege	4464	VenomV6.exe
Token: 33	4464	VenomV6.exe
Token: SeManageVolumePrivilege	4464	VenomV6.exe
Token: SeProfSingleProcessPrivilege	4464	VenomV6.exe
Token: SeRestorePrivilege	4464	VenomV6.exe
Token: SeSecurityPrivilege	4464	VenomV6.exe
Token: SeSystemProfilePrivilege	4464	VenomV6.exe
Token: SeTakeOwnershipPrivilege	4464	VenomV6.exe
Token: SeShutdownPrivilege	4464	VenomV6.exe
Token: SeDebugPrivilege	4464	VenomV6.exe
Token: SeBackupPrivilege	4464	VenomV6.exe
Token: SeBackupPrivilege	4464	VenomV6.exe
Token: SeSecurityPrivilege	4464	VenomV6.exe
Token: SeSecurityPrivilege	4464	VenomV6.exe
Token: SeBackupPrivilege	4464	VenomV6.exe
Token: SeBackupPrivilege	4464	VenomV6.exe
Token: SeSecurityPrivilege	4464	VenomV6.exe
Token: SeSecurityPrivilege	4464	VenomV6.exe
Token: SeBackupPrivilege	4464	VenomV6.exe
Token: SeBackupPrivilege	4464	VenomV6.exe
Token: SeSecurityPrivilege	4464	VenomV6.exe
Token: SeSecurityPrivilege	4464	VenomV6.exe
Token: SeBackupPrivilege	4464	VenomV6.exe
Token: SeBackupPrivilege	4464	VenomV6.exe
Token: SeSecurityPrivilege	4464	VenomV6.exe
Token: SeSecurityPrivilege	4464	VenomV6.exe
Token: SeBackupPrivilege	4464	VenomV6.exe
Token: SeBackupPrivilege	4464	VenomV6.exe
Token: SeSecurityPrivilege	4464	VenomV6.exe
Token: SeSecurityPrivilege	4464	VenomV6.exe
Token: SeBackupPrivilege	4464	VenomV6.exe
Token: SeBackupPrivilege	4464	VenomV6.exe
Token: SeSecurityPrivilege	4464	VenomV6.exe
Token: SeSecurityPrivilege	4464	VenomV6.exe
Token: SeBackupPrivilege	4464	VenomV6.exe
Token: SeBackupPrivilege	4464	VenomV6.exe
Token: SeSecurityPrivilege	4464	VenomV6.exe
Token: SeSecurityPrivilege	4464	VenomV6.exe
Token: SeBackupPrivilege	4464	VenomV6.exe
Token: SeBackupPrivilege	4464	VenomV6.exe
Token: SeSecurityPrivilege	4464	VenomV6.exe
Token: SeSecurityPrivilege	4464	VenomV6.exe
Token: SeBackupPrivilege	4464	VenomV6.exe
Token: SeBackupPrivilege	4464	VenomV6.exe
Token: SeSecurityPrivilege	4464	VenomV6.exe
Token: SeSecurityPrivilege	4464	VenomV6.exe
Token: SeBackupPrivilege	4464	VenomV6.exe
Token: SeBackupPrivilege	4464	VenomV6.exe
Token: SeSecurityPrivilege	4464	VenomV6.exe
Token: SeSecurityPrivilege	4464	VenomV6.exe
Token: SeBackupPrivilege	4464	VenomV6.exe
Token: SeBackupPrivilege	4464	VenomV6.exe
Token: SeSecurityPrivilege	4464	VenomV6.exe
Token: SeSecurityPrivilege	4464	VenomV6.exe
Token: SeBackupPrivilege	4464	VenomV6.exe
Token: SeBackupPrivilege	4464	VenomV6.exe
Token: SeSecurityPrivilege	4464	VenomV6.exe
Token: SeSecurityPrivilege	4464	VenomV6.exe

Suspicious use of SetWindowsHookEx 13 IoCs

Processes:

ONENOTE.EXE

pid	process
5324	ONENOTE.EXE
5324	ONENOTE.EXE
5324	ONENOTE.EXE
5324	ONENOTE.EXE
5324	ONENOTE.EXE
5324	ONENOTE.EXE
5324	ONENOTE.EXE
5324	ONENOTE.EXE
5324	ONENOTE.EXE
5324	ONENOTE.EXE
5324	ONENOTE.EXE
5324	ONENOTE.EXE
5324	ONENOTE.EXE

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

VenomV6.exeprintfilterpipelinesvc.exe1C6D.tmp

description	pid	process	target process
PID 4464 wrote to memory of 3928	4464	VenomV6.exe	splwow64.exe
PID 4464 wrote to memory of 3928	4464	VenomV6.exe	splwow64.exe
PID 1952 wrote to memory of 5324	1952	printfilterpipelinesvc.exe	ONENOTE.EXE
PID 1952 wrote to memory of 5324	1952	printfilterpipelinesvc.exe	ONENOTE.EXE
PID 4464 wrote to memory of 5344	4464	VenomV6.exe	1C6D.tmp
PID 4464 wrote to memory of 5344	4464	VenomV6.exe	1C6D.tmp
PID 4464 wrote to memory of 5344	4464	VenomV6.exe	1C6D.tmp
PID 4464 wrote to memory of 5344	4464	VenomV6.exe	1C6D.tmp
PID 5344 wrote to memory of 5628	5344	1C6D.tmp	cmd.exe
PID 5344 wrote to memory of 5628	5344	1C6D.tmp	cmd.exe
PID 5344 wrote to memory of 5628	5344	1C6D.tmp	cmd.exe

C:\Users\Admin\AppData\Local\Temp\Venom Software v6\VenomV6.exe
"C:\Users\Admin\AppData\Local\Temp\Venom Software v6\VenomV6.exe"
1⤵
- Drops desktop.ini file(s)
- Sets desktop wallpaper using registry
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Modifies Control Panel
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4464

C:\Windows\splwow64.exe
C:\Windows\splwow64.exe 12288
2⤵
- Drops file in System32 directory
PID:3928

C:\ProgramData\1C6D.tmp
"C:\ProgramData\1C6D.tmp"
2⤵
- Checks computer location settings
- Deletes itself
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:5344

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /C DEL /F /Q C:\PROGRA~3\1C6D.tmp >> NUL
3⤵
PID:5628

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=1316,i,17096020621006928097,15544233752327415349,262144 --variations-seed-version --mojo-platform-channel-handle=4584 /prefetch:8
1⤵
PID:3684

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc
1⤵
PID:2348

C:\Windows\system32\printfilterpipelinesvc.exe
C:\Windows\system32\printfilterpipelinesvc.exe -Embedding
1⤵
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:1952

C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE
/insertdoc "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\{F781503D-B814-46C3-A07E-20A946DE51E7}.xps" 133609593186780000
2⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious use of SetWindowsHookEx
PID:5324

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

Query Registry

3

T1012

System Information Discovery

4

T1082

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Defacement

1

T1491

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-1181767204-2009306918-3718769404-1000\OOOOOOOOOOO
Filesize
129B

MD5
e18df9ced25941e3395d99678444a238

SHA1
293e2fa151ab87caf60bbff6a0220465690f4f7f

SHA256
814afbb3834b44776227ff71be407fa649c1d6bc6debaceacabd910fc2435f92

SHA512
8f6351f5910aca3b0316c11c58d8b2fe51de535015e8225d8d124ecf6d170e179f2ad3ce7e6d64912be1fa2d64339d34dda63455a7aa7087cc22b38e24cca5c4

Download Submit
C:\3R9qG8i3Z.README.txt
Filesize
953B

MD5
bfc6ad98aabe7c0c49fe2492ba28a592

SHA1
fb56fa6ce2461a292970639df8e0924cd90b3697

SHA256
c95148156b572c3fd2dc4f6f5e85cd89a66417206e00fdb1c2cf5f4d2c467f1c

SHA512
1c8619e6d5e0ce69d5f1985a4b766078e4bb295f9326db99200eb4bd810489dabcc44323a140047b026eefa8304be38272478ce787dd93a8817cb40f49ac4bc5

Download Submit
C:\ProgramData\1C6D.tmp
Filesize
14KB

MD5
294e9f64cb1642dd89229fff0592856b

SHA1
97b148c27f3da29ba7b18d6aee8a0db9102f47c9

SHA256
917e115cc403e29b4388e0d175cbfac3e7e40ca1742299fbdb353847db2de7c2

SHA512
b87d531890bf1577b9b4af41dddb2cdbbfa164cf197bd5987df3a3075983645a3acba443e289b7bfd338422978a104f55298fbfe346872de0895bde44adc89cf

Download Submit
C:\Users\Admin\AppData\Local\Temp\Venom Software v6\EEEEEEEEEEE
Filesize
146KB

MD5
5146df482a551ee82ccb834cc000b906

SHA1
2dedc0447dbef3e4743b1f8a3e9477588c7d600d

SHA256
6babe841c0c194f6de3ba0441cecb602295f60c2749bc877706e8d7741b5231c

SHA512
7769515adb7913ce90893adb34ac05c30e5d07a29626bc886de212f6183e491577a7bde4c16e7e9cda0da6f280fabfeae34d1c25adffc204e33f5463a781aed0

Download Submit
C:\Users\Admin\AppData\Local\Temp\{3F609244-EAE4-40FF-A1C9-D43B392E3BAD}
Filesize
4KB

MD5
391b2a74a713572a245cd7d7dc3e4192

SHA1
9bce2de54200f68847c22e6b04853bfa0d3a913f

SHA256
af987221bf1681c229f943858534c8cd9cffd9ab74d9da0a2487f81ffb4a5b44

SHA512
0b054c65e951a1b1c691767ab044e352f6af236f69f93325bca08061769b9b8a90ba24d7fbcaf6978f77425f3e1b349ca0c0f988f1de218fe4055845d4b77b0b

Download Submit
F:\$RECYCLE.BIN\S-1-5-21-1181767204-2009306918-3718769404-1000\DDDDDDDDDDD
Filesize
129B

MD5
e1dc19ec1cb54136f3d03d180eaa09c3

SHA1
84ea7b3c616c2edcfa51ca21bdf883b1e7d689ea

SHA256
bffe5d4568ce7c9ce6d0adbf8f3d9ee2fb1faed2cd9798e09173f6727f21c042

SHA512
0ff68e836cf3e63efeb288f88ade0175ec773143d2d53dde50dc54664925c8d7b1314fa06570eefe43acb4e5940fe58b96f15457d0e8789dd4a05deea8a110c5

Download Submit
memory/4464-2-0x00000000014E0000-0x00000000014F0000-memory.dmp

Filesize
64KB

Download
memory/4464-0-0x00000000014E0000-0x00000000014F0000-memory.dmp

Filesize
64KB

Download
memory/4464-1-0x00000000014E0000-0x00000000014F0000-memory.dmp

Filesize
64KB

Download
memory/5324-3098-0x00007FFC9AB10000-0x00007FFC9AB20000-memory.dmp

Filesize
64KB

Download
memory/5324-3109-0x00007FFC9AB10000-0x00007FFC9AB20000-memory.dmp

Filesize
64KB

Download
memory/5324-3100-0x00007FFC9AB10000-0x00007FFC9AB20000-memory.dmp

Filesize
64KB

Download
memory/5324-3110-0x00007FFC9AB10000-0x00007FFC9AB20000-memory.dmp

Filesize
64KB

Download
memory/5324-3099-0x00007FFC9AB10000-0x00007FFC9AB20000-memory.dmp

Filesize
64KB

Download
memory/5324-3139-0x00007FFC981B0000-0x00007FFC981C0000-memory.dmp

Filesize
64KB

Download
memory/5324-3140-0x00007FFC981B0000-0x00007FFC981C0000-memory.dmp

Filesize
64KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads