Analysis
-
max time kernel
149s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
-
submitted
31-05-2024 06:29
General
-
Target
43a500e327fa47db6e1ee241b553c46bea58f6ba143d38af8b006051e8952792.exe
-
Size
350KB
-
MD5
2ca90a883f3db6d96bc5722be2fb8bc2
-
SHA1
0e8c787283fa2c046f388ef0c5fa215541a97043
-
SHA256
43a500e327fa47db6e1ee241b553c46bea58f6ba143d38af8b006051e8952792
-
SHA512
c87f815182108f62fffd502d590284ae3f0f4c6dabc823271da87dbe5f54c843eb65cc690314e0ac10188b3e43c258ace549567fe7380b4d217c2befbcde3c74
-
SSDEEP
6144:9yAIPCuAZOXWUVg1XN5MC81xSNmG+f0bwu/WekQTp4Aum1:9MPCuAZOXRu1zMd1xaH+f0bn/Wexp4AJ
Malware Config
Extracted
C:\iHpE7aGA3.README.txt
https://github.com/uTox/uTox/releases/download/v0.18.1/utox_x86_64.exe
Signatures
-
Renames multiple (607) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops desktop.ini file(s) 2 IoCs
-
Drops file in System32 directory 4 IoCs
-
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Enumerates system info in registry 2 TTPs 3 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: RenamesItself 26 IoCs
-
Suspicious use of AdjustPrivilegeToken 64 IoCs
-
Suspicious use of SetWindowsHookEx 13 IoCs
-
Suspicious use of WriteProcessMemory 11 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\43a500e327fa47db6e1ee241b553c46bea58f6ba143d38af8b006051e8952792.exe"C:\Users\Admin\AppData\Local\Temp\43a500e327fa47db6e1ee241b553c46bea58f6ba143d38af8b006051e8952792.exe"1⤵
- Drops desktop.ini file(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\splwow64.exeC:\Windows\splwow64.exe 122882⤵
- Drops file in System32 directory
-
-
C:\ProgramData\84A2.tmp"C:\ProgramData\84A2.tmp"2⤵
- Checks computer location settings
- Deletes itself
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C DEL /F /Q C:\PROGRA~3\84A2.tmp >> NUL3⤵
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc1⤵
-
C:\Windows\system32\printfilterpipelinesvc.exeC:\Windows\system32\printfilterpipelinesvc.exe -Embedding1⤵
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE/insertdoc "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\{B8D3AF8B-3556-442B-ABAB-FD51FFBECF7D}.xps" 1336161059142900002⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
129B
MD51fe7fc89e4083af7ca2e1949cabca59a
SHA1f4347c240b7c9653af409817068664803ead284e
SHA2563e123cd9ae5af509f6edaa952910d27f3c5fb216be652c7e9b95a4ad8c03ae3c
SHA51297bdd4d94c081c35ca6e4c702c182595e64f0e305023c3d3015077f1b2c18595e4a4ddb8c1af4f9990f84b52765bf250c9c77d33f7835853556eee8f25faca0a
-
Filesize
14KB
MD5294e9f64cb1642dd89229fff0592856b
SHA197b148c27f3da29ba7b18d6aee8a0db9102f47c9
SHA256917e115cc403e29b4388e0d175cbfac3e7e40ca1742299fbdb353847db2de7c2
SHA512b87d531890bf1577b9b4af41dddb2cdbbfa164cf197bd5987df3a3075983645a3acba443e289b7bfd338422978a104f55298fbfe346872de0895bde44adc89cf
-
Filesize
350KB
MD5ec79c29385d9c733a90fbbc72f7bb247
SHA1d76195ed8f0679a4ecace016aa1da9a78e67385d
SHA2566cea23ff8990bc7f9f11761f5ba882aae7c90b57137ed385a792f5640fdc9dd3
SHA5123b52eb5d3e2e8fb99d40df02b73780299f4c9436c61cb2a0b6b7d2548853dc6fb3a83eb294da362d345ee10b832ce65f4385a49ad00be40211703258902425f6
-
Filesize
4KB
MD5a435579905464ada6cff77d08ba44e90
SHA1786f7d610d7be3dc763fb12faa575457703be65f
SHA256bb442972658b47f0cbc3bda644547259935aa03ec3fd4c6cf88c2a51e0b7cc79
SHA5125b8d3504e1ffd2880b5453469d06cddf55141926d2248a170d5222bda46316b7e9d036c4985d3c4ee518d3fa4a361f55bbde51f9a03aa40c70f07eeefecf4696
-
Filesize
4KB
MD56ee79e8329fe4cc7ea8c67cbaaa2c33d
SHA14205d20731de8d118ae26941ab90364ba9c24635
SHA2564b2df6ceceae93746fda05a8a2f77d9ea4a4095d7373aa4d649bef8fe9c75621
SHA512789db1145baa5143324bc6394e85ab315bd38ed547220e3d08c9d90304d3ba56a6718a05ddc46b6bbef794ca6ce1911d2625f1a53b5983c671cf02d23766fb46
-
Filesize
1KB
MD5481f6946b253bb263007b53a2010c7a4
SHA1fd65cc5ebca40e832d31601e4304e0e1e2f5ea89
SHA25634b4b51dc57d0cd622e0c06811701b615d01a85f8c3bc41f13ce9304b99398f7
SHA512a6e1f48429fb3649180ae94a3f826684b16d1db9dfc699048185182049fc7058e517e3583474b1124bfa4425057633967ec07213fb02af9481a5cf8a0ba1aa98
-
Filesize
129B
MD5be7165174ae0767fb8f117dbc8b22b0b
SHA12ff6f52e1b9d770f9be751d3d556aed59e736540
SHA2565286cb876ef38f30c48dbe9575b85684aa91231f6f06b782aa4ac60477945d38
SHA5122060dd2448605a10be00b0079e48e682da21d03e25ca5fd8a72f8498aa7785454d3bb049106074395a2682be615894b34414313fe981b671c6fd334c0614c6cd
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
96KB
-
Filesize
264KB
-
Filesize
264KB
-
Filesize
240KB
-
Filesize
264KB
-
Filesize
264KB
-
Filesize
240KB
-
Filesize
264KB
-
Filesize
264KB
-
Filesize
264KB
-
Filesize
264KB
-
Filesize
264KB
-
Filesize
4KB
-
Filesize
264KB