Analysis
-
max time kernel
121s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240419-en -
resource tags
-
submitted
31/05/2024, 11:35
General
-
Target
9df8195bcf7875fbe9c606b0c55dd237edc3160078ac927c94995378d59b3409.exe
-
Size
348KB
-
MD5
67233b799136b9b170c9506b8e82cb81
-
SHA1
8c4b5d442530f1cd31355f3a782e88e65e024007
-
SHA256
9df8195bcf7875fbe9c606b0c55dd237edc3160078ac927c94995378d59b3409
-
SHA512
977ba52c0d3dd07cc4ca99c85f7907f3cff4c5f6253947107a56a213e47307b6b8f02e589fa96288a76f217b028df889f74770981233dba732dcd0cea236b8ab
-
SSDEEP
6144:pLFkCMg+SX2RIcFMzbNSYMor7uhyFQIChwTd4E4rKgKYfHF2yqLtgnWaIFSNfseC:RFJURIIibNQorqhyKo4BJ/0yqLtaEk0x
Malware Config
Signatures
-
Renames multiple (307) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops desktop.ini file(s) 2 IoCs
-
Suspicious use of NtSetInformationThreadHideFromDebugger 4 IoCs
-
Suspicious behavior: EnumeratesProcesses 12 IoCs
-
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\9df8195bcf7875fbe9c606b0c55dd237edc3160078ac927c94995378d59b3409.exe"C:\Users\Admin\AppData\Local\Temp\9df8195bcf7875fbe9c606b0c55dd237edc3160078ac927c94995378d59b3409.exe"1⤵
- Drops desktop.ini file(s)
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x1481⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
129B
MD58eed04ecf8edd3be8d934129f5189fb3
SHA1c29a56036c23eb8d718a9ad6308d5aafae66920a
SHA25614d573723910bee4cbda1fcce62f410f9457ca9f5d6d2044959594ee6b960f74
SHA512ff9b92b2d69a7e52dfd49254c3601e99d33693b5fd90cb7fcd0b7b584500beb682e812a3a5eb1f8d6779bfc0eae20498aa07baca6780fa4e1df85e06dec27901
-
Filesize
122B
MD51cd2c508680a93907346e98d6a1677e6
SHA142ab98d499046fe5477610f5c256aff0b0f5be5e
SHA256f722457807534d1c563d6cfaa43e3a8b90d721dcef1d48c0a3921b4025cd6bda
SHA5122757aeab0f7c2703e0dfb095b37aada25d2947d21c7c988e4dc4b842d07741f34e4f35447694bae5a60de374f6812c511fd912177c81f37a3efd578848ae574c
-
Filesize
129B
MD5cb8d3859125ae353c618849ebd14eea0
SHA1c12e8766bdceb1e745cca99843e00ac263b3e1b8
SHA25616810395a1e54dfe9e472a61cc4d3d6332b6eb9d313e3be85d1b8bab47482ab5
SHA512389eb25c41b2e1bffdfd9ceb7e9eb4132ef700961268914bcc00cbeafec867f235f04178cb8a4be517d5d085be5b46844276d986e28d503e3cdd5b8e6c6d7b87
-
Filesize
264KB
-
Filesize
264KB
-
Filesize
264KB
-
Filesize
264KB
-
Filesize
264KB
-
Filesize
96KB
-
Filesize
264KB
-
Filesize
264KB
-
Filesize
264KB
-
Filesize
264KB
-
Filesize
4KB
-
Filesize
240KB
-
Filesize
264KB