Overview

overview

10

Static

static

10

03db266db5...d1.exe

windows7-x64

10

03db266db5...d1.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    118s
  • max time network
    118s
  • platform
    windows7_x64
  • resource
    win7-20240611-en
  • resource tags

    arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
  • submitted
    12-06-2024 23:45

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    03db266db5b96223ef42206d57e30fa58c59e70b1d14c017422f097af1560ad1.exe

  • Size

    147KB

  • MD5

    6ac5cd70e043576b82a313273150f0d9

  • SHA1

    2c3b2ed20f1e8e630c61109288bd0ac64b5e0329

  • SHA256

    03db266db5b96223ef42206d57e30fa58c59e70b1d14c017422f097af1560ad1

  • SHA512

    c77a84cc5ae2cf246278a736051baa44d1f15496547a2bfbba2cbd65e207b6e17a6b9fb4a221b4ec4286c4d80fa65709854cbd46d14a4548fbcf9fb72d01def5

  • SSDEEP

    1536:nzICS4AAwczUUf8y8gvMH+1zGSNAojMP95D1xDpAv5wo3Lk6eEVNAhaxlxxFmwUk:YqJogYkcSNm9V7DpKv3L35Sslxx0wT

Score
10/10
ransomwarespywarestealer

Malware Config

Extracted

Path

C:\zpvmjd9JY.README.txt

Ransom Note
~~~AsiriumSquad~~~ >>>> Your data are stolen and encrypted. >>>> What guarantees that we will not deceive you? We are not a politically motivated group and we do not need anything other than your money. If you pay, we will provide you the programs for decryption and we will delete your data. Life is too short to be sad. Be not sad, money, it is only paper. If we do not give you decrypters, or we do not delete your data after payment, then nobody will pay us in the future. Therefore to us our reputation is very important. We attack worldwide and there is no dissatisfied victim after payment. >>>> You need contact us to decrypt file. buy our special decryption software, this software will allow you to recover all of your data and remove the ransomware from your computer.The price for the software is $300. Payment can be made in Bitcoin only. How do I pay, where do I get Bitcoin? Moonpay.com Important!: your pc, your personal life, your liberty is in danger ! take this serius if u dont pay whe Must ruin ur life otherwise no one will pay. Payment informationAmount: 0.004 BTC Bitcoin Address: bc1q07v4dm6q5ln5w3ac93ue8jdvcjmq8tg3tvlmlr Contact us with Your personal DECRYPTION ID and screenshot of PAYMENT at: [email protected] >>>> Your personal DECRYPTION ID: 8D9634EC6DA0FEAA9AE33BD6F552A84B >>>> Warning! Do not DELETE or MODIFY any files, it can lead to recovery problems! >>>> Warning! If you do not pay the ransom we will attack your company repeatedly again!

Signatures

  • Renames multiple (287) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware
  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Drops desktop.ini file(s) 2 IoCs
  • Sets desktop wallpaper using registry 2 TTPs 2 IoCs
    ransomware
  • Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
  • Modifies Control Panel 2 IoCs
    evasion
  • Modifies registry class 5 IoCs
  • Suspicious behavior: EnumeratesProcesses 14 IoCs
  • Suspicious behavior: RenamesItself 26 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\03db266db5b96223ef42206d57e30fa58c59e70b1d14c017422f097af1560ad1.exe
    "C:\Users\Admin\AppData\Local\Temp\03db266db5b96223ef42206d57e30fa58c59e70b1d14c017422f097af1560ad1.exe"
    1⤵
    • Loads dropped DLL
    • Drops desktop.ini file(s)
    • Sets desktop wallpaper using registry
    • Modifies Control Panel
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1748
    • C:\ProgramData\2404.tmp
      "C:\ProgramData\2404.tmp"
      2⤵
      • Deletes itself
      • Executes dropped EXE
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • Suspicious behavior: RenamesItself
      • Suspicious use of WriteProcessMemory
      PID:632
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /C DEL /F /Q C:\PROGRA~3\2404.tmp >> NUL
        3⤵
          PID:2856
    • C:\Windows\system32\AUDIODG.EXE
      C:\Windows\system32\AUDIODG.EXE 0x148
      1⤵
        PID:1936

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\$Recycle.Bin\S-1-5-21-1340930862-1405011213-2821322012-1000\AAAAAAAAAAA
        Filesize

        129B

        MD5

        cde4179cba849d3f290482dbfc8742a6

        SHA1

        d6d699f5999759c7db00c1269ed19bf0ec54428f

        SHA256

        59a4d3052331c424be1124bf9888e17ff7768b572d13c018be42b0ec3c2a9886

        SHA512

        1ac658fa7ba2f24b9d05d9dcdafaa9fb00d3151c1b382a883924d8507aecea9e9cab46af1db5ee52af2159b47550be261c64fa3b950086765e57007c70335ff7

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\DDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDD
        Filesize

        147KB

        MD5

        919d36f8c8169b7ff5d5246ce3105cba

        SHA1

        f02072672424e091f77ae421dc54cf2ae9a6861c

        SHA256

        58c2dcf1a7b5ea7f37d4f5d8cb808c374c6d61fbd5d0076b1251310c9cd68b9e

        SHA512

        dfb5072e6b18ee367adbaace68d62bf5ec8255b06f9e8ebde61c7e1a921ea3af26d0125e62f1d98f667bf0c7771d12cf6cf23390ea272c136db4b78513c5ab0d

        Download Submit

      • C:\zpvmjd9JY.README.txt
        Filesize

        1KB

        MD5

        3755f8f7a2a7bd4f76dba5a4456cf1bf

        SHA1

        8ebd9d2aa13676f67a5150f407d6a13b25320c8f

        SHA256

        3c072e54cfda48b23f9a90b0cc0ba80b0825db220915d849ad1a0a84523ae60e

        SHA512

        cd02c2c3b495fe13385022e94526ea3cc1c3e129ae6653b67fb1457a1e5c0afe7a0856e64298b750aa7f6e8d2fadbdcdad9f69650fce4722990177042d07dc4d

        Download Submit

      • F:\$RECYCLE.BIN\S-1-5-21-1340930862-1405011213-2821322012-1000\DDDDDDDDDDD
        Filesize

        129B

        MD5

        09470d4f7d112df3e7961c886f5ac85c

        SHA1

        4bc4e9fc70f8363253cd2f3e5eb61293b6827b98

        SHA256

        c5a7b92e9429bae79cb84c9f31d04d0a3b030ed268f0af6ed6f86488ce53351a

        SHA512

        7a9f492b609f103ee97865a648c2cbc1bd309f6f5612cec55206746d8fa18177cd45a6f2aa09117a3096fb506d5639173898899873c05a79d58e3b4eb9fc44ff

        Download Submit

      • \ProgramData\2404.tmp
        Filesize

        14KB

        MD5

        294e9f64cb1642dd89229fff0592856b

        SHA1

        97b148c27f3da29ba7b18d6aee8a0db9102f47c9

        SHA256

        917e115cc403e29b4388e0d175cbfac3e7e40ca1742299fbdb353847db2de7c2

        SHA512

        b87d531890bf1577b9b4af41dddb2cdbbfa164cf197bd5987df3a3075983645a3acba443e289b7bfd338422978a104f55298fbfe346872de0895bde44adc89cf

        Download Submit

      • memory/632-802-0x00000000002A0000-0x00000000002E0000-memory.dmp

        Filesize

        256KB

        Download

      • memory/632-801-0x000000007EFA0000-0x000000007EFA1000-memory.dmp

        Filesize

        4KB

        Download

      • memory/632-804-0x000000007EF20000-0x000000007EF21000-memory.dmp

        Filesize

        4KB

        Download

      • memory/632-803-0x000000007EF80000-0x000000007EF81000-memory.dmp

        Filesize

        4KB

        Download

      • memory/632-834-0x000000007EF60000-0x000000007EF61000-memory.dmp

        Filesize

        4KB

        Download

      • memory/632-833-0x000000007EF40000-0x000000007EF41000-memory.dmp

        Filesize

        4KB

        Download

      • memory/1748-0-0x0000000001FD0000-0x0000000002010000-memory.dmp

        Filesize

        256KB

        Download