Analysis
-
max time kernel
3s -
max time network
3s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
12-06-2024 11:30
Static task
static1
Behavioral task
behavioral1
Sample
Ransomware PowerPoint.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
Ransomware PowerPoint.exe
Resource
win10v2004-20240611-en
Errors
General
-
Target
Ransomware PowerPoint.exe
-
Size
136KB
-
MD5
70108103a53123201ceb2e921fcfe83c
-
SHA1
c71799a6a6d09ee758b04cdf90a4ab76fbd2a7e3
-
SHA256
9c3f8df80193c085912c9950c58051ae77c321975784cc069ceacd4f57d5861d
-
SHA512
996701c65eee7f781c2d22dce63f4a95900f36b97a99dcf833045bce239a08b3c2f6326b3a808431cdab92d59161dd80763e44126578e160d79b7095175d276b
-
SSDEEP
1536:3VrdxBvcGdDHHtWv8udA1JYREgJ/qEOpsChnU4V1lyqHv4vAmOG9HSDKRppppp5B:1H5D0dSgo7ppTV1lyqPOAmOG9HSOD
Malware Config
Signatures
-
Deletes itself 1 IoCs
Processes:
sys3.exepid process 2140 sys3.exe -
Executes dropped EXE 1 IoCs
Processes:
sys3.exepid process 2140 sys3.exe -
Loads dropped DLL 2 IoCs
Processes:
Ransomware PowerPoint.exepid process 2368 Ransomware PowerPoint.exe 2368 Ransomware PowerPoint.exe -
Writes to the Master Boot Record (MBR) 1 TTPs 2 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
Processes:
Ransomware PowerPoint.exesys3.exedescription ioc process File opened for modification \??\PHYSICALDRIVE0 Ransomware PowerPoint.exe File opened for modification \??\PHYSICALDRIVE0 sys3.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
sys3.exedescription pid process Token: SeShutdownPrivilege 2140 sys3.exe -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
Ransomware PowerPoint.exedescription pid process target process PID 2368 wrote to memory of 2140 2368 Ransomware PowerPoint.exe sys3.exe PID 2368 wrote to memory of 2140 2368 Ransomware PowerPoint.exe sys3.exe PID 2368 wrote to memory of 2140 2368 Ransomware PowerPoint.exe sys3.exe PID 2368 wrote to memory of 2140 2368 Ransomware PowerPoint.exe sys3.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Ransomware PowerPoint.exe"C:\Users\Admin\AppData\Local\Temp\Ransomware PowerPoint.exe"1⤵
- Loads dropped DLL
- Writes to the Master Boot Record (MBR)
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\sys3.exeC:\Users\Admin\AppData\Local\Temp\\sys3.exe2⤵
- Deletes itself
- Executes dropped EXE
- Writes to the Master Boot Record (MBR)
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\LogonUI.exe"LogonUI.exe" /flags:0x01⤵
-
C:\Windows\system32\LogonUI.exe"LogonUI.exe" /flags:0x11⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\systm.txtFilesize
59B
MD5214748056d47a2418b469bf7520556f2
SHA193c561cac44213ad6de3ccf0e6b6dcb0a39cb09e
SHA2565ecbf39656b95ffa447f42cace84eb2c01fd5af713c9fd0e33e78b9d138ef42f
SHA51255fb4805bcbed7fcd437a4bfb1de6a1b233cc2294a5082a8e1f782673f62061c9714547cd2853f5c6cb77882f7e560bcfc1db7eb0526f6eb967565c979f78017
-
\Users\Admin\AppData\Local\Temp\sys3.exeFilesize
136KB
MD570108103a53123201ceb2e921fcfe83c
SHA1c71799a6a6d09ee758b04cdf90a4ab76fbd2a7e3
SHA2569c3f8df80193c085912c9950c58051ae77c321975784cc069ceacd4f57d5861d
SHA512996701c65eee7f781c2d22dce63f4a95900f36b97a99dcf833045bce239a08b3c2f6326b3a808431cdab92d59161dd80763e44126578e160d79b7095175d276b
-
memory/2368-0-0x000000002AA00000-0x000000002AA24000-memory.dmpFilesize
144KB
-
memory/2368-9-0x000000002AA00000-0x000000002AA24000-memory.dmpFilesize
144KB
-
memory/2476-13-0x0000000002AA0000-0x0000000002AA1000-memory.dmpFilesize
4KB
-
memory/2696-12-0x0000000002D90000-0x0000000002D91000-memory.dmpFilesize
4KB