Analysis
- max time kernel
118s - max time network
118s - platform
windows7_x64 - resource
win7-20240419-en - resource tags
- submitted
13/06/2024, 13:59
General
- Target If i Dead 2.0.exe
- Size 1.4MB
- Sample240613-ramdaa1hle
- SHA256 2c7585afa5e462e2207cb229a695df0fb47129b605d416716aae4de26918f302
Malware Config
Signatures
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Opens file in notepad (likely ransom note) 1 IoCs
- Suspicious behavior: AddClipboardFormatListener 1 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of FindShellTrayWindow 9 IoCs
- Suspicious use of SendNotifyMessage 8 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\If i Dead 2.0.exe"C:\Users\Admin\AppData\Local\Temp\If i Dead 2.0.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Program Files\VideoLAN\VLC\vlc.exe"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\AppData\Local\Temp\IfIDeath.mp3"2⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
-
-
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\ReadMe.txt2⤵
- Opens file in notepad (likely ransom note)
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
IfIDeath.mp3
ReadMe.txt
memory/2612-30-0x000007FEF5470000-0x000007FEF5481000-memory.dmp
memory/2612-11-0x000000013FA40000-0x000000013FB38000-memory.dmp
memory/2612-14-0x000007FEFBFC0000-0x000007FEFBFD8000-memory.dmp
memory/2612-15-0x000007FEFB5F0000-0x000007FEFB607000-memory.dmp
memory/2612-16-0x000007FEFB0B0000-0x000007FEFB0C1000-memory.dmp
memory/2612-17-0x000007FEFB090000-0x000007FEFB0A7000-memory.dmp
memory/2612-19-0x000007FEF7D00000-0x000007FEF7D1D000-memory.dmp
memory/2612-18-0x000007FEFB070000-0x000007FEFB081000-memory.dmp
memory/2612-13-0x000007FEF6790000-0x000007FEF6A46000-memory.dmp
memory/2612-21-0x000007FEF7CE0000-0x000007FEF7CF1000-memory.dmp
memory/2612-20-0x000007FEF6580000-0x000007FEF678B000-memory.dmp
memory/2612-22-0x000007FEF70B0000-0x000007FEF70F1000-memory.dmp
memory/2612-24-0x000007FEF7CB0000-0x000007FEF7CD1000-memory.dmp
memory/2612-25-0x000007FEF72C0000-0x000007FEF72D8000-memory.dmp
memory/2612-26-0x000007FEF7090000-0x000007FEF70A1000-memory.dmp
memory/2612-27-0x000007FEF6CE0000-0x000007FEF6CF1000-memory.dmp
memory/2612-28-0x000007FEF54B0000-0x000007FEF54C1000-memory.dmp
memory/2612-33-0x000007FEF53B0000-0x000007FEF5417000-memory.dmp
memory/2612-32-0x000007FEF5420000-0x000007FEF5450000-memory.dmp
memory/2612-31-0x000007FEF5450000-0x000007FEF5468000-memory.dmp
memory/2612-45-0x000007FEF3450000-0x000007FEF3474000-memory.dmp
memory/2612-12-0x000007FEFB3B0000-0x000007FEFB3E4000-memory.dmp
memory/2612-29-0x000007FEF5490000-0x000007FEF54AB000-memory.dmp
memory/2612-48-0x000007FEF33E0000-0x000007FEF3422000-memory.dmp
memory/2612-44-0x000007FEF3480000-0x000007FEF34A8000-memory.dmp
memory/2612-47-0x000007FEF3430000-0x000007FEF3446000-memory.dmp
memory/2612-50-0x000007FEF3300000-0x000007FEF336D000-memory.dmp
memory/2612-53-0x000007FEF3280000-0x000007FEF3292000-memory.dmp
memory/2612-52-0x000007FEF32A0000-0x000007FEF32B1000-memory.dmp
memory/2612-51-0x000007FEF32E0000-0x000007FEF32F5000-memory.dmp
memory/2612-49-0x000007FEF3370000-0x000007FEF33D2000-memory.dmp
memory/2612-46-0x000007FEFB740000-0x000007FEFB750000-memory.dmp
memory/2612-23-0x000007FEF54D0000-0x000007FEF6580000-memory.dmp
memory/2612-43-0x000007FEF34B0000-0x000007FEF3507000-memory.dmp
memory/2612-34-0x000007FEF5330000-0x000007FEF53AC000-memory.dmp
memory/2612-42-0x000007FEF5130000-0x000007FEF51F5000-memory.dmp
memory/2612-41-0x000007FEF5200000-0x000007FEF5211000-memory.dmp
memory/2612-40-0x000007FEF5220000-0x000007FEF5233000-memory.dmp
memory/2612-39-0x000007FEF5240000-0x000007FEF526F000-memory.dmp
memory/2612-38-0x000007FEF5270000-0x000007FEF52C7000-memory.dmp
memory/2612-37-0x000007FEF52D0000-0x000007FEF52E1000-memory.dmp
memory/2612-36-0x000007FEF52F0000-0x000007FEF5308000-memory.dmp
memory/2612-35-0x000007FEF5310000-0x000007FEF5321000-memory.dmp
memory/2612-54-0x000007FEF3100000-0x000007FEF327A000-memory.dmp