Resubmissions

22-08-2024 18:43

240822-xc563asamh 10

21-08-2024 17:16

240821-vtjnaathnq 10

30-06-2024 00:59

240630-bcjr6svbkk 10

20-06-2024 02:02

240620-cf43ysxbnk 10

20-06-2024 01:44

240620-b5v1xawemk 10

19-06-2024 01:10

240619-bjmseavfmp 10

18-06-2024 20:40

240618-zfwsxawdpa 10

18-06-2024 13:45

240618-q2vcjawdle 10

Analysis

  • max time kernel
    147s
  • max time network
    157s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    20-06-2024 01:44

General

  • Target

    Documents/Ransomware.Vipasana/Ransomware.Vipasana/c0cf40b8830d666a24bdd4febdc162e95aa30ed968fa3675e26ad97b2e88e03a.exe

  • Size

    370KB

  • MD5

    a890e2f924dea3cb3e46a95431ffae39

  • SHA1

    35719ee58a5771156bc956bcf1b5c54ac3391593

  • SHA256

    c0cf40b8830d666a24bdd4febdc162e95aa30ed968fa3675e26ad97b2e88e03a

  • SHA512

    664fb8075712912be30185d17d912dae148e778627e852affe1b1080bb9c8d5917e7b3c1d194e62ac6919c16235754f776523ba7ce95af38be86b61cc3e3d162

  • SSDEEP

    6144:KRzMgpY8bXFHW1FbwwEHidUoagoW2C9cuqBGI4Zq6mYN8+G5l9PAzJdVeO2Ui:sDRbXFHW1+K2UWBGIymYG+i9A+ONi

Malware Config

Signatures

  • Drops file in Drivers directory 1 IoCs
  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Adds Run key to start application 2 TTPs 1 IoCs
  • Drops file in System32 directory 64 IoCs
  • Sets desktop wallpaper using registry 2 TTPs 1 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies Control Panel 3 IoCs
  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Documents\Ransomware.Vipasana\Ransomware.Vipasana\c0cf40b8830d666a24bdd4febdc162e95aa30ed968fa3675e26ad97b2e88e03a.exe
    "C:\Users\Admin\AppData\Local\Temp\Documents\Ransomware.Vipasana\Ransomware.Vipasana\c0cf40b8830d666a24bdd4febdc162e95aa30ed968fa3675e26ad97b2e88e03a.exe"
    1⤵
    • Checks computer location settings
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:2664
    • C:\Users\Admin\AppData\Local\Temp\c0cf40b8830d666a24bdd4febdc162e95aa30ed968fa3675e26ad97b2e88e03a.exe
      "C:\Users\Admin\AppData\Local\Temp\c0cf40b8830d666a24bdd4febdc162e95aa30ed968fa3675e26ad97b2e88e03a.exe"
      2⤵
      • Drops file in Drivers directory
      • Checks computer location settings
      • Executes dropped EXE
      • Adds Run key to start application
      • Drops file in System32 directory
      • Sets desktop wallpaper using registry
      • Drops file in Program Files directory
      • Drops file in Windows directory
      • Modifies Control Panel
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:3432
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\TSMZW.bat" "
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:1420
        • C:\Windows\SysWOW64\chcp.com
          chcp 1251
          4⤵
            PID:4888

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\ProgramData\Microsoft\ClickToRun\MachineData\Catalog\Packages\{9AC08E99-230B-47E8-9721-4577B7F124EA}\{1A8308C7-90D1-4200-B16E-646F163A08E8}\Manifest.xml

      Filesize

      3.4MB

      MD5

      0222232febd1ce5f18276419a366f7b1

      SHA1

      980c9a1027da7517faefe9c923f68bd52c5b1cce

      SHA256

      2632d12b12810954d69a1e064d04911bd088e50c7d8d85f34c0ee56cfb0594f7

      SHA512

      69dfee017fd7bc8bff22f7721537e5d9e99e727ef1b78d4eab952b55af307cba78f93c2ae5c718653e510eb317c6c7f943a29eb150e87b6f5d1f2522bf91439f

    • C:\Users\Admin\AppData\Local\Temp\TSMZW.bat

      Filesize

      309B

      MD5

      626f91e541860909ba550df2dc05b53c

      SHA1

      faf0fb4e297cc08cc9011543d4691b1f0ea07035

      SHA256

      08aee9381bc66e886b997996959ac4199da648e330cbb2e59c28a91cadc09e39

      SHA512

      6c659ccf5c0b6d322c7a18fd79581dd6cab9ca7983fb299ce9afe4227f16ae61e7f8978ef1e9a98957766234d09877d6b027f80761a33856e8ced3d856a48b16

    • C:\Users\Admin\AppData\Local\Temp\c0cf40b8830d666a24bdd4febdc162e95aa30ed968fa3675e26ad97b2e88e03a.exe

      Filesize

      370KB

      MD5

      a890e2f924dea3cb3e46a95431ffae39

      SHA1

      35719ee58a5771156bc956bcf1b5c54ac3391593

      SHA256

      c0cf40b8830d666a24bdd4febdc162e95aa30ed968fa3675e26ad97b2e88e03a

      SHA512

      664fb8075712912be30185d17d912dae148e778627e852affe1b1080bb9c8d5917e7b3c1d194e62ac6919c16235754f776523ba7ce95af38be86b61cc3e3d162

    • memory/2664-7-0x0000000000400000-0x0000000000464000-memory.dmp

      Filesize

      400KB

    • memory/3432-1728-0x0000000000400000-0x0000000000464000-memory.dmp

      Filesize

      400KB

    • memory/3432-1159-0x0000000000400000-0x0000000000464000-memory.dmp

      Filesize

      400KB

    • memory/3432-879-0x0000000000400000-0x0000000000464000-memory.dmp

      Filesize

      400KB

    • memory/3432-13-0x0000000000400000-0x0000000000464000-memory.dmp

      Filesize

      400KB

    • memory/3432-1952-0x0000000000400000-0x0000000000464000-memory.dmp

      Filesize

      400KB

    • memory/3432-2091-0x0000000000400000-0x0000000000464000-memory.dmp

      Filesize

      400KB

    • memory/3432-2098-0x0000000000400000-0x0000000000464000-memory.dmp

      Filesize

      400KB

    • memory/3432-2108-0x0000000000400000-0x0000000000464000-memory.dmp

      Filesize

      400KB

    • memory/3432-2117-0x0000000000400000-0x0000000000464000-memory.dmp

      Filesize

      400KB

    • memory/3432-12-0x0000000000400000-0x0000000000464000-memory.dmp

      Filesize

      400KB