Analysis
-
max time kernel
121s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
24-06-2024 13:27
Behavioral task
behavioral1
Sample
6371b930d541e441cb5a9234b327395e05501f3405fb45ef13d9c2dabb6aa40c.exe
Resource
win7-20240221-en
windows7-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
6371b930d541e441cb5a9234b327395e05501f3405fb45ef13d9c2dabb6aa40c.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
10 signatures
150 seconds
General
-
Target
6371b930d541e441cb5a9234b327395e05501f3405fb45ef13d9c2dabb6aa40c.exe
-
Size
145KB
-
MD5
c00352e2857075c8f757ea9be769b652
-
SHA1
2a100aa5902ba6f9f35187117182afabf220071b
-
SHA256
6371b930d541e441cb5a9234b327395e05501f3405fb45ef13d9c2dabb6aa40c
-
SHA512
94d7e90ebd6b1d37daa43617a345c463d59096903a55621ff3eb490179411cb7bb58f75bb396a5d2b8720701833dc623ddfb259ad35c0716703a8e4bc66018ad
-
SSDEEP
3072:m6glyuxE4GsUPnliByocWepbN3/1rtqd:m6gDBGpvEByocWeFN3/F8
Score
7/10
Malware Config
Signatures
-
Deletes itself 1 IoCs
Processes:
33CD.tmppid Process 2920 33CD.tmp -
Executes dropped EXE 1 IoCs
Processes:
33CD.tmppid Process 2920 33CD.tmp -
Loads dropped DLL 1 IoCs
Processes:
6371b930d541e441cb5a9234b327395e05501f3405fb45ef13d9c2dabb6aa40c.exepid Process 3000 6371b930d541e441cb5a9234b327395e05501f3405fb45ef13d9c2dabb6aa40c.exe -
Drops desktop.ini file(s) 2 IoCs
Processes:
6371b930d541e441cb5a9234b327395e05501f3405fb45ef13d9c2dabb6aa40c.exedescription ioc Process File opened for modification F:\$RECYCLE.BIN\S-1-5-21-1298544033-3225604241-2703760938-1000\desktop.ini 6371b930d541e441cb5a9234b327395e05501f3405fb45ef13d9c2dabb6aa40c.exe File opened for modification C:\$Recycle.Bin\S-1-5-21-1298544033-3225604241-2703760938-1000\desktop.ini 6371b930d541e441cb5a9234b327395e05501f3405fb45ef13d9c2dabb6aa40c.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 5 IoCs
Processes:
6371b930d541e441cb5a9234b327395e05501f3405fb45ef13d9c2dabb6aa40c.exe33CD.tmppid Process 3000 6371b930d541e441cb5a9234b327395e05501f3405fb45ef13d9c2dabb6aa40c.exe 3000 6371b930d541e441cb5a9234b327395e05501f3405fb45ef13d9c2dabb6aa40c.exe 3000 6371b930d541e441cb5a9234b327395e05501f3405fb45ef13d9c2dabb6aa40c.exe 3000 6371b930d541e441cb5a9234b327395e05501f3405fb45ef13d9c2dabb6aa40c.exe 2920 33CD.tmp -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Opens file in notepad (likely ransom note) 1 IoCs
Processes:
NOTEPAD.EXEpid Process 1480 NOTEPAD.EXE -
Suspicious behavior: EnumeratesProcesses 12 IoCs
Processes:
6371b930d541e441cb5a9234b327395e05501f3405fb45ef13d9c2dabb6aa40c.exepid Process 3000 6371b930d541e441cb5a9234b327395e05501f3405fb45ef13d9c2dabb6aa40c.exe 3000 6371b930d541e441cb5a9234b327395e05501f3405fb45ef13d9c2dabb6aa40c.exe 3000 6371b930d541e441cb5a9234b327395e05501f3405fb45ef13d9c2dabb6aa40c.exe 3000 6371b930d541e441cb5a9234b327395e05501f3405fb45ef13d9c2dabb6aa40c.exe 3000 6371b930d541e441cb5a9234b327395e05501f3405fb45ef13d9c2dabb6aa40c.exe 3000 6371b930d541e441cb5a9234b327395e05501f3405fb45ef13d9c2dabb6aa40c.exe 3000 6371b930d541e441cb5a9234b327395e05501f3405fb45ef13d9c2dabb6aa40c.exe 3000 6371b930d541e441cb5a9234b327395e05501f3405fb45ef13d9c2dabb6aa40c.exe 3000 6371b930d541e441cb5a9234b327395e05501f3405fb45ef13d9c2dabb6aa40c.exe 3000 6371b930d541e441cb5a9234b327395e05501f3405fb45ef13d9c2dabb6aa40c.exe 3000 6371b930d541e441cb5a9234b327395e05501f3405fb45ef13d9c2dabb6aa40c.exe 3000 6371b930d541e441cb5a9234b327395e05501f3405fb45ef13d9c2dabb6aa40c.exe -
Suspicious behavior: RenamesItself 26 IoCs
Processes:
33CD.tmppid Process 2920 33CD.tmp 2920 33CD.tmp 2920 33CD.tmp 2920 33CD.tmp 2920 33CD.tmp 2920 33CD.tmp 2920 33CD.tmp 2920 33CD.tmp 2920 33CD.tmp 2920 33CD.tmp 2920 33CD.tmp 2920 33CD.tmp 2920 33CD.tmp 2920 33CD.tmp 2920 33CD.tmp 2920 33CD.tmp 2920 33CD.tmp 2920 33CD.tmp 2920 33CD.tmp 2920 33CD.tmp 2920 33CD.tmp 2920 33CD.tmp 2920 33CD.tmp 2920 33CD.tmp 2920 33CD.tmp 2920 33CD.tmp -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
6371b930d541e441cb5a9234b327395e05501f3405fb45ef13d9c2dabb6aa40c.exedescription pid Process Token: SeAssignPrimaryTokenPrivilege 3000 6371b930d541e441cb5a9234b327395e05501f3405fb45ef13d9c2dabb6aa40c.exe Token: SeBackupPrivilege 3000 6371b930d541e441cb5a9234b327395e05501f3405fb45ef13d9c2dabb6aa40c.exe Token: SeDebugPrivilege 3000 6371b930d541e441cb5a9234b327395e05501f3405fb45ef13d9c2dabb6aa40c.exe Token: 36 3000 6371b930d541e441cb5a9234b327395e05501f3405fb45ef13d9c2dabb6aa40c.exe Token: SeImpersonatePrivilege 3000 6371b930d541e441cb5a9234b327395e05501f3405fb45ef13d9c2dabb6aa40c.exe Token: SeIncBasePriorityPrivilege 3000 6371b930d541e441cb5a9234b327395e05501f3405fb45ef13d9c2dabb6aa40c.exe Token: SeIncreaseQuotaPrivilege 3000 6371b930d541e441cb5a9234b327395e05501f3405fb45ef13d9c2dabb6aa40c.exe Token: 33 3000 6371b930d541e441cb5a9234b327395e05501f3405fb45ef13d9c2dabb6aa40c.exe Token: SeManageVolumePrivilege 3000 6371b930d541e441cb5a9234b327395e05501f3405fb45ef13d9c2dabb6aa40c.exe Token: SeProfSingleProcessPrivilege 3000 6371b930d541e441cb5a9234b327395e05501f3405fb45ef13d9c2dabb6aa40c.exe Token: SeRestorePrivilege 3000 6371b930d541e441cb5a9234b327395e05501f3405fb45ef13d9c2dabb6aa40c.exe Token: SeSecurityPrivilege 3000 6371b930d541e441cb5a9234b327395e05501f3405fb45ef13d9c2dabb6aa40c.exe Token: SeSystemProfilePrivilege 3000 6371b930d541e441cb5a9234b327395e05501f3405fb45ef13d9c2dabb6aa40c.exe Token: SeTakeOwnershipPrivilege 3000 6371b930d541e441cb5a9234b327395e05501f3405fb45ef13d9c2dabb6aa40c.exe Token: SeShutdownPrivilege 3000 6371b930d541e441cb5a9234b327395e05501f3405fb45ef13d9c2dabb6aa40c.exe Token: SeDebugPrivilege 3000 6371b930d541e441cb5a9234b327395e05501f3405fb45ef13d9c2dabb6aa40c.exe Token: SeBackupPrivilege 3000 6371b930d541e441cb5a9234b327395e05501f3405fb45ef13d9c2dabb6aa40c.exe Token: SeBackupPrivilege 3000 6371b930d541e441cb5a9234b327395e05501f3405fb45ef13d9c2dabb6aa40c.exe Token: SeSecurityPrivilege 3000 6371b930d541e441cb5a9234b327395e05501f3405fb45ef13d9c2dabb6aa40c.exe Token: SeSecurityPrivilege 3000 6371b930d541e441cb5a9234b327395e05501f3405fb45ef13d9c2dabb6aa40c.exe Token: SeBackupPrivilege 3000 6371b930d541e441cb5a9234b327395e05501f3405fb45ef13d9c2dabb6aa40c.exe Token: SeBackupPrivilege 3000 6371b930d541e441cb5a9234b327395e05501f3405fb45ef13d9c2dabb6aa40c.exe Token: SeSecurityPrivilege 3000 6371b930d541e441cb5a9234b327395e05501f3405fb45ef13d9c2dabb6aa40c.exe Token: SeSecurityPrivilege 3000 6371b930d541e441cb5a9234b327395e05501f3405fb45ef13d9c2dabb6aa40c.exe Token: SeBackupPrivilege 3000 6371b930d541e441cb5a9234b327395e05501f3405fb45ef13d9c2dabb6aa40c.exe Token: SeBackupPrivilege 3000 6371b930d541e441cb5a9234b327395e05501f3405fb45ef13d9c2dabb6aa40c.exe Token: SeSecurityPrivilege 3000 6371b930d541e441cb5a9234b327395e05501f3405fb45ef13d9c2dabb6aa40c.exe Token: SeSecurityPrivilege 3000 6371b930d541e441cb5a9234b327395e05501f3405fb45ef13d9c2dabb6aa40c.exe Token: SeBackupPrivilege 3000 6371b930d541e441cb5a9234b327395e05501f3405fb45ef13d9c2dabb6aa40c.exe Token: SeBackupPrivilege 3000 6371b930d541e441cb5a9234b327395e05501f3405fb45ef13d9c2dabb6aa40c.exe Token: SeSecurityPrivilege 3000 6371b930d541e441cb5a9234b327395e05501f3405fb45ef13d9c2dabb6aa40c.exe Token: SeSecurityPrivilege 3000 6371b930d541e441cb5a9234b327395e05501f3405fb45ef13d9c2dabb6aa40c.exe Token: SeBackupPrivilege 3000 6371b930d541e441cb5a9234b327395e05501f3405fb45ef13d9c2dabb6aa40c.exe Token: SeBackupPrivilege 3000 6371b930d541e441cb5a9234b327395e05501f3405fb45ef13d9c2dabb6aa40c.exe Token: SeSecurityPrivilege 3000 6371b930d541e441cb5a9234b327395e05501f3405fb45ef13d9c2dabb6aa40c.exe Token: SeSecurityPrivilege 3000 6371b930d541e441cb5a9234b327395e05501f3405fb45ef13d9c2dabb6aa40c.exe Token: SeBackupPrivilege 3000 6371b930d541e441cb5a9234b327395e05501f3405fb45ef13d9c2dabb6aa40c.exe Token: SeBackupPrivilege 3000 6371b930d541e441cb5a9234b327395e05501f3405fb45ef13d9c2dabb6aa40c.exe Token: SeSecurityPrivilege 3000 6371b930d541e441cb5a9234b327395e05501f3405fb45ef13d9c2dabb6aa40c.exe Token: SeSecurityPrivilege 3000 6371b930d541e441cb5a9234b327395e05501f3405fb45ef13d9c2dabb6aa40c.exe Token: SeBackupPrivilege 3000 6371b930d541e441cb5a9234b327395e05501f3405fb45ef13d9c2dabb6aa40c.exe Token: SeBackupPrivilege 3000 6371b930d541e441cb5a9234b327395e05501f3405fb45ef13d9c2dabb6aa40c.exe Token: SeSecurityPrivilege 3000 6371b930d541e441cb5a9234b327395e05501f3405fb45ef13d9c2dabb6aa40c.exe Token: SeSecurityPrivilege 3000 6371b930d541e441cb5a9234b327395e05501f3405fb45ef13d9c2dabb6aa40c.exe Token: SeBackupPrivilege 3000 6371b930d541e441cb5a9234b327395e05501f3405fb45ef13d9c2dabb6aa40c.exe Token: SeBackupPrivilege 3000 6371b930d541e441cb5a9234b327395e05501f3405fb45ef13d9c2dabb6aa40c.exe Token: SeSecurityPrivilege 3000 6371b930d541e441cb5a9234b327395e05501f3405fb45ef13d9c2dabb6aa40c.exe Token: SeSecurityPrivilege 3000 6371b930d541e441cb5a9234b327395e05501f3405fb45ef13d9c2dabb6aa40c.exe Token: SeBackupPrivilege 3000 6371b930d541e441cb5a9234b327395e05501f3405fb45ef13d9c2dabb6aa40c.exe Token: SeBackupPrivilege 3000 6371b930d541e441cb5a9234b327395e05501f3405fb45ef13d9c2dabb6aa40c.exe Token: SeSecurityPrivilege 3000 6371b930d541e441cb5a9234b327395e05501f3405fb45ef13d9c2dabb6aa40c.exe Token: SeSecurityPrivilege 3000 6371b930d541e441cb5a9234b327395e05501f3405fb45ef13d9c2dabb6aa40c.exe Token: SeBackupPrivilege 3000 6371b930d541e441cb5a9234b327395e05501f3405fb45ef13d9c2dabb6aa40c.exe Token: SeBackupPrivilege 3000 6371b930d541e441cb5a9234b327395e05501f3405fb45ef13d9c2dabb6aa40c.exe Token: SeSecurityPrivilege 3000 6371b930d541e441cb5a9234b327395e05501f3405fb45ef13d9c2dabb6aa40c.exe Token: SeSecurityPrivilege 3000 6371b930d541e441cb5a9234b327395e05501f3405fb45ef13d9c2dabb6aa40c.exe Token: SeBackupPrivilege 3000 6371b930d541e441cb5a9234b327395e05501f3405fb45ef13d9c2dabb6aa40c.exe Token: SeBackupPrivilege 3000 6371b930d541e441cb5a9234b327395e05501f3405fb45ef13d9c2dabb6aa40c.exe Token: SeSecurityPrivilege 3000 6371b930d541e441cb5a9234b327395e05501f3405fb45ef13d9c2dabb6aa40c.exe Token: SeSecurityPrivilege 3000 6371b930d541e441cb5a9234b327395e05501f3405fb45ef13d9c2dabb6aa40c.exe Token: SeBackupPrivilege 3000 6371b930d541e441cb5a9234b327395e05501f3405fb45ef13d9c2dabb6aa40c.exe Token: SeBackupPrivilege 3000 6371b930d541e441cb5a9234b327395e05501f3405fb45ef13d9c2dabb6aa40c.exe Token: SeSecurityPrivilege 3000 6371b930d541e441cb5a9234b327395e05501f3405fb45ef13d9c2dabb6aa40c.exe Token: SeSecurityPrivilege 3000 6371b930d541e441cb5a9234b327395e05501f3405fb45ef13d9c2dabb6aa40c.exe -
Suspicious use of WriteProcessMemory 9 IoCs
Processes:
6371b930d541e441cb5a9234b327395e05501f3405fb45ef13d9c2dabb6aa40c.exe33CD.tmpdescription pid Process procid_target PID 3000 wrote to memory of 2920 3000 6371b930d541e441cb5a9234b327395e05501f3405fb45ef13d9c2dabb6aa40c.exe 29 PID 3000 wrote to memory of 2920 3000 6371b930d541e441cb5a9234b327395e05501f3405fb45ef13d9c2dabb6aa40c.exe 29 PID 3000 wrote to memory of 2920 3000 6371b930d541e441cb5a9234b327395e05501f3405fb45ef13d9c2dabb6aa40c.exe 29 PID 3000 wrote to memory of 2920 3000 6371b930d541e441cb5a9234b327395e05501f3405fb45ef13d9c2dabb6aa40c.exe 29 PID 3000 wrote to memory of 2920 3000 6371b930d541e441cb5a9234b327395e05501f3405fb45ef13d9c2dabb6aa40c.exe 29 PID 2920 wrote to memory of 2676 2920 33CD.tmp 30 PID 2920 wrote to memory of 2676 2920 33CD.tmp 30 PID 2920 wrote to memory of 2676 2920 33CD.tmp 30 PID 2920 wrote to memory of 2676 2920 33CD.tmp 30
Processes
-
C:\Users\Admin\AppData\Local\Temp\6371b930d541e441cb5a9234b327395e05501f3405fb45ef13d9c2dabb6aa40c.exe"C:\Users\Admin\AppData\Local\Temp\6371b930d541e441cb5a9234b327395e05501f3405fb45ef13d9c2dabb6aa40c.exe"1⤵
- Loads dropped DLL
- Drops desktop.ini file(s)
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3000 -
C:\ProgramData\33CD.tmp"C:\ProgramData\33CD.tmp"2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:2920 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C DEL /F /Q C:\PROGRA~3\33CD.tmp >> NUL3⤵PID:2676
-
-
-
C:\Windows\explorer.exe"C:\Windows\explorer.exe"1⤵PID:1292
-
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\2P7jdGpHD.README.txt1⤵
- Opens file in notepad (likely ransom note)
PID:1480
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x14c1⤵PID:1364
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
129B
MD5287c0a82e57e8221e959ad608d689722
SHA17d7f318e81dc6abc5ded2a09b00acda683c50743
SHA256303729afac485131bbdf8309d8a088060400ebd3eda2535a51d3bc8b92471046
SHA5121902afcda940c4af05bc80ed35e135aba098635683be9bcb48b989ae2d01e9ca3fe3c8830597fa690496d5c8a162360b654ae734043d13426c8f7660baca61fc
-
Filesize
354B
MD582477511bd66d813474e640b636bba76
SHA1045c9f40e45f02e9154166a012e5a021ae5e3ca8
SHA256bc381eb017ab84d17eb6f3ae994305ef1edd3898d5ec140b2dd5ba478c81e428
SHA51212d62cece6f54188720ea3381b4695129e06aed7c7ff9f0170f349b47bfdb8eff93fa3d682bb2e995310586088cd5a27e28b14a2f85bedd9568d3451ab9966c4
-
C:\Users\Admin\AppData\Local\Temp\DDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDD
Filesize145KB
MD5838099760f7a358dfb9bf73f72ee34cd
SHA17eeb8207839ae81ebf3bd126423e4e4d615651e3
SHA2566fa7e4c57bd3f8403a4b45f913f9302702dc5e69777152382e1f261095a045a9
SHA512761a32588edc8afd019ab202b2cbe1bb34fdab2b41cfe4d5cdea4fc7b5b2375f40eaab8c031698965b356fec6ff32d0e9d3f3ac465281a7283c71beb2a9d6fa8
-
Filesize
129B
MD554a5865bf1606ccd80765743eaa21978
SHA16074fdd13d9edbf2ff7160ef9ff53e9a062fe66e
SHA256a156b24bf4a97c178dbf4bc56aa5483802498a016697f2e60489f994f3cc1094
SHA512ebefc5ce2b2e02c22e0d5d6d2057c56f6470ec8655ebce32d7680255c1ba841d76419c3c68fb1a9ef7b1319e61a0d4e54d4be5893b33dc000852c10ec7741d8d
-
Filesize
14KB
MD5294e9f64cb1642dd89229fff0592856b
SHA197b148c27f3da29ba7b18d6aee8a0db9102f47c9
SHA256917e115cc403e29b4388e0d175cbfac3e7e40ca1742299fbdb353847db2de7c2
SHA512b87d531890bf1577b9b4af41dddb2cdbbfa164cf197bd5987df3a3075983645a3acba443e289b7bfd338422978a104f55298fbfe346872de0895bde44adc89cf