Overview

overview

10

Static

static

10

9075cb70be...7b.exe

windows7-x64

9

9075cb70be...7b.exe

windows10-2004-x64

9

Analysis

  • max time kernel
    121s
  • max time network
    122s
  • platform
    windows7_x64
  • resource
    win7-20240704-en
  • resource tags

    arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
  • submitted
    09-07-2024 12:05

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    9075cb70be32cfd3c97dc814eab5456eef5800c07acc4862094c09680cf4667b.exe

  • Size

    147KB

  • MD5

    e2345db4f8ebb6ed5e78f14e6b57384c

  • SHA1

    e5f299b1d4f2d5d0837d4b8229074c266ba62f14

  • SHA256

    9075cb70be32cfd3c97dc814eab5456eef5800c07acc4862094c09680cf4667b

  • SHA512

    3baa786b6472dd4a267ca06e045e918e5bba0e10c08adb77ccc5444d6ff694525659685f6a8abc10e5eb99e1b0cc2d0b6faa584f6cb404190b88c509be9a2a41

  • SSDEEP

    3072:O6glyuxE4GsUPnliByocWepteMq6UJhlQ8fH/H:O6gDBGpvEByocWe+b6Ul/f

Score
9/10
ransomwarespywarestealer

Malware Config

Signatures

  • Renames multiple (8023) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware
  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Drops desktop.ini file(s) 2 IoCs
  • Sets desktop wallpaper using registry 2 TTPs 2 IoCs
    ransomware
  • Suspicious use of NtSetInformationThreadHideFromDebugger 5 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies Control Panel 2 IoCs
    evasion
  • Modifies registry class 5 IoCs
  • Suspicious behavior: EnumeratesProcesses 56 IoCs
  • Suspicious behavior: RenamesItself 26 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\9075cb70be32cfd3c97dc814eab5456eef5800c07acc4862094c09680cf4667b.exe
    "C:\Users\Admin\AppData\Local\Temp\9075cb70be32cfd3c97dc814eab5456eef5800c07acc4862094c09680cf4667b.exe"
    1⤵
    • Loads dropped DLL
    • Drops desktop.ini file(s)
    • Sets desktop wallpaper using registry
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Drops file in Program Files directory
    • Modifies Control Panel
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2240
    • C:\ProgramData\401C.tmp
      "C:\ProgramData\401C.tmp"
      2⤵
      • Deletes itself
      • Executes dropped EXE
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • Suspicious behavior: RenamesItself
      • Suspicious use of WriteProcessMemory
      PID:2852
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /C DEL /F /Q C:\PROGRA~3\401C.tmp >> NUL
        3⤵
          PID:1932
    • C:\Windows\system32\AUDIODG.EXE
      C:\Windows\system32\AUDIODG.EXE 0x148
      1⤵
        PID:2456

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\$Recycle.Bin\S-1-5-21-3434294380-2554721341-1919518612-1000\desktop.ini
        Filesize

        129B

        MD5

        0362002e4de251c5787ae709d5b2c12e

        SHA1

        d26aabe2bea4581bdd43865af6f7fa868b4dd004

        SHA256

        2072ae14996295b9d7cd80f0ae66116f350e726ed12cb5cd9f5be92185b118d1

        SHA512

        cc6a4b06e1e90308403b3a1d757647b9efa12a124909bb953d87d04fa0d512f0b1f1e9ed9951a00465064f2c118f856e0619101b26263f5b2176d15f6c4c30c5

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\DDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDD
        Filesize

        147KB

        MD5

        a56cade6f4262677c559981e50eabae4

        SHA1

        b2f41a8d6e3f8540ec1ea28901d25d4f933823cb

        SHA256

        a873e9b739f0f2c741d985a4675651e64e023d774b81cd00db10e9aee3df2acf

        SHA512

        4f49f683c1914d5f6ce0bec16817351ced28715851077123a0f7b7e623dbed1b1f0a1480884367659255b8d6149d8a0dce487940d095b943e3079637f60eca7d

        Download Submit

      • C:\rkOLwOtuy.README.txt
        Filesize

        1KB

        MD5

        12195084f7d45242aee98ce43164a8ed

        SHA1

        dc77f76589a9e6df6abc30954d52e35a5f1a2bdf

        SHA256

        9551659ef8e5c10038fac2ecfb0adbcf8997ecf7841084f71d1eb2380ee20d40

        SHA512

        5b841a70d5f4743a12a682dc567abee3b78038529d24c13fc8a58d9c5f853c66271579c05212d043fbf426383bad03d4e97377a6b7253390014a3c4b8894f259

        Download Submit

      • F:\$RECYCLE.BIN\S-1-5-21-3434294380-2554721341-1919518612-1000\DDDDDDDDDDD
        Filesize

        129B

        MD5

        9294866a4acf36e5648f79f4c5adf74c

        SHA1

        bac4be11cdb9de0ad139bd214d45573bf85a6c72

        SHA256

        732d4d7fdb1b76b76da67719a2929e1298f7d20312a0ce64e085f769dc971ed9

        SHA512

        ef05d0ddc16a59c6950e0e95d58d4b262ba29b07689d19efe6206668b1e9421afeedb5defbbea0c7955f8307c562719bca7600481da4d479f069a9be12cd3eaa

        Download Submit

      • \ProgramData\401C.tmp
        Filesize

        14KB

        MD5

        294e9f64cb1642dd89229fff0592856b

        SHA1

        97b148c27f3da29ba7b18d6aee8a0db9102f47c9

        SHA256

        917e115cc403e29b4388e0d175cbfac3e7e40ca1742299fbdb353847db2de7c2

        SHA512

        b87d531890bf1577b9b4af41dddb2cdbbfa164cf197bd5987df3a3075983645a3acba443e289b7bfd338422978a104f55298fbfe346872de0895bde44adc89cf

        Download Submit

      • memory/2240-0-0x00000000002D0000-0x0000000000310000-memory.dmp

        Filesize

        256KB

        Download

      • memory/2852-11972-0x0000000000401000-0x0000000000404000-memory.dmp

        Filesize

        12KB

        Download

      • memory/2852-11974-0x0000000000400000-0x0000000000407000-memory.dmp

        Filesize

        28KB

        Download