Analysis
-
max time kernel
118s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
10-07-2024 16:45
Static task
static1
Behavioral task
behavioral1
Sample
main.exe
Resource
win7-20240704-en
windows7-x64
Behavioral task
behavioral2
Sample
main.exe
Resource
win10v2004-20240709-en
windows10-2004-x64
General
-
Target
main.exe
-
Size
1.1MB
-
MD5
1d363ea7301c6c6feaddfc4a591a27cd
-
SHA1
3677acc29ad990542f05bd86f4b8025c3bc3652d
-
SHA256
211f14448b9c3d094c384ad365a5e0899f91fd015f138e99edf068b1aac8d3ab
-
SHA512
acd1824af37a67a754110704eb761325951dfe2732d8f2b967862a951ea47aee6cc5a78a602d3ec612a918612c67ffa41feca66f0882314d6356fa2d5f52bf68
-
SSDEEP
24576:0jDMacqe/kumuSgsZdRVw8D/Pt9htFEcOuCPtIggndsY0s0:wMce/bcgsVD/PfhfOuQqdF0
Malware Config
Signatures
-
Renames multiple (325) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Deletes itself 1 IoCs
pid Process 408 85A.tmp -
Executes dropped EXE 1 IoCs
pid Process 408 85A.tmp -
Loads dropped DLL 1 IoCs
pid Process 2656 main.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops desktop.ini file(s) 2 IoCs
description ioc Process File opened for modification C:\$Recycle.Bin\S-1-5-21-3294248377-1418901787-4083263181-1000\desktop.ini main.exe File opened for modification F:\$RECYCLE.BIN\S-1-5-21-3294248377-1418901787-4083263181-1000\desktop.ini main.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 8 IoCs
pid Process 2656 main.exe 2656 main.exe 408 85A.tmp 408 85A.tmp 408 85A.tmp 408 85A.tmp 408 85A.tmp 408 85A.tmp -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 12 IoCs
pid Process 2656 main.exe 2656 main.exe 2656 main.exe 2656 main.exe 2656 main.exe 2656 main.exe 2656 main.exe 2656 main.exe 2656 main.exe 2656 main.exe 2656 main.exe 2656 main.exe -
Suspicious behavior: RenamesItself 26 IoCs
pid Process 408 85A.tmp 408 85A.tmp 408 85A.tmp 408 85A.tmp 408 85A.tmp 408 85A.tmp 408 85A.tmp 408 85A.tmp 408 85A.tmp 408 85A.tmp 408 85A.tmp 408 85A.tmp 408 85A.tmp 408 85A.tmp 408 85A.tmp 408 85A.tmp 408 85A.tmp 408 85A.tmp 408 85A.tmp 408 85A.tmp 408 85A.tmp 408 85A.tmp 408 85A.tmp 408 85A.tmp 408 85A.tmp 408 85A.tmp -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeAssignPrimaryTokenPrivilege 2656 main.exe Token: SeBackupPrivilege 2656 main.exe Token: SeDebugPrivilege 2656 main.exe Token: 36 2656 main.exe Token: SeImpersonatePrivilege 2656 main.exe Token: SeIncBasePriorityPrivilege 2656 main.exe Token: SeIncreaseQuotaPrivilege 2656 main.exe Token: 33 2656 main.exe Token: SeManageVolumePrivilege 2656 main.exe Token: SeProfSingleProcessPrivilege 2656 main.exe Token: SeRestorePrivilege 2656 main.exe Token: SeSecurityPrivilege 2656 main.exe Token: SeSystemProfilePrivilege 2656 main.exe Token: SeTakeOwnershipPrivilege 2656 main.exe Token: SeShutdownPrivilege 2656 main.exe Token: SeDebugPrivilege 2656 main.exe Token: SeBackupPrivilege 2656 main.exe Token: SeBackupPrivilege 2656 main.exe Token: SeSecurityPrivilege 2656 main.exe Token: SeSecurityPrivilege 2656 main.exe Token: SeBackupPrivilege 2656 main.exe Token: SeBackupPrivilege 2656 main.exe Token: SeSecurityPrivilege 2656 main.exe Token: SeSecurityPrivilege 2656 main.exe Token: SeBackupPrivilege 2656 main.exe Token: SeBackupPrivilege 2656 main.exe Token: SeSecurityPrivilege 2656 main.exe Token: SeSecurityPrivilege 2656 main.exe Token: SeBackupPrivilege 2656 main.exe Token: SeBackupPrivilege 2656 main.exe Token: SeSecurityPrivilege 2656 main.exe Token: SeSecurityPrivilege 2656 main.exe Token: SeBackupPrivilege 2656 main.exe Token: SeBackupPrivilege 2656 main.exe Token: SeSecurityPrivilege 2656 main.exe Token: SeSecurityPrivilege 2656 main.exe Token: SeBackupPrivilege 2656 main.exe Token: SeBackupPrivilege 2656 main.exe Token: SeSecurityPrivilege 2656 main.exe Token: SeSecurityPrivilege 2656 main.exe Token: SeBackupPrivilege 2656 main.exe Token: SeBackupPrivilege 2656 main.exe Token: SeSecurityPrivilege 2656 main.exe Token: SeSecurityPrivilege 2656 main.exe Token: SeBackupPrivilege 2656 main.exe Token: SeBackupPrivilege 2656 main.exe Token: SeSecurityPrivilege 2656 main.exe Token: SeSecurityPrivilege 2656 main.exe Token: SeBackupPrivilege 2656 main.exe Token: SeBackupPrivilege 2656 main.exe Token: SeSecurityPrivilege 2656 main.exe Token: SeSecurityPrivilege 2656 main.exe Token: SeBackupPrivilege 2656 main.exe Token: SeBackupPrivilege 2656 main.exe Token: SeSecurityPrivilege 2656 main.exe Token: SeSecurityPrivilege 2656 main.exe Token: SeBackupPrivilege 2656 main.exe Token: SeBackupPrivilege 2656 main.exe Token: SeSecurityPrivilege 2656 main.exe Token: SeSecurityPrivilege 2656 main.exe Token: SeBackupPrivilege 2656 main.exe Token: SeBackupPrivilege 2656 main.exe Token: SeSecurityPrivilege 2656 main.exe Token: SeSecurityPrivilege 2656 main.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2656 main.exe -
Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 2656 wrote to memory of 408 2656 main.exe 32 PID 2656 wrote to memory of 408 2656 main.exe 32 PID 2656 wrote to memory of 408 2656 main.exe 32 PID 2656 wrote to memory of 408 2656 main.exe 32 PID 2656 wrote to memory of 408 2656 main.exe 32 PID 408 wrote to memory of 2156 408 85A.tmp 35 PID 408 wrote to memory of 2156 408 85A.tmp 35 PID 408 wrote to memory of 2156 408 85A.tmp 35 PID 408 wrote to memory of 2156 408 85A.tmp 35
Processes
-
C:\Users\Admin\AppData\Local\Temp\main.exe"C:\Users\Admin\AppData\Local\Temp\main.exe"1⤵
- Loads dropped DLL
- Drops desktop.ini file(s)
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2656 -
C:\ProgramData\85A.tmp"C:\ProgramData\85A.tmp"2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:408 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C DEL /F /Q C:\PROGRA~3\85A.tmp >> NUL3⤵PID:2156
-
-
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x1481⤵PID:348
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
129B
MD55aed226ea78c3978ec819e7d380b56bb
SHA1523c67c75f64a1b5b3f1d20c931a0fa1ae1cbb66
SHA2560f28c76f69fa495dcfae94feddd39004dfec01650aaae96a68c692e1181d8b7b
SHA512e745451f6622a2ad3ae1582c0e3bbb5e183c442572b1173d8affcce76d776116a7f21189667e70fe9ca1f0f8f307f6259bf4b151dde31d07b4268bfa4694dfe6
-
Filesize
289B
MD5343cf231bf640aee5079dafeac910456
SHA1986593eb26aac8592140bc47a677d3a849fd37c6
SHA256e191e18d1f27b1312b9f9599867b4b2bd99ede3af66b50cf91c45300ca49740c
SHA512308507c924fffa902a70343730c416c2d5e19e2958326a90640893a9559ba1e894d17f2e44dcb0b1d9b3b2dd3e3c0e5b9d13c659b90238fc4d497cccd1ca1185
-
Filesize
1.1MB
MD5ca6bfdd9be1e0ac6942257618e7ada23
SHA1b8d958a5f132f5bec257732f51b63cda382f5214
SHA256c305a5fe975d4baa9031d96557491f458315438e222f7b060a3d38104edd6045
SHA5122e9c6eb2c41429a887feb1442a319353e03fd0b9f023c53b4c5406fb975326ee4a8afa783c7a255e16ea91ce9095df7e6c4dd9acf34cd51688bee9246f06db03
-
Filesize
129B
MD54d1ce27e8b7f844744c4e993e80709df
SHA187bbc9d5d5a13aa894b6b427b3aff32dc0f6c363
SHA256904dbc710094f402f50e7717edbf28a1579adceb8d1605dd111cd5d6cc2e9154
SHA51208e104d4a7efcfb201d129adbfa146f44caae4e1848eeb00da921a534f4f9df3ef83883fb8ee829c7e24d0a2cc9f3fa760e796b93d6102ac1d80ac320de5b6f8
-
Filesize
14KB
MD5294e9f64cb1642dd89229fff0592856b
SHA197b148c27f3da29ba7b18d6aee8a0db9102f47c9
SHA256917e115cc403e29b4388e0d175cbfac3e7e40ca1742299fbdb353847db2de7c2
SHA512b87d531890bf1577b9b4af41dddb2cdbbfa164cf197bd5987df3a3075983645a3acba443e289b7bfd338422978a104f55298fbfe346872de0895bde44adc89cf