f28599b06560617bccdfb56acc841f3e642ff51b9956632fcc4204f026711e23

Analysis

max time kernel
130s
max time network
155s
platform
windows10-1703_x64
resource
win10-20240611-en
resource tags

arch:x64arch:x86image:win10-20240611-enlocale:en-usos:windows10-1703-x64system
submitted
14-07-2024 13:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1.exe
Size

146KB
MD5

314275168bf7958219662a242dbfe8a7
SHA1

d629032d9d8f491d133ee26a230c393335d7ad74
SHA256

f28599b06560617bccdfb56acc841f3e642ff51b9956632fcc4204f026711e23
SHA512

b5246db461ee78d622a33a758b3d178208b88e0b9e98185f17ee95f2fbbcf66b1059afece1dd5b586d01587bc01662491a6baab208b9836d4b4b9efc55f14c2f
SSDEEP

3072:V6glyuxE4GsUPnliByocWepo2NVLiguo/pyEwUSx:V6gDBGpvEByocWeauV2gvzwUA

Score

10^/10

ransomware spyware stealer

Malware Config

Extracted

Path

C:\7V7uPExzv.README.txt

Ransom Note

~~~NULLBULGE LOCK - BASED ON LOCKBIT~~~ >>>> Your data is encrypted... but dont freak out If we encrypted you, you majorly fucked up. But... all can be saved But not for free, we require an xmr payment >>>> What guarantees that we will not deceive you? We are not a politically motivated group and we do not need anything other than your money. If you pay, we will provide you the programs for decryption. Life is too short to be sad. Dont be sad money is only paper. Your files are more important than paper right? If we do not give you decrypter then nobody will pay us in the future. To us, our reputation is very important. There is no dissatisfied victim after payment. >>>> You may contact us and decrypt one file for free on these TOR sites with your personal DECRYPTION ID Download and install TOR Browser https://www.torproject.org/ Write to a chat and wait for the answer, we will always answer you. Sometimes you will need to wait a while Links for Tor Browser: http://nullblgtk7dwzpfklgktzll27ovvnj7pvqkoprmhubnnb32qcbmcpgid.onion/ Link for the normal browser http://group.goocasino.org https://nullbulge.com >>>> Your personal DECRYPTION ID: 217B9D5D58C4AD3CB4B839FB912D32A9 >>>> Warning! Do not DELETE or MODIFY any files, it can lead to recovery problems!

URLs

http://nullblgtk7dwzpfklgktzll27ovvnj7pvqkoprmhubnnb32qcbmcpgid.onion/

http://group.goocasino.org

https://nullbulge.com

Signatures

Renames multiple (482) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Deletes itself 1 IoCs

Processes:

50AC.tmp

pid	Process
3264	50AC.tmp

Executes dropped EXE 1 IoCs

Processes:

50AC.tmp

pid	Process
3264	50AC.tmp

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Drops desktop.ini file(s) 2 IoCs

Processes:

1.exe

description	ioc	Process
File opened for modification	C:\$Recycle.Bin\S-1-5-21-1453213197-474736321-1741884505-1000\desktop.ini	1.exe
File opened for modification	F:\$RECYCLE.BIN\S-1-5-21-1453213197-474736321-1741884505-1000\desktop.ini	1.exe

Drops file in System32 directory 4 IoCs

Processes:

printfilterpipelinesvc.exesplwow64.exe

description	ioc	Process
File created	C:\Windows\system32\spool\PRINTERS\PPcp04g2kzhbec_cj80b52plb3.TMP	printfilterpipelinesvc.exe
File created	C:\Windows\system32\spool\PRINTERS\00002.SPL	splwow64.exe
File created	C:\Windows\system32\spool\PRINTERS\PPueki0g7up6vreray49cs93xrb.TMP	printfilterpipelinesvc.exe
File created	C:\Windows\system32\spool\PRINTERS\PPt3jthnmhdc3lmxeg6t7zqct0d.TMP	printfilterpipelinesvc.exe

Sets desktop wallpaper using registry 2 TTPs 2 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

Processes:

1.exe

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000\Control Panel\Desktop\WallPaper = "C:\\ProgramData\\7V7uPExzv.bmp"	1.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000\Control Panel\Desktop\Wallpaper = "C:\\ProgramData\\7V7uPExzv.bmp"	1.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 5 IoCs

Processes:

1.exe50AC.tmp

pid	Process
4152	1.exe
4152	1.exe
4152	1.exe
4152	1.exe
3264	50AC.tmp

Drops file in Windows directory 1 IoCs

Processes:

svchost.exe

description	ioc	Process
File opened for modification	C:\Windows\Debug\ESE.TXT	svchost.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

ONENOTE.EXE

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	ONENOTE.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ONENOTE.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	ONENOTE.EXE

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

ONENOTE.EXE

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	ONENOTE.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	ONENOTE.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	ONENOTE.EXE

Modifies Control Panel 2 IoCs

evasion

Processes:

1.exe

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000\Control Panel\Desktop	1.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000\Control Panel\Desktop\WallpaperStyle = "10"	1.exe

Modifies registry class 5 IoCs

Processes:

1.exe

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\7V7uPExzv	1.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\7V7uPExzv\DefaultIcon\ = "C:\\ProgramData\\7V7uPExzv.ico"	1.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.7V7uPExzv	1.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.7V7uPExzv\ = "7V7uPExzv"	1.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\7V7uPExzv\DefaultIcon	1.exe

Suspicious behavior: EnumeratesProcesses 30 IoCs

Processes:

1.exeONENOTE.EXE

pid	Process
4152	1.exe
4152	1.exe
4152	1.exe
4152	1.exe
4152	1.exe
4152	1.exe
4152	1.exe
4152	1.exe
4152	1.exe
4152	1.exe
4152	1.exe
4152	1.exe
4152	1.exe
4152	1.exe
4152	1.exe
4152	1.exe
4152	1.exe
4152	1.exe
4152	1.exe
4152	1.exe
4152	1.exe
4152	1.exe
4152	1.exe
4152	1.exe
4152	1.exe
4152	1.exe
4152	1.exe
4152	1.exe
4784	ONENOTE.EXE
4784	ONENOTE.EXE

Suspicious behavior: RenamesItself 26 IoCs

Processes:

50AC.tmp

pid	Process
3264	50AC.tmp
3264	50AC.tmp
3264	50AC.tmp
3264	50AC.tmp
3264	50AC.tmp
3264	50AC.tmp
3264	50AC.tmp
3264	50AC.tmp
3264	50AC.tmp
3264	50AC.tmp
3264	50AC.tmp
3264	50AC.tmp
3264	50AC.tmp
3264	50AC.tmp
3264	50AC.tmp
3264	50AC.tmp
3264	50AC.tmp
3264	50AC.tmp
3264	50AC.tmp
3264	50AC.tmp
3264	50AC.tmp
3264	50AC.tmp
3264	50AC.tmp
3264	50AC.tmp
3264	50AC.tmp
3264	50AC.tmp

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

1.exe

description	pid	Process
Token: SeAssignPrimaryTokenPrivilege	4152	1.exe
Token: SeBackupPrivilege	4152	1.exe
Token: SeDebugPrivilege	4152	1.exe
Token: 36	4152	1.exe
Token: SeImpersonatePrivilege	4152	1.exe
Token: SeIncBasePriorityPrivilege	4152	1.exe
Token: SeIncreaseQuotaPrivilege	4152	1.exe
Token: 33	4152	1.exe
Token: SeManageVolumePrivilege	4152	1.exe
Token: SeProfSingleProcessPrivilege	4152	1.exe
Token: SeRestorePrivilege	4152	1.exe
Token: SeSecurityPrivilege	4152	1.exe
Token: SeSystemProfilePrivilege	4152	1.exe
Token: SeTakeOwnershipPrivilege	4152	1.exe
Token: SeShutdownPrivilege	4152	1.exe
Token: SeDebugPrivilege	4152	1.exe
Token: SeBackupPrivilege	4152	1.exe
Token: SeBackupPrivilege	4152	1.exe
Token: SeSecurityPrivilege	4152	1.exe
Token: SeSecurityPrivilege	4152	1.exe
Token: SeBackupPrivilege	4152	1.exe
Token: SeBackupPrivilege	4152	1.exe
Token: SeSecurityPrivilege	4152	1.exe
Token: SeSecurityPrivilege	4152	1.exe
Token: SeBackupPrivilege	4152	1.exe
Token: SeBackupPrivilege	4152	1.exe
Token: SeSecurityPrivilege	4152	1.exe
Token: SeSecurityPrivilege	4152	1.exe
Token: SeBackupPrivilege	4152	1.exe
Token: SeBackupPrivilege	4152	1.exe
Token: SeSecurityPrivilege	4152	1.exe
Token: SeSecurityPrivilege	4152	1.exe
Token: SeBackupPrivilege	4152	1.exe
Token: SeBackupPrivilege	4152	1.exe
Token: SeSecurityPrivilege	4152	1.exe
Token: SeSecurityPrivilege	4152	1.exe
Token: SeBackupPrivilege	4152	1.exe
Token: SeBackupPrivilege	4152	1.exe
Token: SeSecurityPrivilege	4152	1.exe
Token: SeSecurityPrivilege	4152	1.exe
Token: SeBackupPrivilege	4152	1.exe
Token: SeBackupPrivilege	4152	1.exe
Token: SeSecurityPrivilege	4152	1.exe
Token: SeSecurityPrivilege	4152	1.exe
Token: SeBackupPrivilege	4152	1.exe
Token: SeBackupPrivilege	4152	1.exe
Token: SeSecurityPrivilege	4152	1.exe
Token: SeSecurityPrivilege	4152	1.exe
Token: SeBackupPrivilege	4152	1.exe
Token: SeBackupPrivilege	4152	1.exe
Token: SeSecurityPrivilege	4152	1.exe
Token: SeSecurityPrivilege	4152	1.exe
Token: SeBackupPrivilege	4152	1.exe
Token: SeBackupPrivilege	4152	1.exe
Token: SeSecurityPrivilege	4152	1.exe
Token: SeSecurityPrivilege	4152	1.exe
Token: SeBackupPrivilege	4152	1.exe
Token: SeBackupPrivilege	4152	1.exe
Token: SeSecurityPrivilege	4152	1.exe
Token: SeSecurityPrivilege	4152	1.exe
Token: SeBackupPrivilege	4152	1.exe
Token: SeBackupPrivilege	4152	1.exe
Token: SeSecurityPrivilege	4152	1.exe
Token: SeSecurityPrivilege	4152	1.exe

Suspicious use of SetWindowsHookEx 13 IoCs

Processes:

ONENOTE.EXE

pid	Process
4784	ONENOTE.EXE
4784	ONENOTE.EXE
4784	ONENOTE.EXE
4784	ONENOTE.EXE
4784	ONENOTE.EXE
4784	ONENOTE.EXE
4784	ONENOTE.EXE
4784	ONENOTE.EXE
4784	ONENOTE.EXE
4784	ONENOTE.EXE
4784	ONENOTE.EXE
4784	ONENOTE.EXE
4784	ONENOTE.EXE

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

1.exeprintfilterpipelinesvc.exe50AC.tmp

description	pid	Process	procid_target
PID 4152 wrote to memory of 4912	4152	1.exe	75
PID 4152 wrote to memory of 4912	4152	1.exe	75
PID 196 wrote to memory of 4784	196	printfilterpipelinesvc.exe	77
PID 196 wrote to memory of 4784	196	printfilterpipelinesvc.exe	77
PID 4152 wrote to memory of 3264	4152	1.exe	78
PID 4152 wrote to memory of 3264	4152	1.exe	78
PID 4152 wrote to memory of 3264	4152	1.exe	78
PID 4152 wrote to memory of 3264	4152	1.exe	78
PID 3264 wrote to memory of 4916	3264	50AC.tmp	79
PID 3264 wrote to memory of 4916	3264	50AC.tmp	79
PID 3264 wrote to memory of 4916	3264	50AC.tmp	79

C:\Users\Admin\AppData\Local\Temp\1.exe
"C:\Users\Admin\AppData\Local\Temp\1.exe"
1⤵
- Drops desktop.ini file(s)
- Sets desktop wallpaper using registry
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Modifies Control Panel
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4152
- C:\Windows\splwow64.exe
  C:\Windows\splwow64.exe 12288
  2⤵
  - Drops file in System32 directory
  PID:4912
- C:\ProgramData\50AC.tmp
  "C:\ProgramData\50AC.tmp"
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious behavior: RenamesItself
  - Suspicious use of WriteProcessMemory
  PID:3264
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /C DEL /F /Q C:\PROGRA~3\50AC.tmp >> NUL
    3⤵
    PID:4916

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k appmodel -s tiledatamodelsvc
1⤵
- Drops file in Windows directory
PID:4628

C:\Windows\system32\printfilterpipelinesvc.exe
C:\Windows\system32\printfilterpipelinesvc.exe -Embedding
1⤵
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:196
- C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE
  /insertdoc "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\{BC084088-BCC3-44F6-A73E-3AF1AE788A2C}.xps" 133654372105730000
  2⤵
  - Checks processor information in registry
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  PID:4784

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Defacement

T1491

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-1453213197-474736321-1741884505-1000\FFFFFFFFFFF

Filesize
129B

MD5
9937c7fc001d7724ca831c3d267e2aa5

SHA1
9b1e7847c382971a1d7534cefbbb75322b30ff09

SHA256
c0d6ab687e5255c653d4a2bdb72a999690ec3f5cd33f573ca39f4617e32ad397

SHA512
18d9ac53d9c2cf48b6e43769e84a9b653f89b5a1f8bd0b1b35b282a0129217be6d472850e97611123fc3058910f5f50ceb98bcb90a1385b573d52f62c73cb369

Download Submit
C:\7V7uPExzv.README.txt

Filesize
1KB

MD5
8756c5a772561e83aaefc0c8df79b3e9

SHA1
56ec4d0587b456242b40cd36bf5be897bfc3fb3a

SHA256
2d0bc953a7d52bd2a77bd67b2445bad73b28cd23a9ee0a6b78df636a90b6e50f

SHA512
04357418b0f84d80535d8bc7a07aedbc86c4b6f63fc3133ea98f1b1860ddb748153da899c7776f251f2b0a6d6a1f174d90ceb4ddd5143817f1ed4981db055e0f

Download Submit
C:\ProgramData\50AC.tmp

Filesize
14KB

MD5
294e9f64cb1642dd89229fff0592856b

SHA1
97b148c27f3da29ba7b18d6aee8a0db9102f47c9

SHA256
917e115cc403e29b4388e0d175cbfac3e7e40ca1742299fbdb353847db2de7c2

SHA512
b87d531890bf1577b9b4af41dddb2cdbbfa164cf197bd5987df3a3075983645a3acba443e289b7bfd338422978a104f55298fbfe346872de0895bde44adc89cf

Download Submit
C:\Users\Admin\AppData\Local\Temp\EEEEE

Filesize
146KB

MD5
ec48998b331451dad77d73b0206b1431

SHA1
89f72b89f48f4eecde0fdf5c026d39879e0e5ce5

SHA256
0809ab5cb04946f1758133aa9bb5f1d157938c0194db2aa8f69a7a412771b8ca

SHA512
bbed1cac3b70df6fd445473dde70fb0bb333bf22af7fedc45a4d83eef4eadebf379b7f8dae58f43cf16e82f15c905fa8f2fb4c294aef9962ac6b534feabea5e1

Download Submit
C:\Users\Admin\AppData\Local\Temp\{98A6577A-876B-4CAC-8B14-5AD0B4C6AAA8}

Filesize
4KB

MD5
0f12ac875f923962841fcb126d043a51

SHA1
162f4aba23a03549fe903dcf6193c3c68b5d2e63

SHA256
952bf2aa525b259bc3d01984b5b6ae32cdc21eb97b19d91bafd06ea59af837d8

SHA512
d7f8b5e557ed2213b470dcfe775d19b8272b8f9b07b0854ba2d1305b642ded1305eea64cb961698b367dc46aa321ba5b4e3384f115772470c14660030ffff36e

Download Submit
C:\Users\Admin\Documents\OneNote Notebooks\My Notebook\Open Notebook.onetoc2

Filesize
4KB

MD5
57912ec9e0497056337561b42252fb79

SHA1
b3d477ba6f4d21d842f200b618d109b677e60d93

SHA256
34eec49ab553e3ddf9339b0a246b8644f24919caf007b862d9eabe73b8643998

SHA512
f4dc1739ac3b051a602faf8a8cefd5c6d85237b51c0f81d70830a232e65efdbf1e436a88347ef2b0d8e2fc96f2e7d88b6f82f3fbff388f8fa894d46833d40b7b

Download Submit
F:\$RECYCLE.BIN\S-1-5-21-1453213197-474736321-1741884505-1000\DDDDDDDDDDD

Filesize
129B

MD5
19aac490d12f2bc12d72638e3415d29d

SHA1
874847dc6bd04ce92802727d28f8e54ee59a84d8

SHA256
c2b9cc31d72c8eac28d6e463119aed9f500b85f21bf5cef712aa28b1d7056962

SHA512
763840afd2e73a1f843c4bcd9c875b176aafe93b5a0ff3a0fd5309bd241601710ba7498e6911fbc81ba2657105f314523bbbbaf8b9e49b0c6e96601b3bf44b74

Download Submit
memory/4152-2594-0x0000000002E20000-0x0000000002E30000-memory.dmp

Filesize
64KB

Download
memory/4152-2-0x0000000002E20000-0x0000000002E30000-memory.dmp

Filesize
64KB

Download
memory/4152-1-0x0000000002E20000-0x0000000002E30000-memory.dmp

Filesize
64KB

Download
memory/4152-0-0x0000000002E20000-0x0000000002E30000-memory.dmp

Filesize
64KB

Download
memory/4152-2595-0x0000000002E20000-0x0000000002E30000-memory.dmp

Filesize
64KB

Download
memory/4628-2444-0x000001DF5F820000-0x000001DF5F830000-memory.dmp

Filesize
64KB

Download
memory/4628-2593-0x000001DF64450000-0x000001DF64451000-memory.dmp

Filesize
4KB

Download
memory/4628-2577-0x000001DF5FE90000-0x000001DF5FE91000-memory.dmp

Filesize
4KB

Download
memory/4628-2588-0x000001DF5FFF0000-0x000001DF5FFF1000-memory.dmp

Filesize
4KB

Download
memory/4628-2567-0x000001DF5FE10000-0x000001DF5FE11000-memory.dmp

Filesize
4KB

Download
memory/4628-2448-0x000001DF5F860000-0x000001DF5F870000-memory.dmp

Filesize
64KB

Download
memory/4784-2611-0x00007FFA94DE0000-0x00007FFA94DF0000-memory.dmp

Filesize
64KB

Download
memory/4784-2613-0x00007FFA94DE0000-0x00007FFA94DF0000-memory.dmp

Filesize
64KB

Download
memory/4784-2612-0x00007FFA94DE0000-0x00007FFA94DF0000-memory.dmp

Filesize
64KB

Download
memory/4784-2614-0x00007FFA94DE0000-0x00007FFA94DF0000-memory.dmp

Filesize
64KB

Download
memory/4784-2645-0x00007FFA91F60000-0x00007FFA91F70000-memory.dmp

Filesize
64KB

Download
memory/4784-2646-0x00007FFA91F60000-0x00007FFA91F70000-memory.dmp

Filesize
64KB

Download