Analysis
-
max time kernel
95s -
max time network
127s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
14-07-2024 13:25
Behavioral task
behavioral1
Sample
1.exe
Resource
win7-20240704-en
windows7-x64
Behavioral task
behavioral2
Sample
1.exe
Resource
win10-20240611-en
windows10-1703-x64
Behavioral task
behavioral3
Sample
1.exe
Resource
win10v2004-20240709-en
windows10-2004-x64
Behavioral task
behavioral4
Sample
1.exe
Resource
win11-20240709-en
windows11-21h2-x64
General
-
Target
1.exe
-
Size
146KB
-
MD5
314275168bf7958219662a242dbfe8a7
-
SHA1
d629032d9d8f491d133ee26a230c393335d7ad74
-
SHA256
f28599b06560617bccdfb56acc841f3e642ff51b9956632fcc4204f026711e23
-
SHA512
b5246db461ee78d622a33a758b3d178208b88e0b9e98185f17ee95f2fbbcf66b1059afece1dd5b586d01587bc01662491a6baab208b9836d4b4b9efc55f14c2f
-
SSDEEP
3072:V6glyuxE4GsUPnliByocWepo2NVLiguo/pyEwUSx:V6gDBGpvEByocWeauV2gvzwUA
Malware Config
Extracted
C:\7V7uPExzv.README.txt
http://nullblgtk7dwzpfklgktzll27ovvnj7pvqkoprmhubnnb32qcbmcpgid.onion/
http://group.goocasino.org
https://nullbulge.com
Signatures
-
Renames multiple (594) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
B8F1.tmpdescription ioc Process Key value queried \REGISTRY\USER\S-1-5-21-384068567-2943195810-3631207890-1000\Control Panel\International\Geo\Nation B8F1.tmp -
Deletes itself 1 IoCs
Processes:
B8F1.tmppid Process 2796 B8F1.tmp -
Executes dropped EXE 1 IoCs
Processes:
B8F1.tmppid Process 2796 B8F1.tmp -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops desktop.ini file(s) 2 IoCs
Processes:
1.exedescription ioc Process File opened for modification C:\$Recycle.Bin\S-1-5-21-384068567-2943195810-3631207890-1000\desktop.ini 1.exe File opened for modification F:\$RECYCLE.BIN\S-1-5-21-384068567-2943195810-3631207890-1000\desktop.ini 1.exe -
Drops file in System32 directory 4 IoCs
Processes:
splwow64.exeprintfilterpipelinesvc.exedescription ioc Process File created C:\Windows\system32\spool\PRINTERS\00002.SPL splwow64.exe File created C:\Windows\system32\spool\PRINTERS\PPb0q_4oxsktxcvxcx5_4gltuxb.TMP printfilterpipelinesvc.exe File created C:\Windows\system32\spool\PRINTERS\PPgjeoz9p_s8vb2z5c2bo6wgsee.TMP printfilterpipelinesvc.exe File created C:\Windows\system32\spool\PRINTERS\PPzs68224i6abd0bv_pacqqng0b.TMP printfilterpipelinesvc.exe -
Sets desktop wallpaper using registry 2 TTPs 2 IoCs
Processes:
1.exedescription ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-384068567-2943195810-3631207890-1000\Control Panel\Desktop\WallPaper = "C:\\ProgramData\\7V7uPExzv.bmp" 1.exe Set value (str) \REGISTRY\USER\S-1-5-21-384068567-2943195810-3631207890-1000\Control Panel\Desktop\Wallpaper = "C:\\ProgramData\\7V7uPExzv.bmp" 1.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 5 IoCs
Processes:
1.exeB8F1.tmppid Process 3592 1.exe 3592 1.exe 3592 1.exe 3592 1.exe 2796 B8F1.tmp -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
ONENOTE.EXEdescription ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString ONENOTE.EXE Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 ONENOTE.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz ONENOTE.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
ONENOTE.EXEdescription ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS ONENOTE.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily ONENOTE.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU ONENOTE.EXE -
Modifies Control Panel 2 IoCs
Processes:
1.exedescription ioc Process Key created \REGISTRY\USER\S-1-5-21-384068567-2943195810-3631207890-1000\Control Panel\Desktop 1.exe Set value (str) \REGISTRY\USER\S-1-5-21-384068567-2943195810-3631207890-1000\Control Panel\Desktop\WallpaperStyle = "10" 1.exe -
Modifies registry class 6 IoCs
Processes:
1.exeOpenWith.exedescription ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.7V7uPExzv 1.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.7V7uPExzv\ = "7V7uPExzv" 1.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\7V7uPExzv\DefaultIcon 1.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\7V7uPExzv 1.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\7V7uPExzv\DefaultIcon\ = "C:\\ProgramData\\7V7uPExzv.ico" 1.exe Key created \REGISTRY\USER\S-1-5-21-384068567-2943195810-3631207890-1000_Classes\Local Settings OpenWith.exe -
Suspicious behavior: AddClipboardFormatListener 2 IoCs
Processes:
ONENOTE.EXEpid Process 4992 ONENOTE.EXE 4992 ONENOTE.EXE -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
1.exepid Process 3592 1.exe 3592 1.exe 3592 1.exe 3592 1.exe 3592 1.exe 3592 1.exe 3592 1.exe 3592 1.exe 3592 1.exe 3592 1.exe 3592 1.exe 3592 1.exe 3592 1.exe 3592 1.exe 3592 1.exe 3592 1.exe 3592 1.exe 3592 1.exe 3592 1.exe 3592 1.exe 3592 1.exe 3592 1.exe 3592 1.exe 3592 1.exe 3592 1.exe 3592 1.exe 3592 1.exe 3592 1.exe 3592 1.exe 3592 1.exe 3592 1.exe 3592 1.exe 3592 1.exe 3592 1.exe 3592 1.exe 3592 1.exe 3592 1.exe 3592 1.exe 3592 1.exe 3592 1.exe 3592 1.exe 3592 1.exe 3592 1.exe 3592 1.exe 3592 1.exe 3592 1.exe 3592 1.exe 3592 1.exe 3592 1.exe 3592 1.exe 3592 1.exe 3592 1.exe 3592 1.exe 3592 1.exe 3592 1.exe 3592 1.exe 3592 1.exe 3592 1.exe 3592 1.exe 3592 1.exe 3592 1.exe 3592 1.exe 3592 1.exe 3592 1.exe -
Suspicious behavior: RenamesItself 26 IoCs
Processes:
B8F1.tmppid Process 2796 B8F1.tmp 2796 B8F1.tmp 2796 B8F1.tmp 2796 B8F1.tmp 2796 B8F1.tmp 2796 B8F1.tmp 2796 B8F1.tmp 2796 B8F1.tmp 2796 B8F1.tmp 2796 B8F1.tmp 2796 B8F1.tmp 2796 B8F1.tmp 2796 B8F1.tmp 2796 B8F1.tmp 2796 B8F1.tmp 2796 B8F1.tmp 2796 B8F1.tmp 2796 B8F1.tmp 2796 B8F1.tmp 2796 B8F1.tmp 2796 B8F1.tmp 2796 B8F1.tmp 2796 B8F1.tmp 2796 B8F1.tmp 2796 B8F1.tmp 2796 B8F1.tmp -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
1.exedescription pid Process Token: SeAssignPrimaryTokenPrivilege 3592 1.exe Token: SeBackupPrivilege 3592 1.exe Token: SeDebugPrivilege 3592 1.exe Token: 36 3592 1.exe Token: SeImpersonatePrivilege 3592 1.exe Token: SeIncBasePriorityPrivilege 3592 1.exe Token: SeIncreaseQuotaPrivilege 3592 1.exe Token: 33 3592 1.exe Token: SeManageVolumePrivilege 3592 1.exe Token: SeProfSingleProcessPrivilege 3592 1.exe Token: SeRestorePrivilege 3592 1.exe Token: SeSecurityPrivilege 3592 1.exe Token: SeSystemProfilePrivilege 3592 1.exe Token: SeTakeOwnershipPrivilege 3592 1.exe Token: SeShutdownPrivilege 3592 1.exe Token: SeDebugPrivilege 3592 1.exe Token: SeBackupPrivilege 3592 1.exe Token: SeBackupPrivilege 3592 1.exe Token: SeSecurityPrivilege 3592 1.exe Token: SeSecurityPrivilege 3592 1.exe Token: SeBackupPrivilege 3592 1.exe Token: SeBackupPrivilege 3592 1.exe Token: SeSecurityPrivilege 3592 1.exe Token: SeSecurityPrivilege 3592 1.exe Token: SeBackupPrivilege 3592 1.exe Token: SeBackupPrivilege 3592 1.exe Token: SeSecurityPrivilege 3592 1.exe Token: SeSecurityPrivilege 3592 1.exe Token: SeBackupPrivilege 3592 1.exe Token: SeBackupPrivilege 3592 1.exe Token: SeSecurityPrivilege 3592 1.exe Token: SeSecurityPrivilege 3592 1.exe Token: SeBackupPrivilege 3592 1.exe Token: SeBackupPrivilege 3592 1.exe Token: SeSecurityPrivilege 3592 1.exe Token: SeSecurityPrivilege 3592 1.exe Token: SeBackupPrivilege 3592 1.exe Token: SeBackupPrivilege 3592 1.exe Token: SeSecurityPrivilege 3592 1.exe Token: SeSecurityPrivilege 3592 1.exe Token: SeBackupPrivilege 3592 1.exe Token: SeBackupPrivilege 3592 1.exe Token: SeSecurityPrivilege 3592 1.exe Token: SeSecurityPrivilege 3592 1.exe Token: SeBackupPrivilege 3592 1.exe Token: SeBackupPrivilege 3592 1.exe Token: SeSecurityPrivilege 3592 1.exe Token: SeSecurityPrivilege 3592 1.exe Token: SeBackupPrivilege 3592 1.exe Token: SeBackupPrivilege 3592 1.exe Token: SeSecurityPrivilege 3592 1.exe Token: SeSecurityPrivilege 3592 1.exe Token: SeBackupPrivilege 3592 1.exe Token: SeBackupPrivilege 3592 1.exe Token: SeSecurityPrivilege 3592 1.exe Token: SeSecurityPrivilege 3592 1.exe Token: SeBackupPrivilege 3592 1.exe Token: SeBackupPrivilege 3592 1.exe Token: SeSecurityPrivilege 3592 1.exe Token: SeSecurityPrivilege 3592 1.exe Token: SeBackupPrivilege 3592 1.exe Token: SeBackupPrivilege 3592 1.exe Token: SeSecurityPrivilege 3592 1.exe Token: SeSecurityPrivilege 3592 1.exe -
Suspicious use of SetWindowsHookEx 15 IoCs
Processes:
ONENOTE.EXEOpenWith.exepid Process 4992 ONENOTE.EXE 4992 ONENOTE.EXE 4992 ONENOTE.EXE 4992 ONENOTE.EXE 4992 ONENOTE.EXE 4992 ONENOTE.EXE 4992 ONENOTE.EXE 4992 ONENOTE.EXE 4992 ONENOTE.EXE 4992 ONENOTE.EXE 4992 ONENOTE.EXE 4992 ONENOTE.EXE 4992 ONENOTE.EXE 4992 ONENOTE.EXE 2584 OpenWith.exe -
Suspicious use of WriteProcessMemory 11 IoCs
Processes:
1.exeprintfilterpipelinesvc.exeB8F1.tmpdescription pid Process procid_target PID 3592 wrote to memory of 376 3592 1.exe 91 PID 3592 wrote to memory of 376 3592 1.exe 91 PID 3732 wrote to memory of 4992 3732 printfilterpipelinesvc.exe 94 PID 3732 wrote to memory of 4992 3732 printfilterpipelinesvc.exe 94 PID 3592 wrote to memory of 2796 3592 1.exe 95 PID 3592 wrote to memory of 2796 3592 1.exe 95 PID 3592 wrote to memory of 2796 3592 1.exe 95 PID 3592 wrote to memory of 2796 3592 1.exe 95 PID 2796 wrote to memory of 2108 2796 B8F1.tmp 96 PID 2796 wrote to memory of 2108 2796 B8F1.tmp 96 PID 2796 wrote to memory of 2108 2796 B8F1.tmp 96
Processes
-
C:\Users\Admin\AppData\Local\Temp\1.exe"C:\Users\Admin\AppData\Local\Temp\1.exe"1⤵
- Drops desktop.ini file(s)
- Sets desktop wallpaper using registry
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Modifies Control Panel
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3592 -
C:\Windows\splwow64.exeC:\Windows\splwow64.exe 122882⤵
- Drops file in System32 directory
PID:376
-
-
C:\ProgramData\B8F1.tmp"C:\ProgramData\B8F1.tmp"2⤵
- Checks computer location settings
- Deletes itself
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:2796 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C DEL /F /Q C:\PROGRA~3\B8F1.tmp >> NUL3⤵PID:2108
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc1⤵PID:4436
-
C:\Windows\system32\printfilterpipelinesvc.exeC:\Windows\system32\printfilterpipelinesvc.exe -Embedding1⤵
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:3732 -
C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE/insertdoc "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\{DB266294-49BF-47BA-88F3-490A5037D72A}.xps" 1336543718725800002⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:4992
-
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:2584
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
129B
MD593478bca8b903de75c70cb3ae917d135
SHA1fd5f69b6c755a11964e419d80ed52b78223f327f
SHA25624a4ec3bf58824db33c10ce561079f705d127691a37cafccbc20ddab9b5d7971
SHA5126b6872b71656cd2a684ba45041e68bfc3f9e923eb9b94751ac8e2ec49a7beca549533d7b68169f5351d97d68b3a8b6a4356d51531b316023caf8c6784116ad3c
-
Filesize
1KB
MD58387d8c343cb2e7aafd8063e87763dca
SHA124595c6201f015f09ea401b902daf9f36e1cf3e7
SHA256d5a7a86c823bbd526a96c54b5ad9d4233bed5debb94dcd3d45a31af5d383a1f9
SHA5120bf9759bcc6123fa912f4caa21eb5888eeca8921e65455b84da00db75d6d4d388d2606b1c2eb6fa67c9995ea0ebca77381c4e926482aed4abbccd5b3a87f4be4
-
Filesize
14KB
MD5294e9f64cb1642dd89229fff0592856b
SHA197b148c27f3da29ba7b18d6aee8a0db9102f47c9
SHA256917e115cc403e29b4388e0d175cbfac3e7e40ca1742299fbdb353847db2de7c2
SHA512b87d531890bf1577b9b4af41dddb2cdbbfa164cf197bd5987df3a3075983645a3acba443e289b7bfd338422978a104f55298fbfe346872de0895bde44adc89cf
-
Filesize
146KB
MD5463cecb857d2bf46ca5993d3ffffa126
SHA1aa48c27bd0265765c2088de20c3d334ed7c270c4
SHA256e6a9feb12138bb76eef4627894d40d39a3877592956329d5356d04a28797340b
SHA51296167b1673998f4d2dfc45efd64f1fdb9e17104b209c5804deedccbea8531451aed25744c0161fcc12b3fb0c24169491ccc8e361a0c8ce65ba418569daaf08ae
-
Filesize
4KB
MD54e92a931eb3f4fc334d568f26237fadc
SHA1dc09c820fb41d06176d90ed5d585ff8f4f6e7165
SHA2562715fd3eb5d978522a240eb3bdf119b4128db0ccf0335bbdf770884b8a68e20d
SHA512123f8cc7e9f80ad49bcd3a3143fd7db6125531e81d676b20bf9b57d65f57aac928ae9a5ebe077863d20504c144532caca3dedcf4ec28eb405e45a8eacb8f3c2c
-
Filesize
4KB
MD5cbc2c958f17d9f6f4e28a60c627cfc05
SHA1dfbd3ab45a5ac27123fcd1e673ebd88bcf33393e
SHA2565257108315113a29eaee57a5f1afadbb440b7ca0625c86d7eeea3b60c255e84b
SHA5129342b5aff8b56512001a40c5d1320212cd4397b416f0d07370fe8c63c6605f23144c61a87e4821e202ab45f729572157c64c25e8f82e9973f7a1375e5bb18d1f
-
Filesize
129B
MD5210da3e95d222cf358546c86133a012e
SHA1e69d4982aaa5046284c2734449c70ea60c6f6ec1
SHA2566be63f272c22f8917e50c9116dcda75e9e4507a86835e65cdab06b689b12b9a2
SHA5120c937c551cd0c8f821c7231ee3451ba9e7e9665f37f8157c11ea3e9eda41783bbaf1f4aee99bf985c4f7b6c0a24d8a24ebf7de38df5405a89963391ce0523dde