Analysis
-
max time kernel
147s -
max time network
155s -
platform
windows11-21h2_x64 -
resource
win11-20240709-en -
resource tags
arch:x64arch:x86image:win11-20240709-enlocale:en-usos:windows11-21h2-x64system -
submitted
14-07-2024 13:25
Behavioral task
behavioral1
Sample
1.exe
Resource
win7-20240704-en
windows7-x64
Behavioral task
behavioral2
Sample
1.exe
Resource
win10-20240611-en
windows10-1703-x64
Behavioral task
behavioral3
Sample
1.exe
Resource
win10v2004-20240709-en
windows10-2004-x64
Behavioral task
behavioral4
Sample
1.exe
Resource
win11-20240709-en
windows11-21h2-x64
General
-
Target
1.exe
-
Size
146KB
-
MD5
314275168bf7958219662a242dbfe8a7
-
SHA1
d629032d9d8f491d133ee26a230c393335d7ad74
-
SHA256
f28599b06560617bccdfb56acc841f3e642ff51b9956632fcc4204f026711e23
-
SHA512
b5246db461ee78d622a33a758b3d178208b88e0b9e98185f17ee95f2fbbcf66b1059afece1dd5b586d01587bc01662491a6baab208b9836d4b4b9efc55f14c2f
-
SSDEEP
3072:V6glyuxE4GsUPnliByocWepo2NVLiguo/pyEwUSx:V6gDBGpvEByocWeauV2gvzwUA
Malware Config
Extracted
C:\7V7uPExzv.README.txt
http://nullblgtk7dwzpfklgktzll27ovvnj7pvqkoprmhubnnb32qcbmcpgid.onion/
http://group.goocasino.org
https://nullbulge.com
Signatures
-
Renames multiple (506) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Deletes itself 1 IoCs
Processes:
CD05.tmppid Process 1560 CD05.tmp -
Executes dropped EXE 1 IoCs
Processes:
CD05.tmppid Process 1560 CD05.tmp -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops desktop.ini file(s) 2 IoCs
Processes:
1.exedescription ioc Process File opened for modification C:\$Recycle.Bin\S-1-5-21-514081398-208714212-3319599467-1000\desktop.ini 1.exe File opened for modification F:\$RECYCLE.BIN\S-1-5-21-514081398-208714212-3319599467-1000\desktop.ini 1.exe -
Drops file in System32 directory 4 IoCs
Processes:
splwow64.exeprintfilterpipelinesvc.exedescription ioc Process File created C:\Windows\system32\spool\PRINTERS\00002.SPL splwow64.exe File created C:\Windows\system32\spool\PRINTERS\PPt7230fes93n5eb6q7gcmk3eqc.TMP printfilterpipelinesvc.exe File created C:\Windows\system32\spool\PRINTERS\PP9310ic9cramsfueh9e3m4pif.TMP printfilterpipelinesvc.exe File created C:\Windows\system32\spool\PRINTERS\PPryzog3l9rk5xups2i8kf5yne.TMP printfilterpipelinesvc.exe -
Sets desktop wallpaper using registry 2 TTPs 2 IoCs
Processes:
1.exedescription ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-514081398-208714212-3319599467-1000\Control Panel\Desktop\WallPaper = "C:\\ProgramData\\7V7uPExzv.bmp" 1.exe Set value (str) \REGISTRY\USER\S-1-5-21-514081398-208714212-3319599467-1000\Control Panel\Desktop\Wallpaper = "C:\\ProgramData\\7V7uPExzv.bmp" 1.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 5 IoCs
Processes:
1.exeCD05.tmppid Process 5644 1.exe 5644 1.exe 5644 1.exe 5644 1.exe 1560 CD05.tmp -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
ONENOTE.EXEdescription ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz ONENOTE.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString ONENOTE.EXE Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 ONENOTE.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
ONENOTE.EXEdescription ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS ONENOTE.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily ONENOTE.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU ONENOTE.EXE -
Modifies Control Panel 2 IoCs
Processes:
1.exedescription ioc Process Key created \REGISTRY\USER\S-1-5-21-514081398-208714212-3319599467-1000\Control Panel\Desktop 1.exe Set value (str) \REGISTRY\USER\S-1-5-21-514081398-208714212-3319599467-1000\Control Panel\Desktop\WallpaperStyle = "10" 1.exe -
Modifies registry class 5 IoCs
Processes:
1.exedescription ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.7V7uPExzv 1.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.7V7uPExzv\ = "7V7uPExzv" 1.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\7V7uPExzv\DefaultIcon 1.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\7V7uPExzv 1.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\7V7uPExzv\DefaultIcon\ = "C:\\ProgramData\\7V7uPExzv.ico" 1.exe -
Suspicious behavior: AddClipboardFormatListener 2 IoCs
Processes:
ONENOTE.EXEpid Process 2816 ONENOTE.EXE 2816 ONENOTE.EXE -
Suspicious behavior: EnumeratesProcesses 60 IoCs
Processes:
1.exeONENOTE.EXEpid Process 5644 1.exe 5644 1.exe 5644 1.exe 5644 1.exe 5644 1.exe 5644 1.exe 5644 1.exe 5644 1.exe 5644 1.exe 5644 1.exe 5644 1.exe 5644 1.exe 5644 1.exe 5644 1.exe 5644 1.exe 5644 1.exe 5644 1.exe 5644 1.exe 5644 1.exe 5644 1.exe 5644 1.exe 5644 1.exe 5644 1.exe 5644 1.exe 5644 1.exe 5644 1.exe 5644 1.exe 5644 1.exe 5644 1.exe 5644 1.exe 5644 1.exe 5644 1.exe 5644 1.exe 5644 1.exe 5644 1.exe 5644 1.exe 5644 1.exe 5644 1.exe 5644 1.exe 5644 1.exe 5644 1.exe 5644 1.exe 5644 1.exe 5644 1.exe 5644 1.exe 5644 1.exe 5644 1.exe 5644 1.exe 5644 1.exe 5644 1.exe 5644 1.exe 5644 1.exe 5644 1.exe 5644 1.exe 5644 1.exe 5644 1.exe 5644 1.exe 5644 1.exe 2816 ONENOTE.EXE 2816 ONENOTE.EXE -
Suspicious behavior: RenamesItself 26 IoCs
Processes:
CD05.tmppid Process 1560 CD05.tmp 1560 CD05.tmp 1560 CD05.tmp 1560 CD05.tmp 1560 CD05.tmp 1560 CD05.tmp 1560 CD05.tmp 1560 CD05.tmp 1560 CD05.tmp 1560 CD05.tmp 1560 CD05.tmp 1560 CD05.tmp 1560 CD05.tmp 1560 CD05.tmp 1560 CD05.tmp 1560 CD05.tmp 1560 CD05.tmp 1560 CD05.tmp 1560 CD05.tmp 1560 CD05.tmp 1560 CD05.tmp 1560 CD05.tmp 1560 CD05.tmp 1560 CD05.tmp 1560 CD05.tmp 1560 CD05.tmp -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
1.exedescription pid Process Token: SeAssignPrimaryTokenPrivilege 5644 1.exe Token: SeBackupPrivilege 5644 1.exe Token: SeDebugPrivilege 5644 1.exe Token: 36 5644 1.exe Token: SeImpersonatePrivilege 5644 1.exe Token: SeIncBasePriorityPrivilege 5644 1.exe Token: SeIncreaseQuotaPrivilege 5644 1.exe Token: 33 5644 1.exe Token: SeManageVolumePrivilege 5644 1.exe Token: SeProfSingleProcessPrivilege 5644 1.exe Token: SeRestorePrivilege 5644 1.exe Token: SeSecurityPrivilege 5644 1.exe Token: SeSystemProfilePrivilege 5644 1.exe Token: SeTakeOwnershipPrivilege 5644 1.exe Token: SeShutdownPrivilege 5644 1.exe Token: SeDebugPrivilege 5644 1.exe Token: SeBackupPrivilege 5644 1.exe Token: SeBackupPrivilege 5644 1.exe Token: SeSecurityPrivilege 5644 1.exe Token: SeSecurityPrivilege 5644 1.exe Token: SeBackupPrivilege 5644 1.exe Token: SeBackupPrivilege 5644 1.exe Token: SeSecurityPrivilege 5644 1.exe Token: SeSecurityPrivilege 5644 1.exe Token: SeBackupPrivilege 5644 1.exe Token: SeBackupPrivilege 5644 1.exe Token: SeSecurityPrivilege 5644 1.exe Token: SeSecurityPrivilege 5644 1.exe Token: SeBackupPrivilege 5644 1.exe Token: SeBackupPrivilege 5644 1.exe Token: SeSecurityPrivilege 5644 1.exe Token: SeSecurityPrivilege 5644 1.exe Token: SeBackupPrivilege 5644 1.exe Token: SeBackupPrivilege 5644 1.exe Token: SeSecurityPrivilege 5644 1.exe Token: SeSecurityPrivilege 5644 1.exe Token: SeBackupPrivilege 5644 1.exe Token: SeBackupPrivilege 5644 1.exe Token: SeSecurityPrivilege 5644 1.exe Token: SeSecurityPrivilege 5644 1.exe Token: SeBackupPrivilege 5644 1.exe Token: SeBackupPrivilege 5644 1.exe Token: SeSecurityPrivilege 5644 1.exe Token: SeSecurityPrivilege 5644 1.exe Token: SeBackupPrivilege 5644 1.exe Token: SeBackupPrivilege 5644 1.exe Token: SeSecurityPrivilege 5644 1.exe Token: SeSecurityPrivilege 5644 1.exe Token: SeBackupPrivilege 5644 1.exe Token: SeBackupPrivilege 5644 1.exe Token: SeSecurityPrivilege 5644 1.exe Token: SeSecurityPrivilege 5644 1.exe Token: SeBackupPrivilege 5644 1.exe Token: SeBackupPrivilege 5644 1.exe Token: SeSecurityPrivilege 5644 1.exe Token: SeSecurityPrivilege 5644 1.exe Token: SeBackupPrivilege 5644 1.exe Token: SeBackupPrivilege 5644 1.exe Token: SeSecurityPrivilege 5644 1.exe Token: SeSecurityPrivilege 5644 1.exe Token: SeBackupPrivilege 5644 1.exe Token: SeBackupPrivilege 5644 1.exe Token: SeSecurityPrivilege 5644 1.exe Token: SeSecurityPrivilege 5644 1.exe -
Suspicious use of SetWindowsHookEx 14 IoCs
Processes:
ONENOTE.EXEpid Process 2816 ONENOTE.EXE 2816 ONENOTE.EXE 2816 ONENOTE.EXE 2816 ONENOTE.EXE 2816 ONENOTE.EXE 2816 ONENOTE.EXE 2816 ONENOTE.EXE 2816 ONENOTE.EXE 2816 ONENOTE.EXE 2816 ONENOTE.EXE 2816 ONENOTE.EXE 2816 ONENOTE.EXE 2816 ONENOTE.EXE 2816 ONENOTE.EXE -
Suspicious use of WriteProcessMemory 11 IoCs
Processes:
1.exeprintfilterpipelinesvc.exeCD05.tmpdescription pid Process procid_target PID 5644 wrote to memory of 5280 5644 1.exe 80 PID 5644 wrote to memory of 5280 5644 1.exe 80 PID 2304 wrote to memory of 2816 2304 printfilterpipelinesvc.exe 83 PID 2304 wrote to memory of 2816 2304 printfilterpipelinesvc.exe 83 PID 5644 wrote to memory of 1560 5644 1.exe 84 PID 5644 wrote to memory of 1560 5644 1.exe 84 PID 5644 wrote to memory of 1560 5644 1.exe 84 PID 5644 wrote to memory of 1560 5644 1.exe 84 PID 1560 wrote to memory of 2852 1560 CD05.tmp 85 PID 1560 wrote to memory of 2852 1560 CD05.tmp 85 PID 1560 wrote to memory of 2852 1560 CD05.tmp 85
Processes
-
C:\Users\Admin\AppData\Local\Temp\1.exe"C:\Users\Admin\AppData\Local\Temp\1.exe"1⤵
- Drops desktop.ini file(s)
- Sets desktop wallpaper using registry
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Modifies Control Panel
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5644 -
C:\Windows\splwow64.exeC:\Windows\splwow64.exe 122882⤵
- Drops file in System32 directory
PID:5280
-
-
C:\ProgramData\CD05.tmp"C:\ProgramData\CD05.tmp"2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:1560 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C DEL /F /Q C:\PROGRA~3\CD05.tmp >> NUL3⤵PID:2852
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc1⤵PID:4720
-
C:\Windows\system32\printfilterpipelinesvc.exeC:\Windows\system32\printfilterpipelinesvc.exe -Embedding1⤵
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:2304 -
C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE/insertdoc "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\{DE54664E-E0C5-4908-8135-5359BE4BC89B}.xps" 1336543719430600002⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2816
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
129B
MD523fc60e6fbf4c93cc695843bc49d3a55
SHA13a61f7ec9af1312f50174f327075319e9dbd8277
SHA256d365fb861bb9dc5fb3d2ca977a0c73c110167fb104ac4fd8c02221f65b75060e
SHA512b222f266f5d83f55ba3e89b8c7425330055f3ab55af441224ea12abe971fa91eab9aafcfebe3ac13d18f7ba3b0e9be341bd6dc6fef31625892063828bc226b26
-
Filesize
1KB
MD5ab429b52b0ffbb47d164ce5339cfbc5e
SHA152aa00dac6eaf0965f90989b0e3559e27c346c12
SHA25672a77b9f3f19cf07d8e2fa9c252f06c85b83a618504a938bda1197a1a86ac82f
SHA51269f3b97d9157275bbe6f96752fba0aaedcc7b19bf9faadd15e9a4830099980a48f7cb3cc266f271d7ae54365c191d4f550e7eac1f9d545573b833895115e4d35
-
Filesize
14KB
MD5294e9f64cb1642dd89229fff0592856b
SHA197b148c27f3da29ba7b18d6aee8a0db9102f47c9
SHA256917e115cc403e29b4388e0d175cbfac3e7e40ca1742299fbdb353847db2de7c2
SHA512b87d531890bf1577b9b4af41dddb2cdbbfa164cf197bd5987df3a3075983645a3acba443e289b7bfd338422978a104f55298fbfe346872de0895bde44adc89cf
-
Filesize
146KB
MD542ffcae01e9acb467d9803b77d04816b
SHA125bab68af73846413f934294389c2e16cdf92df5
SHA256865e0da9d0bdbdc3ece9ce3f9a4b9091a2a6b939e67fb6ad3f382e3945c00cf0
SHA512759a600c6f59703cd9db5cc4fb1004aeb9e649a884bdb102a211ba4ebd91b21f24b171b7ff6993c1fe102d4ff700251d9fdfe5c5a85ec69d746258abfdab7530
-
Filesize
4KB
MD50e2c27c4a0c906592c072a2abed50872
SHA1eac450c261789f56cf40fb77b028b4660dadedd6
SHA25603542b1e90f7c1c23e52a0dc7a87ef6a7ce00507addd7f746c61b3429c46398f
SHA512066662c1822d29770c23ee0f992e18186140b85a03d11a8268a208859bee21bbf194988f2e9bb3839f9c4fc395668c6e950830c6759b309c2298cd19197b76aa
-
Filesize
4KB
MD5cb53223a8520b33657c7a3a47fcb65f5
SHA14144c6d84cf629c5c4f90d01fab0fd24674889a4
SHA256387a3f0c3b8882b98677f0a8b1510896837bc90c25f0c5d94bc7407de4d73c04
SHA512f332db3f532370c3797f86bf0439c8ddc1c29eb861fc3fe012a14a66a3a48a12e35744a1c1af01c7cae29bbecd4aeb5f36e53212c50ea7a5a91358861881d722
-
Filesize
4KB
MD550098f337b00327af9e7bc4272ca092c
SHA1ce615b15b381b4d1e5062c03214a9ed609d34b26
SHA25639a4d2c8460bf77441ff2c6a48e573e3c62a276020c7e3f1d989f9b753684fc5
SHA512beaa3629e825331b3cf24a7db9fa5d6b3448c57ba2f890a397b4f0b88a8c51db1e9ef62c26f234fb5463adce2cb2c35e14aa874fd60802c8e7cacaa75084d185
-
Filesize
129B
MD582ec81a69503c868b77339fdebe4bc23
SHA1a51c86ac5fc8ab5631a56e100d7fdca387baad36
SHA256c2d2fe5fcad29db7d5be9990231b45e52a511704ec9e3a84d22fe6b184be40d8
SHA51255cb5fe55b827200fa85b60b1c9008d039ceb37a82dad7239e0a1150181d06e672f19977d955afcfb51d2dafd8f9c105ad0ac7e1ad5f48fe1631a1b3680f2041