Overview

overview

10

Static

static

10

90fcaf3926...b2.exe

windows7-x64

10

90fcaf3926...b2.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    118s
  • max time network
    118s
  • platform
    windows7_x64
  • resource
    win7-20240708-en
  • resource tags

    arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
  • submitted
    14-07-2024 14:35

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    90fcaf3926265ba790e6245975b3106617b89f4d7fe2a7733a6ecd0f7ac79bb2.exe

  • Size

    146KB

  • MD5

    9c538ff5f541f0e8b9b2cc8386b40c65

  • SHA1

    689fcc9c3a30efe6ff5bee231506bf3c4637e6e8

  • SHA256

    90fcaf3926265ba790e6245975b3106617b89f4d7fe2a7733a6ecd0f7ac79bb2

  • SHA512

    1367c402cab5e89d6863f9dad5faf497d7e15a8ce9a0644c314f523d2435f95286048ef4d87c65096a024c6f4a299049f15d863c30054ef666fa053102c25122

  • SSDEEP

    3072:V6glyuxE4GsUPnliByocWepo2NVLiguo/pyEwUS7:V6gDBGpvEByocWeauV2gvzwUg

Score
10/10
ransomwarespywarestealer

Malware Config

Extracted

Path

C:\7V7uPExzv.README.txt

Ransom Note
~~~NULLBULGE LOCK - BASED ON LOCKBIT~~~ >>>> Your data is encrypted... but dont freak out If we encrypted you, you majorly fucked up. But... all can be saved But not for free, we require an xmr payment >>>> What guarantees that we will not deceive you? We are not a politically motivated group and we do not need anything other than your money. If you pay, we will provide you the programs for decryption. Life is too short to be sad. Dont be sad money is only paper. Your files are more important than paper right? If we do not give you decrypter then nobody will pay us in the future. To us, our reputation is very important. There is no dissatisfied victim after payment. >>>> You may contact us and decrypt one file for free on these TOR sites with your personal DECRYPTION ID Download and install TOR Browser https://www.torproject.org/ Write to a chat and wait for the answer, we will always answer you. Sometimes you will need to wait a while Links for Tor Browser: http://nullblgtk7dwzpfklgktzll27ovvnj7pvqkoprmhubnnb32qcbmcpgid.onion/ Link for the normal browser http://group.goocasino.org https://nullbulge.com >>>> Your personal DECRYPTION ID: 217B9D5D58C4AD3CF1AA322CDD7E2EF8 >>>> Warning! Do not DELETE or MODIFY any files, it can lead to recovery problems!
URLs

http://nullblgtk7dwzpfklgktzll27ovvnj7pvqkoprmhubnnb32qcbmcpgid.onion/

http://group.goocasino.org

https://nullbulge.com

Signatures

  • Renames multiple (354) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware
  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Drops desktop.ini file(s) 2 IoCs
  • Sets desktop wallpaper using registry 2 TTPs 2 IoCs
    ransomware
  • Suspicious use of NtSetInformationThreadHideFromDebugger 5 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies Control Panel 2 IoCs
    evasion
  • Modifies registry class 5 IoCs
  • Suspicious behavior: EnumeratesProcesses 10 IoCs
  • Suspicious behavior: RenamesItself 26 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\90fcaf3926265ba790e6245975b3106617b89f4d7fe2a7733a6ecd0f7ac79bb2.exe
    "C:\Users\Admin\AppData\Local\Temp\90fcaf3926265ba790e6245975b3106617b89f4d7fe2a7733a6ecd0f7ac79bb2.exe"
    1⤵
    • Loads dropped DLL
    • Drops desktop.ini file(s)
    • Sets desktop wallpaper using registry
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Modifies Control Panel
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2180
    • C:\ProgramData\5C62.tmp
      "C:\ProgramData\5C62.tmp"
      2⤵
      • Deletes itself
      • Executes dropped EXE
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • Suspicious behavior: RenamesItself
      • Suspicious use of WriteProcessMemory
      PID:1880
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /C DEL /F /Q C:\PROGRA~3\5C62.tmp >> NUL
        3⤵
          PID:2928
    • C:\Windows\system32\AUDIODG.EXE
      C:\Windows\system32\AUDIODG.EXE 0x14c
      1⤵
        PID:532

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\$Recycle.Bin\S-1-5-21-1506706701-1246725540-2219210854-1000\DDDDDDDDDDD
        Filesize

        129B

        MD5

        d14e1a185385075f4fc3bdc841279df3

        SHA1

        60e09a56dba1f139add205e911815eb1aef8b348

        SHA256

        86e52210f3dca071e1fdf8c07f687de6cd9ec394d0659f00a6052fa005c290ee

        SHA512

        26b14cdc3271128f77e6e75c06aa68e44b023bb4febfa686b6aa54ca041826dc9fc2f608f19c79e90534ffa3403e59a90399dd9489d26ce69cc4825c158ceb75

        Download Submit

      • C:\7V7uPExzv.README.txt
        Filesize

        1KB

        MD5

        fa250f8835f52c6ab97d6ab14cc56661

        SHA1

        fe44968a5b9be57b4e33b2246e7edd02d0b6ecb8

        SHA256

        6a7894a4d8941dcd7d71ae56bda3761e979e1cc5022684681545db12745bcdda

        SHA512

        1e150ab26a77e44105cbacac77ca6448c97fcb7cb608a86cf244af49c5e8efacf6be1cb7350741b7c58422d8a6706a7c0a1007a00f2ab4032e967bcde8691a57

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\DDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDD
        Filesize

        146KB

        MD5

        99f2008c4eb5ac06ca696dd7fe1614c8

        SHA1

        7ec37e2bc88b8ebe6671577908b4238c10d19944

        SHA256

        30fd42a9ead88ca7ce1027ca128ca1e36e83046ada85b0d7657af4a85b2184fd

        SHA512

        d946b4b88b08aa302c16c2d0a5c9c28be9c6d0af23af43398b9b31f6406485559edea4a10baa7f24bcd435ca3857cb45d477c951e47ac917a1551acb4ba95995

        Download Submit

      • F:\$RECYCLE.BIN\S-1-5-21-1506706701-1246725540-2219210854-1000\DDDDDDDDDDD
        Filesize

        129B

        MD5

        b5432e58a94e2bbc5bc669cc24bad57d

        SHA1

        e55e80d407270b7af06da1a84b1018582f5344dd

        SHA256

        c2d0f5dfec3b82a5d16ac194e6864c50a2d62ec72458c4a0eca8f10550f02259

        SHA512

        3e3c2a69c79e1653a5de0f381334c62104a57f4a343556a193233a220231db997caf365103bb443eb7c6291014c4c73f27030d4f00fc017b62ec84339baf1cde

        Download Submit

      • \ProgramData\5C62.tmp
        Filesize

        14KB

        MD5

        294e9f64cb1642dd89229fff0592856b

        SHA1

        97b148c27f3da29ba7b18d6aee8a0db9102f47c9

        SHA256

        917e115cc403e29b4388e0d175cbfac3e7e40ca1742299fbdb353847db2de7c2

        SHA512

        b87d531890bf1577b9b4af41dddb2cdbbfa164cf197bd5987df3a3075983645a3acba443e289b7bfd338422978a104f55298fbfe346872de0895bde44adc89cf

        Download Submit

      • memory/1880-887-0x0000000000401000-0x0000000000404000-memory.dmp

        Filesize

        12KB

        Download

      • memory/1880-889-0x0000000000400000-0x0000000000407000-memory.dmp

        Filesize

        28KB

        Download

      • memory/2180-0-0x0000000000E50000-0x0000000000E90000-memory.dmp

        Filesize

        256KB

        Download