Overview

overview

10

Static

static

10

90fcaf3926...b2.exe

windows7-x64

10

90fcaf3926...b2.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    148s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240709-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
  • submitted
    14-07-2024 14:35

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    90fcaf3926265ba790e6245975b3106617b89f4d7fe2a7733a6ecd0f7ac79bb2.exe

  • Size

    146KB

  • MD5

    9c538ff5f541f0e8b9b2cc8386b40c65

  • SHA1

    689fcc9c3a30efe6ff5bee231506bf3c4637e6e8

  • SHA256

    90fcaf3926265ba790e6245975b3106617b89f4d7fe2a7733a6ecd0f7ac79bb2

  • SHA512

    1367c402cab5e89d6863f9dad5faf497d7e15a8ce9a0644c314f523d2435f95286048ef4d87c65096a024c6f4a299049f15d863c30054ef666fa053102c25122

  • SSDEEP

    3072:V6glyuxE4GsUPnliByocWepo2NVLiguo/pyEwUS7:V6gDBGpvEByocWeauV2gvzwUg

Score
10/10
ransomwarespywarestealer

Malware Config

Extracted

Path

C:\7V7uPExzv.README.txt

Ransom Note
~~~NULLBULGE LOCK - BASED ON LOCKBIT~~~ >>>> Your data is encrypted... but dont freak out If we encrypted you, you majorly fucked up. But... all can be saved But not for free, we require an xmr payment >>>> What guarantees that we will not deceive you? We are not a politically motivated group and we do not need anything other than your money. If you pay, we will provide you the programs for decryption. Life is too short to be sad. Dont be sad money is only paper. Your files are more important than paper right? If we do not give you decrypter then nobody will pay us in the future. To us, our reputation is very important. There is no dissatisfied victim after payment. >>>> You may contact us and decrypt one file for free on these TOR sites with your personal DECRYPTION ID Download and install TOR Browser https://www.torproject.org/ Write to a chat and wait for the answer, we will always answer you. Sometimes you will need to wait a while Links for Tor Browser: http://nullblgtk7dwzpfklgktzll27ovvnj7pvqkoprmhubnnb32qcbmcpgid.onion/ Link for the normal browser http://group.goocasino.org https://nullbulge.com >>>> Your personal DECRYPTION ID: 217B9D5D58C4AD3C97741A9AED537439 >>>> Warning! Do not DELETE or MODIFY any files, it can lead to recovery problems!
URLs

http://nullblgtk7dwzpfklgktzll27ovvnj7pvqkoprmhubnnb32qcbmcpgid.onion/

http://group.goocasino.org

https://nullbulge.com

Signatures

  • Renames multiple (627) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Drops desktop.ini file(s) 2 IoCs
  • Drops file in System32 directory 4 IoCs
  • Sets desktop wallpaper using registry 2 TTPs 2 IoCs
    ransomware
  • Suspicious use of NtSetInformationThreadHideFromDebugger 5 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies Control Panel 2 IoCs
    evasion
  • Modifies registry class 5 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: RenamesItself 26 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of SetWindowsHookEx 13 IoCs
  • Suspicious use of WriteProcessMemory 11 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\90fcaf3926265ba790e6245975b3106617b89f4d7fe2a7733a6ecd0f7ac79bb2.exe
    "C:\Users\Admin\AppData\Local\Temp\90fcaf3926265ba790e6245975b3106617b89f4d7fe2a7733a6ecd0f7ac79bb2.exe"
    1⤵
    • Drops desktop.ini file(s)
    • Sets desktop wallpaper using registry
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Modifies Control Panel
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4568
    • C:\Windows\splwow64.exe
      C:\Windows\splwow64.exe 12288
      2⤵
      • Drops file in System32 directory
      PID:3496
    • C:\ProgramData\C42C.tmp
      "C:\ProgramData\C42C.tmp"
      2⤵
      • Checks computer location settings
      • Deletes itself
      • Executes dropped EXE
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • Suspicious behavior: RenamesItself
      • Suspicious use of WriteProcessMemory
      PID:5116
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /C DEL /F /Q C:\PROGRA~3\C42C.tmp >> NUL
        3⤵
          PID:4796
    • C:\Windows\system32\svchost.exe
      C:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc
      1⤵
        PID:512
      • C:\Windows\system32\printfilterpipelinesvc.exe
        C:\Windows\system32\printfilterpipelinesvc.exe -Embedding
        1⤵
        • Drops file in System32 directory
        • Suspicious use of WriteProcessMemory
        PID:3688
        • C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE
          /insertdoc "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\{B5AC06B1-716D-496B-A2AC-5858A992B43E}.xps" 133654413719700000
          2⤵
          • Checks processor information in registry
          • Enumerates system info in registry
          • Suspicious use of SetWindowsHookEx
          PID:4588

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\$Recycle.Bin\S-1-5-21-2636447293-1148739154-93880854-1000\IIIIIIIIIII
        Filesize

        129B

        MD5

        044c6f47db146de6993f8706c61c1593

        SHA1

        1e039b97f8ab8475309f4e6d780f9eaf88ba8ab1

        SHA256

        14d164cd16960f89223fadae44c0f191ee2b15acf86a9486e797cefa06ead3fe

        SHA512

        df4b72e3b338ed8bde94a4c88f1ab96f6b8c7d319e04254b86d4d89a18b56724596abe90c2b597a5e35d19b2cb2b059721a9826488815665f496f6eb288e09d2

        Download Submit

      • C:\7V7uPExzv.README.txt
        Filesize

        1KB

        MD5

        a72e94d4cbf2937446fa516cfba964ca

        SHA1

        3d395577c516caf15b851b9aaad7bbf15184fcf9

        SHA256

        428847797d5c279a505d0ae18a0910a803469fe3ce40e902f7f46635ec3c801b

        SHA512

        10f534bc8209220e6bfe043ba9f080dda34aa5496e8d84f01bca07b2eb8bd7ff4e03c2098936bbd095b9a3fe6f610bc8e625482f04ac86f0952fc54195624dc4

        Download Submit

      • C:\ProgramData\C42C.tmp
        Filesize

        14KB

        MD5

        294e9f64cb1642dd89229fff0592856b

        SHA1

        97b148c27f3da29ba7b18d6aee8a0db9102f47c9

        SHA256

        917e115cc403e29b4388e0d175cbfac3e7e40ca1742299fbdb353847db2de7c2

        SHA512

        b87d531890bf1577b9b4af41dddb2cdbbfa164cf197bd5987df3a3075983645a3acba443e289b7bfd338422978a104f55298fbfe346872de0895bde44adc89cf

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\DDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDD
        Filesize

        146KB

        MD5

        b4e6697ddff2ea1c56be59d22f755a00

        SHA1

        88f4cfe5bd620c00473fce9b8954505226a527b5

        SHA256

        1b33f1dfde270c6d82f0e6116b9d43963be916e4bc92c338778e732ea7149046

        SHA512

        59da140d4bafa92fec2ea4b4639c6d0b32e481b92d3025e581cf0ff27837c22208aa969d45f72c8b9f8d16bec1eba4206d30ac0be58e60228d77c300b0dc7631

        Download Submit

      • C:\Users\Admin\Documents\OneNote Notebooks\My Notebook\Open Notebook.onetoc2
        Filesize

        4KB

        MD5

        6dfd412b78968d6bcbbcda2ba948fde0

        SHA1

        18228c70cd8d76cd68b2ed2cf25f6cdc78c55e55

        SHA256

        6e224971fba21918ad45dca51f059e514d42ddf24bd068e97c110db5e38568bd

        SHA512

        cc3a680fed41c7c2755b4deb29e4bbd9e14b3f6caf0eba487b14667c2ad1edcbc59cca4d54a17dbdb9fd093487bc17d20c86ebed1b80de8038d9d23d279361ac

        Download Submit

      • F:\$RECYCLE.BIN\S-1-5-21-2636447293-1148739154-93880854-1000\DDDDDDDDDDD
        Filesize

        129B

        MD5

        de16e4023389d8c15f0c01e8e57a3005

        SHA1

        9067bcad9b7d7d4ac632e65c9c24580834c91f36

        SHA256

        98494135f88818a3925dd1b42648e5f7c714082fcd5fabbb48a1e2c9b9650a8a

        SHA512

        9f90607241bb89f3cfea8e696f3dcb2e935061ab7ab4cdc60a946e5dad649cf4b8a3c86357350e49c35e9b96eb75773b0f2dd0b9a5aa94fec526857ddd2e73a8

        Download Submit

      • memory/4568-0-0x0000000003410000-0x0000000003420000-memory.dmp

        Filesize

        64KB

        Download

      • memory/4568-2-0x0000000003410000-0x0000000003420000-memory.dmp

        Filesize

        64KB

        Download

      • memory/4568-1-0x0000000003410000-0x0000000003420000-memory.dmp

        Filesize

        64KB

        Download

      • memory/4588-2798-0x00007FFB39AD0000-0x00007FFB39AE0000-memory.dmp

        Filesize

        64KB

        Download

      • memory/4588-2801-0x00007FFB39AD0000-0x00007FFB39AE0000-memory.dmp

        Filesize

        64KB

        Download

      • memory/4588-2799-0x00007FFB39AD0000-0x00007FFB39AE0000-memory.dmp

        Filesize

        64KB

        Download

      • memory/4588-2833-0x00007FFB37200000-0x00007FFB37210000-memory.dmp

        Filesize

        64KB

        Download

      • memory/4588-2797-0x00007FFB39AD0000-0x00007FFB39AE0000-memory.dmp

        Filesize

        64KB

        Download

      • memory/4588-2834-0x00007FFB37200000-0x00007FFB37210000-memory.dmp

        Filesize

        64KB

        Download

      • memory/4588-2796-0x00007FFB39AD0000-0x00007FFB39AE0000-memory.dmp

        Filesize

        64KB

        Download