Analysis
-
max time kernel
145s -
max time network
124s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
14/07/2024, 19:57
Behavioral task
behavioral1
Sample
1.exe
Resource
win7-20240704-en
windows7-x64
15 signatures
150 seconds
Behavioral task
behavioral2
Sample
1.exe
Resource
win10v2004-20240709-en
windows10-2004-x64
19 signatures
150 seconds
General
-
Target
1.exe
-
Size
146KB
-
MD5
314275168bf7958219662a242dbfe8a7
-
SHA1
d629032d9d8f491d133ee26a230c393335d7ad74
-
SHA256
f28599b06560617bccdfb56acc841f3e642ff51b9956632fcc4204f026711e23
-
SHA512
b5246db461ee78d622a33a758b3d178208b88e0b9e98185f17ee95f2fbbcf66b1059afece1dd5b586d01587bc01662491a6baab208b9836d4b4b9efc55f14c2f
-
SSDEEP
3072:V6glyuxE4GsUPnliByocWepo2NVLiguo/pyEwUSx:V6gDBGpvEByocWeauV2gvzwUA
Score
10/10
Malware Config
Extracted
Path
C:\7V7uPExzv.README.txt
Ransom Note
~~~NULLBULGE LOCK - BASED ON LOCKBIT~~~
>>>> Your data is encrypted... but dont freak out
If we encrypted you, you majorly fucked up. But... all can be saved
But not for free, we require an xmr payment
>>>> What guarantees that we will not deceive you?
We are not a politically motivated group and we do not need anything other than your money.
If you pay, we will provide you the programs for decryption.
Life is too short to be sad. Dont be sad money is only paper. Your files are more important than paper right?
If we do not give you decrypter then nobody will pay us in the future.
To us, our reputation is very important. There is no dissatisfied victim after payment.
>>>> You may contact us and decrypt one file for free on these TOR sites with your personal DECRYPTION ID
Download and install TOR Browser https://www.torproject.org/
Write to a chat and wait for the answer, we will always answer you.
Sometimes you will need to wait a while
Links for Tor Browser:
http://nullblgtk7dwzpfklgktzll27ovvnj7pvqkoprmhubnnb32qcbmcpgid.onion/
Link for the normal browser
http://group.goocasino.org
https://nullbulge.com
>>>> Your personal DECRYPTION ID: 217B9D5D58C4AD3CBBC5FA84A4CEB0EE
>>>> Warning! Do not DELETE or MODIFY any files, it can lead to recovery problems!
URLs
http://nullblgtk7dwzpfklgktzll27ovvnj7pvqkoprmhubnnb32qcbmcpgid.onion/
http://group.goocasino.org
https://nullbulge.com
Signatures
-
Renames multiple (612) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3419463127-3903270268-2580331543-1000\Control Panel\International\Geo\Nation E233.tmp -
Deletes itself 1 IoCs
pid Process 2460 E233.tmp -
Executes dropped EXE 1 IoCs
pid Process 2460 E233.tmp -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops desktop.ini file(s) 2 IoCs
description ioc Process File opened for modification C:\$Recycle.Bin\S-1-5-21-3419463127-3903270268-2580331543-1000\desktop.ini 1.exe File opened for modification F:\$RECYCLE.BIN\S-1-5-21-3419463127-3903270268-2580331543-1000\desktop.ini 1.exe -
Drops file in System32 directory 4 IoCs
description ioc Process File created C:\Windows\system32\spool\PRINTERS\PPlr0qhc4h9jmqlr05a_hy69ttd.TMP printfilterpipelinesvc.exe File created C:\Windows\system32\spool\PRINTERS\PP04x0us9bx525e5nntf1ym3ytc.TMP printfilterpipelinesvc.exe File created C:\Windows\system32\spool\PRINTERS\PPxj4biupyx69kdhs9kzylf8zw.TMP printfilterpipelinesvc.exe File created C:\Windows\system32\spool\PRINTERS\00002.SPL splwow64.exe -
Sets desktop wallpaper using registry 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3419463127-3903270268-2580331543-1000\Control Panel\Desktop\WallPaper = "C:\\ProgramData\\7V7uPExzv.bmp" 1.exe Set value (str) \REGISTRY\USER\S-1-5-21-3419463127-3903270268-2580331543-1000\Control Panel\Desktop\Wallpaper = "C:\\ProgramData\\7V7uPExzv.bmp" 1.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 5 IoCs
pid Process 3480 1.exe 3480 1.exe 3480 1.exe 3480 1.exe 2460 E233.tmp -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 ONENOTE.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz ONENOTE.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString ONENOTE.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS ONENOTE.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily ONENOTE.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU ONENOTE.EXE -
Modifies Control Panel 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3419463127-3903270268-2580331543-1000\Control Panel\Desktop\WallpaperStyle = "10" 1.exe Key created \REGISTRY\USER\S-1-5-21-3419463127-3903270268-2580331543-1000\Control Panel\Desktop 1.exe -
Modifies registry class 5 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\7V7uPExzv 1.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\7V7uPExzv\DefaultIcon\ = "C:\\ProgramData\\7V7uPExzv.ico" 1.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.7V7uPExzv 1.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.7V7uPExzv\ = "7V7uPExzv" 1.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\7V7uPExzv\DefaultIcon 1.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3480 1.exe 3480 1.exe 3480 1.exe 3480 1.exe 3480 1.exe 3480 1.exe 3480 1.exe 3480 1.exe 3480 1.exe 3480 1.exe 3480 1.exe 3480 1.exe 3480 1.exe 3480 1.exe 3480 1.exe 3480 1.exe 3480 1.exe 3480 1.exe 3480 1.exe 3480 1.exe 3480 1.exe 3480 1.exe 3480 1.exe 3480 1.exe 3480 1.exe 3480 1.exe 3480 1.exe 3480 1.exe 3480 1.exe 3480 1.exe 3480 1.exe 3480 1.exe 3480 1.exe 3480 1.exe 3480 1.exe 3480 1.exe 3480 1.exe 3480 1.exe 3480 1.exe 3480 1.exe 3480 1.exe 3480 1.exe 3480 1.exe 3480 1.exe 3480 1.exe 3480 1.exe 3480 1.exe 3480 1.exe 3480 1.exe 3480 1.exe 3480 1.exe 3480 1.exe 3480 1.exe 3480 1.exe 3480 1.exe 3480 1.exe 3480 1.exe 3480 1.exe 3480 1.exe 3480 1.exe 3480 1.exe 3480 1.exe 3480 1.exe 3480 1.exe -
Suspicious behavior: RenamesItself 26 IoCs
pid Process 2460 E233.tmp 2460 E233.tmp 2460 E233.tmp 2460 E233.tmp 2460 E233.tmp 2460 E233.tmp 2460 E233.tmp 2460 E233.tmp 2460 E233.tmp 2460 E233.tmp 2460 E233.tmp 2460 E233.tmp 2460 E233.tmp 2460 E233.tmp 2460 E233.tmp 2460 E233.tmp 2460 E233.tmp 2460 E233.tmp 2460 E233.tmp 2460 E233.tmp 2460 E233.tmp 2460 E233.tmp 2460 E233.tmp 2460 E233.tmp 2460 E233.tmp 2460 E233.tmp -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeAssignPrimaryTokenPrivilege 3480 1.exe Token: SeBackupPrivilege 3480 1.exe Token: SeDebugPrivilege 3480 1.exe Token: 36 3480 1.exe Token: SeImpersonatePrivilege 3480 1.exe Token: SeIncBasePriorityPrivilege 3480 1.exe Token: SeIncreaseQuotaPrivilege 3480 1.exe Token: 33 3480 1.exe Token: SeManageVolumePrivilege 3480 1.exe Token: SeProfSingleProcessPrivilege 3480 1.exe Token: SeRestorePrivilege 3480 1.exe Token: SeSecurityPrivilege 3480 1.exe Token: SeSystemProfilePrivilege 3480 1.exe Token: SeTakeOwnershipPrivilege 3480 1.exe Token: SeShutdownPrivilege 3480 1.exe Token: SeDebugPrivilege 3480 1.exe Token: SeBackupPrivilege 3480 1.exe Token: SeBackupPrivilege 3480 1.exe Token: SeSecurityPrivilege 3480 1.exe Token: SeSecurityPrivilege 3480 1.exe Token: SeBackupPrivilege 3480 1.exe Token: SeBackupPrivilege 3480 1.exe Token: SeSecurityPrivilege 3480 1.exe Token: SeSecurityPrivilege 3480 1.exe Token: SeBackupPrivilege 3480 1.exe Token: SeBackupPrivilege 3480 1.exe Token: SeSecurityPrivilege 3480 1.exe Token: SeSecurityPrivilege 3480 1.exe Token: SeBackupPrivilege 3480 1.exe Token: SeBackupPrivilege 3480 1.exe Token: SeSecurityPrivilege 3480 1.exe Token: SeSecurityPrivilege 3480 1.exe Token: SeBackupPrivilege 3480 1.exe Token: SeBackupPrivilege 3480 1.exe Token: SeSecurityPrivilege 3480 1.exe Token: SeSecurityPrivilege 3480 1.exe Token: SeBackupPrivilege 3480 1.exe Token: SeBackupPrivilege 3480 1.exe Token: SeSecurityPrivilege 3480 1.exe Token: SeSecurityPrivilege 3480 1.exe Token: SeBackupPrivilege 3480 1.exe Token: SeBackupPrivilege 3480 1.exe Token: SeSecurityPrivilege 3480 1.exe Token: SeSecurityPrivilege 3480 1.exe Token: SeBackupPrivilege 3480 1.exe Token: SeBackupPrivilege 3480 1.exe Token: SeSecurityPrivilege 3480 1.exe Token: SeSecurityPrivilege 3480 1.exe Token: SeBackupPrivilege 3480 1.exe Token: SeBackupPrivilege 3480 1.exe Token: SeSecurityPrivilege 3480 1.exe Token: SeSecurityPrivilege 3480 1.exe Token: SeBackupPrivilege 3480 1.exe Token: SeBackupPrivilege 3480 1.exe Token: SeSecurityPrivilege 3480 1.exe Token: SeSecurityPrivilege 3480 1.exe Token: SeBackupPrivilege 3480 1.exe Token: SeBackupPrivilege 3480 1.exe Token: SeSecurityPrivilege 3480 1.exe Token: SeSecurityPrivilege 3480 1.exe Token: SeBackupPrivilege 3480 1.exe Token: SeBackupPrivilege 3480 1.exe Token: SeSecurityPrivilege 3480 1.exe Token: SeSecurityPrivilege 3480 1.exe -
Suspicious use of SetWindowsHookEx 13 IoCs
pid Process 512 ONENOTE.EXE 512 ONENOTE.EXE 512 ONENOTE.EXE 512 ONENOTE.EXE 512 ONENOTE.EXE 512 ONENOTE.EXE 512 ONENOTE.EXE 512 ONENOTE.EXE 512 ONENOTE.EXE 512 ONENOTE.EXE 512 ONENOTE.EXE 512 ONENOTE.EXE 512 ONENOTE.EXE -
Suspicious use of WriteProcessMemory 11 IoCs
description pid Process procid_target PID 3480 wrote to memory of 3636 3480 1.exe 88 PID 3480 wrote to memory of 3636 3480 1.exe 88 PID 1828 wrote to memory of 512 1828 printfilterpipelinesvc.exe 91 PID 1828 wrote to memory of 512 1828 printfilterpipelinesvc.exe 91 PID 3480 wrote to memory of 2460 3480 1.exe 92 PID 3480 wrote to memory of 2460 3480 1.exe 92 PID 3480 wrote to memory of 2460 3480 1.exe 92 PID 3480 wrote to memory of 2460 3480 1.exe 92 PID 2460 wrote to memory of 1272 2460 E233.tmp 93 PID 2460 wrote to memory of 1272 2460 E233.tmp 93 PID 2460 wrote to memory of 1272 2460 E233.tmp 93
Processes
-
C:\Users\Admin\AppData\Local\Temp\1.exe"C:\Users\Admin\AppData\Local\Temp\1.exe"1⤵
- Drops desktop.ini file(s)
- Sets desktop wallpaper using registry
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Modifies Control Panel
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3480 -
C:\Windows\splwow64.exeC:\Windows\splwow64.exe 122882⤵
- Drops file in System32 directory
PID:3636
-
-
C:\ProgramData\E233.tmp"C:\ProgramData\E233.tmp"2⤵
- Checks computer location settings
- Deletes itself
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:2460 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C DEL /F /Q C:\PROGRA~3\E233.tmp >> NUL3⤵PID:1272
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc1⤵PID:4832
-
C:\Windows\system32\printfilterpipelinesvc.exeC:\Windows\system32\printfilterpipelinesvc.exe -Embedding1⤵
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:1828 -
C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE/insertdoc "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\{CAC9AD6B-14A5-44D4-A8CB-CF0D1E037EF5}.xps" 1336546063247400002⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious use of SetWindowsHookEx
PID:512
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
129B
MD589ea2719c3649cf58294f7d927466e11
SHA167b67505c78907a6eef256f7deb87612fdc4ff24
SHA256689969e905367e37e78f73efb313441778ebe0449051c5ddb93e5c5e664cc464
SHA5125ae4579b63cbb52d90d5613905142ad3bbf297cb848c13fa0121bf284c59e0e6780691c50f45dcc7548ed53b8e2a690002064641095b77d7377e925dc87a8956
-
Filesize
1KB
MD5938b736d0f8740af44c218cdf0af39e8
SHA1036d74cb2f41468531dbb9c6800ccad87e5d5ff9
SHA2567c8c79d1f253cd8ede38b92ddd93d5f5177c3a5f45cd0c62edfa836aec394197
SHA512d11b56a84ae591cf507ec138f8a09dadc6a7c1ef4c9eececf7b6cfebe9c2ccfc22a8c12a8d94842c820071624b2d2b166256350f67f4a4100ab30d931de7e5f0
-
Filesize
14KB
MD5294e9f64cb1642dd89229fff0592856b
SHA197b148c27f3da29ba7b18d6aee8a0db9102f47c9
SHA256917e115cc403e29b4388e0d175cbfac3e7e40ca1742299fbdb353847db2de7c2
SHA512b87d531890bf1577b9b4af41dddb2cdbbfa164cf197bd5987df3a3075983645a3acba443e289b7bfd338422978a104f55298fbfe346872de0895bde44adc89cf
-
Filesize
146KB
MD5f168b3c66e3707fffc2074b17879b128
SHA11c7ee5ac88bb54719ec8b484a361296a9446d9f4
SHA256360941c958bad1284764530074d72edfee9e377cb2b3a5b7dad59372c2d82a01
SHA512b695acfe6fb7e6592acc3adaaf43e001beac27ef33dd5e910ba1ee6d79c8389cec4edecfdb3320c253ee8d8a1d96c3fe517c268f716c2e2343af11d0fe731a4c
-
Filesize
4KB
MD50f3d13530c78621b686abf99312e2c05
SHA1cf9c2eb6fe504ea04a730063f9b104e38865289a
SHA256bb54bb0a8a3c9381456cad51d39494a676d13ddd8cd968f0cdc6b9b88882dd58
SHA51268ed5835143e3f482fb2e83a01554693f8531a9ad12722859201a01128d7e451f1df711b66839e7cd53f9b909508707ce32c0d049d451ed3966fbe14ad16a0a9
-
Filesize
129B
MD53f789c1a6af1c3356f78581a4814f343
SHA1c2637d994287e5f854d8cf6254e32922cdd7f9d4
SHA256d318d1afb8cc5fcb338cd9f69a9d7a89287aff88d657559b93c4ece54145f0a3
SHA512efdefd39a10ca10ae4f1deeea3dc6dcaa81f85c33f189455da32b5b6f4746a03561a5c7af430047041c8125da85829ba4df1b9aa5d4a519a0e2be3a07ef63add