Overview

overview

10

Static

static

10

1/0280cde4...60.exe

windows10-2004-x64

10

1/08b76206...65.exe

windows10-2004-x64

10

1/0e4fc438...91.exe

windows10-2004-x64

10

1/0fb86a8b...05.exe

windows10-2004-x64

10

1/25898c73...8f.exe

windows10-2004-x64

10

1/2c2e9491...3c.exe

windows10-2004-x64

10

1/2ef0f582...2e.exe

windows10-2004-x64

10

1/39884fc0...82.exe

windows10-2004-x64

10

1/3a72ecec...8a.exe

windows10-2004-x64

10

1/3bfcb4f7...71.exe

windows10-2004-x64

10

1/4103411f...f5.exe

windows10-2004-x64

10

1/4e0fdb84...95.exe

windows10-2004-x64

7

1/5297372f...33.exe

windows10-2004-x64

5

1/68292f38...e4.exe

windows10-2004-x64

10

1/6da4696b...e5.exe

windows10-2004-x64

7

1/7021c9cb...78.exe

windows10-2004-x64

10

1/752f5cc5...60.exe

windows10-2004-x64

10

1/7c7cded8...0c.exe

windows10-2004-x64

10

1/97d29ffc...84.exe

windows10-2004-x64

7

1/a306cc84...03.exe

windows10-2004-x64

7

1/ae1a168f...74.exe

windows10-2004-x64

7

1/b13f2364...d6.exe

windows10-2004-x64

8

1/b2a1d168...9d.bat

windows10-2004-x64

8

1/bb29aeb6...bd.exe

windows10-2004-x64

8

1/c8e5a24a...f5.bat

windows10-2004-x64

8

1/c9736cdc...97.exe

windows10-2004-x64

8

1/d58780d1...a0.exe

windows10-2004-x64

10

1/de19e016...d0.exe

windows10-2004-x64

1

1/e886016e...51.exe

windows10-2004-x64

10

1/f0f496ec...f4.bat

windows10-2004-x64

8

1/f28599b0...23.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    147s
  • max time network
    148s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240709-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
  • submitted
    15-07-2024 08:43

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    1/f28599b06560617bccdfb56acc841f3e642ff51b9956632fcc4204f026711e23.exe

  • Size

    146KB

  • MD5

    314275168bf7958219662a242dbfe8a7

  • SHA1

    d629032d9d8f491d133ee26a230c393335d7ad74

  • SHA256

    f28599b06560617bccdfb56acc841f3e642ff51b9956632fcc4204f026711e23

  • SHA512

    b5246db461ee78d622a33a758b3d178208b88e0b9e98185f17ee95f2fbbcf66b1059afece1dd5b586d01587bc01662491a6baab208b9836d4b4b9efc55f14c2f

  • SSDEEP

    3072:V6glyuxE4GsUPnliByocWepo2NVLiguo/pyEwUSx:V6gDBGpvEByocWeauV2gvzwUA

Score
10/10
ransomwarespywarestealer

Malware Config

Extracted

Path

C:\7V7uPExzv.README.txt

Ransom Note
~~~NULLBULGE LOCK - BASED ON LOCKBIT~~~ >>>> Your data is encrypted... but dont freak out If we encrypted you, you majorly fucked up. But... all can be saved But not for free, we require an xmr payment >>>> What guarantees that we will not deceive you? We are not a politically motivated group and we do not need anything other than your money. If you pay, we will provide you the programs for decryption. Life is too short to be sad. Dont be sad money is only paper. Your files are more important than paper right? If we do not give you decrypter then nobody will pay us in the future. To us, our reputation is very important. There is no dissatisfied victim after payment. >>>> You may contact us and decrypt one file for free on these TOR sites with your personal DECRYPTION ID Download and install TOR Browser https://www.torproject.org/ Write to a chat and wait for the answer, we will always answer you. Sometimes you will need to wait a while Links for Tor Browser: http://nullblgtk7dwzpfklgktzll27ovvnj7pvqkoprmhubnnb32qcbmcpgid.onion/ Link for the normal browser http://group.goocasino.org https://nullbulge.com >>>> Your personal DECRYPTION ID: 217B9D5D58C4AD3C7236357A55FF2461 >>>> Warning! Do not DELETE or MODIFY any files, it can lead to recovery problems!
URLs

http://nullblgtk7dwzpfklgktzll27ovvnj7pvqkoprmhubnnb32qcbmcpgid.onion/

http://group.goocasino.org

https://nullbulge.com

Signatures

  • Renames multiple (636) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Drops desktop.ini file(s) 2 IoCs
  • Drops file in System32 directory 4 IoCs
  • Sets desktop wallpaper using registry 2 TTPs 2 IoCs
    ransomware
  • Suspicious use of NtSetInformationThreadHideFromDebugger 5 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies Control Panel 2 IoCs
    evasion
  • Modifies registry class 5 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: RenamesItself 26 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of SetWindowsHookEx 13 IoCs
  • Suspicious use of WriteProcessMemory 11 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\1\f28599b06560617bccdfb56acc841f3e642ff51b9956632fcc4204f026711e23.exe
    "C:\Users\Admin\AppData\Local\Temp\1\f28599b06560617bccdfb56acc841f3e642ff51b9956632fcc4204f026711e23.exe"
    1⤵
    • Drops desktop.ini file(s)
    • Sets desktop wallpaper using registry
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Modifies Control Panel
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2448
    • C:\Windows\splwow64.exe
      C:\Windows\splwow64.exe 12288
      2⤵
      • Drops file in System32 directory
      PID:1460
    • C:\ProgramData\2816.tmp
      "C:\ProgramData\2816.tmp"
      2⤵
      • Checks computer location settings
      • Deletes itself
      • Executes dropped EXE
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • Suspicious behavior: RenamesItself
      • Suspicious use of WriteProcessMemory
      PID:2364
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /C DEL /F /Q C:\PROGRA~3\2816.tmp >> NUL
        3⤵
          PID:2732
    • C:\Windows\system32\svchost.exe
      C:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc
      1⤵
        PID:4368
      • C:\Windows\system32\printfilterpipelinesvc.exe
        C:\Windows\system32\printfilterpipelinesvc.exe -Embedding
        1⤵
        • Drops file in System32 directory
        • Suspicious use of WriteProcessMemory
        PID:4416
        • C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE
          /insertdoc "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\{1526E35C-B19E-4AA7-8BE6-5EF5C10E87D2}.xps" 133655066658950000
          2⤵
          • Checks processor information in registry
          • Enumerates system info in registry
          • Suspicious use of SetWindowsHookEx
          PID:3508

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\$Recycle.Bin\S-1-5-21-1176886754-713327781-2233697964-1000\CCCCCCCCCCC
        Filesize

        129B

        MD5

        bb8febb026b073e2a0da2e47da1ba9ad

        SHA1

        696154b5b603a02e6d0641fb913fee1292d9c0a7

        SHA256

        2bc28ee1007c4c0eecf0a0f98028a2a4125c3cbe28d6d51a947b328c9966316e

        SHA512

        6b4065d10ec231331998004c1796a89dd2aa75266e25f48880abc74f8231785f3b3e671540ef3ed7d2651cfe96e4a6d3055cd54e1c88ccd72f6db2c1c2b4231b

        Download Submit

      • C:\7V7uPExzv.README.txt
        Filesize

        1KB

        MD5

        421ab6b875a43dd97ed733425b515ffd

        SHA1

        94142794ab6e370cfbc94880de779527aa50729d

        SHA256

        0cb2c2c8d73d099261acd0ac82f7192999b8e1e5ea8da0bec14b9b6b91e856d7

        SHA512

        b9426b1509d7ac0424db4cf897ac77775282fefd4493db987ffe50af4fae7542854903aae3ea673ee0a53d997e75480bf75671d583144a2c52a93b3f61ba32e5

        Download Submit

      • C:\ProgramData\2816.tmp
        Filesize

        14KB

        MD5

        294e9f64cb1642dd89229fff0592856b

        SHA1

        97b148c27f3da29ba7b18d6aee8a0db9102f47c9

        SHA256

        917e115cc403e29b4388e0d175cbfac3e7e40ca1742299fbdb353847db2de7c2

        SHA512

        b87d531890bf1577b9b4af41dddb2cdbbfa164cf197bd5987df3a3075983645a3acba443e289b7bfd338422978a104f55298fbfe346872de0895bde44adc89cf

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\1\DDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDD
        Filesize

        146KB

        MD5

        122316a63d0006fb62137e4ba7bba89f

        SHA1

        bae4a9aa59686e1379f2051cf4483ab5e09c6408

        SHA256

        d4e07c1798319b620b67bb04f8e70014712be004151535cb07adbcfe2850d5a3

        SHA512

        e11afba64ea1603f25e849c7241efcfa9735637deba0f1920973552e453fd3ed4196aab4952f7c44d95a7613d8d531c38fa5a5a8b5f2c7f25de30c60a9d4eca4

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\{8922586C-24E4-47C4-9BEB-21A5D5D880B8}
        Filesize

        4KB

        MD5

        a9afb45a60ac57424cdaf26ff1e5ad13

        SHA1

        e00073c2d4aec40fe03e2dcf92e3a488dcaccee3

        SHA256

        2bb9cdcab4b5542d40cc6504baef766c179093065d85803d5c6988e1ad07d850

        SHA512

        25c6cd38d8a1b2c19bd0378a1292190b7da79ef5df7c46104a7e060ad732f0ebc3cdc4b567604c264fffad2fe91a06f89e4e3f1c9c2b1bcf60a883554d49e53a

        Download Submit

      • F:\$RECYCLE.BIN\S-1-5-21-1176886754-713327781-2233697964-1000\DDDDDDDDDDD
        Filesize

        129B

        MD5

        4fa9e2dfddc5b756acc1fc49f80b752a

        SHA1

        2042c9a85c2cf150403c4051bcdd4b240e45f937

        SHA256

        53ddbb80a963830e208faae1f9771297c1cf6e58dd222fa71e041feb7b77be77

        SHA512

        3aa56ad1935a4b14b6d179a46e28d04175f5ee2e2952022853ec3c7d155dd90038c71ca469f25f6da762f5ee53f6bf82e36907fa0c1fef4a7ea1cb3b0e1bb97e

        Download Submit

      • memory/2448-0-0x0000000002DC0000-0x0000000002DD0000-memory.dmp

        Filesize

        64KB

        Download

      • memory/2448-1-0x0000000002DC0000-0x0000000002DD0000-memory.dmp

        Filesize

        64KB

        Download

      • memory/2448-2-0x0000000002DC0000-0x0000000002DD0000-memory.dmp

        Filesize

        64KB

        Download

      • memory/3508-2836-0x00007FFD81AD0000-0x00007FFD81AE0000-memory.dmp

        Filesize

        64KB

        Download

      • memory/3508-2838-0x00007FFD81AD0000-0x00007FFD81AE0000-memory.dmp

        Filesize

        64KB

        Download

      • memory/3508-2837-0x00007FFD81AD0000-0x00007FFD81AE0000-memory.dmp

        Filesize

        64KB

        Download

      • memory/3508-2843-0x00007FFD81AD0000-0x00007FFD81AE0000-memory.dmp

        Filesize

        64KB

        Download

      • memory/3508-2841-0x00007FFD81AD0000-0x00007FFD81AE0000-memory.dmp

        Filesize

        64KB

        Download

      • memory/3508-2872-0x00007FFD7F940000-0x00007FFD7F950000-memory.dmp

        Filesize

        64KB

        Download

      • memory/3508-2873-0x00007FFD7F940000-0x00007FFD7F950000-memory.dmp

        Filesize

        64KB

        Download