Overview

overview

10

Static

static

10

1/0280cde4...60.exe

windows10-2004-x64

10

1/08b76206...65.exe

windows10-2004-x64

10

1/0e4fc438...91.exe

windows10-2004-x64

10

1/0fb86a8b...05.exe

windows10-2004-x64

10

1/25898c73...8f.exe

windows10-2004-x64

10

1/2c2e9491...3c.exe

windows10-2004-x64

10

1/2ef0f582...2e.exe

windows10-2004-x64

10

1/39884fc0...82.exe

windows10-2004-x64

10

1/3a72ecec...8a.exe

windows10-2004-x64

10

1/3bfcb4f7...71.exe

windows10-2004-x64

10

1/4103411f...f5.exe

windows10-2004-x64

10

1/4e0fdb84...95.exe

windows10-2004-x64

7

1/5297372f...33.exe

windows10-2004-x64

5

1/68292f38...e4.exe

windows10-2004-x64

10

1/6da4696b...e5.exe

windows10-2004-x64

7

1/7021c9cb...78.exe

windows10-2004-x64

10

1/752f5cc5...60.exe

windows10-2004-x64

10

1/7c7cded8...0c.exe

windows10-2004-x64

10

1/97d29ffc...84.exe

windows10-2004-x64

7

1/a306cc84...03.exe

windows10-2004-x64

7

1/ae1a168f...74.exe

windows10-2004-x64

7

1/b13f2364...d6.exe

windows10-2004-x64

8

1/b2a1d168...9d.bat

windows10-2004-x64

8

1/bb29aeb6...bd.exe

windows10-2004-x64

8

1/c8e5a24a...f5.bat

windows10-2004-x64

8

1/c9736cdc...97.exe

windows10-2004-x64

8

1/d58780d1...a0.exe

windows10-2004-x64

10

1/de19e016...d0.exe

windows10-2004-x64

1

1/e886016e...51.exe

windows10-2004-x64

10

1/f0f496ec...f4.bat

windows10-2004-x64

8

1/f28599b0...23.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    148s
  • max time network
    130s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240709-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
  • submitted
    15-07-2024 08:43

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    1/0fb86a8ba8fdf57990c283080a671c1320cbcdfd0e8b5f5a250d9c38a6fce305.exe

  • Size

    146KB

  • MD5

    2357ecbcf3b566c76c839daf7ecf2681

  • SHA1

    89d9b7c3eff0a15dc9dbbfe2163de7d5e9479f58

  • SHA256

    0fb86a8ba8fdf57990c283080a671c1320cbcdfd0e8b5f5a250d9c38a6fce305

  • SHA512

    bb5630ae44e684f2dfc74478c57bf97a94045501a64022d563e87f2a60d777307cab2b5a14e6764d25a2fd1f27901624c1ee76ca551d5a5e3a21abc4befef401

  • SSDEEP

    3072:V6glyuxE4GsUPnliByocWepo2NVLiguo/pyEwUS:V6gDBGpvEByocWeauV2gvzwU

Score
10/10
ransomwarespywarestealer

Malware Config

Extracted

Path

C:\7V7uPExzv.README.txt

Ransom Note
~~~NULLBULGE LOCK - BASED ON LOCKBIT~~~ >>>> Your data is encrypted... but dont freak out If we encrypted you, you majorly fucked up. But... all can be saved But not for free, we require an xmr payment >>>> What guarantees that we will not deceive you? We are not a politically motivated group and we do not need anything other than your money. If you pay, we will provide you the programs for decryption. Life is too short to be sad. Dont be sad money is only paper. Your files are more important than paper right? If we do not give you decrypter then nobody will pay us in the future. To us, our reputation is very important. There is no dissatisfied victim after payment. >>>> You may contact us and decrypt one file for free on these TOR sites with your personal DECRYPTION ID Download and install TOR Browser https://www.torproject.org/ Write to a chat and wait for the answer, we will always answer you. Sometimes you will need to wait a while Links for Tor Browser: http://nullblgtk7dwzpfklgktzll27ovvnj7pvqkoprmhubnnb32qcbmcpgid.onion/ Link for the normal browser http://group.goocasino.org https://nullbulge.com >>>> Your personal DECRYPTION ID: 217B9D5D58C4AD3CA7D789D62621C84C >>>> Warning! Do not DELETE or MODIFY any files, it can lead to recovery problems!
URLs

http://nullblgtk7dwzpfklgktzll27ovvnj7pvqkoprmhubnnb32qcbmcpgid.onion/

http://group.goocasino.org

https://nullbulge.com

Signatures

  • Renames multiple (648) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Drops desktop.ini file(s) 2 IoCs
  • Drops file in System32 directory 4 IoCs
  • Sets desktop wallpaper using registry 2 TTPs 2 IoCs
    ransomware
  • Suspicious use of NtSetInformationThreadHideFromDebugger 5 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies Control Panel 2 IoCs
    evasion
  • Modifies registry class 5 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: RenamesItself 26 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of SetWindowsHookEx 13 IoCs
  • Suspicious use of WriteProcessMemory 11 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\1\0fb86a8ba8fdf57990c283080a671c1320cbcdfd0e8b5f5a250d9c38a6fce305.exe
    "C:\Users\Admin\AppData\Local\Temp\1\0fb86a8ba8fdf57990c283080a671c1320cbcdfd0e8b5f5a250d9c38a6fce305.exe"
    1⤵
    • Drops desktop.ini file(s)
    • Sets desktop wallpaper using registry
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Modifies Control Panel
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:916
    • C:\Windows\splwow64.exe
      C:\Windows\splwow64.exe 12288
      2⤵
      • Drops file in System32 directory
      PID:3776
    • C:\ProgramData\C360.tmp
      "C:\ProgramData\C360.tmp"
      2⤵
      • Checks computer location settings
      • Deletes itself
      • Executes dropped EXE
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • Suspicious behavior: RenamesItself
      • Suspicious use of WriteProcessMemory
      PID:3276
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /C DEL /F /Q C:\PROGRA~3\C360.tmp >> NUL
        3⤵
          PID:1452
    • C:\Windows\system32\svchost.exe
      C:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc
      1⤵
        PID:2536
      • C:\Windows\system32\printfilterpipelinesvc.exe
        C:\Windows\system32\printfilterpipelinesvc.exe -Embedding
        1⤵
        • Drops file in System32 directory
        • Suspicious use of WriteProcessMemory
        PID:4536
        • C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE
          /insertdoc "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\{907F62DD-2DEB-4435-BEB5-186E5F6B76EF}.xps" 133655066658230000
          2⤵
          • Checks processor information in registry
          • Enumerates system info in registry
          • Suspicious use of SetWindowsHookEx
          PID:4512

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\$Recycle.Bin\S-1-5-21-47134698-4092160662-1261813102-1000\desktop.ini
        Filesize

        129B

        MD5

        66735f8fdd6355e77cfd3a0d8f2aca2e

        SHA1

        d91767ca42ff235d3fcdd6479e9a1144c67bfcb4

        SHA256

        2b94b6ec55cb42fa0adba80f6bc0d35ffb12c118046da61f194eb716da461384

        SHA512

        f8c44cefcac94c8bdf6a0825a089b2351cf06d18767a252773e339fe2bcedbb86008bfbc8ad82818502891b2a3125fb873a70eafc532a87ae0e8c013b9fad3a1

        Download Submit

      • C:\7V7uPExzv.README.txt
        Filesize

        1KB

        MD5

        82529e5295db7cd56bb64877c8e44770

        SHA1

        10ae8e3e76ad416a77a513a5a861281cf0ddc596

        SHA256

        34cbc410a284fe4e47ee78fc232d8d7b9cf2e3b163a93b1a7c74e1b261e40ac6

        SHA512

        b3e939b65dda890c4334749ca37a1189d1ef415d6692bfc4fd0cafa613a626cc288997a05f8afeac813f1ead363d22106c5154671568d2951a6755adc4203d75

        Download Submit

      • C:\ProgramData\C360.tmp
        Filesize

        14KB

        MD5

        294e9f64cb1642dd89229fff0592856b

        SHA1

        97b148c27f3da29ba7b18d6aee8a0db9102f47c9

        SHA256

        917e115cc403e29b4388e0d175cbfac3e7e40ca1742299fbdb353847db2de7c2

        SHA512

        b87d531890bf1577b9b4af41dddb2cdbbfa164cf197bd5987df3a3075983645a3acba443e289b7bfd338422978a104f55298fbfe346872de0895bde44adc89cf

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\1\EEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEE
        Filesize

        146KB

        MD5

        1cdf58c283b9511dcbf0e5a1da5d1f66

        SHA1

        20518d6f4f30dff1c2223e877878c5994d9b43dc

        SHA256

        bc5982989bf00476c05fb37bc9dc9942fd0dd2564a2473a2c29b4d15b3b3f58a

        SHA512

        bc4b1711b7297da5f47c2f768f0012d3160ef55d6edb87ff0a690da2952d67cd857d4c9f34234449553910c37c759bd10c2827152da5fc1de4dda28b3c710316

        Download Submit

      • C:\Users\Admin\Documents\OneNote Notebooks\My Notebook\Open Notebook.onetoc2
        Filesize

        4KB

        MD5

        a25042389f43954df0c693f94d017bc5

        SHA1

        827e1c3059d850e7ec5770ad5a2f3dabd85a286c

        SHA256

        ca21357276b03191fcf7f010dd5765c36272f6cc4d368ab426f1d0512f746828

        SHA512

        1b0e541b6b8473b9169d6423124ba9a147f41b23aef629d6964a8cc4a9115fde83dbda8391d31490c9528e894de33dc47eb16f3b49b86d17281eaac34d234326

        Download Submit

      • F:\$RECYCLE.BIN\S-1-5-21-47134698-4092160662-1261813102-1000\DDDDDDDDDDD
        Filesize

        129B

        MD5

        21e2788ff6d51852d6f8bfa6e312da75

        SHA1

        762352836c3ce5f9ad4473262f1501cc65da23fb

        SHA256

        6777b2166f30a661669787745ced55a19b8c2fd35e3b98d2796f6b052e1c2fef

        SHA512

        98f5ebe3c3f8310d0a855085899dad285e12260938d04688dea13e6bf67b471d8354724e672f6ca20a8ce92962e821d9158115eb2308b45388409db5c30a4b0f

        Download Submit

      • memory/916-0-0x0000000001370000-0x0000000001380000-memory.dmp

        Filesize

        64KB

        Download

      • memory/916-1-0x0000000001370000-0x0000000001380000-memory.dmp

        Filesize

        64KB

        Download

      • memory/916-2-0x0000000001370000-0x0000000001380000-memory.dmp

        Filesize

        64KB

        Download

      • memory/4512-2998-0x00007FFD2E0B0000-0x00007FFD2E0C0000-memory.dmp

        Filesize

        64KB

        Download

      • memory/4512-2999-0x00007FFD2E0B0000-0x00007FFD2E0C0000-memory.dmp

        Filesize

        64KB

        Download

      • memory/4512-3000-0x00007FFD2E0B0000-0x00007FFD2E0C0000-memory.dmp

        Filesize

        64KB

        Download

      • memory/4512-3002-0x00007FFD2E0B0000-0x00007FFD2E0C0000-memory.dmp

        Filesize

        64KB

        Download

      • memory/4512-3005-0x00007FFD2E0B0000-0x00007FFD2E0C0000-memory.dmp

        Filesize

        64KB

        Download

      • memory/4512-3034-0x00007FFD2BDF0000-0x00007FFD2BE00000-memory.dmp

        Filesize

        64KB

        Download

      • memory/4512-3035-0x00007FFD2BDF0000-0x00007FFD2BE00000-memory.dmp

        Filesize

        64KB

        Download