Analysis
-
max time kernel
188s -
max time network
195s -
platform
windows10-1703_x64 -
resource
win10-20240611-en -
resource tags
arch:x64arch:x86image:win10-20240611-enlocale:en-usos:windows10-1703-x64system -
submitted
19-07-2024 01:06
Static task
static1
Behavioral task
behavioral1
Sample
sample1.exe
Resource
win10-20240611-en
General
-
Target
sample1.exe
-
Size
573KB
-
MD5
9f1c1e45b292299818c7fe64c865e67a
-
SHA1
1cce67a2b76d3bcd85f158f533e55296b8aea592
-
SHA256
637e28b38086ff9efd1606805ff57aaf6cdec4537378f019d6070a5efdc9c983
-
SHA512
80eab29223eb6484f35b16582dcee4814d85f23ba8628ea273897afea72ba4c815850dd4ff1391e1f3b49de26fb0525031a56973c72870b4db68ba28a54da3e3
-
SSDEEP
6144:8KIpz8gbJnHlZB1wYvPgwi/YkVlWGGv5wVRU/rCPED3xTfuRkbjaRVepohAYHdGZ:BGz7JHsYKN2v5/G+TfuR1VioyYHjS
Malware Config
Extracted
C:\Program Files\akira_readme.txt
akira
https://akiral2iz6a7qgd3ayp3l6yub7xx2uep76idk3u2kollpj5z3z636bad.onion
https://akiralkzxzq2dsrzsrvbr2xgbbu2wgsmxryd4csgfameg52n7efvr2id.onion
Signatures
-
Akira
Akira is a ransomware first seen in March 2023 and targets several industries, including education, finance, real estate, manufacturing, and consulting.
-
Renames multiple (7472) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Drops startup file 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\akira_readme.txt sample1.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops desktop.ini file(s) 32 IoCs
description ioc Process File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\DataServices\DESKTOP.INI sample1.exe File opened for modification C:\Program Files (x86)\desktop.ini sample1.exe File opened for modification C:\Users\Admin\Pictures\desktop.ini sample1.exe File opened for modification C:\Users\Admin\Searches\desktop.ini sample1.exe File opened for modification C:\Users\Public\Music\desktop.ini sample1.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini sample1.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\desktop.ini sample1.exe File opened for modification C:\Users\Admin\Contacts\desktop.ini sample1.exe File opened for modification C:\Users\Admin\Saved Games\desktop.ini sample1.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini sample1.exe File opened for modification C:\Program Files\desktop.ini sample1.exe File opened for modification C:\Users\Admin\Favorites\Links\desktop.ini sample1.exe File opened for modification C:\Users\Admin\Links\desktop.ini sample1.exe File opened for modification C:\Users\Admin\Pictures\Saved Pictures\desktop.ini sample1.exe File opened for modification C:\Users\Admin\Videos\desktop.ini sample1.exe File opened for modification C:\Users\Public\Downloads\desktop.ini sample1.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\Stationery\Desktop.ini sample1.exe File opened for modification C:\Users\Admin\Documents\desktop.ini sample1.exe File opened for modification C:\Users\Admin\Downloads\desktop.ini sample1.exe File opened for modification C:\Users\Public\AccountPictures\desktop.ini sample1.exe File opened for modification C:\Users\Public\Documents\desktop.ini sample1.exe File opened for modification C:\Users\Admin\Desktop\desktop.ini sample1.exe File opened for modification C:\Users\Admin\Music\desktop.ini sample1.exe File opened for modification C:\Users\Public\desktop.ini sample1.exe File opened for modification C:\Program Files\Common Files\microsoft shared\Stationery\Desktop.ini sample1.exe File opened for modification C:\Users\Admin\OneDrive\desktop.ini sample1.exe File opened for modification C:\Users\Public\Pictures\desktop.ini sample1.exe File opened for modification C:\Users\Admin\Favorites\desktop.ini sample1.exe File opened for modification C:\Users\Admin\Pictures\Camera Roll\desktop.ini sample1.exe File opened for modification C:\Users\Public\Desktop\desktop.ini sample1.exe File opened for modification C:\Users\Public\Libraries\desktop.ini sample1.exe File opened for modification C:\Users\Public\Videos\desktop.ini sample1.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\images\8794_40x40x32.png sample1.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\images\9434_24x24x32.png sample1.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\images\HxA-Yahoo-Light.scale-200.png sample1.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\en-gb\akira_readme.txt sample1.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\js\nls\zh-tw\akira_readme.txt sample1.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\Professional2019DemoR_BypassTrial180-ul-oob.xrm-ms sample1.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Advertising.Xaml_10.0.1605.0_x86__8wekyb3d8bbwe\resources.pri sample1.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.SkypeApp_11.8.204.0_x64__kzf8qxf38zg5c\SkypeApp\Assets\Images\moji_mask_DarkMain.png sample1.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\SharpDXEngine\Rendering\Shaders\Builtin\HLSL\Sprite.fx sample1.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_17.7668.58071.0_x64__8wekyb3d8bbwe\images\OneNoteAppList.scale-100.png sample1.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.SkypeApp_11.8.204.0_x64__kzf8qxf38zg5c\SkypeApp\Designs\Flags\small\at_16x11.png sample1.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_10.1702.333.0_x64__8wekyb3d8bbwe\Assets\StopwatchMedTile.scale-200.png sample1.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\lib\ext\sunjce_provider.jar sample1.exe File opened for modification C:\Program Files\Microsoft Office\root\Integration\C2RManifest.office32mui.msi.16.en-us.xml sample1.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProjectProO365R_SubTest-pl.xrm-ms sample1.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.People_10.1.10531.0_x64__8wekyb3d8bbwe\Assets\Sounds\Saving_Contact.wav sample1.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1611.10393.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Car\RTL\contrast-black\akira_readme.txt sample1.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\images\bg_patterns_header.png sample1.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProjectProO365R_Subscription-ppd.xrm-ms sample1.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\MSOSEC.XML sample1.exe File created C:\Program Files\Windows Media Player\Skins\akira_readme.txt sample1.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\s_reportabuse-default_18.svg sample1.exe File opened for modification C:\Program Files\Java\jdk-1.8\jmc.txt sample1.exe File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.SkypeApp_11.8.204.0_neutral_split.scale-125_kzf8qxf38zg5c\SkypeApp\Assets\SkypeMedTile.scale-125_contrast-white.png sample1.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_17.7668.58071.0_x64__8wekyb3d8bbwe\images\offsyml.ttf sample1.exe File created C:\Program Files\WindowsApps\Microsoft.MSPaint_1.1702.28017.0_neutral_~_8wekyb3d8bbwe\AppxMetadata\akira_readme.txt sample1.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_17.7668.58071.0_x64__8wekyb3d8bbwe\images\contrast-black\OneNoteSectionWideTile.scale-150.png sample1.exe File created C:\Program Files\WindowsApps\Microsoft.Windows.Photos_16.511.8780.0_x64__8wekyb3d8bbwe\Lumia.ViewerPlugin\ReliveSurfaces\Sequence\akira_readme.txt sample1.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\images\HxA-Google.scale-300.png sample1.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1611.10393.0_x64__8wekyb3d8bbwe\Assets\AppTiles\contrast-white\MapsSmallTile.scale-200.png sample1.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGMN011.XML sample1.exe File opened for modification C:\Program Files\Mozilla Firefox\browser\features\[email protected] sample1.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\Assets\AppTiles\WeatherIcons\30x30\174.png sample1.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\ENUtxt.pdf sample1.exe File opened for modification C:\Program Files\Windows Media Player\Network Sharing\wmpnss_color48.jpg sample1.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\en-us\akira_readme.txt sample1.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MSPaint_1.1702.28017.0_x64__8wekyb3d8bbwe\Assets\Images\Stickers\Sticker_Wood.dxt sample1.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.SkypeApp_11.8.204.0_x64__kzf8qxf38zg5c\SkypeApp\Designs\Flags\small\je_16x11.png sample1.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_OEM_Perp4-ul-phn.xrm-ms sample1.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\Assets\manifestAssets\contrast-black\StoreLogo.scale-100.png sample1.exe File created C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.1.25002.0_neutral_~_8wekyb3d8bbwe\AppxMetadata\akira_readme.txt sample1.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.16112.11621.0_neutral_resources.scale-150_8wekyb3d8bbwe\Assets\contrast-white\iheart-radio.scale-150_contrast-white.png sample1.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\de-de\akira_readme.txt sample1.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\pages-app\js\nls\nb-no\ui-strings.js sample1.exe File created C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\Assets\Buttons\Undo\akira_readme.txt sample1.exe File created C:\Program Files\WindowsApps\Microsoft.Office.OneNote_17.7668.58071.0_x64__8wekyb3d8bbwe\sr-latn-cs\akira_readme.txt sample1.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.SkypeApp_11.8.204.0_x64__kzf8qxf38zg5c\SkypeApp\Designs\Emoticons\small\fingerscrossed.png sample1.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\zh-tw\ui-strings.js sample1.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\Assets\AppPackageAppList.targetsize-40_altform-unplated.png sample1.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.1612.10312.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\InsiderHubWideTile.scale-100.png sample1.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsStore_11701.1001.87.0_x64__8wekyb3d8bbwe\Assets\AppTiles\StoreAppList.targetsize-24_altform-unplated.png sample1.exe File created C:\Program Files\VideoLAN\VLC\locale\sw\LC_MESSAGES\akira_readme.txt sample1.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\acrobat_parcel_generic_32.svg sample1.exe File opened for modification C:\Program Files\Java\jdk-1.8\legal\javafx\gstreamer.md sample1.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\WacLangPack2019Eula.txt sample1.exe File opened for modification C:\Program Files\Microsoft Office\root\rsod\officemui.msi.16.en-us.tree.dat sample1.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_17.7668.58071.0_x64__8wekyb3d8bbwe\images\contrast-black\OneNoteNotebookMedTile.scale-150.png sample1.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.SkypeApp_11.8.204.0_x64__kzf8qxf38zg5c\SkypeApp\Designs\Flags\small\vc_16x11.png sample1.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\images\HxCalendarWideTile.scale-125.png sample1.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.16112.11621.0_x64__8wekyb3d8bbwe\Assets\music_welcome_page2.jpg sample1.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\zh-tw\ui-strings.js sample1.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\SPRING\PREVIEW.GIF sample1.exe File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsAlarms_10.1702.333.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\WorldClockLargeTile.contrast-black_scale-125.png sample1.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_2017.311.255.0_neutral_~_8wekyb3d8bbwe\AppxSignature.p7x sample1.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1408 sample1.exe 1408 sample1.exe 1408 sample1.exe 1408 sample1.exe 1408 sample1.exe 1408 sample1.exe 1408 sample1.exe 1408 sample1.exe 1408 sample1.exe 1408 sample1.exe 1408 sample1.exe 1408 sample1.exe 1408 sample1.exe 1408 sample1.exe 1408 sample1.exe 1408 sample1.exe 1408 sample1.exe 1408 sample1.exe 1408 sample1.exe 1408 sample1.exe 1408 sample1.exe 1408 sample1.exe 1408 sample1.exe 1408 sample1.exe 1408 sample1.exe 1408 sample1.exe 1408 sample1.exe 1408 sample1.exe 1408 sample1.exe 1408 sample1.exe 1408 sample1.exe 1408 sample1.exe 1408 sample1.exe 1408 sample1.exe 1408 sample1.exe 1408 sample1.exe 1408 sample1.exe 1408 sample1.exe 1408 sample1.exe 1408 sample1.exe 1408 sample1.exe 1408 sample1.exe 1408 sample1.exe 1408 sample1.exe 1408 sample1.exe 1408 sample1.exe 1408 sample1.exe 1408 sample1.exe 1408 sample1.exe 1408 sample1.exe 1408 sample1.exe 1408 sample1.exe 1408 sample1.exe 1408 sample1.exe 1408 sample1.exe 1408 sample1.exe 1408 sample1.exe 1408 sample1.exe 1408 sample1.exe 1408 sample1.exe 1408 sample1.exe 1408 sample1.exe 1408 sample1.exe 1408 sample1.exe
Processes
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2KB
MD5bd14c24a37c4a8cf1d6cd63e5542ecca
SHA1c51a9b04bf15ac9749012cf2f9da55035996be90
SHA256962caf0607499b57a00e3f948279c4f200bc58b559705678d3756481c7426ba7
SHA5123a8ca142c9b8584a51f9cdb6bd15554bfce89ba9c4119b25da72d5f5b245d926f31fc9f04482e29af1485051b8500a7bec7c1b383439a9ec7dc8056a5a0630dd