Analysis
-
max time kernel
23s -
max time network
17s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system -
submitted
19-07-2024 04:01
Static task
static1
Behavioral task
behavioral1
Sample
sample1.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
sample1.exe
Resource
win10v2004-20240709-en
General
-
Target
sample1.exe
-
Size
573KB
-
MD5
9f1c1e45b292299818c7fe64c865e67a
-
SHA1
1cce67a2b76d3bcd85f158f533e55296b8aea592
-
SHA256
637e28b38086ff9efd1606805ff57aaf6cdec4537378f019d6070a5efdc9c983
-
SHA512
80eab29223eb6484f35b16582dcee4814d85f23ba8628ea273897afea72ba4c815850dd4ff1391e1f3b49de26fb0525031a56973c72870b4db68ba28a54da3e3
-
SSDEEP
6144:8KIpz8gbJnHlZB1wYvPgwi/YkVlWGGv5wVRU/rCPED3xTfuRkbjaRVepohAYHdGZ:BGz7JHsYKN2v5/G+TfuR1VioyYHjS
Malware Config
Extracted
C:\MSOCache\All Users\akira_readme.txt
akira
https://akiral2iz6a7qgd3ayp3l6yub7xx2uep76idk3u2kollpj5z3z636bad.onion
https://akiralkzxzq2dsrzsrvbr2xgbbu2wgsmxryd4csgfameg52n7efvr2id.onion
Signatures
-
Akira
Akira is a ransomware first seen in March 2023 and targets several industries, including education, finance, real estate, manufacturing, and consulting.
-
Renames multiple (8621) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Drops startup file 1 IoCs
Processes:
sample1.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\akira_readme.txt sample1.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops desktop.ini file(s) 47 IoCs
Processes:
sample1.exedescription ioc process File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini sample1.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\desktop.ini sample1.exe File opened for modification C:\Users\Admin\Pictures\desktop.ini sample1.exe File opened for modification C:\Users\Public\Libraries\desktop.ini sample1.exe File opened for modification C:\Users\Public\Pictures\desktop.ini sample1.exe File opened for modification C:\Program Files\Microsoft Games\Solitaire\desktop.ini sample1.exe File opened for modification C:\Users\Admin\Favorites\Links for United States\desktop.ini sample1.exe File opened for modification C:\Users\Admin\Music\desktop.ini sample1.exe File opened for modification C:\Users\Public\Recorded TV\desktop.ini sample1.exe File opened for modification C:\Users\Public\Videos\Sample Videos\desktop.ini sample1.exe File opened for modification C:\Program Files\Microsoft Games\Hearts\desktop.ini sample1.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\DataServices\DESKTOP.INI sample1.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\RZDJXGPT\desktop.ini sample1.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\V77VW23N\desktop.ini sample1.exe File opened for modification C:\Users\Admin\Documents\desktop.ini sample1.exe File opened for modification C:\Users\Public\desktop.ini sample1.exe File opened for modification C:\Users\Public\Documents\desktop.ini sample1.exe File opened for modification C:\Program Files\Microsoft Games\SpiderSolitaire\desktop.ini sample1.exe File opened for modification C:\Program Files (x86)\desktop.ini sample1.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\0IOH8RGC\desktop.ini sample1.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\DOR6XL06\desktop.ini sample1.exe File opened for modification C:\Users\Admin\Favorites\Links\desktop.ini sample1.exe File opened for modification C:\Users\Admin\Saved Games\desktop.ini sample1.exe File opened for modification C:\Users\Public\Pictures\Sample Pictures\desktop.ini sample1.exe File opened for modification C:\Users\Admin\Contacts\desktop.ini sample1.exe File opened for modification C:\Users\Public\Music\desktop.ini sample1.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\Stationery\Desktop.ini sample1.exe File opened for modification C:\Program Files\Microsoft Games\FreeCell\desktop.ini sample1.exe File opened for modification C:\Program Files\Microsoft Games\Purble Place\desktop.ini sample1.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\Stationery\Desktop.ini sample1.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\desktop.ini sample1.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows Mail\Stationery\Desktop.ini sample1.exe File opened for modification C:\Users\Public\Videos\desktop.ini sample1.exe File opened for modification C:\Program Files\desktop.ini sample1.exe File opened for modification C:\Users\Admin\Videos\desktop.ini sample1.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini sample1.exe File opened for modification C:\Program Files\Microsoft Games\Chess\desktop.ini sample1.exe File opened for modification C:\Users\Admin\Desktop\desktop.ini sample1.exe File opened for modification C:\Users\Admin\Favorites\desktop.ini sample1.exe File opened for modification C:\Users\Public\Desktop\desktop.ini sample1.exe File opened for modification C:\Users\Public\Downloads\desktop.ini sample1.exe File opened for modification C:\Users\Public\Music\Sample Music\desktop.ini sample1.exe File opened for modification C:\Program Files\Microsoft Games\Mahjong\desktop.ini sample1.exe File opened for modification C:\Users\Admin\Downloads\desktop.ini sample1.exe File opened for modification C:\Users\Admin\Links\desktop.ini sample1.exe File opened for modification C:\Users\Admin\Searches\desktop.ini sample1.exe File opened for modification C:\Users\Public\Recorded TV\Sample Media\desktop.ini sample1.exe -
Drops file in Program Files directory 64 IoCs
Processes:
sample1.exedescription ioc process File opened for modification C:\Program Files\VideoLAN\VLC\lua\playlist\bbc_co_uk.luac sample1.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\EDGE\EDGE.ELM sample1.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0341742.JPG sample1.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Fonts\Thatch.xml sample1.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBSPAPR\ZPDIR36F.GIF sample1.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\rtscom.dll.mui sample1.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\SpecialNavigationLeft_SelectionSubpicture.png sample1.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\ModuleAutoDeps\org-netbeans-modules-queries.xml sample1.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Chatham sample1.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0230558.WMF sample1.exe File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\nl.pak sample1.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Regina sample1.exe File opened for modification C:\Program Files\DVD Maker\sonicsptransform.ax sample1.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\OUTLLIBR.DLL.IDX_DLL sample1.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\VPREVIEW.EXE sample1.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\jfxrt.jar sample1.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\mscss7wre_es.dub sample1.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\images\system_s.png sample1.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\SlideShow.Gadget\images\prev_down.png sample1.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\it-IT\js\timeZones.js sample1.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\BD19828_.WMF sample1.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Currency.Gadget\ja-JP\gadget.xml sample1.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Atlantic\Faroe sample1.exe File opened for modification C:\Program Files\Windows Photo Viewer\en-US\ImagingDevices.exe.mui sample1.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\de-DE\flyout.html sample1.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0240175.WMF sample1.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\NA02413_.WMF sample1.exe File created C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\Calendar\akira_readme.txt sample1.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.nl_ja_4.4.0.v20140623020002.jar sample1.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\RSSFeeds.Gadget\de-DE\RSSFeeds.html sample1.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\docked_black_snow.png sample1.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\en-US\js\currency.js sample1.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\SO00453_.WMF sample1.exe File created C:\Program Files (x86)\Microsoft Sync Framework\v1.0\Runtime\x86\resources\akira_readme.txt sample1.exe File opened for modification C:\Program Files (x86)\MSBuild\Microsoft.Office.InfoPath.targets sample1.exe File opened for modification C:\Program Files\Common Files\System\Ole DB\oledbjvs.inc sample1.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\images\settings_box_top.png sample1.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\11.00\can03.ths sample1.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\Sounds\Places\TOOT.WAV sample1.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\ipsrus.xml sample1.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\play-background.png sample1.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0099168.JPG sample1.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\icons\date-span-16.png sample1.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\de-DE\js\init.js sample1.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\RICEPAPR\PREVIEW.GIF sample1.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\ACCTBOX.POC sample1.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\POSTCARD.XML sample1.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\it-IT\gadget.xml sample1.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Bibliography\Style\APA.XSL sample1.exe File opened for modification C:\Program Files\DenyExpand.dotx sample1.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\J0115866.GIF sample1.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PAGESIZE\PGMN092.XML sample1.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\RSSFeeds.Gadget\de-DE\gadget.xml sample1.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Etc\GMT-11 sample1.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\AN04267_.WMF sample1.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\SegoeChess.ttf sample1.exe File opened for modification C:\Program Files\DVD Maker\es-ES\WMM2CLIP.dll.mui sample1.exe File opened for modification C:\Program Files\DVD Maker\ja-JP\WMM2CLIP.dll.mui sample1.exe File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\vi.pak sample1.exe File opened for modification C:\Program Files (x86)\Common Files\System\Ole DB\ja-JP\msdaorar.dll.mui sample1.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\NA00417_.WMF sample1.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\LOGO98.POC sample1.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\PROGRAM.DPV sample1.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\Stationery\To_Do_List.emf sample1.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
sample1.exepid process 2168 sample1.exe 2168 sample1.exe 2168 sample1.exe 2168 sample1.exe 2168 sample1.exe 2168 sample1.exe 2168 sample1.exe 2168 sample1.exe 2168 sample1.exe 2168 sample1.exe 2168 sample1.exe 2168 sample1.exe 2168 sample1.exe 2168 sample1.exe 2168 sample1.exe 2168 sample1.exe 2168 sample1.exe 2168 sample1.exe 2168 sample1.exe 2168 sample1.exe 2168 sample1.exe 2168 sample1.exe 2168 sample1.exe 2168 sample1.exe 2168 sample1.exe 2168 sample1.exe 2168 sample1.exe 2168 sample1.exe 2168 sample1.exe 2168 sample1.exe 2168 sample1.exe 2168 sample1.exe 2168 sample1.exe 2168 sample1.exe 2168 sample1.exe 2168 sample1.exe 2168 sample1.exe 2168 sample1.exe 2168 sample1.exe 2168 sample1.exe 2168 sample1.exe 2168 sample1.exe 2168 sample1.exe 2168 sample1.exe 2168 sample1.exe 2168 sample1.exe 2168 sample1.exe 2168 sample1.exe 2168 sample1.exe 2168 sample1.exe 2168 sample1.exe 2168 sample1.exe 2168 sample1.exe 2168 sample1.exe 2168 sample1.exe 2168 sample1.exe 2168 sample1.exe 2168 sample1.exe 2168 sample1.exe 2168 sample1.exe 2168 sample1.exe 2168 sample1.exe 2168 sample1.exe 2168 sample1.exe
Processes
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2KB
MD5bd14c24a37c4a8cf1d6cd63e5542ecca
SHA1c51a9b04bf15ac9749012cf2f9da55035996be90
SHA256962caf0607499b57a00e3f948279c4f200bc58b559705678d3756481c7426ba7
SHA5123a8ca142c9b8584a51f9cdb6bd15554bfce89ba9c4119b25da72d5f5b245d926f31fc9f04482e29af1485051b8500a7bec7c1b383439a9ec7dc8056a5a0630dd