5b731e23be406f4b0e0908bccfba25798fa5fff5695191de760fe385a538688b

Analysis

max time kernel
1800s
max time network
1559s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
20-07-2024 14:23

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

niggaware ransomware in 2029.exe
Size

396KB
MD5

6bea20141f31c1f027e325d631dd7416
SHA1

306060f6d99d2d39dccbca0877725cc88a098651
SHA256

54924abbcd3589b5758a4efb30be4e910488365230f24a97b2d642e699ff4fdc
SHA512

00fb5f0fd5c746edf5441f7e6eddb7dff3fd04b4886c4e0a1349af8be76fced72658a48d96962a3de22612b87fb9b126b5429f0d527a12db7709428a8cdb9bc3
SSDEEP

12288:TfTkNEWWcfMjzcR8eN565iIfhEl08V6pCo:jTkuQMDecG0cZo

Score

10^/10

discovery evasion persistence trojan

Malware Config

Signatures

Windows security bypass 2 TTPs 10 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Processes:

niggaware ransomware in 2029.exe043A6A5B00014973000ABB91B4EB2331.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1"	niggaware ransomware in 2029.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	043A6A5B00014973000ABB91B4EB2331.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	043A6A5B00014973000ABB91B4EB2331.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1"	043A6A5B00014973000ABB91B4EB2331.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	niggaware ransomware in 2029.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	niggaware ransomware in 2029.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	niggaware ransomware in 2029.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	niggaware ransomware in 2029.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	043A6A5B00014973000ABB91B4EB2331.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	043A6A5B00014973000ABB91B4EB2331.exe

Disables taskbar notifications via registry modification
evasion
Deletes itself 1 IoCs

Processes:

043A6A5B00014973000ABB91B4EB2331.exe

pid process

2336 043A6A5B00014973000ABB91B4EB2331.exe
Executes dropped EXE 1 IoCs

Processes:

043A6A5B00014973000ABB91B4EB2331.exe

pid process

2336 043A6A5B00014973000ABB91B4EB2331.exe

Loads dropped DLL 4 IoCs

Processes:

niggaware ransomware in 2029.exe043A6A5B00014973000ABB91B4EB2331.exe

pid	process
1968	niggaware ransomware in 2029.exe
1968	niggaware ransomware in 2029.exe
2336	043A6A5B00014973000ABB91B4EB2331.exe
2336	043A6A5B00014973000ABB91B4EB2331.exe

Windows security modification 2 TTPs 14 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Processes:

niggaware ransomware in 2029.exe043A6A5B00014973000ABB91B4EB2331.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	niggaware ransomware in 2029.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	niggaware ransomware in 2029.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	043A6A5B00014973000ABB91B4EB2331.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	043A6A5B00014973000ABB91B4EB2331.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\svc	043A6A5B00014973000ABB91B4EB2331.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	niggaware ransomware in 2029.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Security Center\svc	niggaware ransomware in 2029.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1"	043A6A5B00014973000ABB91B4EB2331.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Security Center\svc	043A6A5B00014973000ABB91B4EB2331.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	niggaware ransomware in 2029.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	043A6A5B00014973000ABB91B4EB2331.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	043A6A5B00014973000ABB91B4EB2331.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1"	niggaware ransomware in 2029.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\svc	niggaware ransomware in 2029.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

043A6A5B00014973000ABB91B4EB2331.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\043A6A5B00014973000ABB91B4EB2331 = "C:\\ProgramData\\043A6A5B00014973000ABB91B4EB2331\\043A6A5B00014973000ABB91B4EB2331.exe"	043A6A5B00014973000ABB91B4EB2331.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

niggaware ransomware in 2029.exe043A6A5B00014973000ABB91B4EB2331.exe

pid	process
1968	niggaware ransomware in 2029.exe
1968	niggaware ransomware in 2029.exe
1968	niggaware ransomware in 2029.exe
1968	niggaware ransomware in 2029.exe
1968	niggaware ransomware in 2029.exe
1968	niggaware ransomware in 2029.exe
1968	niggaware ransomware in 2029.exe
1968	niggaware ransomware in 2029.exe
1968	niggaware ransomware in 2029.exe
1968	niggaware ransomware in 2029.exe
1968	niggaware ransomware in 2029.exe
1968	niggaware ransomware in 2029.exe
1968	niggaware ransomware in 2029.exe
1968	niggaware ransomware in 2029.exe
2336	043A6A5B00014973000ABB91B4EB2331.exe
2336	043A6A5B00014973000ABB91B4EB2331.exe
2336	043A6A5B00014973000ABB91B4EB2331.exe
2336	043A6A5B00014973000ABB91B4EB2331.exe
2336	043A6A5B00014973000ABB91B4EB2331.exe
2336	043A6A5B00014973000ABB91B4EB2331.exe
2336	043A6A5B00014973000ABB91B4EB2331.exe
2336	043A6A5B00014973000ABB91B4EB2331.exe
2336	043A6A5B00014973000ABB91B4EB2331.exe
2336	043A6A5B00014973000ABB91B4EB2331.exe
2336	043A6A5B00014973000ABB91B4EB2331.exe
2336	043A6A5B00014973000ABB91B4EB2331.exe
2336	043A6A5B00014973000ABB91B4EB2331.exe
2336	043A6A5B00014973000ABB91B4EB2331.exe
2336	043A6A5B00014973000ABB91B4EB2331.exe
2336	043A6A5B00014973000ABB91B4EB2331.exe
2336	043A6A5B00014973000ABB91B4EB2331.exe
2336	043A6A5B00014973000ABB91B4EB2331.exe
2336	043A6A5B00014973000ABB91B4EB2331.exe
2336	043A6A5B00014973000ABB91B4EB2331.exe
1968	niggaware ransomware in 2029.exe
1968	niggaware ransomware in 2029.exe
1968	niggaware ransomware in 2029.exe
1968	niggaware ransomware in 2029.exe
1968	niggaware ransomware in 2029.exe
1968	niggaware ransomware in 2029.exe
2336	043A6A5B00014973000ABB91B4EB2331.exe
2336	043A6A5B00014973000ABB91B4EB2331.exe
2336	043A6A5B00014973000ABB91B4EB2331.exe
2336	043A6A5B00014973000ABB91B4EB2331.exe
2336	043A6A5B00014973000ABB91B4EB2331.exe
2336	043A6A5B00014973000ABB91B4EB2331.exe
2336	043A6A5B00014973000ABB91B4EB2331.exe
2336	043A6A5B00014973000ABB91B4EB2331.exe
2336	043A6A5B00014973000ABB91B4EB2331.exe
2336	043A6A5B00014973000ABB91B4EB2331.exe
2336	043A6A5B00014973000ABB91B4EB2331.exe
2336	043A6A5B00014973000ABB91B4EB2331.exe
1968	niggaware ransomware in 2029.exe
1968	niggaware ransomware in 2029.exe
1968	niggaware ransomware in 2029.exe
1968	niggaware ransomware in 2029.exe
1968	niggaware ransomware in 2029.exe
1968	niggaware ransomware in 2029.exe
2336	043A6A5B00014973000ABB91B4EB2331.exe
2336	043A6A5B00014973000ABB91B4EB2331.exe
2336	043A6A5B00014973000ABB91B4EB2331.exe
2336	043A6A5B00014973000ABB91B4EB2331.exe
2336	043A6A5B00014973000ABB91B4EB2331.exe
2336	043A6A5B00014973000ABB91B4EB2331.exe

Suspicious use of FindShellTrayWindow 13 IoCs

Processes:

043A6A5B00014973000ABB91B4EB2331.exe

pid	process
2336	043A6A5B00014973000ABB91B4EB2331.exe
2336	043A6A5B00014973000ABB91B4EB2331.exe
2336	043A6A5B00014973000ABB91B4EB2331.exe
2336	043A6A5B00014973000ABB91B4EB2331.exe
2336	043A6A5B00014973000ABB91B4EB2331.exe
2336	043A6A5B00014973000ABB91B4EB2331.exe
2336	043A6A5B00014973000ABB91B4EB2331.exe
2336	043A6A5B00014973000ABB91B4EB2331.exe
2336	043A6A5B00014973000ABB91B4EB2331.exe
2336	043A6A5B00014973000ABB91B4EB2331.exe
2336	043A6A5B00014973000ABB91B4EB2331.exe
2336	043A6A5B00014973000ABB91B4EB2331.exe
2336	043A6A5B00014973000ABB91B4EB2331.exe

Suspicious use of SendNotifyMessage 12 IoCs

Processes:

043A6A5B00014973000ABB91B4EB2331.exe

pid	process
2336	043A6A5B00014973000ABB91B4EB2331.exe
2336	043A6A5B00014973000ABB91B4EB2331.exe
2336	043A6A5B00014973000ABB91B4EB2331.exe
2336	043A6A5B00014973000ABB91B4EB2331.exe
2336	043A6A5B00014973000ABB91B4EB2331.exe
2336	043A6A5B00014973000ABB91B4EB2331.exe
2336	043A6A5B00014973000ABB91B4EB2331.exe
2336	043A6A5B00014973000ABB91B4EB2331.exe
2336	043A6A5B00014973000ABB91B4EB2331.exe
2336	043A6A5B00014973000ABB91B4EB2331.exe
2336	043A6A5B00014973000ABB91B4EB2331.exe
2336	043A6A5B00014973000ABB91B4EB2331.exe

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

043A6A5B00014973000ABB91B4EB2331.exe

pid process

2336 043A6A5B00014973000ABB91B4EB2331.exe
2336 043A6A5B00014973000ABB91B4EB2331.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

niggaware ransomware in 2029.exe

description	pid	process	target process
PID 1968 wrote to memory of 2336	1968	niggaware ransomware in 2029.exe	043A6A5B00014973000ABB91B4EB2331.exe
PID 1968 wrote to memory of 2336	1968	niggaware ransomware in 2029.exe	043A6A5B00014973000ABB91B4EB2331.exe
PID 1968 wrote to memory of 2336	1968	niggaware ransomware in 2029.exe	043A6A5B00014973000ABB91B4EB2331.exe
PID 1968 wrote to memory of 2336	1968	niggaware ransomware in 2029.exe	043A6A5B00014973000ABB91B4EB2331.exe

C:\Users\Admin\AppData\Local\Temp\niggaware ransomware in 2029.exe
"C:\Users\Admin\AppData\Local\Temp\niggaware ransomware in 2029.exe"
1⤵
- Windows security bypass
- Loads dropped DLL
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1968

C:\ProgramData\043A6A5B00014973000ABB91B4EB2331\043A6A5B00014973000ABB91B4EB2331.exe
"C:\ProgramData\043A6A5B00014973000ABB91B4EB2331\043A6A5B00014973000ABB91B4EB2331.exe" "C:\Users\Admin\AppData\Local\Temp\niggaware ransomware in 2029.exe"
2⤵
- Windows security bypass
- Deletes itself
- Executes dropped EXE
- Loads dropped DLL
- Windows security modification
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:2336

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\ProgramData\043A6A5B00014973000ABB91B4EB2331\043A6A5B00014973000ABB91B4EB2331.exe

Filesize
396KB

MD5
6bea20141f31c1f027e325d631dd7416

SHA1
306060f6d99d2d39dccbca0877725cc88a098651

SHA256
54924abbcd3589b5758a4efb30be4e910488365230f24a97b2d642e699ff4fdc

SHA512
00fb5f0fd5c746edf5441f7e6eddb7dff3fd04b4886c4e0a1349af8be76fced72658a48d96962a3de22612b87fb9b126b5429f0d527a12db7709428a8cdb9bc3

Download Submit
memory/1968-1-0x0000000000400000-0x00000000004BF000-memory.dmp

Filesize
764KB

Download
memory/1968-0-0x0000000000360000-0x0000000000364000-memory.dmp

Filesize
16KB

Download
memory/1968-2-0x0000000000400000-0x00000000004BF000-memory.dmp

Filesize
764KB

Download
memory/1968-20-0x0000000000400000-0x00000000004BF000-memory.dmp

Filesize
764KB

Download
memory/1968-28-0x0000000000400000-0x00000000004BF000-memory.dmp

Filesize
764KB

Download
memory/2336-12-0x0000000000400000-0x00000000004BF000-memory.dmp

Filesize
764KB

Download
memory/2336-11-0x0000000000400000-0x00000000004BF000-memory.dmp

Filesize
764KB

Download
memory/2336-21-0x0000000000400000-0x00000000004BF000-memory.dmp

Filesize
764KB

Download
memory/2336-30-0x0000000000400000-0x00000000004BF000-memory.dmp

Filesize
764KB

Download
memory/2336-36-0x0000000000400000-0x00000000004BF000-memory.dmp

Filesize
764KB

Download
memory/2336-49-0x0000000000400000-0x00000000004BF000-memory.dmp

Filesize
764KB

Download
memory/2336-50-0x0000000000400000-0x00000000004BF000-memory.dmp

Filesize
764KB

Download
memory/2336-51-0x0000000000400000-0x00000000004BF000-memory.dmp

Filesize
764KB

Download
memory/2336-52-0x0000000000400000-0x00000000004BF000-memory.dmp

Filesize
764KB

Download
memory/2336-53-0x0000000000400000-0x00000000004BF000-memory.dmp

Filesize
764KB

Download
memory/2336-55-0x0000000000400000-0x00000000004BF000-memory.dmp

Filesize
764KB

Download
memory/2336-56-0x0000000000400000-0x00000000004BF000-memory.dmp

Filesize
764KB

Download
memory/2336-57-0x0000000000400000-0x00000000004BF000-memory.dmp

Filesize
764KB

Download
memory/2336-58-0x0000000000400000-0x00000000004BF000-memory.dmp

Filesize
764KB

Download
memory/2336-59-0x0000000000400000-0x00000000004BF000-memory.dmp

Filesize
764KB

Download
memory/2336-60-0x0000000000400000-0x00000000004BF000-memory.dmp

Filesize
764KB

Download
memory/2336-61-0x0000000000400000-0x00000000004BF000-memory.dmp

Filesize
764KB

Download
memory/2336-62-0x0000000000400000-0x00000000004BF000-memory.dmp

Filesize
764KB

Download
memory/2336-63-0x0000000000400000-0x00000000004BF000-memory.dmp

Filesize
764KB

Download
memory/2336-64-0x0000000000400000-0x00000000004BF000-memory.dmp

Filesize
764KB

Download
memory/2336-65-0x0000000000400000-0x00000000004BF000-memory.dmp

Filesize
764KB

Download
memory/2336-66-0x0000000000400000-0x00000000004BF000-memory.dmp

Filesize
764KB

Download
memory/2336-67-0x0000000000400000-0x00000000004BF000-memory.dmp

Filesize
764KB

Download
memory/2336-68-0x0000000000400000-0x00000000004BF000-memory.dmp

Filesize
764KB

Download
memory/2336-69-0x0000000000400000-0x00000000004BF000-memory.dmp

Filesize
764KB

Download
memory/2336-70-0x0000000000400000-0x00000000004BF000-memory.dmp

Filesize
764KB

Download
memory/2336-71-0x0000000000400000-0x00000000004BF000-memory.dmp

Filesize
764KB

Download
memory/2336-72-0x0000000000400000-0x00000000004BF000-memory.dmp

Filesize
764KB

Download
memory/2336-73-0x0000000000400000-0x00000000004BF000-memory.dmp

Filesize
764KB

Download
memory/2336-74-0x0000000000400000-0x00000000004BF000-memory.dmp

Filesize
764KB

Download
memory/2336-75-0x0000000000400000-0x00000000004BF000-memory.dmp

Filesize
764KB

Download
memory/2336-76-0x0000000000400000-0x00000000004BF000-memory.dmp

Filesize
764KB

Download
memory/2336-77-0x0000000000400000-0x00000000004BF000-memory.dmp

Filesize
764KB

Download
memory/2336-78-0x0000000000400000-0x00000000004BF000-memory.dmp

Filesize
764KB

Download
memory/2336-79-0x0000000000400000-0x00000000004BF000-memory.dmp

Filesize
764KB

Download
memory/2336-80-0x0000000000400000-0x00000000004BF000-memory.dmp

Filesize
764KB

Download
memory/2336-81-0x0000000000400000-0x00000000004BF000-memory.dmp

Filesize
764KB

Download
memory/2336-82-0x0000000000400000-0x00000000004BF000-memory.dmp

Filesize
764KB

Download
memory/2336-83-0x0000000000400000-0x00000000004BF000-memory.dmp

Filesize
764KB

Download
memory/2336-84-0x0000000000400000-0x00000000004BF000-memory.dmp

Filesize
764KB

Download
memory/2336-85-0x0000000000400000-0x00000000004BF000-memory.dmp

Filesize
764KB

Download
memory/2336-86-0x0000000000400000-0x00000000004BF000-memory.dmp

Filesize
764KB

Download
memory/2336-87-0x0000000000400000-0x00000000004BF000-memory.dmp

Filesize
764KB

Download
memory/2336-88-0x0000000000400000-0x00000000004BF000-memory.dmp

Filesize
764KB

Download
memory/2336-89-0x0000000000400000-0x00000000004BF000-memory.dmp

Filesize
764KB

Download
memory/2336-90-0x0000000000400000-0x00000000004BF000-memory.dmp

Filesize
764KB

Download