Overview

overview

1

Static

static

1

patreon-do....3.zip

windows7-x64

1

patreon-do....3.zip

windows10-2004-x64

1

Resubmissions

21/07/2024, 19:41

240721-yehdfs1epe 1

21/07/2024, 19:41

240721-yd3m1a1ene 7

Analysis

  • max time kernel
    140s
  • max time network
    139s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240709-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
  • submitted
    21/07/2024, 19:41

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    patreon-downloader-1.1.3.zip

  • Size

    344KB

  • MD5

    4c4e0c5a125af711acef60db3b5f0a55

  • SHA1

    b139c9af7aae1f7e7d74b49e848211288c5f15fe

  • SHA256

    e91056d140d4b1f647fa92d6ddab5c986c8eb54f738f8c84ce0de009ba901580

  • SHA512

    59dba867f779ad74c7f9dc14ec53f413ff4c601b651ae007849a94c5cfec30ea534e24279496bdc66129d3fcf5e63d64b16362595b7580860a1bd3653d2b0f56

  • SSDEEP

    6144:0jIWdbY1dHQaNx1leUGaHB3SaPoBA+Sb2z7RI+RYkGW+PTsk9Sn9TLyRm/GqaibN:0jIWZYnHQaNx1leUGo3SYoBA+yZ0HGP8

Score
1/10

Malware Config

Signatures

  • Opens file in notepad (likely ransom note) 1 IoCs
    ransomware
  • Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes

  • C:\Windows\Explorer.exe
    C:\Windows\Explorer.exe /idlist,,C:\Users\Admin\AppData\Local\Temp\patreon-downloader-1.1.3.zip
    1⤵
      PID:3956
    • C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Desktop\ExpandReset.cmd" "
      1⤵
        PID:228
      • C:\Windows\system32\AUDIODG.EXE
        C:\Windows\system32\AUDIODG.EXE 0x344 0x348
        1⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:2448
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Desktop\ExpandReset.cmd" "
        1⤵
          PID:1552
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Desktop\ExpandReset.cmd" "
          1⤵
            PID:2556
          • C:\Windows\system32\cmd.exe
            C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Desktop\ExpandReset.cmd" "
            1⤵
              PID:4848
            • C:\Windows\system32\cmd.exe
              C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Desktop\ExpandReset.bat" "
              1⤵
                PID:3052
              • C:\Windows\system32\cmd.exe
                C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Desktop\ExpandReset.bat" "
                1⤵
                  PID:1680
                • C:\Windows\system32\cmd.exe
                  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Desktop\ExpandReset.bat" "
                  1⤵
                    PID:4772
                  • C:\Windows\system32\cmd.exe
                    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Desktop\ExpandReset.bat" "
                    1⤵
                      PID:1340
                    • C:\Windows\system32\cmd.exe
                      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Desktop\ExpandReset.bat" "
                      1⤵
                        PID:4704
                      • C:\Windows\system32\cmd.exe
                        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Desktop\ExpandReset.bat" "
                        1⤵
                          PID:4920
                        • C:\Windows\system32\cmd.exe
                          C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Desktop\ExpandReset.bat" "
                          1⤵
                            PID:4008
                          • C:\Windows\system32\cmd.exe
                            C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Desktop\ExpandReset.bat" "
                            1⤵
                              PID:4080
                            • C:\Windows\System32\WScript.exe
                              "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\BlockPing.vbe"
                              1⤵
                                PID:3044
                              • C:\Windows\System32\NOTEPAD.EXE
                                "C:\Windows\System32\NOTEPAD.EXE" C:\Users\Admin\Desktop\ExpandReset.bat
                                1⤵
                                • Opens file in notepad (likely ransom note)
                                PID:2832

                              Network

                              MITRE ATT&CK Matrix

                              Replay Monitor

                              Loading Replay Monitor...

                              Downloads