Analysis
-
max time kernel
92s -
max time network
99s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-ja -
resource tags
arch:x64arch:x86image:win10v2004-20240709-jalocale:ja-jpos:windows10-2004-x64systemwindows -
submitted
26-07-2024 05:23
Behavioral task
behavioral1
Sample
1.exe
Resource
win7-20240704-ja
windows7-x64
Behavioral task
behavioral2
Sample
1.exe
Resource
win10v2004-20240709-ja
windows10-2004-x64
General
-
Target
1.exe
-
Size
147KB
-
MD5
e586722144cb8d90672ec57043dd85d0
-
SHA1
44d79cc55fc09b556e5cd29d686ac5658e0b9ada
-
SHA256
f885292741e1b6d1bd35d6c35cf125ade98b5956f88f64e6596bde835fb15984
-
SHA512
90ec3e866ee29d6b40cb7616ca4b5e9d5935be30ac067d07c7d3e81630881670642457326176b6eab15c5c62de55c4e9581bdb767fe894cce63a6cb934a586e7
-
SSDEEP
1536:QzICS4AAwczUUf8y8gvMH+1zGSNAojMP95D1xDHc4KWJXmP0bGAVXVd7YZx3JCTz:vqJogYkcSNm9V7DUWJXm8b7ld7IGTHT
Malware Config
Extracted
C:\6MLkBJomc.README.txt
Signatures
-
Renames multiple (642) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
D467.tmpdescription ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2636447293-1148739154-93880854-1000\Control Panel\International\Geo\Nation D467.tmp -
Deletes itself 1 IoCs
Processes:
D467.tmppid Process 3260 D467.tmp -
Executes dropped EXE 1 IoCs
Processes:
D467.tmppid Process 3260 D467.tmp -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops desktop.ini file(s) 2 IoCs
Processes:
1.exedescription ioc Process File opened for modification C:\$Recycle.Bin\S-1-5-21-2636447293-1148739154-93880854-1000\desktop.ini 1.exe File opened for modification F:\$RECYCLE.BIN\S-1-5-21-2636447293-1148739154-93880854-1000\desktop.ini 1.exe -
Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
-
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
Processes:
D467.tmppid Process 3260 D467.tmp -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
D467.tmpcmd.exe1.exedescription ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D467.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
1.exepid Process 4848 1.exe 4848 1.exe 4848 1.exe 4848 1.exe 4848 1.exe 4848 1.exe 4848 1.exe 4848 1.exe 4848 1.exe 4848 1.exe 4848 1.exe 4848 1.exe 4848 1.exe 4848 1.exe 4848 1.exe 4848 1.exe 4848 1.exe 4848 1.exe 4848 1.exe 4848 1.exe 4848 1.exe 4848 1.exe 4848 1.exe 4848 1.exe 4848 1.exe 4848 1.exe 4848 1.exe 4848 1.exe 4848 1.exe 4848 1.exe 4848 1.exe 4848 1.exe 4848 1.exe 4848 1.exe 4848 1.exe 4848 1.exe 4848 1.exe 4848 1.exe 4848 1.exe 4848 1.exe 4848 1.exe 4848 1.exe 4848 1.exe 4848 1.exe 4848 1.exe 4848 1.exe 4848 1.exe 4848 1.exe 4848 1.exe 4848 1.exe 4848 1.exe 4848 1.exe 4848 1.exe 4848 1.exe 4848 1.exe 4848 1.exe 4848 1.exe 4848 1.exe 4848 1.exe 4848 1.exe 4848 1.exe 4848 1.exe 4848 1.exe 4848 1.exe -
Suspicious behavior: RenamesItself 26 IoCs
Processes:
D467.tmppid Process 3260 D467.tmp 3260 D467.tmp 3260 D467.tmp 3260 D467.tmp 3260 D467.tmp 3260 D467.tmp 3260 D467.tmp 3260 D467.tmp 3260 D467.tmp 3260 D467.tmp 3260 D467.tmp 3260 D467.tmp 3260 D467.tmp 3260 D467.tmp 3260 D467.tmp 3260 D467.tmp 3260 D467.tmp 3260 D467.tmp 3260 D467.tmp 3260 D467.tmp 3260 D467.tmp 3260 D467.tmp 3260 D467.tmp 3260 D467.tmp 3260 D467.tmp 3260 D467.tmp -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
1.exedescription pid Process Token: SeAssignPrimaryTokenPrivilege 4848 1.exe Token: SeBackupPrivilege 4848 1.exe Token: SeDebugPrivilege 4848 1.exe Token: 36 4848 1.exe Token: SeImpersonatePrivilege 4848 1.exe Token: SeIncBasePriorityPrivilege 4848 1.exe Token: SeIncreaseQuotaPrivilege 4848 1.exe Token: 33 4848 1.exe Token: SeManageVolumePrivilege 4848 1.exe Token: SeProfSingleProcessPrivilege 4848 1.exe Token: SeRestorePrivilege 4848 1.exe Token: SeSecurityPrivilege 4848 1.exe Token: SeSystemProfilePrivilege 4848 1.exe Token: SeTakeOwnershipPrivilege 4848 1.exe Token: SeShutdownPrivilege 4848 1.exe Token: SeDebugPrivilege 4848 1.exe Token: SeBackupPrivilege 4848 1.exe Token: SeBackupPrivilege 4848 1.exe Token: SeSecurityPrivilege 4848 1.exe Token: SeSecurityPrivilege 4848 1.exe Token: SeBackupPrivilege 4848 1.exe Token: SeBackupPrivilege 4848 1.exe Token: SeSecurityPrivilege 4848 1.exe Token: SeSecurityPrivilege 4848 1.exe Token: SeBackupPrivilege 4848 1.exe Token: SeBackupPrivilege 4848 1.exe Token: SeSecurityPrivilege 4848 1.exe Token: SeSecurityPrivilege 4848 1.exe Token: SeBackupPrivilege 4848 1.exe Token: SeBackupPrivilege 4848 1.exe Token: SeSecurityPrivilege 4848 1.exe Token: SeSecurityPrivilege 4848 1.exe Token: SeBackupPrivilege 4848 1.exe Token: SeBackupPrivilege 4848 1.exe Token: SeSecurityPrivilege 4848 1.exe Token: SeSecurityPrivilege 4848 1.exe Token: SeBackupPrivilege 4848 1.exe Token: SeBackupPrivilege 4848 1.exe Token: SeSecurityPrivilege 4848 1.exe Token: SeSecurityPrivilege 4848 1.exe Token: SeBackupPrivilege 4848 1.exe Token: SeBackupPrivilege 4848 1.exe Token: SeSecurityPrivilege 4848 1.exe Token: SeSecurityPrivilege 4848 1.exe Token: SeBackupPrivilege 4848 1.exe Token: SeBackupPrivilege 4848 1.exe Token: SeSecurityPrivilege 4848 1.exe Token: SeSecurityPrivilege 4848 1.exe Token: SeBackupPrivilege 4848 1.exe Token: SeBackupPrivilege 4848 1.exe Token: SeSecurityPrivilege 4848 1.exe Token: SeSecurityPrivilege 4848 1.exe Token: SeBackupPrivilege 4848 1.exe Token: SeBackupPrivilege 4848 1.exe Token: SeSecurityPrivilege 4848 1.exe Token: SeSecurityPrivilege 4848 1.exe Token: SeBackupPrivilege 4848 1.exe Token: SeBackupPrivilege 4848 1.exe Token: SeSecurityPrivilege 4848 1.exe Token: SeSecurityPrivilege 4848 1.exe Token: SeBackupPrivilege 4848 1.exe Token: SeBackupPrivilege 4848 1.exe Token: SeSecurityPrivilege 4848 1.exe Token: SeSecurityPrivilege 4848 1.exe -
Suspicious use of WriteProcessMemory 7 IoCs
Processes:
1.exeD467.tmpdescription pid Process procid_target PID 4848 wrote to memory of 3260 4848 1.exe 94 PID 4848 wrote to memory of 3260 4848 1.exe 94 PID 4848 wrote to memory of 3260 4848 1.exe 94 PID 4848 wrote to memory of 3260 4848 1.exe 94 PID 3260 wrote to memory of 1108 3260 D467.tmp 95 PID 3260 wrote to memory of 1108 3260 D467.tmp 95 PID 3260 wrote to memory of 1108 3260 D467.tmp 95
Processes
-
C:\Users\Admin\AppData\Local\Temp\1.exe"C:\Users\Admin\AppData\Local\Temp\1.exe"1⤵
- Drops desktop.ini file(s)
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4848 -
C:\ProgramData\D467.tmp"C:\ProgramData\D467.tmp"2⤵
- Checks computer location settings
- Deletes itself
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:3260 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C DEL /F /Q C:\PROGRA~3\D467.tmp >> NUL3⤵
- System Location Discovery: System Language Discovery
PID:1108
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
129B
MD56eaf8d29a952ae11bd75f534ed233e36
SHA1e7c8b0a899a0d01ea0e4d188afd3456d2311412a
SHA25650de1b6a2934adc41f2dd680b6b75316cf2c8a97efac76fa0f128b3f54e09fe5
SHA5127910b5649fc03f2b9c61207df531d00ce9c81fdc30f4716c1ec7518c9811224ec8d4eee9ad7c686beaec5931c37ab7a5822fc248ac83dc27e6f5555ac89a5888
-
Filesize
1KB
MD55d5e3bcf3bf2dbe5a7550905da970fe7
SHA1435377160c7cc453c1b0f5434cf43f27f0e26f65
SHA2563f87ea04b7b04c9d7d2fd2b631bc1b3273cfda1ffc1562de09feef03e60a706c
SHA5124eb102f496c14d8dd1439b62a920ba0595f74391473c81f88d7ce30bac5c0741217b5065490f66344594f2534bffc2e6f8107b99683b1383e6d91d7e0443e62f
-
Filesize
14KB
MD5294e9f64cb1642dd89229fff0592856b
SHA197b148c27f3da29ba7b18d6aee8a0db9102f47c9
SHA256917e115cc403e29b4388e0d175cbfac3e7e40ca1742299fbdb353847db2de7c2
SHA512b87d531890bf1577b9b4af41dddb2cdbbfa164cf197bd5987df3a3075983645a3acba443e289b7bfd338422978a104f55298fbfe346872de0895bde44adc89cf
-
Filesize
147KB
MD545009dc8c817f5f4e2e89846a61282d7
SHA182879f86fce8abe9c523533883cc8fba009548c8
SHA2561109a6af31a0742c876c8948a386f10d1af1bd3769510a73acce5b12644c6913
SHA51289c864ef8b69e83717f302c7b05b7e3a1a27a35d270195b3e627e1806dc67c8dbddb09e034a40105f58f80dccfda4948edee7d74b811d8b2aebed2352b74de07
-
Filesize
129B
MD5081021666f0890c5b10e7d9a371d4be9
SHA13fd0b7b4bc929a66a0bde1483fa111e7a05ca666
SHA25673d9deb70939c08f8409731a1a01ef373b4da085c5b6110d110357aaec78efaf
SHA512bb6603bc00a5506f2119efb286d7496406a0051bd4369d5c345c81a0613147964edd4be81d56e4852209b3b35a46819d167061ea068ff3d0db12313bed27cf19