Overview

overview

10

Static

static

10

1/0178b79b...bd.exe

windows7-x64

10

1/0178b79b...bd.exe

windows10-2004-x64

10

1/0280cde4...60.exe

windows7-x64

10

1/0280cde4...60.exe

windows10-2004-x64

10

1/08b76206...65.exe

windows7-x64

10

1/08b76206...65.exe

windows10-2004-x64

10

1/0e4fc438...91.exe

windows7-x64

3

1/0e4fc438...91.exe

windows10-2004-x64

10

1/0fb86a8b...05.exe

windows7-x64

10

1/0fb86a8b...05.exe

windows10-2004-x64

10

1/25898c73...8f.exe

windows7-x64

10

1/25898c73...8f.exe

windows10-2004-x64

10

1/2c2e9491...3c.exe

windows7-x64

3

1/2c2e9491...3c.exe

windows10-2004-x64

10

1/2ef0f582...2e.exe

windows7-x64

3

1/2ef0f582...2e.exe

windows10-2004-x64

10

1/39884fc0...82.exe

windows7-x64

10

1/39884fc0...82.exe

windows10-2004-x64

10

1/3a72ecec...8a.exe

windows7-x64

10

1/3a72ecec...8a.exe

windows10-2004-x64

10

1/3bfcb4f7...71.exe

windows7-x64

10

1/3bfcb4f7...71.exe

windows10-2004-x64

10

1/4103411f...f5.exe

windows7-x64

10

1/4103411f...f5.exe

windows10-2004-x64

10

1/4e0fdb84...95.exe

windows7-x64

3

1/4e0fdb84...95.exe

windows10-2004-x64

7

1/5297372f...33.exe

windows7-x64

5

1/5297372f...33.exe

windows10-2004-x64

5

1/68292f38...e4.exe

windows7-x64

3

1/68292f38...e4.exe

windows10-2004-x64

10

1/6da4696b...e5.exe

windows7-x64

7

1/6da4696b...e5.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    149s
  • max time network
    155s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    02-08-2024 18:52

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    1/0fb86a8ba8fdf57990c283080a671c1320cbcdfd0e8b5f5a250d9c38a6fce305.exe

  • Size

    146KB

  • MD5

    2357ecbcf3b566c76c839daf7ecf2681

  • SHA1

    89d9b7c3eff0a15dc9dbbfe2163de7d5e9479f58

  • SHA256

    0fb86a8ba8fdf57990c283080a671c1320cbcdfd0e8b5f5a250d9c38a6fce305

  • SHA512

    bb5630ae44e684f2dfc74478c57bf97a94045501a64022d563e87f2a60d777307cab2b5a14e6764d25a2fd1f27901624c1ee76ca551d5a5e3a21abc4befef401

  • SSDEEP

    3072:V6glyuxE4GsUPnliByocWepo2NVLiguo/pyEwUS:V6gDBGpvEByocWeauV2gvzwU

Score
10/10
defense_evasiondiscoveryransomwarespywarestealer

Malware Config

Extracted

Path

C:\7V7uPExzv.README.txt

Ransom Note
~~~NULLBULGE LOCK - BASED ON LOCKBIT~~~ >>>> Your data is encrypted... but dont freak out If we encrypted you, you majorly fucked up. But... all can be saved But not for free, we require an xmr payment >>>> What guarantees that we will not deceive you? We are not a politically motivated group and we do not need anything other than your money. If you pay, we will provide you the programs for decryption. Life is too short to be sad. Dont be sad money is only paper. Your files are more important than paper right? If we do not give you decrypter then nobody will pay us in the future. To us, our reputation is very important. There is no dissatisfied victim after payment. >>>> You may contact us and decrypt one file for free on these TOR sites with your personal DECRYPTION ID Download and install TOR Browser https://www.torproject.org/ Write to a chat and wait for the answer, we will always answer you. Sometimes you will need to wait a while Links for Tor Browser: http://nullblgtk7dwzpfklgktzll27ovvnj7pvqkoprmhubnnb32qcbmcpgid.onion/ Link for the normal browser http://group.goocasino.org https://nullbulge.com >>>> Your personal DECRYPTION ID: 217B9D5D58C4AD3C5B31CAB5AC540F46 >>>> Warning! Do not DELETE or MODIFY any files, it can lead to recovery problems!
URLs

http://nullblgtk7dwzpfklgktzll27ovvnj7pvqkoprmhubnnb32qcbmcpgid.onion/

http://group.goocasino.org

https://nullbulge.com

Signatures

  • Renames multiple (638) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Drops desktop.ini file(s) 2 IoCs
  • Indicator Removal: File Deletion 1 TTPs

    Adversaries may delete files left behind by the actions of their intrusion activity.

    defense_evasion
  • Drops file in System32 directory 4 IoCs
  • Sets desktop wallpaper using registry 2 TTPs 2 IoCs
    ransomware
  • Suspicious use of NtSetInformationThreadHideFromDebugger 5 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies Control Panel 2 IoCs
    evasion
  • Modifies registry class 5 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: RenamesItself 26 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of SetWindowsHookEx 13 IoCs
  • Suspicious use of WriteProcessMemory 11 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\1\0fb86a8ba8fdf57990c283080a671c1320cbcdfd0e8b5f5a250d9c38a6fce305.exe
    "C:\Users\Admin\AppData\Local\Temp\1\0fb86a8ba8fdf57990c283080a671c1320cbcdfd0e8b5f5a250d9c38a6fce305.exe"
    1⤵
    • Drops desktop.ini file(s)
    • Sets desktop wallpaper using registry
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4520
    • C:\Windows\splwow64.exe
      C:\Windows\splwow64.exe 12288
      2⤵
      • Drops file in System32 directory
      PID:3860
    • C:\ProgramData\BBDF.tmp
      "C:\ProgramData\BBDF.tmp"
      2⤵
      • Checks computer location settings
      • Deletes itself
      • Executes dropped EXE
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: RenamesItself
      • Suspicious use of WriteProcessMemory
      PID:376
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /C DEL /F /Q C:\PROGRA~3\BBDF.tmp >> NUL
        3⤵
        • System Location Discovery: System Language Discovery
        PID:824
  • C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc
    1⤵
      PID:5076
    • C:\Windows\system32\printfilterpipelinesvc.exe
      C:\Windows\system32\printfilterpipelinesvc.exe -Embedding
      1⤵
      • Drops file in System32 directory
      • Suspicious use of WriteProcessMemory
      PID:4620
      • C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE
        /insertdoc "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\{3A6192AF-9F9B-4A9C-9ED3-CFD1CA437255}.xps" 133670984049820000
        2⤵
        • Checks processor information in registry
        • Enumerates system info in registry
        • Suspicious use of SetWindowsHookEx
        PID:2744

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\$Recycle.Bin\S-1-5-21-523280732-2327480845-3730041215-1000\desktop.ini
      Filesize

      129B

      MD5

      436521f9fb5c4e1166c345a41ca9044b

      SHA1

      a30ff355c55831a037ad4f39db57dba071678847

      SHA256

      d1d907e792e88b6ed3a6aca2cc506b9b5476611f637bf8534094b31e0e182386

      SHA512

      cbd3ba782b5ff1e80f281e29721202bd199db9f06d986821b488a311f6ff3325c281af5bc672f66097243706657fa870031586cd884c87bfd4ff563b681f0fb0

      Download Submit

    • C:\7V7uPExzv.README.txt
      Filesize

      1KB

      MD5

      ce7c4f45b1fbc29a5a8c091e9bf016bb

      SHA1

      8c8ab77395e32194158533f3fb9ece15994f96de

      SHA256

      b095c1aa73b9281a93e2f26d96374bac6b8feafd893f2f4427d71db3f64d304a

      SHA512

      7b4de97586fa51d7575f2bc638e3513e45e671aca1a5c6f1578f5838b70c90aa9c7fc501819a5b81aa33f0e5401300d466d40a055a1898d362b817e0208e5473

      Download Submit

    • C:\ProgramData\BBDF.tmp
      Filesize

      14KB

      MD5

      294e9f64cb1642dd89229fff0592856b

      SHA1

      97b148c27f3da29ba7b18d6aee8a0db9102f47c9

      SHA256

      917e115cc403e29b4388e0d175cbfac3e7e40ca1742299fbdb353847db2de7c2

      SHA512

      b87d531890bf1577b9b4af41dddb2cdbbfa164cf197bd5987df3a3075983645a3acba443e289b7bfd338422978a104f55298fbfe346872de0895bde44adc89cf

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\1\DDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDD
      Filesize

      146KB

      MD5

      a44656549cd1ba36d7d978730d2f2a66

      SHA1

      cee592fec1b3ff3ca8ffaa127da57adb0d7e4a68

      SHA256

      da3052c915846805ee6224690bf6f0955b533e7b6b4a0c63b70a434f90852912

      SHA512

      d40db0a82b6d42da92fd418a67480da1825ded4497b45e6497b4227da3c7e5bc011de29372b157d50674a816d9bdabfda77796a90ed5eb4a706a59593f73a7d0

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\{E0D2E5FD-19B3-4262-A600-878707D4FFF0}
      Filesize

      4KB

      MD5

      bf28821405cbdd5536c21d0ec2b29ca9

      SHA1

      993799388201dad1e8868893fc83e2a3b9709ea0

      SHA256

      2d14bf83fa3e216ba306ff3c3594c3388d012a869b334fb0802b9c09dbdc3189

      SHA512

      c794a6af9909ae21204d2fe6b3a03056685b3a4e0bb44c8d20a3b322f04b9514825032eff5040de57833ec7fb2f0e227ab7cef6fc4971a3c2749a532c207d9b2

      Download Submit

    • C:\Users\Admin\Documents\OneNote Notebooks\My Notebook\Open Notebook.onetoc2
      Filesize

      4KB

      MD5

      ec18682dd18106b2db77fab393fbee2b

      SHA1

      87eb65ed94847000e3896187c168d86b7987555c

      SHA256

      25f21e51c4cf827aa5ed05b580ac3229774aac893ee4b246e453c61c54c6480b

      SHA512

      018683d2f0e1e41c58a185609578e5b3c6a69e821dc6aca3417a731ff2847030a0bbe241688854d51ae5a07fb2dc1294d99f3421cc9e3e3cc9adea6342f560af

      Download Submit

    • F:\$RECYCLE.BIN\S-1-5-21-523280732-2327480845-3730041215-1000\DDDDDDDDDDD
      Filesize

      129B

      MD5

      15d006308b24bed88e5c4ae05796c1e8

      SHA1

      765930f2b28f36064e187345ba4f3a33b2d90a63

      SHA256

      04397ef0feaa11611159f812610eacc8c55ca255c7f73eeb93e79f805a54a48e

      SHA512

      cba729af71e3b41f08230cdb26d7cc88b71d4363e602ea515555675659b4507ff39a21d0114a1396a117c05667aa572daea2dcc36843cb98f3db45830aad3539

      Download Submit

    • memory/2744-2838-0x00007FFD77C10000-0x00007FFD77C20000-memory.dmp

      Filesize

      64KB

      Download

    • memory/2744-2837-0x00007FFD77C10000-0x00007FFD77C20000-memory.dmp

      Filesize

      64KB

      Download

    • memory/2744-2836-0x00007FFD77C10000-0x00007FFD77C20000-memory.dmp

      Filesize

      64KB

      Download

    • memory/2744-2839-0x00007FFD77C10000-0x00007FFD77C20000-memory.dmp

      Filesize

      64KB

      Download

    • memory/2744-2868-0x00007FFD758B0000-0x00007FFD758C0000-memory.dmp

      Filesize

      64KB

      Download

    • memory/2744-2869-0x00007FFD758B0000-0x00007FFD758C0000-memory.dmp

      Filesize

      64KB

      Download

    • memory/2744-2835-0x00007FFD77C10000-0x00007FFD77C20000-memory.dmp

      Filesize

      64KB

      Download

    • memory/4520-1-0x0000000000DE0000-0x0000000000DF0000-memory.dmp

      Filesize

      64KB

      Download

    • memory/4520-0-0x0000000000DE0000-0x0000000000DF0000-memory.dmp

      Filesize

      64KB

      Download

    • memory/4520-2-0x0000000000DE0000-0x0000000000DF0000-memory.dmp

      Filesize

      64KB

      Download