cc65535243dfd3cd54a9c5ecfcb93c7f918a87c725e9c52925017ab92effe278

Resubmissions

08/07/2025, 02:15

250708-cptctazjz610

14/02/2025, 20:11

14/02/2025, 20:11

05/02/2025, 09:01

15/10/2024, 03:47

05/08/2024, 04:49

05/08/2024, 03:50

Analysis

max time kernel
118s
max time network
133s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
05/08/2024, 03:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
1c8bc3890f3f202e459fb87acec4602955697eef3b08c93c15ebb0facb019845.exe
Size 179KB
Sample240805-eee4jszepd
SHA256 1c8bc3890f3f202e459fb87acec4602955697eef3b08c93c15ebb0facb019845
MD5 c2fea37aa19c947614c20fe2ad3aeef2
SHA1 16834915e3db38b5b954c2099d77bcb700428588
SHA512 e5d86b7d03c3428c59b0d0bc7e57089abc8dc8baf3dd9dde47852c43ede1e48804851cfb3ed018121b78248f8e75ed7049ea8b2d6ed6303df36514a016e98e59
SSDEEP 3072:ZTO/rWaQcrcfX25Qs9jRzj/rvV9Yecqj3:tO/rWayXIFVj/rvV9B
MD5 SHA1 SHA512 SSDEEP

Score

6^/10

discovery persistence ransomware

Malware Config

Signatures

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Windows\CurrentVersion\Run\discord = "C:\\Users\\Admin\\AppData\\Local\\discord.exe"	1c8bc3890f3f202e459fb87acec4602955697eef3b08c93c15ebb0facb019845.exe

Sets desktop wallpaper using registry 2 TTPs 1 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\Pictures\\imagezRgXDakPY0CNfvlnIxnKxMErmOCpMG.jpg"	1c8bc3890f3f202e459fb87acec4602955697eef3b08c93c15ebb0facb019845.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	1c8bc3890f3f202e459fb87acec4602955697eef3b08c93c15ebb0facb019845.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NOTEPAD.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 34 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000000d854e951ecdca4792ad3aea80f0355100000000020000000000106600000001000020000000280ea293d0df1f02be8b04be07104e7261533883ad3ca64c77c35f5c3fb99432000000000e8000000002000020000000e6187d190c9e9b5b0926ae117b7ee4c97d6a5fa68901f2139cf3ec99975a20f9900000004e52bb2e5086ce514deae0244f408abeff85b46c889d79547404d09b330781dec390f6b6acf8bd70e84549d73ea536d65b6ef40bd2c9ed88159146634d6ca5f08b98f82c224b389e822261fe9dd3663217fc73ca2de770620597817c83974c636349f542e73876ea55d2e8c29f90cefeb29f2a57fc5e781e5b7f344258a7306180d528de9d3a50c7169d23989ce98773400000009f6c89c2ea4c5928f9ae45768a5882c69da99fc0459e14fc0d9fb0e86fcd4b94f65291c2d6f3a5906edb457aa508546e6b4b987476d02c93a0b243153ca298a3	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{F83A0241-52DD-11EF-8B6F-725FF0DF1EEB} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "428991748"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000000d854e951ecdca4792ad3aea80f03551000000000200000000001066000000010000200000008885e3100d1bdf8205286935107965b16d17985a3daa805c3f8f32e1c4690a86000000000e800000000200002000000075c5c3db1d0d61cf3b98c030cf95bc9af36e706d201e6f418dc7190c766800e620000000d2a092c6136e9609a7202db59231271dde2fae5f456b7be00058c25d5bddf67f40000000fd9eb7b362096a84457d733ebe80101abbb9f72eb3a189df8024e064e1ebb663312dae25bb38366c6cccf1534034ef6d7864b621c41b46da59420bf5bd6099ec	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 7057c4d9eae6da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2460	1c8bc3890f3f202e459fb87acec4602955697eef3b08c93c15ebb0facb019845.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
2460	1c8bc3890f3f202e459fb87acec4602955697eef3b08c93c15ebb0facb019845.exe
2676	iexplore.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
2460	1c8bc3890f3f202e459fb87acec4602955697eef3b08c93c15ebb0facb019845.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2676	iexplore.exe
2676	iexplore.exe
2964	IEXPLORE.EXE
2964	IEXPLORE.EXE
2964	IEXPLORE.EXE
2964	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 2460 wrote to memory of 2432	2460	1c8bc3890f3f202e459fb87acec4602955697eef3b08c93c15ebb0facb019845.exe	32
PID 2460 wrote to memory of 2432	2460	1c8bc3890f3f202e459fb87acec4602955697eef3b08c93c15ebb0facb019845.exe	32
PID 2460 wrote to memory of 2432	2460	1c8bc3890f3f202e459fb87acec4602955697eef3b08c93c15ebb0facb019845.exe	32
PID 2460 wrote to memory of 2432	2460	1c8bc3890f3f202e459fb87acec4602955697eef3b08c93c15ebb0facb019845.exe	32
PID 2460 wrote to memory of 2932	2460	1c8bc3890f3f202e459fb87acec4602955697eef3b08c93c15ebb0facb019845.exe	33
PID 2460 wrote to memory of 2932	2460	1c8bc3890f3f202e459fb87acec4602955697eef3b08c93c15ebb0facb019845.exe	33
PID 2460 wrote to memory of 2932	2460	1c8bc3890f3f202e459fb87acec4602955697eef3b08c93c15ebb0facb019845.exe	33
PID 2460 wrote to memory of 2932	2460	1c8bc3890f3f202e459fb87acec4602955697eef3b08c93c15ebb0facb019845.exe	33
PID 2932 wrote to memory of 2676	2932	cmd.exe	35
PID 2932 wrote to memory of 2676	2932	cmd.exe	35
PID 2932 wrote to memory of 2676	2932	cmd.exe	35
PID 2932 wrote to memory of 2676	2932	cmd.exe	35
PID 2676 wrote to memory of 2964	2676	iexplore.exe	36
PID 2676 wrote to memory of 2964	2676	iexplore.exe	36
PID 2676 wrote to memory of 2964	2676	iexplore.exe	36
PID 2676 wrote to memory of 2964	2676	iexplore.exe	36

C:\Users\Admin\AppData\Local\Temp\1c8bc3890f3f202e459fb87acec4602955697eef3b08c93c15ebb0facb019845.exe
"C:\Users\Admin\AppData\Local\Temp\1c8bc3890f3f202e459fb87acec4602955697eef3b08c93c15ebb0facb019845.exe"
1⤵
- Adds Run key to start application
- Sets desktop wallpaper using registry
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2460
- C:\Windows\SysWOW64\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Roaming\Read Me First!.txt
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2432
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c @echo off & echo github: https://github.com/temon_69 & start https://github.com/temon_69
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2932
- - C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe" https://github.com/temon_69
    3⤵
    - Modifies Internet Explorer settings
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2676
  - - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2676 CREDAT:275457 /prefetch:2
      4⤵
      System Location Discovery: System Language Discovery
      Modifies Internet Explorer settings
      Suspicious use of SetWindowsHookEx
      PID:2964

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Defacement

T1491

Replay Monitor

Loading Replay Monitor...

Downloads

3C428B1A3E5F57D887EC4B864FAC5DCC

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC
Size 914B
SHA256 cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f
MD5 e4a68ac854ac5242460afd72481b2a44
SHA1 df3c24f9bfd666761b268073fe06d1cc8d4f82a4
SHA512 5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5
MD5 SHA1 SHA512

Submit Download

F0ACCF77CDCBFF39F6191887F6D2D357

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357
Size 1KB
SHA256 df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e
MD5 a266bb7dcc38a562631361bbf61dd11b
SHA1 3b1efd3a66ea28b16697394703a72ca340a05bd5
SHA512 0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc
MD5 SHA1 SHA512

Submit Download

3C428B1A3E5F57D887EC4B864FAC5DCC

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC
Size 252B
SHA256 f490b69d8a11cdc99c71cd4e87184dd81f2e9e21b25df290efb009feabf2f971
MD5 7f45e9c876481d18b47aed6d34f722bb
SHA1 c93513314d6a0e10c8ce198f1305f74675ba4c15
SHA512 4cd536742c3a5327a24da98def7f3d6b68e2ca89505fc43aa004231ce2d2e90543825a5a34506d4f5c9ba4ab310f2da8418f4bbfd4d7822d72983c187ab4c3af
MD5 SHA1 SHA512

Submit Download