Overview

overview

10

Static

static

10

002.7z

windows10-2004-x64

3

01c647838c...7f.exe

windows10-2004-x64

10

02f5c32fa2...d6.exe

windows10-2004-x64

6

1a05cba687...a3.exe

windows10-2004-x64

10

1a8f35d0f2...b9.exe

windows10-2004-x64

1af797776e...13.exe

windows10-2004-x64

10

1b2b369f31...2e.exe

windows10-2004-x64

3

1b4a0b685c...db.exe

windows10-2004-x64

3

1b4d73a9a7...89.exe

windows10-2004-x64

10

1ba8934b2e...4d.exe

windows10-2004-x64

3

1c2a51daa5...5b.exe

windows10-2004-x64

10

1c8bc3890f...45.exe

windows10-2004-x64

7

1ce9fa5304...ef.exe

windows10-2004-x64

1d51d46e07...cd.exe

windows10-2004-x64

10

1db9ec5678...e0.exe

windows10-2004-x64

10

1dbbed25cf...88.exe

windows10-2004-x64

1de8054e71...a1.exe

windows10-2004-x64

9

1e56efa724...ba.exe

windows10-2004-x64

3

1e754e1c7e...44.exe

windows10-2004-x64

3

1e8e39da21...bc.exe

windows10-2004-x64

1e9e575dd3...86.exe

windows10-2004-x64

3

1eb6de09f5...69.exe

windows10-2004-x64

4

1f0daca3fc...d9.exe

windows10-2004-x64

6

1f0efbc182...be.exe

windows10-2004-x64

1fd42d07b4...6e.exe

windows10-2004-x64

10

2a02608130...a1.exe

windows10-2004-x64

3

2a05ac3c43...e4.exe

windows10-2004-x64

10

2a32c84488...95.exe

windows10-2004-x64

10

2a6c920bfb...dc.exe

windows10-2004-x64

3

2aebddfd22...c8.exe

windows10-2004-x64

3

2b245f773b...bb.exe

windows10-2004-x64

10

2b331aa02a...b7.exe

windows10-2004-x64

10

Resubmissions

15-10-2024 03:47

241015-ecgjlashrh 10

05-08-2024 04:49

240805-ffygys1eke 10

05-08-2024 03:50

240805-eee4jszepd 10

Analysis

  • max time kernel
    141s
  • max time network
    137s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    05-08-2024 04:49

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    1de8054e71f00406e617230fc22017bfd66c78b216a57cec085ca6a5cb2f24a1.exe

  • Size

    112KB

  • MD5

    b6cfdefd2ef6bb507cbac8634ec3f6a1

  • SHA1

    583bbf424a7114586dd48fe57be999cbd750ba56

  • SHA256

    1de8054e71f00406e617230fc22017bfd66c78b216a57cec085ca6a5cb2f24a1

  • SHA512

    5b8ea7112f2f5ef2f34ac18b9ce8b3afc0016c4603fe222a02a8fc03e115890bcdb4929db273026aded00aa8a226cd49c2b5cd1279086aea049c13ae7608f5e1

  • SSDEEP

    1536:R2HSDWrKs9S4AZvJHU4mKQvXqWJLsYfgIXE0FtRhSH0SJE3PpgNmKRUM:RjaWP3vQNJLsUE03RA1eP87

Score
9/10
credential_accessdefense_evasiondiscoveryexecutionimpactpersistenceransomwarespywarestealer

Malware Config

Signatures

  • Credentials from Password Stores: Credentials from Web Browsers 1 TTPs

    Malicious Access or copy of Web Browser Credential store.

    credential_accessstealer
  • Deletes shadow copies 3 TTPs

    Ransomware often targets backup files to inhibit system recovery.

    ransomwaredefense_evasionimpactexecution
  • Renames multiple (519) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware
  • Credentials from Password Stores: Windows Credential Manager 1 TTPs

    Suspicious access to Credentials History.

    credential_accessstealer
  • Drops startup file 6 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Drops desktop.ini file(s) 64 IoCs
  • Drops file in System32 directory 1 IoCs
  • Sets desktop wallpaper using registry 2 TTPs 1 IoCs
    ransomware
  • Drops file in Program Files directory 64 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Interacts with shadow copies 3 TTPs 2 IoCs

    Shadow copies are often targeted by ransomware to inhibit system recovery.

    ransomware
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\1de8054e71f00406e617230fc22017bfd66c78b216a57cec085ca6a5cb2f24a1.exe
    "C:\Users\Admin\AppData\Local\Temp\1de8054e71f00406e617230fc22017bfd66c78b216a57cec085ca6a5cb2f24a1.exe"
    1⤵
    • Drops startup file
    • Adds Run key to start application
    • Drops desktop.ini file(s)
    • Drops file in System32 directory
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:3560
    • C:\Windows\system32\cmd.exe
      "C:\Windows\system32\cmd.exe"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:4412
      • C:\Windows\system32\mode.com
        mode con cp select=1251
        3⤵
          PID:2920
        • C:\Windows\system32\vssadmin.exe
          vssadmin delete shadows /all /quiet
          3⤵
          • Interacts with shadow copies
          PID:3556
      • C:\Windows\system32\cmd.exe
        "C:\Windows\system32\cmd.exe"
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:5596
        • C:\Windows\system32\mode.com
          mode con cp select=1251
          3⤵
            PID:268
          • C:\Windows\system32\vssadmin.exe
            vssadmin delete shadows /all /quiet
            3⤵
            • Interacts with shadow copies
            PID:5976
      • C:\Windows\system32\vssvc.exe
        C:\Windows\system32\vssvc.exe
        1⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:4360
      • C:\Windows\system32\NOTEPAD.EXE
        "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\How to decrypt your files.txt
        1⤵
          PID:852

        Network

        MITRE ATT&CK Enterprise v15

        Reconnaissance

        Resource Development

        Initial Access

        Execution

        Windows Management Instrumentation

        1
        T1047

        Persistence

        Boot or Logon Autostart Execution

        1
        T1547

        Registry Run Keys / Startup Folder

        1
        T1547.001

        Privilege Escalation

        Boot or Logon Autostart Execution

        1
        T1547

        Registry Run Keys / Startup Folder

        1
        T1547.001

        Defense Evasion

        Direct Volume Access

        1
        T1006

        Indicator Removal

        2
        T1070

        File Deletion

        2
        T1070.004

        Modify Registry

        2
        T1112

        Credential Access

        Credentials from Password Stores

        2
        T1555

        Credentials from Web Browsers

        1
        T1555.003

        Windows Credential Manager

        1
        T1555.004

        Unsecured Credentials

        1
        T1552

        Credentials In Files

        1
        T1552.001

        Discovery

        Browser Information Discovery

        1
        T1217

        System Location Discovery

        1
        T1614

        System Language Discovery

        1
        T1614.001

        Lateral Movement

        Collection

        Data from Local System

        1
        T1005

        Command and Control

        Exfiltration

        Impact

        Defacement

        1
        T1491

        Inhibit System Recovery

        2
        T1490

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Program Files\Common Files\microsoft shared\ClickToRun\AppvIsvSubsystems32.dll.id-CB6EB901.{[email protected]}.xtbl
          Filesize

          2.7MB

          MD5

          966b66f4c47136926c9956a3442495bb

          SHA1

          c7584c276744198122c88fe20461e57f42361342

          SHA256

          20639c3f92ecf69bcc1a747b40176d43fb10c24cf44701d4782cbcc78126942a

          SHA512

          1f27c1eb12525382764ab790a912621d7931aaeecd22b47f4f1dbc74bc7b90cd20b8c10b4c52b25d4a27e6bea2ae50e9bb3717561444255d753d547f8f18dedd

          Download Submit

        • C:\Users\Admin\Desktop\How to decrypt your files.txt
          Filesize

          110B

          MD5

          5433f42607a7437245a6a036736cffe6

          SHA1

          fee3b3806d8377968734e806be1f84f301d35c3f

          SHA256

          b64134f3c6e2175ce91ba8bae9c2c87f168eb0e8f86860b7ec9c785a48d6a56c

          SHA512

          9ad1e6666ed0ae4b94ab22af16df2bfb309648aeec73a1fb1bd1c623ef8c5d66e48d16712aaf3750f55bf691075e4a6c3550fdcb46c7ae24e586e80c681b53e8

          Download Submit