Overview

overview

10

Static

static

10

1/0178b79b...bd.exe

windows11-21h2-x64

10

1/0280cde4...60.exe

windows11-21h2-x64

10

1/08b76206...65.exe

windows11-21h2-x64

10

1/0e4fc438...91.exe

windows11-21h2-x64

10

1/0fb86a8b...05.exe

windows11-21h2-x64

10

1/25898c73...8f.exe

windows11-21h2-x64

10

1/2c2e9491...3c.exe

windows11-21h2-x64

10

1/2ef0f582...2e.exe

windows11-21h2-x64

10

1/39884fc0...82.exe

windows11-21h2-x64

10

1/3a72ecec...8a.exe

windows11-21h2-x64

10

1/3bfcb4f7...71.exe

windows11-21h2-x64

10

1/4103411f...f5.exe

windows11-21h2-x64

10

1/4e0fdb84...95.exe

windows11-21h2-x64

3

1/5297372f...33.exe

windows11-21h2-x64

5

1/68292f38...e4.exe

windows11-21h2-x64

10

1/6da4696b...e5.exe

windows11-21h2-x64

7

1/7021c9cb...78.exe

windows11-21h2-x64

10

1/752f5cc5...60.exe

windows11-21h2-x64

10

1/7c7cded8...0c.exe

windows11-21h2-x64

10

1/97d29ffc...84.exe

windows11-21h2-x64

7

1/a306cc84...03.exe

windows11-21h2-x64

3

1/ae1a168f...74.exe

windows11-21h2-x64

7

1/b13f2364...d6.exe

windows11-21h2-x64

8

1/b2a1d168...9d.bat

windows11-21h2-x64

8

1/bb29aeb6...bd.exe

windows11-21h2-x64

8

1/c8e5a24a...f5.bat

windows11-21h2-x64

8

1/c9736cdc...97.exe

windows11-21h2-x64

8

1/d58780d1...a0.exe

windows11-21h2-x64

10

1/de19e016...d0.exe

windows11-21h2-x64

3

1/e886016e...51.exe

windows11-21h2-x64

10

1/f0f496ec...f4.bat

windows11-21h2-x64

8

1/f28599b0...23.exe

windows11-21h2-x64

10

Resubmissions

11-12-2024 15:32

241211-sy44nssrdm 10

09-08-2024 21:57

240809-1t1vfs1cpm 10

06-08-2024 13:01

240806-p9f97szdlm 10

06-08-2024 12:52

240806-p3672stdkg 10

06-08-2024 12:29

240806-ppa8fsygqr 10

06-08-2024 12:26

240806-pmc92ashlh 10

Analysis

  • max time kernel
    47s
  • max time network
    41s
  • platform
    windows11-21h2_x64
  • resource
    win11-20240802-en
  • resource tags

    arch:x64arch:x86image:win11-20240802-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    06-08-2024 12:52

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    1/f28599b06560617bccdfb56acc841f3e642ff51b9956632fcc4204f026711e23.exe

  • Size

    146KB

  • MD5

    314275168bf7958219662a242dbfe8a7

  • SHA1

    d629032d9d8f491d133ee26a230c393335d7ad74

  • SHA256

    f28599b06560617bccdfb56acc841f3e642ff51b9956632fcc4204f026711e23

  • SHA512

    b5246db461ee78d622a33a758b3d178208b88e0b9e98185f17ee95f2fbbcf66b1059afece1dd5b586d01587bc01662491a6baab208b9836d4b4b9efc55f14c2f

  • SSDEEP

    3072:V6glyuxE4GsUPnliByocWepo2NVLiguo/pyEwUSx:V6gDBGpvEByocWeauV2gvzwUA

Score
10/10
defense_evasiondiscoveryransomwarespywarestealer

Malware Config

Extracted

Path

C:\7V7uPExzv.README.txt

Ransom Note
~~~NULLBULGE LOCK - BASED ON LOCKBIT~~~ >>>> Your data is encrypted... but dont freak out If we encrypted you, you majorly fucked up. But... all can be saved But not for free, we require an xmr payment >>>> What guarantees that we will not deceive you? We are not a politically motivated group and we do not need anything other than your money. If you pay, we will provide you the programs for decryption. Life is too short to be sad. Dont be sad money is only paper. Your files are more important than paper right? If we do not give you decrypter then nobody will pay us in the future. To us, our reputation is very important. There is no dissatisfied victim after payment. >>>> You may contact us and decrypt one file for free on these TOR sites with your personal DECRYPTION ID Download and install TOR Browser https://www.torproject.org/ Write to a chat and wait for the answer, we will always answer you. Sometimes you will need to wait a while Links for Tor Browser: http://nullblgtk7dwzpfklgktzll27ovvnj7pvqkoprmhubnnb32qcbmcpgid.onion/ Link for the normal browser http://group.goocasino.org https://nullbulge.com >>>> Your personal DECRYPTION ID: 217B9D5D58C4AD3C55477D9CC42DDB5E >>>> Warning! Do not DELETE or MODIFY any files, it can lead to recovery problems!
URLs

http://nullblgtk7dwzpfklgktzll27ovvnj7pvqkoprmhubnnb32qcbmcpgid.onion/

http://group.goocasino.org

https://nullbulge.com

Signatures

  • Renames multiple (569) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware
  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Drops desktop.ini file(s) 2 IoCs
  • Indicator Removal: File Deletion 1 TTPs

    Adversaries may delete files left behind by the actions of their intrusion activity.

    defense_evasion
  • Drops file in System32 directory 4 IoCs
  • Sets desktop wallpaper using registry 2 TTPs 2 IoCs
    ransomware
  • Suspicious use of NtSetInformationThreadHideFromDebugger 5 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies Control Panel 2 IoCs
    evasion
  • Modifies registry class 5 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: RenamesItself 26 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of SetWindowsHookEx 13 IoCs
  • Suspicious use of WriteProcessMemory 11 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\1\f28599b06560617bccdfb56acc841f3e642ff51b9956632fcc4204f026711e23.exe
    "C:\Users\Admin\AppData\Local\Temp\1\f28599b06560617bccdfb56acc841f3e642ff51b9956632fcc4204f026711e23.exe"
    1⤵
    • Drops desktop.ini file(s)
    • Sets desktop wallpaper using registry
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:3856
    • C:\Windows\splwow64.exe
      C:\Windows\splwow64.exe 12288
      2⤵
      • Drops file in System32 directory
      PID:4896
    • C:\ProgramData\C94C.tmp
      "C:\ProgramData\C94C.tmp"
      2⤵
      • Deletes itself
      • Executes dropped EXE
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: RenamesItself
      • Suspicious use of WriteProcessMemory
      PID:896
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /C DEL /F /Q C:\PROGRA~3\C94C.tmp >> NUL
        3⤵
        • System Location Discovery: System Language Discovery
        PID:4100
  • C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc
    1⤵
      PID:4728
    • C:\Windows\system32\printfilterpipelinesvc.exe
      C:\Windows\system32\printfilterpipelinesvc.exe -Embedding
      1⤵
      • Drops file in System32 directory
      • Suspicious use of WriteProcessMemory
      PID:3348
      • C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE
        /insertdoc "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\{80C1041D-7BFD-4DB9-B3BB-61996D7DF24C}.xps" 133674223743130000
        2⤵
        • Checks processor information in registry
        • Enumerates system info in registry
        • Suspicious use of SetWindowsHookEx
        PID:4808

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\$Recycle.Bin\S-1-5-21-661032028-162657920-1226909816-1000\IIIIIIIIIII
      Filesize

      129B

      MD5

      b39854a4b72eac00fd98d0f8211f2ad8

      SHA1

      574a44aa92a4c86ddd87938b837686f28556ad64

      SHA256

      89872fc746674b58c66261132b692238f779d4cfe2cd7f33f2d2dfa540524f7c

      SHA512

      a00f53c1e37be679278f1a4ea16d138e61f958596a365f7df6ffc44adcf1cf54dc896a07223b66c8526659d77fae30068cc01f2109ed1364bfb6b54c4232108f

      Download Submit

    • C:\7V7uPExzv.README.txt
      Filesize

      1KB

      MD5

      87355a342ee82d86bd1909e52667c6b7

      SHA1

      e55d4e79a09416e7b90d19b224e238fc901d5728

      SHA256

      864b6859d9eb8ced3746b5074cf394626af91276a96d3d82fed33a7f43f0d85b

      SHA512

      af526eb01c7dc651c2509a8293872c0603c2ecc0ee21628d3b26d5c8b0758652f378d50c58f55efdc030a78b62f35d95858302a0a4cd03f00eb53fc51fb9be24

      Download Submit

    • C:\ProgramData\C94C.tmp
      Filesize

      14KB

      MD5

      294e9f64cb1642dd89229fff0592856b

      SHA1

      97b148c27f3da29ba7b18d6aee8a0db9102f47c9

      SHA256

      917e115cc403e29b4388e0d175cbfac3e7e40ca1742299fbdb353847db2de7c2

      SHA512

      b87d531890bf1577b9b4af41dddb2cdbbfa164cf197bd5987df3a3075983645a3acba443e289b7bfd338422978a104f55298fbfe346872de0895bde44adc89cf

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\1\DDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDD
      Filesize

      146KB

      MD5

      fcb7fd440097e97b420addfefeb2cde3

      SHA1

      8b5293df18cbc24be6b1dff8d1907c98c5a6a3ac

      SHA256

      2a3cffe5c2af57aab83ead3d248385fd9cf351a7baf24da5a5fbfab4c3ac62ae

      SHA512

      fb4b83629206047e4280abdeb795d510153dace2f8b5a9f2cac89be4fa335061f07134ec6bd922539165768095d0b8f4420168caca9d7d1d5d419f57c7c5c50e

      Download Submit

    • C:\Users\Admin\Documents\OneNote Notebooks\My Notebook\Open Notebook.onetoc2
      Filesize

      4KB

      MD5

      f5b2b7437591066f49e69f56a6743805

      SHA1

      afac42728a30bb8f037ee2b561f5e5bd20e93cd0

      SHA256

      43777fe595243b06fcf6b762c3249066acf0053b918b98b054d098ab94d2d6ff

      SHA512

      e577b4c0d12b2c07dc04b97e9de64c2c5267743a643c4d345b11f1b80b14a71eb6b9144bfdc65cb836a573d65ff5448d3d33789fdd5670d78c2946b1bfde0600

      Download Submit

    • F:\$RECYCLE.BIN\S-1-5-21-661032028-162657920-1226909816-1000\DDDDDDDDDDD
      Filesize

      129B

      MD5

      0d062348e10bf563cf6a660f612791db

      SHA1

      1ec58a92113feaeedabe9399034671d74d3225be

      SHA256

      036651b43dfc7e5a14e7fbc300cd0cab331108b135d8ece449c29e4ce3027cd1

      SHA512

      33c35200902e49c1a0dc06abd9c8efcfa97bb297a1a78191bd2b0e0f52a476403ced4dbabe647e1c7c6899391f307ad36c6873d1db6e8d5d2352501423cf3c47

      Download Submit

    • memory/3856-2-0x0000000003020000-0x0000000003030000-memory.dmp

      Filesize

      64KB

      Download

    • memory/3856-0-0x0000000003020000-0x0000000003030000-memory.dmp

      Filesize

      64KB

      Download

    • memory/3856-1-0x0000000003020000-0x0000000003030000-memory.dmp

      Filesize

      64KB

      Download

    • memory/4808-2826-0x00007FF90B4D0000-0x00007FF90B4E0000-memory.dmp

      Filesize

      64KB

      Download

    • memory/4808-2827-0x00007FF90B4D0000-0x00007FF90B4E0000-memory.dmp

      Filesize

      64KB

      Download

    • memory/4808-2828-0x00007FF90B4D0000-0x00007FF90B4E0000-memory.dmp

      Filesize

      64KB

      Download

    • memory/4808-2829-0x00007FF90B4D0000-0x00007FF90B4E0000-memory.dmp

      Filesize

      64KB

      Download

    • memory/4808-2830-0x00007FF90B4D0000-0x00007FF90B4E0000-memory.dmp

      Filesize

      64KB

      Download

    • memory/4808-2859-0x00007FF9090D0000-0x00007FF9090E0000-memory.dmp

      Filesize

      64KB

      Download

    • memory/4808-2860-0x00007FF9090D0000-0x00007FF9090E0000-memory.dmp

      Filesize

      64KB

      Download