Overview

overview

9

Static

static

3

desktop.ini.exe

windows7-x64

9

desktop.ini.exe

windows10-2004-x64

9

Analysis

  • max time kernel
    600s
  • max time network
    317s
  • platform
    windows7_x64
  • resource
    win7-20240705-en
  • resource tags

    arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
  • submitted
    06/08/2024, 17:21

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target

    desktop.ini.exe

  • Size

    167KB

  • MD5

    368305b4e8cecadd85663de1ce71cd9a

  • SHA1

    0af726317f9a708821e6d179488fd6b19c1b7296

  • SHA256

    09de95e4402c8e35e3d5751e704c6b8d8ef3d9c6337c2cd8fb1ea5334510ac4e

  • SHA512

    3d0b385b3150c82de6e2794c6e6a05334a9d1b8dae62fcf980f36d78f695dd9e37d05218afc05a57bfd8afdb34e9368353f8bcdaff397cb131e99b4b3f8ae403

  • SSDEEP

    3072:6e7WpMNca3rytOkWpXfnYRl2l/9HSFHzJ0lB95G:RqKB+tOkWKR0iJ0B5G

Score
9/10
credential_accessdiscoveryransomwarespywarestealer

Malware Config

Signatures

  • Credentials from Password Stores: Credentials from Web Browsers 1 TTPs

    Malicious Access or copy of Web Browser Credential store.

    credential_accessstealer
  • Renames multiple (12207) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware
  • Credentials from Password Stores: Windows Credential Manager 1 TTPs

    Suspicious access to Credentials History.

    credential_accessstealer
  • Drops startup file 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 64 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery

Processes

  • C:\Users\Admin\AppData\Local\Temp\desktop.ini.exe
    "C:\Users\Admin\AppData\Local\Temp\desktop.ini.exe"
    1⤵
    • Drops startup file
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    PID:1432

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\$Recycle.Bin\S-1-5-21-2172136094-3310281978-782691160-1000\desktop.ini.tmp
          Filesize

          167KB

          MD5

          2616a1cb496ad71711a278658262d891

          SHA1

          18bc837dce9b78d1732f515eb7abf1d6a1d5a69e

          SHA256

          b0a24bddce789154be410a67b95e731f4890d75ecd2c894225627184427c1d56

          SHA512

          97f38c998031ed0c6d5e36373c9c3eba9105829d014cf86782d0b1bf6c0782ab001a733da7b3d1298a4e246cef95ffbe2edf79f03c84afbad2ca62f90e334f25

          Download Submit

        • C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp
          Filesize

          176KB

          MD5

          c3a5e5bfe28dceb6732a82738171e510

          SHA1

          a6ba4d4715598bed2fca8ee0b3a664b7ca6224c8

          SHA256

          017f919a292a91e767aa812efbe57dd060417238bcde0a92a4731b64593cb812

          SHA512

          2da5ecb3e747478f1c228175bb60239bf2dbb5884d758f27bc92e600a07eff7371861c0f8dd94dcf36760b5beaf97ccbfada5366f1d79c22d157f658951a04de

          Download Submit