Overview

overview

9

Static

static

3

desktop.ini.exe

windows7-x64

9

desktop.ini.exe

windows10-2004-x64

9

Analysis

  • max time kernel
    600s
  • max time network
    441s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    06/08/2024, 17:21

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target

    desktop.ini.exe

  • Size

    167KB

  • MD5

    368305b4e8cecadd85663de1ce71cd9a

  • SHA1

    0af726317f9a708821e6d179488fd6b19c1b7296

  • SHA256

    09de95e4402c8e35e3d5751e704c6b8d8ef3d9c6337c2cd8fb1ea5334510ac4e

  • SHA512

    3d0b385b3150c82de6e2794c6e6a05334a9d1b8dae62fcf980f36d78f695dd9e37d05218afc05a57bfd8afdb34e9368353f8bcdaff397cb131e99b4b3f8ae403

  • SSDEEP

    3072:6e7WpMNca3rytOkWpXfnYRl2l/9HSFHzJ0lB95G:RqKB+tOkWKR0iJ0B5G

Score
9/10
credential_accessdiscoveryransomwarespywarestealer

Malware Config

Signatures

  • Credentials from Password Stores: Credentials from Web Browsers 1 TTPs

    Malicious Access or copy of Web Browser Credential store.

    credential_accessstealer
  • Renames multiple (16204) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware
  • Credentials from Password Stores: Windows Credential Manager 1 TTPs

    Suspicious access to Credentials History.

    credential_accessstealer
  • Drops startup file 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 64 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery

Processes

  • C:\Users\Admin\AppData\Local\Temp\desktop.ini.exe
    "C:\Users\Admin\AppData\Local\Temp\desktop.ini.exe"
    1⤵
    • Drops startup file
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    PID:3676

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\$Recycle.Bin\S-1-5-21-1302416131-1437503476-2806442725-1000\desktop.ini.tmp
          Filesize

          167KB

          MD5

          d1b5fba0bdc4db458ced18d6a6f431ad

          SHA1

          a149ceb955939483ba6a32666d7bfdf075906efc

          SHA256

          20bd4ef3e0d3e7ad60a3f21a9f736731fc658a6deec0c12ee2e3115875389034

          SHA512

          8f0df8a4934e528f0be4825bdb05e9e96659c9fe076409a72b2ea8cf9debeba6af840c6123903bb94a04a5b4a71bb6fe2ed021705dbd86f1dfb792e30a40f5ae

          Download Submit

        • C:\Program Files\7-Zip\7-zip.dll.tmp
          Filesize

          266KB

          MD5

          7b3759d535d5c88f3355de094bd84940

          SHA1

          e083845281ae19635719ac93a08a7142d715702c

          SHA256

          badea1b144a5500d0ab510c4b29cc75c4909b6f6dc37f90aa07115d22a6883f4

          SHA512

          f90dfaca141b978965e6c9d658ba565c963878451b72cde1596935d77b391dc3cab29325aa8069a4e2503a289174603e306efa8f4d9ae2b432ca2c1020e48f86

          Download Submit