Analysis
-
max time kernel
86s -
max time network
47s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
10-08-2024 16:10
Behavioral task
behavioral1
Sample
setup.exe
Resource
win7-20240704-en
windows7-x64
Behavioral task
behavioral2
Sample
setup.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
General
-
Target
setup.exe
-
Size
146KB
-
MD5
ef531da468065fc649d072824c9a76e2
-
SHA1
93c35e2e7f4915645479f6ae680683dcb3d9bc54
-
SHA256
d12c35c8825aad5b09855a89102236774ca847a7559132c4e9d92aaf69772815
-
SHA512
4c212df24e00fb7d93a5d26f27c3c0628cd7dbea67d7ee72844d1de5d6c5713860e423a01a8226da825882507f5982a06d01d8677e8bb26c66a43f131dac7894
-
SSDEEP
1536:IzICS4AAwczUUf8y8gvMH+1zGSNAojMP95D1xDjkxB81Hd8lQG9XtPmSQVwpdNIQ:XqJogYkcSNm9V7DjQPQGfjLpjIa1tT
Malware Config
Extracted
C:\xgU6NOijB.README.txt
https://t.me/bit_decryptor
Signatures
-
Renames multiple (790) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Deletes itself 1 IoCs
pid Process 2300 1DFC.tmp -
Executes dropped EXE 1 IoCs
pid Process 2300 1DFC.tmp -
Loads dropped DLL 1 IoCs
pid Process 1512 setup.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops desktop.ini file(s) 2 IoCs
description ioc Process File opened for modification C:\$Recycle.Bin\S-1-5-21-2212144002-1172735686-1556890956-1000\desktop.ini setup.exe File opened for modification F:\$RECYCLE.BIN\S-1-5-21-2212144002-1172735686-1556890956-1000\desktop.ini setup.exe -
Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
-
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
pid Process 2300 1DFC.tmp -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language setup.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1DFC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe -
Suspicious behavior: EnumeratesProcesses 24 IoCs
pid Process 1512 setup.exe 1512 setup.exe 1512 setup.exe 1512 setup.exe 1512 setup.exe 1512 setup.exe 1512 setup.exe 1512 setup.exe 1512 setup.exe 1512 setup.exe 1512 setup.exe 1512 setup.exe 1512 setup.exe 1512 setup.exe 1512 setup.exe 1512 setup.exe 1512 setup.exe 1512 setup.exe 1512 setup.exe 1512 setup.exe 1512 setup.exe 1512 setup.exe 1512 setup.exe 1512 setup.exe -
Suspicious behavior: RenamesItself 26 IoCs
pid Process 2300 1DFC.tmp 2300 1DFC.tmp 2300 1DFC.tmp 2300 1DFC.tmp 2300 1DFC.tmp 2300 1DFC.tmp 2300 1DFC.tmp 2300 1DFC.tmp 2300 1DFC.tmp 2300 1DFC.tmp 2300 1DFC.tmp 2300 1DFC.tmp 2300 1DFC.tmp 2300 1DFC.tmp 2300 1DFC.tmp 2300 1DFC.tmp 2300 1DFC.tmp 2300 1DFC.tmp 2300 1DFC.tmp 2300 1DFC.tmp 2300 1DFC.tmp 2300 1DFC.tmp 2300 1DFC.tmp 2300 1DFC.tmp 2300 1DFC.tmp 2300 1DFC.tmp -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeAssignPrimaryTokenPrivilege 1512 setup.exe Token: SeBackupPrivilege 1512 setup.exe Token: SeDebugPrivilege 1512 setup.exe Token: 36 1512 setup.exe Token: SeImpersonatePrivilege 1512 setup.exe Token: SeIncBasePriorityPrivilege 1512 setup.exe Token: SeIncreaseQuotaPrivilege 1512 setup.exe Token: 33 1512 setup.exe Token: SeManageVolumePrivilege 1512 setup.exe Token: SeProfSingleProcessPrivilege 1512 setup.exe Token: SeRestorePrivilege 1512 setup.exe Token: SeSecurityPrivilege 1512 setup.exe Token: SeSystemProfilePrivilege 1512 setup.exe Token: SeTakeOwnershipPrivilege 1512 setup.exe Token: SeShutdownPrivilege 1512 setup.exe Token: SeDebugPrivilege 1512 setup.exe Token: SeBackupPrivilege 1512 setup.exe Token: SeBackupPrivilege 1512 setup.exe Token: SeSecurityPrivilege 1512 setup.exe Token: SeSecurityPrivilege 1512 setup.exe Token: SeBackupPrivilege 1512 setup.exe Token: SeBackupPrivilege 1512 setup.exe Token: SeSecurityPrivilege 1512 setup.exe Token: SeSecurityPrivilege 1512 setup.exe Token: SeBackupPrivilege 1512 setup.exe Token: SeBackupPrivilege 1512 setup.exe Token: SeSecurityPrivilege 1512 setup.exe Token: SeSecurityPrivilege 1512 setup.exe Token: SeBackupPrivilege 1512 setup.exe Token: SeBackupPrivilege 1512 setup.exe Token: SeSecurityPrivilege 1512 setup.exe Token: SeSecurityPrivilege 1512 setup.exe Token: SeBackupPrivilege 1512 setup.exe Token: SeBackupPrivilege 1512 setup.exe Token: SeSecurityPrivilege 1512 setup.exe Token: SeSecurityPrivilege 1512 setup.exe Token: SeBackupPrivilege 1512 setup.exe Token: SeBackupPrivilege 1512 setup.exe Token: SeSecurityPrivilege 1512 setup.exe Token: SeSecurityPrivilege 1512 setup.exe Token: SeBackupPrivilege 1512 setup.exe Token: SeBackupPrivilege 1512 setup.exe Token: SeSecurityPrivilege 1512 setup.exe Token: SeSecurityPrivilege 1512 setup.exe Token: SeBackupPrivilege 1512 setup.exe Token: SeBackupPrivilege 1512 setup.exe Token: SeSecurityPrivilege 1512 setup.exe Token: SeSecurityPrivilege 1512 setup.exe Token: SeBackupPrivilege 1512 setup.exe Token: SeBackupPrivilege 1512 setup.exe Token: SeSecurityPrivilege 1512 setup.exe Token: SeSecurityPrivilege 1512 setup.exe Token: SeBackupPrivilege 1512 setup.exe Token: SeBackupPrivilege 1512 setup.exe Token: SeSecurityPrivilege 1512 setup.exe Token: SeSecurityPrivilege 1512 setup.exe Token: SeBackupPrivilege 1512 setup.exe Token: SeBackupPrivilege 1512 setup.exe Token: SeSecurityPrivilege 1512 setup.exe Token: SeSecurityPrivilege 1512 setup.exe Token: SeBackupPrivilege 1512 setup.exe Token: SeBackupPrivilege 1512 setup.exe Token: SeSecurityPrivilege 1512 setup.exe Token: SeSecurityPrivilege 1512 setup.exe -
Suspicious use of WriteProcessMemory 15 IoCs
description pid Process procid_target PID 1512 wrote to memory of 2300 1512 setup.exe 32 PID 1512 wrote to memory of 2300 1512 setup.exe 32 PID 1512 wrote to memory of 2300 1512 setup.exe 32 PID 1512 wrote to memory of 2300 1512 setup.exe 32 PID 1512 wrote to memory of 2300 1512 setup.exe 32 PID 1512 wrote to memory of 2300 1512 setup.exe 32 PID 1512 wrote to memory of 2300 1512 setup.exe 32 PID 1512 wrote to memory of 2300 1512 setup.exe 32 PID 2300 wrote to memory of 1228 2300 1DFC.tmp 33 PID 2300 wrote to memory of 1228 2300 1DFC.tmp 33 PID 2300 wrote to memory of 1228 2300 1DFC.tmp 33 PID 2300 wrote to memory of 1228 2300 1DFC.tmp 33 PID 2300 wrote to memory of 1228 2300 1DFC.tmp 33 PID 2300 wrote to memory of 1228 2300 1DFC.tmp 33 PID 2300 wrote to memory of 1228 2300 1DFC.tmp 33
Processes
-
C:\Users\Admin\AppData\Local\Temp\setup.exe"C:\Users\Admin\AppData\Local\Temp\setup.exe"1⤵
- Loads dropped DLL
- Drops desktop.ini file(s)
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1512 -
C:\ProgramData\1DFC.tmp"C:\ProgramData\1DFC.tmp"2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:2300 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C DEL /F /Q C:\PROGRA~3\1DFC.tmp >> NUL3⤵
- System Location Discovery: System Language Discovery
PID:1228
-
-
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x1541⤵PID:1040
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
129B
MD5cda6e6ddd843b6c7a93c3f7302921f13
SHA1f64b3d4289206ee48828419f400c62ae39f7c971
SHA2560b5b8a3ae0a724667a8813d2f0e8a2c347b6c507e09d8de36b1796227bd74d26
SHA5122f5bab3251e54e20fb597ee6ae4f5a490170788ac5a4ddf49cf6a774d4215f250584648df283f33d1f9a6c135c5e464399e3f19871331a9a32dd88e38cc195e0
-
Filesize
146KB
MD584840deeac461d580fccb9671e30ad2b
SHA1b8aa8e232b251070f7a02cbd89bbcf5c4c23ecd7
SHA2561b9512cf5f57b771615079544813fa08d3e606c991012c82e545e50f2f4c31b2
SHA512c25d8c4a4df8f051b9fee466c1efa568b56f2bb55826ac411eee85456d2e9d1d1e524a705919c29385663819c40258347cc4c9ef2ea39ff67771ca8471ee7447
-
Filesize
659B
MD5afbda1a44cc177afda6301841fbc27c3
SHA1fcd4ea70e2ad521a194442879807f9c888e15fdc
SHA256560c2c79c2d29de0e0461a7daec81b447c0028b8dd08b7e9cd5a82d982f82db7
SHA51271557e300ea016454e8262b70d96e3cd2ec23d3e7361fb71e15133830aa56462e79d58d00ce1ee685bfdc3190d6bb104d235ecc0cf8ab70c5ec3cd214a7b59a8
-
Filesize
129B
MD589df516a0c46a76d66636ad840fcd266
SHA1490030ea93ff1cffc69c48a5ab6f2f484bae54e9
SHA256f91fa4ea72d7dd0ebe34516b7e37cf5b3bbc856606508496d67a5365043130f0
SHA51232601abb7d7437bffca441f42b9f1c92e13f04c1691407d8caf0a55bb27462f1c62b093b916dae6e90b0be9a9b3634803e6470ffe7d7a0ad39fa460a674d04ee
-
Filesize
14KB
MD5294e9f64cb1642dd89229fff0592856b
SHA197b148c27f3da29ba7b18d6aee8a0db9102f47c9
SHA256917e115cc403e29b4388e0d175cbfac3e7e40ca1742299fbdb353847db2de7c2
SHA512b87d531890bf1577b9b4af41dddb2cdbbfa164cf197bd5987df3a3075983645a3acba443e289b7bfd338422978a104f55298fbfe346872de0895bde44adc89cf