cddb6c4fa2f970b16d08baa775f5c0598cc19a862a0803997bc43e03e91db801

Analysis

max time kernel
426s
max time network
429s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
13/08/2024, 17:17

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

lol.exe
Size

3.7MB
MD5

c6d127fc91f484bc2ab98f5a2ee91c46
SHA1

7305b9e0efaa5cf45692e1de433671de65411ab1
SHA256

cddb6c4fa2f970b16d08baa775f5c0598cc19a862a0803997bc43e03e91db801
SHA512

4d00672b2aaf0d81fd08399840e7618602a41457dd08aedb0bcb0558698043f65e503465116454950a8b66751dead14e0ef9fd98b039e843489d28dda31fc3e4
SSDEEP

49152:k6AFGtlq8VwAsOoIU6iQLiFjroR7a1TPWFAGg4aoPzlBpmRSF0pE5D8Mf5uz804/:kS+QOoR+hPWF3g4vTp/Zd8QuN4/RcGV

Score

5^/10

ransomware

Malware Config

Signatures

Sets desktop wallpaper using registry 2 TTPs 1 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\Desktop\\background.png"	lol.exe

Modifies Control Panel 3 IoCs

evasion

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\Control Panel\Desktop	lol.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\Control Panel\Desktop\TileWallpaper = "0"	lol.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\Control Panel\Desktop\WallpaperStyle = "10"	lol.exe

C:\Users\Admin\AppData\Local\Temp\lol.exe
"C:\Users\Admin\AppData\Local\Temp\lol.exe"
1⤵
- Sets desktop wallpaper using registry
- Modifies Control Panel
PID:4412

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact