Overview

overview

10

Static

static

10

315d043b99...13.exe

windows7-x64

9

315d043b99...13.exe

windows10-2004-x64

9

Analysis

  • max time kernel
    147s
  • max time network
    128s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    17/08/2024, 14:48

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target

    315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe

  • Size

    146KB

  • MD5

    6edfb62405f50d7fb16882ca9b16ed36

  • SHA1

    73c346267e9527ca5886bf8a90b77f9ebceb58fe

  • SHA256

    315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13

  • SHA512

    b3ea04a001c846af5d93435db055986a448fc5d01e86a9292937ce085609b653d41719111d2d031c8b6694eb01d5856e86f9e1a65e8cdc43af51a8ed3d370d2f

  • SSDEEP

    3072:PqJogYkcSNm9V7DGoNK696RTpfnEsCygHQlyT:Pq2kc4m9tDHNK6UlJ9CyN

Score
9/10
defense_evasiondiscoveryransomwarespywarestealer

Malware Config

Signatures

  • Renames multiple (621) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Drops desktop.ini file(s) 2 IoCs
  • Indicator Removal: File Deletion 1 TTPs

    Adversaries may delete files left behind by the actions of their intrusion activity.

    defense_evasion
  • Drops file in System32 directory 4 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: RenamesItself 26 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of SetWindowsHookEx 13 IoCs
  • Suspicious use of WriteProcessMemory 11 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe
    "C:\Users\Admin\AppData\Local\Temp\315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe"
    1⤵
    • Drops desktop.ini file(s)
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2944
    • C:\Windows\splwow64.exe
      C:\Windows\splwow64.exe 12288
      2⤵
      • Drops file in System32 directory
      PID:2000
    • C:\ProgramData\BA87.tmp
      "C:\ProgramData\BA87.tmp"
      2⤵
      • Checks computer location settings
      • Deletes itself
      • Executes dropped EXE
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: RenamesItself
      • Suspicious use of WriteProcessMemory
      PID:3768
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /C DEL /F /Q C:\PROGRA~3\BA87.tmp >> NUL
        3⤵
        • System Location Discovery: System Language Discovery
        PID:3176
  • C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc
    1⤵
      PID:4808
    • C:\Windows\system32\printfilterpipelinesvc.exe
      C:\Windows\system32\printfilterpipelinesvc.exe -Embedding
      1⤵
      • Drops file in System32 directory
      • Suspicious use of WriteProcessMemory
      PID:1476
      • C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE
        /insertdoc "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\{439C6202-84D8-477C-A7EE-6A6C7055D140}.xps" 133683797138860000
        2⤵
        • Checks processor information in registry
        • Enumerates system info in registry
        • Suspicious use of SetWindowsHookEx
        PID:4792

    Network

          MITRE ATT&CK Enterprise v15

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\$Recycle.Bin\S-1-5-21-656926755-4116854191-210765258-1000\HHHHHHHHHHH
            Filesize

            129B

            MD5

            e36326ee5d4fe56e68b09354f7572064

            SHA1

            e04173081635a6e625d05e12462a2cafb7c002a6

            SHA256

            ef52cf2d17c5022f70dadd1c78506d675303cbb292cdb71bfd1d017d96539e26

            SHA512

            a608e650d47b74bcb9c543e0679a63b6211ed0548a256d0d9b701c9654f7109f688a48ce9dca67b4c4e6cc94a51df66714c697c963df9ac9730c6cec10f8ada7

            Download Submit

          • C:\ProgramData\BA87.tmp
            Filesize

            14KB

            MD5

            294e9f64cb1642dd89229fff0592856b

            SHA1

            97b148c27f3da29ba7b18d6aee8a0db9102f47c9

            SHA256

            917e115cc403e29b4388e0d175cbfac3e7e40ca1742299fbdb353847db2de7c2

            SHA512

            b87d531890bf1577b9b4af41dddb2cdbbfa164cf197bd5987df3a3075983645a3acba443e289b7bfd338422978a104f55298fbfe346872de0895bde44adc89cf

            Download Submit

          • C:\Users\Admin\AppData\Local\Temp\CCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCC
            Filesize

            146KB

            MD5

            4ba50da5cd653fd7988ff9d39774d17d

            SHA1

            b47d753d0619df0ff9251ab76878eb5fee6b9eb2

            SHA256

            29404f23628110fb53b113bc9602f988b882920dc4f97fd7362df462a74b5b80

            SHA512

            5691afb5d1c72762f87ce87e95765b7a2b235794a0160487acc3fd423ff06263f0d97613a59e15784548e252dfcef171aefa1a0f5e323562fa56c5c5485984bd

            Download Submit

          • C:\Users\Admin\Documents\OneNote Notebooks\My Notebook\Open Notebook.onetoc2
            Filesize

            4KB

            MD5

            84de1d9c4240d9203caccc8bfee739ab

            SHA1

            feac051395106c10ab3f269400ee636fabb5786f

            SHA256

            5d3973aad39d22bd6cef59d678e12cc2e7427e3d19bf36f9b8728c62a8517c85

            SHA512

            e17fde344cdcebd18a8f3cf0b8cfa5560862cc44a0b94c58538b92573eb5be591cd59c2dff0bcfbf9031785ebbe8268a2be5eab62b3784c5adb82dad54d29324

            Download Submit

          • C:\raMFGAusF.README.txt
            Filesize

            597B

            MD5

            8b868d53629149c6b3a461ff64ce8cef

            SHA1

            b8a0b57cfe78c6d8468bdd5ef52411765a456e41

            SHA256

            5f8d2cdb81cac5d0b7df3bae0634042b305b4ac7ad06c728b21df0ea9628da25

            SHA512

            2fbb224b435621bc8947caf5aa4e294725f7df1c79dfaae1674086c8e92fcdb106d734680ac58e02b112613c778b582b2eaa8e6979dc1d75dc1dccab54f7c337

            Download Submit

          • F:\$RECYCLE.BIN\S-1-5-21-656926755-4116854191-210765258-1000\DDDDDDDDDDD
            Filesize

            129B

            MD5

            56c79daff66a4b09ffbd20d1810d7958

            SHA1

            42338cc02c6230c7632edcbea7ffdaf254f4f1f1

            SHA256

            d042bcd7940c4ac668fa33a4a51771c30c40028ce1d636a12aa1c9e3e6476244

            SHA512

            471050c271cf4b6176ba4e5b44e560919b444bef59aa52de1ee8ca5d35164db34cb1652dba693c6ea6e723c388fd674da5ca711fbe99a249c03030ef72f23dcf

            Download Submit

          • memory/2944-2880-0x0000000000A40000-0x0000000000A50000-memory.dmp

            Filesize

            64KB

            Download

          • memory/2944-2881-0x0000000000A40000-0x0000000000A50000-memory.dmp

            Filesize

            64KB

            Download

          • memory/2944-1-0x0000000000A40000-0x0000000000A50000-memory.dmp

            Filesize

            64KB

            Download

          • memory/2944-2882-0x0000000000A40000-0x0000000000A50000-memory.dmp

            Filesize

            64KB

            Download

          • memory/2944-0-0x0000000000A40000-0x0000000000A50000-memory.dmp

            Filesize

            64KB

            Download

          • memory/2944-2-0x0000000000A40000-0x0000000000A50000-memory.dmp

            Filesize

            64KB

            Download

          • memory/4792-2907-0x00007FF822610000-0x00007FF822620000-memory.dmp

            Filesize

            64KB

            Download

          • memory/4792-2908-0x00007FF822610000-0x00007FF822620000-memory.dmp

            Filesize

            64KB

            Download

          • memory/4792-2903-0x00007FF822610000-0x00007FF822620000-memory.dmp

            Filesize

            64KB

            Download

          • memory/4792-2917-0x00007FF822610000-0x00007FF822620000-memory.dmp

            Filesize

            64KB

            Download

          • memory/4792-2915-0x00007FF822610000-0x00007FF822620000-memory.dmp

            Filesize

            64KB

            Download

          • memory/4792-2930-0x00007FF8202B0000-0x00007FF8202C0000-memory.dmp

            Filesize

            64KB

            Download

          • memory/4792-2931-0x00007FF8202B0000-0x00007FF8202C0000-memory.dmp

            Filesize

            64KB

            Download