Analysis
-
max time kernel
121s -
max time network
125s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
18-08-2024 03:08
Behavioral task
behavioral1
Sample
315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe
Resource
win7-20240708-en
windows7-x64
14 signatures
150 seconds
Behavioral task
behavioral2
Sample
315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
18 signatures
150 seconds
General
-
Target
315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe
-
Size
146KB
-
MD5
6edfb62405f50d7fb16882ca9b16ed36
-
SHA1
73c346267e9527ca5886bf8a90b77f9ebceb58fe
-
SHA256
315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13
-
SHA512
b3ea04a001c846af5d93435db055986a448fc5d01e86a9292937ce085609b653d41719111d2d031c8b6694eb01d5856e86f9e1a65e8cdc43af51a8ed3d370d2f
-
SSDEEP
3072:PqJogYkcSNm9V7DGoNK696RTpfnEsCygHQlyT:Pq2kc4m9tDHNK6UlJ9CyN
Malware Config
Signatures
-
Renames multiple (350) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Deletes itself 1 IoCs
pid Process 2324 E012.tmp -
Executes dropped EXE 1 IoCs
pid Process 2324 E012.tmp -
Loads dropped DLL 1 IoCs
pid Process 2404 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops desktop.ini file(s) 2 IoCs
description ioc Process File opened for modification C:\$Recycle.Bin\S-1-5-21-2958949473-3205530200-1453100116-1000\desktop.ini 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe File opened for modification F:\$RECYCLE.BIN\S-1-5-21-2958949473-3205530200-1453100116-1000\desktop.ini 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe -
Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
-
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
pid Process 2324 E012.tmp -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E012.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe -
Suspicious behavior: EnumeratesProcesses 12 IoCs
pid Process 2404 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe 2404 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe 2404 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe 2404 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe 2404 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe 2404 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe 2404 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe 2404 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe 2404 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe 2404 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe 2404 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe 2404 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe -
Suspicious behavior: RenamesItself 26 IoCs
pid Process 2324 E012.tmp 2324 E012.tmp 2324 E012.tmp 2324 E012.tmp 2324 E012.tmp 2324 E012.tmp 2324 E012.tmp 2324 E012.tmp 2324 E012.tmp 2324 E012.tmp 2324 E012.tmp 2324 E012.tmp 2324 E012.tmp 2324 E012.tmp 2324 E012.tmp 2324 E012.tmp 2324 E012.tmp 2324 E012.tmp 2324 E012.tmp 2324 E012.tmp 2324 E012.tmp 2324 E012.tmp 2324 E012.tmp 2324 E012.tmp 2324 E012.tmp 2324 E012.tmp -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeAssignPrimaryTokenPrivilege 2404 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe Token: SeBackupPrivilege 2404 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe Token: SeDebugPrivilege 2404 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe Token: 36 2404 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe Token: SeImpersonatePrivilege 2404 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe Token: SeIncBasePriorityPrivilege 2404 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe Token: SeIncreaseQuotaPrivilege 2404 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe Token: 33 2404 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe Token: SeManageVolumePrivilege 2404 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe Token: SeProfSingleProcessPrivilege 2404 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe Token: SeRestorePrivilege 2404 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe Token: SeSecurityPrivilege 2404 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe Token: SeSystemProfilePrivilege 2404 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe Token: SeTakeOwnershipPrivilege 2404 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe Token: SeShutdownPrivilege 2404 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe Token: SeDebugPrivilege 2404 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe Token: SeBackupPrivilege 2404 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe Token: SeBackupPrivilege 2404 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe Token: SeSecurityPrivilege 2404 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe Token: SeSecurityPrivilege 2404 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe Token: SeBackupPrivilege 2404 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe Token: SeBackupPrivilege 2404 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe Token: SeSecurityPrivilege 2404 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe Token: SeSecurityPrivilege 2404 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe Token: SeBackupPrivilege 2404 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe Token: SeBackupPrivilege 2404 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe Token: SeSecurityPrivilege 2404 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe Token: SeSecurityPrivilege 2404 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe Token: SeBackupPrivilege 2404 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe Token: SeBackupPrivilege 2404 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe Token: SeSecurityPrivilege 2404 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe Token: SeSecurityPrivilege 2404 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe Token: SeBackupPrivilege 2404 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe Token: SeBackupPrivilege 2404 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe Token: SeSecurityPrivilege 2404 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe Token: SeSecurityPrivilege 2404 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe Token: SeBackupPrivilege 2404 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe Token: SeBackupPrivilege 2404 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe Token: SeSecurityPrivilege 2404 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe Token: SeSecurityPrivilege 2404 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe Token: SeBackupPrivilege 2404 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe Token: SeBackupPrivilege 2404 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe Token: SeSecurityPrivilege 2404 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe Token: SeSecurityPrivilege 2404 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe Token: SeBackupPrivilege 2404 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe Token: SeBackupPrivilege 2404 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe Token: SeSecurityPrivilege 2404 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe Token: SeSecurityPrivilege 2404 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe Token: SeBackupPrivilege 2404 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe Token: SeBackupPrivilege 2404 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe Token: SeSecurityPrivilege 2404 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe Token: SeSecurityPrivilege 2404 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe Token: SeBackupPrivilege 2404 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe Token: SeBackupPrivilege 2404 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe Token: SeSecurityPrivilege 2404 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe Token: SeSecurityPrivilege 2404 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe Token: SeBackupPrivilege 2404 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe Token: SeBackupPrivilege 2404 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe Token: SeSecurityPrivilege 2404 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe Token: SeSecurityPrivilege 2404 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe Token: SeBackupPrivilege 2404 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe Token: SeBackupPrivilege 2404 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe Token: SeSecurityPrivilege 2404 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe Token: SeSecurityPrivilege 2404 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe -
Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 2404 wrote to memory of 2324 2404 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe 33 PID 2404 wrote to memory of 2324 2404 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe 33 PID 2404 wrote to memory of 2324 2404 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe 33 PID 2404 wrote to memory of 2324 2404 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe 33 PID 2404 wrote to memory of 2324 2404 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe 33 PID 2324 wrote to memory of 1868 2324 E012.tmp 34 PID 2324 wrote to memory of 1868 2324 E012.tmp 34 PID 2324 wrote to memory of 1868 2324 E012.tmp 34 PID 2324 wrote to memory of 1868 2324 E012.tmp 34
Processes
-
C:\Users\Admin\AppData\Local\Temp\315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe"C:\Users\Admin\AppData\Local\Temp\315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe"1⤵
- Loads dropped DLL
- Drops desktop.ini file(s)
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2404 -
C:\ProgramData\E012.tmp"C:\ProgramData\E012.tmp"2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:2324 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C DEL /F /Q C:\PROGRA~3\E012.tmp >> NUL3⤵
- System Location Discovery: System Language Discovery
PID:1868
-
-
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x1481⤵PID:1804
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
129B
MD537435b01a35ca442e6516babe120099a
SHA180c6b92c5310b6418c0d449a3d1069e7b160c20e
SHA256fdba3645d89a55020303df07a8c42e22346751214305ed151663019f80cd2881
SHA512465be6923205bd54916c763e11708d97c12d304620d2cdc47da2c5a7f91f4777732ed97b90fed3007250468f4d91f2af6cbf6998c0fe9bb3a1ea528c9bc9eeed
-
C:\Users\Admin\AppData\Local\Temp\DDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDD
Filesize146KB
MD5c4deae7b544e2da3e39d89eaac91ffa7
SHA1c73dda28d71ec98b97b3adb6db0d26f092cd4f4a
SHA2564c50c3ff36c26588775481e30973fdc7de92a9bcbf080746fa86078aeda3ec9b
SHA512ce0f535bc3c5688452653f7f5e5ba38fe097869d678a62f1c554d54c894f071017e6ee69baeb1ca267c0b2d861e6b476a593e6deb52402b88da0a4c6d20e0ce7
-
Filesize
597B
MD58b868d53629149c6b3a461ff64ce8cef
SHA1b8a0b57cfe78c6d8468bdd5ef52411765a456e41
SHA2565f8d2cdb81cac5d0b7df3bae0634042b305b4ac7ad06c728b21df0ea9628da25
SHA5122fbb224b435621bc8947caf5aa4e294725f7df1c79dfaae1674086c8e92fcdb106d734680ac58e02b112613c778b582b2eaa8e6979dc1d75dc1dccab54f7c337
-
Filesize
129B
MD509e90ff625e9b152212a33dea7b3567a
SHA1faf1664bd2ba10833c33b0364eb329023bd956cc
SHA256321eed92fce82f4bd90c77efd486f46fe5140a225be144e755c80944f55296f4
SHA512c59ee83975c33a62a90aa74886a9605414af124cfafdcef72e239adee2eaa4223aced4a5768f8140fe19bd2a41effd356f86b0738117fedbba08580e065efd29
-
Filesize
14KB
MD5294e9f64cb1642dd89229fff0592856b
SHA197b148c27f3da29ba7b18d6aee8a0db9102f47c9
SHA256917e115cc403e29b4388e0d175cbfac3e7e40ca1742299fbdb353847db2de7c2
SHA512b87d531890bf1577b9b4af41dddb2cdbbfa164cf197bd5987df3a3075983645a3acba443e289b7bfd338422978a104f55298fbfe346872de0895bde44adc89cf