Analysis
-
max time kernel
122s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system -
submitted
19-08-2024 03:57
Behavioral task
behavioral1
Sample
315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe
Resource
win7-20240705-en
windows7-x64
14 signatures
150 seconds
Behavioral task
behavioral2
Sample
315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
18 signatures
150 seconds
General
-
Target
315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe
-
Size
146KB
-
MD5
6edfb62405f50d7fb16882ca9b16ed36
-
SHA1
73c346267e9527ca5886bf8a90b77f9ebceb58fe
-
SHA256
315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13
-
SHA512
b3ea04a001c846af5d93435db055986a448fc5d01e86a9292937ce085609b653d41719111d2d031c8b6694eb01d5856e86f9e1a65e8cdc43af51a8ed3d370d2f
-
SSDEEP
3072:PqJogYkcSNm9V7DGoNK696RTpfnEsCygHQlyT:Pq2kc4m9tDHNK6UlJ9CyN
Malware Config
Signatures
-
Renames multiple (347) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Deletes itself 1 IoCs
pid Process 2172 C810.tmp -
Executes dropped EXE 1 IoCs
pid Process 2172 C810.tmp -
Loads dropped DLL 1 IoCs
pid Process 1948 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops desktop.ini file(s) 2 IoCs
description ioc Process File opened for modification C:\$Recycle.Bin\S-1-5-21-2172136094-3310281978-782691160-1000\desktop.ini 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe File opened for modification F:\$RECYCLE.BIN\S-1-5-21-2172136094-3310281978-782691160-1000\desktop.ini 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe -
Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
-
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
pid Process 2172 C810.tmp -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C810.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe -
Suspicious behavior: EnumeratesProcesses 12 IoCs
pid Process 1948 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe 1948 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe 1948 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe 1948 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe 1948 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe 1948 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe 1948 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe 1948 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe 1948 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe 1948 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe 1948 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe 1948 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe -
Suspicious behavior: RenamesItself 26 IoCs
pid Process 2172 C810.tmp 2172 C810.tmp 2172 C810.tmp 2172 C810.tmp 2172 C810.tmp 2172 C810.tmp 2172 C810.tmp 2172 C810.tmp 2172 C810.tmp 2172 C810.tmp 2172 C810.tmp 2172 C810.tmp 2172 C810.tmp 2172 C810.tmp 2172 C810.tmp 2172 C810.tmp 2172 C810.tmp 2172 C810.tmp 2172 C810.tmp 2172 C810.tmp 2172 C810.tmp 2172 C810.tmp 2172 C810.tmp 2172 C810.tmp 2172 C810.tmp 2172 C810.tmp -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeAssignPrimaryTokenPrivilege 1948 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe Token: SeBackupPrivilege 1948 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe Token: SeDebugPrivilege 1948 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe Token: 36 1948 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe Token: SeImpersonatePrivilege 1948 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe Token: SeIncBasePriorityPrivilege 1948 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe Token: SeIncreaseQuotaPrivilege 1948 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe Token: 33 1948 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe Token: SeManageVolumePrivilege 1948 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe Token: SeProfSingleProcessPrivilege 1948 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe Token: SeRestorePrivilege 1948 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe Token: SeSecurityPrivilege 1948 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe Token: SeSystemProfilePrivilege 1948 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe Token: SeTakeOwnershipPrivilege 1948 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe Token: SeShutdownPrivilege 1948 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe Token: SeDebugPrivilege 1948 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe Token: SeBackupPrivilege 1948 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe Token: SeBackupPrivilege 1948 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe Token: SeSecurityPrivilege 1948 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe Token: SeSecurityPrivilege 1948 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe Token: SeBackupPrivilege 1948 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe Token: SeBackupPrivilege 1948 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe Token: SeSecurityPrivilege 1948 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe Token: SeSecurityPrivilege 1948 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe Token: SeBackupPrivilege 1948 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe Token: SeBackupPrivilege 1948 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe Token: SeSecurityPrivilege 1948 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe Token: SeSecurityPrivilege 1948 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe Token: SeBackupPrivilege 1948 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe Token: SeBackupPrivilege 1948 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe Token: SeSecurityPrivilege 1948 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe Token: SeSecurityPrivilege 1948 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe Token: SeBackupPrivilege 1948 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe Token: SeBackupPrivilege 1948 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe Token: SeSecurityPrivilege 1948 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe Token: SeSecurityPrivilege 1948 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe Token: SeBackupPrivilege 1948 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe Token: SeBackupPrivilege 1948 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe Token: SeSecurityPrivilege 1948 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe Token: SeSecurityPrivilege 1948 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe Token: SeBackupPrivilege 1948 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe Token: SeBackupPrivilege 1948 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe Token: SeSecurityPrivilege 1948 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe Token: SeSecurityPrivilege 1948 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe Token: SeBackupPrivilege 1948 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe Token: SeBackupPrivilege 1948 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe Token: SeSecurityPrivilege 1948 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe Token: SeSecurityPrivilege 1948 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe Token: SeBackupPrivilege 1948 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe Token: SeBackupPrivilege 1948 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe Token: SeSecurityPrivilege 1948 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe Token: SeSecurityPrivilege 1948 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe Token: SeBackupPrivilege 1948 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe Token: SeBackupPrivilege 1948 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe Token: SeSecurityPrivilege 1948 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe Token: SeSecurityPrivilege 1948 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe Token: SeBackupPrivilege 1948 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe Token: SeBackupPrivilege 1948 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe Token: SeSecurityPrivilege 1948 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe Token: SeSecurityPrivilege 1948 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe Token: SeBackupPrivilege 1948 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe Token: SeBackupPrivilege 1948 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe Token: SeSecurityPrivilege 1948 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe Token: SeSecurityPrivilege 1948 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe -
Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 1948 wrote to memory of 2172 1948 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe 32 PID 1948 wrote to memory of 2172 1948 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe 32 PID 1948 wrote to memory of 2172 1948 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe 32 PID 1948 wrote to memory of 2172 1948 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe 32 PID 1948 wrote to memory of 2172 1948 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe 32 PID 2172 wrote to memory of 1068 2172 C810.tmp 33 PID 2172 wrote to memory of 1068 2172 C810.tmp 33 PID 2172 wrote to memory of 1068 2172 C810.tmp 33 PID 2172 wrote to memory of 1068 2172 C810.tmp 33
Processes
-
C:\Users\Admin\AppData\Local\Temp\315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe"C:\Users\Admin\AppData\Local\Temp\315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe"1⤵
- Loads dropped DLL
- Drops desktop.ini file(s)
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1948 -
C:\ProgramData\C810.tmp"C:\ProgramData\C810.tmp"2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:2172 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C DEL /F /Q C:\PROGRA~3\C810.tmp >> NUL3⤵
- System Location Discovery: System Language Discovery
PID:1068
-
-
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x1481⤵PID:1628
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
129B
MD53826e78fa596d56ea99d480104e9374d
SHA166e6597fb6fd1d01ea9e9188d672bd2922550da2
SHA25685138180cb2740ae6b039d2848363aaed50980ee998c643ca1fb8512511e05da
SHA51293804d3a2d956cd1e12552955e263eb97b11d6097dfc5380e58bcb057a985105ee41acc6269a36aec343bb465d8460b2071266acdbb2ca5fa4bff2fedb46a089
-
C:\Users\Admin\AppData\Local\Temp\DDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDD
Filesize146KB
MD542f71dee48832e94411e17f29710877a
SHA1f0b6c38287e08300b59bd1af8a0e85f8617eaffc
SHA256c09c1b0e057b12162ff2bae3b396ee696f85aefe31eaf797a4a5b546d84f03e7
SHA512c195b109dea26fc82744d430e1f36eba3e8e38297103fc16f01850e1b88d2bb6e3516b7e0327423eef4780ff4121aff0d323857f804cb07924ba34e9bf65f7d4
-
Filesize
597B
MD58b868d53629149c6b3a461ff64ce8cef
SHA1b8a0b57cfe78c6d8468bdd5ef52411765a456e41
SHA2565f8d2cdb81cac5d0b7df3bae0634042b305b4ac7ad06c728b21df0ea9628da25
SHA5122fbb224b435621bc8947caf5aa4e294725f7df1c79dfaae1674086c8e92fcdb106d734680ac58e02b112613c778b582b2eaa8e6979dc1d75dc1dccab54f7c337
-
Filesize
129B
MD552860e673b48b754cab92e3039e2888b
SHA1a177c7bb059962b5bff1b863057ecd697f031929
SHA25608ef7406d25c573234aba558f29c127fdaf64ef85e744c30c9666b3152dde0d7
SHA512a7fbddd8dde0605f65c806606c71f989bd911dc6f4dbb694e5262130ac6eed35f8e451a47c1f86efe0ea30ebee41c51e9dea4e8272436e39fa822c15b9be31d8
-
Filesize
14KB
MD5294e9f64cb1642dd89229fff0592856b
SHA197b148c27f3da29ba7b18d6aee8a0db9102f47c9
SHA256917e115cc403e29b4388e0d175cbfac3e7e40ca1742299fbdb353847db2de7c2
SHA512b87d531890bf1577b9b4af41dddb2cdbbfa164cf197bd5987df3a3075983645a3acba443e289b7bfd338422978a104f55298fbfe346872de0895bde44adc89cf