Overview

overview

10

Static

static

10

dec9845622...6f.exe

windows7-x64

9

dec9845622...6f.exe

windows10-2004-x64

9

Analysis

  • max time kernel
    119s
  • max time network
    120s
  • platform
    windows7_x64
  • resource
    win7-20240704-en
  • resource tags

    arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
  • submitted
    31-08-2024 03:30

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    dec9845622a1996d768b0f38b7d7d16e6c76b2572b7e2eac55f678e686d4dc6f.exe

  • Size

    145KB

  • MD5

    2a704c78d287be6fb1a9324dd3bbd780

  • SHA1

    2f79d2d07b33be225d3d333477c2d2159a471e0e

  • SHA256

    dec9845622a1996d768b0f38b7d7d16e6c76b2572b7e2eac55f678e686d4dc6f

  • SHA512

    a2681bdb05ecb2636958b37a65c32bfd27467b241052133ad7f02bb634ad6e5539718ba810c3568f9cf3d10996cdd255e6632c75565ec40b278cff88713a812d

  • SSDEEP

    3072:S6glyuxE4GsUPnliByocWepLk+B2Rq+V8Lmp:S6gDBGpvEByocWelKq8T

Score
9/10
defense_evasiondiscoveryransomwarespywarestealer

Malware Config

Signatures

  • Renames multiple (340) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware
  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Drops desktop.ini file(s) 2 IoCs
  • Indicator Removal: File Deletion 1 TTPs

    Adversaries may delete files left behind by the actions of their intrusion activity.

    defense_evasion
  • Sets desktop wallpaper using registry 2 TTPs 2 IoCs
    ransomware
  • Suspicious use of NtSetInformationThreadHideFromDebugger 5 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies Control Panel 2 IoCs
    evasion
  • Modifies registry class 5 IoCs
  • Suspicious behavior: EnumeratesProcesses 14 IoCs
  • Suspicious behavior: RenamesItself 26 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\dec9845622a1996d768b0f38b7d7d16e6c76b2572b7e2eac55f678e686d4dc6f.exe
    "C:\Users\Admin\AppData\Local\Temp\dec9845622a1996d768b0f38b7d7d16e6c76b2572b7e2eac55f678e686d4dc6f.exe"
    1⤵
    • Loads dropped DLL
    • Drops desktop.ini file(s)
    • Sets desktop wallpaper using registry
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2520
    • C:\ProgramData\9A3D.tmp
      "C:\ProgramData\9A3D.tmp"
      2⤵
      • Deletes itself
      • Executes dropped EXE
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: RenamesItself
      • Suspicious use of WriteProcessMemory
      PID:1248
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /C DEL /F /Q C:\PROGRA~3\9A3D.tmp >> NUL
        3⤵
        • System Location Discovery: System Language Discovery
        PID:812
  • C:\Windows\system32\AUDIODG.EXE
    C:\Windows\system32\AUDIODG.EXE 0x14c
    1⤵
      PID:2916

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\$Recycle.Bin\S-1-5-21-3434294380-2554721341-1919518612-1000\CCCCCCCCCCC
      Filesize

      129B

      MD5

      f3626cbad0cdb00d62612b77d6a54334

      SHA1

      3d373f49df3b3d476f4dbba5f44c26004f9ca8be

      SHA256

      cf239dc64230a1c7b9b903240ab7c9c49d976a423b5bd6d46f901a0604c7a6fe

      SHA512

      65377b8aa089d162cf3deca5ea560c8af1c786a56cd9778edb52ae622d2e6c7ea573433b8b252fbcad84c0ecc8f175ae06e8342b2a9976c4ed70ece68dc3807f

      Download Submit

    • C:\AjrMf9Fb5.README.txt
      Filesize

      19B

      MD5

      7edb66f1ed51a03a8b381c2307756c3c

      SHA1

      60fbdfcefe96843c077b66f7df2f89cbb3bd0312

      SHA256

      0fb417b326d101acbdbb29f1a10c8cfea19b6ce313c17f970ecbfd318c5015dd

      SHA512

      f65dc6c8a1494c267b217f562a6c98fa4b8d7ee9a77127d4062a6fba5e26879b9a4adb5649b3777d26f95ba491f29cde343fc4353e9ef6c8648ed51332a87dff

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\DDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDD
      Filesize

      145KB

      MD5

      b1fd1e3d933468b780219f2f6da50704

      SHA1

      632bdf4a4b0c090e3a31857db02ba4942f0fc4ef

      SHA256

      47a14e68575e5c778dc7bdefc80fb70e196ac5b91faa3a7f217795a038fe41c1

      SHA512

      a98230967bf8399469dfd7cd84bd45c823eb2b021c7604c1066cc9a1b6b99f5da79d79572b975fe948dbb9caebad0253f48638b153508cfcab62da54e3da90ad

      Download Submit

    • F:\$RECYCLE.BIN\S-1-5-21-3434294380-2554721341-1919518612-1000\CCCCCCCCCCC
      Filesize

      129B

      MD5

      816dae6105296e5bbd573b0db64ee048

      SHA1

      e4b3dcd3bd0e3b5129c608806f2d21b7adf56240

      SHA256

      badbf32a945c946ca63ee890b6005ac285f8f89e8efcb3c3c5cbcbf1fb17c915

      SHA512

      98bdaabad8395cc4836f9a788e9306cb54f128ff91d0b525b1ae5986c90f94a79aff782dcaccbd035b4c5fb661faf7854f7565cf15e47c8b3a7497c7a0092218

      Download Submit

    • \ProgramData\9A3D.tmp
      Filesize

      14KB

      MD5

      294e9f64cb1642dd89229fff0592856b

      SHA1

      97b148c27f3da29ba7b18d6aee8a0db9102f47c9

      SHA256

      917e115cc403e29b4388e0d175cbfac3e7e40ca1742299fbdb353847db2de7c2

      SHA512

      b87d531890bf1577b9b4af41dddb2cdbbfa164cf197bd5987df3a3075983645a3acba443e289b7bfd338422978a104f55298fbfe346872de0895bde44adc89cf

      Download Submit

    • memory/1248-873-0x0000000000401000-0x0000000000404000-memory.dmp

      Filesize

      12KB

      Download

    • memory/1248-875-0x0000000000400000-0x0000000000407000-memory.dmp

      Filesize

      28KB

      Download

    • memory/2520-0-0x00000000003D0000-0x0000000000410000-memory.dmp

      Filesize

      256KB

      Download