Analysis
-
max time kernel
118s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
04-09-2024 10:25
General
-
Target
cc970bd2673e46c7e0df5430ab617bc2a9214b4d5c2c44252af681a08ff526a8.bin.exe
-
Size
1005KB
-
MD5
0c30fdc297c54753166d572ed04d1d6b
-
SHA1
3a05c251c1050b505b15e57f60459506cdec3c72
-
SHA256
cc970bd2673e46c7e0df5430ab617bc2a9214b4d5c2c44252af681a08ff526a8
-
SHA512
880a70b5637e19ac2f67fcaac16680335e26aa2b41245670574944249d9100a110d66c311659285c04ab1b1db6f0d69369b3626621972cc4b149dcdc79ecc016
-
SSDEEP
12288:wbWIqB/A1gv9XQ7ZNlZDV3LEWI+Xx+uBW6y4qNmhY:wbyxv9XQ7B3oWI+XHW6y4g
Malware Config
Extracted
C:\PerfLogs\Admin\akira_readme.txt
akira
https://akiral2iz6a7qgd3ayp3l6yub7xx2uep76idk3u2kollpj5z3z636bad.onion
https://akiralkzxzq2dsrzsrvbr2xgbbu2wgsmxryd4csgfameg52n7efvr2id.onion
Signatures
-
Akira
Akira is a ransomware first seen in March 2023 and targets several industries, including education, finance, real estate, manufacturing, and consulting.
-
Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
-
Renames multiple (8630) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell command to delete shadowcopy.
-
Drops startup file 1 IoCs
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops desktop.ini file(s) 47 IoCs
-
Drops file in System32 directory 1 IoCs
-
Drops file in Program Files directory 64 IoCs
-
Drops file in Windows directory 2 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 5 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 16 IoCs
-
Suspicious use of FindShellTrayWindow 28 IoCs
-
Suspicious use of SendNotifyMessage 17 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
-
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\cc970bd2673e46c7e0df5430ab617bc2a9214b4d5c2c44252af681a08ff526a8.bin.exe"C:\Users\Admin\AppData\Local\Temp\cc970bd2673e46c7e0df5430ab617bc2a9214b4d5c2c44252af681a08ff526a8.bin.exe"1⤵
- Drops startup file
- Drops desktop.ini file(s)
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -Command "Get-WmiObject Win32_Shadowcopy | Remove-WmiObject"1⤵
- Process spawned unexpected child process
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\explorer.exeexplorer.exe1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
6.4MB
MD5c26026883c4aa1847c5ef3e094e05bc4
SHA1ca56c69020467aec6551f9b377bcf1cec995a9ab
SHA2562653c3ea2f9bf567d2e9702e778750e6d7e7b6553156216c67f1a1c556fff025
SHA512cdffe0fab49d040873681fb6d0110470a1636a720ad8d85b5836e27611fff9014ad406d504b618dd29bc39ba131fcfe3ec9717bf460eb4bd31cd9dc0eedbbe8f
-
Filesize
2KB
MD595860a3684e436a515c86ba954e7e491
SHA18d61cff23d56fc922fedc978fc0293f34f6b13cf
SHA25665a5356f6bc47c81ed14441a08354f6a59e41d3e61965d5edb7c4f3fb8a5a1ae
SHA5125388bfb907208af091a2831411a7493e09866e5cf85699100476f151660192a48dc8e1fcc71937b23988f731020e72df912ce757ade42a1798c748d5e6277624
-
Filesize
159KB
MD5bea81ba40c087482c5c7e9f6f10cf7d9
SHA1e4167b661043f5b753433c2437b11bf4488b200d
SHA256a625c62b1184c06226f7dd5a5771370e98546f5c6192485c3c70008c16539a3b
SHA512f78720b79a6e84a463726555a82a96ec40ec699ad83b4416453fa134a6b7cf1508a9708bd1698e07af021739481bf770995b88df0c2893c8b30ee77cf6b85546
-
Filesize
10KB
MD5cb3b6b41cef7ce5f3f1850938ffc3e71
SHA1c933a1a2d8d26d3100a8599c8373dadb510a1dc4
SHA2564ff39d5ae25501c5ed2f9aa2f3d170a5425589b1fc6cda17afb460873f4cd12e
SHA512c33b3b61a4871ba8ba0ef713df6b96eb4831ae91b5632a75da5711c78c6d71fd7e05636c60cf8345c5eae26cf0f68ec336179e1c3287283131a4e8a21397bfe6
-
Filesize
350KB
MD512b2f2cb5b638a6dd6047cde4c245334
SHA17e9e933d20335d353c4432fad6be22ca04dbf8c1
SHA256890269954a245d930be425b7807616a14e02c3e6f8e4ca1cc69680cf53f8eec8
SHA512e920d01be1e4a9b7ff32311d22b198e6f02b5f1c4aad690ddc7b0b40db9eee84fd78505d12f4f0cdf9b8252fc1b4e454d1d272b445eb31e32d5d2abd49ceb46d
-
Filesize
276KB
MD5b3aa1ca385cede0b5e931fef2c6e38d2
SHA1b6b371885fdcaec2c950af08555db162b2e32814
SHA256e544917c6cb8be25766af6d78a0f8c0c63b00a32c1be32888da02ed6e02bcb26
SHA5120cd2a53fa57302c12473054705e26ab0c1b45282f62562717aec98ab6b204f4a2ed17eded8d0e7300b1637163462ecd1b04259c933382a9115f509ce69ab43c5
-
Filesize
148KB
MD5bef926b3d35e9c6f9f9e8f4d22676415
SHA1cd5de8c26df561c5652c2b6b30888415df0d4854
SHA25609a656cbc4f95b010391486d91b4b8a8cd7821c9d227368438ceaefc69be14be
SHA51274b2aa11bb1e32482931221dff5d0415b5a86c93c0ae6e00f7a7be83fdaa2a6d3c485e776116f761a7da6a908da6c2c9fbb8f2da4a38bb1ed17ff3578e57fc77
-
Filesize
392KB
MD5ff9fc9af9d789f47f2135f2045433b4b
SHA1795c20ee0f2fae302880afb3ac3e52a2e67003f9
SHA2568d5d7312d0d33dd5618769ee46728cb261430c77cc07e3fbab0469bcab38c858
SHA512d6014572a85b8fbe990360ec9284684f1c8db7babaada20c6d9e90ac78441cb4eb3e1e8892cddfa4ba7c700e4337088f5aae4958b6b30a8f65a1e11764498024
-
Filesize
191KB
MD52a71cde53065d4c8721744a1f810cfe8
SHA1c0ac28d91829495de3fe49e8b9001cf51343116e
SHA256a9b6b1936af4d1bd27d78d521ecfd0530e39628c000022bdea05a75babd0d55c
SHA5123e642fd5b603d831327ae0c33e1353d233bd91558a5344852e294cc416ea248022433982f383b726636e05bedda76f87a7b890cb0d1215caedcc72fd20177c13
-
Filesize
212KB
MD5af57e3dcad8d61b5a00893efc555e41b
SHA182830fbcc63cd36f603cb17b1d12d06c206065f2
SHA25684d9ee5567f77d616ea129e6de33e5fbd0183271966875b221a5ddb2b65a7d1a
SHA512c1405f90cf02eaad52ef7091ad2155962ce299ee738245d6152a3d0307d26aa96cf7db5171be9e4bdd4d16d9f0329084399dbe106b848c12b92475e9dd468aa3
-
Filesize
12KB
MD544fe61ea3aa0c571e5ecfc1595cae381
SHA19ed754b6b1013b223c36b285cdde5305deb16221
SHA256eaf0fcae80ba1e04feee66ba14e6d64e7d3c77e086d990d65630bf440e744147
SHA512455daf63e67492edc6d571204c1b8451f3dee91b48ded435ae9a0de54442d9210956a34cfd41451887ab2cd804cdb8f7a0ee4485913f0c4730cb2f6219b96fed
-
Filesize
138KB
MD58840bc7ddac54995f0831ab0bba8adcc
SHA189fad940483460d32af9df9ee24f485813e3d508
SHA256d5538adc1f7bbfc60324ae667fd98d6b313ad8b6684f974c84476aa046094811
SHA51286e3e2c194c66863dd493b9088d6354ef1eb5bc126f4cf28f4933e92e52ecd3302a069d8145ddb9381b4084af5cb28fd2ccd82b21606c0ad31ec84aee32dcdb9
-
Filesize
286KB
MD506ff8426bd97986270e58a69c4bee3c6
SHA18d2692b086a48501aa0c6945a815549066b7fc68
SHA256c4c74be6ce679f290c97475f6dddc58494e84ece29e088ae26d2848a0644ac6c
SHA512902520057107909eeff1996da19e8872bc7cfd5784d72c3639b6d8e59d8e8cdde703a6ee6911469694b32e98e76021d26e474429c2f47ed17acb35785919a896
-
Filesize
318KB
MD584662a1cd80b78d230bec4eb12f94b70
SHA13cebcdce3ffe5ef2cf34fca8941e34855668f76a
SHA25649f20eaf5fe2078dffc2af71d0eafd140fa92f90ae528eff4dc6a368cffa5852
SHA512f57e138938d271b663e3a107fc01fb9b90c708ff6084ed7f74a74c94044d225825be89063f4f6c6d5999b3af30cc1a7ad4af346d0542ab92d16176aafa332df5
-
Filesize
233KB
MD54478bfa588693f74c222f57113042172
SHA1db73bf65da1c071c84199c6cf4e597afc8795ef3
SHA256d68af8151b178af44209679a05dcd97007a30104a3e0e20b7572c9c29297128d
SHA512496126357ff14c6e69b80ed9b1d3f72e7f31b57886a73df98586e98d2f640280334fe13d78c7fe67793f093b7bc734a1493f2c56c74e528075d166187b74782d
-
Filesize
308KB
MD561e5fe35f363f15754a622aea3c62224
SHA12a98e524efb5e4cef4af8505e7fe8d857ca61123
SHA2563bbc40061aad071deb1c1e8d775c3fb48bbd132f1bdb9c380e5ae6223a3a3471
SHA512a172249f911a6bde940fe3d1f14aa1715417972e4b8c860e73611a234bb320cb3f3cc3154324ae699e7c5f089096946459f7747c4d7dc2d39d5eeec8afee2a6b
-
Filesize
297KB
MD5bd9d54381ee22d3162474c6e82322ce4
SHA1b9b43537edf13bb42b2184bb37405c257c6b77cb
SHA25678c0e25299d5cd6a34e18183c3ef44a06c4ec949328b42d4800732cdeb07aa1b
SHA5124e02d4cdd92a96beb31b4e4a5e721ce3f35179892d8118c57370b82423ad318751a404b6b77881ef39b993519904cc99f0253dcb6f212292fb7121a0646ab299
-
Filesize
339KB
MD5b4957211065c440450fb3f5e0b4ad119
SHA191be3f553627480dcefb4dcac1afcfdb3c372677
SHA256982815ddfa1527ce524e3088d157c77b8366d7c2b00125039970d469c0eb4556
SHA512c03311c94ce48f7632916093fcc6f8e47b78bcc153d943d3e054c33e284abb88d10a5a5ce7902fe65330fa818f6dbf1277ab75e9594f274281d4072098caf4b0
-
Filesize
382KB
MD5b27bc48927be9b78086b80d8a55bccbf
SHA15ecb298337776b3cd10c63b9a3ca4aa8d3e88ee7
SHA256fe4b46c5b4205aeedac25ede32f80efe57ed6ac754381e5e3f203e52f7aa5b18
SHA512bb9fa1476e33afd4d3278dcca52e6dacf6d291acb4905c709a6fd9392bf068e8206d9ed354b1967127b0b0bcbe5fd448eda0fdf38589b6e3e082850ed1df80b0
-
Filesize
541KB
MD55efc037e3f313f001d40dcd26c9b2783
SHA1a86e0e4add9deec7cee01e35e562bd9ac606f66d
SHA256f2fefb1d481d76edd390caac8a6a1871cdcb4285ccb65b2c9689fa9e1b27eb0f
SHA512686dbdc27819697312b6bd4ae94f83a90a8255f438479039d530c30cbee92e74201b28b353fb24b64f7328f0302856ddac4a0cbe8026714a695bdfdd2f2632a7
-
Filesize
265KB
MD5055dba2463eb5b0c1a068f3e9769dd8c
SHA19fe3a59f3b80ab1059492e30870d4a7997dd010e
SHA2569afb39195ddd6ae1f8909c06bd6af821858362665a8de59063b5e165c05924bb
SHA512d58a0983c8097a7ac15c3e2690dcd0dbcbcb0490d6eece891b9cbdd0aa5cb3d360cadccb795e0408434fb98253319f82455711971beecd8008ce0ab191fa0108
-
Filesize
201KB
MD5b2fbcacae2b71c359c67df762f3e8d68
SHA1f620cfb882db1c6678811880cb630f7fca36f7fa
SHA2564e98d913e4abae1159bafba38ecc402ca63de5c7c1a2f2ff9003551ac679e2c9
SHA512eb07b4663ab9eb594c5c29392b5f56a29186c73850590dc0d0a0feb18498e18f703be15806b3c55bd52571972dbe0cbe6851e1201833b4da20ecac7afabbe8c1
-
Filesize
361KB
MD5d7d0d767e55e249e7216a94b24ed58d6
SHA155c619cb43eb6249a59af12c1596605aa415015f
SHA2567ce3d7c8bb4dbeaaf41b65291f51f03733dce7b542ad5b8aac2cedc2ee5de3a4
SHA512ddbdc5889d0e5b33e9fd7a80de5d439d821c24f2326a6f2f2de67064ca3db7146a702d83d6790b20954631fd8981916791092e496f081b08a8090c8809d15d80
-
Filesize
14KB
MD57c0f5d5a4eb93099bb873e35db826e5b
SHA1aec7e9e53053edb0aebd213d0f891b8a521e6904
SHA2564746289a045a7b8042e04b134b5eb042c26023610c345f12501ca66d6f3b4a96
SHA512eec0d467f6780103ec93cda7f5d88b337c0535477a979c22096df0421004df1349f7657c073483b1c3bfeb1c4e70165709c500f4a01d2d8263d43c0924475b2e
-
Filesize
254KB
MD5f407eb7175551e6804412a968436695b
SHA110914e8c7d0c5523fa558c6e0168e46ed7024658
SHA2564db9d7f5056cab07b7b98f506daf1a39efbec381196168d6cc7a9b65b6a28732
SHA512e5f76db18133900422f64263b23bd44cbfa5b997a0b4155a5c327eefdfb399322fbf1e4cb142029c5b252218cfceac5803f92523d66b9cbb39b8ddcc6b835cfb
-
Filesize
19KB
MD5dd877260066f71c5188ac38860fc61e2
SHA1b6914bd314e753777c1d83a8b4476e9a47001da5
SHA256d1eebe70e918dcfddae11a7e48f6fc6f3f4e7186732acf16b8095f13b713a762
SHA5120c331e8247fa1e80f772dd9977b9bdce4250f05df66ba84fc7ada1114fdbddf17a6a7729a278701161a59bf18c561cde70673a162d5f44b603522cf2268f50ba
-
Filesize
244KB
MD5618c94226d058e82fa773f14d10c8865
SHA1d798927a02f39aebe0ec8633011a1209eeff5b55
SHA2560633d2895089342c2277c8ad39694aec35985490ba6d2f111b1963f6c94e94fd
SHA5128bc5648950c91fafb68e0982a0567dd1671c58ed7b2855f507619c8f9fd2bf6a41adbc4522cd014f6b9d56dcd92e21e6137d65ed6285fc94372829143ecd9f11
-
Filesize
170KB
MD5349c450ccb5c3d6040fed51eaa436a73
SHA10d42d8acb0d7ff5d9bbf8d5991b49922784658e4
SHA2560584e2ccc15a1a2ccbdeb077face902d58cc7c3fa52302bcd57d23bd9c16ed91
SHA51288b671d1a09d56c68fc45ce488ee11039167ed7e6ff171187c5c7fc6552a7ff8a6081ef3be71b73c69b3cda6172e6ed94f21b27ff3d66c19992e980a7de47bad
-
Filesize
223KB
MD5ce8aec9a53126a8a26178148d2e2bd5a
SHA10ea19616416ddd2a4a0695cd82d56b937cbd4fb2
SHA2566426593ed2312215278c464be4847925869ce560b00916787e073b56226bdb5f
SHA512cd7646bcd4b78b12cd2ade7cffc514cdea127cf5b913697a9d5274269bd4150e7380e7217636b6a60b1142dac6a794e2c97f49a65f1121910998628d4e2ab59e
-
Filesize
329KB
MD5fafd0ee62bf8053a8fe83c8c59cb647d
SHA180b2350be0dd29f48a7736b619b49b11119ab340
SHA256b58dcfe8710eb7dddf87ebc452af8ccbe732177fb1bfdf0276e77d9220e8cec6
SHA5120744d6f31c9456753ba9063d0e250d34a598c450eef9bee7bb663994c9aa4d4dd1feabbb9eae40298a52535f24edff1dd69531433dea8884fb1467b140e6beee
-
Filesize
371KB
MD5fd09c4d2a70b2067e3dfcfeacf6451ad
SHA1217fe20e383602c04ae753f1ac4c7880ca080ab2
SHA2569ebc41ad8bd43c5ffcdb06c335a5094943dca4f425d18632a4d75cf596616277
SHA512f97b11158309ad92ad4132665eaaede60aa47c0b44cb70982a3b349be2bf798edd4449084f04a3ab6466f2c21e8d1f2e26c43e51c030e8398959cfca2f94177f
-
Filesize
180KB
MD5d6ee8d68094852a9802573562be61bee
SHA1fa5b72298bfc03cb938140da00fcd0410a92c706
SHA256abe3ea3662c9579244cf6d384607455310a63f08f9872df0a98ea98d12d5d4ef
SHA512895f87372ef6f4f9cf5ff36daeeed19b16d861565f108e5abbe95d9cbecd5ea8c282c9d28b6e10692a6dbac638f0ca0b0b63c20e7702aeae54e4b44d543eb572
-
Filesize
9.6MB
-
Filesize
9.6MB
-
Filesize
32KB
-
Filesize
9.6MB
-
Filesize
2.9MB
-
Filesize
4KB
-
Filesize
9.6MB
-
Filesize
9.6MB
-
Filesize
9.6MB
