Analysis
-
max time kernel
117s -
max time network
117s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
12-09-2024 04:29
Static task
static1
Behavioral task
behavioral1
Sample
ecc6369f4bf0bc1d0ad9e7afba34c21f4614641ecff396911817829b534cb1d8.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
ecc6369f4bf0bc1d0ad9e7afba34c21f4614641ecff396911817829b534cb1d8.exe
Resource
win10v2004-20240802-en
General
-
Target
ecc6369f4bf0bc1d0ad9e7afba34c21f4614641ecff396911817829b534cb1d8.exe
-
Size
20KB
-
MD5
ff9b155b365dd09203582cdc96cfed50
-
SHA1
0020fe6ded8eb9fbaaea8c285a273058028077de
-
SHA256
ecc6369f4bf0bc1d0ad9e7afba34c21f4614641ecff396911817829b534cb1d8
-
SHA512
9d23ce4634cacc4c316d983a435c3ac1e34db2c2db7adc5d6b06f328069835dbf707e13c680835f66a5b2ae7543bad68de4ab7024637d4f5c00afee7d2725d89
-
SSDEEP
384:2/WqRiFLIuRbjpLr2VKjq32VuzJKOj8Ulfjmc5wR4QqcrHnrK:1VRjRr3jq2Vsoa8+7R3QjrH2
Malware Config
Extracted
C:\MSOCache\All Users\{90140000-0019-0409-0000-0000000FF1CE}-C\#RECOVERY#.txt
https://getsession.org
https://t.me/Files_decrypt
Signatures
-
Credentials from Password Stores: Credentials from Web Browsers 1 TTPs
Malicious Access or copy of Web Browser Credential store.
-
Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Modifies boot configuration data using bcdedit 1 TTPs 2 IoCs
pid Process 2748 bcdedit.exe 2724 bcdedit.exe -
Renames multiple (1048) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Modifies Windows Firewall 2 TTPs 1 IoCs
pid Process 2768 netsh.exe -
Credentials from Password Stores: Windows Credential Manager 1 TTPs
Suspicious access to Credentials History.
-
Deletes itself 1 IoCs
pid Process 2860 cmd.exe -
Drops startup file 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\#RECOVERY#.txt ecc6369f4bf0bc1d0ad9e7afba34c21f4614641ecff396911817829b534cb1d8.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops desktop.ini file(s) 35 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\desktop.ini ecc6369f4bf0bc1d0ad9e7afba34c21f4614641ecff396911817829b534cb1d8.exe File opened for modification C:\Users\Admin\Documents\desktop.ini ecc6369f4bf0bc1d0ad9e7afba34c21f4614641ecff396911817829b534cb1d8.exe File opened for modification C:\Users\Admin\Favorites\desktop.ini ecc6369f4bf0bc1d0ad9e7afba34c21f4614641ecff396911817829b534cb1d8.exe File opened for modification C:\Users\Admin\Videos\desktop.ini ecc6369f4bf0bc1d0ad9e7afba34c21f4614641ecff396911817829b534cb1d8.exe File opened for modification C:\Users\Public\desktop.ini ecc6369f4bf0bc1d0ad9e7afba34c21f4614641ecff396911817829b534cb1d8.exe File opened for modification C:\Users\Public\Music\desktop.ini ecc6369f4bf0bc1d0ad9e7afba34c21f4614641ecff396911817829b534cb1d8.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\QMPQWRBT\desktop.ini ecc6369f4bf0bc1d0ad9e7afba34c21f4614641ecff396911817829b534cb1d8.exe File opened for modification C:\Users\Public\Pictures\Sample Pictures\desktop.ini ecc6369f4bf0bc1d0ad9e7afba34c21f4614641ecff396911817829b534cb1d8.exe File opened for modification C:\Users\Admin\Desktop\desktop.ini ecc6369f4bf0bc1d0ad9e7afba34c21f4614641ecff396911817829b534cb1d8.exe File opened for modification C:\Users\Admin\Downloads\desktop.ini ecc6369f4bf0bc1d0ad9e7afba34c21f4614641ecff396911817829b534cb1d8.exe File opened for modification C:\Users\Admin\Favorites\Links for United States\desktop.ini ecc6369f4bf0bc1d0ad9e7afba34c21f4614641ecff396911817829b534cb1d8.exe File opened for modification C:\Users\Admin\Saved Games\desktop.ini ecc6369f4bf0bc1d0ad9e7afba34c21f4614641ecff396911817829b534cb1d8.exe File opened for modification C:\Users\Public\Downloads\desktop.ini ecc6369f4bf0bc1d0ad9e7afba34c21f4614641ecff396911817829b534cb1d8.exe File opened for modification C:\Users\Public\Libraries\desktop.ini ecc6369f4bf0bc1d0ad9e7afba34c21f4614641ecff396911817829b534cb1d8.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows Mail\Stationery\Desktop.ini ecc6369f4bf0bc1d0ad9e7afba34c21f4614641ecff396911817829b534cb1d8.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\desktop.ini ecc6369f4bf0bc1d0ad9e7afba34c21f4614641ecff396911817829b534cb1d8.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini ecc6369f4bf0bc1d0ad9e7afba34c21f4614641ecff396911817829b534cb1d8.exe File opened for modification C:\Users\Admin\Music\desktop.ini ecc6369f4bf0bc1d0ad9e7afba34c21f4614641ecff396911817829b534cb1d8.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini ecc6369f4bf0bc1d0ad9e7afba34c21f4614641ecff396911817829b534cb1d8.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\39RANI6K\desktop.ini ecc6369f4bf0bc1d0ad9e7afba34c21f4614641ecff396911817829b534cb1d8.exe File opened for modification C:\Users\Admin\Contacts\desktop.ini ecc6369f4bf0bc1d0ad9e7afba34c21f4614641ecff396911817829b534cb1d8.exe File opened for modification C:\Users\Admin\Links\desktop.ini ecc6369f4bf0bc1d0ad9e7afba34c21f4614641ecff396911817829b534cb1d8.exe File opened for modification C:\Users\Admin\Searches\desktop.ini ecc6369f4bf0bc1d0ad9e7afba34c21f4614641ecff396911817829b534cb1d8.exe File opened for modification C:\Users\Public\Desktop\desktop.ini ecc6369f4bf0bc1d0ad9e7afba34c21f4614641ecff396911817829b534cb1d8.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\AQYH36ZT\desktop.ini ecc6369f4bf0bc1d0ad9e7afba34c21f4614641ecff396911817829b534cb1d8.exe File opened for modification C:\Users\Public\Documents\desktop.ini ecc6369f4bf0bc1d0ad9e7afba34c21f4614641ecff396911817829b534cb1d8.exe File opened for modification C:\Users\Public\Music\Sample Music\desktop.ini ecc6369f4bf0bc1d0ad9e7afba34c21f4614641ecff396911817829b534cb1d8.exe File opened for modification C:\Users\Public\Pictures\desktop.ini ecc6369f4bf0bc1d0ad9e7afba34c21f4614641ecff396911817829b534cb1d8.exe File opened for modification C:\Users\Public\Recorded TV\desktop.ini ecc6369f4bf0bc1d0ad9e7afba34c21f4614641ecff396911817829b534cb1d8.exe File opened for modification C:\Users\Public\Recorded TV\Sample Media\desktop.ini ecc6369f4bf0bc1d0ad9e7afba34c21f4614641ecff396911817829b534cb1d8.exe File opened for modification C:\Users\Public\Videos\Sample Videos\desktop.ini ecc6369f4bf0bc1d0ad9e7afba34c21f4614641ecff396911817829b534cb1d8.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\U3EGUGI8\desktop.ini ecc6369f4bf0bc1d0ad9e7afba34c21f4614641ecff396911817829b534cb1d8.exe File opened for modification C:\Users\Admin\Pictures\desktop.ini ecc6369f4bf0bc1d0ad9e7afba34c21f4614641ecff396911817829b534cb1d8.exe File opened for modification C:\Users\Public\Videos\desktop.ini ecc6369f4bf0bc1d0ad9e7afba34c21f4614641ecff396911817829b534cb1d8.exe File opened for modification C:\Users\Admin\Favorites\Links\desktop.ini ecc6369f4bf0bc1d0ad9e7afba34c21f4614641ecff396911817829b534cb1d8.exe -
Sets desktop wallpaper using registry 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\FDFE.tmp.jpg" ecc6369f4bf0bc1d0ad9e7afba34c21f4614641ecff396911817829b534cb1d8.exe Set value (str) \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\Pictures\\My Wallpaper.jpg" ecc6369f4bf0bc1d0ad9e7afba34c21f4614641ecff396911817829b534cb1d8.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs
Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.
description ioc Process Key queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe -
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language timeout.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ecc6369f4bf0bc1d0ad9e7afba34c21f4614641ecff396911817829b534cb1d8.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe -
Delays execution with timeout.exe 1 IoCs
pid Process 2588 timeout.exe -
Interacts with shadow copies 3 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
pid Process 1448 vssadmin.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 2424 ecc6369f4bf0bc1d0ad9e7afba34c21f4614641ecff396911817829b534cb1d8.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeBackupPrivilege 2240 vssvc.exe Token: SeRestorePrivilege 2240 vssvc.exe Token: SeAuditPrivilege 2240 vssvc.exe -
Suspicious use of WriteProcessMemory 33 IoCs
description pid Process procid_target PID 2424 wrote to memory of 1448 2424 ecc6369f4bf0bc1d0ad9e7afba34c21f4614641ecff396911817829b534cb1d8.exe 30 PID 2424 wrote to memory of 1448 2424 ecc6369f4bf0bc1d0ad9e7afba34c21f4614641ecff396911817829b534cb1d8.exe 30 PID 2424 wrote to memory of 1448 2424 ecc6369f4bf0bc1d0ad9e7afba34c21f4614641ecff396911817829b534cb1d8.exe 30 PID 2424 wrote to memory of 1448 2424 ecc6369f4bf0bc1d0ad9e7afba34c21f4614641ecff396911817829b534cb1d8.exe 30 PID 2424 wrote to memory of 2664 2424 ecc6369f4bf0bc1d0ad9e7afba34c21f4614641ecff396911817829b534cb1d8.exe 31 PID 2424 wrote to memory of 2664 2424 ecc6369f4bf0bc1d0ad9e7afba34c21f4614641ecff396911817829b534cb1d8.exe 31 PID 2424 wrote to memory of 2664 2424 ecc6369f4bf0bc1d0ad9e7afba34c21f4614641ecff396911817829b534cb1d8.exe 31 PID 2424 wrote to memory of 2664 2424 ecc6369f4bf0bc1d0ad9e7afba34c21f4614641ecff396911817829b534cb1d8.exe 31 PID 2424 wrote to memory of 2696 2424 ecc6369f4bf0bc1d0ad9e7afba34c21f4614641ecff396911817829b534cb1d8.exe 32 PID 2424 wrote to memory of 2696 2424 ecc6369f4bf0bc1d0ad9e7afba34c21f4614641ecff396911817829b534cb1d8.exe 32 PID 2424 wrote to memory of 2696 2424 ecc6369f4bf0bc1d0ad9e7afba34c21f4614641ecff396911817829b534cb1d8.exe 32 PID 2424 wrote to memory of 2696 2424 ecc6369f4bf0bc1d0ad9e7afba34c21f4614641ecff396911817829b534cb1d8.exe 32 PID 2424 wrote to memory of 2684 2424 ecc6369f4bf0bc1d0ad9e7afba34c21f4614641ecff396911817829b534cb1d8.exe 33 PID 2424 wrote to memory of 2684 2424 ecc6369f4bf0bc1d0ad9e7afba34c21f4614641ecff396911817829b534cb1d8.exe 33 PID 2424 wrote to memory of 2684 2424 ecc6369f4bf0bc1d0ad9e7afba34c21f4614641ecff396911817829b534cb1d8.exe 33 PID 2424 wrote to memory of 2684 2424 ecc6369f4bf0bc1d0ad9e7afba34c21f4614641ecff396911817829b534cb1d8.exe 33 PID 2684 wrote to memory of 2768 2684 cmd.exe 38 PID 2684 wrote to memory of 2768 2684 cmd.exe 38 PID 2684 wrote to memory of 2768 2684 cmd.exe 38 PID 2664 wrote to memory of 2748 2664 cmd.exe 39 PID 2664 wrote to memory of 2748 2664 cmd.exe 39 PID 2664 wrote to memory of 2748 2664 cmd.exe 39 PID 2696 wrote to memory of 2724 2696 cmd.exe 40 PID 2696 wrote to memory of 2724 2696 cmd.exe 40 PID 2696 wrote to memory of 2724 2696 cmd.exe 40 PID 2424 wrote to memory of 2860 2424 ecc6369f4bf0bc1d0ad9e7afba34c21f4614641ecff396911817829b534cb1d8.exe 43 PID 2424 wrote to memory of 2860 2424 ecc6369f4bf0bc1d0ad9e7afba34c21f4614641ecff396911817829b534cb1d8.exe 43 PID 2424 wrote to memory of 2860 2424 ecc6369f4bf0bc1d0ad9e7afba34c21f4614641ecff396911817829b534cb1d8.exe 43 PID 2424 wrote to memory of 2860 2424 ecc6369f4bf0bc1d0ad9e7afba34c21f4614641ecff396911817829b534cb1d8.exe 43 PID 2860 wrote to memory of 2588 2860 cmd.exe 45 PID 2860 wrote to memory of 2588 2860 cmd.exe 45 PID 2860 wrote to memory of 2588 2860 cmd.exe 45 PID 2860 wrote to memory of 2588 2860 cmd.exe 45 -
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\ecc6369f4bf0bc1d0ad9e7afba34c21f4614641ecff396911817829b534cb1d8.exe"C:\Users\Admin\AppData\Local\Temp\ecc6369f4bf0bc1d0ad9e7afba34c21f4614641ecff396911817829b534cb1d8.exe"1⤵
- Drops startup file
- Drops desktop.ini file(s)
- Sets desktop wallpaper using registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2424 -
C:\Windows\system32\vssadmin.exedelete shadows /all /quiet2⤵
- Interacts with shadow copies
PID:1448
-
-
C:\Windows\system32\cmd.exe"C:\Windows\sysnative\cmd.exe" /c bcdedit /set {current} bootstatuspolicy ignoreallfailures2⤵
- Suspicious use of WriteProcessMemory
PID:2664 -
C:\Windows\system32\bcdedit.exebcdedit /set {current} bootstatuspolicy ignoreallfailures3⤵
- Modifies boot configuration data using bcdedit
PID:2748
-
-
-
C:\Windows\system32\cmd.exe"C:\Windows\sysnative\cmd.exe" /c bcdedit /set {current} recoveryenabled no2⤵
- Suspicious use of WriteProcessMemory
PID:2696 -
C:\Windows\system32\bcdedit.exebcdedit /set {current} recoveryenabled no3⤵
- Modifies boot configuration data using bcdedit
PID:2724
-
-
-
C:\Windows\system32\cmd.exe"C:\Windows\sysnative\cmd.exe" /c netsh advfirewall set allprofiles state off2⤵
- Suspicious use of WriteProcessMemory
PID:2684 -
C:\Windows\system32\netsh.exenetsh advfirewall set allprofiles state off3⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
PID:2768
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c timeout 1 && del "C:\Users\Admin\AppData\Local\Temp\ecc6369f4bf0bc1d0ad9e7afba34c21f4614641ecff396911817829b534cb1d8.exe" >> NUL2⤵
- Deletes itself
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2860 -
C:\Windows\SysWOW64\timeout.exetimeout 13⤵
- System Location Discovery: System Language Discovery
- Delays execution with timeout.exe
PID:2588
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2240
Network
MITRE ATT&CK Enterprise v15
Persistence
Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Netsh Helper DLL
1Privilege Escalation
Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Netsh Helper DLL
1Defense Evasion
Direct Volume Access
1Impair Defenses
1Disable or Modify System Firewall
1Indicator Removal
2File Deletion
2Modify Registry
1Credential Access
Credentials from Password Stores
2Credentials from Web Browsers
1Windows Credential Manager
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
6KB
MD55213d920022d7f2354fadb01ac529654
SHA1ca172c1f5fcb73e8ac9499f761a8ac7d283f26ea
SHA256e693fed95620f647ad197f34ead311c58a7ecc333b7eb32560be09576f570675
SHA5121c38eef88a834d91f1196d4db9d8438606f60833c3b8c8f59d6ed22a1df03ee7d910577e2b3d33d9cefc856cbbf2b0fb7fa9b994ffcfae33a45120a2adf638a3