Overview

overview

10

Static

static

10

artifact.exe

windows7-x64

9

artifact.exe

windows10-2004-x64

9

Analysis

  • max time kernel
    107s
  • max time network
    67s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    17-09-2024 02:15

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    artifact.exe

  • Size

    146KB

  • MD5

    d5c43db682644a7c08e653206f9c8d73

  • SHA1

    3df0d727a4ebd48c2f9a1012828a47271c1e4a1c

  • SHA256

    c31a2e594ba6f814f266ff511659faa3489b5508187693048e0ff17bc087bb7b

  • SHA512

    f800f0320128091b3eac64f5f7e41d425ce20be0f0b3d5ff36c35843b4212a71e9c2cc6359e3373db179317c825c84848b299145d4928b04a7cdfd5611e8c7ef

  • SSDEEP

    3072:p6glyuxE4GsUPnliByocWepsXU3tITJ9GN+YVF:p6gDBGpvEByocWesUgfGN+YVF

Score
9/10
defense_evasiondiscoveryransomwarespywarestealer

Malware Config

Signatures

  • Renames multiple (4110) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware
  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Drops desktop.ini file(s) 2 IoCs
  • Indicator Removal: File Deletion 1 TTPs

    Adversaries may delete files left behind by the actions of their intrusion activity.

    defense_evasion
  • Sets desktop wallpaper using registry 2 TTPs 2 IoCs
    ransomware
  • Suspicious use of NtSetInformationThreadHideFromDebugger 5 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies Control Panel 2 IoCs
    evasion
  • Modifies registry class 5 IoCs
  • Suspicious behavior: EnumeratesProcesses 50 IoCs
  • Suspicious behavior: RenamesItself 26 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\artifact.exe
    "C:\Users\Admin\AppData\Local\Temp\artifact.exe"
    1⤵
    • Loads dropped DLL
    • Drops desktop.ini file(s)
    • Sets desktop wallpaper using registry
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2248
    • C:\ProgramData\AA34.tmp
      "C:\ProgramData\AA34.tmp"
      2⤵
      • Deletes itself
      • Executes dropped EXE
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: RenamesItself
      • Suspicious use of WriteProcessMemory
      PID:2512
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /C DEL /F /Q C:\PROGRA~3\AA34.tmp >> NUL
        3⤵
        • System Location Discovery: System Language Discovery
        PID:956
  • C:\Windows\system32\AUDIODG.EXE
    C:\Windows\system32\AUDIODG.EXE 0x150
    1⤵
      PID:1588

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\$Recycle.Bin\S-1-5-21-457978338-2990298471-2379561640-1000\desktop.ini
      Filesize

      129B

      MD5

      1b9c7c0b9397ed59c3ee7b764314c9c8

      SHA1

      08ba5da3e8ea787bcb313c9291d1c13491f4a159

      SHA256

      ee72836c914657873d124326a310edb253de56a588e845d87fd695bebbce3eb7

      SHA512

      5d32321822b69b2db58b7ac79d17f1f9493c1182f87d47b30a0b1f07b2f828640eab6c9133aac0b774ab7dc8d64cf895b49c3775a2eb4acfc2945ba1ba307be5

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\DDDDDDDDDDDD
      Filesize

      146KB

      MD5

      556e9018a1025f56be217906a11afd69

      SHA1

      f15efc96d5fd02ac4f886bc2ad4bbc3d31f4bc70

      SHA256

      3deb212d542a8cce0741f9cd20eecf4a45681d8e37d7604796bd571a0a89780c

      SHA512

      f899b0f385942639403eff3453f5b04783287102417e965b606101391f47a51bd49df595e35fb542f1b05f2af5a745abe365e41d78abcd8412cd5b6c5e65d74a

      Download Submit

    • C:\ioZ35V9gf.README.txt
      Filesize

      343B

      MD5

      72b1ffaeb7de456483f491ecceadb088

      SHA1

      ee1953abc295245ab01f35a4a823883826bf2b41

      SHA256

      eb892eac9899b995047733bb17acd4945eb42b7b49f2ee8ad52b8026bc0297a7

      SHA512

      c0e7cad617cf1490bb25fc47936edc3ae164b190ed34f2d2a50e7e84ce6e0d6712a6ba9ab351cca1589266078326a00317516c53fecf96f20eaefe15e92ce445

      Download Submit

    • F:\$RECYCLE.BIN\S-1-5-21-457978338-2990298471-2379561640-1000\DDDDDDDDDDD
      Filesize

      129B

      MD5

      8b8a49b31fbca8e8f43a1d9e7ab21434

      SHA1

      24beef600e636187ca6f2acacca73c8e07d085fc

      SHA256

      05b381f43bb4ccf234bd4b3bf7a139f330be20a4cbd241b9365d651dd9d7442c

      SHA512

      f53c8171659ce238cfc4f7c52130ec839df7d3e7f937a608aa7765aac4646c7c960c9909e14d2087d040441edf5c4439f17d6970c84e8839eb4990922272a038

      Download Submit

    • \ProgramData\AA34.tmp
      Filesize

      14KB

      MD5

      294e9f64cb1642dd89229fff0592856b

      SHA1

      97b148c27f3da29ba7b18d6aee8a0db9102f47c9

      SHA256

      917e115cc403e29b4388e0d175cbfac3e7e40ca1742299fbdb353847db2de7c2

      SHA512

      b87d531890bf1577b9b4af41dddb2cdbbfa164cf197bd5987df3a3075983645a3acba443e289b7bfd338422978a104f55298fbfe346872de0895bde44adc89cf

      Download Submit

    • memory/2248-0-0x0000000000120000-0x0000000000160000-memory.dmp

      Filesize

      256KB

      Download

    • memory/2512-9828-0x0000000000401000-0x0000000000404000-memory.dmp

      Filesize

      12KB

      Download

    • memory/2512-9830-0x0000000000400000-0x0000000000407000-memory.dmp

      Filesize

      28KB

      Download

    • memory/2512-9831-0x0000000000400000-0x0000000000407000-memory.dmp

      Filesize

      28KB

      Download