Resubmissions

17/09/2024, 02:25

240917-cwdwpszfmn

17/09/2024, 02:23

240917-cvcl9azfln10

Analysis

  • max time kernel
    28s
  • max time network
    23s
  • platform
    windows10-1703_x64
  • resource
    win10-20240404-en
  • resource tags

    arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
  • submitted
    17/09/2024, 02:23

General

  • Target
    InfinityCrypt.exe
  • Size 211KB
  • Sample240917-cvcl9azfln
  • SHA256 f5d002bfe80b48386a6c99c41528931b7f5df736cd34094463c3f85dde0180bf
  • MD5 SHA1 SHA512 SSDEEP

Malware Config

Signatures

  • InfinityLock Ransomware

    Also known as InfinityCrypt. Based on the open-source HiddenTear ransomware.

  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\InfinityCrypt.exe
    "C:\Users\Admin\AppData\Local\Temp\InfinityCrypt.exe"
    1⤵
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Checks processor information in registry
    • Suspicious use of AdjustPrivilegeToken
    PID:3320

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        icudtl.dat.F19B043E0BEC21548C94C4E0D269EC160D5A18D5771270B494ECE72BC8BFB294

        • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\icudtl.dat.F19B043E0BEC21548C94C4E0D269EC160D5A18D5771270B494ECE72BC8BFB294
        • Size 16B
        • SHA256 9a5a6a7b81279f968088a9cee746f53be890b9f450ec6a6f3b0c3ecca48b1772
        • MD5 SHA1 SHA512

        s_remove_18.svg.F19B043E0BEC21548C94C4E0D269EC160D5A18D5771270B494ECE72BC8BFB294

        • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\s_remove_18.svg.F19B043E0BEC21548C94C4E0D269EC160D5A18D5771270B494ECE72BC8BFB294
        • Size 720B
        • SHA256 7ad95ca6739ce926f9edec3a12e2b20caf466f3c9124c0356a3aee6babbc4331
        • MD5 SHA1 SHA512

        example_icons.png.F19B043E0BEC21548C94C4E0D269EC160D5A18D5771270B494ECE72BC8BFB294

        • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\images\example_icons.png.F19B043E0BEC21548C94C4E0D269EC160D5A18D5771270B494ECE72BC8BFB294
        • Size 688B
        • SHA256 c3c9baed7e4228018ee049de9cdb01b718791c0d69710598b702831b67343fdc
        • MD5 SHA1 SHA512

        example_icons2x.png.F19B043E0BEC21548C94C4E0D269EC160D5A18D5771270B494ECE72BC8BFB294

        • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\images\example_icons2x.png.F19B043E0BEC21548C94C4E0D269EC160D5A18D5771270B494ECE72BC8BFB294
        • Size 1KB
        • SHA256 74cc80ac6cd2b571fd120d592dc37d52830a6c577c22b957eb78d96da2345167
        • MD5 SHA1 SHA512

        rhp_world_icon.png.F19B043E0BEC21548C94C4E0D269EC160D5A18D5771270B494ECE72BC8BFB294

        • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\images\rhp_world_icon.png.F19B043E0BEC21548C94C4E0D269EC160D5A18D5771270B494ECE72BC8BFB294
        • Size 448B
        • SHA256 d81ca1aae49c4872454d2d56c7fe14923af3ec3584f9e9b09601d2feaf3714f3
        • MD5 SHA1 SHA512

        rhp_world_icon_2x.png.F19B043E0BEC21548C94C4E0D269EC160D5A18D5771270B494ECE72BC8BFB294

        • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\images\rhp_world_icon_2x.png.F19B043E0BEC21548C94C4E0D269EC160D5A18D5771270B494ECE72BC8BFB294
        • Size 624B
        • SHA256 9b6dfb83ed540f639a67a2e2f7f978973b0041936e21897711b3b576129dd8fa
        • MD5 SHA1 SHA512

        rhp_world_icon_hover.png.F19B043E0BEC21548C94C4E0D269EC160D5A18D5771270B494ECE72BC8BFB294

        • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\images\rhp_world_icon_hover.png.F19B043E0BEC21548C94C4E0D269EC160D5A18D5771270B494ECE72BC8BFB294
        • Size 400B
        • SHA256 8d15ab5da11b968b8f60a5b3ec54bd36cda6d411924b46627255537bb4327ac9
        • MD5 SHA1 SHA512

        rhp_world_icon_hover_2x.png.F19B043E0BEC21548C94C4E0D269EC160D5A18D5771270B494ECE72BC8BFB294

        • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\images\rhp_world_icon_hover_2x.png.F19B043E0BEC21548C94C4E0D269EC160D5A18D5771270B494ECE72BC8BFB294
        • Size 560B
        • SHA256 8ca8a68402ecb50b85fd2bb276b07473f44b315aaf1cf78de410c7e36e00847e
        • MD5 SHA1 SHA512

        rhp_world_icon.png.F19B043E0BEC21548C94C4E0D269EC160D5A18D5771270B494ECE72BC8BFB294

        • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\images\themes\dark\rhp_world_icon.png.F19B043E0BEC21548C94C4E0D269EC160D5A18D5771270B494ECE72BC8BFB294
        • Size 400B
        • SHA256 052686ff8ceabf567125b295574b33706fb0ed2dfbdaa2cce84539a6a0647788
        • MD5 SHA1 SHA512

        rhp_world_icon_2x.png.F19B043E0BEC21548C94C4E0D269EC160D5A18D5771270B494ECE72BC8BFB294

        • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\images\themes\dark\rhp_world_icon_2x.png.F19B043E0BEC21548C94C4E0D269EC160D5A18D5771270B494ECE72BC8BFB294
        • Size 560B
        • SHA256 40d8cb5b17ca0c4ba1f442d599128710c327811309858242f7ac18498168a3f0
        • MD5 SHA1 SHA512

        rhp_world_icon_hover.png.F19B043E0BEC21548C94C4E0D269EC160D5A18D5771270B494ECE72BC8BFB294

        • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\images\themes\dark\rhp_world_icon_hover.png.F19B043E0BEC21548C94C4E0D269EC160D5A18D5771270B494ECE72BC8BFB294
        • Size 400B
        • SHA256 61a9fb1a6aac9f4339cf5057cc00dc8b67457402222d12e75888749db1474be0
        • MD5 SHA1 SHA512

        rhp_world_icon_hover_2x.png.F19B043E0BEC21548C94C4E0D269EC160D5A18D5771270B494ECE72BC8BFB294

        • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\images\themes\dark\rhp_world_icon_hover_2x.png.F19B043E0BEC21548C94C4E0D269EC160D5A18D5771270B494ECE72BC8BFB294
        • Size 560B
        • SHA256 7a6e109bfec4e9f252762304ab2fb34b82d911975c4a221470e763c5ee7e035a
        • MD5 SHA1 SHA512

        icons.png.F19B043E0BEC21548C94C4E0D269EC160D5A18D5771270B494ECE72BC8BFB294

        • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\icons.png.F19B043E0BEC21548C94C4E0D269EC160D5A18D5771270B494ECE72BC8BFB294
        • Size 7KB
        • SHA256 1ec25de373770dac03cfceb2da3b3d396a02f20322a21607d9d2c05725669652
        • MD5 SHA1 SHA512 SSDEEP

        icons_ie8.gif.F19B043E0BEC21548C94C4E0D269EC160D5A18D5771270B494ECE72BC8BFB294

        • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\icons_ie8.gif.F19B043E0BEC21548C94C4E0D269EC160D5A18D5771270B494ECE72BC8BFB294
        • Size 7KB
        • SHA256 e2fa470678743b087b8d4593ce7a56cb3f71ab7566650193c5f7d36001b8661a
        • MD5 SHA1 SHA512 SSDEEP

        icons_retina.png.F19B043E0BEC21548C94C4E0D269EC160D5A18D5771270B494ECE72BC8BFB294

        • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\icons_retina.png.F19B043E0BEC21548C94C4E0D269EC160D5A18D5771270B494ECE72BC8BFB294
        • Size 15KB
        • SHA256 e049feeea54a047a6089b27646800d4b95175a914caad835f79ba796235e4ada
        • MD5 SHA1 SHA512 SSDEEP

        new_icons.png.F19B043E0BEC21548C94C4E0D269EC160D5A18D5771270B494ECE72BC8BFB294

        • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\new_icons.png.F19B043E0BEC21548C94C4E0D269EC160D5A18D5771270B494ECE72BC8BFB294
        • Size 8KB
        • SHA256 148ee51efb74d021d4bdb741c355c351e41a5990c79fc0f3145116db62ed2be3
        • MD5 SHA1 SHA512 SSDEEP

        new_icons_retina.png.F19B043E0BEC21548C94C4E0D269EC160D5A18D5771270B494ECE72BC8BFB294

        • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\new_icons_retina.png.F19B043E0BEC21548C94C4E0D269EC160D5A18D5771270B494ECE72BC8BFB294
        • Size 17KB
        • SHA256 8ea1255a830139d8da9d90929f73a060959777f0615beb2959769b79254a753d
        • MD5 SHA1 SHA512 SSDEEP

        bg_pattern_RHP.png.F19B043E0BEC21548C94C4E0D269EC160D5A18D5771270B494ECE72BC8BFB294

        • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\images\bg_pattern_RHP.png.F19B043E0BEC21548C94C4E0D269EC160D5A18D5771270B494ECE72BC8BFB294
        • Size 192B
        • SHA256 a43fdcae7733996414543e35678eba8e43a528592b874468333abee251a52331
        • MD5 SHA1 SHA512

        bg_patterns_header.png.F19B043E0BEC21548C94C4E0D269EC160D5A18D5771270B494ECE72BC8BFB294

        • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\images\bg_patterns_header.png.F19B043E0BEC21548C94C4E0D269EC160D5A18D5771270B494ECE72BC8BFB294
        • Size 704B
        • SHA256 b267ddf4d443b12ecd14d341bbc834dc8c70192f20080a97e2a46ba9aea403b9
        • MD5 SHA1 SHA512

        illustrations.png.F19B043E0BEC21548C94C4E0D269EC160D5A18D5771270B494ECE72BC8BFB294

        • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\images\illustrations.png.F19B043E0BEC21548C94C4E0D269EC160D5A18D5771270B494ECE72BC8BFB294
        • Size 8KB
        • SHA256 484efc8e91238b9697c7d15513e1c286fdfcafa79cabcff031bb8bf8e239c155
        • MD5 SHA1 SHA512 SSDEEP

        illustrations_retina.png.F19B043E0BEC21548C94C4E0D269EC160D5A18D5771270B494ECE72BC8BFB294

        • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\images\illustrations_retina.png.F19B043E0BEC21548C94C4E0D269EC160D5A18D5771270B494ECE72BC8BFB294
        • Size 19KB
        • SHA256 c8f09d6431214b1d57ec77eca846344b52d284d48ff3d6b4519c7ee5fbb7ed93
        • MD5 SHA1 SHA512 SSDEEP

        ui-strings.js.F19B043E0BEC21548C94C4E0D269EC160D5A18D5771270B494ECE72BC8BFB294

        • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\en-gb\ui-strings.js.F19B043E0BEC21548C94C4E0D269EC160D5A18D5771270B494ECE72BC8BFB294
        • Size 832B
        • SHA256 3b8d9032ed0aacf1d9cad691562fc4103ed4dc558f54bccffa23f03ee7952562
        • MD5 SHA1 SHA512

        ui-strings.js.F19B043E0BEC21548C94C4E0D269EC160D5A18D5771270B494ECE72BC8BFB294

        • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\ui-strings.js.F19B043E0BEC21548C94C4E0D269EC160D5A18D5771270B494ECE72BC8BFB294
        • Size 1KB
        • SHA256 fa7657122988f554c31fbb390dab50c8ab14ca479f286a621a8c7e44f4dcee3b
        • MD5 SHA1 SHA512

        ui-strings.js.F19B043E0BEC21548C94C4E0D269EC160D5A18D5771270B494ECE72BC8BFB294

        • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\js\nls\ui-strings.js.F19B043E0BEC21548C94C4E0D269EC160D5A18D5771270B494ECE72BC8BFB294
        • Size 1KB
        • SHA256 d3799d0d72869343e7c78a0a4ca90b8a159d45bbb9a642d57cd06590c5f85618
        • MD5 SHA1 SHA512

        main.css.F19B043E0BEC21548C94C4E0D269EC160D5A18D5771270B494ECE72BC8BFB294

        • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\task-handler\css\main.css.F19B043E0BEC21548C94C4E0D269EC160D5A18D5771270B494ECE72BC8BFB294
        • Size 816B
        • SHA256 0eb362ba278cfae26433ba02e55ff3c7987b863cbf470db280be1f4b6d2c2b65
        • MD5 SHA1 SHA512

        bun.png.F19B043E0BEC21548C94C4E0D269EC160D5A18D5771270B494ECE72BC8BFB294

        • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\bun.png.F19B043E0BEC21548C94C4E0D269EC160D5A18D5771270B494ECE72BC8BFB294
        • Size 2KB
        • SHA256 db2513a7b79a6e663e3b08ff2a3930c8d87135b4513fba7951fd801eb5f1ea00
        • MD5 SHA1 SHA512

        cstm_brand_preview.png.F19B043E0BEC21548C94C4E0D269EC160D5A18D5771270B494ECE72BC8BFB294

        • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\cstm_brand_preview.png.F19B043E0BEC21548C94C4E0D269EC160D5A18D5771270B494ECE72BC8BFB294
        • Size 2KB
        • SHA256 fdaec9391b0768eca998f5461f9c9262f21305c2b49b8b5b3ec71289ec02c3fe
        • MD5 SHA1 SHA512

        cstm_brand_preview2x.png.F19B043E0BEC21548C94C4E0D269EC160D5A18D5771270B494ECE72BC8BFB294

        • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\cstm_brand_preview2x.png.F19B043E0BEC21548C94C4E0D269EC160D5A18D5771270B494ECE72BC8BFB294
        • Size 4KB
        • SHA256 91adcd8670a2eb5a05eb61e2c6ccfcc0b4e0a2c4b4de5187f53701afce94e99c
        • MD5 SHA1 SHA512 SSDEEP

        dd_arrow_small.png.F19B043E0BEC21548C94C4E0D269EC160D5A18D5771270B494ECE72BC8BFB294

        • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\dd_arrow_small.png.F19B043E0BEC21548C94C4E0D269EC160D5A18D5771270B494ECE72BC8BFB294
        • Size 304B
        • SHA256 e2e66450bd0fcb19b8f33ede3d1fac60a6000ba8acaa0de48eec2f14d8ccc962
        • MD5 SHA1 SHA512

        dd_arrow_small2x.png.F19B043E0BEC21548C94C4E0D269EC160D5A18D5771270B494ECE72BC8BFB294

        • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\dd_arrow_small2x.png.F19B043E0BEC21548C94C4E0D269EC160D5A18D5771270B494ECE72BC8BFB294
        • Size 400B
        • SHA256 62dfc29e1b7a4efea8fcf3a2bbae3cc38f9979e12979e5b3e3b2c82e3121c583
        • MD5 SHA1 SHA512

        nub.png.F19B043E0BEC21548C94C4E0D269EC160D5A18D5771270B494ECE72BC8BFB294

        • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\nub.png.F19B043E0BEC21548C94C4E0D269EC160D5A18D5771270B494ECE72BC8BFB294
        • Size 1008B
        • SHA256 3be1d6726a2459ea0d569a899bc780e983195fadaef81346891f26deab90010d
        • MD5 SHA1 SHA512

        share_icons.png.F19B043E0BEC21548C94C4E0D269EC160D5A18D5771270B494ECE72BC8BFB294

        • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\share_icons.png.F19B043E0BEC21548C94C4E0D269EC160D5A18D5771270B494ECE72BC8BFB294
        • Size 1KB
        • SHA256 716feee25b9842d3fd3aaf254ece15789597af8c8395b956021a03a912f0486d
        • MD5 SHA1 SHA512

        share_icons2x.png.F19B043E0BEC21548C94C4E0D269EC160D5A18D5771270B494ECE72BC8BFB294

        • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\share_icons2x.png.F19B043E0BEC21548C94C4E0D269EC160D5A18D5771270B494ECE72BC8BFB294
        • Size 2KB
        • SHA256 1f42e9705d6ae34fa582b50f2f3fba19c0e0fe3293c0dd073709b7b1dcffdf3a
        • MD5 SHA1 SHA512

        ui-strings.js.F19B043E0BEC21548C94C4E0D269EC160D5A18D5771270B494ECE72BC8BFB294

        • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\viewer\nls\nl-nl\ui-strings.js.F19B043E0BEC21548C94C4E0D269EC160D5A18D5771270B494ECE72BC8BFB294
        • Size 848B
        • SHA256 73c8a5dca3098305938b8930fea0f6307d70595ba5b2a5784c38b2776d3c121b
        • MD5 SHA1 SHA512

        DisplayLanguageNames.en_US_POSIX.txt.F19B043E0BEC21548C94C4E0D269EC160D5A18D5771270B494ECE72BC8BFB294

        • Path C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\LanguageNames2\DisplayLanguageNames.en_US_POSIX.txt.F19B043E0BEC21548C94C4E0D269EC160D5A18D5771270B494ECE72BC8BFB294
        • Size 32KB
        • SHA256 b06cceef4b8780b33f840d65427cdbd614d2dedafe5f84985ce37c32b2f6cdf5
        • MD5 SHA1 SHA512 SSDEEP

        memory/3320-0-0x00000000732CE000-0x00000000732CF000-memory.dmp

        memory/3320-2263-0x00000000732CE000-0x00000000732CF000-memory.dmp

        memory/3320-1-0x00000000003D0000-0x000000000040C000-memory.dmp

        memory/3320-2-0x0000000004C30000-0x0000000004CCC000-memory.dmp

        memory/3320-3-0x00000000051D0000-0x00000000056CE000-memory.dmp

        memory/3320-4-0x0000000004D70000-0x0000000004E02000-memory.dmp

        memory/3320-5-0x0000000004CE0000-0x0000000004CEA000-memory.dmp

        memory/3320-6-0x00000000732C0000-0x00000000739AE000-memory.dmp

        memory/3320-7-0x0000000004F30000-0x0000000004F86000-memory.dmp

        memory/3320-2650-0x00000000732C0000-0x00000000739AE000-memory.dmp

        memory/3320-2921-0x0000000006020000-0x0000000006086000-memory.dmp

        memory/3320-2922-0x00000000732C0000-0x00000000739AE000-memory.dmp

        memory/3320-2923-0x00000000732C0000-0x00000000739AE000-memory.dmp