Analysis
-
max time kernel
118s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
17-09-2024 17:54
Behavioral task
behavioral1
Sample
a5052518e8735f52112f0eec7f0416f9.exe
Resource
win7-20240708-en
windows7-x64
17 signatures
150 seconds
Behavioral task
behavioral2
Sample
a5052518e8735f52112f0eec7f0416f9.exe
Resource
win10v2004-20240910-en
windows10-2004-x64
21 signatures
150 seconds
General
-
Target
a5052518e8735f52112f0eec7f0416f9.exe
-
Size
146KB
-
MD5
a5052518e8735f52112f0eec7f0416f9
-
SHA1
5442e7cbd8d82d70937c1bd599472e7f202224d0
-
SHA256
fa0259d8b6d87ae11532b7c3e26ef3ace9df21ae3919e97c73de88c6b75d2fb1
-
SHA512
254fa270339145cba103b0cae10813548b54e0127f88c709dbbc83fc43a0dc828ef3d07ab19c917469e76a45a0903a858bbdc900412f11072f2d80677de2017d
-
SSDEEP
3072:h6glyuxE4GsUPnliByocWepGEIqC6f7VaIAhzSCn8X:h6gDBGpvEByocWemFBV8
Malware Config
Signatures
-
Renames multiple (332) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Deletes itself 1 IoCs
pid Process 2096 F566.tmp -
Executes dropped EXE 1 IoCs
pid Process 2096 F566.tmp -
Loads dropped DLL 1 IoCs
pid Process 2512 a5052518e8735f52112f0eec7f0416f9.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops desktop.ini file(s) 2 IoCs
description ioc Process File opened for modification C:\$Recycle.Bin\S-1-5-21-1506706701-1246725540-2219210854-1000\desktop.ini a5052518e8735f52112f0eec7f0416f9.exe File opened for modification F:\$RECYCLE.BIN\S-1-5-21-1506706701-1246725540-2219210854-1000\desktop.ini a5052518e8735f52112f0eec7f0416f9.exe -
Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
-
Sets desktop wallpaper using registry 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Control Panel\Desktop\WallPaper = "C:\\ProgramData\\iMWl3xQaf.bmp" a5052518e8735f52112f0eec7f0416f9.exe Set value (str) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Control Panel\Desktop\Wallpaper = "C:\\ProgramData\\iMWl3xQaf.bmp" a5052518e8735f52112f0eec7f0416f9.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 5 IoCs
pid Process 2512 a5052518e8735f52112f0eec7f0416f9.exe 2512 a5052518e8735f52112f0eec7f0416f9.exe 2512 a5052518e8735f52112f0eec7f0416f9.exe 2512 a5052518e8735f52112f0eec7f0416f9.exe 2096 F566.tmp -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language a5052518e8735f52112f0eec7f0416f9.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F566.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe -
Modifies Control Panel 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Control Panel\Desktop\WallpaperStyle = "10" a5052518e8735f52112f0eec7f0416f9.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Control Panel\Desktop a5052518e8735f52112f0eec7f0416f9.exe -
Modifies registry class 5 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.iMWl3xQaf a5052518e8735f52112f0eec7f0416f9.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.iMWl3xQaf\ = "iMWl3xQaf" a5052518e8735f52112f0eec7f0416f9.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\iMWl3xQaf\DefaultIcon a5052518e8735f52112f0eec7f0416f9.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\iMWl3xQaf a5052518e8735f52112f0eec7f0416f9.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\iMWl3xQaf\DefaultIcon\ = "C:\\ProgramData\\iMWl3xQaf.ico" a5052518e8735f52112f0eec7f0416f9.exe -
Suspicious behavior: EnumeratesProcesses 14 IoCs
pid Process 2512 a5052518e8735f52112f0eec7f0416f9.exe 2512 a5052518e8735f52112f0eec7f0416f9.exe 2512 a5052518e8735f52112f0eec7f0416f9.exe 2512 a5052518e8735f52112f0eec7f0416f9.exe 2512 a5052518e8735f52112f0eec7f0416f9.exe 2512 a5052518e8735f52112f0eec7f0416f9.exe 2512 a5052518e8735f52112f0eec7f0416f9.exe 2512 a5052518e8735f52112f0eec7f0416f9.exe 2512 a5052518e8735f52112f0eec7f0416f9.exe 2512 a5052518e8735f52112f0eec7f0416f9.exe 2512 a5052518e8735f52112f0eec7f0416f9.exe 2512 a5052518e8735f52112f0eec7f0416f9.exe 2512 a5052518e8735f52112f0eec7f0416f9.exe 2512 a5052518e8735f52112f0eec7f0416f9.exe -
Suspicious behavior: RenamesItself 26 IoCs
pid Process 2096 F566.tmp 2096 F566.tmp 2096 F566.tmp 2096 F566.tmp 2096 F566.tmp 2096 F566.tmp 2096 F566.tmp 2096 F566.tmp 2096 F566.tmp 2096 F566.tmp 2096 F566.tmp 2096 F566.tmp 2096 F566.tmp 2096 F566.tmp 2096 F566.tmp 2096 F566.tmp 2096 F566.tmp 2096 F566.tmp 2096 F566.tmp 2096 F566.tmp 2096 F566.tmp 2096 F566.tmp 2096 F566.tmp 2096 F566.tmp 2096 F566.tmp 2096 F566.tmp -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeAssignPrimaryTokenPrivilege 2512 a5052518e8735f52112f0eec7f0416f9.exe Token: SeBackupPrivilege 2512 a5052518e8735f52112f0eec7f0416f9.exe Token: SeDebugPrivilege 2512 a5052518e8735f52112f0eec7f0416f9.exe Token: 36 2512 a5052518e8735f52112f0eec7f0416f9.exe Token: SeImpersonatePrivilege 2512 a5052518e8735f52112f0eec7f0416f9.exe Token: SeIncBasePriorityPrivilege 2512 a5052518e8735f52112f0eec7f0416f9.exe Token: SeIncreaseQuotaPrivilege 2512 a5052518e8735f52112f0eec7f0416f9.exe Token: 33 2512 a5052518e8735f52112f0eec7f0416f9.exe Token: SeManageVolumePrivilege 2512 a5052518e8735f52112f0eec7f0416f9.exe Token: SeProfSingleProcessPrivilege 2512 a5052518e8735f52112f0eec7f0416f9.exe Token: SeRestorePrivilege 2512 a5052518e8735f52112f0eec7f0416f9.exe Token: SeSecurityPrivilege 2512 a5052518e8735f52112f0eec7f0416f9.exe Token: SeSystemProfilePrivilege 2512 a5052518e8735f52112f0eec7f0416f9.exe Token: SeTakeOwnershipPrivilege 2512 a5052518e8735f52112f0eec7f0416f9.exe Token: SeShutdownPrivilege 2512 a5052518e8735f52112f0eec7f0416f9.exe Token: SeDebugPrivilege 2512 a5052518e8735f52112f0eec7f0416f9.exe Token: SeBackupPrivilege 2512 a5052518e8735f52112f0eec7f0416f9.exe Token: SeBackupPrivilege 2512 a5052518e8735f52112f0eec7f0416f9.exe Token: SeSecurityPrivilege 2512 a5052518e8735f52112f0eec7f0416f9.exe Token: SeSecurityPrivilege 2512 a5052518e8735f52112f0eec7f0416f9.exe Token: SeBackupPrivilege 2512 a5052518e8735f52112f0eec7f0416f9.exe Token: SeBackupPrivilege 2512 a5052518e8735f52112f0eec7f0416f9.exe Token: SeSecurityPrivilege 2512 a5052518e8735f52112f0eec7f0416f9.exe Token: SeSecurityPrivilege 2512 a5052518e8735f52112f0eec7f0416f9.exe Token: SeBackupPrivilege 2512 a5052518e8735f52112f0eec7f0416f9.exe Token: SeBackupPrivilege 2512 a5052518e8735f52112f0eec7f0416f9.exe Token: SeSecurityPrivilege 2512 a5052518e8735f52112f0eec7f0416f9.exe Token: SeSecurityPrivilege 2512 a5052518e8735f52112f0eec7f0416f9.exe Token: SeBackupPrivilege 2512 a5052518e8735f52112f0eec7f0416f9.exe Token: SeBackupPrivilege 2512 a5052518e8735f52112f0eec7f0416f9.exe Token: SeSecurityPrivilege 2512 a5052518e8735f52112f0eec7f0416f9.exe Token: SeSecurityPrivilege 2512 a5052518e8735f52112f0eec7f0416f9.exe Token: SeBackupPrivilege 2512 a5052518e8735f52112f0eec7f0416f9.exe Token: SeBackupPrivilege 2512 a5052518e8735f52112f0eec7f0416f9.exe Token: SeSecurityPrivilege 2512 a5052518e8735f52112f0eec7f0416f9.exe Token: SeSecurityPrivilege 2512 a5052518e8735f52112f0eec7f0416f9.exe Token: SeBackupPrivilege 2512 a5052518e8735f52112f0eec7f0416f9.exe Token: SeBackupPrivilege 2512 a5052518e8735f52112f0eec7f0416f9.exe Token: SeSecurityPrivilege 2512 a5052518e8735f52112f0eec7f0416f9.exe Token: SeSecurityPrivilege 2512 a5052518e8735f52112f0eec7f0416f9.exe Token: SeBackupPrivilege 2512 a5052518e8735f52112f0eec7f0416f9.exe Token: SeBackupPrivilege 2512 a5052518e8735f52112f0eec7f0416f9.exe Token: SeSecurityPrivilege 2512 a5052518e8735f52112f0eec7f0416f9.exe Token: SeSecurityPrivilege 2512 a5052518e8735f52112f0eec7f0416f9.exe Token: SeBackupPrivilege 2512 a5052518e8735f52112f0eec7f0416f9.exe Token: SeBackupPrivilege 2512 a5052518e8735f52112f0eec7f0416f9.exe Token: SeSecurityPrivilege 2512 a5052518e8735f52112f0eec7f0416f9.exe Token: SeSecurityPrivilege 2512 a5052518e8735f52112f0eec7f0416f9.exe Token: SeBackupPrivilege 2512 a5052518e8735f52112f0eec7f0416f9.exe Token: SeBackupPrivilege 2512 a5052518e8735f52112f0eec7f0416f9.exe Token: SeSecurityPrivilege 2512 a5052518e8735f52112f0eec7f0416f9.exe Token: SeSecurityPrivilege 2512 a5052518e8735f52112f0eec7f0416f9.exe Token: SeBackupPrivilege 2512 a5052518e8735f52112f0eec7f0416f9.exe Token: SeBackupPrivilege 2512 a5052518e8735f52112f0eec7f0416f9.exe Token: SeSecurityPrivilege 2512 a5052518e8735f52112f0eec7f0416f9.exe Token: SeSecurityPrivilege 2512 a5052518e8735f52112f0eec7f0416f9.exe Token: SeBackupPrivilege 2512 a5052518e8735f52112f0eec7f0416f9.exe Token: SeBackupPrivilege 2512 a5052518e8735f52112f0eec7f0416f9.exe Token: SeSecurityPrivilege 2512 a5052518e8735f52112f0eec7f0416f9.exe Token: SeSecurityPrivilege 2512 a5052518e8735f52112f0eec7f0416f9.exe Token: SeBackupPrivilege 2512 a5052518e8735f52112f0eec7f0416f9.exe Token: SeBackupPrivilege 2512 a5052518e8735f52112f0eec7f0416f9.exe Token: SeSecurityPrivilege 2512 a5052518e8735f52112f0eec7f0416f9.exe Token: SeSecurityPrivilege 2512 a5052518e8735f52112f0eec7f0416f9.exe -
Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 2512 wrote to memory of 2096 2512 a5052518e8735f52112f0eec7f0416f9.exe 33 PID 2512 wrote to memory of 2096 2512 a5052518e8735f52112f0eec7f0416f9.exe 33 PID 2512 wrote to memory of 2096 2512 a5052518e8735f52112f0eec7f0416f9.exe 33 PID 2512 wrote to memory of 2096 2512 a5052518e8735f52112f0eec7f0416f9.exe 33 PID 2512 wrote to memory of 2096 2512 a5052518e8735f52112f0eec7f0416f9.exe 33 PID 2096 wrote to memory of 1064 2096 F566.tmp 34 PID 2096 wrote to memory of 1064 2096 F566.tmp 34 PID 2096 wrote to memory of 1064 2096 F566.tmp 34 PID 2096 wrote to memory of 1064 2096 F566.tmp 34
Processes
-
C:\Users\Admin\AppData\Local\Temp\a5052518e8735f52112f0eec7f0416f9.exe"C:\Users\Admin\AppData\Local\Temp\a5052518e8735f52112f0eec7f0416f9.exe"1⤵
- Loads dropped DLL
- Drops desktop.ini file(s)
- Sets desktop wallpaper using registry
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Modifies Control Panel
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2512 -
C:\ProgramData\F566.tmp"C:\ProgramData\F566.tmp"2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:2096 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C DEL /F /Q C:\PROGRA~3\F566.tmp >> NUL3⤵
- System Location Discovery: System Language Discovery
PID:1064
-
-
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x14c1⤵PID:2796
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
129B
MD541f014c9523b004373028fff140898b0
SHA171b1970c153a7ba988294729dae7c8759100fc0c
SHA256694117547c3442ec8ba5a0b3d7482806424f0bc6fad6332e16df7b44fb657927
SHA512320ae4d0f9f690eee1b26793f2d6642079349f92f0f2b3c6257759956ca1d816b3896a9ab61dc96bd1a0c059e6c8d2874461d6abb34df5a9f339cd99e2b6236f
-
Filesize
146KB
MD568ff743f21aa2a02c19e4807693fee56
SHA13dca409438f65f86381c8b072117b0ebcb800577
SHA25670ea7e7a3e32797b36ac31a3c03eb3c00d42bc870ba9d58c6f763b62e16d5d1e
SHA512d36d89487db77a11f93131d51c66d339625e5607bdc9bfd6de2e11693ae326fe58a54ade91060a320b6ce8d6801ce1ff05ee9794312faecba6e9f7bb4e1d0134
-
Filesize
343B
MD572b1ffaeb7de456483f491ecceadb088
SHA1ee1953abc295245ab01f35a4a823883826bf2b41
SHA256eb892eac9899b995047733bb17acd4945eb42b7b49f2ee8ad52b8026bc0297a7
SHA512c0e7cad617cf1490bb25fc47936edc3ae164b190ed34f2d2a50e7e84ce6e0d6712a6ba9ab351cca1589266078326a00317516c53fecf96f20eaefe15e92ce445
-
Filesize
129B
MD51855d2046c248de5d960b7ccb09edff9
SHA13aded9081f0e8c31d203dac6b4e502602ae209bc
SHA25636e5483008c1b6e3fbb3d3511c183d145f1a798ff6db91a27c316730fb0cbe81
SHA512e262e65969be8943cbc331bd7d790e195a33dc16ae086e59bd7a139f478af361756ed8b01e6aabbb648a3a0da0d08a00ce5c625a5a14d2763cf16f8ae5e51c87
-
Filesize
14KB
MD5294e9f64cb1642dd89229fff0592856b
SHA197b148c27f3da29ba7b18d6aee8a0db9102f47c9
SHA256917e115cc403e29b4388e0d175cbfac3e7e40ca1742299fbdb353847db2de7c2
SHA512b87d531890bf1577b9b4af41dddb2cdbbfa164cf197bd5987df3a3075983645a3acba443e289b7bfd338422978a104f55298fbfe346872de0895bde44adc89cf