Analysis
-
max time kernel
121s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
24-09-2024 05:07
General
-
Target
ef8b996e4d7e84c179f8268f3d686195.exe
-
Size
146KB
-
MD5
ef8b996e4d7e84c179f8268f3d686195
-
SHA1
07057ff4fd122bca513bbce0cbaa1174d50caf01
-
SHA256
d582110cd8a31d867e1a1eada4fb726acbbf960bed0aafeec854e455bc53403f
-
SHA512
6c434febdbf2e57328a118d249d3a8ed736749671b605c9baabecbcafc4040ab10f0c0ce94f6f2551286fc213b4f88a6079271ff4971f524a36211b25f70b90b
-
SSDEEP
3072:gqJogYkcSNm9V7DXW5I4KNGHsOqhNDvtdT:gq2kc4m9tDXW5fdqh
Malware Config
Signatures
-
Renames multiple (347) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops desktop.ini file(s) 2 IoCs
-
Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
-
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 12 IoCs
-
Suspicious behavior: RenamesItself 26 IoCs
-
Suspicious use of AdjustPrivilegeToken 64 IoCs
-
Suspicious use of WriteProcessMemory 9 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\ef8b996e4d7e84c179f8268f3d686195.exe"C:\Users\Admin\AppData\Local\Temp\ef8b996e4d7e84c179f8268f3d686195.exe"1⤵
- Loads dropped DLL
- Drops desktop.ini file(s)
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\5F9D.tmp"C:\ProgramData\5F9D.tmp"2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C DEL /F /Q C:\PROGRA~3\5F9D.tmp >> NUL3⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x1481⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
129B
MD51f4422ba066557f9b4f70bbb6ba66490
SHA1e1e1da153fcfb53f1f6dac2c5da83275661e3d78
SHA256f7ca0cdf2e97e73c5c1ff5afb60b58e0423c36a310f27f5f3339927ed2d78092
SHA5129bebf3ce4f1732a2fb7ae346f50c93e994e6779011cb8d58a1f54e59b13ffed755e41a5c5e00baf2ba84a6f0a7404ca67861553d9861415fc4c19672e2a1ed84
-
Filesize
14KB
MD5294e9f64cb1642dd89229fff0592856b
SHA197b148c27f3da29ba7b18d6aee8a0db9102f47c9
SHA256917e115cc403e29b4388e0d175cbfac3e7e40ca1742299fbdb353847db2de7c2
SHA512b87d531890bf1577b9b4af41dddb2cdbbfa164cf197bd5987df3a3075983645a3acba443e289b7bfd338422978a104f55298fbfe346872de0895bde44adc89cf
-
Filesize
146KB
MD54abb059dbe9568c801b0849cc43f789c
SHA1edde603893f35ae7ca71ca0befbdcefb50f7ccea
SHA2562f2046b9040a5c5cb1447a2ac41064be1587aae8ea37b5af204c83655d4bfcf2
SHA5127f5afb22fff75a61d2ad00651305c20eafcb0130c384669a24d5fbc39eac68fd96440170713970f21cda26c3c08ace73aa8cbaeec3ee2916e0d400e9db1a23a8
-
Filesize
638B
MD5e5bc1b8f423f3cce04388bfbe53d93ff
SHA154e173bb949842e15150102631a2fd8c7fc0d967
SHA2567c750178e9525b4eef587eed36c7040a4806207909e4463a56f33073081b7de5
SHA512aa720ad06776f38ce63d67b743ee019bef1130874a52d7825559e559a056e2ed5c543290a1c13e6ea733204791865ba17f9d4b1d0650e64db1f89af0da7b693f
-
Filesize
129B
MD51ff067d7b8b25c6991c4b712b994ba5c
SHA1144c8aabb5a1d07aa4286e06bcbf80bd54573225
SHA256e981df970607148e7737655c4e12ffdaec74767942d3f9c1b487b8d1ddd28ddd
SHA51200b6ab5f07c0c9c3bedb0b3fe6c0c544a4e6b96b1dbae4d229c61d2f20c6b083873a7e3655a979b64b6741043e6101fc0568dedf1df7f023eba104ad400dcdd1
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
256KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
256KB