Analysis
-
max time kernel
148s -
max time network
139s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
25-09-2024 02:35
General
-
Target
d582110cd8a31d867e1a1eada4fb726acbbf960bed0aafeec854e455bc53403f.exe
-
Size
146KB
-
MD5
ef8b996e4d7e84c179f8268f3d686195
-
SHA1
07057ff4fd122bca513bbce0cbaa1174d50caf01
-
SHA256
d582110cd8a31d867e1a1eada4fb726acbbf960bed0aafeec854e455bc53403f
-
SHA512
6c434febdbf2e57328a118d249d3a8ed736749671b605c9baabecbcafc4040ab10f0c0ce94f6f2551286fc213b4f88a6079271ff4971f524a36211b25f70b90b
-
SSDEEP
3072:gqJogYkcSNm9V7DXW5I4KNGHsOqhNDvtdT:gq2kc4m9tDXW5fdqh
Malware Config
Signatures
-
Renames multiple (639) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops desktop.ini file(s) 2 IoCs
-
Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
-
Drops file in System32 directory 4 IoCs
-
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Enumerates system info in registry 2 TTPs 3 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: RenamesItself 26 IoCs
-
Suspicious use of AdjustPrivilegeToken 64 IoCs
-
Suspicious use of SetWindowsHookEx 13 IoCs
-
Suspicious use of WriteProcessMemory 11 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\d582110cd8a31d867e1a1eada4fb726acbbf960bed0aafeec854e455bc53403f.exe"C:\Users\Admin\AppData\Local\Temp\d582110cd8a31d867e1a1eada4fb726acbbf960bed0aafeec854e455bc53403f.exe"1⤵
- Drops desktop.ini file(s)
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\splwow64.exeC:\Windows\splwow64.exe 122882⤵
- Drops file in System32 directory
-
-
C:\ProgramData\DC67.tmp"C:\ProgramData\DC67.tmp"2⤵
- Checks computer location settings
- Deletes itself
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C DEL /F /Q C:\PROGRA~3\DC67.tmp >> NUL3⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc1⤵
-
C:\Windows\system32\printfilterpipelinesvc.exeC:\Windows\system32\printfilterpipelinesvc.exe -Embedding1⤵
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE/insertdoc "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\{B837EF15-F51E-464E-95F7-2B5A567B1E63}.xps" 1337170532191500002⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
129B
MD51c68315a9ec33b8c27be850be8eabd90
SHA155ddb5adb806f206b2c43cbf0015337c191e23e3
SHA2569f8c9c631d6508f37be24f43e0e978ea0ae4e18d24725d193f206b6bc5613107
SHA5129c6c328df79ea7d2d879bbdbeb7f6eb0453138bacc7638e43d6c9caf61b916c714863c8796c0abdf29944ea8e68160649d0bfa7618066e47f8c3d2c0df4d9486
-
Filesize
14KB
MD5294e9f64cb1642dd89229fff0592856b
SHA197b148c27f3da29ba7b18d6aee8a0db9102f47c9
SHA256917e115cc403e29b4388e0d175cbfac3e7e40ca1742299fbdb353847db2de7c2
SHA512b87d531890bf1577b9b4af41dddb2cdbbfa164cf197bd5987df3a3075983645a3acba443e289b7bfd338422978a104f55298fbfe346872de0895bde44adc89cf
-
Filesize
146KB
MD5441664a7ef8cfbd15937aea0f63ee6af
SHA1bcaa37554c82eb2f0e76eb5b41e83ef8bc2cec0e
SHA25627743d742dccb814f2fc97502962d9eab28bd8532991b7094899f55f96c252bb
SHA512f51488378f623bd30e556885b8fa31b4af48b6c66fbce0052a5a50b8a388c5d5008d97b22045ac9ba3c1af30ec12f908323f21a8fc9df6eb355b4bf5b224de77
-
Filesize
4KB
MD54e7b9b733cb3cb59f941d8ac89fee8ee
SHA1e3755915aed19964a6f86a7cd736527bf13835a2
SHA256b7154fd2b7dda400bc4a423de47349a0a716ae26bb3e3340b6ebf1b0bd4a66e4
SHA5128830780da4cd5907cad4a7a699c180937e96c18fee35659cd9e093c5b9f4ad3a6cee50e6adccf772804e2f25da2ecc9d6dcbd8118d2b46d960f4335c8c73d01e
-
Filesize
638B
MD5e5bc1b8f423f3cce04388bfbe53d93ff
SHA154e173bb949842e15150102631a2fd8c7fc0d967
SHA2567c750178e9525b4eef587eed36c7040a4806207909e4463a56f33073081b7de5
SHA512aa720ad06776f38ce63d67b743ee019bef1130874a52d7825559e559a056e2ed5c543290a1c13e6ea733204791865ba17f9d4b1d0650e64db1f89af0da7b693f
-
Filesize
129B
MD50e4713c22a35e92f1fc97cb7ff6f173f
SHA111788b437dbe7a229d1785515f570f85cce9c00e
SHA256cf879f43e4779407c6947d24654bd7d6d1f3e5607a7b1e877b1e35834a6d69e2
SHA51239933226ee62ac8f3b04fa02c8b17b83d1199570fac922c4848898c309dac643cbe5f18f4ecc7bae4194f33af757e4cd4b0d82578a669c8e23a4edec32e2da57
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB