4e3463135c8ca8b3570dc818ab1ab056db9d08b43e37639ad0a0e53ae6d9f052

General

Target

4e3463135c8ca8b3570dc818ab1ab056db9d08b43e37639ad0a0e53ae6d9f052N.exe
Size

1.5MB
MD5

99f6acc34882adbb61226daafb5abc70
SHA1

6325fbbb4584d3e45a74ac2eaec3615ffb916430
SHA256

4e3463135c8ca8b3570dc818ab1ab056db9d08b43e37639ad0a0e53ae6d9f052
SHA512

bdf5fe162d7ec550a5c5a58b5b452d53f78b90bcdaa388f152b870afec84c768148aab4d7214c3cb1da87db2890d12737bacd0c2550e24bd95b29769a702f054
SSDEEP

3072:8gV7qqpZXXRvjxCb5NgXDY7uSlkJcUa7kYQTcqW2NdQQGH/UDhSCUc4aqTB891gv:V1rlKgzelZNQSBQGH/CSpWqTVmQ

Score

6^/10

discovery ransomware

Malware Config

Signatures

Enumerates connected drives 3 TTPs 10 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\E:	4e3463135c8ca8b3570dc818ab1ab056db9d08b43e37639ad0a0e53ae6d9f052N.exe
File opened (read-only)	\??\H:	4e3463135c8ca8b3570dc818ab1ab056db9d08b43e37639ad0a0e53ae6d9f052N.exe
File opened (read-only)	\??\I:	4e3463135c8ca8b3570dc818ab1ab056db9d08b43e37639ad0a0e53ae6d9f052N.exe
File opened (read-only)	\??\J:	4e3463135c8ca8b3570dc818ab1ab056db9d08b43e37639ad0a0e53ae6d9f052N.exe
File opened (read-only)	\??\L:	4e3463135c8ca8b3570dc818ab1ab056db9d08b43e37639ad0a0e53ae6d9f052N.exe
File opened (read-only)	\??\G:	4e3463135c8ca8b3570dc818ab1ab056db9d08b43e37639ad0a0e53ae6d9f052N.exe
File opened (read-only)	\??\K:	4e3463135c8ca8b3570dc818ab1ab056db9d08b43e37639ad0a0e53ae6d9f052N.exe
File opened (read-only)	\??\M:	4e3463135c8ca8b3570dc818ab1ab056db9d08b43e37639ad0a0e53ae6d9f052N.exe
File opened (read-only)	\??\N:	4e3463135c8ca8b3570dc818ab1ab056db9d08b43e37639ad0a0e53ae6d9f052N.exe
File opened (read-only)	\??\O:	4e3463135c8ca8b3570dc818ab1ab056db9d08b43e37639ad0a0e53ae6d9f052N.exe

Sets desktop wallpaper using registry 2 TTPs 1 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\Control Panel\Desktop\Wallpaper = "C:\\windows\\WallPapers.jpg"	4e3463135c8ca8b3570dc818ab1ab056db9d08b43e37639ad0a0e53ae6d9f052N.exe

Drops file in Program Files directory 21 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\7-Zip\7z.cab	4e3463135c8ca8b3570dc818ab1ab056db9d08b43e37639ad0a0e53ae6d9f052N.exe
File opened for modification	C:\Program Files\7-Zip\RCXA548.tmp	4e3463135c8ca8b3570dc818ab1ab056db9d08b43e37639ad0a0e53ae6d9f052N.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	4e3463135c8ca8b3570dc818ab1ab056db9d08b43e37639ad0a0e53ae6d9f052N.exe
File created	C:\Program Files\7-Zip\7z.cab	4e3463135c8ca8b3570dc818ab1ab056db9d08b43e37639ad0a0e53ae6d9f052N.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.cab	4e3463135c8ca8b3570dc818ab1ab056db9d08b43e37639ad0a0e53ae6d9f052N.exe
File opened for modification	C:\Program Files\7-Zip\RCXA55A.tmp	4e3463135c8ca8b3570dc818ab1ab056db9d08b43e37639ad0a0e53ae6d9f052N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.cab	4e3463135c8ca8b3570dc818ab1ab056db9d08b43e37639ad0a0e53ae6d9f052N.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.cab	4e3463135c8ca8b3570dc818ab1ab056db9d08b43e37639ad0a0e53ae6d9f052N.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	4e3463135c8ca8b3570dc818ab1ab056db9d08b43e37639ad0a0e53ae6d9f052N.exe
File created	C:\Program Files\7-Zip\7zFM.cab	4e3463135c8ca8b3570dc818ab1ab056db9d08b43e37639ad0a0e53ae6d9f052N.exe
File opened for modification	C:\Program Files\7-Zip\RCXA56C.tmp	4e3463135c8ca8b3570dc818ab1ab056db9d08b43e37639ad0a0e53ae6d9f052N.exe
File opened for modification	C:\Program Files\7-Zip\RCXA57C.tmp	4e3463135c8ca8b3570dc818ab1ab056db9d08b43e37639ad0a0e53ae6d9f052N.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\RCXA58D.tmp	4e3463135c8ca8b3570dc818ab1ab056db9d08b43e37639ad0a0e53ae6d9f052N.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\RCXA58E.tmp	4e3463135c8ca8b3570dc818ab1ab056db9d08b43e37639ad0a0e53ae6d9f052N.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	4e3463135c8ca8b3570dc818ab1ab056db9d08b43e37639ad0a0e53ae6d9f052N.exe
File opened for modification	C:\Program Files\7-Zip\RCXA559.tmp	4e3463135c8ca8b3570dc818ab1ab056db9d08b43e37639ad0a0e53ae6d9f052N.exe
File created	C:\Program Files\7-Zip\7z.exe	4e3463135c8ca8b3570dc818ab1ab056db9d08b43e37639ad0a0e53ae6d9f052N.exe
File created	C:\Program Files\7-Zip\7zFM.exe	4e3463135c8ca8b3570dc818ab1ab056db9d08b43e37639ad0a0e53ae6d9f052N.exe
File opened for modification	C:\Program Files\7-Zip\RCXA56B.tmp	4e3463135c8ca8b3570dc818ab1ab056db9d08b43e37639ad0a0e53ae6d9f052N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	4e3463135c8ca8b3570dc818ab1ab056db9d08b43e37639ad0a0e53ae6d9f052N.exe
File created	C:\Program Files\readme.1xt	4e3463135c8ca8b3570dc818ab1ab056db9d08b43e37639ad0a0e53ae6d9f052N.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\windows\readme.1xt	4e3463135c8ca8b3570dc818ab1ab056db9d08b43e37639ad0a0e53ae6d9f052N.exe
File created	C:\windows\WallPapers.jpg	4e3463135c8ca8b3570dc818ab1ab056db9d08b43e37639ad0a0e53ae6d9f052N.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4408	2052	WerFault.exe	81

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	4e3463135c8ca8b3570dc818ab1ab056db9d08b43e37639ad0a0e53ae6d9f052N.exe

Modifies Internet Explorer settings 1 TTPs 2 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\Software\Microsoft\Internet Explorer\Desktop\General	4e3463135c8ca8b3570dc818ab1ab056db9d08b43e37639ad0a0e53ae6d9f052N.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\SOFTWARE\Microsoft\Internet Explorer\Desktop\General\WallpaperSource = "C:\\windows\\WallPapers.jpg"	4e3463135c8ca8b3570dc818ab1ab056db9d08b43e37639ad0a0e53ae6d9f052N.exe

C:\Users\Admin\AppData\Local\Temp\4e3463135c8ca8b3570dc818ab1ab056db9d08b43e37639ad0a0e53ae6d9f052N.exe
"C:\Users\Admin\AppData\Local\Temp\4e3463135c8ca8b3570dc818ab1ab056db9d08b43e37639ad0a0e53ae6d9f052N.exe"
1⤵
- Enumerates connected drives
- Sets desktop wallpaper using registry
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
PID:2052
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2052 -s 916
  2⤵
  - Program crash
  PID:4408

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 360 -p 2052 -ip 2052
1⤵
PID:384

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

2

T1112

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Defacement

1

T1491

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\7-Zip\7z.cab

Filesize
544KB

MD5
9a1dd1d96481d61934dcc2d568971d06

SHA1
f136ef9bf8bd2fc753292fb5b7cf173a22675fb3

SHA256
8cebb25e240db3b6986fcaed6bc0b900fa09dad763a56fb71273529266c5c525

SHA512
7ac1581f8a29e778ba1a1220670796c47fa5b838417f8f635e2cb1998a01515cff3ee57045dacb78a8ec70d43754b970743aba600379fe6d9481958d32d8a5aa

Download Submit
C:\Program Files\7-Zip\7z.exe

Filesize
288KB

MD5
8af24ca2375b93eba795225f81a0ced2

SHA1
f4ca3165bd0a6112fb87d4555e7ee75214af4be8

SHA256
0158bddb2e3dd70d509c25f07ce6bc8bb091b3ba80f3e8e26ec47db0394f9072

SHA512
05c49e0b4dd5b5a5652c08e987c1900e63f116745d72656d7543c84479bbad9391c39611dee130bc4319cba460e5d8c34840fccb84876e16b80bfcae059d5ae8

Download Submit
C:\Program Files\7-Zip\7zFM.cab

Filesize
930KB

MD5
30ac0b832d75598fb3ec37b6f2a8c86a

SHA1
6f47dbfd6ff36df7ba581a4cef024da527dc3046

SHA256
1ea0839c8dc95ad2c060af7d042c40c0daed58ce8e4524c0fba12fd73e4afb74

SHA512
505870601a4389b7ed2c8fecf85835adfd2944cbc10801f74bc4e08f5a0d6ecc9a52052fc37e216304cd1655129021862294a698ed36b3b43d428698f7263057

Download Submit
C:\Program Files\7-Zip\7zFM.exe

Filesize
1.5MB

MD5
65cad70578501b698f663bd987b113eb

SHA1
4eb128008ddbd069f2a611e7022bab6111b01780

SHA256
c67c47ecb4d3a13353f41d780ccf8595622096875a694642557ef3f2b8780f55

SHA512
8a77ebd517c4cf8db2ebbf93fb570881154a8272b5fb2190d80490dfa24d795acfc2a80f5264c491e5d2610cc0fbeebf65b2ef62b70bb1508db3003146c12dc7

Download Submit
C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.cab

Filesize
2.1MB

MD5
b8d69fa2755c3ab1f12f8866a8e2a4f7

SHA1
8e3cdfb20e158c2906323ba0094a18c7dd2aaf2d

SHA256
7e0976036431640ae1d9f1c0b52bcea5dd37ef86cd3f5304dc8a96459d9483cd

SHA512
5acac46068b331216978500f67a7fa5257bc5b05133fab6d88280b670ae4885ef2d5d1f531169b66bf1952e082f56b1ad2bc3901479b740f96c53ea405adda18

Download Submit
memory/2052-0-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2052-67-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads