Analysis
- max time kernel
132s - max time network
122s - platform
windows7_x64 - resource
win7-20240903-en - resource tags
- submitted
30/09/2024, 05:16
General
- Target sample.exe
- Size 10KB
- Sample240930-fx413atfpb
- SHA256 6cd338d71c9b2e482089e164a2d58f03e0619734b4436fb745df4f57527eeed6
Score
9/10
Malware Config
Signatures
- Renames multiple (276) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Opens file in notepad (likely ransom note) 1 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\sample.exe"C:\Users\Admin\AppData\Local\Temp\sample.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\README.txt1⤵
- Opens file in notepad (likely ransom note)
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
desktop.ini.morgan
container.dat.morgan
3561288849sdhlie.sqlite.morgan
README.txt
SelectUnprotect.xlsx.morgan
memory/1508-0-0x0000000073EAE000-0x0000000073EAF000-memory.dmp
memory/1508-1-0x0000000000AF0000-0x0000000000AF8000-memory.dmp
memory/1508-2-0x0000000073EA0000-0x000000007458E000-memory.dmp
memory/1508-280-0x0000000073EA0000-0x000000007458E000-memory.dmp