Analysis
- max time kernel
149s - max time network
143s - platform
windows10-2004_x64 - resource
win10v2004-20240802-en - resource tags
- submitted
30/09/2024, 05:16
General
- Target sample.exe
- Size 10KB
- Sample240930-fx413atfpb
- SHA256 6cd338d71c9b2e482089e164a2d58f03e0619734b4436fb745df4f57527eeed6
Malware Config
Signatures
- Renames multiple (729) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Sets desktop wallpaper using registry 2 TTPs 1 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Opens file in notepad (likely ransom note) 1 IoCs
- Suspicious behavior: EnumeratesProcesses 7 IoCs
- Suspicious use of AdjustPrivilegeToken 4 IoCs
- Suspicious use of FindShellTrayWindow 19 IoCs
- Suspicious use of SendNotifyMessage 19 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\sample.exe"C:\Users\Admin\AppData\Local\Temp\sample.exe"1⤵
- Sets desktop wallpaper using registry
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\README.txt1⤵
- Opens file in notepad (likely ransom note)
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /01⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
Network
MITRE ATT&CK Enterprise v15
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
000003.log.morgan
settings.dat.morgan
0.1.filtertrie.intermediate.txt.morgan
0.2.filtertrie.intermediate.txt.morgan
AppCache133670754066107026.txt.morgan
AppCache133670762621537007.txt.morgan
3561288849sdhlie.sqlite.morgan
README.txt
memory/436-735-0x0000000074D00000-0x00000000754B0000-memory.dmp
memory/436-2-0x0000000074D00000-0x00000000754B0000-memory.dmp
memory/436-0-0x0000000074D0E000-0x0000000074D0F000-memory.dmp
memory/436-1-0x0000000000D10000-0x0000000000D18000-memory.dmp
memory/4704-743-0x00000225709E0000-0x00000225709E1000-memory.dmp
memory/4704-738-0x00000225709E0000-0x00000225709E1000-memory.dmp
memory/4704-739-0x00000225709E0000-0x00000225709E1000-memory.dmp
memory/4704-737-0x00000225709E0000-0x00000225709E1000-memory.dmp
memory/4704-744-0x00000225709E0000-0x00000225709E1000-memory.dmp
memory/4704-749-0x00000225709E0000-0x00000225709E1000-memory.dmp
memory/4704-748-0x00000225709E0000-0x00000225709E1000-memory.dmp
memory/4704-747-0x00000225709E0000-0x00000225709E1000-memory.dmp
memory/4704-746-0x00000225709E0000-0x00000225709E1000-memory.dmp
memory/4704-745-0x00000225709E0000-0x00000225709E1000-memory.dmp