ac912d8d7b51eb2e29f72dd9fa1c99c99ee897d45acb60b3ffcd0ec436c1ade4

General

Target

sample.exe
Size

10KB
MD5

0e7215901aa61f182a5d229d289b073a
SHA1

a34cea415bc7d07d93c6b1b02e2a2349fc3b38b8
SHA256

6cd338d71c9b2e482089e164a2d58f03e0619734b4436fb745df4f57527eeed6
SHA512

d2d20855e7365c9db534b9c70e687c65503147619b18656fcd461424dcb7ccac32b4d5de029e7676037e78d9b2bb616688763b16559f262a34f0d11415c0b203
SSDEEP

192:X7slLwEkBoDGZu6qdkXn3sHBrDPNCGmkVQLrF:AV8+G4dk30XYoVor

Score

9^/10

discovery ransomware spyware stealer

Malware Config

Signatures

Renames multiple (729) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Sets desktop wallpaper using registry 2 TTPs 1 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\wallpaper.jpg"	sample.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sample.exe

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

pid	Process
1276	NOTEPAD.EXE

Suspicious behavior: EnumeratesProcesses 7 IoCs

pid	Process
4704	taskmgr.exe
4704	taskmgr.exe
4704	taskmgr.exe
4704	taskmgr.exe
4704	taskmgr.exe
4704	taskmgr.exe
4704	taskmgr.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	436	sample.exe
Token: SeDebugPrivilege	4704	taskmgr.exe
Token: SeSystemProfilePrivilege	4704	taskmgr.exe
Token: SeCreateGlobalPrivilege	4704	taskmgr.exe

Suspicious use of FindShellTrayWindow 19 IoCs

pid	Process
4704	taskmgr.exe
4704	taskmgr.exe
4704	taskmgr.exe
4704	taskmgr.exe
4704	taskmgr.exe
4704	taskmgr.exe
4704	taskmgr.exe
4704	taskmgr.exe
4704	taskmgr.exe
4704	taskmgr.exe
4704	taskmgr.exe
4704	taskmgr.exe
4704	taskmgr.exe
4704	taskmgr.exe
4704	taskmgr.exe
4704	taskmgr.exe
4704	taskmgr.exe
4704	taskmgr.exe
4704	taskmgr.exe

Suspicious use of SendNotifyMessage 19 IoCs

pid	Process
4704	taskmgr.exe
4704	taskmgr.exe
4704	taskmgr.exe
4704	taskmgr.exe
4704	taskmgr.exe
4704	taskmgr.exe
4704	taskmgr.exe
4704	taskmgr.exe
4704	taskmgr.exe
4704	taskmgr.exe
4704	taskmgr.exe
4704	taskmgr.exe
4704	taskmgr.exe
4704	taskmgr.exe
4704	taskmgr.exe
4704	taskmgr.exe
4704	taskmgr.exe
4704	taskmgr.exe
4704	taskmgr.exe

C:\Users\Admin\AppData\Local\Temp\sample.exe
"C:\Users\Admin\AppData\Local\Temp\sample.exe"
1⤵
- Sets desktop wallpaper using registry
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:436

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\README.txt
1⤵
- Opens file in notepad (likely ransom note)
PID:1276

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /0
1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4704

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Credentials from Password Stores

1

T1555

Credentials from Web Browsers

1

T1555.003

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Defacement

1

T1491

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\000003.log.morgan

Filesize
16B

MD5
1e5747b4c995e0a2013bdd7e5d106693

SHA1
75c145a9803a54cc32b1debfbd95a31297e31fbb

SHA256
165772da379e078bc8b7535b93dcec8192d29ff5aaed271e61010892ab3e2cbb

SHA512
2aaf627771106fcba16e7d336f95663c101e0a1a610fa24f81093a07e407352fbe7e568ec13e978a51047a071cb0fb22a38dc0eb262e4badf01b8702c6c54d00

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.AccountsControl_cw5n1h2txyewy\Settings\settings.dat.morgan

Filesize
8KB

MD5
dfce9e60e4e9555168b8e671fec8c709

SHA1
0c4d94b590fc8eee2c8589332a64aad2fabe5ed9

SHA256
38d7a4f3ab7be0fc5620ab314b9976bb37df3e32fc3ca158119061cf15936acf

SHA512
b9ea477b5665dbcf4704c7c287b0336bbb6d57753435ee053f8327bd166230e56e76d6b3cbb688c02fff06851ff6261137366020688fd9b19d27e59a413ee471

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Settings_{f94138d4-4cd4-4221-818a-f0c33d41c660}\0.1.filtertrie.intermediate.txt.morgan

Filesize
16B

MD5
0785be4c59d706caec9dff65e4497609

SHA1
ebefe2551763351c990c370cae2a91f117bf5320

SHA256
576d8eefafe49758b8f35a5e1df69302d751abe5e5db181938e2441208efbe53

SHA512
c19bc7413a56b72f09aab094da0a4ba74bc5b00372f99d1733225410d2ca1b7bdeec7ef4d7b02d04bc4aa73278899dbb292325a997bb53710e77e20bb74eb8f7

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Settings_{f94138d4-4cd4-4221-818a-f0c33d41c660}\0.2.filtertrie.intermediate.txt.morgan

Filesize
16B

MD5
1529e9189db6972834d742dc19807370

SHA1
f85b2082fb9dbbd63748e60c2141a7ba11642b33

SHA256
2ee313a15e3a92f02fe9e0b855bed6108824d3baf652cdc432de2a421afeb1ec

SHA512
d5bd05371a52b64fcab76b726811a1ef792e14c5e15b16d534dea1a8821350503eb3cbd054d724dec5dbfdbca13db77795735dc7673b9207d784090ff3d2555b

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133670754066107026.txt.morgan

Filesize
77KB

MD5
5067b2f252307df367609c1e5acdb245

SHA1
1110f010196026f8f3678c058e9091a5b75f022d

SHA256
3788caf81a591b785978b2d7eaa742bee517bd579767c2477aa316c81ebd711e

SHA512
1c56bd86f92a4d573c289a20bd72525efa1e9f8ea987685ab0c08198741ac687bb4a33a04646adc1b522a2fdb57e9e6bd4d5eeaa3aedee873ac9b604fb33ecdd

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133670762621537007.txt.morgan

Filesize
65KB

MD5
2e310212476a6d637c68103cd27194f4

SHA1
330453bf9992d431a9d755c391b17a730b6b4d5e

SHA256
e623049d1c6df7dbb8186fa70cd6478d48e69a89e671476f814e5da1afbcdf37

SHA512
841f5cdce292f4531eaade0bda58b184f9cc15da7618ea1962d836eb8e08d459a6a0f35c5d5ee284c535214df824512f272ea30f7bddbe3b7e06f0b61edcb012

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yaq795em.default-release\storage\permanent\chrome\idb\3561288849sdhlie.sqlite.morgan

Filesize
48KB

MD5
494a6df948a03019c85c5fb8f23f0b02

SHA1
b7b3fe7c148c58d7aa299602e8a67136db293287

SHA256
e855301f9312c9df0f5a331cef624846347369753437eb3331b044c0668f265e

SHA512
099e5347b8713c8211fb9397064058940da4325111bdaf452e04c7824ad0a74ca9973e93bb76aa2b85ae457d2b48591cd6198584957850fb514d2dfdf51590d4

Download Submit
C:\Users\Admin\Desktop\README.txt

Filesize
79B

MD5
e8eb2a43f72a42d4fbb58b3b5ccdfdc4

SHA1
4c3707c8e524a8dbc6ca1e1a7a6bf9f229664765

SHA256
06f63c9c4059858324bd60de4965d4b9a75ea60774d2d7e9b38a4d3254e5d94b

SHA512
d097551e363e2de142e4611f0890cc727216f9cc9b61801fd56864b59cb9dd17bc9299dfe4dd41f1a360f30182e0bf5bf128a382b0c4a58880fce1054a947e69

Download Submit
memory/436-735-0x0000000074D00000-0x00000000754B0000-memory.dmp

Filesize
7.7MB

Download
memory/436-2-0x0000000074D00000-0x00000000754B0000-memory.dmp

Filesize
7.7MB

Download
memory/436-0-0x0000000074D0E000-0x0000000074D0F000-memory.dmp

Filesize
4KB

Download
memory/436-1-0x0000000000D10000-0x0000000000D18000-memory.dmp

Filesize
32KB

Download
memory/4704-743-0x00000225709E0000-0x00000225709E1000-memory.dmp

Filesize
4KB

Download
memory/4704-738-0x00000225709E0000-0x00000225709E1000-memory.dmp

Filesize
4KB

Download
memory/4704-739-0x00000225709E0000-0x00000225709E1000-memory.dmp

Filesize
4KB

Download
memory/4704-737-0x00000225709E0000-0x00000225709E1000-memory.dmp

Filesize
4KB

Download
memory/4704-744-0x00000225709E0000-0x00000225709E1000-memory.dmp

Filesize
4KB

Download
memory/4704-749-0x00000225709E0000-0x00000225709E1000-memory.dmp

Filesize
4KB

Download
memory/4704-748-0x00000225709E0000-0x00000225709E1000-memory.dmp

Filesize
4KB

Download
memory/4704-747-0x00000225709E0000-0x00000225709E1000-memory.dmp

Filesize
4KB

Download
memory/4704-746-0x00000225709E0000-0x00000225709E1000-memory.dmp

Filesize
4KB

Download
memory/4704-745-0x00000225709E0000-0x00000225709E1000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing