Analysis
-
max time kernel
40s -
max time network
41s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
01-10-2024 19:51
General
-
Target
f16db77670d11d7884a9814e5212038b618ee9ab573345353e9b5fc9e438a2c2.exe
-
Size
145KB
-
MD5
9c70caed1f0c37a7d891f22f5e6ac297
-
SHA1
8a1f61df4627065a5977033b42654fb4ec85be19
-
SHA256
f16db77670d11d7884a9814e5212038b618ee9ab573345353e9b5fc9e438a2c2
-
SHA512
c54a137cb0439a1cd8040f3e12e0f6dbcfedb99db2135d66e7d6667a0298bc920118c909a5545555425df8149ac1fe321fb1e4bf43a2782831dfbc2ca42de645
-
SSDEEP
3072:DqJogYkcSNm9V7DjWWumrIDNd7k/PHm2T:Dq2kc4m9tDaWumrIDNm/u
Malware Config
Signatures
-
Renames multiple (623) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops desktop.ini file(s) 2 IoCs
-
Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
-
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Modifies registry class 5 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: RenamesItself 26 IoCs
-
Suspicious use of AdjustPrivilegeToken 64 IoCs
-
Suspicious use of WriteProcessMemory 7 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\f16db77670d11d7884a9814e5212038b618ee9ab573345353e9b5fc9e438a2c2.exe"C:\Users\Admin\AppData\Local\Temp\f16db77670d11d7884a9814e5212038b618ee9ab573345353e9b5fc9e438a2c2.exe"1⤵
- Drops desktop.ini file(s)
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\D551.tmp"C:\ProgramData\D551.tmp"2⤵
- Checks computer location settings
- Deletes itself
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C DEL /F /Q C:\PROGRA~3\D551.tmp >> NUL3⤵
- System Location Discovery: System Language Discovery
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
129B
MD5ff885ca24ee8a8ee68ddcff467bc30f4
SHA1dd0328fb3bd75004fa8563f255f784413dd7177e
SHA2566fb384c4097b0ebfbe5e5685f4033a82ad62aafcd8c1f92bce8b910294d8baa5
SHA512d62803655f83a8be01a1c96a2c62cb07575c53021019219cc0df5f7e6fa1201b7d59a3aa60bd077675d3cd965858c3b92d7b84ffe8c72f5af5094d28b3b24b0d
-
Filesize
14KB
MD5294e9f64cb1642dd89229fff0592856b
SHA197b148c27f3da29ba7b18d6aee8a0db9102f47c9
SHA256917e115cc403e29b4388e0d175cbfac3e7e40ca1742299fbdb353847db2de7c2
SHA512b87d531890bf1577b9b4af41dddb2cdbbfa164cf197bd5987df3a3075983645a3acba443e289b7bfd338422978a104f55298fbfe346872de0895bde44adc89cf
-
Filesize
145KB
MD59e1c657e8bbce28efd7e09b8148a0a09
SHA10958ee4b9070f95b8bab2940b70d11724558f558
SHA2562730f4e36e708bbf909f2a2658600220248f0fa89d2e419ec81284487103a18a
SHA5129414b5a2bd900d201cefdcd8996ad53e8eccd9187b447b1190a1b496a44c8f24a8b869c7a0d80b65c556879e5e2e9ad1a69d6a2f15357d31872423181114b206
-
Filesize
129B
MD5b9bd3d6bdc009803798987adef3c35da
SHA116bb82789a76b938a9c6bf8da5b9100bcfaa0558
SHA2560418bb27477f60935515555f2dc4b56965cb269bf8291f07baa3c104be08f349
SHA5124976dd3b70c80a84b50042c1b0f8bf1f428760a0e11797609b56e813b7f349af239e464d030c87bd59c2215e26f70953d56040af080ad5c83a60e4a81ed8eb35
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
4KB
-
Filesize
64KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB