Analysis
-
max time kernel
119s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
03-10-2024 01:46
Behavioral task
behavioral1
Sample
9097ab2b2b71f3ea0cf8c9271224b6227e9aa2545ae23d4621f122bdb99c77b8.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
9097ab2b2b71f3ea0cf8c9271224b6227e9aa2545ae23d4621f122bdb99c77b8.exe
Resource
win10v2004-20240802-en
General
-
Target
9097ab2b2b71f3ea0cf8c9271224b6227e9aa2545ae23d4621f122bdb99c77b8.exe
-
Size
1.2MB
-
MD5
54416fc42afa9b09ea7e8d8e318f4891
-
SHA1
8c924431049191e763a14503517a9583f070fdeb
-
SHA256
9097ab2b2b71f3ea0cf8c9271224b6227e9aa2545ae23d4621f122bdb99c77b8
-
SHA512
1ce45889054522a9277ebbd012f20dfe4039feafe5e25a0c9c5293dce867aa06e5550606191a8ce876a6307ffbdba3af41013f1c546cf3c4560827b99a98873a
-
SSDEEP
24576:RtP7hdO1s6Ekgcec1SgnyN9HPFCCNhQI6GOfaFVIVrYwcMavDiZn3m75/J7:XLO18kgcec0gnyN9HPFCCNSI6GOfaFVp
Malware Config
Signatures
-
Detect Rhysida ransomware 3 IoCs
resource yara_rule behavioral1/memory/2264-717-0x0000000000400000-0x0000000000522000-memory.dmp family_rhysida behavioral1/memory/2264-718-0x0000000000400000-0x0000000000522000-memory.dmp family_rhysida behavioral1/memory/2264-719-0x0000000000400000-0x0000000000522000-memory.dmp family_rhysida -
Rhysida
Rhysida is a ransomware that is written in C++ and discovered in 2023.
-
Renames multiple (722) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell and hide display window.
pid Process 2908 powershell.exe -
Credentials from Password Stores: Windows Credential Manager 1 TTPs
Suspicious access to Credentials History.
-
Drops startup file 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\CriticalBreachDetected.pdf 9097ab2b2b71f3ea0cf8c9271224b6227e9aa2545ae23d4621f122bdb99c77b8.exe -
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Hide Artifacts: Hidden Window 1 TTPs 2 IoCs
Windows that would typically be displayed when an application carries out an operation can be hidden.
pid Process 1796 cmd.exe 2740 cmd.exe -
Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
-
Sets desktop wallpaper using registry 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Public\\bg.jpg" reg.exe -
Hide Artifacts: Ignore Process Interrupts 1 TTPs 2 IoCs
Command interpreters often include specific commands/flags that ignore errors and other hangups.
pid Process 2740 cmd.exe 1796 cmd.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 2908 powershell.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2908 powershell.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2264 wrote to memory of 2712 2264 9097ab2b2b71f3ea0cf8c9271224b6227e9aa2545ae23d4621f122bdb99c77b8.exe 32 PID 2264 wrote to memory of 2712 2264 9097ab2b2b71f3ea0cf8c9271224b6227e9aa2545ae23d4621f122bdb99c77b8.exe 32 PID 2264 wrote to memory of 2712 2264 9097ab2b2b71f3ea0cf8c9271224b6227e9aa2545ae23d4621f122bdb99c77b8.exe 32 PID 2712 wrote to memory of 2844 2712 cmd.exe 33 PID 2712 wrote to memory of 2844 2712 cmd.exe 33 PID 2712 wrote to memory of 2844 2712 cmd.exe 33 PID 2844 wrote to memory of 2948 2844 cmd.exe 34 PID 2844 wrote to memory of 2948 2844 cmd.exe 34 PID 2844 wrote to memory of 2948 2844 cmd.exe 34 PID 2264 wrote to memory of 2576 2264 9097ab2b2b71f3ea0cf8c9271224b6227e9aa2545ae23d4621f122bdb99c77b8.exe 35 PID 2264 wrote to memory of 2576 2264 9097ab2b2b71f3ea0cf8c9271224b6227e9aa2545ae23d4621f122bdb99c77b8.exe 35 PID 2264 wrote to memory of 2576 2264 9097ab2b2b71f3ea0cf8c9271224b6227e9aa2545ae23d4621f122bdb99c77b8.exe 35 PID 2576 wrote to memory of 2580 2576 cmd.exe 36 PID 2576 wrote to memory of 2580 2576 cmd.exe 36 PID 2576 wrote to memory of 2580 2576 cmd.exe 36 PID 2580 wrote to memory of 1968 2580 cmd.exe 37 PID 2580 wrote to memory of 1968 2580 cmd.exe 37 PID 2580 wrote to memory of 1968 2580 cmd.exe 37 PID 2264 wrote to memory of 2716 2264 9097ab2b2b71f3ea0cf8c9271224b6227e9aa2545ae23d4621f122bdb99c77b8.exe 38 PID 2264 wrote to memory of 2716 2264 9097ab2b2b71f3ea0cf8c9271224b6227e9aa2545ae23d4621f122bdb99c77b8.exe 38 PID 2264 wrote to memory of 2716 2264 9097ab2b2b71f3ea0cf8c9271224b6227e9aa2545ae23d4621f122bdb99c77b8.exe 38 PID 2716 wrote to memory of 2724 2716 cmd.exe 39 PID 2716 wrote to memory of 2724 2716 cmd.exe 39 PID 2716 wrote to memory of 2724 2716 cmd.exe 39 PID 2724 wrote to memory of 2600 2724 cmd.exe 40 PID 2724 wrote to memory of 2600 2724 cmd.exe 40 PID 2724 wrote to memory of 2600 2724 cmd.exe 40 PID 2264 wrote to memory of 2828 2264 9097ab2b2b71f3ea0cf8c9271224b6227e9aa2545ae23d4621f122bdb99c77b8.exe 41 PID 2264 wrote to memory of 2828 2264 9097ab2b2b71f3ea0cf8c9271224b6227e9aa2545ae23d4621f122bdb99c77b8.exe 41 PID 2264 wrote to memory of 2828 2264 9097ab2b2b71f3ea0cf8c9271224b6227e9aa2545ae23d4621f122bdb99c77b8.exe 41 PID 2828 wrote to memory of 1328 2828 cmd.exe 42 PID 2828 wrote to memory of 1328 2828 cmd.exe 42 PID 2828 wrote to memory of 1328 2828 cmd.exe 42 PID 1328 wrote to memory of 2556 1328 cmd.exe 43 PID 1328 wrote to memory of 2556 1328 cmd.exe 43 PID 1328 wrote to memory of 2556 1328 cmd.exe 43 PID 2264 wrote to memory of 2564 2264 9097ab2b2b71f3ea0cf8c9271224b6227e9aa2545ae23d4621f122bdb99c77b8.exe 44 PID 2264 wrote to memory of 2564 2264 9097ab2b2b71f3ea0cf8c9271224b6227e9aa2545ae23d4621f122bdb99c77b8.exe 44 PID 2264 wrote to memory of 2564 2264 9097ab2b2b71f3ea0cf8c9271224b6227e9aa2545ae23d4621f122bdb99c77b8.exe 44 PID 2564 wrote to memory of 2572 2564 cmd.exe 45 PID 2564 wrote to memory of 2572 2564 cmd.exe 45 PID 2564 wrote to memory of 2572 2564 cmd.exe 45 PID 2572 wrote to memory of 2584 2572 cmd.exe 46 PID 2572 wrote to memory of 2584 2572 cmd.exe 46 PID 2572 wrote to memory of 2584 2572 cmd.exe 46 PID 2264 wrote to memory of 2624 2264 9097ab2b2b71f3ea0cf8c9271224b6227e9aa2545ae23d4621f122bdb99c77b8.exe 47 PID 2264 wrote to memory of 2624 2264 9097ab2b2b71f3ea0cf8c9271224b6227e9aa2545ae23d4621f122bdb99c77b8.exe 47 PID 2264 wrote to memory of 2624 2264 9097ab2b2b71f3ea0cf8c9271224b6227e9aa2545ae23d4621f122bdb99c77b8.exe 47 PID 2624 wrote to memory of 2672 2624 cmd.exe 48 PID 2624 wrote to memory of 2672 2624 cmd.exe 48 PID 2624 wrote to memory of 2672 2624 cmd.exe 48 PID 2672 wrote to memory of 2036 2672 cmd.exe 49 PID 2672 wrote to memory of 2036 2672 cmd.exe 49 PID 2672 wrote to memory of 2036 2672 cmd.exe 49 PID 2264 wrote to memory of 3052 2264 9097ab2b2b71f3ea0cf8c9271224b6227e9aa2545ae23d4621f122bdb99c77b8.exe 50 PID 2264 wrote to memory of 3052 2264 9097ab2b2b71f3ea0cf8c9271224b6227e9aa2545ae23d4621f122bdb99c77b8.exe 50 PID 2264 wrote to memory of 3052 2264 9097ab2b2b71f3ea0cf8c9271224b6227e9aa2545ae23d4621f122bdb99c77b8.exe 50 PID 3052 wrote to memory of 3056 3052 cmd.exe 51 PID 3052 wrote to memory of 3056 3052 cmd.exe 51 PID 3052 wrote to memory of 3056 3052 cmd.exe 51 PID 3056 wrote to memory of 2368 3056 cmd.exe 52 PID 3056 wrote to memory of 2368 3056 cmd.exe 52 PID 3056 wrote to memory of 2368 3056 cmd.exe 52 PID 2264 wrote to memory of 1932 2264 9097ab2b2b71f3ea0cf8c9271224b6227e9aa2545ae23d4621f122bdb99c77b8.exe 53
Processes
-
C:\Users\Admin\AppData\Local\Temp\9097ab2b2b71f3ea0cf8c9271224b6227e9aa2545ae23d4621f122bdb99c77b8.exe"C:\Users\Admin\AppData\Local\Temp\9097ab2b2b71f3ea0cf8c9271224b6227e9aa2545ae23d4621f122bdb99c77b8.exe"1⤵
- Drops startup file
- Suspicious use of WriteProcessMemory
PID:2264 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cmd.exe /c reg delete "HKCU\Conttol Panel\Desktop" /v Wallpaper /f2⤵
- Suspicious use of WriteProcessMemory
PID:2712 -
C:\Windows\system32\cmd.execmd.exe /c reg delete "HKCU\Conttol Panel\Desktop" /v Wallpaper /f3⤵
- Suspicious use of WriteProcessMemory
PID:2844 -
C:\Windows\system32\reg.exereg delete "HKCU\Conttol Panel\Desktop" /v Wallpaper /f4⤵PID:2948
-
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cmd.exe /c reg delete "HKCU\Conttol Panel\Desktop" /v WallpaperStyle /f2⤵
- Suspicious use of WriteProcessMemory
PID:2576 -
C:\Windows\system32\cmd.execmd.exe /c reg delete "HKCU\Conttol Panel\Desktop" /v WallpaperStyle /f3⤵
- Suspicious use of WriteProcessMemory
PID:2580 -
C:\Windows\system32\reg.exereg delete "HKCU\Conttol Panel\Desktop" /v WallpaperStyle /f4⤵PID:1968
-
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cmd.exe /c reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\ActiveDesktop" /v NoChangingWallPaper /t REG_SZ /d 1 /f2⤵
- Suspicious use of WriteProcessMemory
PID:2716 -
C:\Windows\system32\cmd.execmd.exe /c reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\ActiveDesktop" /v NoChangingWallPaper /t REG_SZ /d 1 /f3⤵
- Suspicious use of WriteProcessMemory
PID:2724 -
C:\Windows\system32\reg.exereg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\ActiveDesktop" /v NoChangingWallPaper /t REG_SZ /d 1 /f4⤵PID:2600
-
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cmd.exe /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\ActiveDesktop" /v NoChangingWallPaper /t REG_SZ /d 1 /f2⤵
- Suspicious use of WriteProcessMemory
PID:2828 -
C:\Windows\system32\cmd.execmd.exe /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\ActiveDesktop" /v NoChangingWallPaper /t REG_SZ /d 1 /f3⤵
- Suspicious use of WriteProcessMemory
PID:1328 -
C:\Windows\system32\reg.exereg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\ActiveDesktop" /v NoChangingWallPaper /t REG_SZ /d 1 /f4⤵PID:2556
-
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cmd.exe /c reg add "HKCU\Control Panel\Desktop" /v Wallpaper /t REG_SZ /d "C:\Users\Public\bg.jpg" /f2⤵
- Suspicious use of WriteProcessMemory
PID:2564 -
C:\Windows\system32\cmd.execmd.exe /c reg add "HKCU\Control Panel\Desktop" /v Wallpaper /t REG_SZ /d "C:\Users\Public\bg.jpg" /f3⤵
- Suspicious use of WriteProcessMemory
PID:2572 -
C:\Windows\system32\reg.exereg add "HKCU\Control Panel\Desktop" /v Wallpaper /t REG_SZ /d "C:\Users\Public\bg.jpg" /f4⤵
- Sets desktop wallpaper using registry
PID:2584
-
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cmd.exe /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v Wallpaper /t REG_SZ /d "C:\Users\Public\bg.jpg" /f2⤵
- Suspicious use of WriteProcessMemory
PID:2624 -
C:\Windows\system32\cmd.execmd.exe /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v Wallpaper /t REG_SZ /d "C:\Users\Public\bg.jpg" /f3⤵
- Suspicious use of WriteProcessMemory
PID:2672 -
C:\Windows\system32\reg.exereg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v Wallpaper /t REG_SZ /d "C:\Users\Public\bg.jpg" /f4⤵PID:2036
-
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cmd.exe /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v WallpaperStyle /t REG_SZ /d 2 /f2⤵
- Suspicious use of WriteProcessMemory
PID:3052 -
C:\Windows\system32\cmd.execmd.exe /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v WallpaperStyle /t REG_SZ /d 2 /f3⤵
- Suspicious use of WriteProcessMemory
PID:3056 -
C:\Windows\system32\reg.exereg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v WallpaperStyle /t REG_SZ /d 2 /f4⤵PID:2368
-
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cmd.exe /c reg add "HKCU\Control Panel\Desktop" /v WallpaperStyle /t REG_SZ /d 2 /f2⤵PID:1932
-
C:\Windows\system32\cmd.execmd.exe /c reg add "HKCU\Control Panel\Desktop" /v WallpaperStyle /t REG_SZ /d 2 /f3⤵PID:3068
-
C:\Windows\system32\reg.exereg add "HKCU\Control Panel\Desktop" /v WallpaperStyle /t REG_SZ /d 2 /f4⤵PID:1476
-
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c rundll32.exe user32.dll,UpdatePerUserSystemParameters2⤵PID:1584
-
C:\Windows\system32\rundll32.exerundll32.exe user32.dll,UpdatePerUserSystemParameters3⤵PID:2296
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cmd.exe /c start powershell.exe -WindowStyle Hidden -Command Sleep -Milliseconds 500; Remove-Item -Force -Path "C:\Users\Admin\AppData\Local\Temp\C:\Users\Admin\AppData\Local\Temp\9097ab2b2b71f3ea0cf8c9271224b6227e9aa2545ae23d4621f122bdb99c77b8.exe" -ErrorAction SilentlyContinue;2⤵
- Hide Artifacts: Hidden Window
- Hide Artifacts: Ignore Process Interrupts
PID:1796 -
C:\Windows\system32\cmd.execmd.exe /c start powershell.exe -WindowStyle Hidden -Command Sleep -Milliseconds 500; Remove-Item -Force -Path "C:\Users\Admin\AppData\Local\Temp\C:\Users\Admin\AppData\Local\Temp\9097ab2b2b71f3ea0cf8c9271224b6227e9aa2545ae23d4621f122bdb99c77b8.exe" -ErrorAction SilentlyContinue;3⤵
- Hide Artifacts: Hidden Window
- Hide Artifacts: Ignore Process Interrupts
PID:2740 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -WindowStyle Hidden -Command Sleep -Milliseconds 500; Remove-Item -Force -Path "C:\Users\Admin\AppData\Local\Temp\C:\Users\Admin\AppData\Local\Temp\9097ab2b2b71f3ea0cf8c9271224b6227e9aa2545ae23d4621f122bdb99c77b8.exe" -ErrorAction SilentlyContinue;4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2908
-
-
-
Network
MITRE ATT&CK Enterprise v15
Defense Evasion
Hide Artifacts
2Hidden Window
1Ignore Process Interrupts
1Indicator Removal
1File Deletion
1Modify Registry
1