Analysis

  • max time kernel
    119s
  • max time network
    120s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    03-10-2024 01:46

General

  • Target

    9097ab2b2b71f3ea0cf8c9271224b6227e9aa2545ae23d4621f122bdb99c77b8.exe

  • Size

    1.2MB

  • MD5

    54416fc42afa9b09ea7e8d8e318f4891

  • SHA1

    8c924431049191e763a14503517a9583f070fdeb

  • SHA256

    9097ab2b2b71f3ea0cf8c9271224b6227e9aa2545ae23d4621f122bdb99c77b8

  • SHA512

    1ce45889054522a9277ebbd012f20dfe4039feafe5e25a0c9c5293dce867aa06e5550606191a8ce876a6307ffbdba3af41013f1c546cf3c4560827b99a98873a

  • SSDEEP

    24576:RtP7hdO1s6Ekgcec1SgnyN9HPFCCNhQI6GOfaFVIVrYwcMavDiZn3m75/J7:XLO18kgcec0gnyN9HPFCCNSI6GOfaFVp

Malware Config

Signatures

  • Detect Rhysida ransomware 3 IoCs
  • Rhysida

    Rhysida is a ransomware that is written in C++ and discovered in 2023.

  • Renames multiple (722) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

  • Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

    Run Powershell and hide display window.

  • Credentials from Password Stores: Windows Credential Manager 1 TTPs

    Suspicious access to Credentials History.

  • Drops startup file 1 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Hide Artifacts: Hidden Window 1 TTPs 2 IoCs

    Windows that would typically be displayed when an application carries out an operation can be hidden.

  • Indicator Removal: File Deletion 1 TTPs

    Adversaries may delete files left behind by the actions of their intrusion activity.

  • Sets desktop wallpaper using registry 2 TTPs 1 IoCs
  • Hide Artifacts: Ignore Process Interrupts 1 TTPs 2 IoCs

    Command interpreters often include specific commands/flags that ignore errors and other hangups.

  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\9097ab2b2b71f3ea0cf8c9271224b6227e9aa2545ae23d4621f122bdb99c77b8.exe
    "C:\Users\Admin\AppData\Local\Temp\9097ab2b2b71f3ea0cf8c9271224b6227e9aa2545ae23d4621f122bdb99c77b8.exe"
    1⤵
    • Drops startup file
    • Suspicious use of WriteProcessMemory
    PID:2264
    • C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c cmd.exe /c reg delete "HKCU\Conttol Panel\Desktop" /v Wallpaper /f
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:2712
      • C:\Windows\system32\cmd.exe
        cmd.exe /c reg delete "HKCU\Conttol Panel\Desktop" /v Wallpaper /f
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:2844
        • C:\Windows\system32\reg.exe
          reg delete "HKCU\Conttol Panel\Desktop" /v Wallpaper /f
          4⤵
            PID:2948
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c cmd.exe /c reg delete "HKCU\Conttol Panel\Desktop" /v WallpaperStyle /f
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:2576
        • C:\Windows\system32\cmd.exe
          cmd.exe /c reg delete "HKCU\Conttol Panel\Desktop" /v WallpaperStyle /f
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:2580
          • C:\Windows\system32\reg.exe
            reg delete "HKCU\Conttol Panel\Desktop" /v WallpaperStyle /f
            4⤵
              PID:1968
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c cmd.exe /c reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\ActiveDesktop" /v NoChangingWallPaper /t REG_SZ /d 1 /f
          2⤵
          • Suspicious use of WriteProcessMemory
          PID:2716
          • C:\Windows\system32\cmd.exe
            cmd.exe /c reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\ActiveDesktop" /v NoChangingWallPaper /t REG_SZ /d 1 /f
            3⤵
            • Suspicious use of WriteProcessMemory
            PID:2724
            • C:\Windows\system32\reg.exe
              reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\ActiveDesktop" /v NoChangingWallPaper /t REG_SZ /d 1 /f
              4⤵
                PID:2600
          • C:\Windows\system32\cmd.exe
            C:\Windows\system32\cmd.exe /c cmd.exe /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\ActiveDesktop" /v NoChangingWallPaper /t REG_SZ /d 1 /f
            2⤵
            • Suspicious use of WriteProcessMemory
            PID:2828
            • C:\Windows\system32\cmd.exe
              cmd.exe /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\ActiveDesktop" /v NoChangingWallPaper /t REG_SZ /d 1 /f
              3⤵
              • Suspicious use of WriteProcessMemory
              PID:1328
              • C:\Windows\system32\reg.exe
                reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\ActiveDesktop" /v NoChangingWallPaper /t REG_SZ /d 1 /f
                4⤵
                  PID:2556
            • C:\Windows\system32\cmd.exe
              C:\Windows\system32\cmd.exe /c cmd.exe /c reg add "HKCU\Control Panel\Desktop" /v Wallpaper /t REG_SZ /d "C:\Users\Public\bg.jpg" /f
              2⤵
              • Suspicious use of WriteProcessMemory
              PID:2564
              • C:\Windows\system32\cmd.exe
                cmd.exe /c reg add "HKCU\Control Panel\Desktop" /v Wallpaper /t REG_SZ /d "C:\Users\Public\bg.jpg" /f
                3⤵
                • Suspicious use of WriteProcessMemory
                PID:2572
                • C:\Windows\system32\reg.exe
                  reg add "HKCU\Control Panel\Desktop" /v Wallpaper /t REG_SZ /d "C:\Users\Public\bg.jpg" /f
                  4⤵
                  • Sets desktop wallpaper using registry
                  PID:2584
            • C:\Windows\system32\cmd.exe
              C:\Windows\system32\cmd.exe /c cmd.exe /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v Wallpaper /t REG_SZ /d "C:\Users\Public\bg.jpg" /f
              2⤵
              • Suspicious use of WriteProcessMemory
              PID:2624
              • C:\Windows\system32\cmd.exe
                cmd.exe /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v Wallpaper /t REG_SZ /d "C:\Users\Public\bg.jpg" /f
                3⤵
                • Suspicious use of WriteProcessMemory
                PID:2672
                • C:\Windows\system32\reg.exe
                  reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v Wallpaper /t REG_SZ /d "C:\Users\Public\bg.jpg" /f
                  4⤵
                    PID:2036
              • C:\Windows\system32\cmd.exe
                C:\Windows\system32\cmd.exe /c cmd.exe /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v WallpaperStyle /t REG_SZ /d 2 /f
                2⤵
                • Suspicious use of WriteProcessMemory
                PID:3052
                • C:\Windows\system32\cmd.exe
                  cmd.exe /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v WallpaperStyle /t REG_SZ /d 2 /f
                  3⤵
                  • Suspicious use of WriteProcessMemory
                  PID:3056
                  • C:\Windows\system32\reg.exe
                    reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v WallpaperStyle /t REG_SZ /d 2 /f
                    4⤵
                      PID:2368
                • C:\Windows\system32\cmd.exe
                  C:\Windows\system32\cmd.exe /c cmd.exe /c reg add "HKCU\Control Panel\Desktop" /v WallpaperStyle /t REG_SZ /d 2 /f
                  2⤵
                    PID:1932
                    • C:\Windows\system32\cmd.exe
                      cmd.exe /c reg add "HKCU\Control Panel\Desktop" /v WallpaperStyle /t REG_SZ /d 2 /f
                      3⤵
                        PID:3068
                        • C:\Windows\system32\reg.exe
                          reg add "HKCU\Control Panel\Desktop" /v WallpaperStyle /t REG_SZ /d 2 /f
                          4⤵
                            PID:1476
                      • C:\Windows\system32\cmd.exe
                        C:\Windows\system32\cmd.exe /c rundll32.exe user32.dll,UpdatePerUserSystemParameters
                        2⤵
                          PID:1584
                          • C:\Windows\system32\rundll32.exe
                            rundll32.exe user32.dll,UpdatePerUserSystemParameters
                            3⤵
                              PID:2296
                          • C:\Windows\system32\cmd.exe
                            C:\Windows\system32\cmd.exe /c cmd.exe /c start powershell.exe -WindowStyle Hidden -Command Sleep -Milliseconds 500; Remove-Item -Force -Path "C:\Users\Admin\AppData\Local\Temp\C:\Users\Admin\AppData\Local\Temp\9097ab2b2b71f3ea0cf8c9271224b6227e9aa2545ae23d4621f122bdb99c77b8.exe" -ErrorAction SilentlyContinue;
                            2⤵
                            • Hide Artifacts: Hidden Window
                            • Hide Artifacts: Ignore Process Interrupts
                            PID:1796
                            • C:\Windows\system32\cmd.exe
                              cmd.exe /c start powershell.exe -WindowStyle Hidden -Command Sleep -Milliseconds 500; Remove-Item -Force -Path "C:\Users\Admin\AppData\Local\Temp\C:\Users\Admin\AppData\Local\Temp\9097ab2b2b71f3ea0cf8c9271224b6227e9aa2545ae23d4621f122bdb99c77b8.exe" -ErrorAction SilentlyContinue;
                              3⤵
                              • Hide Artifacts: Hidden Window
                              • Hide Artifacts: Ignore Process Interrupts
                              PID:2740
                              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                powershell.exe -WindowStyle Hidden -Command Sleep -Milliseconds 500; Remove-Item -Force -Path "C:\Users\Admin\AppData\Local\Temp\C:\Users\Admin\AppData\Local\Temp\9097ab2b2b71f3ea0cf8c9271224b6227e9aa2545ae23d4621f122bdb99c77b8.exe" -ErrorAction SilentlyContinue;
                                4⤵
                                • Command and Scripting Interpreter: PowerShell
                                • Suspicious behavior: EnumeratesProcesses
                                • Suspicious use of AdjustPrivilegeToken
                                PID:2908

                        Network

                        MITRE ATT&CK Enterprise v15

                        Replay Monitor

                        Loading Replay Monitor...

                        Downloads

                        • memory/2264-717-0x0000000000400000-0x0000000000522000-memory.dmp

                          Filesize

                          1.1MB

                        • memory/2264-718-0x0000000000400000-0x0000000000522000-memory.dmp

                          Filesize

                          1.1MB

                        • memory/2264-719-0x0000000000400000-0x0000000000522000-memory.dmp

                          Filesize

                          1.1MB

                        • memory/2908-724-0x000000001B5D0000-0x000000001B8B2000-memory.dmp

                          Filesize

                          2.9MB

                        • memory/2908-725-0x0000000001DF0000-0x0000000001DF8000-memory.dmp

                          Filesize

                          32KB