Analysis
-
max time kernel
120s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
-
submitted
05-10-2024 14:52
General
-
Target
Morgan.exe
-
Size
14KB
-
MD5
cd2149ef2f2c9675e75a224c10f60a8e
-
SHA1
a1a962caae493a33f947ff6412d18f864c7fc3fb
-
SHA256
17db6fd9f81222711b1f33983a8f64b8c3bddfc7dc25f4f6b6e0c6c29d877eeb
-
SHA512
0aad285dcf287da822d1e9abdb444a4c353c66f054f5828df8fd4a7ebdc41ab0e269d4171e99cfee6f4857c5859a663c8b5f0345a0395e2ee2b0ee1dbbc965aa
-
SSDEEP
192:hI/3edqmr6APSJg15CHEcWIW2g93EUY68FL8GZDAPIrIvCGmaMiDVQvr:HdPKi15Ck4W2g9UUg8GRXLuMiDVMr
Malware Config
Signatures
-
Renames multiple (281) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Sets desktop wallpaper using registry 2 TTPs 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Opens file in notepad (likely ransom note) 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Morgan.exe"C:\Users\Admin\AppData\Local\Temp\Morgan.exe"1⤵
- Sets desktop wallpaper using registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\README.txt1⤵
- Opens file in notepad (likely ransom note)
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
80B
MD51db915c39f9a66c16647e69ff555c023
SHA1d9997af2b0b84d58d2227a5ed1a5ea6b34e1036c
SHA25690b313a2ba0c7fc95cc2a5d0781c87706beac59e013d22f18e644cfaeb0d3091
SHA512fdd3b5fb9758130f7cf12778a469245afbfdd4f1ac7d4866081f322372db4057b7c13547335644587e2bbaeeebb5c8502881685a1ab0acce08a1f9e150a505af
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b
-
Filesize
16B
MD5ef312cbba158d44652429da990e41410
SHA150fe4c55092e26be5cdc4249821410e2d9fd65be
SHA256d6914f44025bcbf8ece62894a48d57522c56628ae25dcb6feca68f2d5a818299
SHA512a5d647057aa5dfb8bf13d89693f42ddd7f45d226547e69be2e7cd7499fe3355c7b9826016eacb620098ebc7d09316b6fa99cf5ef1ac0e11c57bc1b1bdb13244c
-
Filesize
48KB
MD5ca18d2e0ec6d1a264098e6215a061cee
SHA143e756e791d320b7b3ed9783ef5d84f60d1d3dc5
SHA256cd2f439bb0b1c772ef95fc04c7cc8446bcb03223dc428c21a6b181704385031d
SHA512654f610a90f9fff0e5b29eee2b5ac7b5a021a50ecbcd6ef4f53a2b2471171e663a147c8d046aa57115e74c0c67735b46355495fe10ec1340c88c0288ec5a502e
-
Filesize
79B
MD563a7cf86830caf6bb544798137bb3342
SHA139b91c5a64a64d062f6c9eda594389778338e520
SHA2565c588502f53a49248b66d44d264693227124028a1e40bffa689d1ab0c3624f1d
SHA51260602b0002390adb81eb073899d1fed382ea2019acc819968c672a7c9ddff9bce5c18002e5091f2506d7e7d911fdefc73cb62ddb105bbc4fe5674031c7fd4d80
-
Filesize
4KB
-
Filesize
40KB
-
Filesize
6.9MB
-
Filesize
6.9MB