Analysis
- max time kernel
93s - max time network
94s - platform
windows10-2004_x64 - resource
win10v2004-20241007-en - resource tags
- submitted
10/10/2024, 10:25
General
- Target c80df944d146d2e7b42b0dc4a2a79ddb41e3440216bc6cf795389b41d00842c9.exe
- Size 25KB
- Sample241010-mgdbqszamk
- SHA256 c80df944d146d2e7b42b0dc4a2a79ddb41e3440216bc6cf795389b41d00842c9
Score
10/10
Malware Config
Extracted
Path
-
C:\Users\Admin\Documents\OneNote Notebooks\My Notebook\Readme.txt
Ransom Note
- --- What happened? --- All of your files are encrypted and stolen. Stolen data will be published soon on our tor website. There is no way to recover your data and prevent data leakage without us Decryption is not possible without private key. Don't waste your and our time to recover your files. It is impossible without our help --- How to recover files & prevent leakage? --- To make sure that we REALLY CAN recover your data - we offer FREE DECRYPTION for warranty. We promise that you can recover all your files safely and prevent data leakage. We can do it! --- Contact Us--- (XIXTEXRZ)
Signatures
- Renames multiple (112) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
- Adds Run key to start application 2 TTPs 1 IoCs
- Sets desktop wallpaper using registry 2 TTPs 1 IoCs
- Suspicious behavior: EnumeratesProcesses 50 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\c80df944d146d2e7b42b0dc4a2a79ddb41e3440216bc6cf795389b41d00842c9.exe"C:\Users\Admin\AppData\Local\Temp\c80df944d146d2e7b42b0dc4a2a79ddb41e3440216bc6cf795389b41d00842c9.exe"1⤵
- Adds Run key to start application
- Sets desktop wallpaper using registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
Readme.txt
memory/1332-0-0x00007FF9D97A3000-0x00007FF9D97A5000-memory.dmp
memory/1332-1-0x00000000000C0000-0x00000000000CC000-memory.dmp
memory/1332-63-0x00007FF9D97A0000-0x00007FF9DA261000-memory.dmp
memory/1332-350-0x00007FF9D97A3000-0x00007FF9D97A5000-memory.dmp
memory/1332-351-0x00007FF9D97A0000-0x00007FF9DA261000-memory.dmp