Overview

overview

10

Static

static

3

2024-10-19...ry.exe

windows7-x64

10

2024-10-19...ry.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    117s
  • max time network
    119s
  • platform
    windows7_x64
  • resource
    win7-20240708-en
  • resource tags

    arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
  • submitted
    19-10-2024 09:58

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    2024-10-19_8f95d249a8940a86f0518d676cfc3096_derusbi_lockbit_wannacry.exe

  • Size

    4.5MB

  • MD5

    8f95d249a8940a86f0518d676cfc3096

  • SHA1

    ac3c91f89d4fca14410e24bd348ced70891b543a

  • SHA256

    d0b41ed9435129ccdf1bf7ca87fa4b33649b5b924d8cdbc12966d33fb7b9b873

  • SHA512

    21e8fe5d0f2e2e9ea36a7ea5fc0230a9ac3657528f93ad9b83ef9895fccf2563ecc8f6115a625c60ca8581e6bc043a3a6560a50d650476676bf8c391975e1a82

  • SSDEEP

    24576:HgIWd8sPeH6qAoIqEU502aM56PemUnJNhxtP+AmUmey2s73tOOu55E9QiwzTUBUD:id8gez+AmUvy2s7s5e9QiE

Score
10/10
ffdroiderjupytermazebackdoordiscoveryevasionransomwarespywarestealertrojan

Malware Config

Signatures

  • FFDroider

    Stealer targeting social media platform users first seen in April 2022.

    stealerffdroider
  • Jupyter, SolarMarker

    Jupyter is a backdoor and infostealer first seen in mid 2020.

    backdoortrojanstealerjupyter
  • Maze

    Ransomware family also known as ChaCha.

    trojanransomwaremaze
  • Modifies security service 2 TTPs 1 IoCs
    evasion
  • Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
    evasion
  • UAC bypass 3 TTPs 4 IoCs
    evasiontrojan
  • Windows security bypass 2 TTPs 1 IoCs
    evasiontrojan
  • Disables RegEdit via registry modification 2 IoCs
    evasion
  • Disables Task Manager via registry modification
    evasion
  • Drops file in Drivers directory 6 IoCs
  • Identifies Wine through registry keys 2 TTPs 3 IoCs

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion
  • Reads ssh keys stored on the system 2 TTPs

    Tries to access SSH used by SSH programs.

    spywarestealer
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Windows security modification 2 TTPs 3 IoCs
    evasiontrojan
  • Checks for any installed AV software in registry 1 TTPs 5 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Checks whether UAC is enabled 1 TTPs 1 IoCs
    evasiontrojan
  • Checks system information in the registry 2 TTPs 2 IoCs

    System information is often read in order to detect sandboxing environments.

  • Drops file in System32 directory 64 IoCs
  • Drops file in Program Files directory 20 IoCs
  • Drops file in Windows directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Enumerates system info in registry 2 TTPs 4 IoCs
  • Modifies Internet Explorer settings 1 TTPs 2 IoCs
    adwarespyware
  • Modifies registry class 10 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • System policy modification 1 TTPs 15 IoCs
    evasion

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-10-19_8f95d249a8940a86f0518d676cfc3096_derusbi_lockbit_wannacry.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-10-19_8f95d249a8940a86f0518d676cfc3096_derusbi_lockbit_wannacry.exe"
    1⤵
    • Modifies security service
    • Modifies visibility of file extensions in Explorer
    • UAC bypass
    • Windows security bypass
    • Disables RegEdit via registry modification
    • Drops file in Drivers directory
    • Identifies Wine through registry keys
    • Windows security modification
    • Checks for any installed AV software in registry
    • Checks whether UAC is enabled
    • Checks system information in the registry
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Enumerates system info in registry
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    • System policy modification
    PID:2660

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

1
T1543

Windows Service

1
T1543.003

Privilege Escalation

Abuse Elevation Control Mechanism

1
T1548

Bypass User Account Control

1
T1548.002

Create or Modify System Process

1
T1543

Windows Service

1
T1543.003

Defense Evasion

Abuse Elevation Control Mechanism

1
T1548

Bypass User Account Control

1
T1548.002

Hide Artifacts

1
T1564

Hidden Files and Directories

1
T1564.001

Impair Defenses

3
T1562

Disable or Modify Tools

3
T1562.001

Modify Registry

7
T1112

Virtualization/Sandbox Evasion

1
T1497

Credential Access

Credentials from Password Stores

1
T1555

Credentials from Web Browsers

1
T1555.003

Unsecured Credentials

2
T1552

Credentials In Files

2
T1552.001

Discovery

Query Registry

4
T1012

Software Discovery

1
T1518

Security Software Discovery

1
T1518.001

System Information Discovery

3
T1082

System Location Discovery

1
T1614

System Language Discovery

1
T1614.001

Virtualization/Sandbox Evasion

1
T1497

Lateral Movement

Collection

Data from Local System

2
T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\EXTROYAN\Windows\ADMIN\Tertm
    Filesize

    372B

    MD5

    2dd171b723aa14cf2d4f34a721cdd937

    SHA1

    d9b5bd27f31936af66f8f6c409cc35d4c2e57595

    SHA256

    f11b9ee92c06cc3a6d5c45cf58aca74741d5a2c47f69d4f2ad3bb214391b1228

    SHA512

    cd08bea0ee2126808090dc84e169ea906b2ae3ffbfc2b6b058962f6d989cd87804854b9ea6f729e0287ed7ccf134174318ee2232e6891a8d2cfe218a3f06e4b8

    Download Submit

  • C:\EXTROYAN\Windows\ADMIN\Tertm
    Filesize

    384B

    MD5

    5ba9bedb850ad158eaca84fba0c221fe

    SHA1

    40ad2d1a813ecc31edb6b182d00598224ca8af42

    SHA256

    778207013ce7eedbe5b370c5f6f1669d995b301fb4f16f046d976f1605836f23

    SHA512

    51175e3acb719c6bb8bee3e9ba58f6cc605f43f70e77771812d46070bd71adc1ed57db7dc91f172bcb2cb2051e521ba02496f7f4934c807ee1d93403ce5bc4f9

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\Timetest
    Filesize

    22KB

    MD5

    1dae7803a8feac44a8d4bc5e9ae971a4

    SHA1

    98cc6313c55bef5ed246939581622741cd95ffcb

    SHA256

    6e9d13f660180734199c70644ca9d98613b61bed51a598fb0c3a506c76896ddd

    SHA512

    3352a21e63b23670a0100f6be5de60c6e50158b0d7471b29a42c55728a34ec8f61f6609c3c0dcc5153a13f4d05c8ed840222069dca0af22ef31ce3af68036413

    Download Submit

  • C:\targets.xls
    Filesize

    20B

    MD5

    dc1187cdd2ecc593e027d5e0a22e3136

    SHA1

    a7b53cc8bd6a1e2cdd2c50edaece16eccd45c15e

    SHA256

    a9b7de9a4a699b745d4ac014f7f6bbe3c84cdc89834caf630a7509d3754e6f1f

    SHA512

    5ee7e518796d4b5c34af36cbf64be6c27807d27e3a5cc8a0068ac7338108cde2460bb4d8db4c7a096129d3145a3a05bc9d06bf7b90ebe50154f1e3bcfbc5195b

    Download Submit