Analysis
-
max time kernel
120s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
29-10-2024 04:56
Behavioral task
behavioral1
Sample
Loader 3.0.exe
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral2
Sample
Loader 3.0.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
General
-
Target
Loader 3.0.exe
-
Size
147KB
-
MD5
ff4cd364323fc2048c35783a38070aef
-
SHA1
4736172dd07a3a196343b94dd56b4e4edc0f2bce
-
SHA256
6dd7522accb6773bade16720b53ca577574defae5b1c7caf4b7fc6826dfed7e7
-
SHA512
c72b07b78ccbcfad14fa9f7bc3e8a086c29969b4f7f30dbe57a1a173cd82d61a20bf5ead0bc7b627d5d7f7f0def71710e2ce09590be7a886ad6c9414981eb961
-
SSDEEP
1536:FzICS4AAwczUUf8y8gvMH+1zGSNAojMP95D1xDEtDyI4njdbJBGCkmsQwvB6jr4j:GqJogYkcSNm9V7Dk4F91qYUrnbT
Malware Config
Signatures
-
Renames multiple (332) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Deletes itself 1 IoCs
pid Process 1800 602A.tmp -
Executes dropped EXE 1 IoCs
pid Process 1800 602A.tmp -
Loads dropped DLL 1 IoCs
pid Process 1204 Loader 3.0.exe -
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops desktop.ini file(s) 2 IoCs
description ioc Process File opened for modification C:\$Recycle.Bin\S-1-5-21-3063565911-2056067323-3330884624-1000\desktop.ini Loader 3.0.exe File opened for modification F:\$RECYCLE.BIN\S-1-5-21-3063565911-2056067323-3330884624-1000\desktop.ini Loader 3.0.exe -
Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
-
Sets desktop wallpaper using registry 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Control Panel\Desktop\Wallpaper = "C:\\ProgramData\\Jw5Jgl9mC.bmp" Loader 3.0.exe Set value (str) \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Control Panel\Desktop\WallPaper = "C:\\ProgramData\\Jw5Jgl9mC.bmp" Loader 3.0.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
pid Process 1800 602A.tmp -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 602A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Loader 3.0.exe -
Modifies Control Panel 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Control Panel\Desktop Loader 3.0.exe Set value (str) \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Control Panel\Desktop\WallpaperStyle = "10" Loader 3.0.exe -
Modifies registry class 5 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.Jw5Jgl9mC\ = "Jw5Jgl9mC" Loader 3.0.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Jw5Jgl9mC\DefaultIcon Loader 3.0.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Jw5Jgl9mC Loader 3.0.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Jw5Jgl9mC\DefaultIcon\ = "C:\\ProgramData\\Jw5Jgl9mC.ico" Loader 3.0.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.Jw5Jgl9mC Loader 3.0.exe -
Suspicious behavior: EnumeratesProcesses 14 IoCs
pid Process 1204 Loader 3.0.exe 1204 Loader 3.0.exe 1204 Loader 3.0.exe 1204 Loader 3.0.exe 1204 Loader 3.0.exe 1204 Loader 3.0.exe 1204 Loader 3.0.exe 1204 Loader 3.0.exe 1204 Loader 3.0.exe 1204 Loader 3.0.exe 1204 Loader 3.0.exe 1204 Loader 3.0.exe 1204 Loader 3.0.exe 1204 Loader 3.0.exe -
Suspicious behavior: RenamesItself 26 IoCs
pid Process 1800 602A.tmp 1800 602A.tmp 1800 602A.tmp 1800 602A.tmp 1800 602A.tmp 1800 602A.tmp 1800 602A.tmp 1800 602A.tmp 1800 602A.tmp 1800 602A.tmp 1800 602A.tmp 1800 602A.tmp 1800 602A.tmp 1800 602A.tmp 1800 602A.tmp 1800 602A.tmp 1800 602A.tmp 1800 602A.tmp 1800 602A.tmp 1800 602A.tmp 1800 602A.tmp 1800 602A.tmp 1800 602A.tmp 1800 602A.tmp 1800 602A.tmp 1800 602A.tmp -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeAssignPrimaryTokenPrivilege 1204 Loader 3.0.exe Token: SeBackupPrivilege 1204 Loader 3.0.exe Token: SeDebugPrivilege 1204 Loader 3.0.exe Token: 36 1204 Loader 3.0.exe Token: SeImpersonatePrivilege 1204 Loader 3.0.exe Token: SeIncBasePriorityPrivilege 1204 Loader 3.0.exe Token: SeIncreaseQuotaPrivilege 1204 Loader 3.0.exe Token: 33 1204 Loader 3.0.exe Token: SeManageVolumePrivilege 1204 Loader 3.0.exe Token: SeProfSingleProcessPrivilege 1204 Loader 3.0.exe Token: SeRestorePrivilege 1204 Loader 3.0.exe Token: SeSecurityPrivilege 1204 Loader 3.0.exe Token: SeSystemProfilePrivilege 1204 Loader 3.0.exe Token: SeTakeOwnershipPrivilege 1204 Loader 3.0.exe Token: SeShutdownPrivilege 1204 Loader 3.0.exe Token: SeDebugPrivilege 1204 Loader 3.0.exe Token: SeBackupPrivilege 1204 Loader 3.0.exe Token: SeBackupPrivilege 1204 Loader 3.0.exe Token: SeSecurityPrivilege 1204 Loader 3.0.exe Token: SeSecurityPrivilege 1204 Loader 3.0.exe Token: SeBackupPrivilege 1204 Loader 3.0.exe Token: SeBackupPrivilege 1204 Loader 3.0.exe Token: SeSecurityPrivilege 1204 Loader 3.0.exe Token: SeSecurityPrivilege 1204 Loader 3.0.exe Token: SeBackupPrivilege 1204 Loader 3.0.exe Token: SeBackupPrivilege 1204 Loader 3.0.exe Token: SeSecurityPrivilege 1204 Loader 3.0.exe Token: SeSecurityPrivilege 1204 Loader 3.0.exe Token: SeBackupPrivilege 1204 Loader 3.0.exe Token: SeBackupPrivilege 1204 Loader 3.0.exe Token: SeSecurityPrivilege 1204 Loader 3.0.exe Token: SeSecurityPrivilege 1204 Loader 3.0.exe Token: SeBackupPrivilege 1204 Loader 3.0.exe Token: SeBackupPrivilege 1204 Loader 3.0.exe Token: SeSecurityPrivilege 1204 Loader 3.0.exe Token: SeSecurityPrivilege 1204 Loader 3.0.exe Token: SeBackupPrivilege 1204 Loader 3.0.exe Token: SeBackupPrivilege 1204 Loader 3.0.exe Token: SeSecurityPrivilege 1204 Loader 3.0.exe Token: SeSecurityPrivilege 1204 Loader 3.0.exe Token: SeBackupPrivilege 1204 Loader 3.0.exe Token: SeBackupPrivilege 1204 Loader 3.0.exe Token: SeSecurityPrivilege 1204 Loader 3.0.exe Token: SeSecurityPrivilege 1204 Loader 3.0.exe Token: SeBackupPrivilege 1204 Loader 3.0.exe Token: SeBackupPrivilege 1204 Loader 3.0.exe Token: SeSecurityPrivilege 1204 Loader 3.0.exe Token: SeSecurityPrivilege 1204 Loader 3.0.exe Token: SeBackupPrivilege 1204 Loader 3.0.exe Token: SeBackupPrivilege 1204 Loader 3.0.exe Token: SeSecurityPrivilege 1204 Loader 3.0.exe Token: SeSecurityPrivilege 1204 Loader 3.0.exe Token: SeBackupPrivilege 1204 Loader 3.0.exe Token: SeBackupPrivilege 1204 Loader 3.0.exe Token: SeSecurityPrivilege 1204 Loader 3.0.exe Token: SeSecurityPrivilege 1204 Loader 3.0.exe Token: SeBackupPrivilege 1204 Loader 3.0.exe Token: SeBackupPrivilege 1204 Loader 3.0.exe Token: SeSecurityPrivilege 1204 Loader 3.0.exe Token: SeSecurityPrivilege 1204 Loader 3.0.exe Token: SeBackupPrivilege 1204 Loader 3.0.exe Token: SeBackupPrivilege 1204 Loader 3.0.exe Token: SeSecurityPrivilege 1204 Loader 3.0.exe Token: SeSecurityPrivilege 1204 Loader 3.0.exe -
Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 1204 wrote to memory of 1800 1204 Loader 3.0.exe 32 PID 1204 wrote to memory of 1800 1204 Loader 3.0.exe 32 PID 1204 wrote to memory of 1800 1204 Loader 3.0.exe 32 PID 1204 wrote to memory of 1800 1204 Loader 3.0.exe 32 PID 1204 wrote to memory of 1800 1204 Loader 3.0.exe 32 PID 1800 wrote to memory of 1600 1800 602A.tmp 33 PID 1800 wrote to memory of 1600 1800 602A.tmp 33 PID 1800 wrote to memory of 1600 1800 602A.tmp 33 PID 1800 wrote to memory of 1600 1800 602A.tmp 33
Processes
-
C:\Users\Admin\AppData\Local\Temp\Loader 3.0.exe"C:\Users\Admin\AppData\Local\Temp\Loader 3.0.exe"1⤵
- Loads dropped DLL
- Drops desktop.ini file(s)
- Sets desktop wallpaper using registry
- System Location Discovery: System Language Discovery
- Modifies Control Panel
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1204 -
C:\ProgramData\602A.tmp"C:\ProgramData\602A.tmp"2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:1800 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C DEL /F /Q C:\PROGRA~3\602A.tmp >> NUL3⤵
- System Location Discovery: System Language Discovery
PID:1600
-
-
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x14c1⤵PID:860
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
129B
MD5e2a7530362fbb20a37045fd2a0fb0722
SHA14b9fc157272b8098a84fb5139c9ca4ad7b961e56
SHA256022cc1c123a6f60b7f8093586caed599f790d7e7c332b933b9afb23c4d7e8f93
SHA51265d90862d119c62e2d978e6e13b486c30243cac37267097a70446c036c50492da72b5cbda009993ad9458c502621bcffc366fe7db5f9530753396bd1999d280b
-
Filesize
1KB
MD58b28296a2c168d86adbafc888d0f95f0
SHA149d6b109bf24f39c2c0f62c0796b8693c0bd99e5
SHA2567b3daacf846fe79840647e67d9c5226a7fda47d5b32c24d874654e8ff78ffcc9
SHA512b0f0e0a6f2962250c3b9f87637854756e7a0fcde561aae14654d0dcd1e1013876442c0354e41c5bc8e3ef57f170ac2073874ff22fdc5656f62f930350f9df6ac
-
Filesize
147KB
MD579a5837c047212dadc7fe19bc7dce967
SHA1ec707d83066b05eac581ef5f5fe4d368dfdc0055
SHA256c41d3d8d300223a2e1e18fc96b4897b1b4ecb7bebd97c6f20678b45fe2d32c22
SHA512e001466c7225e028ee0a7fbf702554c5eb2c512c001dd5e7e469c29b0bc8dc7e1926d3bd5e89c4889090d93692bf50a0f233f5b755f5c5d927d1b010f1c5f0ab
-
Filesize
129B
MD5d303aa6eaa284e63a5718ea33a14c195
SHA151051b2f580ee6edbd806bbfd76ce9aba660871a
SHA25619fc36f4e9fbc13c174828ef268e43fcb6e5b137d68070c5026146a8e7f6afdb
SHA5128a731225726017c078fa19d16bea18011543de57faff6f6752f1e4401b39593a361f180ce55c49d319beea4f2519c387f00c39f0d976a1d5c6eb4561481f47ac
-
Filesize
14KB
MD5294e9f64cb1642dd89229fff0592856b
SHA197b148c27f3da29ba7b18d6aee8a0db9102f47c9
SHA256917e115cc403e29b4388e0d175cbfac3e7e40ca1742299fbdb353847db2de7c2
SHA512b87d531890bf1577b9b4af41dddb2cdbbfa164cf197bd5987df3a3075983645a3acba443e289b7bfd338422978a104f55298fbfe346872de0895bde44adc89cf