Analysis

  • max time kernel
    150s
  • max time network
    124s
  • platform
    windows7_x64
  • resource
    win7-20240729-en
  • resource tags

    arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
  • submitted
    05/11/2024, 12:23

General

  • Target

    Ransomware Cyb3r Byt3s.exe

  • Size

    735KB

  • MD5

    535bc51f49d1106cf06dfe92ad0444b5

  • SHA1

    c2260418363cd0b0d099059e4dde4f2ae61da745

  • SHA256

    a834b3d15719bbf9f0c7b5740b8a30de2eb3aee9e24598b3a30e37253e0c154e

  • SHA512

    17b6c3bdba740d16e96f2212b9d4b7d82ec4ac94cc24eedaf00b30c556473bf6c11d8d1bbdfe98823685b9d0342bf21fb4f4a9db585d60686dbb60b2e7772de2

  • SSDEEP

    12288:U3aga2H7TvoQgRFlyt0CLPj3fNFLk6TNcLhytKdGWXQikDhPKOPY6cUe3XQ2fwCB:zU7Glyt7LvNFLkgNcLhYChkDhPPY6cU2

Malware Config

Signatures

  • Credentials from Password Stores: Windows Credential Manager 1 TTPs

    Suspicious access to Credentials History.

  • Drops startup file 6 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Drops desktop.ini file(s) 64 IoCs
  • Enumerates connected drives 3 TTPs 23 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Sets desktop wallpaper using registry 2 TTPs 1 IoCs
  • UPX packed file 2 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

Processes

  • C:\Users\Admin\AppData\Local\Temp\Ransomware Cyb3r Byt3s.exe
    "C:\Users\Admin\AppData\Local\Temp\Ransomware Cyb3r Byt3s.exe"
    1⤵
    • Drops startup file
    • Drops desktop.ini file(s)
    • Enumerates connected drives
    • Sets desktop wallpaper using registry
    • System Location Discovery: System Language Discovery
    PID:2640

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\ProgramData\Microsoft\Assistance\Client\1.0\ja-JP\Help_MValidator.Lck.cvenc

          Filesize

          1KB

          MD5

          3e17ae7a36157cf7158c99cd115c3994

          SHA1

          52b9c067aad28210b9fb8c40abeb277dc7edc6b6

          SHA256

          59f23ce58630c59f6d074d7331137717ad70820c936075739970303b0e94733f

          SHA512

          2410b6dc1a6f15c1f12f601f0836134f3ec5bf3007a763f496ce31a7b19b298ed783ab18fbdec93ea85839de8367f0fb42af7d5630ebfa30f98b1e8fc098d59e

        • C:\ProgramData\Package Cache\{7DAD0258-515C-3DD4-8964-BD714199E0F7}v12.0.40660\packages\vcRuntimeAdditional_x86\vc_runtimeAdditional_x86.msi.cvenc

          Filesize

          141KB

          MD5

          50aa93ab215fa426d6720114a41a2f28

          SHA1

          e4af363a7289d4cafe0dd76d93d9025dd337b2c4

          SHA256

          8b86ea82362464768431dddb427fac824d11f496e90354dae0ae6a01db39a4b1

          SHA512

          13bc31940a592b29b41da690b6e97bc6f4262abba3d59735db07a142178b733d744105c0a2b01a23cfe2fe1d714c8b520f26433073d2f2fae2991863d2b54461

        • C:\ProgramData\Package Cache\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\packages\vcRuntimeMinimum_amd64\vc_runtimeMinimum_x64.msi.cvenc

          Filesize

          149KB

          MD5

          525c26f39412bdc28c0a4595ebdd7ef8

          SHA1

          221e4c94e4ba6d579d9d7cd22a4d65869d9fd35b

          SHA256

          9f9b021ad6f2ab61ffb41591fc17c630b1f73a44047a21f2d249fd7d5af68ed2

          SHA512

          3c19a578d89f9850c351668d1f311b90bc911da1356c547a6e08dc5c55c01de4d5cfcf557a2eab5ea043d83766d30f5e0776bb331bd7b35e18c1b066cfab8a2f

        • C:\Users\Admin\AppData\Local\Adobe\Acrobat\CyberVolk_ReadMe.txt

          Filesize

          291B

          MD5

          0fc56ffcd80bb3b9c72eeeb99d089d76

          SHA1

          993b8d70a51222c52893b3a9697f1a877d604b83

          SHA256

          9a0b5fa8fbbe92d4e39244664eedccd3f64b5567eff3fbd0718d6ea207362b97

          SHA512

          f6e6a788dc0f98c609cc441c36449fbb777d3f161ac904897744a6da062ad67f616d92d98efcddde7a02c7928fe4f04495956d099dff729626cca7487fe2a469

        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB\CURRENT.cvenc

          Filesize

          1KB

          MD5

          ff4ac919f22dd048e15c413e5f40d917

          SHA1

          04c47526cd248f68346c4051ecf38de6ac2f25f9

          SHA256

          15d43a835faff24585d4936d2f22cc7d93517ff9430f9d8341d6331b4a911b00

          SHA512

          4b9e2fb8a9a08c6149d993a2b86b8501289a98e61439b67a4d6b6ee659d7f65974ffe95de30785d71242bce83304297a05cbf6261f4f2f8fb6c528b79890eaf4

        • C:\Users\Admin\AppData\Local\Microsoft\Feeds\Microsoft Feeds~\MSNBC News~.feed-ms.cvenc

          Filesize

          29KB

          MD5

          e97af960bd45916f7691f92c7bb2f59c

          SHA1

          a077f3ff4402842e7f6dc7ce85cf2baf931bf898

          SHA256

          1049b201dfdbceef2400aa20b7ee9f7b84b9586f2fdd0e3172d82e961e17b827

          SHA512

          91c0ac2133daa8d9db2c360db47a5f95150b10730527b70c77e1cadef0ce79ac018f5c678214e00695e74025b2d0e76abd12e9bcaf6357e857668f49e8f39081

        • C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\FXDUII3O\desktop.ini.cvenc

          Filesize

          1KB

          MD5

          5d6aad502b6c45366df5ff0c5a8259a0

          SHA1

          78ee2e5803d75d34c85b29a9e8e7b050251a0821

          SHA256

          69fbb37508040ec15911379eecdd25e3abccd00c4874e8432526d920fc945707

          SHA512

          0caee26298b30c3fb3e09ea376adaf4a27b47a685497551c855bcc9d09ae5de0ac6e701dd704c6dc582fa3d68f73c4a744f648b84912deff6b8f185de02c5057

        • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n3lsnn48.default-release\storage\permanent\chrome\idb\3561288849sdhlie.sqlite.cvenc

          Filesize

          49KB

          MD5

          1070e346072e3385c746ada030a5cc8b

          SHA1

          ecd7f4f94a2899201487ec0dd65f5bbc98e7595e

          SHA256

          91450c3cbf5fa7ade212bdf33ba7ba4699f575750bfefd007971abb919826d34

          SHA512

          94f152f4bb17ff88a32425f299042dd695a87865a9cad6b76de81d63837a962c77ce6355bd544af8f7c5f21e5fc9659bbe0fe06a5d467e154cd046f936b19bee

        • memory/2640-0-0x0000000000400000-0x00000000008A4000-memory.dmp

          Filesize

          4.6MB

        • memory/2640-596-0x0000000000400000-0x00000000008A4000-memory.dmp

          Filesize

          4.6MB