Analysis

  • max time kernel
    150s
  • max time network
    152s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    05/11/2024, 12:23

General

  • Target

    Ransomware Cyb3r Byt3s.exe

  • Size

    735KB

  • MD5

    535bc51f49d1106cf06dfe92ad0444b5

  • SHA1

    c2260418363cd0b0d099059e4dde4f2ae61da745

  • SHA256

    a834b3d15719bbf9f0c7b5740b8a30de2eb3aee9e24598b3a30e37253e0c154e

  • SHA512

    17b6c3bdba740d16e96f2212b9d4b7d82ec4ac94cc24eedaf00b30c556473bf6c11d8d1bbdfe98823685b9d0342bf21fb4f4a9db585d60686dbb60b2e7772de2

  • SSDEEP

    12288:U3aga2H7TvoQgRFlyt0CLPj3fNFLk6TNcLhytKdGWXQikDhPKOPY6cUe3XQ2fwCB:zU7Glyt7LvNFLkgNcLhYChkDhPPY6cU2

Malware Config

Signatures

  • Credentials from Password Stores: Windows Credential Manager 1 TTPs

    Suspicious access to Credentials History.

  • Drops startup file 4 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Drops desktop.ini file(s) 64 IoCs
  • Enumerates connected drives 3 TTPs 23 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Sets desktop wallpaper using registry 2 TTPs 1 IoCs
  • UPX packed file 2 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

Processes

  • C:\Users\Admin\AppData\Local\Temp\Ransomware Cyb3r Byt3s.exe
    "C:\Users\Admin\AppData\Local\Temp\Ransomware Cyb3r Byt3s.exe"
    1⤵
    • Drops startup file
    • Drops desktop.ini file(s)
    • Enumerates connected drives
    • Sets desktop wallpaper using registry
    • System Location Discovery: System Language Discovery
    PID:1888

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\ProgramData\Package Cache\{CB0836EC-B072-368D-82B2-D3470BF95707}v12.0.40660\packages\vcRuntimeMinimum_amd64\vc_runtimeMinimum_x64.msi.cvenc

          Filesize

          141KB

          MD5

          b8a0c4f9a943ea26f14e68ce4aee0a59

          SHA1

          756b13d2a804046981d139bed9d2b703f98b98e0

          SHA256

          6d599cb583bc879258bb4b796d4d489882a2a8f17cd025b8c438ddf3a3530164

          SHA512

          a1cf6db8d477fa863759953f6d2ab27a19366e0872fa7544ad8f347f3b3bff4550654973dbca01f0164b29792e26e6a17b2d877469bf57888bd3907d6fb8c6a5

        • C:\Users\Admin\AppData\Local\Adobe\Acrobat\DC\Cache\CyberVolk_ReadMe.txt

          Filesize

          291B

          MD5

          0fc56ffcd80bb3b9c72eeeb99d089d76

          SHA1

          993b8d70a51222c52893b3a9697f1a877d604b83

          SHA256

          9a0b5fa8fbbe92d4e39244664eedccd3f64b5567eff3fbd0718d6ea207362b97

          SHA512

          f6e6a788dc0f98c609cc441c36449fbb777d3f161ac904897744a6da062ad67f616d92d98efcddde7a02c7928fe4f04495956d099dff729626cca7487fe2a469

        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\CURRENT.cvenc

          Filesize

          1KB

          MD5

          19a8ab80397d62c49806345dfe68c77e

          SHA1

          1007b54da8c85d696e457333717904fbda6935c9

          SHA256

          d42546eb8cec8223174cd04217ebccf41d5db319ffcefb88267896f15efb3c23

          SHA512

          342ebd7dc86179a8c74a0876d6da19318915e813a66f69b56059b986ba08e70a8692657d187c65f8130084f4c16008df36507b5a226c4c65cb7d3ed18a15e130

        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\MANIFEST-000001.cvenc

          Filesize

          1KB

          MD5

          c81270a824c3d3308aff717555d09697

          SHA1

          ef55d4416b67a2ff4be5d91a691d623f0e68a9ed

          SHA256

          2f73d78234802c7a768f31c7cbdeaccf8a1fcb4023b08841cf6115839af0a1ad

          SHA512

          972d08cfbefc10d7c13b88fdc3f1fac36159d0ecd11c11b9d6c6b2a9960c09fcb52785d7da8b7c574a04a00081022c413c6efedc0f5be2da7376dd546798b280

        • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\Microsoft_Office_msotd_exe_15.cvenc

          Filesize

          37KB

          MD5

          8e5e45951253610c1166cdd52959b99a

          SHA1

          064b8bbfdddb56f7de87d18dd11d6a2035f2d5f7

          SHA256

          f6da823951f54185fc02e6a7d90455dad6ca059c422759fae139d623e909e596

          SHA512

          6887601019a538eb41a576a4306078894117b66aceda53bac0746365630c3c7d32dad27509b26d6efdaa9233499c34eabe45f77ad2bc6cf9aae4532a219aea6d

        • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}_msinfo32_exe.cvenc

          Filesize

          37KB

          MD5

          502124f5cbcc1857364d4d985307181d

          SHA1

          4c7c350bb1c92760e28c0cf58f0dfa8c4dc220f5

          SHA256

          dc8a40b458314d1fd317af20346f455ff226324c893147a85cccac5d66aacbc8

          SHA512

          3153dbd6d04d6d79be9715d44375c1c2d5730c1e4b31fe9e7033a67bbf0d33b5b3c3c34d5148adc20bfcd41b6371b9fab582df8432da98975110a2cf225b65f0

        • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133727658826891613.txt.cvenc

          Filesize

          78KB

          MD5

          c6132e519e163726dbbfda086d031644

          SHA1

          11def520af96c514a297459fda7dfa64606dca21

          SHA256

          101d74c6de8bb512832a62fd782fa53a44a368c7e37c07f10a38308cd6485dd6

          SHA512

          cbc97f391e9a303f68ba92f8f2ae71a248c0d3725590ab0a6008ce8a455e6f32a9fbc87c2257018edddef6b68a5bdb65bfd4c8f89c5504e88af9efd11972b8c8

        • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133727660257997193.txt.cvenc

          Filesize

          48KB

          MD5

          ca40402acb7f01d9d9d6521e150f6dc0

          SHA1

          ad111b047d254f762c6142b1c1ae9511a23a3caf

          SHA256

          b8d2f4a7d68cfbc1b8a3cee44a471671cff0b9577809486333539401d28be1a2

          SHA512

          6930179b3dd1164d1081ea2bed53473d111d8d50aa36567cf41d4214dbf0fc06f0581e5466e3cae683783e3c7e4ec1d1636985f5efca5484d9b6a6d853bbcc96

        • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133727666145703406.txt.cvenc

          Filesize

          66KB

          MD5

          6dc82b1a3ba99df05f10bf1dcd3c15ce

          SHA1

          d9b0ed77a873e946f015b043f3efeb1a15fc6df7

          SHA256

          f0a2bfda46eb97f8da691fc1b09e81ea364d255de37aafa654ee168635ca6e30

          SHA512

          50a6993fe576137a4387ce66692b839931f562c033b822e0a04f421a8fd4e57d42e633fa38ad86f93b53cd7cc08557a984b2dbac025563c6f5950a2376a39f9f

        • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qgf82dd5.default-release\storage\permanent\chrome\idb\3561288849sdhlie.sqlite.cvenc

          Filesize

          49KB

          MD5

          df3cbbe92a7ab2fe237a40afc369d4fc

          SHA1

          a11e49dd31d971ece504f58335567b4fdb2fde64

          SHA256

          271f7ff6e72441deb810a5481d8286a5938c3319c19cf8736ce69b62e6526b03

          SHA512

          855e8da1e75aa02c75cdc7fbea658686a8cf05d9794ca02f45a5d57875d4b58aefd5eddc273f6e3ee679c0a07900a449a5dfcc79396ba0289994874010fd9b9d

        • C:\Users\Admin\AppData\Roaming\time.dat

          Filesize

          5B

          MD5

          06d25652fd4d2f202bff043f7ae5c504

          SHA1

          f5b87f13df16e1681de41f62ae871fa09f31fbb7

          SHA256

          ca1b7797566e850c3e583a2fbda610a51d5504ca9b0d611a0a3e2770c912d52d

          SHA512

          2e163503f90bac259177ef629f0d59ee990d875d39b5556c76acee45ff2050d1f4b14922ebbd475d4cfc8693d2b9515902a2ee44031f2c98b472992c2ccdf2db

        • C:\Users\Admin\AppData\Roaming\time.dat

          Filesize

          5B

          MD5

          7ce5417e80aef872ba20917011e39416

          SHA1

          4ce45e74ef4a8701eaaa4e8fb17bab705ebd772c

          SHA256

          987f32746376de3fa8ff935ec01448a5936c8e222ce383cf89b4dc2ecdc67ea8

          SHA512

          b9926371eb5022b27b43e08bb30040cb4ed8938e0ab7ec0495a9ee176faae0e9ff6f392d801bf6c610080813568810202364100273883e5057c2ab3bd57887ec

        • C:\Users\Admin\AppData\Roaming\time.dat

          Filesize

          5B

          MD5

          7bf023ca6853abd395cab03f83945d24

          SHA1

          d3aa95e00bcefca65d121709dddb12c213b32fc1

          SHA256

          5a703f620dbab029a3ac801c3fc85ef4327a5f0a751b852f650bf14b9b44459b

          SHA512

          653e70bfdb9cb9b69d577710c09032bd2a9658d0e23cba214970232f6a6cc0538b54d0b946c026cf2af87a12672d6d65074d6fc196778aac828ec57f1c88b03a

        • C:\Users\Admin\AppData\Roaming\time.dat

          Filesize

          5B

          MD5

          db9488b8bd624473f2001f5ca6a1551e

          SHA1

          7dc1e1a4c76403b5404918eeca098b12f11f7596

          SHA256

          45c08529fc638c300feeb27a726d997626694ac3793087acc34e51f0a6e170e8

          SHA512

          2d65e85357dc5a292a7969581ca95ad8551b476501b3311065b29fca333addb2f4d5330720de52196bdf7b6d35a8ed562f43c4091eeb783d2b82eb26decfe445

        • C:\Users\Admin\AppData\Roaming\time.dat

          Filesize

          5B

          MD5

          619d6b6bff9a5152560ae73fb2264006

          SHA1

          791d6736d22916e74b5f4c1e486aafb9fccb20be

          SHA256

          5a8bbd7a0887dfcfee9cd1f97e7ba9e568741cb632f3121b5b7d4f3e90e85b79

          SHA512

          d604b2abc14a450ed963ac334eb0d1fd13cc0e4b08a26f1ef4643824e18f3aaef3c60f616fb344a2f3b53ec4097446827d5a9864acc8d12c30016efc0712c6b5

        • C:\Users\Admin\AppData\Roaming\time.dat

          Filesize

          5B

          MD5

          81b69a02d9469be08c2426117991d9f0

          SHA1

          c3ab5823761fe40d6dcd0a01bf4f0a944fa0b628

          SHA256

          d6e1d9c927753981079ade4b46eb23e9179b89e3b13f06f025b3a798d63b6c0f

          SHA512

          3e3f7b87217408d6910deb23acbf0ca9246f7bbd61ec0686b1d12a4e4c66795a89886764df8962ce9e3f5d90347614d7883ea60f314be15e34b292ccf808746b

        • C:\Users\Admin\AppData\Roaming\time.dat

          Filesize

          5B

          MD5

          a52357f1ce8160dee6563b6a3391ffa8

          SHA1

          b73819a7e2227bda306f42ddd029c72406b1f55a

          SHA256

          bfed65e0ee3b331187d31bd503dcbad42f17bf749b37c34f64cf8bbc3007073c

          SHA512

          01d5c13702803762b4e163f6f03c5d5f46b81e4c2badbee0cd2e463f53f26fee98895278061ad078f61e9b28d1057fa3f576c17ec9171ee57a743fcb14fd65db

        • C:\Users\Admin\AppData\Roaming\time.dat

          Filesize

          5B

          MD5

          a0179641d667ce21172c78e960b3a1ef

          SHA1

          4c3d20191d29ddbbcc3c73657ab4c2781f049b98

          SHA256

          4433080be68eabdd338bda9c8c30bee3fc1f696b6212f13bcb77721e1d738c7a

          SHA512

          a9c4d7baed7afe634341b14f6bd9de0751940768c260efb8be75cde6c1507c899da7aa677235363afe972cfcac9626b43d9b0ba142bcccf1c93ebeb8be87006b

        • C:\Users\Admin\AppData\Roaming\time.dat

          Filesize

          5B

          MD5

          9184a041ce18953012722dcfa9052c39

          SHA1

          b66f41c59f284077ff3722b06f0da23661adc6d5

          SHA256

          2beac637f987eff79344e5b9b32dd390cb92b9925dcf0a47b94c436b300efec5

          SHA512

          50b103df02a3a96f9cd01317fd821d2cf7faeb6b3b918ad87c47ae1952ebcea91cda7ea82ec43aabf7703f56baa39ab88fa65c12ceee7926541d2fae87ad1d35

        • C:\Users\Admin\AppData\Roaming\time.dat

          Filesize

          5B

          MD5

          d8ac3b01ba19729174a8f1e63c9e937c

          SHA1

          e40192d86760273f0f1f13bfe0609f2ce38fb56d

          SHA256

          a5f6e28cca214fb60a873fd4b27ea02bbef08b5bde05f4ba831b790a54a2435c

          SHA512

          cea558fdb51a2a7d85758b01c834896f49849cd7b018a5080c6213a60e94e89d70b0d92e466e2844828aa6566115ba6e21a6d69d833186a6699d45dc7bb6c9ca

        • C:\Users\Admin\AppData\Roaming\time.dat

          Filesize

          5B

          MD5

          a25328715ddbaafaf2a70718e94220ac

          SHA1

          33d2f3fdaa0ab606148902ec6ddc94c340393423

          SHA256

          f2b2d2b023f71e791c2644201fa62b2dcf6c78d7402d774a552d5b7b20f02ad3

          SHA512

          13269781e22ef427cddd6aa2813993b044b7061048657c33da449bebdb77f4d23dc4a525c4b024ce9a54ca0d8a2b45c941309c3c90bc90b88406ca6050269254

        • C:\Users\Admin\AppData\Roaming\time.dat

          Filesize

          5B

          MD5

          d450f01b90e9cfa5848596f1e6457c17

          SHA1

          83d1c2d23075b1bd21d8a57d0a9ad7480e7e7234

          SHA256

          78ef135cef6cb29d44b91beb545a2a78dbdbc0a981735bad98640318a1b80b9b

          SHA512

          515ade2b324a6a287157d5b0b0ca075df8edad201ec3d227e0adb4c4fd6c0b4ace77d6963556f19d825670f2c2aac04e36a462873742c5c2413b9892f6aa3aa0

        • C:\Users\Admin\AppData\Roaming\time.dat

          Filesize

          5B

          MD5

          c8997cb7eaa2a24c8344695c19dd1f92

          SHA1

          ebdc14bc4955b5bf54242dbe94b8a68ccad1ce7b

          SHA256

          ac1864880bb4bc57a3c079c00e5c104d68c0cb1164f93abcfdad0059806a3c6d

          SHA512

          17f98596c100a69601bd79799378fb545919ef2dc8ef8a3c5d2220f5b460c215adcb9c676e7e054d0006301fe15f9bbd0a99f714b1dfdb78ad8ebd734da1e5a3

        • C:\Users\Admin\AppData\Roaming\time.dat

          Filesize

          5B

          MD5

          1221132d8390ea66832cf2eabd8eb668

          SHA1

          2e79360c33912d132e7a96d1a9ca018cdf675ca9

          SHA256

          2a50ac545f30b02200c4f18f694ce7e0ce691e9f509c38d8beebf3b4dd046b53

          SHA512

          b15e496fcedc0a6cdba00039fdd241047539de119ea06eea00994450a8325da09318b2c21f5d173484c600c7e301eac43031efdde5485cfdd91b18508acfa800

        • memory/1888-0-0x0000000000400000-0x00000000008A4000-memory.dmp

          Filesize

          4.6MB

        • memory/1888-428-0x0000000000400000-0x00000000008A4000-memory.dmp

          Filesize

          4.6MB