Overview

overview

10

Static

static

7

066d06ca00...81.exe

windows7-x64

10

06d6f22d02...bc.exe

windows7-x64

8

09f1d49065...d1.exe

windows7-x64

10

208cca124d...45.exe

windows7-x64

10

241f67ece2...79.exe

windows7-x64

1

30616f6c48...60.exe

windows7-x64

10

44f28cd6ea...7e.exe

windows7-x64

3

4b190a407b...5f.exe

windows7-x64

10

72ddceebe7...6b.exe

windows7-x64

9

7b53a00b3a...b2.exe

windows7-x64

7

7cf39ebb44...57.exe

windows7-x64

10

8c42a08427...51.exe

windows7-x64

7

9d081b734c...91.exe

windows7-x64

4

b25cc31472...15.exe

windows7-x64

10

b2ec72de35...8f.exe

windows7-x64

6

b4c2ffccfe...dd.exe

windows7-x64

5

bab7af3306...be.exe

windows7-x64

9

c531015ec0...86.exe

windows7-x64

8

dc7ab2e7ed...60.exe

windows7-x64

8

debfd1fb34...d8.exe

windows7-x64

8

df36e2aaae...37.exe

windows7-x64

9

df99316e57...27.exe

windows7-x64

4

e60fc4473a...60.exe

windows7-x64

10

Analysis

  • max time kernel
    1199s
  • max time network
    1206s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    12-11-2024 19:27

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    30616f6c488fa16ccdcbfd6273e7ac8604c82bc1468fc1a70b2a43661b674760.exe

  • Size

    6.8MB

  • MD5

    b5bae1ed2fde118e256ede9d86affe42

  • SHA1

    4870df80763feae4870e674a93515a2635637748

  • SHA256

    30616f6c488fa16ccdcbfd6273e7ac8604c82bc1468fc1a70b2a43661b674760

  • SHA512

    00c871aaf12b9690d99ec2797758e69a7513da378cf6d7a2f7e0d3c2095267b346aee5fd7585121bdd5c3ff112f832d810367788136c5bb68758675c4eec5bfa

  • SSDEEP

    196608:FCwwsESTbwQQ/lAL53VFOT0gLw6GfXduJvNKd:ozsESTbwL/E3VF8kduhNe

Score
10/10
discoveryevasionpersistenceransomwaretrojan

Malware Config

Signatures

  • UAC bypass 3 TTPs 2 IoCs
    evasiontrojan
  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 2 IoCs
  • Adds Run key to start application 2 TTPs 4 IoCs
    persistence
  • Drops desktop.ini file(s) 15 IoCs
  • Enumerates connected drives 3 TTPs 1 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops autorun.inf file 1 TTPs 1 IoCs

    Malware can abuse Windows Autorun to spread further via attached volumes.

  • Drops file in System32 directory 1 IoCs
  • Sets desktop wallpaper using registry 2 TTPs 2 IoCs
    ransomware
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 15 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies registry class 45 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 60 IoCs
  • System policy modification 1 TTPs 2 IoCs
    evasion

Processes

  • C:\Users\Admin\AppData\Local\Temp\30616f6c488fa16ccdcbfd6273e7ac8604c82bc1468fc1a70b2a43661b674760.exe
    "C:\Users\Admin\AppData\Local\Temp\30616f6c488fa16ccdcbfd6273e7ac8604c82bc1468fc1a70b2a43661b674760.exe"
    1⤵
    • UAC bypass
    • Loads dropped DLL
    • Adds Run key to start application
    • Drops desktop.ini file(s)
    • Enumerates connected drives
    • Drops autorun.inf file
    • Drops file in System32 directory
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    • System policy modification
    PID:2504
    • C:\Users\Admin\Documents\Temp\CANCER~93578.exe
      "C:\Users\Admin\Documents\Temp\CANCER~93578.exe"
      2⤵
      • Executes dropped EXE
      PID:1336
    • C:\Users\Admin\Pictures\Temp\CANCER~23505.exe
      "C:\Users\Admin\Pictures\Temp\CANCER~23505.exe"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:2164
    • C:\Users\Admin\AppData\Local\Temp\30616f6c488fa16ccdcbfd6273e7ac8604c82bc1468fc1a70b2a43661b674760.exe
      "C:\Users\Admin\AppData\Local\Temp\30616f6c488fa16ccdcbfd6273e7ac8604c82bc1468fc1a70b2a43661b674760.exe" "C:\Users\Admin\Shared\Temp\CANCER~54786.exe"
      2⤵
      • System Location Discovery: System Language Discovery
      PID:1304
    • C:\Users\Admin\AppData\Local\Temp\30616f6c488fa16ccdcbfd6273e7ac8604c82bc1468fc1a70b2a43661b674760.exe
      "C:\Users\Admin\AppData\Local\Temp\30616f6c488fa16ccdcbfd6273e7ac8604c82bc1468fc1a70b2a43661b674760.exe" "C:\Users\Admin\AppData\CANCER~42981.exe"
      2⤵
      • System Location Discovery: System Language Discovery
      PID:2904
    • C:\Users\Admin\AppData\Local\Temp\30616f6c488fa16ccdcbfd6273e7ac8604c82bc1468fc1a70b2a43661b674760.exe
      "C:\Users\Admin\AppData\Local\Temp\30616f6c488fa16ccdcbfd6273e7ac8604c82bc1468fc1a70b2a43661b674760.exe" "C:\Users\Admin\AppData\Local\CANCER~88241.exe"
      2⤵
      • System Location Discovery: System Language Discovery
      PID:2456
    • C:\Users\Admin\AppData\Local\Temp\30616f6c488fa16ccdcbfd6273e7ac8604c82bc1468fc1a70b2a43661b674760.exe
      "C:\Users\Admin\AppData\Local\Temp\30616f6c488fa16ccdcbfd6273e7ac8604c82bc1468fc1a70b2a43661b674760.exe" "C:\Users\Admin\AppData\Roaming\CANCER~42854.exe"
      2⤵
      • System Location Discovery: System Language Discovery
      PID:2052
    • C:\Users\Admin\AppData\Local\Temp\30616f6c488fa16ccdcbfd6273e7ac8604c82bc1468fc1a70b2a43661b674760.exe
      "C:\Users\Admin\AppData\Local\Temp\30616f6c488fa16ccdcbfd6273e7ac8604c82bc1468fc1a70b2a43661b674760.exe" "C:\Users\Admin\Program Data\CANCER~15255.exe"
      2⤵
      • System Location Discovery: System Language Discovery
      PID:2204
    • C:\Users\Admin\AppData\Local\Temp\30616f6c488fa16ccdcbfd6273e7ac8604c82bc1468fc1a70b2a43661b674760.exe
      "C:\Users\Admin\AppData\Local\Temp\30616f6c488fa16ccdcbfd6273e7ac8604c82bc1468fc1a70b2a43661b674760.exe" "C:\Program Files\zzz_Cancer\CANCER~39764.exe"
      2⤵
      • System Location Discovery: System Language Discovery
      PID:1660
    • C:\Users\Admin\AppData\Local\Temp\30616f6c488fa16ccdcbfd6273e7ac8604c82bc1468fc1a70b2a43661b674760.exe
      "C:\Users\Admin\AppData\Local\Temp\30616f6c488fa16ccdcbfd6273e7ac8604c82bc1468fc1a70b2a43661b674760.exe" "C:\Program Files\_\CANCER~56817.exe"
      2⤵
      • System Location Discovery: System Language Discovery
      PID:1780
    • C:\Users\Admin\AppData\Local\Temp\30616f6c488fa16ccdcbfd6273e7ac8604c82bc1468fc1a70b2a43661b674760.exe
      "C:\Users\Admin\AppData\Local\Temp\30616f6c488fa16ccdcbfd6273e7ac8604c82bc1468fc1a70b2a43661b674760.exe" "C:\Programs\Eww\CANCER~15377.exe"
      2⤵
      • System Location Discovery: System Language Discovery
      PID:2328
    • C:\Users\Admin\AppData\Local\Temp\30616f6c488fa16ccdcbfd6273e7ac8604c82bc1468fc1a70b2a43661b674760.exe
      "C:\Users\Admin\AppData\Local\Temp\30616f6c488fa16ccdcbfd6273e7ac8604c82bc1468fc1a70b2a43661b674760.exe" "C:\Windows\XLIN\CANCER~47749.exe"
      2⤵
      • System Location Discovery: System Language Discovery
      PID:1632
    • C:\Users\Admin\AppData\Local\Temp\30616f6c488fa16ccdcbfd6273e7ac8604c82bc1468fc1a70b2a43661b674760.exe
      "C:\Users\Admin\AppData\Local\Temp\30616f6c488fa16ccdcbfd6273e7ac8604c82bc1468fc1a70b2a43661b674760.exe" "C:\Windows\D-Link\Media\CANCER~7965.exe"
      2⤵
      • System Location Discovery: System Language Discovery
      PID:1384
    • C:\Users\Admin\AppData\Local\Temp\30616f6c488fa16ccdcbfd6273e7ac8604c82bc1468fc1a70b2a43661b674760.exe
      "C:\Users\Admin\AppData\Local\Temp\30616f6c488fa16ccdcbfd6273e7ac8604c82bc1468fc1a70b2a43661b674760.exe" "C:\Temp\Cached\CANCER~14187.exe"
      2⤵
      • System Location Discovery: System Language Discovery
      PID:1908
    • C:\Users\Admin\AppData\Local\Temp\30616f6c488fa16ccdcbfd6273e7ac8604c82bc1468fc1a70b2a43661b674760.exe
      "C:\Users\Admin\AppData\Local\Temp\30616f6c488fa16ccdcbfd6273e7ac8604c82bc1468fc1a70b2a43661b674760.exe" "C:\CANCER~1175.exe"
      2⤵
      • System Location Discovery: System Language Discovery
      PID:2824
    • C:\Users\Admin\AppData\Local\Temp\30616f6c488fa16ccdcbfd6273e7ac8604c82bc1468fc1a70b2a43661b674760.exe
      "C:\Users\Admin\AppData\Local\Temp\30616f6c488fa16ccdcbfd6273e7ac8604c82bc1468fc1a70b2a43661b674760.exe" "C:\Program Data\CANCER~21420.exe"
      2⤵
      • System Location Discovery: System Language Discovery
      PID:2080

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

1
T1091

Execution

Persistence

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Privilege Escalation

Abuse Elevation Control Mechanism

1
T1548

Bypass User Account Control

1
T1548.002

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Defense Evasion

Abuse Elevation Control Mechanism

1
T1548

Bypass User Account Control

1
T1548.002

Impair Defenses

1
T1562

Disable or Modify Tools

1
T1562.001

Modify Registry

4
T1112

Credential Access

Discovery

Peripheral Device Discovery

1
T1120

Query Registry

1
T1012

System Information Discovery

2
T1082

System Location Discovery

1
T1614

System Language Discovery

1
T1614.001

Lateral Movement

Replication Through Removable Media

1
T1091

Collection

Command and Control

Exfiltration

Impact

Defacement

1
T1491

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.msi
    Filesize

    7B

    MD5

    44f601e6b6d1113354b901483b2e624c

    SHA1

    f39912a200b8a49c8ea43ec7085f498cae4324c7

    SHA256

    4dde4c53d78e3e01233b0019370fcdba1e04acf2070f83e843f990a7f6d941b3

    SHA512

    98d3dcc0a164d2cc56079d38fc0fb6a1de6113bc1451f2603c187c43b265e0884dc842956327340a5299536a5fe4234b11a5aed1b48da69b62788200578cf8e4

    Download Submit

  • \Users\Admin\Documents\Temp\CANCER~93578.exe
    Filesize

    6.8MB

    MD5

    b5bae1ed2fde118e256ede9d86affe42

    SHA1

    4870df80763feae4870e674a93515a2635637748

    SHA256

    30616f6c488fa16ccdcbfd6273e7ac8604c82bc1468fc1a70b2a43661b674760

    SHA512

    00c871aaf12b9690d99ec2797758e69a7513da378cf6d7a2f7e0d3c2095267b346aee5fd7585121bdd5c3ff112f832d810367788136c5bb68758675c4eec5bfa

    Download Submit

  • memory/2164-1309-0x0000000000370000-0x0000000000A46000-memory.dmp

    Filesize

    6.8MB

    Download

  • memory/2504-3-0x0000000073F80000-0x000000007466E000-memory.dmp

    Filesize

    6.9MB

    Download

  • memory/2504-4-0x000000000BDC0000-0x000000000C4AA000-memory.dmp

    Filesize

    6.9MB

    Download

  • memory/2504-5-0x00000000002D0000-0x00000000002D6000-memory.dmp

    Filesize

    24KB

    Download

  • memory/2504-6-0x0000000073F80000-0x000000007466E000-memory.dmp

    Filesize

    6.9MB

    Download

  • memory/2504-0-0x0000000073F8E000-0x0000000073F8F000-memory.dmp

    Filesize

    4KB

    Download

  • memory/2504-160-0x0000000073F80000-0x000000007466E000-memory.dmp

    Filesize

    6.9MB

    Download

  • memory/2504-2-0x0000000000420000-0x0000000000426000-memory.dmp

    Filesize

    24KB

    Download

  • memory/2504-1-0x0000000000830000-0x0000000000F06000-memory.dmp

    Filesize

    6.8MB

    Download

  • memory/2504-16889-0x0000000073F8E000-0x0000000073F8F000-memory.dmp

    Filesize

    4KB

    Download

  • memory/2504-21051-0x0000000073F80000-0x000000007466E000-memory.dmp

    Filesize

    6.9MB

    Download

  • memory/2504-24733-0x0000000073F80000-0x000000007466E000-memory.dmp

    Filesize

    6.9MB

    Download

  • memory/2504-40754-0x0000000073F80000-0x000000007466E000-memory.dmp

    Filesize

    6.9MB

    Download