Malware Analysis Report

2024-12-07 10:00

Sample ID 241114-25xgvatqgx
Target 72b8ac452310da80b09c7e5ef25cdf1fa1b2ec47983ebae39bcc3c0fa87b83be
SHA256 72b8ac452310da80b09c7e5ef25cdf1fa1b2ec47983ebae39bcc3c0fa87b83be
Tags
discovery ransomware
score
6/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
6/10

SHA256

72b8ac452310da80b09c7e5ef25cdf1fa1b2ec47983ebae39bcc3c0fa87b83be

Threat Level: Shows suspicious behavior

The file 72b8ac452310da80b09c7e5ef25cdf1fa1b2ec47983ebae39bcc3c0fa87b83be was found to be: Shows suspicious behavior.

Malicious Activity Summary

discovery ransomware

Enumerates connected drives

Sets desktop wallpaper using registry

Drops file in Program Files directory

Drops file in Windows directory

Unsigned PE

Program crash

Enumerates physical storage devices

System Location Discovery: System Language Discovery

Modifies Internet Explorer settings

Suspicious use of WriteProcessMemory

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-11-14 23:10

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-11-14 23:10

Reported

2024-11-14 23:13

Platform

win7-20240903-en

Max time kernel

119s

Max time network

121s

Command Line

"C:\Users\Admin\AppData\Local\Temp\72b8ac452310da80b09c7e5ef25cdf1fa1b2ec47983ebae39bcc3c0fa87b83be.exe"

Signatures

Sets desktop wallpaper using registry

ransomware
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Themes\\TranscodedWallpaper.jpg" C:\Users\Admin\AppData\Local\Temp\72b8ac452310da80b09c7e5ef25cdf1fa1b2ec47983ebae39bcc3c0fa87b83be.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification C:\Program Files\7-Zip\RCXB4A2.tmp C:\Users\Admin\AppData\Local\Temp\72b8ac452310da80b09c7e5ef25cdf1fa1b2ec47983ebae39bcc3c0fa87b83be.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\OFFICE14\MSOXMLED.EXE C:\Users\Admin\AppData\Local\Temp\72b8ac452310da80b09c7e5ef25cdf1fa1b2ec47983ebae39bcc3c0fa87b83be.exe N/A
File created C:\Program Files\DVD Maker\DVDMaker.exe C:\Users\Admin\AppData\Local\Temp\72b8ac452310da80b09c7e5ef25cdf1fa1b2ec47983ebae39bcc3c0fa87b83be.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\MSInfo\msinfo32.cab C:\Users\Admin\AppData\Local\Temp\72b8ac452310da80b09c7e5ef25cdf1fa1b2ec47983ebae39bcc3c0fa87b83be.exe N/A
File opened for modification C:\Program Files\Common Files\Microsoft Shared\OFFICE14\RCXB515.tmp C:\Users\Admin\AppData\Local\Temp\72b8ac452310da80b09c7e5ef25cdf1fa1b2ec47983ebae39bcc3c0fa87b83be.exe N/A
File opened for modification C:\Program Files\Google\Chrome\Application\RCXB54C.tmp C:\Users\Admin\AppData\Local\Temp\72b8ac452310da80b09c7e5ef25cdf1fa1b2ec47983ebae39bcc3c0fa87b83be.exe N/A
File created C:\Program Files\Google\Chrome\Application\chrome.cab C:\Users\Admin\AppData\Local\Temp\72b8ac452310da80b09c7e5ef25cdf1fa1b2ec47983ebae39bcc3c0fa87b83be.exe N/A
File created C:\Program Files\7-Zip\7z.exe C:\Users\Admin\AppData\Local\Temp\72b8ac452310da80b09c7e5ef25cdf1fa1b2ec47983ebae39bcc3c0fa87b83be.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\FlickLearningWizard.cab C:\Users\Admin\AppData\Local\Temp\72b8ac452310da80b09c7e5ef25cdf1fa1b2ec47983ebae39bcc3c0fa87b83be.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\InputPersonalization.cab C:\Users\Admin\AppData\Local\Temp\72b8ac452310da80b09c7e5ef25cdf1fa1b2ec47983ebae39bcc3c0fa87b83be.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\TabTip.exe C:\Users\Admin\AppData\Local\Temp\72b8ac452310da80b09c7e5ef25cdf1fa1b2ec47983ebae39bcc3c0fa87b83be.exe N/A
File opened for modification C:\Program Files\Common Files\Microsoft Shared\MSInfo\msinfo32.cab C:\Users\Admin\AppData\Local\Temp\72b8ac452310da80b09c7e5ef25cdf1fa1b2ec47983ebae39bcc3c0fa87b83be.exe N/A
File opened for modification C:\Program Files\Common Files\Microsoft Shared\OFFICE14\RCXB504.tmp C:\Users\Admin\AppData\Local\Temp\72b8ac452310da80b09c7e5ef25cdf1fa1b2ec47983ebae39bcc3c0fa87b83be.exe N/A
File created C:\Program Files\DVD Maker\DVDMaker.cab C:\Users\Admin\AppData\Local\Temp\72b8ac452310da80b09c7e5ef25cdf1fa1b2ec47983ebae39bcc3c0fa87b83be.exe N/A
File opened for modification C:\Program Files\Google\Chrome\Application\RCXB535.tmp C:\Users\Admin\AppData\Local\Temp\72b8ac452310da80b09c7e5ef25cdf1fa1b2ec47983ebae39bcc3c0fa87b83be.exe N/A
File opened for modification C:\Program Files\Google\Chrome\Application\RCXB536.tmp C:\Users\Admin\AppData\Local\Temp\72b8ac452310da80b09c7e5ef25cdf1fa1b2ec47983ebae39bcc3c0fa87b83be.exe N/A
File opened for modification C:\Program Files\Google\Chrome\Application\RCXB549.tmp C:\Users\Admin\AppData\Local\Temp\72b8ac452310da80b09c7e5ef25cdf1fa1b2ec47983ebae39bcc3c0fa87b83be.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\InputPersonalization.exe C:\Users\Admin\AppData\Local\Temp\72b8ac452310da80b09c7e5ef25cdf1fa1b2ec47983ebae39bcc3c0fa87b83be.exe N/A
File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\mip.cab C:\Users\Admin\AppData\Local\Temp\72b8ac452310da80b09c7e5ef25cdf1fa1b2ec47983ebae39bcc3c0fa87b83be.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\mip.exe C:\Users\Admin\AppData\Local\Temp\72b8ac452310da80b09c7e5ef25cdf1fa1b2ec47983ebae39bcc3c0fa87b83be.exe N/A
File opened for modification C:\Program Files\7-Zip\RCXB4A3.tmp C:\Users\Admin\AppData\Local\Temp\72b8ac452310da80b09c7e5ef25cdf1fa1b2ec47983ebae39bcc3c0fa87b83be.exe N/A
File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\ShapeCollector.cab C:\Users\Admin\AppData\Local\Temp\72b8ac452310da80b09c7e5ef25cdf1fa1b2ec47983ebae39bcc3c0fa87b83be.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\MSInfo\msinfo32.exe C:\Users\Admin\AppData\Local\Temp\72b8ac452310da80b09c7e5ef25cdf1fa1b2ec47983ebae39bcc3c0fa87b83be.exe N/A
File opened for modification C:\Program Files\Common Files\Microsoft Shared\OFFICE14\RCXB503.tmp C:\Users\Admin\AppData\Local\Temp\72b8ac452310da80b09c7e5ef25cdf1fa1b2ec47983ebae39bcc3c0fa87b83be.exe N/A
File opened for modification C:\Program Files\Google\Chrome\Application\RCXB55F.tmp C:\Users\Admin\AppData\Local\Temp\72b8ac452310da80b09c7e5ef25cdf1fa1b2ec47983ebae39bcc3c0fa87b83be.exe N/A
File opened for modification C:\Program Files\Common Files\Microsoft Shared\OFFICE14\MSOXMLED.cab C:\Users\Admin\AppData\Local\Temp\72b8ac452310da80b09c7e5ef25cdf1fa1b2ec47983ebae39bcc3c0fa87b83be.exe N/A
File opened for modification C:\Program Files\Google\Chrome\Application\RCXB547.tmp C:\Users\Admin\AppData\Local\Temp\72b8ac452310da80b09c7e5ef25cdf1fa1b2ec47983ebae39bcc3c0fa87b83be.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\FlickLearningWizard.exe C:\Users\Admin\AppData\Local\Temp\72b8ac452310da80b09c7e5ef25cdf1fa1b2ec47983ebae39bcc3c0fa87b83be.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\InkWatson.cab C:\Users\Admin\AppData\Local\Temp\72b8ac452310da80b09c7e5ef25cdf1fa1b2ec47983ebae39bcc3c0fa87b83be.exe N/A
File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\TabTip.cab C:\Users\Admin\AppData\Local\Temp\72b8ac452310da80b09c7e5ef25cdf1fa1b2ec47983ebae39bcc3c0fa87b83be.exe N/A
File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\FlickLearningWizard.cab C:\Users\Admin\AppData\Local\Temp\72b8ac452310da80b09c7e5ef25cdf1fa1b2ec47983ebae39bcc3c0fa87b83be.exe N/A
File opened for modification C:\Program Files\DVD Maker\DVDMaker.cab C:\Users\Admin\AppData\Local\Temp\72b8ac452310da80b09c7e5ef25cdf1fa1b2ec47983ebae39bcc3c0fa87b83be.exe N/A
File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\InputPersonalization.cab C:\Users\Admin\AppData\Local\Temp\72b8ac452310da80b09c7e5ef25cdf1fa1b2ec47983ebae39bcc3c0fa87b83be.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\ShapeCollector.cab C:\Users\Admin\AppData\Local\Temp\72b8ac452310da80b09c7e5ef25cdf1fa1b2ec47983ebae39bcc3c0fa87b83be.exe N/A
File opened for modification C:\Program Files\7-Zip\7z.cab C:\Users\Admin\AppData\Local\Temp\72b8ac452310da80b09c7e5ef25cdf1fa1b2ec47983ebae39bcc3c0fa87b83be.exe N/A
File opened for modification C:\Program Files\7-Zip\RCXB490.tmp C:\Users\Admin\AppData\Local\Temp\72b8ac452310da80b09c7e5ef25cdf1fa1b2ec47983ebae39bcc3c0fa87b83be.exe N/A
File opened for modification C:\Program Files\7-Zip\RCXB4A1.tmp C:\Users\Admin\AppData\Local\Temp\72b8ac452310da80b09c7e5ef25cdf1fa1b2ec47983ebae39bcc3c0fa87b83be.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\ShapeCollector.exe C:\Users\Admin\AppData\Local\Temp\72b8ac452310da80b09c7e5ef25cdf1fa1b2ec47983ebae39bcc3c0fa87b83be.exe N/A
File created C:\Program Files\Google\Chrome\Application\chrome.exe C:\Users\Admin\AppData\Local\Temp\72b8ac452310da80b09c7e5ef25cdf1fa1b2ec47983ebae39bcc3c0fa87b83be.exe N/A
File created C:\Program Files\readme.1xt C:\Users\Admin\AppData\Local\Temp\72b8ac452310da80b09c7e5ef25cdf1fa1b2ec47983ebae39bcc3c0fa87b83be.exe N/A
File created C:\Program Files\7-Zip\7z.cab C:\Users\Admin\AppData\Local\Temp\72b8ac452310da80b09c7e5ef25cdf1fa1b2ec47983ebae39bcc3c0fa87b83be.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\ConvertInkStore.cab C:\Users\Admin\AppData\Local\Temp\72b8ac452310da80b09c7e5ef25cdf1fa1b2ec47983ebae39bcc3c0fa87b83be.exe N/A
File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\InkWatson.cab C:\Users\Admin\AppData\Local\Temp\72b8ac452310da80b09c7e5ef25cdf1fa1b2ec47983ebae39bcc3c0fa87b83be.exe N/A
File opened for modification C:\Program Files\Google\Chrome\Application\RCXB55E.tmp C:\Users\Admin\AppData\Local\Temp\72b8ac452310da80b09c7e5ef25cdf1fa1b2ec47983ebae39bcc3c0fa87b83be.exe N/A
File opened for modification C:\Program Files\7-Zip\RCXB4A4.tmp C:\Users\Admin\AppData\Local\Temp\72b8ac452310da80b09c7e5ef25cdf1fa1b2ec47983ebae39bcc3c0fa87b83be.exe N/A
File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\ConvertInkStore.cab C:\Users\Admin\AppData\Local\Temp\72b8ac452310da80b09c7e5ef25cdf1fa1b2ec47983ebae39bcc3c0fa87b83be.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\TabTip.cab C:\Users\Admin\AppData\Local\Temp\72b8ac452310da80b09c7e5ef25cdf1fa1b2ec47983ebae39bcc3c0fa87b83be.exe N/A
File opened for modification C:\Program Files\Google\Chrome\Application\RCXB537.tmp C:\Users\Admin\AppData\Local\Temp\72b8ac452310da80b09c7e5ef25cdf1fa1b2ec47983ebae39bcc3c0fa87b83be.exe N/A
File opened for modification C:\Program Files\Google\Chrome\Application\RCXB54B.tmp C:\Users\Admin\AppData\Local\Temp\72b8ac452310da80b09c7e5ef25cdf1fa1b2ec47983ebae39bcc3c0fa87b83be.exe N/A
File opened for modification C:\Program Files\7-Zip\RCXB491.tmp C:\Users\Admin\AppData\Local\Temp\72b8ac452310da80b09c7e5ef25cdf1fa1b2ec47983ebae39bcc3c0fa87b83be.exe N/A
File created C:\Program Files\7-Zip\7zFM.exe C:\Users\Admin\AppData\Local\Temp\72b8ac452310da80b09c7e5ef25cdf1fa1b2ec47983ebae39bcc3c0fa87b83be.exe N/A
File opened for modification C:\Program Files\7-Zip\7zFM.exe C:\Users\Admin\AppData\Local\Temp\72b8ac452310da80b09c7e5ef25cdf1fa1b2ec47983ebae39bcc3c0fa87b83be.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\InkWatson.exe C:\Users\Admin\AppData\Local\Temp\72b8ac452310da80b09c7e5ef25cdf1fa1b2ec47983ebae39bcc3c0fa87b83be.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\mip.cab C:\Users\Admin\AppData\Local\Temp\72b8ac452310da80b09c7e5ef25cdf1fa1b2ec47983ebae39bcc3c0fa87b83be.exe N/A
File opened for modification C:\Program Files\Google\Chrome\Application\RCXB54D.tmp C:\Users\Admin\AppData\Local\Temp\72b8ac452310da80b09c7e5ef25cdf1fa1b2ec47983ebae39bcc3c0fa87b83be.exe N/A
File opened for modification C:\Program Files\7-Zip\7z.exe C:\Users\Admin\AppData\Local\Temp\72b8ac452310da80b09c7e5ef25cdf1fa1b2ec47983ebae39bcc3c0fa87b83be.exe N/A
File opened for modification C:\Program Files\7-Zip\7zFM.cab C:\Users\Admin\AppData\Local\Temp\72b8ac452310da80b09c7e5ef25cdf1fa1b2ec47983ebae39bcc3c0fa87b83be.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\ConvertInkStore.exe C:\Users\Admin\AppData\Local\Temp\72b8ac452310da80b09c7e5ef25cdf1fa1b2ec47983ebae39bcc3c0fa87b83be.exe N/A
File opened for modification C:\Program Files\Common Files\Microsoft Shared\OFFICE14\MSOXMLED.EXE C:\Users\Admin\AppData\Local\Temp\72b8ac452310da80b09c7e5ef25cdf1fa1b2ec47983ebae39bcc3c0fa87b83be.exe N/A
File opened for modification C:\Program Files\Google\Chrome\Application\chrome.cab C:\Users\Admin\AppData\Local\Temp\72b8ac452310da80b09c7e5ef25cdf1fa1b2ec47983ebae39bcc3c0fa87b83be.exe N/A
File created C:\Program Files\7-Zip\7zFM.cab C:\Users\Admin\AppData\Local\Temp\72b8ac452310da80b09c7e5ef25cdf1fa1b2ec47983ebae39bcc3c0fa87b83be.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\OFFICE14\MSOXMLED.cab C:\Users\Admin\AppData\Local\Temp\72b8ac452310da80b09c7e5ef25cdf1fa1b2ec47983ebae39bcc3c0fa87b83be.exe N/A
File opened for modification C:\Program Files\Google\Chrome\Application\RCXB548.tmp C:\Users\Admin\AppData\Local\Temp\72b8ac452310da80b09c7e5ef25cdf1fa1b2ec47983ebae39bcc3c0fa87b83be.exe N/A
File opened for modification C:\Program Files\Google\Chrome\Application\RCXB54A.tmp C:\Users\Admin\AppData\Local\Temp\72b8ac452310da80b09c7e5ef25cdf1fa1b2ec47983ebae39bcc3c0fa87b83be.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File created C:\windows\WallPapers.jpg C:\Users\Admin\AppData\Local\Temp\72b8ac452310da80b09c7e5ef25cdf1fa1b2ec47983ebae39bcc3c0fa87b83be.exe N/A
File created C:\windows\readme.1xt C:\Users\Admin\AppData\Local\Temp\72b8ac452310da80b09c7e5ef25cdf1fa1b2ec47983ebae39bcc3c0fa87b83be.exe N/A

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\72b8ac452310da80b09c7e5ef25cdf1fa1b2ec47983ebae39bcc3c0fa87b83be.exe N/A

Modifies Internet Explorer settings

adware spyware
Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Desktop\General C:\Users\Admin\AppData\Local\Temp\72b8ac452310da80b09c7e5ef25cdf1fa1b2ec47983ebae39bcc3c0fa87b83be.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Desktop\General\WallpaperSource = "C:\\windows\\WallPapers.jpg" C:\Users\Admin\AppData\Local\Temp\72b8ac452310da80b09c7e5ef25cdf1fa1b2ec47983ebae39bcc3c0fa87b83be.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\72b8ac452310da80b09c7e5ef25cdf1fa1b2ec47983ebae39bcc3c0fa87b83be.exe

"C:\Users\Admin\AppData\Local\Temp\72b8ac452310da80b09c7e5ef25cdf1fa1b2ec47983ebae39bcc3c0fa87b83be.exe"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2308 -s 952

Network

N/A

Files

memory/2308-1-0x0000000000400000-0x0000000000485000-memory.dmp

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\TranscodedWallpaper.jpg

MD5 0d472c9720e55e9c249207de6c69722c
SHA1 7244426a440a268cb37b49005812b8f20f052776
SHA256 bc1d3cfb69f97bc930af3af7be8601e60eb1cc78516aa844e41c65e51c316de3
SHA512 f77bf33604691e0f21f1f3548187153495aad5cd5beb80b409ff50c71502e5303ddb7d64b652edc5b4177bf88e8cee0df914f91b9532b9b1116af32050291cca

C:\Program Files\7-Zip\7z.cab

MD5 9a1dd1d96481d61934dcc2d568971d06
SHA1 f136ef9bf8bd2fc753292fb5b7cf173a22675fb3
SHA256 8cebb25e240db3b6986fcaed6bc0b900fa09dad763a56fb71273529266c5c525
SHA512 7ac1581f8a29e778ba1a1220670796c47fa5b838417f8f635e2cb1998a01515cff3ee57045dacb78a8ec70d43754b970743aba600379fe6d9481958d32d8a5aa

C:\Program Files\7-Zip\7z.exe

MD5 7d349fb7035a5291e548b2f6dcfd668c
SHA1 f092e91bacd7e46a4ae1bd10b13a3045a2f7502e
SHA256 0d5ef4b74d10e88874547a67000fd453ca7c4e0e4f496525f1664fe06cbdcc1c
SHA512 0c3f9a6589bc7532519ac9a436a004868a14bff54aa18c8e80c2077818d36d2cf295ea2985c8e8672cc56567d33ae70ea716f66ecdca5da0debc82aeb921c049

C:\Program Files\7-Zip\7zFM.cab

MD5 30ac0b832d75598fb3ec37b6f2a8c86a
SHA1 6f47dbfd6ff36df7ba581a4cef024da527dc3046
SHA256 1ea0839c8dc95ad2c060af7d042c40c0daed58ce8e4524c0fba12fd73e4afb74
SHA512 505870601a4389b7ed2c8fecf85835adfd2944cbc10801f74bc4e08f5a0d6ecc9a52052fc37e216304cd1655129021862294a698ed36b3b43d428698f7263057

C:\Program Files\Common Files\Microsoft Shared\OFFICE14\RCXB503.tmp

MD5 f92f6883ff4738d8f8710f414e623069
SHA1 29e1b67df116a5b5bb019bbe7a2a50edc1946b76
SHA256 23014d03cfa93eedc7df229f43a5969bc138a6475c80efe899efebfc1f526646
SHA512 945bdcf1a4ad9c36a180d0b9d8689c5f08f741e3036a02c5017227421d34e8e94d99a9bf216e0f3440bde25763a3824f6a4373de4ba8e7ab8b420ad42d61a274

C:\Program Files\Common Files\Microsoft Shared\OFFICE14\MSOXMLED.cab

MD5 f45a7db6aec433fd579774dfdb3eaa89
SHA1 2f8773cc2b720143776a0909d19b98c4954b39cc
SHA256 2bc2372cfabd26933bc4012046e66a5d2efc9554c0835d1a0aa012d3bd1a6f9a
SHA512 03a4b7c53373ff6308a0292bb84981dc1566923e93669bbb11cb03d9f58a8d477a1a2399aac5059f477bbf1cf14b17817d208bc7c496b8675ece83cdabec5662

C:\Program Files\Google\Chrome\Application\RCXB547.tmp

MD5 f8256e1c7bc79d690140a07156a4241d
SHA1 f803e09b02eff4e2db69170b6e63b0fcb1f78908
SHA256 dbf1fb265fc99ba5da6e5df4a3b4af6ac9360613de5b4cc12aae8e6ec594f962
SHA512 5cdda45286f9f2e5aa36a4fc3df9b7168dc4d8a1ce82866dd49829cd4cc026afd55757e7c1ab629f4218f51a2c287627a94608b2eec30a4a25ad65be5a5a48b2

C:\Program Files\Google\Chrome\Application\chrome.cab

MD5 095092f4e746810c5829038d48afd55a
SHA1 246eb3d41194dddc826049bbafeb6fc522ec044a
SHA256 2f606012843d144610dc7be55d1716d5d106cbc6acbce57561dc0e62c38b8588
SHA512 7f36fc03bfed0f3cf6ac3406c819993bf995e4f8c26a7589e9032c14b5a9c7048f5567f77b3b15f946c5282fc0be6308a92eab7879332d74c400d0c139ce8400

memory/2308-177-0x0000000000400000-0x0000000000485000-memory.dmp

memory/2308-178-0x0000000000400000-0x0000000000485000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-11-14 23:10

Reported

2024-11-14 23:13

Platform

win10v2004-20241007-en

Max time kernel

95s

Max time network

135s

Command Line

"C:\Users\Admin\AppData\Local\Temp\72b8ac452310da80b09c7e5ef25cdf1fa1b2ec47983ebae39bcc3c0fa87b83be.exe"

Signatures

Sets desktop wallpaper using registry

ransomware
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\Desktop\Wallpaper = "C:\\windows\\WallPapers.jpg" C:\Users\Admin\AppData\Local\Temp\72b8ac452310da80b09c7e5ef25cdf1fa1b2ec47983ebae39bcc3c0fa87b83be.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\RCXB1A3.tmp C:\Users\Admin\AppData\Local\Temp\72b8ac452310da80b09c7e5ef25cdf1fa1b2ec47983ebae39bcc3c0fa87b83be.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\RCXB240.tmp C:\Users\Admin\AppData\Local\Temp\72b8ac452310da80b09c7e5ef25cdf1fa1b2ec47983ebae39bcc3c0fa87b83be.exe N/A
File opened for modification C:\Program Files\7-Zip\7z.cab C:\Users\Admin\AppData\Local\Temp\72b8ac452310da80b09c7e5ef25cdf1fa1b2ec47983ebae39bcc3c0fa87b83be.exe N/A
File created C:\Program Files\7-Zip\7z.exe C:\Users\Admin\AppData\Local\Temp\72b8ac452310da80b09c7e5ef25cdf1fa1b2ec47983ebae39bcc3c0fa87b83be.exe N/A
File created C:\Program Files\7-Zip\7zFM.exe C:\Users\Admin\AppData\Local\Temp\72b8ac452310da80b09c7e5ef25cdf1fa1b2ec47983ebae39bcc3c0fa87b83be.exe N/A
File opened for modification C:\Program Files\7-Zip\RCXB180.tmp C:\Users\Admin\AppData\Local\Temp\72b8ac452310da80b09c7e5ef25cdf1fa1b2ec47983ebae39bcc3c0fa87b83be.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.cab C:\Users\Admin\AppData\Local\Temp\72b8ac452310da80b09c7e5ef25cdf1fa1b2ec47983ebae39bcc3c0fa87b83be.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe C:\Users\Admin\AppData\Local\Temp\72b8ac452310da80b09c7e5ef25cdf1fa1b2ec47983ebae39bcc3c0fa87b83be.exe N/A
File opened for modification C:\Program Files\7-Zip\RCXB130.tmp C:\Users\Admin\AppData\Local\Temp\72b8ac452310da80b09c7e5ef25cdf1fa1b2ec47983ebae39bcc3c0fa87b83be.exe N/A
File opened for modification C:\Program Files\7-Zip\7z.exe C:\Users\Admin\AppData\Local\Temp\72b8ac452310da80b09c7e5ef25cdf1fa1b2ec47983ebae39bcc3c0fa87b83be.exe N/A
File created C:\Program Files\7-Zip\7zFM.cab C:\Users\Admin\AppData\Local\Temp\72b8ac452310da80b09c7e5ef25cdf1fa1b2ec47983ebae39bcc3c0fa87b83be.exe N/A
File opened for modification C:\Program Files\7-Zip\RCXB170.tmp C:\Users\Admin\AppData\Local\Temp\72b8ac452310da80b09c7e5ef25cdf1fa1b2ec47983ebae39bcc3c0fa87b83be.exe N/A
File opened for modification C:\Program Files\7-Zip\RCXB181.tmp C:\Users\Admin\AppData\Local\Temp\72b8ac452310da80b09c7e5ef25cdf1fa1b2ec47983ebae39bcc3c0fa87b83be.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.cab C:\Users\Admin\AppData\Local\Temp\72b8ac452310da80b09c7e5ef25cdf1fa1b2ec47983ebae39bcc3c0fa87b83be.exe N/A
File created C:\Program Files\readme.1xt C:\Users\Admin\AppData\Local\Temp\72b8ac452310da80b09c7e5ef25cdf1fa1b2ec47983ebae39bcc3c0fa87b83be.exe N/A
File created C:\Program Files\7-Zip\7z.cab C:\Users\Admin\AppData\Local\Temp\72b8ac452310da80b09c7e5ef25cdf1fa1b2ec47983ebae39bcc3c0fa87b83be.exe N/A
File opened for modification C:\Program Files\7-Zip\7zFM.cab C:\Users\Admin\AppData\Local\Temp\72b8ac452310da80b09c7e5ef25cdf1fa1b2ec47983ebae39bcc3c0fa87b83be.exe N/A
File opened for modification C:\Program Files\7-Zip\7zFM.exe C:\Users\Admin\AppData\Local\Temp\72b8ac452310da80b09c7e5ef25cdf1fa1b2ec47983ebae39bcc3c0fa87b83be.exe N/A
File opened for modification C:\Program Files\7-Zip\RCXB120.tmp C:\Users\Admin\AppData\Local\Temp\72b8ac452310da80b09c7e5ef25cdf1fa1b2ec47983ebae39bcc3c0fa87b83be.exe N/A
File opened for modification C:\Program Files\7-Zip\RCXB192.tmp C:\Users\Admin\AppData\Local\Temp\72b8ac452310da80b09c7e5ef25cdf1fa1b2ec47983ebae39bcc3c0fa87b83be.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe C:\Users\Admin\AppData\Local\Temp\72b8ac452310da80b09c7e5ef25cdf1fa1b2ec47983ebae39bcc3c0fa87b83be.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File created C:\windows\readme.1xt C:\Users\Admin\AppData\Local\Temp\72b8ac452310da80b09c7e5ef25cdf1fa1b2ec47983ebae39bcc3c0fa87b83be.exe N/A
File created C:\windows\WallPapers.jpg C:\Users\Admin\AppData\Local\Temp\72b8ac452310da80b09c7e5ef25cdf1fa1b2ec47983ebae39bcc3c0fa87b83be.exe N/A

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\72b8ac452310da80b09c7e5ef25cdf1fa1b2ec47983ebae39bcc3c0fa87b83be.exe N/A

Modifies Internet Explorer settings

adware spyware
Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Software\Microsoft\Internet Explorer\Desktop\General C:\Users\Admin\AppData\Local\Temp\72b8ac452310da80b09c7e5ef25cdf1fa1b2ec47983ebae39bcc3c0fa87b83be.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\SOFTWARE\Microsoft\Internet Explorer\Desktop\General\WallpaperSource = "C:\\windows\\WallPapers.jpg" C:\Users\Admin\AppData\Local\Temp\72b8ac452310da80b09c7e5ef25cdf1fa1b2ec47983ebae39bcc3c0fa87b83be.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\72b8ac452310da80b09c7e5ef25cdf1fa1b2ec47983ebae39bcc3c0fa87b83be.exe

"C:\Users\Admin\AppData\Local\Temp\72b8ac452310da80b09c7e5ef25cdf1fa1b2ec47983ebae39bcc3c0fa87b83be.exe"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 4308 -ip 4308

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4308 -s 780

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 13.86.106.20.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 75.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 200.163.202.172.in-addr.arpa udp
US 8.8.8.8:53 171.39.242.20.in-addr.arpa udp
US 8.8.8.8:53 172.214.232.199.in-addr.arpa udp
US 8.8.8.8:53 31.243.111.52.in-addr.arpa udp

Files

memory/4308-0-0x0000000000400000-0x0000000000485000-memory.dmp

C:\Program Files\7-Zip\7z.exe

MD5 1aff57c81d0a2df9a9a05fe23b48e608
SHA1 7ab4bc30ab58d5c578ada6937fcb0bc959f3b252
SHA256 825d79982d2bebdaa769a139150b87297ab4af60281ed706427ff04cddbc7868
SHA512 844af374c32d82a137f6888996898201b938697e5bdf095b1e91f3a21bc8c8ca128d8dd18c8ab6042d43cecf705cb03bfe42f98556b700fd7be27f57d82ab38c

C:\Program Files\7-Zip\7z.cab

MD5 9a1dd1d96481d61934dcc2d568971d06
SHA1 f136ef9bf8bd2fc753292fb5b7cf173a22675fb3
SHA256 8cebb25e240db3b6986fcaed6bc0b900fa09dad763a56fb71273529266c5c525
SHA512 7ac1581f8a29e778ba1a1220670796c47fa5b838417f8f635e2cb1998a01515cff3ee57045dacb78a8ec70d43754b970743aba600379fe6d9481958d32d8a5aa

C:\Program Files\7-Zip\7zFM.cab

MD5 30ac0b832d75598fb3ec37b6f2a8c86a
SHA1 6f47dbfd6ff36df7ba581a4cef024da527dc3046
SHA256 1ea0839c8dc95ad2c060af7d042c40c0daed58ce8e4524c0fba12fd73e4afb74
SHA512 505870601a4389b7ed2c8fecf85835adfd2944cbc10801f74bc4e08f5a0d6ecc9a52052fc37e216304cd1655129021862294a698ed36b3b43d428698f7263057

C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.cab

MD5 b8d69fa2755c3ab1f12f8866a8e2a4f7
SHA1 8e3cdfb20e158c2906323ba0094a18c7dd2aaf2d
SHA256 7e0976036431640ae1d9f1c0b52bcea5dd37ef86cd3f5304dc8a96459d9483cd
SHA512 5acac46068b331216978500f67a7fa5257bc5b05133fab6d88280b670ae4885ef2d5d1f531169b66bf1952e082f56b1ad2bc3901479b740f96c53ea405adda18

C:\Program Files\Common Files\microsoft shared\ClickToRun\RCXB1A3.tmp

MD5 f92f6883ff4738d8f8710f414e623069
SHA1 29e1b67df116a5b5bb019bbe7a2a50edc1946b76
SHA256 23014d03cfa93eedc7df229f43a5969bc138a6475c80efe899efebfc1f526646
SHA512 945bdcf1a4ad9c36a180d0b9d8689c5f08f741e3036a02c5017227421d34e8e94d99a9bf216e0f3440bde25763a3824f6a4373de4ba8e7ab8b420ad42d61a274

memory/4308-68-0x0000000000400000-0x0000000000485000-memory.dmp