Analysis
- max time kernel
148s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20241007-en - resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system - submitted
14/11/2024, 00:35
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
314c52fc3ef69ee952e54c38157ea7451068a5361deb8782a54d03f59f722f65.exe
Resource
win7-20240903-en
windows7-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
314c52fc3ef69ee952e54c38157ea7451068a5361deb8782a54d03f59f722f65.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
7 signatures
150 seconds
General
- Target 314c52fc3ef69ee952e54c38157ea7451068a5361deb8782a54d03f59f722f65.exe
- Size 25KB
- Sample241114-axb3dssbkc
- SHA256 314c52fc3ef69ee952e54c38157ea7451068a5361deb8782a54d03f59f722f65
- MD5 0aa91fb2d8f92135050decbfa80c8303
- SHA1 d757c6babb1ed008ec49a7960c2a8d72ec41b115
- SHA512 97f077acaf00e4f6f01b4ce589a9549528756aa0be4bae7d6db72bfbb8f5c5a57823b84cf125befe578a223692a14b0bf97739e4b075fb5907d8acf6de332455
- SSDEEP 384:4rUZuZXd1F89lhp8pEAb2Vw0CswuaAeGbwkKL4cX1PaAjqjtxCvwR:ibHEA70KuaAkZaBJTR
- MD5 SHA1 SHA512 SSDEEP
Score
9/10
Malware Config
Signatures
- Renames multiple (163) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
- Sets desktop wallpaper using registry 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\Desktop\Wallpaper = "C:\\ProgramData\\z.png" 314c52fc3ef69ee952e54c38157ea7451068a5361deb8782a54d03f59f722f65.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 314c52fc3ef69ee952e54c38157ea7451068a5361deb8782a54d03f59f722f65.exe - Modifies Control Panel 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\Desktop\WallpaperStyle = "\n" 314c52fc3ef69ee952e54c38157ea7451068a5361deb8782a54d03f59f722f65.exe Set value (str) \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\Desktop\TileWallpaper 314c52fc3ef69ee952e54c38157ea7451068a5361deb8782a54d03f59f722f65.exe - Modifies registry class 3 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.DARKSET\DefaultIcon 314c52fc3ef69ee952e54c38157ea7451068a5361deb8782a54d03f59f722f65.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.DARKSET 314c52fc3ef69ee952e54c38157ea7451068a5361deb8782a54d03f59f722f65.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.DARKSET\DefaultIcon\ = "C:\\ProgramData\\z.png" 314c52fc3ef69ee952e54c38157ea7451068a5361deb8782a54d03f59f722f65.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1136 314c52fc3ef69ee952e54c38157ea7451068a5361deb8782a54d03f59f722f65.exe 1136 314c52fc3ef69ee952e54c38157ea7451068a5361deb8782a54d03f59f722f65.exe 1136 314c52fc3ef69ee952e54c38157ea7451068a5361deb8782a54d03f59f722f65.exe 1136 314c52fc3ef69ee952e54c38157ea7451068a5361deb8782a54d03f59f722f65.exe 1136 314c52fc3ef69ee952e54c38157ea7451068a5361deb8782a54d03f59f722f65.exe 1136 314c52fc3ef69ee952e54c38157ea7451068a5361deb8782a54d03f59f722f65.exe 1136 314c52fc3ef69ee952e54c38157ea7451068a5361deb8782a54d03f59f722f65.exe 1136 314c52fc3ef69ee952e54c38157ea7451068a5361deb8782a54d03f59f722f65.exe 1136 314c52fc3ef69ee952e54c38157ea7451068a5361deb8782a54d03f59f722f65.exe 1136 314c52fc3ef69ee952e54c38157ea7451068a5361deb8782a54d03f59f722f65.exe 1136 314c52fc3ef69ee952e54c38157ea7451068a5361deb8782a54d03f59f722f65.exe 1136 314c52fc3ef69ee952e54c38157ea7451068a5361deb8782a54d03f59f722f65.exe 1136 314c52fc3ef69ee952e54c38157ea7451068a5361deb8782a54d03f59f722f65.exe 1136 314c52fc3ef69ee952e54c38157ea7451068a5361deb8782a54d03f59f722f65.exe 1136 314c52fc3ef69ee952e54c38157ea7451068a5361deb8782a54d03f59f722f65.exe 1136 314c52fc3ef69ee952e54c38157ea7451068a5361deb8782a54d03f59f722f65.exe 1136 314c52fc3ef69ee952e54c38157ea7451068a5361deb8782a54d03f59f722f65.exe 1136 314c52fc3ef69ee952e54c38157ea7451068a5361deb8782a54d03f59f722f65.exe 1136 314c52fc3ef69ee952e54c38157ea7451068a5361deb8782a54d03f59f722f65.exe 1136 314c52fc3ef69ee952e54c38157ea7451068a5361deb8782a54d03f59f722f65.exe 1136 314c52fc3ef69ee952e54c38157ea7451068a5361deb8782a54d03f59f722f65.exe 1136 314c52fc3ef69ee952e54c38157ea7451068a5361deb8782a54d03f59f722f65.exe 1136 314c52fc3ef69ee952e54c38157ea7451068a5361deb8782a54d03f59f722f65.exe 1136 314c52fc3ef69ee952e54c38157ea7451068a5361deb8782a54d03f59f722f65.exe 1136 314c52fc3ef69ee952e54c38157ea7451068a5361deb8782a54d03f59f722f65.exe 1136 314c52fc3ef69ee952e54c38157ea7451068a5361deb8782a54d03f59f722f65.exe 1136 314c52fc3ef69ee952e54c38157ea7451068a5361deb8782a54d03f59f722f65.exe 1136 314c52fc3ef69ee952e54c38157ea7451068a5361deb8782a54d03f59f722f65.exe 1136 314c52fc3ef69ee952e54c38157ea7451068a5361deb8782a54d03f59f722f65.exe 1136 314c52fc3ef69ee952e54c38157ea7451068a5361deb8782a54d03f59f722f65.exe 1136 314c52fc3ef69ee952e54c38157ea7451068a5361deb8782a54d03f59f722f65.exe 1136 314c52fc3ef69ee952e54c38157ea7451068a5361deb8782a54d03f59f722f65.exe 1136 314c52fc3ef69ee952e54c38157ea7451068a5361deb8782a54d03f59f722f65.exe 1136 314c52fc3ef69ee952e54c38157ea7451068a5361deb8782a54d03f59f722f65.exe 1136 314c52fc3ef69ee952e54c38157ea7451068a5361deb8782a54d03f59f722f65.exe 1136 314c52fc3ef69ee952e54c38157ea7451068a5361deb8782a54d03f59f722f65.exe 1136 314c52fc3ef69ee952e54c38157ea7451068a5361deb8782a54d03f59f722f65.exe 1136 314c52fc3ef69ee952e54c38157ea7451068a5361deb8782a54d03f59f722f65.exe 1136 314c52fc3ef69ee952e54c38157ea7451068a5361deb8782a54d03f59f722f65.exe 1136 314c52fc3ef69ee952e54c38157ea7451068a5361deb8782a54d03f59f722f65.exe 1136 314c52fc3ef69ee952e54c38157ea7451068a5361deb8782a54d03f59f722f65.exe 1136 314c52fc3ef69ee952e54c38157ea7451068a5361deb8782a54d03f59f722f65.exe 1136 314c52fc3ef69ee952e54c38157ea7451068a5361deb8782a54d03f59f722f65.exe 1136 314c52fc3ef69ee952e54c38157ea7451068a5361deb8782a54d03f59f722f65.exe 1136 314c52fc3ef69ee952e54c38157ea7451068a5361deb8782a54d03f59f722f65.exe 1136 314c52fc3ef69ee952e54c38157ea7451068a5361deb8782a54d03f59f722f65.exe 1136 314c52fc3ef69ee952e54c38157ea7451068a5361deb8782a54d03f59f722f65.exe 1136 314c52fc3ef69ee952e54c38157ea7451068a5361deb8782a54d03f59f722f65.exe 1136 314c52fc3ef69ee952e54c38157ea7451068a5361deb8782a54d03f59f722f65.exe 1136 314c52fc3ef69ee952e54c38157ea7451068a5361deb8782a54d03f59f722f65.exe 1136 314c52fc3ef69ee952e54c38157ea7451068a5361deb8782a54d03f59f722f65.exe 1136 314c52fc3ef69ee952e54c38157ea7451068a5361deb8782a54d03f59f722f65.exe 1136 314c52fc3ef69ee952e54c38157ea7451068a5361deb8782a54d03f59f722f65.exe 1136 314c52fc3ef69ee952e54c38157ea7451068a5361deb8782a54d03f59f722f65.exe 1136 314c52fc3ef69ee952e54c38157ea7451068a5361deb8782a54d03f59f722f65.exe 1136 314c52fc3ef69ee952e54c38157ea7451068a5361deb8782a54d03f59f722f65.exe 1136 314c52fc3ef69ee952e54c38157ea7451068a5361deb8782a54d03f59f722f65.exe 1136 314c52fc3ef69ee952e54c38157ea7451068a5361deb8782a54d03f59f722f65.exe 1136 314c52fc3ef69ee952e54c38157ea7451068a5361deb8782a54d03f59f722f65.exe 1136 314c52fc3ef69ee952e54c38157ea7451068a5361deb8782a54d03f59f722f65.exe 1136 314c52fc3ef69ee952e54c38157ea7451068a5361deb8782a54d03f59f722f65.exe 1136 314c52fc3ef69ee952e54c38157ea7451068a5361deb8782a54d03f59f722f65.exe 1136 314c52fc3ef69ee952e54c38157ea7451068a5361deb8782a54d03f59f722f65.exe 1136 314c52fc3ef69ee952e54c38157ea7451068a5361deb8782a54d03f59f722f65.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeIncBasePriorityPrivilege 1136 314c52fc3ef69ee952e54c38157ea7451068a5361deb8782a54d03f59f722f65.exe Token: SeDebugPrivilege 1136 314c52fc3ef69ee952e54c38157ea7451068a5361deb8782a54d03f59f722f65.exe Token: SeDebugPrivilege 1136 314c52fc3ef69ee952e54c38157ea7451068a5361deb8782a54d03f59f722f65.exe Token: SeDebugPrivilege 1136 314c52fc3ef69ee952e54c38157ea7451068a5361deb8782a54d03f59f722f65.exe Token: SeDebugPrivilege 1136 314c52fc3ef69ee952e54c38157ea7451068a5361deb8782a54d03f59f722f65.exe Token: SeDebugPrivilege 1136 314c52fc3ef69ee952e54c38157ea7451068a5361deb8782a54d03f59f722f65.exe Token: SeDebugPrivilege 1136 314c52fc3ef69ee952e54c38157ea7451068a5361deb8782a54d03f59f722f65.exe Token: SeDebugPrivilege 1136 314c52fc3ef69ee952e54c38157ea7451068a5361deb8782a54d03f59f722f65.exe Token: SeDebugPrivilege 1136 314c52fc3ef69ee952e54c38157ea7451068a5361deb8782a54d03f59f722f65.exe Token: SeDebugPrivilege 1136 314c52fc3ef69ee952e54c38157ea7451068a5361deb8782a54d03f59f722f65.exe Token: SeDebugPrivilege 1136 314c52fc3ef69ee952e54c38157ea7451068a5361deb8782a54d03f59f722f65.exe Token: SeDebugPrivilege 1136 314c52fc3ef69ee952e54c38157ea7451068a5361deb8782a54d03f59f722f65.exe Token: SeDebugPrivilege 1136 314c52fc3ef69ee952e54c38157ea7451068a5361deb8782a54d03f59f722f65.exe Token: SeDebugPrivilege 1136 314c52fc3ef69ee952e54c38157ea7451068a5361deb8782a54d03f59f722f65.exe Token: SeDebugPrivilege 1136 314c52fc3ef69ee952e54c38157ea7451068a5361deb8782a54d03f59f722f65.exe Token: SeDebugPrivilege 1136 314c52fc3ef69ee952e54c38157ea7451068a5361deb8782a54d03f59f722f65.exe Token: SeDebugPrivilege 1136 314c52fc3ef69ee952e54c38157ea7451068a5361deb8782a54d03f59f722f65.exe Token: SeDebugPrivilege 1136 314c52fc3ef69ee952e54c38157ea7451068a5361deb8782a54d03f59f722f65.exe Token: SeDebugPrivilege 1136 314c52fc3ef69ee952e54c38157ea7451068a5361deb8782a54d03f59f722f65.exe Token: SeDebugPrivilege 1136 314c52fc3ef69ee952e54c38157ea7451068a5361deb8782a54d03f59f722f65.exe Token: SeDebugPrivilege 1136 314c52fc3ef69ee952e54c38157ea7451068a5361deb8782a54d03f59f722f65.exe Token: SeDebugPrivilege 1136 314c52fc3ef69ee952e54c38157ea7451068a5361deb8782a54d03f59f722f65.exe Token: SeDebugPrivilege 1136 314c52fc3ef69ee952e54c38157ea7451068a5361deb8782a54d03f59f722f65.exe Token: SeDebugPrivilege 1136 314c52fc3ef69ee952e54c38157ea7451068a5361deb8782a54d03f59f722f65.exe Token: SeDebugPrivilege 1136 314c52fc3ef69ee952e54c38157ea7451068a5361deb8782a54d03f59f722f65.exe Token: SeDebugPrivilege 1136 314c52fc3ef69ee952e54c38157ea7451068a5361deb8782a54d03f59f722f65.exe Token: SeDebugPrivilege 1136 314c52fc3ef69ee952e54c38157ea7451068a5361deb8782a54d03f59f722f65.exe Token: SeDebugPrivilege 1136 314c52fc3ef69ee952e54c38157ea7451068a5361deb8782a54d03f59f722f65.exe Token: SeDebugPrivilege 1136 314c52fc3ef69ee952e54c38157ea7451068a5361deb8782a54d03f59f722f65.exe Token: SeDebugPrivilege 1136 314c52fc3ef69ee952e54c38157ea7451068a5361deb8782a54d03f59f722f65.exe Token: SeDebugPrivilege 1136 314c52fc3ef69ee952e54c38157ea7451068a5361deb8782a54d03f59f722f65.exe Token: SeDebugPrivilege 1136 314c52fc3ef69ee952e54c38157ea7451068a5361deb8782a54d03f59f722f65.exe Token: SeDebugPrivilege 1136 314c52fc3ef69ee952e54c38157ea7451068a5361deb8782a54d03f59f722f65.exe Token: SeDebugPrivilege 1136 314c52fc3ef69ee952e54c38157ea7451068a5361deb8782a54d03f59f722f65.exe Token: SeDebugPrivilege 1136 314c52fc3ef69ee952e54c38157ea7451068a5361deb8782a54d03f59f722f65.exe Token: SeDebugPrivilege 1136 314c52fc3ef69ee952e54c38157ea7451068a5361deb8782a54d03f59f722f65.exe Token: SeDebugPrivilege 1136 314c52fc3ef69ee952e54c38157ea7451068a5361deb8782a54d03f59f722f65.exe Token: SeDebugPrivilege 1136 314c52fc3ef69ee952e54c38157ea7451068a5361deb8782a54d03f59f722f65.exe Token: SeDebugPrivilege 1136 314c52fc3ef69ee952e54c38157ea7451068a5361deb8782a54d03f59f722f65.exe Token: SeDebugPrivilege 1136 314c52fc3ef69ee952e54c38157ea7451068a5361deb8782a54d03f59f722f65.exe Token: SeDebugPrivilege 1136 314c52fc3ef69ee952e54c38157ea7451068a5361deb8782a54d03f59f722f65.exe Token: SeDebugPrivilege 1136 314c52fc3ef69ee952e54c38157ea7451068a5361deb8782a54d03f59f722f65.exe Token: SeDebugPrivilege 1136 314c52fc3ef69ee952e54c38157ea7451068a5361deb8782a54d03f59f722f65.exe Token: SeDebugPrivilege 1136 314c52fc3ef69ee952e54c38157ea7451068a5361deb8782a54d03f59f722f65.exe Token: SeDebugPrivilege 1136 314c52fc3ef69ee952e54c38157ea7451068a5361deb8782a54d03f59f722f65.exe Token: SeDebugPrivilege 1136 314c52fc3ef69ee952e54c38157ea7451068a5361deb8782a54d03f59f722f65.exe Token: SeDebugPrivilege 1136 314c52fc3ef69ee952e54c38157ea7451068a5361deb8782a54d03f59f722f65.exe Token: SeDebugPrivilege 1136 314c52fc3ef69ee952e54c38157ea7451068a5361deb8782a54d03f59f722f65.exe Token: SeDebugPrivilege 1136 314c52fc3ef69ee952e54c38157ea7451068a5361deb8782a54d03f59f722f65.exe Token: SeDebugPrivilege 1136 314c52fc3ef69ee952e54c38157ea7451068a5361deb8782a54d03f59f722f65.exe Token: SeDebugPrivilege 1136 314c52fc3ef69ee952e54c38157ea7451068a5361deb8782a54d03f59f722f65.exe Token: SeDebugPrivilege 1136 314c52fc3ef69ee952e54c38157ea7451068a5361deb8782a54d03f59f722f65.exe Token: SeDebugPrivilege 1136 314c52fc3ef69ee952e54c38157ea7451068a5361deb8782a54d03f59f722f65.exe Token: SeDebugPrivilege 1136 314c52fc3ef69ee952e54c38157ea7451068a5361deb8782a54d03f59f722f65.exe Token: SeDebugPrivilege 1136 314c52fc3ef69ee952e54c38157ea7451068a5361deb8782a54d03f59f722f65.exe Token: SeDebugPrivilege 1136 314c52fc3ef69ee952e54c38157ea7451068a5361deb8782a54d03f59f722f65.exe Token: SeDebugPrivilege 1136 314c52fc3ef69ee952e54c38157ea7451068a5361deb8782a54d03f59f722f65.exe Token: SeDebugPrivilege 1136 314c52fc3ef69ee952e54c38157ea7451068a5361deb8782a54d03f59f722f65.exe Token: SeDebugPrivilege 1136 314c52fc3ef69ee952e54c38157ea7451068a5361deb8782a54d03f59f722f65.exe Token: SeDebugPrivilege 1136 314c52fc3ef69ee952e54c38157ea7451068a5361deb8782a54d03f59f722f65.exe Token: SeDebugPrivilege 1136 314c52fc3ef69ee952e54c38157ea7451068a5361deb8782a54d03f59f722f65.exe Token: SeDebugPrivilege 1136 314c52fc3ef69ee952e54c38157ea7451068a5361deb8782a54d03f59f722f65.exe Token: SeDebugPrivilege 1136 314c52fc3ef69ee952e54c38157ea7451068a5361deb8782a54d03f59f722f65.exe Token: SeDebugPrivilege 1136 314c52fc3ef69ee952e54c38157ea7451068a5361deb8782a54d03f59f722f65.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\314c52fc3ef69ee952e54c38157ea7451068a5361deb8782a54d03f59f722f65.exe"C:\Users\Admin\AppData\Local\Temp\314c52fc3ef69ee952e54c38157ea7451068a5361deb8782a54d03f59f722f65.exe"1⤵
- Sets desktop wallpaper using registry
- System Location Discovery: System Language Discovery
- Modifies Control Panel
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1136
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\ReadMe.txt
- Size 553B
- SHA256 a4935c44cd602fa2337af74b1dca24e284126d0526d93a35427d1b04ff119516
- MD5 65cb50035da49a040f4f5e090bc6eacb
- SHA1 871ff1f10b33e61adbe617a9cca5a4c8faaa7640
- SHA512 47415b00eb2935fa11e237e1de28d589d7279ff3303348ad1e627a66d39ca9d561ea6405cffbe0580cedde08fda09dadd519890195d8c2c9535043f52a75eb59
- MD5 SHA1 SHA512