Analysis
- max time kernel
93s - max time network
149s - platform
windows10-2004_x64 - resource
win10v2004-20241007-en - resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system - submitted
14/11/2024, 01:55
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
314c52fc3ef69ee952e54c38157ea7451068a5361deb8782a54d03f59f722f65.exe
Resource
win7-20240903-en
windows7-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
314c52fc3ef69ee952e54c38157ea7451068a5361deb8782a54d03f59f722f65.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
8 signatures
150 seconds
General
- Target 314c52fc3ef69ee952e54c38157ea7451068a5361deb8782a54d03f59f722f65.exe
- Size 25KB
- Sample241114-ccf7qasgrb
- SHA256 314c52fc3ef69ee952e54c38157ea7451068a5361deb8782a54d03f59f722f65
- MD5 0aa91fb2d8f92135050decbfa80c8303
- SHA1 d757c6babb1ed008ec49a7960c2a8d72ec41b115
- SHA512 97f077acaf00e4f6f01b4ce589a9549528756aa0be4bae7d6db72bfbb8f5c5a57823b84cf125befe578a223692a14b0bf97739e4b075fb5907d8acf6de332455
- SSDEEP 384:4rUZuZXd1F89lhp8pEAb2Vw0CswuaAeGbwkKL4cX1PaAjqjtxCvwR:ibHEA70KuaAkZaBJTR
- MD5 SHA1 SHA512 SSDEEP
Score
9/10
Malware Config
Signatures
- Renames multiple (167) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
- Sets desktop wallpaper using registry 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\Desktop\Wallpaper = "C:\\ProgramData\\z.png" 314c52fc3ef69ee952e54c38157ea7451068a5361deb8782a54d03f59f722f65.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 314c52fc3ef69ee952e54c38157ea7451068a5361deb8782a54d03f59f722f65.exe - Modifies Control Panel 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\Desktop\WallpaperStyle = "\n" 314c52fc3ef69ee952e54c38157ea7451068a5361deb8782a54d03f59f722f65.exe Set value (str) \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\Desktop\TileWallpaper 314c52fc3ef69ee952e54c38157ea7451068a5361deb8782a54d03f59f722f65.exe - Modifies registry class 3 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.DARKSET\DefaultIcon 314c52fc3ef69ee952e54c38157ea7451068a5361deb8782a54d03f59f722f65.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.DARKSET 314c52fc3ef69ee952e54c38157ea7451068a5361deb8782a54d03f59f722f65.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.DARKSET\DefaultIcon\ = "C:\\ProgramData\\z.png" 314c52fc3ef69ee952e54c38157ea7451068a5361deb8782a54d03f59f722f65.exe - Opens file in notepad (likely ransom note) 1 IoCs
pid Process 4436 NOTEPAD.EXE - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3708 314c52fc3ef69ee952e54c38157ea7451068a5361deb8782a54d03f59f722f65.exe 3708 314c52fc3ef69ee952e54c38157ea7451068a5361deb8782a54d03f59f722f65.exe 3708 314c52fc3ef69ee952e54c38157ea7451068a5361deb8782a54d03f59f722f65.exe 3708 314c52fc3ef69ee952e54c38157ea7451068a5361deb8782a54d03f59f722f65.exe 3708 314c52fc3ef69ee952e54c38157ea7451068a5361deb8782a54d03f59f722f65.exe 3708 314c52fc3ef69ee952e54c38157ea7451068a5361deb8782a54d03f59f722f65.exe 3708 314c52fc3ef69ee952e54c38157ea7451068a5361deb8782a54d03f59f722f65.exe 3708 314c52fc3ef69ee952e54c38157ea7451068a5361deb8782a54d03f59f722f65.exe 3708 314c52fc3ef69ee952e54c38157ea7451068a5361deb8782a54d03f59f722f65.exe 3708 314c52fc3ef69ee952e54c38157ea7451068a5361deb8782a54d03f59f722f65.exe 3708 314c52fc3ef69ee952e54c38157ea7451068a5361deb8782a54d03f59f722f65.exe 3708 314c52fc3ef69ee952e54c38157ea7451068a5361deb8782a54d03f59f722f65.exe 3708 314c52fc3ef69ee952e54c38157ea7451068a5361deb8782a54d03f59f722f65.exe 3708 314c52fc3ef69ee952e54c38157ea7451068a5361deb8782a54d03f59f722f65.exe 3708 314c52fc3ef69ee952e54c38157ea7451068a5361deb8782a54d03f59f722f65.exe 3708 314c52fc3ef69ee952e54c38157ea7451068a5361deb8782a54d03f59f722f65.exe 3708 314c52fc3ef69ee952e54c38157ea7451068a5361deb8782a54d03f59f722f65.exe 3708 314c52fc3ef69ee952e54c38157ea7451068a5361deb8782a54d03f59f722f65.exe 3708 314c52fc3ef69ee952e54c38157ea7451068a5361deb8782a54d03f59f722f65.exe 3708 314c52fc3ef69ee952e54c38157ea7451068a5361deb8782a54d03f59f722f65.exe 3708 314c52fc3ef69ee952e54c38157ea7451068a5361deb8782a54d03f59f722f65.exe 3708 314c52fc3ef69ee952e54c38157ea7451068a5361deb8782a54d03f59f722f65.exe 3708 314c52fc3ef69ee952e54c38157ea7451068a5361deb8782a54d03f59f722f65.exe 3708 314c52fc3ef69ee952e54c38157ea7451068a5361deb8782a54d03f59f722f65.exe 3708 314c52fc3ef69ee952e54c38157ea7451068a5361deb8782a54d03f59f722f65.exe 3708 314c52fc3ef69ee952e54c38157ea7451068a5361deb8782a54d03f59f722f65.exe 3708 314c52fc3ef69ee952e54c38157ea7451068a5361deb8782a54d03f59f722f65.exe 3708 314c52fc3ef69ee952e54c38157ea7451068a5361deb8782a54d03f59f722f65.exe 3708 314c52fc3ef69ee952e54c38157ea7451068a5361deb8782a54d03f59f722f65.exe 3708 314c52fc3ef69ee952e54c38157ea7451068a5361deb8782a54d03f59f722f65.exe 3708 314c52fc3ef69ee952e54c38157ea7451068a5361deb8782a54d03f59f722f65.exe 3708 314c52fc3ef69ee952e54c38157ea7451068a5361deb8782a54d03f59f722f65.exe 3708 314c52fc3ef69ee952e54c38157ea7451068a5361deb8782a54d03f59f722f65.exe 3708 314c52fc3ef69ee952e54c38157ea7451068a5361deb8782a54d03f59f722f65.exe 3708 314c52fc3ef69ee952e54c38157ea7451068a5361deb8782a54d03f59f722f65.exe 3708 314c52fc3ef69ee952e54c38157ea7451068a5361deb8782a54d03f59f722f65.exe 3708 314c52fc3ef69ee952e54c38157ea7451068a5361deb8782a54d03f59f722f65.exe 3708 314c52fc3ef69ee952e54c38157ea7451068a5361deb8782a54d03f59f722f65.exe 3708 314c52fc3ef69ee952e54c38157ea7451068a5361deb8782a54d03f59f722f65.exe 3708 314c52fc3ef69ee952e54c38157ea7451068a5361deb8782a54d03f59f722f65.exe 3708 314c52fc3ef69ee952e54c38157ea7451068a5361deb8782a54d03f59f722f65.exe 3708 314c52fc3ef69ee952e54c38157ea7451068a5361deb8782a54d03f59f722f65.exe 3708 314c52fc3ef69ee952e54c38157ea7451068a5361deb8782a54d03f59f722f65.exe 3708 314c52fc3ef69ee952e54c38157ea7451068a5361deb8782a54d03f59f722f65.exe 3708 314c52fc3ef69ee952e54c38157ea7451068a5361deb8782a54d03f59f722f65.exe 3708 314c52fc3ef69ee952e54c38157ea7451068a5361deb8782a54d03f59f722f65.exe 3708 314c52fc3ef69ee952e54c38157ea7451068a5361deb8782a54d03f59f722f65.exe 3708 314c52fc3ef69ee952e54c38157ea7451068a5361deb8782a54d03f59f722f65.exe 3708 314c52fc3ef69ee952e54c38157ea7451068a5361deb8782a54d03f59f722f65.exe 3708 314c52fc3ef69ee952e54c38157ea7451068a5361deb8782a54d03f59f722f65.exe 3708 314c52fc3ef69ee952e54c38157ea7451068a5361deb8782a54d03f59f722f65.exe 3708 314c52fc3ef69ee952e54c38157ea7451068a5361deb8782a54d03f59f722f65.exe 3708 314c52fc3ef69ee952e54c38157ea7451068a5361deb8782a54d03f59f722f65.exe 3708 314c52fc3ef69ee952e54c38157ea7451068a5361deb8782a54d03f59f722f65.exe 3708 314c52fc3ef69ee952e54c38157ea7451068a5361deb8782a54d03f59f722f65.exe 3708 314c52fc3ef69ee952e54c38157ea7451068a5361deb8782a54d03f59f722f65.exe 3708 314c52fc3ef69ee952e54c38157ea7451068a5361deb8782a54d03f59f722f65.exe 3708 314c52fc3ef69ee952e54c38157ea7451068a5361deb8782a54d03f59f722f65.exe 3708 314c52fc3ef69ee952e54c38157ea7451068a5361deb8782a54d03f59f722f65.exe 3708 314c52fc3ef69ee952e54c38157ea7451068a5361deb8782a54d03f59f722f65.exe 3708 314c52fc3ef69ee952e54c38157ea7451068a5361deb8782a54d03f59f722f65.exe 3708 314c52fc3ef69ee952e54c38157ea7451068a5361deb8782a54d03f59f722f65.exe 3708 314c52fc3ef69ee952e54c38157ea7451068a5361deb8782a54d03f59f722f65.exe 3708 314c52fc3ef69ee952e54c38157ea7451068a5361deb8782a54d03f59f722f65.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeIncBasePriorityPrivilege 3708 314c52fc3ef69ee952e54c38157ea7451068a5361deb8782a54d03f59f722f65.exe Token: SeDebugPrivilege 3708 314c52fc3ef69ee952e54c38157ea7451068a5361deb8782a54d03f59f722f65.exe Token: SeDebugPrivilege 3708 314c52fc3ef69ee952e54c38157ea7451068a5361deb8782a54d03f59f722f65.exe Token: SeDebugPrivilege 3708 314c52fc3ef69ee952e54c38157ea7451068a5361deb8782a54d03f59f722f65.exe Token: SeDebugPrivilege 3708 314c52fc3ef69ee952e54c38157ea7451068a5361deb8782a54d03f59f722f65.exe Token: SeDebugPrivilege 3708 314c52fc3ef69ee952e54c38157ea7451068a5361deb8782a54d03f59f722f65.exe Token: SeDebugPrivilege 3708 314c52fc3ef69ee952e54c38157ea7451068a5361deb8782a54d03f59f722f65.exe Token: SeDebugPrivilege 3708 314c52fc3ef69ee952e54c38157ea7451068a5361deb8782a54d03f59f722f65.exe Token: SeDebugPrivilege 3708 314c52fc3ef69ee952e54c38157ea7451068a5361deb8782a54d03f59f722f65.exe Token: SeDebugPrivilege 3708 314c52fc3ef69ee952e54c38157ea7451068a5361deb8782a54d03f59f722f65.exe Token: SeDebugPrivilege 3708 314c52fc3ef69ee952e54c38157ea7451068a5361deb8782a54d03f59f722f65.exe Token: SeDebugPrivilege 3708 314c52fc3ef69ee952e54c38157ea7451068a5361deb8782a54d03f59f722f65.exe Token: SeDebugPrivilege 3708 314c52fc3ef69ee952e54c38157ea7451068a5361deb8782a54d03f59f722f65.exe Token: SeDebugPrivilege 3708 314c52fc3ef69ee952e54c38157ea7451068a5361deb8782a54d03f59f722f65.exe Token: SeDebugPrivilege 3708 314c52fc3ef69ee952e54c38157ea7451068a5361deb8782a54d03f59f722f65.exe Token: SeDebugPrivilege 3708 314c52fc3ef69ee952e54c38157ea7451068a5361deb8782a54d03f59f722f65.exe Token: SeDebugPrivilege 3708 314c52fc3ef69ee952e54c38157ea7451068a5361deb8782a54d03f59f722f65.exe Token: SeDebugPrivilege 3708 314c52fc3ef69ee952e54c38157ea7451068a5361deb8782a54d03f59f722f65.exe Token: SeDebugPrivilege 3708 314c52fc3ef69ee952e54c38157ea7451068a5361deb8782a54d03f59f722f65.exe Token: SeDebugPrivilege 3708 314c52fc3ef69ee952e54c38157ea7451068a5361deb8782a54d03f59f722f65.exe Token: SeDebugPrivilege 3708 314c52fc3ef69ee952e54c38157ea7451068a5361deb8782a54d03f59f722f65.exe Token: SeDebugPrivilege 3708 314c52fc3ef69ee952e54c38157ea7451068a5361deb8782a54d03f59f722f65.exe Token: SeDebugPrivilege 3708 314c52fc3ef69ee952e54c38157ea7451068a5361deb8782a54d03f59f722f65.exe Token: SeDebugPrivilege 3708 314c52fc3ef69ee952e54c38157ea7451068a5361deb8782a54d03f59f722f65.exe Token: SeDebugPrivilege 3708 314c52fc3ef69ee952e54c38157ea7451068a5361deb8782a54d03f59f722f65.exe Token: SeDebugPrivilege 3708 314c52fc3ef69ee952e54c38157ea7451068a5361deb8782a54d03f59f722f65.exe Token: SeDebugPrivilege 3708 314c52fc3ef69ee952e54c38157ea7451068a5361deb8782a54d03f59f722f65.exe Token: SeDebugPrivilege 3708 314c52fc3ef69ee952e54c38157ea7451068a5361deb8782a54d03f59f722f65.exe Token: SeDebugPrivilege 3708 314c52fc3ef69ee952e54c38157ea7451068a5361deb8782a54d03f59f722f65.exe Token: SeDebugPrivilege 3708 314c52fc3ef69ee952e54c38157ea7451068a5361deb8782a54d03f59f722f65.exe Token: SeDebugPrivilege 3708 314c52fc3ef69ee952e54c38157ea7451068a5361deb8782a54d03f59f722f65.exe Token: SeDebugPrivilege 3708 314c52fc3ef69ee952e54c38157ea7451068a5361deb8782a54d03f59f722f65.exe Token: SeDebugPrivilege 3708 314c52fc3ef69ee952e54c38157ea7451068a5361deb8782a54d03f59f722f65.exe Token: SeDebugPrivilege 3708 314c52fc3ef69ee952e54c38157ea7451068a5361deb8782a54d03f59f722f65.exe Token: SeDebugPrivilege 3708 314c52fc3ef69ee952e54c38157ea7451068a5361deb8782a54d03f59f722f65.exe Token: SeDebugPrivilege 3708 314c52fc3ef69ee952e54c38157ea7451068a5361deb8782a54d03f59f722f65.exe Token: SeDebugPrivilege 3708 314c52fc3ef69ee952e54c38157ea7451068a5361deb8782a54d03f59f722f65.exe Token: SeDebugPrivilege 3708 314c52fc3ef69ee952e54c38157ea7451068a5361deb8782a54d03f59f722f65.exe Token: SeDebugPrivilege 3708 314c52fc3ef69ee952e54c38157ea7451068a5361deb8782a54d03f59f722f65.exe Token: SeDebugPrivilege 3708 314c52fc3ef69ee952e54c38157ea7451068a5361deb8782a54d03f59f722f65.exe Token: SeDebugPrivilege 3708 314c52fc3ef69ee952e54c38157ea7451068a5361deb8782a54d03f59f722f65.exe Token: SeDebugPrivilege 3708 314c52fc3ef69ee952e54c38157ea7451068a5361deb8782a54d03f59f722f65.exe Token: SeDebugPrivilege 3708 314c52fc3ef69ee952e54c38157ea7451068a5361deb8782a54d03f59f722f65.exe Token: SeDebugPrivilege 3708 314c52fc3ef69ee952e54c38157ea7451068a5361deb8782a54d03f59f722f65.exe Token: SeDebugPrivilege 3708 314c52fc3ef69ee952e54c38157ea7451068a5361deb8782a54d03f59f722f65.exe Token: SeDebugPrivilege 3708 314c52fc3ef69ee952e54c38157ea7451068a5361deb8782a54d03f59f722f65.exe Token: SeDebugPrivilege 3708 314c52fc3ef69ee952e54c38157ea7451068a5361deb8782a54d03f59f722f65.exe Token: SeDebugPrivilege 3708 314c52fc3ef69ee952e54c38157ea7451068a5361deb8782a54d03f59f722f65.exe Token: SeDebugPrivilege 3708 314c52fc3ef69ee952e54c38157ea7451068a5361deb8782a54d03f59f722f65.exe Token: SeDebugPrivilege 3708 314c52fc3ef69ee952e54c38157ea7451068a5361deb8782a54d03f59f722f65.exe Token: SeDebugPrivilege 3708 314c52fc3ef69ee952e54c38157ea7451068a5361deb8782a54d03f59f722f65.exe Token: SeDebugPrivilege 3708 314c52fc3ef69ee952e54c38157ea7451068a5361deb8782a54d03f59f722f65.exe Token: SeDebugPrivilege 3708 314c52fc3ef69ee952e54c38157ea7451068a5361deb8782a54d03f59f722f65.exe Token: SeDebugPrivilege 3708 314c52fc3ef69ee952e54c38157ea7451068a5361deb8782a54d03f59f722f65.exe Token: SeDebugPrivilege 3708 314c52fc3ef69ee952e54c38157ea7451068a5361deb8782a54d03f59f722f65.exe Token: SeDebugPrivilege 3708 314c52fc3ef69ee952e54c38157ea7451068a5361deb8782a54d03f59f722f65.exe Token: SeDebugPrivilege 3708 314c52fc3ef69ee952e54c38157ea7451068a5361deb8782a54d03f59f722f65.exe Token: SeDebugPrivilege 3708 314c52fc3ef69ee952e54c38157ea7451068a5361deb8782a54d03f59f722f65.exe Token: SeDebugPrivilege 3708 314c52fc3ef69ee952e54c38157ea7451068a5361deb8782a54d03f59f722f65.exe Token: SeDebugPrivilege 3708 314c52fc3ef69ee952e54c38157ea7451068a5361deb8782a54d03f59f722f65.exe Token: SeDebugPrivilege 3708 314c52fc3ef69ee952e54c38157ea7451068a5361deb8782a54d03f59f722f65.exe Token: SeDebugPrivilege 3708 314c52fc3ef69ee952e54c38157ea7451068a5361deb8782a54d03f59f722f65.exe Token: SeDebugPrivilege 3708 314c52fc3ef69ee952e54c38157ea7451068a5361deb8782a54d03f59f722f65.exe Token: SeDebugPrivilege 3708 314c52fc3ef69ee952e54c38157ea7451068a5361deb8782a54d03f59f722f65.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\314c52fc3ef69ee952e54c38157ea7451068a5361deb8782a54d03f59f722f65.exe"C:\Users\Admin\AppData\Local\Temp\314c52fc3ef69ee952e54c38157ea7451068a5361deb8782a54d03f59f722f65.exe"1⤵
- Sets desktop wallpaper using registry
- System Location Discovery: System Language Discovery
- Modifies Control Panel
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3708
-
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\ReadMe.txt1⤵
- Opens file in notepad (likely ransom note)
PID:4436
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\ReadMe.txt
- Size 553B
- SHA256 ff3d090168dcfce1cfc375e67699d2a68a60d8dcc7c9d1b8ba708b9e4cb00cbd
- MD5 85340bd19cfa5baea16d08fc6e80ae15
- SHA1 b66db47a9ac34e865b59a4f47825fc9b2c003f1b
- SHA512 f5bf6da3f248ffe70f16ae79df341f68968b4a6a265fc5e532b01618b39041da8eb25fc707bf5a430e3c3aa7ab73106a6b067d48654900ac6cefa30f4c10ec97
- MD5 SHA1 SHA512