Analysis
-
max time kernel
118s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20241023-en -
resource tags
arch:x64arch:x86image:win7-20241023-enlocale:en-usos:windows7-x64system -
submitted
21-11-2024 20:45
Behavioral task
behavioral1
Sample
0845a8c3be602a72e23a155b23ad554495bd558fa79e1bb849aa75f79d069194.exe
Resource
win7-20241023-en
windows7-x64
17 signatures
150 seconds
Behavioral task
behavioral2
Sample
0845a8c3be602a72e23a155b23ad554495bd558fa79e1bb849aa75f79d069194.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
17 signatures
150 seconds
General
-
Target
0845a8c3be602a72e23a155b23ad554495bd558fa79e1bb849aa75f79d069194.exe
-
Size
146KB
-
MD5
33228a20a7e985f02e2ddd73cccde729
-
SHA1
58ab960e629a609d135e1988c72f2991e5f76e30
-
SHA256
0845a8c3be602a72e23a155b23ad554495bd558fa79e1bb849aa75f79d069194
-
SHA512
075002dd1b0f8e536c1ff99d30368f5adfc90a2f3e7a74c9770119e7b54a5851236657b7edcb735d457e78a7e67b7c285b6ceaa6ca2907542ac208dfc8c9aabe
-
SSDEEP
3072:36glyuxE4GsUPnliByocWepqFPUBwrqveV84:36gDBGpvEByocWe8MB4G
Malware Config
Signatures
-
Renames multiple (341) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Deletes itself 1 IoCs
pid Process 1120 537D.tmp -
Executes dropped EXE 1 IoCs
pid Process 1120 537D.tmp -
Loads dropped DLL 1 IoCs
pid Process 2800 0845a8c3be602a72e23a155b23ad554495bd558fa79e1bb849aa75f79d069194.exe -
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops desktop.ini file(s) 2 IoCs
description ioc Process File opened for modification C:\$Recycle.Bin\S-1-5-21-1163522206-1469769407-485553996-1000\desktop.ini 0845a8c3be602a72e23a155b23ad554495bd558fa79e1bb849aa75f79d069194.exe File opened for modification F:\$RECYCLE.BIN\S-1-5-21-1163522206-1469769407-485553996-1000\desktop.ini 0845a8c3be602a72e23a155b23ad554495bd558fa79e1bb849aa75f79d069194.exe -
Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
-
Sets desktop wallpaper using registry 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Control Panel\Desktop\WallPaper = "C:\\ProgramData\\AFfGduKAp.bmp" 0845a8c3be602a72e23a155b23ad554495bd558fa79e1bb849aa75f79d069194.exe Set value (str) \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Control Panel\Desktop\Wallpaper = "C:\\ProgramData\\AFfGduKAp.bmp" 0845a8c3be602a72e23a155b23ad554495bd558fa79e1bb849aa75f79d069194.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 5 IoCs
pid Process 2800 0845a8c3be602a72e23a155b23ad554495bd558fa79e1bb849aa75f79d069194.exe 2800 0845a8c3be602a72e23a155b23ad554495bd558fa79e1bb849aa75f79d069194.exe 2800 0845a8c3be602a72e23a155b23ad554495bd558fa79e1bb849aa75f79d069194.exe 2800 0845a8c3be602a72e23a155b23ad554495bd558fa79e1bb849aa75f79d069194.exe 1120 537D.tmp -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 0845a8c3be602a72e23a155b23ad554495bd558fa79e1bb849aa75f79d069194.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 537D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe -
Modifies Control Panel 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Control Panel\Desktop 0845a8c3be602a72e23a155b23ad554495bd558fa79e1bb849aa75f79d069194.exe Set value (str) \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Control Panel\Desktop\WallpaperStyle = "10" 0845a8c3be602a72e23a155b23ad554495bd558fa79e1bb849aa75f79d069194.exe -
Modifies registry class 5 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\AFfGduKAp\DefaultIcon 0845a8c3be602a72e23a155b23ad554495bd558fa79e1bb849aa75f79d069194.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\AFfGduKAp 0845a8c3be602a72e23a155b23ad554495bd558fa79e1bb849aa75f79d069194.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\AFfGduKAp\DefaultIcon\ = "C:\\ProgramData\\AFfGduKAp.ico" 0845a8c3be602a72e23a155b23ad554495bd558fa79e1bb849aa75f79d069194.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.AFfGduKAp 0845a8c3be602a72e23a155b23ad554495bd558fa79e1bb849aa75f79d069194.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.AFfGduKAp\ = "AFfGduKAp" 0845a8c3be602a72e23a155b23ad554495bd558fa79e1bb849aa75f79d069194.exe -
Suspicious behavior: EnumeratesProcesses 14 IoCs
pid Process 2800 0845a8c3be602a72e23a155b23ad554495bd558fa79e1bb849aa75f79d069194.exe 2800 0845a8c3be602a72e23a155b23ad554495bd558fa79e1bb849aa75f79d069194.exe 2800 0845a8c3be602a72e23a155b23ad554495bd558fa79e1bb849aa75f79d069194.exe 2800 0845a8c3be602a72e23a155b23ad554495bd558fa79e1bb849aa75f79d069194.exe 2800 0845a8c3be602a72e23a155b23ad554495bd558fa79e1bb849aa75f79d069194.exe 2800 0845a8c3be602a72e23a155b23ad554495bd558fa79e1bb849aa75f79d069194.exe 2800 0845a8c3be602a72e23a155b23ad554495bd558fa79e1bb849aa75f79d069194.exe 2800 0845a8c3be602a72e23a155b23ad554495bd558fa79e1bb849aa75f79d069194.exe 2800 0845a8c3be602a72e23a155b23ad554495bd558fa79e1bb849aa75f79d069194.exe 2800 0845a8c3be602a72e23a155b23ad554495bd558fa79e1bb849aa75f79d069194.exe 2800 0845a8c3be602a72e23a155b23ad554495bd558fa79e1bb849aa75f79d069194.exe 2800 0845a8c3be602a72e23a155b23ad554495bd558fa79e1bb849aa75f79d069194.exe 2800 0845a8c3be602a72e23a155b23ad554495bd558fa79e1bb849aa75f79d069194.exe 2800 0845a8c3be602a72e23a155b23ad554495bd558fa79e1bb849aa75f79d069194.exe -
Suspicious behavior: RenamesItself 26 IoCs
pid Process 1120 537D.tmp 1120 537D.tmp 1120 537D.tmp 1120 537D.tmp 1120 537D.tmp 1120 537D.tmp 1120 537D.tmp 1120 537D.tmp 1120 537D.tmp 1120 537D.tmp 1120 537D.tmp 1120 537D.tmp 1120 537D.tmp 1120 537D.tmp 1120 537D.tmp 1120 537D.tmp 1120 537D.tmp 1120 537D.tmp 1120 537D.tmp 1120 537D.tmp 1120 537D.tmp 1120 537D.tmp 1120 537D.tmp 1120 537D.tmp 1120 537D.tmp 1120 537D.tmp -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeAssignPrimaryTokenPrivilege 2800 0845a8c3be602a72e23a155b23ad554495bd558fa79e1bb849aa75f79d069194.exe Token: SeBackupPrivilege 2800 0845a8c3be602a72e23a155b23ad554495bd558fa79e1bb849aa75f79d069194.exe Token: SeDebugPrivilege 2800 0845a8c3be602a72e23a155b23ad554495bd558fa79e1bb849aa75f79d069194.exe Token: 36 2800 0845a8c3be602a72e23a155b23ad554495bd558fa79e1bb849aa75f79d069194.exe Token: SeImpersonatePrivilege 2800 0845a8c3be602a72e23a155b23ad554495bd558fa79e1bb849aa75f79d069194.exe Token: SeIncBasePriorityPrivilege 2800 0845a8c3be602a72e23a155b23ad554495bd558fa79e1bb849aa75f79d069194.exe Token: SeIncreaseQuotaPrivilege 2800 0845a8c3be602a72e23a155b23ad554495bd558fa79e1bb849aa75f79d069194.exe Token: 33 2800 0845a8c3be602a72e23a155b23ad554495bd558fa79e1bb849aa75f79d069194.exe Token: SeManageVolumePrivilege 2800 0845a8c3be602a72e23a155b23ad554495bd558fa79e1bb849aa75f79d069194.exe Token: SeProfSingleProcessPrivilege 2800 0845a8c3be602a72e23a155b23ad554495bd558fa79e1bb849aa75f79d069194.exe Token: SeRestorePrivilege 2800 0845a8c3be602a72e23a155b23ad554495bd558fa79e1bb849aa75f79d069194.exe Token: SeSecurityPrivilege 2800 0845a8c3be602a72e23a155b23ad554495bd558fa79e1bb849aa75f79d069194.exe Token: SeSystemProfilePrivilege 2800 0845a8c3be602a72e23a155b23ad554495bd558fa79e1bb849aa75f79d069194.exe Token: SeTakeOwnershipPrivilege 2800 0845a8c3be602a72e23a155b23ad554495bd558fa79e1bb849aa75f79d069194.exe Token: SeShutdownPrivilege 2800 0845a8c3be602a72e23a155b23ad554495bd558fa79e1bb849aa75f79d069194.exe Token: SeDebugPrivilege 2800 0845a8c3be602a72e23a155b23ad554495bd558fa79e1bb849aa75f79d069194.exe Token: SeBackupPrivilege 2800 0845a8c3be602a72e23a155b23ad554495bd558fa79e1bb849aa75f79d069194.exe Token: SeBackupPrivilege 2800 0845a8c3be602a72e23a155b23ad554495bd558fa79e1bb849aa75f79d069194.exe Token: SeSecurityPrivilege 2800 0845a8c3be602a72e23a155b23ad554495bd558fa79e1bb849aa75f79d069194.exe Token: SeSecurityPrivilege 2800 0845a8c3be602a72e23a155b23ad554495bd558fa79e1bb849aa75f79d069194.exe Token: SeBackupPrivilege 2800 0845a8c3be602a72e23a155b23ad554495bd558fa79e1bb849aa75f79d069194.exe Token: SeBackupPrivilege 2800 0845a8c3be602a72e23a155b23ad554495bd558fa79e1bb849aa75f79d069194.exe Token: SeSecurityPrivilege 2800 0845a8c3be602a72e23a155b23ad554495bd558fa79e1bb849aa75f79d069194.exe Token: SeSecurityPrivilege 2800 0845a8c3be602a72e23a155b23ad554495bd558fa79e1bb849aa75f79d069194.exe Token: SeBackupPrivilege 2800 0845a8c3be602a72e23a155b23ad554495bd558fa79e1bb849aa75f79d069194.exe Token: SeBackupPrivilege 2800 0845a8c3be602a72e23a155b23ad554495bd558fa79e1bb849aa75f79d069194.exe Token: SeSecurityPrivilege 2800 0845a8c3be602a72e23a155b23ad554495bd558fa79e1bb849aa75f79d069194.exe Token: SeSecurityPrivilege 2800 0845a8c3be602a72e23a155b23ad554495bd558fa79e1bb849aa75f79d069194.exe Token: SeBackupPrivilege 2800 0845a8c3be602a72e23a155b23ad554495bd558fa79e1bb849aa75f79d069194.exe Token: SeBackupPrivilege 2800 0845a8c3be602a72e23a155b23ad554495bd558fa79e1bb849aa75f79d069194.exe Token: SeSecurityPrivilege 2800 0845a8c3be602a72e23a155b23ad554495bd558fa79e1bb849aa75f79d069194.exe Token: SeSecurityPrivilege 2800 0845a8c3be602a72e23a155b23ad554495bd558fa79e1bb849aa75f79d069194.exe Token: SeBackupPrivilege 2800 0845a8c3be602a72e23a155b23ad554495bd558fa79e1bb849aa75f79d069194.exe Token: SeBackupPrivilege 2800 0845a8c3be602a72e23a155b23ad554495bd558fa79e1bb849aa75f79d069194.exe Token: SeSecurityPrivilege 2800 0845a8c3be602a72e23a155b23ad554495bd558fa79e1bb849aa75f79d069194.exe Token: SeSecurityPrivilege 2800 0845a8c3be602a72e23a155b23ad554495bd558fa79e1bb849aa75f79d069194.exe Token: SeBackupPrivilege 2800 0845a8c3be602a72e23a155b23ad554495bd558fa79e1bb849aa75f79d069194.exe Token: SeBackupPrivilege 2800 0845a8c3be602a72e23a155b23ad554495bd558fa79e1bb849aa75f79d069194.exe Token: SeSecurityPrivilege 2800 0845a8c3be602a72e23a155b23ad554495bd558fa79e1bb849aa75f79d069194.exe Token: SeSecurityPrivilege 2800 0845a8c3be602a72e23a155b23ad554495bd558fa79e1bb849aa75f79d069194.exe Token: SeBackupPrivilege 2800 0845a8c3be602a72e23a155b23ad554495bd558fa79e1bb849aa75f79d069194.exe Token: SeBackupPrivilege 2800 0845a8c3be602a72e23a155b23ad554495bd558fa79e1bb849aa75f79d069194.exe Token: SeSecurityPrivilege 2800 0845a8c3be602a72e23a155b23ad554495bd558fa79e1bb849aa75f79d069194.exe Token: SeSecurityPrivilege 2800 0845a8c3be602a72e23a155b23ad554495bd558fa79e1bb849aa75f79d069194.exe Token: SeBackupPrivilege 2800 0845a8c3be602a72e23a155b23ad554495bd558fa79e1bb849aa75f79d069194.exe Token: SeBackupPrivilege 2800 0845a8c3be602a72e23a155b23ad554495bd558fa79e1bb849aa75f79d069194.exe Token: SeSecurityPrivilege 2800 0845a8c3be602a72e23a155b23ad554495bd558fa79e1bb849aa75f79d069194.exe Token: SeSecurityPrivilege 2800 0845a8c3be602a72e23a155b23ad554495bd558fa79e1bb849aa75f79d069194.exe Token: SeBackupPrivilege 2800 0845a8c3be602a72e23a155b23ad554495bd558fa79e1bb849aa75f79d069194.exe Token: SeBackupPrivilege 2800 0845a8c3be602a72e23a155b23ad554495bd558fa79e1bb849aa75f79d069194.exe Token: SeSecurityPrivilege 2800 0845a8c3be602a72e23a155b23ad554495bd558fa79e1bb849aa75f79d069194.exe Token: SeSecurityPrivilege 2800 0845a8c3be602a72e23a155b23ad554495bd558fa79e1bb849aa75f79d069194.exe Token: SeBackupPrivilege 2800 0845a8c3be602a72e23a155b23ad554495bd558fa79e1bb849aa75f79d069194.exe Token: SeBackupPrivilege 2800 0845a8c3be602a72e23a155b23ad554495bd558fa79e1bb849aa75f79d069194.exe Token: SeSecurityPrivilege 2800 0845a8c3be602a72e23a155b23ad554495bd558fa79e1bb849aa75f79d069194.exe Token: SeSecurityPrivilege 2800 0845a8c3be602a72e23a155b23ad554495bd558fa79e1bb849aa75f79d069194.exe Token: SeBackupPrivilege 2800 0845a8c3be602a72e23a155b23ad554495bd558fa79e1bb849aa75f79d069194.exe Token: SeBackupPrivilege 2800 0845a8c3be602a72e23a155b23ad554495bd558fa79e1bb849aa75f79d069194.exe Token: SeSecurityPrivilege 2800 0845a8c3be602a72e23a155b23ad554495bd558fa79e1bb849aa75f79d069194.exe Token: SeSecurityPrivilege 2800 0845a8c3be602a72e23a155b23ad554495bd558fa79e1bb849aa75f79d069194.exe Token: SeBackupPrivilege 2800 0845a8c3be602a72e23a155b23ad554495bd558fa79e1bb849aa75f79d069194.exe Token: SeBackupPrivilege 2800 0845a8c3be602a72e23a155b23ad554495bd558fa79e1bb849aa75f79d069194.exe Token: SeSecurityPrivilege 2800 0845a8c3be602a72e23a155b23ad554495bd558fa79e1bb849aa75f79d069194.exe Token: SeSecurityPrivilege 2800 0845a8c3be602a72e23a155b23ad554495bd558fa79e1bb849aa75f79d069194.exe -
Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 2800 wrote to memory of 1120 2800 0845a8c3be602a72e23a155b23ad554495bd558fa79e1bb849aa75f79d069194.exe 32 PID 2800 wrote to memory of 1120 2800 0845a8c3be602a72e23a155b23ad554495bd558fa79e1bb849aa75f79d069194.exe 32 PID 2800 wrote to memory of 1120 2800 0845a8c3be602a72e23a155b23ad554495bd558fa79e1bb849aa75f79d069194.exe 32 PID 2800 wrote to memory of 1120 2800 0845a8c3be602a72e23a155b23ad554495bd558fa79e1bb849aa75f79d069194.exe 32 PID 2800 wrote to memory of 1120 2800 0845a8c3be602a72e23a155b23ad554495bd558fa79e1bb849aa75f79d069194.exe 32 PID 1120 wrote to memory of 624 1120 537D.tmp 33 PID 1120 wrote to memory of 624 1120 537D.tmp 33 PID 1120 wrote to memory of 624 1120 537D.tmp 33 PID 1120 wrote to memory of 624 1120 537D.tmp 33
Processes
-
C:\Users\Admin\AppData\Local\Temp\0845a8c3be602a72e23a155b23ad554495bd558fa79e1bb849aa75f79d069194.exe"C:\Users\Admin\AppData\Local\Temp\0845a8c3be602a72e23a155b23ad554495bd558fa79e1bb849aa75f79d069194.exe"1⤵
- Loads dropped DLL
- Drops desktop.ini file(s)
- Sets desktop wallpaper using registry
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Modifies Control Panel
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2800 -
C:\ProgramData\537D.tmp"C:\ProgramData\537D.tmp"2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:1120 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C DEL /F /Q C:\PROGRA~3\537D.tmp >> NUL3⤵
- System Location Discovery: System Language Discovery
PID:624
-
-
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x14c1⤵PID:2796
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
129B
MD57703d9be3ab1f0bd351220d20840e2e9
SHA13ac1eb87dd2a9fb1a14022182fcfc8a7afa48249
SHA256ba09084d4c6a0436ecd151875af36c006945392393dd638f602dd0fbc004f269
SHA51298a38dd950f4e725a970e5bf3dbec0518d00268511dc0babc16b4c0a81bff0581409ea0d81b5eb444d2c2f60f3b0f72a3f6e05bbc2845c6216c6928b3434b4f6
-
Filesize
388B
MD58ab02fa258c4a37f117d291ea2961749
SHA1ab4233853da5b1f0607fb7dd960a4074a5932f57
SHA256d06a43337366deab4b78bcf85ba92efb705a0e8391198367091d3e6ad16d036d
SHA512a3f8c6c1aada2584214deb6fc9dc4ffed3a3650f5cf839276bb826e047ad545f981b8873a0a2b58191ee3d1f4e7fbdb148dfc5df3591b9c55e36351327a27cd4
-
C:\Users\Admin\AppData\Local\Temp\DDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDD
Filesize146KB
MD596270d5f3031c08ea788f56085b6c2ac
SHA1cb94a7b402222e7a4666a48b7853b96694c0c880
SHA256858b24aa1b44193550a9d717dbc96f00b260e79017e130b8578440ab3fc31618
SHA512d393fcaa4882181d33e8a9ddf8908adf5451845c36a5ef3cd85c51db3dbe3f431aa3595e2fa345af7bf3c478c1e9ab4e6e0982c107dc6e3a2490055735005d82
-
Filesize
129B
MD553bd1545ff5e6c696e9022c2aa35c68d
SHA129ab7aa6d8c5dfa519bbadc4637bd184b41d5638
SHA256c0ace879f796f550461360e48db63289e37dbda678ef56aee5a283ccae087eb9
SHA512340af14f0bf8da6227c11d30327005b671bfe4493081761514630c3f1ebd43a97ca9f69e58712a9c6e46e6ae11e52666ffcedb6cf43912c80ce7816cbca3158c
-
Filesize
14KB
MD5294e9f64cb1642dd89229fff0592856b
SHA197b148c27f3da29ba7b18d6aee8a0db9102f47c9
SHA256917e115cc403e29b4388e0d175cbfac3e7e40ca1742299fbdb353847db2de7c2
SHA512b87d531890bf1577b9b4af41dddb2cdbbfa164cf197bd5987df3a3075983645a3acba443e289b7bfd338422978a104f55298fbfe346872de0895bde44adc89cf