Overview
overview
10Static
static
10IQHGV07FDy...2).exe
windows7-x64
3IQHGV07FDy...vn.exe
windows7-x64
3Junk)2345.eml.ViR.eml
windows7-x64
5PC Cleaner.exe
windows7-x64
10PC_cleaner...ed.exe
windows7-x64
3PC_cleaner...ed.exe
windows7-x64
3Pizzacrypts.exe
windows7-x64
9Ponmsiyyks.exe
windows7-x64
3Rlesvxamve...on.exe
windows7-x64
SATURN_RANSOM.exe
windows7-x64
10ScreenCapt...er.exe
windows7-x64
1license key.exe
windows7-x64
malware.exe
windows7-x64
8mamba_141.exe_.exe
windows7-x64
1mamba_152.exe_.exe
windows7-x64
5microsoft-cleaned.exe
windows7-x64
3msiexec.exe
windows7-x64
10nc.exe
windows7-x64
1nd2vj1ux.exe
windows7-x64
notes.exe
windows7-x64
nzpuHohZGP...2).exe
windows7-x64
3nzpuHohZGP...sr.exe
windows7-x64
3old_14b68c...0d.exe
windows7-x64
7patched.exe
windows7-x64
9pclock.exe
windows7-x64
7pclock_unpack.exe
windows7-x64
7pitupi20.exe
windows7-x64
10pozhehgxml...co.exe
windows7-x64
7ransom_50....0b.scr
windows7-x64
9ransomware...20.exe
windows7-x64
9safeinf.exe
windows7-x64
7schet1074....16.rtf
windows7-x64
10Analysis
- max time kernel
300s - max time network
123s - platform
windows7_x64 - resource
win7-20240903-en - resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system - submitted
22/11/2024, 03:36
Behavioral task
behavioral1
Sample
IQHGV07FDyQ5u7bmNAvn (2).exe
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral2
Sample
IQHGV07FDyQ5u7bmNAvn.exe
Resource
win7-20240729-en
windows7-x64
Behavioral task
behavioral3
Sample
Junk)2345.eml.ViR.eml
Resource
win7-20241010-en
windows7-x64
Behavioral task
behavioral4
Sample
PC Cleaner.exe
Resource
win7-20241010-en
windows7-x64
Behavioral task
behavioral5
Sample
PC_cleaner-cleaned.exe
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral6
Sample
PC_cleaner_database-cleaned.exe
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral7
Sample
Pizzacrypts.exe
Resource
win7-20241023-en
windows7-x64
Behavioral task
behavioral8
Sample
Ponmsiyyks.exe
Resource
win7-20240708-en
windows7-x64
Behavioral task
behavioral9
Sample
Rlesvxamvenagx @ZL@0ECpw@ZL@ .xml.zyklon.exe
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral10
Sample
SATURN_RANSOM.exe
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral11
Sample
ScreenCapture_Win8.MalwareScanner.exe
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral12
Sample
license key.exe
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral13
Sample
malware.exe
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral14
Sample
mamba_141.exe_.exe
Resource
win7-20241010-en
windows7-x64
Behavioral task
behavioral15
Sample
mamba_152.exe_.exe
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral16
Sample
microsoft-cleaned.exe
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral17
Sample
msiexec.exe
Resource
win7-20240708-en
windows7-x64
Behavioral task
behavioral18
Sample
nc.exe
Resource
win7-20241023-en
windows7-x64
Behavioral task
behavioral19
Sample
nd2vj1ux.exe
Resource
win7-20240729-en
windows7-x64
Behavioral task
behavioral20
Sample
notes.exe
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral21
Sample
nzpuHohZGP2RNfMTp0sr (2).exe
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral22
Sample
nzpuHohZGP2RNfMTp0sr.exe
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral23
Sample
old_14b68cb9f911ce937f52ed8282ef4395f2291c0a23f14d33f731a15572834b0d.exe
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral24
Sample
patched.exe
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral25
Sample
pclock.exe
Resource
win7-20241010-en
windows7-x64
Behavioral task
behavioral26
Sample
pclock_unpack.exe
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral27
Sample
pitupi20.exe
Resource
win7-20241010-en
windows7-x64
Behavioral task
behavioral28
Sample
pozhehgxmlhobpvwlqco.exe
Resource
win7-20240708-en
windows7-x64
Behavioral task
behavioral29
Sample
ransom_50.00_dol_df410f19157f591860e1633b85dfb50b.scr
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral30
Sample
ransomware1061911a3e0a74827a76bbd7bfe16d20.exe
Resource
win7-20240729-en
windows7-x64
Behavioral task
behavioral31
Sample
safeinf.exe
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral32
Sample
schet1074.15.03.16.rtf
Resource
win7-20240903-en
windows7-x64
General
- Target microsoft-cleaned.exe
- Size 337KB
- Sample241122-d54ddstney
- SHA256 03f1e07d8b2eddac94f0de473100dd8f33183c0030dd275a9dfb467d99af97b7
- MD5 2568651635cffe50fd45776886cdc514
- SHA1 bf7567d7492b701a4471a8c9b7a401460bf4621c
- SHA512 53e0046576c21da95ca5766e7f06fba20f77310a2e486bb1b7c6207a7345b039a846ffa6141f6c4b2f2cf76315bd052dcfe04e016f476fefad62786a2d286f5b
- SSDEEP 6144:C+uRqxZQFpFXvGp4F3qd75zSCIHpj3el71nVNi9IY2enhzSs75/Krbgx02r:C+08+FXt3qPOCIH8l7ZHyIXepSoab
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language microsoft-cleaned.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2696 microsoft-cleaned.exe 2696 microsoft-cleaned.exe 2696 microsoft-cleaned.exe 2696 microsoft-cleaned.exe 2696 microsoft-cleaned.exe 2696 microsoft-cleaned.exe 2696 microsoft-cleaned.exe 2696 microsoft-cleaned.exe 2696 microsoft-cleaned.exe 2696 microsoft-cleaned.exe 2696 microsoft-cleaned.exe 2696 microsoft-cleaned.exe 2696 microsoft-cleaned.exe 2696 microsoft-cleaned.exe 2696 microsoft-cleaned.exe 2696 microsoft-cleaned.exe 2696 microsoft-cleaned.exe 2696 microsoft-cleaned.exe 2696 microsoft-cleaned.exe 2696 microsoft-cleaned.exe 2696 microsoft-cleaned.exe 2696 microsoft-cleaned.exe 2696 microsoft-cleaned.exe 2696 microsoft-cleaned.exe 2696 microsoft-cleaned.exe 2696 microsoft-cleaned.exe 2696 microsoft-cleaned.exe 2696 microsoft-cleaned.exe 2696 microsoft-cleaned.exe 2696 microsoft-cleaned.exe 2696 microsoft-cleaned.exe 2696 microsoft-cleaned.exe 2696 microsoft-cleaned.exe 2696 microsoft-cleaned.exe 2696 microsoft-cleaned.exe 2696 microsoft-cleaned.exe 2696 microsoft-cleaned.exe 2696 microsoft-cleaned.exe 2696 microsoft-cleaned.exe 2696 microsoft-cleaned.exe 2696 microsoft-cleaned.exe 2696 microsoft-cleaned.exe 2696 microsoft-cleaned.exe 2696 microsoft-cleaned.exe 2696 microsoft-cleaned.exe 2696 microsoft-cleaned.exe 2696 microsoft-cleaned.exe 2696 microsoft-cleaned.exe 2696 microsoft-cleaned.exe 2696 microsoft-cleaned.exe 2696 microsoft-cleaned.exe 2696 microsoft-cleaned.exe 2696 microsoft-cleaned.exe 2696 microsoft-cleaned.exe 2696 microsoft-cleaned.exe 2696 microsoft-cleaned.exe 2696 microsoft-cleaned.exe 2696 microsoft-cleaned.exe 2696 microsoft-cleaned.exe 2696 microsoft-cleaned.exe 2696 microsoft-cleaned.exe 2696 microsoft-cleaned.exe 2696 microsoft-cleaned.exe 2696 microsoft-cleaned.exe - Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2696 microsoft-cleaned.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\microsoft-cleaned.exe"C:\Users\Admin\AppData\Local\Temp\microsoft-cleaned.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2696
-
C:\Windows\explorer.exeexplorer.exe1⤵PID:2396