Analysis
- max time kernel
290s - max time network
256s - platform
windows7_x64 - resource
win7-20240903-en - resource tags
- submitted
22/11/2024, 03:36
General
- Target ransom_50.00_dol_df410f19157f591860e1633b85dfb50b.scr
- Size 621KB
- Sample241122-d54ddstney
- SHA256 f1384ff19a870f5aa718486666a14e88873d79eaea5725e3a2097b2d9fd9a320
Malware Config
Signatures
- Renames multiple (109) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
- Drops startup file 1 IoCs
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- UPX packed file 5 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Modifies system certificate store 2 TTPs 2 IoCs
- Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\ransom_50.00_dol_df410f19157f591860e1633b85dfb50b.scr"C:\Users\Admin\AppData\Local\Temp\ransom_50.00_dol_df410f19157f591860e1633b85dfb50b.scr" /S1⤵
- Drops startup file
- System Location Discovery: System Language Discovery
- Modifies system certificate store
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\ransom_50.00_dol_df410f19157f591860e1633b85dfb50b.scr"C:\Users\Admin\AppData\Local\Temp\ransom_50.00_dol_df410f19157f591860e1633b85dfb50b.scr" /S2⤵
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v15
Defense Evasion
Modify Registry
1Subvert Trust Controls
1Install Root Certificate
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
tor.zip
memory/2388-0-0x0000000000400000-0x0000000000667000-memory.dmp
memory/2388-11-0x0000000003130000-0x0000000003397000-memory.dmp
memory/2388-135-0x0000000000400000-0x0000000000667000-memory.dmp
memory/2388-136-0x0000000000400000-0x0000000000667000-memory.dmp
memory/2984-12-0x0000000000400000-0x0000000000667000-memory.dmp
memory/2984-122-0x0000000000400000-0x0000000000667000-memory.dmp