Overview
overview
10Static
static
10IQHGV07FDy...2).exe
windows7-x64
3IQHGV07FDy...vn.exe
windows7-x64
3Junk)2345.eml.ViR.eml
windows7-x64
5PC Cleaner.exe
windows7-x64
10PC_cleaner...ed.exe
windows7-x64
3PC_cleaner...ed.exe
windows7-x64
3Pizzacrypts.exe
windows7-x64
9Ponmsiyyks.exe
windows7-x64
3Rlesvxamve...on.exe
windows7-x64
SATURN_RANSOM.exe
windows7-x64
10ScreenCapt...er.exe
windows7-x64
1license key.exe
windows7-x64
malware.exe
windows7-x64
8mamba_141.exe_.exe
windows7-x64
1mamba_152.exe_.exe
windows7-x64
5microsoft-cleaned.exe
windows7-x64
3msiexec.exe
windows7-x64
10nc.exe
windows7-x64
1nd2vj1ux.exe
windows7-x64
notes.exe
windows7-x64
nzpuHohZGP...2).exe
windows7-x64
3nzpuHohZGP...sr.exe
windows7-x64
3old_14b68c...0d.exe
windows7-x64
7patched.exe
windows7-x64
9pclock.exe
windows7-x64
7pclock_unpack.exe
windows7-x64
7pitupi20.exe
windows7-x64
10pozhehgxml...co.exe
windows7-x64
7ransom_50....0b.scr
windows7-x64
9ransomware...20.exe
windows7-x64
9safeinf.exe
windows7-x64
7schet1074....16.rtf
windows7-x64
10Analysis
- max time kernel
300s - max time network
119s - platform
windows7_x64 - resource
win7-20240903-en - resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system - submitted
22/11/2024, 03:36
Behavioral task
behavioral1
Sample
IQHGV07FDyQ5u7bmNAvn (2).exe
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral2
Sample
IQHGV07FDyQ5u7bmNAvn.exe
Resource
win7-20240729-en
windows7-x64
Behavioral task
behavioral3
Sample
Junk)2345.eml.ViR.eml
Resource
win7-20241010-en
windows7-x64
Behavioral task
behavioral4
Sample
PC Cleaner.exe
Resource
win7-20241010-en
windows7-x64
Behavioral task
behavioral5
Sample
PC_cleaner-cleaned.exe
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral6
Sample
PC_cleaner_database-cleaned.exe
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral7
Sample
Pizzacrypts.exe
Resource
win7-20241023-en
windows7-x64
Behavioral task
behavioral8
Sample
Ponmsiyyks.exe
Resource
win7-20240708-en
windows7-x64
Behavioral task
behavioral9
Sample
Rlesvxamvenagx @ZL@0ECpw@ZL@ .xml.zyklon.exe
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral10
Sample
SATURN_RANSOM.exe
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral11
Sample
ScreenCapture_Win8.MalwareScanner.exe
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral12
Sample
license key.exe
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral13
Sample
malware.exe
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral14
Sample
mamba_141.exe_.exe
Resource
win7-20241010-en
windows7-x64
Behavioral task
behavioral15
Sample
mamba_152.exe_.exe
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral16
Sample
microsoft-cleaned.exe
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral17
Sample
msiexec.exe
Resource
win7-20240708-en
windows7-x64
Behavioral task
behavioral18
Sample
nc.exe
Resource
win7-20241023-en
windows7-x64
Behavioral task
behavioral19
Sample
nd2vj1ux.exe
Resource
win7-20240729-en
windows7-x64
Behavioral task
behavioral20
Sample
notes.exe
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral21
Sample
nzpuHohZGP2RNfMTp0sr (2).exe
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral22
Sample
nzpuHohZGP2RNfMTp0sr.exe
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral23
Sample
old_14b68cb9f911ce937f52ed8282ef4395f2291c0a23f14d33f731a15572834b0d.exe
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral24
Sample
patched.exe
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral25
Sample
pclock.exe
Resource
win7-20241010-en
windows7-x64
Behavioral task
behavioral26
Sample
pclock_unpack.exe
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral27
Sample
pitupi20.exe
Resource
win7-20241010-en
windows7-x64
Behavioral task
behavioral28
Sample
pozhehgxmlhobpvwlqco.exe
Resource
win7-20240708-en
windows7-x64
Behavioral task
behavioral29
Sample
ransom_50.00_dol_df410f19157f591860e1633b85dfb50b.scr
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral30
Sample
ransomware1061911a3e0a74827a76bbd7bfe16d20.exe
Resource
win7-20240729-en
windows7-x64
Behavioral task
behavioral31
Sample
safeinf.exe
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral32
Sample
schet1074.15.03.16.rtf
Resource
win7-20240903-en
windows7-x64
General
- Target PC_cleaner-cleaned.exe
- Size 337KB
- Sample241122-d54ddstney
- SHA256 7de4bf9af4e80cf93c1058ebae1fadf69c9a271a44338888b7388744205e3725
- MD5 680acfbb639b80db6ed99f46a705656e
- SHA1 6bfbd09899ef0a153fe3f82587458c29615ddce9
- SHA512 c66b5eac487482724b65518aa22020cd430e62b7555a0a5458849bd912209fd071c47e4116d9bd6ec47e2dcad762183e1d7abb6d2ef27e95c508f8e1315815bc
- SSDEEP 6144:o+WROxZQFpFXvGp4F3qd75zSCIHpj3el71nVNi9IY2enhzSs75/Krbgx02r:o+MI+FXt3qPOCIH8l7ZHyIXepSoab
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PC_cleaner-cleaned.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2072 PC_cleaner-cleaned.exe 2072 PC_cleaner-cleaned.exe 2072 PC_cleaner-cleaned.exe 2072 PC_cleaner-cleaned.exe 2072 PC_cleaner-cleaned.exe 2072 PC_cleaner-cleaned.exe 2072 PC_cleaner-cleaned.exe 2072 PC_cleaner-cleaned.exe 2072 PC_cleaner-cleaned.exe 2072 PC_cleaner-cleaned.exe 2072 PC_cleaner-cleaned.exe 2072 PC_cleaner-cleaned.exe 2072 PC_cleaner-cleaned.exe 2072 PC_cleaner-cleaned.exe 2072 PC_cleaner-cleaned.exe 2072 PC_cleaner-cleaned.exe 2072 PC_cleaner-cleaned.exe 2072 PC_cleaner-cleaned.exe 2072 PC_cleaner-cleaned.exe 2072 PC_cleaner-cleaned.exe 2072 PC_cleaner-cleaned.exe 2072 PC_cleaner-cleaned.exe 2072 PC_cleaner-cleaned.exe 2072 PC_cleaner-cleaned.exe 2072 PC_cleaner-cleaned.exe 2072 PC_cleaner-cleaned.exe 2072 PC_cleaner-cleaned.exe 2072 PC_cleaner-cleaned.exe 2072 PC_cleaner-cleaned.exe 2072 PC_cleaner-cleaned.exe 2072 PC_cleaner-cleaned.exe 2072 PC_cleaner-cleaned.exe 2072 PC_cleaner-cleaned.exe 2072 PC_cleaner-cleaned.exe 2072 PC_cleaner-cleaned.exe 2072 PC_cleaner-cleaned.exe 2072 PC_cleaner-cleaned.exe 2072 PC_cleaner-cleaned.exe 2072 PC_cleaner-cleaned.exe 2072 PC_cleaner-cleaned.exe 2072 PC_cleaner-cleaned.exe 2072 PC_cleaner-cleaned.exe 2072 PC_cleaner-cleaned.exe 2072 PC_cleaner-cleaned.exe 2072 PC_cleaner-cleaned.exe 2072 PC_cleaner-cleaned.exe 2072 PC_cleaner-cleaned.exe 2072 PC_cleaner-cleaned.exe 2072 PC_cleaner-cleaned.exe 2072 PC_cleaner-cleaned.exe 2072 PC_cleaner-cleaned.exe 2072 PC_cleaner-cleaned.exe 2072 PC_cleaner-cleaned.exe 2072 PC_cleaner-cleaned.exe 2072 PC_cleaner-cleaned.exe 2072 PC_cleaner-cleaned.exe 2072 PC_cleaner-cleaned.exe 2072 PC_cleaner-cleaned.exe 2072 PC_cleaner-cleaned.exe 2072 PC_cleaner-cleaned.exe 2072 PC_cleaner-cleaned.exe 2072 PC_cleaner-cleaned.exe 2072 PC_cleaner-cleaned.exe 2072 PC_cleaner-cleaned.exe - Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2072 PC_cleaner-cleaned.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\PC_cleaner-cleaned.exe"C:\Users\Admin\AppData\Local\Temp\PC_cleaner-cleaned.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2072
-
C:\Windows\explorer.exeexplorer.exe1⤵PID:2528