Analysis
-
max time kernel
581s -
max time network
591s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
22-11-2024 03:09
General
-
Target
AES-NI.exe
-
Size
999KB
-
MD5
83e824c998f321a9179efc5c2cd0a118
-
SHA1
16b84004778505afbcc1032d1325c9bed8679b79
-
SHA256
4142ff4667f5b9986888bdcb2a727db6a767f78fe1d5d4ae3346365a1d70eb76
-
SHA512
d1c9fdb653d6b028c16a9d82895b7f03b6f96aecc802ab5104d6a762091e71502e407feea3d3d64f19b9f7c2888b1fb2b1dd5f2909b6e29414d4e4a78b56917b
-
SSDEEP
24576:xMhc8sFdkS6BEeL8xYSCy3vIyzlueaBLxGLJe3:Ghc8sFB6WeIYSPAyUHxGLJe3
Malware Config
Extracted
C:\Users\Public\!!! READ THIS - IMPORTANT !!!.txt
https://bitmsg.me
https://www.bleepingcomputer.com/
Signatures
-
Renames multiple (8207) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Credentials from Password Stores: Windows Credential Manager 1 TTPs
Suspicious access to Credentials History.
-
Deletes itself 1 IoCs
-
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Drops desktop.ini file(s) 48 IoCs
-
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Drops file in System32 directory 6 IoCs
-
UPX packed file 5 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Program Files directory 64 IoCs
-
Browser Information Discovery 1 TTPs
Enumerate browser information.
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Modifies data under HKEY_USERS 64 IoCs
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of WriteProcessMemory 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\AES-NI.exe"C:\Users\Admin\AppData\Local\Temp\AES-NI.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\svchost.exe"C:\Windows\SysWOW64\svchost.exe"2⤵
- Deletes itself
- Drops desktop.ini file(s)
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
948B
MD59b62c42562b3116717908966f21530b9
SHA1eb7c6eabf32d10e8dc8b50cd60794da6d62ceba7
SHA256fd736f4ae046b3a9877b658b9194fc2370619bcbf2f599aefd5d298c098d715f
SHA512240cf086fa61e8358d0365ac3c000ebcc91ce6661b872ff4f9e05a1aaa28d2c045d37a15c53f01fa0bdc259b85b6f95b36c9b50d5a26860a4aa48348a03a2215
-
Filesize
2KB
MD58327d435b0664d16db85ceb198339c03
SHA1dcc875e8ba7cc6f4d9f10aeadfc5fb166da70619
SHA256e691efd7d97f0c86e6a97d76d47ef36d340ac8303640ee6f4e0c3e45fab532bf
SHA51253cd337a8605ab80183ba2f62600c46f231340f67cf24dce2a9ec77fdfda72566a45ea3102d73265b9bd773543d902388b97d81bcf83b28ff9bdb0fe918d1661
-
Filesize
1.8MB
-
Filesize
1016KB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1016KB
-
Filesize
1016KB
-
Filesize
1.8MB
-
Filesize
1016KB
-
Filesize
1016KB
-
Filesize
1016KB
-
Filesize
1016KB
-
Filesize
1016KB
-
Filesize
1016KB
-
Filesize
1016KB