Overview
overview
10Static
static
6AES-NI.exe
windows7-x64
10Abrechnung.exe
windows7-x64
8Box (2).exe
windows7-x64
3Box.exe
windows7-x64
3a66dde2298...43.exe
windows7-x64
9a7768f4973...e0.exe
windows7-x64
10aa7ff3bc28...1e.exe
windows7-x64
7aace43af8d...99.exe
windows7-x64
8ad3cc219a8...ws.dll
windows7-x64
10aee03626b8...b1.exe
windows7-x64
6afd3b729cf...2e.exe
windows7-x64
10b56c4569d6...ss.exe
windows7-x64
3b7989d9eac...ss.zip
windows7-x64
1zsgblrbrum...ke.exe
windows7-x64
7b7d9f11c16...b0.exe
windows7-x64
5b8f60c64c7...af.exe
windows7-x64
10Saldo.Pdf_...__.exe
windows7-x64
9Transazion...__.exe
windows7-x64
9bc557a7bfe...8f.exe
windows7-x64
7bd2d4d4300...17.vbs
windows7-x64
1be03e43db0...5F.exe
windows7-x64
7be03e43db0...8A.exe
windows7-x64
7be514549a2...1f.exe
windows7-x64
9bldjad.ex1.exe
windows7-x64
1bldjad.exe
windows7-x64
1bldjad2.exe
windows7-x64
5c145a26dd6...a0.exe
windows7-x64
3c325092750...db.apk
windows7-x64
3c36c46f4de...6e.exe
windows7-x64
3c3dd2e3cf0...04.exe
windows7-x64
7c71c26bf89...3_.exe
windows7-x64
7c846282987...fd.exe
windows7-x64
5Analysis
-
max time kernel
599s -
max time network
597s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
22-11-2024 03:09
Behavioral task
behavioral1
Sample
AES-NI.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
Abrechnung.exe
Resource
win7-20240903-en
Behavioral task
behavioral3
Sample
Box (2).exe
Resource
win7-20240729-en
Behavioral task
behavioral4
Sample
Box.exe
Resource
win7-20240708-en
Behavioral task
behavioral5
Sample
a66dde22983583da6d3b1e5b9eb1e8fb019f5157eda508305942292c0d10fa43.exe
Resource
win7-20240903-en
Behavioral task
behavioral6
Sample
a7768f4973ad7cf8217212a4d12dbae0.exe
Resource
win7-20240903-en
Behavioral task
behavioral7
Sample
aa7ff3bc285bcb4ec48bf2f361f0ad0a1d9fc8f17b7323d2f0615ade68973c1e.exe
Resource
win7-20240729-en
Behavioral task
behavioral8
Sample
aace43af8d0932a7b01c5b8fb71c8199.exe
Resource
win7-20241023-en
Behavioral task
behavioral9
Sample
ad3cc219a818047d6d3c38a8e4662e21dfedc858578cb2bde2c127d66dfeb7de_PonyNews.dll
Resource
win7-20240903-en
Behavioral task
behavioral10
Sample
aee03626b83a88b71b06899116cb7ce4b8092365103d69792b0c2d7153f24cb1.exe
Resource
win7-20240903-en
Behavioral task
behavioral11
Sample
afd3b729cf99fb9ea441f42862a4835d1d6eeb36ee535f9b206e3a00382c972e.exe
Resource
win7-20240903-en
Behavioral task
behavioral12
Sample
b56c4569d639e8ce104d9e52dffeba6d18813c058887a3404350904811f32d54_not_packed_maybe_useless.exe
Resource
win7-20240903-en
Behavioral task
behavioral13
Sample
b7989d9eacb5a8b224fd183f6ba65e4e6bd30a4f0e4e1a299f0d2b63dcb56730_Archive_useless.zip
Resource
win7-20240903-en
Behavioral task
behavioral14
Sample
zsgblrbrumorwxfizuke.exe
Resource
win7-20240903-en
Behavioral task
behavioral15
Sample
b7d9f11c166fa1a4ceef446dd9c8561c77115cb3ce4910a056dd6a361338a2b0.exe
Resource
win7-20240903-en
Behavioral task
behavioral16
Sample
b8f60c64c70f03c263bf9e9261aa157a73864aaf.exe
Resource
win7-20240903-en
Behavioral task
behavioral17
Sample
Saldo.Pdf______________________________________________________________.exe
Resource
win7-20241023-en
Behavioral task
behavioral18
Sample
Transazione.Pdf______________________________________________________________.exe
Resource
win7-20240903-en
Behavioral task
behavioral19
Sample
bc557a7bfec430aab3a1b326f35c8d6c1d2de0532263df872b2280af65f32b8f.exe
Resource
win7-20240903-en
Behavioral task
behavioral20
Sample
bd2d4d43009623941f49554f5932188154fc9d16d820e00db1281d057468b017.vbs
Resource
win7-20240903-en
Behavioral task
behavioral21
Sample
be03e43db0b190b879c893102a76183231ea39ec51206d25651a3cacffa8d81d_Dumped_TDS=4F8C315F.exe
Resource
win7-20240903-en
Behavioral task
behavioral22
Sample
be03e43db0b190b879c893102a76183231ea39ec51206d25651a3cacffa8d81d_TDS=4F90A68A.exe
Resource
win7-20241023-en
Behavioral task
behavioral23
Sample
be514549a2e654706aeeaa15c8cffce504f0e271c904fe07d865f3999ebaa61f.exe
Resource
win7-20240903-en
Behavioral task
behavioral24
Sample
bldjad.ex1.exe
Resource
win7-20240903-en
Behavioral task
behavioral25
Sample
bldjad.exe
Resource
win7-20241010-en
Behavioral task
behavioral26
Sample
bldjad2.exe
Resource
win7-20240903-en
Behavioral task
behavioral27
Sample
c145a26dd6d200080c16300456e7c0bc95f2b71f56d94136619e239e466a04a0.exe
Resource
win7-20241010-en
Behavioral task
behavioral28
Sample
c325092750dd55898c47be7ec8a7622c3bf8d1a79c40b160ef7901c2ef18f5db.apk
Resource
win7-20240903-en
Behavioral task
behavioral29
Sample
c36c46f4de045ef332decc006694db6e.exe
Resource
win7-20240903-en
Behavioral task
behavioral30
Sample
c3dd2e3cf0ebeec7a6c280e187a044a32b54b369a78aaaa89c600a0767b49704.exe
Resource
win7-20240903-en
Behavioral task
behavioral31
Sample
c71c26bf894feb5dbedb2cf2477258f3edf3133a3c22c68ab378ba65ecf251d3_.exe
Resource
win7-20240903-en
Behavioral task
behavioral32
Sample
c8462829871b7bdb005f4dd881d253aa255a1b2f6f3d89edb1d609b51f5d04fd.exe
Resource
win7-20241010-en
General
-
Target
Transazione.Pdf______________________________________________________________.exe
-
Size
443KB
-
MD5
e982953f4b15ad41dbccb13a09970214
-
SHA1
152b6ec0bda40347968c560f370e8f2089cb0436
-
SHA256
4c953b87b35c7764a32cbcde63ea1fb2f1563883f28ef209718604c48ba497e3
-
SHA512
60d9dc59ad324523ecc5f6933aada9a13cb5e9c67ba0b0e60007d784e17194da2e7308050ce1084c377a965a58bd846fd065c4589c5bc169666915fb557e6124
-
SSDEEP
6144:IzexeLzWAewqagVdgv0mzsWZwGoMaRxgbQGsaYVbW6kbqbsL1GeD69wwBKZ9+:vxeHWAdQg/zjwGoMG/Vybqb01GeD0wT+
Malware Config
Signatures
-
Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts explorer.exe -
Accesses Microsoft Outlook profiles 1 TTPs 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook explorer.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\uqidaken = "C:\\Windows\\omumonim.exe" explorer.exe -
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA Transazione.Pdf______________________________________________________________.exe -
Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 2664 set thread context of 2808 2664 Transazione.Pdf______________________________________________________________.exe 31 PID 2808 set thread context of 2568 2808 Transazione.Pdf______________________________________________________________.exe 32 -
Drops file in Windows directory 2 IoCs
description ioc Process File opened for modification C:\Windows\omumonim.exe explorer.exe File created C:\Windows\omumonim.exe explorer.exe -
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vssadmin.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Transazione.Pdf______________________________________________________________.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Transazione.Pdf______________________________________________________________.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language explorer.exe -
Interacts with shadow copies 3 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
pid Process 2532 vssadmin.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeBackupPrivilege 2372 vssvc.exe Token: SeRestorePrivilege 2372 vssvc.exe Token: SeAuditPrivilege 2372 vssvc.exe -
Suspicious use of WriteProcessMemory 20 IoCs
description pid Process procid_target PID 2664 wrote to memory of 2808 2664 Transazione.Pdf______________________________________________________________.exe 31 PID 2664 wrote to memory of 2808 2664 Transazione.Pdf______________________________________________________________.exe 31 PID 2664 wrote to memory of 2808 2664 Transazione.Pdf______________________________________________________________.exe 31 PID 2664 wrote to memory of 2808 2664 Transazione.Pdf______________________________________________________________.exe 31 PID 2664 wrote to memory of 2808 2664 Transazione.Pdf______________________________________________________________.exe 31 PID 2664 wrote to memory of 2808 2664 Transazione.Pdf______________________________________________________________.exe 31 PID 2664 wrote to memory of 2808 2664 Transazione.Pdf______________________________________________________________.exe 31 PID 2664 wrote to memory of 2808 2664 Transazione.Pdf______________________________________________________________.exe 31 PID 2664 wrote to memory of 2808 2664 Transazione.Pdf______________________________________________________________.exe 31 PID 2664 wrote to memory of 2808 2664 Transazione.Pdf______________________________________________________________.exe 31 PID 2664 wrote to memory of 2808 2664 Transazione.Pdf______________________________________________________________.exe 31 PID 2808 wrote to memory of 2568 2808 Transazione.Pdf______________________________________________________________.exe 32 PID 2808 wrote to memory of 2568 2808 Transazione.Pdf______________________________________________________________.exe 32 PID 2808 wrote to memory of 2568 2808 Transazione.Pdf______________________________________________________________.exe 32 PID 2808 wrote to memory of 2568 2808 Transazione.Pdf______________________________________________________________.exe 32 PID 2808 wrote to memory of 2568 2808 Transazione.Pdf______________________________________________________________.exe 32 PID 2568 wrote to memory of 2532 2568 explorer.exe 33 PID 2568 wrote to memory of 2532 2568 explorer.exe 33 PID 2568 wrote to memory of 2532 2568 explorer.exe 33 PID 2568 wrote to memory of 2532 2568 explorer.exe 33 -
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
-
outlook_win_path 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook explorer.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Transazione.Pdf______________________________________________________________.exe"C:\Users\Admin\AppData\Local\Temp\Transazione.Pdf______________________________________________________________.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2664 -
C:\Users\Admin\AppData\Local\Temp\Transazione.Pdf______________________________________________________________.exe"C:\Users\Admin\AppData\Local\Temp\Transazione.Pdf______________________________________________________________.exe"2⤵
- Checks whether UAC is enabled
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2808 -
C:\Windows\SysWOW64\explorer.exe"C:\Windows\system32\explorer.exe"3⤵
- Accesses Microsoft Outlook accounts
- Accesses Microsoft Outlook profiles
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
- outlook_win_path
PID:2568 -
C:\Windows\SysWOW64\vssadmin.exevssadmin.exe Delete Shadows /All /Quiet4⤵
- System Location Discovery: System Language Discovery
- Interacts with shadow copies
PID:2532
-
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2372
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Defense Evasion
Direct Volume Access
1Indicator Removal
2File Deletion
2Modify Registry
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
443KB
MD5e982953f4b15ad41dbccb13a09970214
SHA1152b6ec0bda40347968c560f370e8f2089cb0436
SHA2564c953b87b35c7764a32cbcde63ea1fb2f1563883f28ef209718604c48ba497e3
SHA51260d9dc59ad324523ecc5f6933aada9a13cb5e9c67ba0b0e60007d784e17194da2e7308050ce1084c377a965a58bd846fd065c4589c5bc169666915fb557e6124