Analysis
-
max time kernel
150s -
max time network
123s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
22-11-2024 03:46
General
-
Target
T1.exe
-
Size
31KB
-
MD5
29cdb46d2e01f2efb9644c7695a007bb
-
SHA1
c276166bddcbcc093cf0b7164c4233745eda6cf5
-
SHA256
3ed94c1b319454f6122a05ef124e5bc8eefc60a3d81987fb712c7af78726e6b3
-
SHA512
fcce8e8a5c0689cf79dc4ca46ff0bbad6f4c5b8c74dbbb186e1e9df3988fa75526c00dfb6b8181ede6f0e5f1496b96caf23cc59de8c774a70812b1b0b5a590a8
-
SSDEEP
768:sg1mvOSFUyD+W4e4++sqzYbxw7S0/oc1xO2ISMggtCLYc3qFgxd:sgcvOSFfEe4+tbxw7iCkwe/Fgx
Malware Config
Extracted
Protocol: smtp- Host:
mail.gmx.net - Port:
587 - Username:
[email protected] - Password:
cuF.7P\Bv#C>`pu)
Signatures
-
T1Happy
T1Happy ransomware is a cryptovirus that behaves different than its counterparts.
-
T1happy family
-
Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Renames multiple (3541) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Disables RegEdit via registry modification 1 IoCs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Credentials from Password Stores: Windows Credential Manager 1 TTPs
Suspicious access to Credentials History.
-
Drops startup file 1 IoCs
-
Modifies file permissions 1 TTPs 1 IoCs
-
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
-
Adds Run key to start application 2 TTPs 2 IoCs
-
Drops desktop.ini file(s) 15 IoCs
-
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Drops file in Program Files directory 64 IoCs
-
Browser Information Discovery 1 TTPs
Enumerate browser information.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Enumerates system info in registry 2 TTPs 2 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 43 IoCs
-
Suspicious use of WriteProcessMemory 9 IoCs
-
System policy modification 1 TTPs 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\T1.exe"C:\Users\Admin\AppData\Local\Temp\T1.exe"1⤵
- Disables RegEdit via registry modification
- Checks computer location settings
- Drops startup file
- Adds Run key to start application
- Drops desktop.ini file(s)
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Windows\SysWOW64\wbem\WMIC.exe"C:\Windows\System32\wbem\WMIC.exe" shadowcopy delete2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c takeown /f C:\Windows\"."2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\takeown.exetakeown /f C:\Windows\"."3⤵
- Modifies file permissions
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Defense Evasion
File and Directory Permissions Modification
1Indicator Removal
1File Deletion
1Modify Registry
2Credential Access
Credentials from Password Stores
2Credentials from Web Browsers
1Windows Credential Manager
1Unsecured Credentials
3Credentials In Files
3Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
512B
MD54f0891c2ded36c5f2db1aa8ae3d55faf
SHA18f080c829e9b8ce3e2f91cd78eff628a7706fff2
SHA25691da07609ecb7fd43b88a2e0144da75dcbb760288fc933b1101e3701aca0a733
SHA512cfff4474f71f367b3b8b1afac36adc69de1891bffde1fab51dff96d104e904fd075d14e158211c22529ec0148546c5d641b4be2607ff9486c76d9212854c17f2
-
Filesize
800B
MD542240d1a3c45802abc0ca74f72198c47
SHA161f5f0868314842176db8e6dd0dd2e0ee461c63b
SHA25661272fc5f44eaf8665374bb6e2ebb2d0bfea891170415cc54eb1816fda3852fc
SHA512198bc16029197e5f0e51a93b984cd2bab6b3d8b4e559130d51ad32ec925674c3d67dbe8a828e9360a3ad23ac363433ab0924736a2afd03b3e44378386e1451a5
-
Filesize
8KB
MD5701acb6cd76878c3b9d6436498b503f5
SHA1f72ab520fc6e287acd583d1a042283617d5860f6
SHA256d6375673be32dfd858072183457d25a00ada4ce5c0f026df42a836b617e4afaf
SHA512b8c8d1ccfdf478c58e962c7e54154283cbbf0c441ca5e19958e13eed4be1866d310686f54f519c38ab75e87dd9c26cce228d80e4439a6415dd32176e899b9208
-
Filesize
54KB
MD50ca6331c3c243b6ed90d9a87e6e52d9d
SHA1e305c9698f415ff18dd78efea0926d3cc9dff796
SHA25603658e38d724208c11bd3f71b364cbae354f0e75d09ea42d5229d89da8f30b38
SHA512b41520af5f95cefd0ce9645d3724671c6037a39eea2ec99fa662af533a8c240c1ad44a17bac76b39d798083ff9e657a2907d711371deeccfda3c34aee65ae671
-
Filesize
16KB
MD575ffcf237a92b1d89f6a63c7edd98eb8
SHA1fca7e5c5dbbc9452dc04027f68116f85e6be2426
SHA256d8b7fc30edc03deb99330ebc05d326ed1778144af354c26ad89e8bfda9f2d17c
SHA5124be69ff99fc14fe5aca2eb299b1afbe3f4d9049e6fb43b7e843a18f2bb62e8618c5de53d37ea803563f3688b828da129e3e375eedb520ff02a31408fd5b45f85
-
Filesize
32KB
MD591b3d6b33edcc1bacfc0aa56044dec50
SHA130ede062033db9dafa0d10f21455d2ff37e9fbce
SHA256ab2b6ced63eb37a20a35cf4e4ad528ba9f65153f252778d57ce78f4d2877e323
SHA5128ccdae7e2952db0790e0a75dcf3cab03bd682e2f679cfd5d9f26e651cd04a3039f6aa67250b4dd98f08d76794a073443a3786a0fca570c60b85ca1ad40c9b197
-
Filesize
32KB
MD56f118d716bd4ccea7ec9cd4120b65517
SHA1bafc6658eceaf641acbed5ea27908affe5948feb
SHA2566d85a741e3eaad778cb9b8d78603f41f9e9468df3fae451b5a8a6c715887bf4c
SHA51263856de4a9c156fb2e77aebdb02433e3dd0b4ef921668e6538b811923a09f4b79dd98d807a33c8e68f481263b19da5fc07be42578ced13b3ffb68f17e48ae0e1
-
Filesize
465KB
MD5e31a3af09fbec3499d86b13ca00db15f
SHA13399ac057ac90d30fa9939186e09a43acbf3269d
SHA256625c3197108a89bdaa510d34037dd4bb75d713b16159dea3810e6558645b2267
SHA512c41f66eecda03b74b91eea96722fbdb331d700583a728248c0999e77ed644d0329831d32d4e710049175ee6653007c1779897a9fce6bfd1be10632c7ee6f8645
-
Filesize
209KB
MD5d2b55a2889841917e4ec47cfad3931b0
SHA1ca10301ea19afad11ad1a22c3c5d39d9540849a9
SHA25648d94c284f5a0558a32652e63f7f4c80c63b04f6e050d6f4fc53fd9a56b3e9aa
SHA512013056cc50e52828873f4a33aef844c213ebb68868aed6ad63f83208b45e5c6e927d43f83f07c60588246b9fbe846be0c14fc040ea349bdcf071876e93839d07
-
Filesize
40KB
-
Filesize
7.7MB
-
Filesize
4KB
-
Filesize
408KB
-
Filesize
7.7MB
-
Filesize
344KB
-
Filesize
4KB
-
Filesize
584KB
-
Filesize
5.6MB
-
Filesize
624KB
-
Filesize
56KB
