Overview

overview

10

Static

static

10

ScreenCapt...r1.exe

windows7-x64

1

ScreenCapt...r1.exe

windows10-2004-x64

1

ScreenCapt...r2.exe

windows7-x64

1

ScreenCapt...r2.exe

windows10-2004-x64

1

ScreenCapt...rt.exe

windows7-x64

1

ScreenCapt...rt.exe

windows10-2004-x64

1

ScreenCapt...er.exe

windows7-x64

1

ScreenCapt...er.exe

windows10-2004-x64

1

ScreenCapt...ck.exe

windows7-x64

1

ScreenCapt...ck.exe

windows10-2004-x64

1

ScreenCapt...k1.exe

windows7-x64

1

ScreenCapt...k1.exe

windows10-2004-x64

1

ScreenCapt...k2.exe

windows7-x64

1

ScreenCapt...k2.exe

windows10-2004-x64

1

Setup (5).exe

windows7-x64

7

Setup (5).exe

windows10-2004-x64

7

Setup (6).exe

windows7-x64

7

Setup (6).exe

windows10-2004-x64

7

Supplement...16.scr

windows7-x64

3

Supplement...16.scr

windows10-2004-x64

3

T1.exe

windows7-x64

10

T1.exe

windows10-2004-x64

10

T1_b7afca7...b5.exe

windows7-x64

10

T1_b7afca7...b5.exe

windows10-2004-x64

10

TeenTube_90767.exe

windows7-x64

10

TeenTube_90767.exe

windows10-2004-x64

10

Trojan-Ran....a.exe

windows7-x64

3

Trojan-Ran....a.exe

windows10-2004-x64

7

Tuyen bo c...ed.doc

windows7-x64

4

Tuyen bo c...ed.doc

windows10-2004-x64

1

Tuyen bo c...ed.doc

windows7-x64

4

Tuyen bo c...ed.doc

windows10-2004-x64

1

Analysis

  • max time kernel
    149s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    22-11-2024 03:46

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    T1_b7afca788487347804156f052c613db5.exe

  • Size

    31KB

  • MD5

    b7afca788487347804156f052c613db5

  • SHA1

    dd3d9703c37589482344460d4c624f50dec7d077

  • SHA256

    a41130085e6e7d7ed320599698d79af44da110a58d761e3dfb35e44500e6ac16

  • SHA512

    a37d6ec993a3d0f19daffc3ff174b05707c12339c4475e88468135bca73572ee9b61fb1eae2fbb7285a3dc893b048da108cc54a0f6dec66983360483720eba7f

  • SSDEEP

    768:eg1mvOSFR8d7OJecatzObxw7S0/o61xOxZKMggzCLYc3qFgxd:egcvOSFR8dVcPbxw7iQk2A/Fgx

Score
10/10
t1happycredential_accessdefense_evasiondiscoveryevasionexecutionimpactpersistenceransomwarespywarestealertrojan

Malware Config

Signatures

  • T1Happy

    T1Happy ransomware is a cryptovirus that behaves different than its counterparts.

    trojanransomwaret1happy
  • T1happy family
    t1happy
  • Deletes shadow copies 3 TTPs

    Ransomware often targets backup files to inhibit system recovery.

    ransomwaredefense_evasionimpactexecution
  • Renames multiple (3489) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware
  • Disables RegEdit via registry modification 1 IoCs
    evasion
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Credentials from Password Stores: Windows Credential Manager 1 TTPs

    Suspicious access to Credentials History.

    credential_accessstealer
  • Drops startup file 1 IoCs
  • Modifies file permissions 1 TTPs 1 IoCs
    discovery
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Unsecured Credentials: Credentials In Files 1 TTPs

    Steal credentials from unsecured files.

    credential_accessstealer
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Drops desktop.ini file(s) 15 IoCs
  • Looks up external IP address via web service 2 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Drops file in Program Files directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 43 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs
  • System policy modification 1 TTPs 2 IoCs
    evasion

Processes

  • C:\Users\Admin\AppData\Local\Temp\T1_b7afca788487347804156f052c613db5.exe
    "C:\Users\Admin\AppData\Local\Temp\T1_b7afca788487347804156f052c613db5.exe"
    1⤵
    • Disables RegEdit via registry modification
    • Checks computer location settings
    • Drops startup file
    • Adds Run key to start application
    • Drops desktop.ini file(s)
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Checks processor information in registry
    • Enumerates system info in registry
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    • System policy modification
    PID:4840
    • C:\Windows\SysWOW64\wbem\WMIC.exe
      "C:\Windows\System32\wbem\WMIC.exe" shadowcopy delete
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of AdjustPrivilegeToken
      PID:3944
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c takeown /f C:\Windows\"."
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:4352
      • C:\Windows\SysWOW64\takeown.exe
        takeown /f C:\Windows\"."
        3⤵
        • Modifies file permissions
        • System Location Discovery: System Language Discovery
        PID:3624
  • C:\Windows\system32\vssvc.exe
    C:\Windows\system32\vssvc.exe
    1⤵
      PID:5452

    Network

    MITRE ATT&CK Enterprise v15

    Reconnaissance

    Resource Development

    Initial Access

    Execution

    Windows Management Instrumentation

    1
    T1047

    Persistence

    Boot or Logon Autostart Execution

    1
    T1547

    Registry Run Keys / Startup Folder

    1
    T1547.001

    Privilege Escalation

    Boot or Logon Autostart Execution

    1
    T1547

    Registry Run Keys / Startup Folder

    1
    T1547.001

    Defense Evasion

    File and Directory Permissions Modification

    1
    T1222

    Indicator Removal

    1
    T1070

    File Deletion

    1
    T1070.004

    Modify Registry

    2
    T1112

    Credential Access

    Credentials from Password Stores

    2
    T1555

    Credentials from Web Browsers

    1
    T1555.003

    Windows Credential Manager

    1
    T1555.004

    Unsecured Credentials

    2
    T1552

    Credentials In Files

    2
    T1552.001

    Discovery

    Query Registry

    3
    T1012

    System Information Discovery

    4
    T1082

    System Location Discovery

    1
    T1614

    System Language Discovery

    1
    T1614.001

    Lateral Movement

    Collection

    Data from Local System

    1
    T1005

    Command and Control

    Exfiltration

    Impact

    Inhibit System Recovery

    1
    T1490

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_87484\javaws.exe
      Filesize

      465KB

      MD5

      2e2de204a9b58431c690525f7679dc89

      SHA1

      9694b9e97e600b7ca748bbc6346c6142df4ad176

      SHA256

      eecbd89b0f68b56c46084ecc4fed9e341a25d2c774b07429d9e2eea1b1b22d61

      SHA512

      6ddd43741be4dbe7a376008eb5a0251005594f61875a82cf8d9573f44c5f4736a3d6ddcf2f034a0817bf636e0f7adfd9b3e9a94a2a701560f9bf10754b44450c

      Download Submit

    • C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeUpdate.exe.happy
      Filesize

      209KB

      MD5

      b322f69161846e0a3e57e15c97b79148

      SHA1

      bf854a0660161bf5d802ec2befbf6b09443b60a4

      SHA256

      8f520580c268ebb48e7ffe5260abf4b76b010dc836300dc55920483e8dbdc032

      SHA512

      e8fc2dbe5e19b9dbd8be9a55d8f26bc857cfe6ec467cd1ef09e0f66b22b2d63d1efea33c75af50470beb19eae8f19f7ceaa8e412383bd0bbe3e68cf852d8b5a2

      Download Submit

    • memory/4840-6-0x0000000005540000-0x0000000005596000-memory.dmp

      Filesize

      344KB

      Download

    • memory/4840-3-0x0000000005850000-0x0000000005DF4000-memory.dmp

      Filesize

      5.6MB

      Download

    • memory/4840-4-0x0000000005340000-0x00000000053D2000-memory.dmp

      Filesize

      584KB

      Download

    • memory/4840-5-0x00000000052C0000-0x00000000052CA000-memory.dmp

      Filesize

      40KB

      Download

    • memory/4840-0-0x0000000074FFE000-0x0000000074FFF000-memory.dmp

      Filesize

      4KB

      Download

    • memory/4840-7-0x0000000074FF0000-0x00000000757A0000-memory.dmp

      Filesize

      7.7MB

      Download

    • memory/4840-8-0x0000000007160000-0x00000000071C6000-memory.dmp

      Filesize

      408KB

      Download

    • memory/4840-492-0x0000000074FFE000-0x0000000074FFF000-memory.dmp

      Filesize

      4KB

      Download

    • memory/4840-856-0x0000000074FF0000-0x00000000757A0000-memory.dmp

      Filesize

      7.7MB

      Download

    • memory/4840-2-0x0000000005200000-0x000000000529C000-memory.dmp

      Filesize

      624KB

      Download

    • memory/4840-1-0x0000000000960000-0x000000000096E000-memory.dmp

      Filesize

      56KB

      Download