Overview
overview
10Static
static
10757e3242f6...b4.exe
windows7-x64
9757e3242f6...b4.exe
windows10-2004-x64
976fe72e0ec...ss.exe
windows7-x64
776fe72e0ec...ss.exe
windows10-2004-x64
1078d4cf8df6...B3.exe
windows7-x64
778d4cf8df6...B3.exe
windows10-2004-x64
1078d4cf8df6...59.exe
windows7-x64
778d4cf8df6...59.exe
windows10-2004-x64
378db508226...69.exe
windows7-x64
978db508226...69.exe
windows10-2004-x64
97965f6adf3...ss.exe
windows7-x64
77965f6adf3...ss.exe
windows10-2004-x64
77B75B33BCF...B5.exe
windows7-x64
17B75B33BCF...B5.exe
windows10-2004-x64
17E3903944E...72.exe
windows7-x64
77E3903944E...72.exe
windows10-2004-x64
57dd9312307...ca.dll
windows7-x64
37dd9312307...ca.dll
windows10-2004-x64
37e4c9a7e39...1f.exe
windows7-x64
97e4c9a7e39...1f.exe
windows10-2004-x64
780eb72d781...B3.exe
windows7-x64
780eb72d781...B3.exe
windows10-2004-x64
1080eb72d781...9A.exe
windows7-x64
780eb72d781...9A.exe
windows10-2004-x64
3845263c869...c8.exe
windows7-x64
9845263c869...c8.exe
windows10-2004-x64
98524224187...8f.exe
windows7-x64
68524224187...8f.exe
windows10-2004-x64
686be3831f5...39.exe
windows7-x64
686be3831f5...39.exe
windows10-2004-x64
68791931bac...DA.exe
windows7-x64
78791931bac...DA.exe
windows10-2004-x64
10Analysis
-
max time kernel
93s -
max time network
139s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
22-11-2024 09:21
Behavioral task
behavioral1
Sample
757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
757e3242f6a2685ed9957c9e66235af889a7accead5719514719106d0b3c6fb4.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral3
Sample
76fe72e0ecdc389b5749df5fe406cb70110b1ef8b64e51cf0a96da2fa2ec5eb2_not_packed_maybe_useless.exe
Resource
win7-20240708-en
Behavioral task
behavioral4
Sample
76fe72e0ecdc389b5749df5fe406cb70110b1ef8b64e51cf0a96da2fa2ec5eb2_not_packed_maybe_useless.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral5
Sample
78d4cf8df6fe5717a0f4bad6cbfce6546fb59a45ee0ac3797b264b28e24ddc0b_Dumped_TDS=4F9911B3.exe
Resource
win7-20241010-en
Behavioral task
behavioral6
Sample
78d4cf8df6fe5717a0f4bad6cbfce6546fb59a45ee0ac3797b264b28e24ddc0b_Dumped_TDS=4F9911B3.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral7
Sample
78d4cf8df6fe5717a0f4bad6cbfce6546fb59a45ee0ac3797b264b28e24ddc0b_TDS=4FA04B59.exe
Resource
win7-20240903-en
Behavioral task
behavioral8
Sample
78d4cf8df6fe5717a0f4bad6cbfce6546fb59a45ee0ac3797b264b28e24ddc0b_TDS=4FA04B59.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral9
Sample
78db508226ccacd363fc0f02b3ae326a2bdd0baed3ae51ddf59c3fc0fcf60669.exe
Resource
win7-20240903-en
Behavioral task
behavioral10
Sample
78db508226ccacd363fc0f02b3ae326a2bdd0baed3ae51ddf59c3fc0fcf60669.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral11
Sample
7965f6adf3261e8820fe583e94dcb2d17dc665efa0442743e47d27c989fcb05f_not_packed_maybe_useless.exe
Resource
win7-20240903-en
Behavioral task
behavioral12
Sample
7965f6adf3261e8820fe583e94dcb2d17dc665efa0442743e47d27c989fcb05f_not_packed_maybe_useless.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral13
Sample
7B75B33BCF4ECF013B93F84ED98B3FB5.exe
Resource
win7-20240729-en
Behavioral task
behavioral14
Sample
7B75B33BCF4ECF013B93F84ED98B3FB5.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral15
Sample
7E3903944EAB7B61B495572BAA60FB72.exe
Resource
win7-20240903-en
Behavioral task
behavioral16
Sample
7E3903944EAB7B61B495572BAA60FB72.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral17
Sample
7dd93123078b383ec179c4c381f9119f4eac4efb287fe8f538a82e7336dfa4ca.dll
Resource
win7-20240903-en
Behavioral task
behavioral18
Sample
7dd93123078b383ec179c4c381f9119f4eac4efb287fe8f538a82e7336dfa4ca.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral19
Sample
7e4c9a7e391be4367d79bd1ab92b748d440e13fd5ca6c0820b30e6e9c670871f.exe
Resource
win7-20241010-en
Behavioral task
behavioral20
Sample
7e4c9a7e391be4367d79bd1ab92b748d440e13fd5ca6c0820b30e6e9c670871f.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral21
Sample
80eb72d78175761e34378e06a5ca13b26edd6c47ee18e0d222fa068a249785f2_Dumped_TDS=4F9911B3.exe
Resource
win7-20240903-en
Behavioral task
behavioral22
Sample
80eb72d78175761e34378e06a5ca13b26edd6c47ee18e0d222fa068a249785f2_Dumped_TDS=4F9911B3.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral23
Sample
80eb72d78175761e34378e06a5ca13b26edd6c47ee18e0d222fa068a249785f2_TDS=4FAAF59A.exe
Resource
win7-20240903-en
Behavioral task
behavioral24
Sample
80eb72d78175761e34378e06a5ca13b26edd6c47ee18e0d222fa068a249785f2_TDS=4FAAF59A.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral25
Sample
845263c86931440e934cf40f4461dc14903a474f6f5eab4773482842855ba1c8.exe
Resource
win7-20241010-en
Behavioral task
behavioral26
Sample
845263c86931440e934cf40f4461dc14903a474f6f5eab4773482842855ba1c8.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral27
Sample
85242241870190a81b55d0ea723c25391fff14140bac149a32630c5f892a3a8f.exe
Resource
win7-20240903-en
Behavioral task
behavioral28
Sample
85242241870190a81b55d0ea723c25391fff14140bac149a32630c5f892a3a8f.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral29
Sample
86be3831f5d8a975b0924168117fc7fcd1f5067ac5935c657efbb4798cb6a439.exe
Resource
win7-20240903-en
Behavioral task
behavioral30
Sample
86be3831f5d8a975b0924168117fc7fcd1f5067ac5935c657efbb4798cb6a439.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral31
Sample
8791931bac7d8afbb30dc1d32a4dd54ee59a2160580a83d822a927039d8ca98f_Dumped_TDS=4F83FCDA.exe
Resource
win7-20240903-en
Behavioral task
behavioral32
Sample
8791931bac7d8afbb30dc1d32a4dd54ee59a2160580a83d822a927039d8ca98f_Dumped_TDS=4F83FCDA.exe
Resource
win10v2004-20241007-en
General
-
Target
845263c86931440e934cf40f4461dc14903a474f6f5eab4773482842855ba1c8.exe
-
Size
246KB
-
MD5
7f61ab7160ccea4f69fed025fbbfdb30
-
SHA1
88d06d4124bca680bf28dde09cc1c3995002eef3
-
SHA256
845263c86931440e934cf40f4461dc14903a474f6f5eab4773482842855ba1c8
-
SHA512
8ff46db7d1bfddef6bab676c1439207a7b755280720bf83406d95a700eac364ef667978a7e538cc3d6e2836487b38ddc34df288100b510e32d16f013ffd07d98
-
SSDEEP
6144:clmE5hV/XRG4FmeAs32AcNhunE+AWTWk6+wv:2/XRG4FdAs32AeOWk
Malware Config
Signatures
-
Renames multiple (129) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation 845263c86931440e934cf40f4461dc14903a474f6f5eab4773482842855ba1c8.exe -
Executes dropped EXE 1 IoCs
pid Process 3056 trust.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\SG = "C:\\Users\\Admin\\AppData\\Roaming\\trust.exe" mshta.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 1 IoCs
pid pid_target Process procid_target 4752 3056 WerFault.exe 83 -
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language mshta.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 845263c86931440e934cf40f4461dc14903a474f6f5eab4773482842855ba1c8.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language trust.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language mshta.exe -
Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 3224 wrote to memory of 3056 3224 845263c86931440e934cf40f4461dc14903a474f6f5eab4773482842855ba1c8.exe 83 PID 3224 wrote to memory of 3056 3224 845263c86931440e934cf40f4461dc14903a474f6f5eab4773482842855ba1c8.exe 83 PID 3224 wrote to memory of 3056 3224 845263c86931440e934cf40f4461dc14903a474f6f5eab4773482842855ba1c8.exe 83 PID 3224 wrote to memory of 4088 3224 845263c86931440e934cf40f4461dc14903a474f6f5eab4773482842855ba1c8.exe 84 PID 3224 wrote to memory of 4088 3224 845263c86931440e934cf40f4461dc14903a474f6f5eab4773482842855ba1c8.exe 84 PID 3224 wrote to memory of 4088 3224 845263c86931440e934cf40f4461dc14903a474f6f5eab4773482842855ba1c8.exe 84 PID 3056 wrote to memory of 3768 3056 trust.exe 85 PID 3056 wrote to memory of 3768 3056 trust.exe 85 PID 3056 wrote to memory of 3768 3056 trust.exe 85
Processes
-
C:\Users\Admin\AppData\Local\Temp\845263c86931440e934cf40f4461dc14903a474f6f5eab4773482842855ba1c8.exe"C:\Users\Admin\AppData\Local\Temp\845263c86931440e934cf40f4461dc14903a474f6f5eab4773482842855ba1c8.exe"1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3224 -
C:\Users\Admin\AppData\Roaming\trust.exe"C:\Users\Admin\AppData\Roaming\trust.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3056 -
C:\Windows\SysWOW64\mshta.exemshta.exe "javascript:o=new ActiveXObject('WScript.Shell');setInterval(function(){try{o.RegWrite('HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce\\SG','C:\\Users\\Admin\\AppData\\Roaming\\trust.exe');}catch(e){}},10);"3⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
PID:3768
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3056 -s 7203⤵
- Program crash
PID:4752
-
-
-
C:\Windows\SysWOW64\mshta.exemshta.exe "javascript:o=new ActiveXObject('Scripting.FileSystemObject');setInterval(function(){try{o.DeleteFile('C:\\Users\\Admin\\AppData\\Local\\Temp\\845263~1.EXE');close()}catch(e){}},10);"2⤵
- System Location Discovery: System Language Discovery
PID:4088
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3056 -ip 30561⤵PID:2516
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
246KB
MD57f61ab7160ccea4f69fed025fbbfdb30
SHA188d06d4124bca680bf28dde09cc1c3995002eef3
SHA256845263c86931440e934cf40f4461dc14903a474f6f5eab4773482842855ba1c8
SHA5128ff46db7d1bfddef6bab676c1439207a7b755280720bf83406d95a700eac364ef667978a7e538cc3d6e2836487b38ddc34df288100b510e32d16f013ffd07d98
-
Filesize
3KB
MD5437823aed7d232ba92060a44cb61dcec
SHA1d6aaa1f701762846c95fabb4fcc65ce7fff36b64
SHA25643b6cf5496192ebea091c89c39ad6996a8c7f7bd8d3039050d51be8c9ad1908a
SHA5120eeaf7ffff1931ad4ca1072ce1ebe004640f9406136bdc123e677bc428eac6914035c00d9b1d6bd0db5bb8408bd807db9f85a1496660de02c77f07acddad2820
-
Filesize
81KB
MD50895b254ac1d4d9091799818bf2cf830
SHA1f1678b2850df7b9355aa66e683ea0f12b3a03b5a
SHA2562efab988280adc6cbc5ade3d4d32f1d9d46bf63759cb905b0ba049555180e872
SHA5126463ea222fb59e97bf4243bca00e03ecbff0d553f1f44f4e3f606aec3ea85c407945ac91740162d69cdc73ba70cdc67dccc0b47e348fe58ab753a547c36fd2dd