Overview

overview

10

Static

static

3

locker.exe

windows7-x64

1

locker.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    95s
  • max time network
    125s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    22/11/2024, 19:02

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    locker.exe

  • Size

    2.3MB

  • MD5

    66c6dfe570b7e10fc9b62614a6bb0476

  • SHA1

    75ca6a5a47105af2855ace988f2e86fb8d54f56a

  • SHA256

    b44af07de17ed16af4d6699b9462bee6855a0a0207ec787d41f00fbed81e1c13

  • SHA512

    90659304debcbe88595c469e1846ff2f8544da480dcd75ba591079eabfa8e9cca9535f8f8130114f33f5c4317a95c735c26386bbd357a9451b9af2391762db54

  • SSDEEP

    24576:w/F1XGA9DHYdqQiF/swJ0r6ck59yjFGWG04J2ksswOGpyCP5WfWr:w91XRlYdqxF/QU5EH6wOVCBW

Score
10/10
credential_accessdiscoveryexecutionransomwarespywarestealer

Malware Config

Extracted

Language
ps1
Deobfuscated
URLs
exe.dropper

https://i.imgur.com/DQ6FCxz.png

Signatures

  • Renames multiple (8784) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware
  • Blocklisted process makes network request 1 IoCs
  • Credentials from Password Stores: Windows Credential Manager 1 TTPs

    Suspicious access to Credentials History.

    credential_accessstealer
  • Drops startup file 2 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

    Using powershell.exe command.

    execution
  • Drops desktop.ini file(s) 31 IoCs
  • Sets desktop wallpaper using registry 2 TTPs 1 IoCs
    ransomware
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 2 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\locker.exe
    "C:\Users\Admin\AppData\Local\Temp\locker.exe"
    1⤵
    • Drops startup file
    • Drops desktop.ini file(s)
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Suspicious use of WriteProcessMemory
    PID:1616
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "(New-Object System.Net.WebClient).DownloadFile('https://i.imgur.com/DQ6FCxz.png', 'C:\Users\Admin\AppData\Local\Temp\Wallpaper.png')"
      2⤵
      • Blocklisted process makes network request
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:5108
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-Type -TypeDefinition 'using System; using System.Runtime.InteropServices; public class Wallpaper { [DllImport(\"user32.dll\", CharSet = CharSet.Auto)] public static extern int SystemParametersInfo(int uAction, int uParam, string lpvParam, int fuWinIni); public static void Set(string path) { SystemParametersInfo(20, 0, path, 3); } }'; [Wallpaper]::Set('C:\Users\Admin\AppData\Local\Temp\Wallpaper.png')"
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Sets desktop wallpaper using registry
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:2380
      • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
        "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\szkxpuhm\szkxpuhm.cmdline"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:3412
        • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
          C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES99BA.tmp" "c:\Users\Admin\AppData\Local\Temp\szkxpuhm\CSC8791463E160B45C8999033F93BE19E3.TMP"
          4⤵
            PID:2984

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\R3ADM3.txt
      Filesize

      576B

      MD5

      f23030d9016bf550545665639ffe3329

      SHA1

      95195c349f6929832a1e7e3d1bd11ebfb2cbce1b

      SHA256

      747d06005c5539438076a0b5d3396727420aeb8c0c6348cd62324f530d0dde28

      SHA512

      6601c4e0af52ca5436dc12280813b0abd963a4ff1fa51af39a09d771b7898604205b74a12ad4597fa1970fc6477cae0b378887156130cf0c73a994c61924703b

      Download Submit

    • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
      Filesize

      2KB

      MD5

      49e7d5f2a296b59afec08bc314bed998

      SHA1

      7f898bf195ffd46ce2d19fad0ce33155f6e47f5f

      SHA256

      394832dfefa5e2e6204b60708a2ca33bb9d2f529664419bc050975f4b80faefe

      SHA512

      f64579fdac0bfebad4c20ad575b8ea45136e295fba950da4cbf84402228a3897b2e2deb4eb4605deb5df93321b1dc15c8a878da36016d7e5e060182142fdf839

      Download Submit

    • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
      Filesize

      1KB

      MD5

      a9ca68519670def80e7157108711832c

      SHA1

      d65dd4bcfedbedb4028ea33149321ac206e3d3fb

      SHA256

      b467b4c23ac84f7dbf34869015eb07c723d000d4aa4a03c21dd85c9d82462c30

      SHA512

      4084c4c98cf6357de929c86373e0cd2dabf9339e9bf262af9299cede5315bf446ea83edbbcef5cebea70e968ed3a4a95fbfe4b13e697c68067daadb5ec129648

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\RES99BA.tmp
      Filesize

      1KB

      MD5

      2092fc806090b6a363df3892b5594141

      SHA1

      85012951f01032c09c3c9639c8cd9f91bf652e5e

      SHA256

      e9260c03894e83ffe91f884f277e2d3ff928a63d870a43e4a10431c7587abdb8

      SHA512

      3d16a90e131961317aaa41658ad35fc65e10054da5c24073a3e527ec90679a70e630d08f729aae17f6a07220da73ba95cd5d3f71f9761e3ee26992ed8dc8dea6

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_4hnq0gfk.gv0.ps1
      Filesize

      60B

      MD5

      d17fe0a3f47be24a6453e9ef58c94641

      SHA1

      6ab83620379fc69f80c0242105ddffd7d98d5d9d

      SHA256

      96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

      SHA512

      5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\szkxpuhm\szkxpuhm.dll
      Filesize

      3KB

      MD5

      1974ac18249f37f2c2fa97e2e77058f8

      SHA1

      6467c994fb0e7c174c8f84a51a4c0302609ed08a

      SHA256

      f98b42824ef470c9b39645dfe07e9c27ffb66e34d2380894991420bffb6c90bb

      SHA512

      8c76559051b0a67acf699abb0d8491a199115b65c6a61eb6c8c0f0268b9722aa68f57d8cf3c04ab8b222a76eb18e593faf0f1d7a62cee9ea5df1b05bb1ec9467

      Download Submit

    • \??\c:\Users\Admin\AppData\Local\Temp\szkxpuhm\CSC8791463E160B45C8999033F93BE19E3.TMP
      Filesize

      652B

      MD5

      e474a622c14031cd088b0d4df7eb8cab

      SHA1

      9793ff460bff77c7ac8a15cc9149920724997eae

      SHA256

      ade20ace7b2f532d160983e9ed5e890237584af7702631bba1f5fce042092b3d

      SHA512

      d40d7f8def99d663622aa13cb323e04159774234be88759714804532d24e74f2464cb8d47cba17237ee3864621ae9e21f961ff7996889eb3f6c5b78bc7b68339

      Download Submit

    • \??\c:\Users\Admin\AppData\Local\Temp\szkxpuhm\szkxpuhm.0.cs
      Filesize

      312B

      MD5

      945a8245afef16ce6654338c6a4b1ab7

      SHA1

      165014157ca311751105fdf7c7c105a1a7b113a0

      SHA256

      331b27fcd961cc9e94bb774dfa7e1b8c5999d91f0f820924dc7c60a6610c1246

      SHA512

      d598cdb315ad50340efd7c52fd31ae9aef585281c3a384d84f1def0ce9782ac324087fede7c0b1157eea9b40c0fc3cbc650f646a9c93260efcfaf7bdf962be5e

      Download Submit

    • \??\c:\Users\Admin\AppData\Local\Temp\szkxpuhm\szkxpuhm.cmdline
      Filesize

      369B

      MD5

      90a2e501b5c2c2c0488c9fd1084fa584

      SHA1

      b2e5d43a581744511355a0dbb08384855fafff4e

      SHA256

      5f0b74fea8f8f84eecef20ea90ed482d6e0dd1a22a39313cdedd3ede75238c59

      SHA512

      0549deb718adedb6d29d185b32e4820893dc2465d61a957260849d9ed7234777f2f64d1b0fff14f377b2a35df5fa6afbb354e3a01915b9f2ec571a3c83fb6278

      Download Submit

    • memory/2380-53661-0x00007FFE37A10000-0x00007FFE384D1000-memory.dmp

      Filesize

      10.8MB

      Download

    • memory/2380-53662-0x00007FFE37A10000-0x00007FFE384D1000-memory.dmp

      Filesize

      10.8MB

      Download

    • memory/2380-53664-0x00007FFE37A10000-0x00007FFE384D1000-memory.dmp

      Filesize

      10.8MB

      Download

    • memory/2380-53677-0x0000019107720000-0x0000019107728000-memory.dmp

      Filesize

      32KB

      Download

    • memory/2380-53680-0x00007FFE37A10000-0x00007FFE384D1000-memory.dmp

      Filesize

      10.8MB

      Download

    • memory/5108-53650-0x00007FFE37A10000-0x00007FFE384D1000-memory.dmp

      Filesize

      10.8MB

      Download

    • memory/5108-53646-0x00007FFE37A10000-0x00007FFE384D1000-memory.dmp

      Filesize

      10.8MB

      Download

    • memory/5108-53645-0x0000020352B40000-0x0000020352B62000-memory.dmp

      Filesize

      136KB

      Download

    • memory/5108-53635-0x00007FFE37A10000-0x00007FFE384D1000-memory.dmp

      Filesize

      10.8MB

      Download

    • memory/5108-53634-0x00007FFE37A13000-0x00007FFE37A15000-memory.dmp

      Filesize

      8KB

      Download