Analysis
- max time kernel
149s - max time network
155s - platform
windows10-2004_x64 - resource
win10v2004-20241007-en - resource tags
- submitted
24/11/2024, 09:24
General
- Target a2bc9b467f331a26b33cfd70f7bf12c9e2e6b3ebc8d3749c12a7eedf507e9323.exe
- Size 254KB
- Sample241124-lc6xtatmay
- SHA256 a2bc9b467f331a26b33cfd70f7bf12c9e2e6b3ebc8d3749c12a7eedf507e9323
Malware Config
Extracted
-
C:\Users\Admin\AppData\Local\Temp\GK9X59JWEe.README.txt
- ATTENTION! Don’t worry, you can return all your files! All your files like pictures, databases, documents and other important are encrypted with strongest encryption and unique key. The only method of recovering files is to purchase decrypt tool and unique key for you. This software will decrypt all your encrypted files. Price of private key and decrypt software is $980. Discount 50% available if you contact us first 72 hours, that’s price for you is $490. Please note that you’ll never restore your data without payment. To get this software and key you need join our server discord: discord.gg/ Personal ID: 2db500aa20c44aaf8a31681e8bab5dd0
Signatures
- Renames multiple (961) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Credentials from Password Stores: Windows Credential Manager 1 TTPs
Suspicious access to Credentials History.
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Using powershell.exe command.
- Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs
- Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Detects videocard installed 1 TTPs 1 IoCs
Uses WMIC.exe to determine videocard installed.
- Modifies registry class 1 IoCs
- Opens file in notepad (likely ransom note) 1 IoCs
- Suspicious behavior: EnumeratesProcesses 6 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of WriteProcessMemory 16 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\a2bc9b467f331a26b33cfd70f7bf12c9e2e6b3ebc8d3749c12a7eedf507e9323.exe"C:\Users\Admin\AppData\Local\Temp\a2bc9b467f331a26b33cfd70f7bf12c9e2e6b3ebc8d3749c12a7eedf507e9323.exe"1⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Get-ItemPropertyValue -Path HKLN:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\Wbem\wmic.exe"wmic.exe" os get Caption2⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\Wbem\wmic.exe"wmic.exe" computersystem get totalphysicalmemory2⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\Wbem\wmic.exe"wmic.exe" csproduct get uuid2⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Windows\System32\Wbem\wmic.exe"wmic" path win32_VideoController get name2⤵
- Detects videocard installed
-
-
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\GK9X59JWEe.README.txt2⤵
- Opens file in notepad (likely ransom note)
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s UsoSvc1⤵
Network
MITRE ATT&CK Enterprise v15
Credential Access
Credentials from Password Stores
2Credentials from Web Browsers
1Windows Credential Manager
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
CURRENT
MANIFEST-000001
index
data_0
data_1
data_2
data_3
powershell.exe.log
winword.exe_Rules.xml
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
Microsoft_Windows_Explorer
https___java_com_help
{6D809377-6AF0-444B-8957-A3773F02200E}_VideoLAN_VLC_VideoLAN Website_url
{6D809377-6AF0-444B-8957-A3773F02200E}_VideoLAN_VLC_vlc_exe
0.1.filtertrie.intermediate.txt
0.2.filtertrie.intermediate.txt
AppCache133727655840085328.txt
AppCache133727656363999749.txt
AppCache133727662640605367.txt
AppCache133727665714398674.txt.luxy
GK9X59JWEe.README.txt
__PSScriptPolicyTest_hjt1sw55.rjs.ps1
memory/1116-48-0x000002E07FDE0000-0x000002E07FDEA000-memory.dmp
memory/1116-49-0x000002E07FE40000-0x000002E07FE52000-memory.dmp
memory/1116-5-0x000002E07FE00000-0x000002E07FE1E000-memory.dmp
memory/1116-4-0x000002E080070000-0x000002E0800C0000-memory.dmp
memory/1116-3-0x000002E07FFF0000-0x000002E080066000-memory.dmp
memory/1116-2-0x00007FF982040000-0x00007FF982B01000-memory.dmp
memory/1116-2095-0x00007FF982040000-0x00007FF982B01000-memory.dmp
memory/1116-0-0x00007FF982043000-0x00007FF982045000-memory.dmp
memory/1116-65-0x00007FF982043000-0x00007FF982045000-memory.dmp
memory/1116-1-0x000002E07E0E0000-0x000002E07E124000-memory.dmp
memory/1116-66-0x00007FF982040000-0x00007FF982B01000-memory.dmp
memory/4708-33-0x00007FF982040000-0x00007FF982B01000-memory.dmp
memory/4708-7-0x00007FF982040000-0x00007FF982B01000-memory.dmp
memory/4708-30-0x00007FF982040000-0x00007FF982B01000-memory.dmp
memory/4708-17-0x0000025C1F930000-0x0000025C1F952000-memory.dmp
memory/4708-6-0x00007FF982040000-0x00007FF982B01000-memory.dmp