Analysis
-
max time kernel
117s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
26-11-2024 02:28
Behavioral task
behavioral1
Sample
PepperX.exe
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral2
Sample
PepperX.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
General
-
Target
PepperX.exe
-
Size
146KB
-
MD5
39c9477cf131ca5ccc05c8871c0e10e6
-
SHA1
07b2581b2cb41053d09c4bb896aaabc1d28f2a7b
-
SHA256
939281eac1c6e5aa2e4238a1e545e67b2609c15f517474b2a5133bb64fe9c1eb
-
SHA512
689fd585232031f746b1573d3ed66ac329420611d4e1092ce6952b49ab0c168091726bd02189a4e183d1196ced4f51953e4eb25a5219a36f86d8f6761da9f129
-
SSDEEP
1536:xzICS4AAwczUUf8y8gvMH+1zGSNAojMP95D1xDqk3sA9atm8z+L8QBfuSoyAMjwT:KqJogYkcSNm9V7D7352v+L8DnyAewT
Malware Config
Signatures
-
Renames multiple (347) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Deletes itself 1 IoCs
Processes:
9157.tmppid Process 1868 9157.tmp -
Executes dropped EXE 1 IoCs
Processes:
9157.tmppid Process 1868 9157.tmp -
Loads dropped DLL 1 IoCs
Processes:
PepperX.exepid Process 2680 PepperX.exe -
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops desktop.ini file(s) 2 IoCs
Processes:
PepperX.exedescription ioc Process File opened for modification C:\$Recycle.Bin\S-1-5-21-3533259084-2542256011-65585152-1000\desktop.ini PepperX.exe File opened for modification F:\$RECYCLE.BIN\S-1-5-21-3533259084-2542256011-65585152-1000\desktop.ini PepperX.exe -
Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
-
Sets desktop wallpaper using registry 2 TTPs 2 IoCs
Processes:
PepperX.exedescription ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Control Panel\Desktop\WallPaper = "C:\\ProgramData\\1pvSvxmZY.bmp" PepperX.exe Set value (str) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Control Panel\Desktop\Wallpaper = "C:\\ProgramData\\1pvSvxmZY.bmp" PepperX.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
Processes:
9157.tmppid Process 1868 9157.tmp -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
PepperX.exe9157.tmpcmd.exedescription ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PepperX.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9157.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe -
Modifies Control Panel 2 IoCs
Processes:
PepperX.exedescription ioc Process Key created \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Control Panel\Desktop PepperX.exe Set value (str) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Control Panel\Desktop\WallpaperStyle = "10" PepperX.exe -
Modifies registry class 5 IoCs
Processes:
PepperX.exedescription ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.1pvSvxmZY PepperX.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.1pvSvxmZY\ = "1pvSvxmZY" PepperX.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\1pvSvxmZY\DefaultIcon PepperX.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\1pvSvxmZY PepperX.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\1pvSvxmZY\DefaultIcon\ = "C:\\ProgramData\\1pvSvxmZY.ico" PepperX.exe -
Opens file in notepad (likely ransom note) 1 IoCs
Processes:
NOTEPAD.EXEpid Process 2404 NOTEPAD.EXE -
Suspicious behavior: EnumeratesProcesses 14 IoCs
Processes:
PepperX.exepid Process 2680 PepperX.exe 2680 PepperX.exe 2680 PepperX.exe 2680 PepperX.exe 2680 PepperX.exe 2680 PepperX.exe 2680 PepperX.exe 2680 PepperX.exe 2680 PepperX.exe 2680 PepperX.exe 2680 PepperX.exe 2680 PepperX.exe 2680 PepperX.exe 2680 PepperX.exe -
Suspicious behavior: RenamesItself 26 IoCs
Processes:
9157.tmppid Process 1868 9157.tmp 1868 9157.tmp 1868 9157.tmp 1868 9157.tmp 1868 9157.tmp 1868 9157.tmp 1868 9157.tmp 1868 9157.tmp 1868 9157.tmp 1868 9157.tmp 1868 9157.tmp 1868 9157.tmp 1868 9157.tmp 1868 9157.tmp 1868 9157.tmp 1868 9157.tmp 1868 9157.tmp 1868 9157.tmp 1868 9157.tmp 1868 9157.tmp 1868 9157.tmp 1868 9157.tmp 1868 9157.tmp 1868 9157.tmp 1868 9157.tmp 1868 9157.tmp -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
PepperX.exedescription pid Process Token: SeAssignPrimaryTokenPrivilege 2680 PepperX.exe Token: SeBackupPrivilege 2680 PepperX.exe Token: SeDebugPrivilege 2680 PepperX.exe Token: 36 2680 PepperX.exe Token: SeImpersonatePrivilege 2680 PepperX.exe Token: SeIncBasePriorityPrivilege 2680 PepperX.exe Token: SeIncreaseQuotaPrivilege 2680 PepperX.exe Token: 33 2680 PepperX.exe Token: SeManageVolumePrivilege 2680 PepperX.exe Token: SeProfSingleProcessPrivilege 2680 PepperX.exe Token: SeRestorePrivilege 2680 PepperX.exe Token: SeSecurityPrivilege 2680 PepperX.exe Token: SeSystemProfilePrivilege 2680 PepperX.exe Token: SeTakeOwnershipPrivilege 2680 PepperX.exe Token: SeShutdownPrivilege 2680 PepperX.exe Token: SeDebugPrivilege 2680 PepperX.exe Token: SeBackupPrivilege 2680 PepperX.exe Token: SeBackupPrivilege 2680 PepperX.exe Token: SeSecurityPrivilege 2680 PepperX.exe Token: SeSecurityPrivilege 2680 PepperX.exe Token: SeBackupPrivilege 2680 PepperX.exe Token: SeBackupPrivilege 2680 PepperX.exe Token: SeSecurityPrivilege 2680 PepperX.exe Token: SeSecurityPrivilege 2680 PepperX.exe Token: SeBackupPrivilege 2680 PepperX.exe Token: SeBackupPrivilege 2680 PepperX.exe Token: SeSecurityPrivilege 2680 PepperX.exe Token: SeSecurityPrivilege 2680 PepperX.exe Token: SeBackupPrivilege 2680 PepperX.exe Token: SeBackupPrivilege 2680 PepperX.exe Token: SeSecurityPrivilege 2680 PepperX.exe Token: SeSecurityPrivilege 2680 PepperX.exe Token: SeBackupPrivilege 2680 PepperX.exe Token: SeBackupPrivilege 2680 PepperX.exe Token: SeSecurityPrivilege 2680 PepperX.exe Token: SeSecurityPrivilege 2680 PepperX.exe Token: SeBackupPrivilege 2680 PepperX.exe Token: SeBackupPrivilege 2680 PepperX.exe Token: SeSecurityPrivilege 2680 PepperX.exe Token: SeSecurityPrivilege 2680 PepperX.exe Token: SeBackupPrivilege 2680 PepperX.exe Token: SeBackupPrivilege 2680 PepperX.exe Token: SeSecurityPrivilege 2680 PepperX.exe Token: SeSecurityPrivilege 2680 PepperX.exe Token: SeBackupPrivilege 2680 PepperX.exe Token: SeBackupPrivilege 2680 PepperX.exe Token: SeSecurityPrivilege 2680 PepperX.exe Token: SeSecurityPrivilege 2680 PepperX.exe Token: SeBackupPrivilege 2680 PepperX.exe Token: SeBackupPrivilege 2680 PepperX.exe Token: SeSecurityPrivilege 2680 PepperX.exe Token: SeSecurityPrivilege 2680 PepperX.exe Token: SeBackupPrivilege 2680 PepperX.exe Token: SeBackupPrivilege 2680 PepperX.exe Token: SeSecurityPrivilege 2680 PepperX.exe Token: SeSecurityPrivilege 2680 PepperX.exe Token: SeBackupPrivilege 2680 PepperX.exe Token: SeBackupPrivilege 2680 PepperX.exe Token: SeSecurityPrivilege 2680 PepperX.exe Token: SeSecurityPrivilege 2680 PepperX.exe Token: SeBackupPrivilege 2680 PepperX.exe Token: SeBackupPrivilege 2680 PepperX.exe Token: SeSecurityPrivilege 2680 PepperX.exe Token: SeSecurityPrivilege 2680 PepperX.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
NOTEPAD.EXEpid Process 2404 NOTEPAD.EXE -
Suspicious use of WriteProcessMemory 9 IoCs
Processes:
PepperX.exe9157.tmpdescription pid Process procid_target PID 2680 wrote to memory of 1868 2680 PepperX.exe 32 PID 2680 wrote to memory of 1868 2680 PepperX.exe 32 PID 2680 wrote to memory of 1868 2680 PepperX.exe 32 PID 2680 wrote to memory of 1868 2680 PepperX.exe 32 PID 2680 wrote to memory of 1868 2680 PepperX.exe 32 PID 1868 wrote to memory of 2244 1868 9157.tmp 33 PID 1868 wrote to memory of 2244 1868 9157.tmp 33 PID 1868 wrote to memory of 2244 1868 9157.tmp 33 PID 1868 wrote to memory of 2244 1868 9157.tmp 33
Processes
-
C:\Users\Admin\AppData\Local\Temp\PepperX.exe"C:\Users\Admin\AppData\Local\Temp\PepperX.exe"1⤵
- Loads dropped DLL
- Drops desktop.ini file(s)
- Sets desktop wallpaper using registry
- System Location Discovery: System Language Discovery
- Modifies Control Panel
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2680 -
C:\ProgramData\9157.tmp"C:\ProgramData\9157.tmp"2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:1868 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C DEL /F /Q C:\PROGRA~3\9157.tmp >> NUL3⤵
- System Location Discovery: System Language Discovery
PID:2244
-
-
-
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\1pvSvxmZY.README.txt1⤵
- Opens file in notepad (likely ransom note)
- Suspicious use of FindShellTrayWindow
PID:2404
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x14c1⤵PID:1692
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
129B
MD5ca37281330fcbad09344a00727b9dea5
SHA14e551ba08ff0d478769c6a123ce7ffc29510cc9f
SHA256716b6349440f63a0bc075f6f10435e72a707557fc9adfb4ed7b419f4eb17fbb5
SHA512639e53135c18e313f0617d2434743d16e93bfcd5b980f97525d730021c3e25316ac1189625d372ede6f785ae926147348da7fe05f668848c0985b927e45684ce
-
Filesize
348B
MD59810eed5ecd966874ebeb398ac6531ed
SHA117d2e2bc15df652734b79185cb323e652559fd6a
SHA25653183e5ed0cf42bed46b17c9dcc92ea49737bb57dce34f1e20675a913796566e
SHA512b26ca61461ed8b09f037e33d209cd0a22959b89e3e7895e057f544010fd5ae037e4fa76311763c121cd6e8b3050de22fa7d2163b4d9cf40585e14f5024e0cb79
-
Filesize
146KB
MD572d68e28468a93f74f6800fcd7a7bf68
SHA1a40b4bfdd94d154b6e53d479a599c23c6a2a719f
SHA25648b2e164e3ecbd59a430c1f6c15ee78cd195835b143c235e45f650a928a62ba1
SHA512bbfa7faba404e1a4f64026e2c19d7cb68cd53041db3a98171da0b21393d94023956aca14c86b44f823ab71b9858c5930df4d6cdeee9dfb73dbfe63fb0668b79e
-
Filesize
129B
MD5f672a267381c6edc2435533fdbe246b4
SHA1edee3fde55dbae2aa4b543535239e54f927eb936
SHA256812ec78ac27a960da822929ada2ca4d5869f1dde9151e9aebb52c8426b45f9ee
SHA5128f1181342e23f1e1f2cc08ac7cc453a3933212f571a3c6999ea1ad8cfd3417b088a95e442bb39e4c272afe20eae9cc325b8e5d38f37bff1f4ee62d310d9e5130
-
Filesize
14KB
MD5294e9f64cb1642dd89229fff0592856b
SHA197b148c27f3da29ba7b18d6aee8a0db9102f47c9
SHA256917e115cc403e29b4388e0d175cbfac3e7e40ca1742299fbdb353847db2de7c2
SHA512b87d531890bf1577b9b4af41dddb2cdbbfa164cf197bd5987df3a3075983645a3acba443e289b7bfd338422978a104f55298fbfe346872de0895bde44adc89cf