a6643508f9a45e08bfede83306e5d3676ea859c19a7a796456984c35fb3c482a

Resubmissions

24/12/2024, 16:28

241224-tywb7s1qat3

14/12/2024, 01:02

241214-bd5q2asmcz7

10/12/2024, 00:03

241210-acches1ncp7

Analysis

max time kernel
83s
max time network
71s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
14/12/2024, 01:02

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
main.pyc
Size 7.9MB
Sample241214-bd5q2asmcz
SHA256 ab3c63ce035e095a909a733bdcae9952c2ddde137777edd79369ebcd3f8f1959
MD5 9e50c866df672ce07e371975874b1e80
SHA1 23b74b67e8354ed0b9cdbf14b1c5e3cefe61abc8
SHA512 e400c9f98a84becfedcdc4c97a69b862e3d76f181be8f22a94f064e769bf731a22220dc6594e18b497638ce9bc77de16d3b3ecdd10bb95bdf649355214d876fe
SSDEEP 49152:A7lmgKSwPsMhMUHfWNPQBJ7rtyI4E6DpaBmWlfN77FYV3OQ/+2vFGk+swa2jDmOz:aRa
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings	cmd.exe

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

pid	Process
2892	NOTEPAD.EXE

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1512	msedge.exe
1512	msedge.exe

Suspicious use of SetWindowsHookEx 10 IoCs

pid	Process
3872	OpenWith.exe
3872	OpenWith.exe
3872	OpenWith.exe
3872	OpenWith.exe
3872	OpenWith.exe
3872	OpenWith.exe
3872	OpenWith.exe
3872	OpenWith.exe
3872	OpenWith.exe
3524	SystemSettingsAdminFlows.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3872 wrote to memory of 2892	3872	OpenWith.exe	96
PID 3872 wrote to memory of 2892	3872	OpenWith.exe	96
PID 4648 wrote to memory of 1700	4648	msedge.exe	117
PID 4648 wrote to memory of 1700	4648	msedge.exe	117
PID 4648 wrote to memory of 1716	4648	msedge.exe	118
PID 4648 wrote to memory of 1716	4648	msedge.exe	118
PID 4648 wrote to memory of 1716	4648	msedge.exe	118
PID 4648 wrote to memory of 1716	4648	msedge.exe	118
PID 4648 wrote to memory of 1716	4648	msedge.exe	118
PID 4648 wrote to memory of 1716	4648	msedge.exe	118
PID 4648 wrote to memory of 1716	4648	msedge.exe	118
PID 4648 wrote to memory of 1716	4648	msedge.exe	118
PID 4648 wrote to memory of 1716	4648	msedge.exe	118
PID 4648 wrote to memory of 1716	4648	msedge.exe	118
PID 4648 wrote to memory of 1716	4648	msedge.exe	118
PID 4648 wrote to memory of 1716	4648	msedge.exe	118
PID 4648 wrote to memory of 1716	4648	msedge.exe	118
PID 4648 wrote to memory of 1716	4648	msedge.exe	118
PID 4648 wrote to memory of 1716	4648	msedge.exe	118
PID 4648 wrote to memory of 1716	4648	msedge.exe	118
PID 4648 wrote to memory of 1716	4648	msedge.exe	118
PID 4648 wrote to memory of 1716	4648	msedge.exe	118
PID 4648 wrote to memory of 1716	4648	msedge.exe	118
PID 4648 wrote to memory of 1716	4648	msedge.exe	118
PID 4648 wrote to memory of 1716	4648	msedge.exe	118
PID 4648 wrote to memory of 1716	4648	msedge.exe	118
PID 4648 wrote to memory of 1716	4648	msedge.exe	118
PID 4648 wrote to memory of 1716	4648	msedge.exe	118
PID 4648 wrote to memory of 1716	4648	msedge.exe	118
PID 4648 wrote to memory of 1716	4648	msedge.exe	118
PID 4648 wrote to memory of 1716	4648	msedge.exe	118
PID 4648 wrote to memory of 1716	4648	msedge.exe	118
PID 4648 wrote to memory of 1716	4648	msedge.exe	118
PID 4648 wrote to memory of 1716	4648	msedge.exe	118
PID 4648 wrote to memory of 1716	4648	msedge.exe	118
PID 4648 wrote to memory of 1716	4648	msedge.exe	118
PID 4648 wrote to memory of 1716	4648	msedge.exe	118
PID 4648 wrote to memory of 1716	4648	msedge.exe	118
PID 4648 wrote to memory of 1716	4648	msedge.exe	118
PID 4648 wrote to memory of 1716	4648	msedge.exe	118
PID 4648 wrote to memory of 1716	4648	msedge.exe	118
PID 4648 wrote to memory of 1716	4648	msedge.exe	118
PID 4648 wrote to memory of 1716	4648	msedge.exe	118
PID 4648 wrote to memory of 1716	4648	msedge.exe	118
PID 4648 wrote to memory of 1512	4648	msedge.exe	119
PID 4648 wrote to memory of 1512	4648	msedge.exe	119
PID 4648 wrote to memory of 4540	4648	msedge.exe	120
PID 4648 wrote to memory of 4540	4648	msedge.exe	120
PID 4648 wrote to memory of 4540	4648	msedge.exe	120
PID 4648 wrote to memory of 4540	4648	msedge.exe	120
PID 4648 wrote to memory of 4540	4648	msedge.exe	120
PID 4648 wrote to memory of 4540	4648	msedge.exe	120
PID 4648 wrote to memory of 4540	4648	msedge.exe	120
PID 4648 wrote to memory of 4540	4648	msedge.exe	120
PID 4648 wrote to memory of 4540	4648	msedge.exe	120
PID 4648 wrote to memory of 4540	4648	msedge.exe	120
PID 4648 wrote to memory of 4540	4648	msedge.exe	120
PID 4648 wrote to memory of 4540	4648	msedge.exe	120
PID 4648 wrote to memory of 4540	4648	msedge.exe	120
PID 4648 wrote to memory of 4540	4648	msedge.exe	120
PID 4648 wrote to memory of 4540	4648	msedge.exe	120
PID 4648 wrote to memory of 4540	4648	msedge.exe	120
PID 4648 wrote to memory of 4540	4648	msedge.exe	120
PID 4648 wrote to memory of 4540	4648	msedge.exe	120

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\main.pyc
1⤵
- Modifies registry class
PID:3416

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3872
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\main.pyc
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:2892

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --default-search-provider=? --out-pipe-name=MSEdgeDefault8a16a0edhbbc4h4a7ch92ach903d648fe157
1⤵
- Suspicious use of WriteProcessMemory
PID:4648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x120,0x124,0x128,0xfc,0x12c,0x7ffcd7f146f8,0x7ffcd7f14708,0x7ffcd7f14718
  2⤵
  PID:1700
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2096,11256009391517729698,18171817153320127310,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2144 /prefetch:2
  2⤵
  PID:1716
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2096,11256009391517729698,18171817153320127310,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2228 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2096,11256009391517729698,18171817153320127310,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2964 /prefetch:8
  2⤵
  PID:4540

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1776

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4988

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DisplayEnhancementService
1⤵
PID:3640

C:\Windows\system32\SystemSettingsAdminFlows.exe
"C:\Windows\system32\SystemSettingsAdminFlows.exe" RemoteDesktopTurnOnRdp
1⤵
- Suspicious use of SetWindowsHookEx
PID:3524

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 6e390bbc0d03a652516705775e8e9a7b7936312a8a5bea407f9d7d9fa99d957e
MD5 7de1bbdc1f9cf1a58ae1de4951ce8cb9
SHA1 010da169e15457c25bd80ef02d76a940c1210301
SHA512 e4a33f2128883e71ab41e803e8b55d0ac17cbc51be3bde42bed157df24f10f34ad264f74ef3254dbe30d253aca03158fde21518c2b78aaa05dae8308b1c5f30c
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 5KB
SHA256 12a2c78a29ed70be8550c974c893af02f72ec423924ec90d7f63824e10d4c5b5
MD5 368dcbe6c34d03a5ac458e3b4bc54563
SHA1 1ea63988ee7262e57640bb92746296920818215a
SHA512 be163a8ca6433c3e9a01eb1325a4da21750cfe466a25b1f6badf65896ca3101f9b3292a9420d8aaaa023f4a9cf7975165685faa1fde385ab8e531cfec4b88bde
SSDEEP 96:nNc9adcS1s6KX9wpvWMoiVmdeHtyHW7cOc1pUWQyV+VDCAiEwb:nNc9McSu6KtGWMXt+CcOc1prV
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 afadc695a0b1cef9cf11e0d3a02ac6cda35259d51f80b0d322fde3f7b664c95b
MD5 90ee719ba38e5cc6fc393aed8e53bd65
SHA1 0c0a0f5131b7fb398b51b1eebd1c25c5ba74922b
SHA512 38a2e546673de84d652689b89c0f4b58886068cd12c57a72577cc6e77f91c13e2d80e4b9cecb5a3b0dd9711f9ecb0a83a723da30d9314470cd58f2af1e812195
SSDEEP 192:E/oCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupNT8Je2RUhcu3mL2cLc7u:En9iIxuERzA83h09RZxYRWGcJCcLc7u
MD5 SHA1 SHA512 SSDEEP

Submit Download