Analysis
-
max time kernel
118s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
02-01-2025 16:44
Behavioral task
behavioral1
Sample
458455e84390b7cdcc4008e104717ef1255245707e3329978a22e0129374d898.exe
Resource
win7-20241010-en
windows7-x64
16 signatures
150 seconds
Behavioral task
behavioral2
Sample
458455e84390b7cdcc4008e104717ef1255245707e3329978a22e0129374d898.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
17 signatures
150 seconds
General
-
Target
458455e84390b7cdcc4008e104717ef1255245707e3329978a22e0129374d898.exe
-
Size
160KB
-
MD5
f33a0c04a1984e22cf953cc811f6d4cf
-
SHA1
90eb7457e9952738195f7203bdde11ee8a77c8ba
-
SHA256
458455e84390b7cdcc4008e104717ef1255245707e3329978a22e0129374d898
-
SHA512
e241c70576f99f84575a05c5d1e9a112e91d3ebb1578d364dac1a0f5d25a8c7fff82ca8aa5e1a5598e7e0800c149f4c648630b41a6ae790e37713040d802d5fb
-
SSDEEP
3072:vDDDDDDDDDDDDDDDDDDDE45d/t6sVkgZqltP3368+QBVBuEsMeUI/EQ9BW:R5d/zugZqll3LHVeVB
Score
9/10
Malware Config
Signatures
-
Renames multiple (165) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Deletes itself 1 IoCs
pid Process 1244 BBB1.tmp -
Executes dropped EXE 1 IoCs
pid Process 1244 BBB1.tmp -
Loads dropped DLL 1 IoCs
pid Process 3044 458455e84390b7cdcc4008e104717ef1255245707e3329978a22e0129374d898.exe -
Drops desktop.ini file(s) 2 IoCs
description ioc Process File opened for modification C:\$Recycle.Bin\S-1-5-21-2039016743-699959520-214465309-1000\desktop.ini 458455e84390b7cdcc4008e104717ef1255245707e3329978a22e0129374d898.exe File opened for modification F:\$RECYCLE.BIN\S-1-5-21-2039016743-699959520-214465309-1000\desktop.ini 458455e84390b7cdcc4008e104717ef1255245707e3329978a22e0129374d898.exe -
Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
-
Sets desktop wallpaper using registry 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Control Panel\Desktop\WallPaper = "C:\\ProgramData\\XA2JxFVyZ.bmp" 458455e84390b7cdcc4008e104717ef1255245707e3329978a22e0129374d898.exe Set value (str) \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Control Panel\Desktop\Wallpaper = "C:\\ProgramData\\XA2JxFVyZ.bmp" 458455e84390b7cdcc4008e104717ef1255245707e3329978a22e0129374d898.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 12 IoCs
pid Process 3044 458455e84390b7cdcc4008e104717ef1255245707e3329978a22e0129374d898.exe 3044 458455e84390b7cdcc4008e104717ef1255245707e3329978a22e0129374d898.exe 3044 458455e84390b7cdcc4008e104717ef1255245707e3329978a22e0129374d898.exe 3044 458455e84390b7cdcc4008e104717ef1255245707e3329978a22e0129374d898.exe 3044 458455e84390b7cdcc4008e104717ef1255245707e3329978a22e0129374d898.exe 3044 458455e84390b7cdcc4008e104717ef1255245707e3329978a22e0129374d898.exe 1244 BBB1.tmp 1244 BBB1.tmp 1244 BBB1.tmp 1244 BBB1.tmp 1244 BBB1.tmp 1244 BBB1.tmp -
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 458455e84390b7cdcc4008e104717ef1255245707e3329978a22e0129374d898.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BBB1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe -
Modifies Control Panel 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Control Panel\Desktop 458455e84390b7cdcc4008e104717ef1255245707e3329978a22e0129374d898.exe Set value (str) \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Control Panel\Desktop\WallpaperStyle = "10" 458455e84390b7cdcc4008e104717ef1255245707e3329978a22e0129374d898.exe -
Modifies registry class 5 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.XA2JxFVyZ 458455e84390b7cdcc4008e104717ef1255245707e3329978a22e0129374d898.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.XA2JxFVyZ\ = "XA2JxFVyZ" 458455e84390b7cdcc4008e104717ef1255245707e3329978a22e0129374d898.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\XA2JxFVyZ\DefaultIcon 458455e84390b7cdcc4008e104717ef1255245707e3329978a22e0129374d898.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\XA2JxFVyZ 458455e84390b7cdcc4008e104717ef1255245707e3329978a22e0129374d898.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\XA2JxFVyZ\DefaultIcon\ = "C:\\ProgramData\\XA2JxFVyZ.ico" 458455e84390b7cdcc4008e104717ef1255245707e3329978a22e0129374d898.exe -
Suspicious behavior: EnumeratesProcesses 12 IoCs
pid Process 3044 458455e84390b7cdcc4008e104717ef1255245707e3329978a22e0129374d898.exe 3044 458455e84390b7cdcc4008e104717ef1255245707e3329978a22e0129374d898.exe 3044 458455e84390b7cdcc4008e104717ef1255245707e3329978a22e0129374d898.exe 3044 458455e84390b7cdcc4008e104717ef1255245707e3329978a22e0129374d898.exe 3044 458455e84390b7cdcc4008e104717ef1255245707e3329978a22e0129374d898.exe 3044 458455e84390b7cdcc4008e104717ef1255245707e3329978a22e0129374d898.exe 3044 458455e84390b7cdcc4008e104717ef1255245707e3329978a22e0129374d898.exe 3044 458455e84390b7cdcc4008e104717ef1255245707e3329978a22e0129374d898.exe 3044 458455e84390b7cdcc4008e104717ef1255245707e3329978a22e0129374d898.exe 3044 458455e84390b7cdcc4008e104717ef1255245707e3329978a22e0129374d898.exe 3044 458455e84390b7cdcc4008e104717ef1255245707e3329978a22e0129374d898.exe 3044 458455e84390b7cdcc4008e104717ef1255245707e3329978a22e0129374d898.exe -
Suspicious behavior: RenamesItself 26 IoCs
pid Process 1244 BBB1.tmp 1244 BBB1.tmp 1244 BBB1.tmp 1244 BBB1.tmp 1244 BBB1.tmp 1244 BBB1.tmp 1244 BBB1.tmp 1244 BBB1.tmp 1244 BBB1.tmp 1244 BBB1.tmp 1244 BBB1.tmp 1244 BBB1.tmp 1244 BBB1.tmp 1244 BBB1.tmp 1244 BBB1.tmp 1244 BBB1.tmp 1244 BBB1.tmp 1244 BBB1.tmp 1244 BBB1.tmp 1244 BBB1.tmp 1244 BBB1.tmp 1244 BBB1.tmp 1244 BBB1.tmp 1244 BBB1.tmp 1244 BBB1.tmp 1244 BBB1.tmp -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeAssignPrimaryTokenPrivilege 3044 458455e84390b7cdcc4008e104717ef1255245707e3329978a22e0129374d898.exe Token: SeBackupPrivilege 3044 458455e84390b7cdcc4008e104717ef1255245707e3329978a22e0129374d898.exe Token: SeDebugPrivilege 3044 458455e84390b7cdcc4008e104717ef1255245707e3329978a22e0129374d898.exe Token: 36 3044 458455e84390b7cdcc4008e104717ef1255245707e3329978a22e0129374d898.exe Token: SeImpersonatePrivilege 3044 458455e84390b7cdcc4008e104717ef1255245707e3329978a22e0129374d898.exe Token: SeIncBasePriorityPrivilege 3044 458455e84390b7cdcc4008e104717ef1255245707e3329978a22e0129374d898.exe Token: SeIncreaseQuotaPrivilege 3044 458455e84390b7cdcc4008e104717ef1255245707e3329978a22e0129374d898.exe Token: 33 3044 458455e84390b7cdcc4008e104717ef1255245707e3329978a22e0129374d898.exe Token: SeManageVolumePrivilege 3044 458455e84390b7cdcc4008e104717ef1255245707e3329978a22e0129374d898.exe Token: SeProfSingleProcessPrivilege 3044 458455e84390b7cdcc4008e104717ef1255245707e3329978a22e0129374d898.exe Token: SeRestorePrivilege 3044 458455e84390b7cdcc4008e104717ef1255245707e3329978a22e0129374d898.exe Token: SeSecurityPrivilege 3044 458455e84390b7cdcc4008e104717ef1255245707e3329978a22e0129374d898.exe Token: SeSystemProfilePrivilege 3044 458455e84390b7cdcc4008e104717ef1255245707e3329978a22e0129374d898.exe Token: SeTakeOwnershipPrivilege 3044 458455e84390b7cdcc4008e104717ef1255245707e3329978a22e0129374d898.exe Token: SeShutdownPrivilege 3044 458455e84390b7cdcc4008e104717ef1255245707e3329978a22e0129374d898.exe Token: SeDebugPrivilege 3044 458455e84390b7cdcc4008e104717ef1255245707e3329978a22e0129374d898.exe Token: SeBackupPrivilege 2924 vssvc.exe Token: SeRestorePrivilege 2924 vssvc.exe Token: SeAuditPrivilege 2924 vssvc.exe Token: SeBackupPrivilege 3044 458455e84390b7cdcc4008e104717ef1255245707e3329978a22e0129374d898.exe Token: SeBackupPrivilege 3044 458455e84390b7cdcc4008e104717ef1255245707e3329978a22e0129374d898.exe Token: SeSecurityPrivilege 3044 458455e84390b7cdcc4008e104717ef1255245707e3329978a22e0129374d898.exe Token: SeSecurityPrivilege 3044 458455e84390b7cdcc4008e104717ef1255245707e3329978a22e0129374d898.exe Token: SeBackupPrivilege 3044 458455e84390b7cdcc4008e104717ef1255245707e3329978a22e0129374d898.exe Token: SeBackupPrivilege 3044 458455e84390b7cdcc4008e104717ef1255245707e3329978a22e0129374d898.exe Token: SeSecurityPrivilege 3044 458455e84390b7cdcc4008e104717ef1255245707e3329978a22e0129374d898.exe Token: SeSecurityPrivilege 3044 458455e84390b7cdcc4008e104717ef1255245707e3329978a22e0129374d898.exe Token: SeBackupPrivilege 3044 458455e84390b7cdcc4008e104717ef1255245707e3329978a22e0129374d898.exe Token: SeBackupPrivilege 3044 458455e84390b7cdcc4008e104717ef1255245707e3329978a22e0129374d898.exe Token: SeSecurityPrivilege 3044 458455e84390b7cdcc4008e104717ef1255245707e3329978a22e0129374d898.exe Token: SeSecurityPrivilege 3044 458455e84390b7cdcc4008e104717ef1255245707e3329978a22e0129374d898.exe Token: SeBackupPrivilege 3044 458455e84390b7cdcc4008e104717ef1255245707e3329978a22e0129374d898.exe Token: SeBackupPrivilege 3044 458455e84390b7cdcc4008e104717ef1255245707e3329978a22e0129374d898.exe Token: SeSecurityPrivilege 3044 458455e84390b7cdcc4008e104717ef1255245707e3329978a22e0129374d898.exe Token: SeSecurityPrivilege 3044 458455e84390b7cdcc4008e104717ef1255245707e3329978a22e0129374d898.exe Token: SeBackupPrivilege 3044 458455e84390b7cdcc4008e104717ef1255245707e3329978a22e0129374d898.exe Token: SeBackupPrivilege 3044 458455e84390b7cdcc4008e104717ef1255245707e3329978a22e0129374d898.exe Token: SeSecurityPrivilege 3044 458455e84390b7cdcc4008e104717ef1255245707e3329978a22e0129374d898.exe Token: SeSecurityPrivilege 3044 458455e84390b7cdcc4008e104717ef1255245707e3329978a22e0129374d898.exe Token: SeBackupPrivilege 3044 458455e84390b7cdcc4008e104717ef1255245707e3329978a22e0129374d898.exe Token: SeBackupPrivilege 3044 458455e84390b7cdcc4008e104717ef1255245707e3329978a22e0129374d898.exe Token: SeSecurityPrivilege 3044 458455e84390b7cdcc4008e104717ef1255245707e3329978a22e0129374d898.exe Token: SeSecurityPrivilege 3044 458455e84390b7cdcc4008e104717ef1255245707e3329978a22e0129374d898.exe Token: SeBackupPrivilege 3044 458455e84390b7cdcc4008e104717ef1255245707e3329978a22e0129374d898.exe Token: SeBackupPrivilege 3044 458455e84390b7cdcc4008e104717ef1255245707e3329978a22e0129374d898.exe Token: SeSecurityPrivilege 3044 458455e84390b7cdcc4008e104717ef1255245707e3329978a22e0129374d898.exe Token: SeSecurityPrivilege 3044 458455e84390b7cdcc4008e104717ef1255245707e3329978a22e0129374d898.exe Token: SeBackupPrivilege 3044 458455e84390b7cdcc4008e104717ef1255245707e3329978a22e0129374d898.exe Token: SeBackupPrivilege 3044 458455e84390b7cdcc4008e104717ef1255245707e3329978a22e0129374d898.exe Token: SeSecurityPrivilege 3044 458455e84390b7cdcc4008e104717ef1255245707e3329978a22e0129374d898.exe Token: SeSecurityPrivilege 3044 458455e84390b7cdcc4008e104717ef1255245707e3329978a22e0129374d898.exe Token: SeBackupPrivilege 3044 458455e84390b7cdcc4008e104717ef1255245707e3329978a22e0129374d898.exe Token: SeBackupPrivilege 3044 458455e84390b7cdcc4008e104717ef1255245707e3329978a22e0129374d898.exe Token: SeSecurityPrivilege 3044 458455e84390b7cdcc4008e104717ef1255245707e3329978a22e0129374d898.exe Token: SeSecurityPrivilege 3044 458455e84390b7cdcc4008e104717ef1255245707e3329978a22e0129374d898.exe Token: SeBackupPrivilege 3044 458455e84390b7cdcc4008e104717ef1255245707e3329978a22e0129374d898.exe Token: SeBackupPrivilege 3044 458455e84390b7cdcc4008e104717ef1255245707e3329978a22e0129374d898.exe Token: SeSecurityPrivilege 3044 458455e84390b7cdcc4008e104717ef1255245707e3329978a22e0129374d898.exe Token: SeSecurityPrivilege 3044 458455e84390b7cdcc4008e104717ef1255245707e3329978a22e0129374d898.exe Token: SeBackupPrivilege 3044 458455e84390b7cdcc4008e104717ef1255245707e3329978a22e0129374d898.exe Token: SeBackupPrivilege 3044 458455e84390b7cdcc4008e104717ef1255245707e3329978a22e0129374d898.exe Token: SeSecurityPrivilege 3044 458455e84390b7cdcc4008e104717ef1255245707e3329978a22e0129374d898.exe Token: SeSecurityPrivilege 3044 458455e84390b7cdcc4008e104717ef1255245707e3329978a22e0129374d898.exe Token: SeBackupPrivilege 3044 458455e84390b7cdcc4008e104717ef1255245707e3329978a22e0129374d898.exe -
Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 3044 wrote to memory of 1244 3044 458455e84390b7cdcc4008e104717ef1255245707e3329978a22e0129374d898.exe 34 PID 3044 wrote to memory of 1244 3044 458455e84390b7cdcc4008e104717ef1255245707e3329978a22e0129374d898.exe 34 PID 3044 wrote to memory of 1244 3044 458455e84390b7cdcc4008e104717ef1255245707e3329978a22e0129374d898.exe 34 PID 3044 wrote to memory of 1244 3044 458455e84390b7cdcc4008e104717ef1255245707e3329978a22e0129374d898.exe 34 PID 3044 wrote to memory of 1244 3044 458455e84390b7cdcc4008e104717ef1255245707e3329978a22e0129374d898.exe 34 PID 1244 wrote to memory of 2300 1244 BBB1.tmp 38 PID 1244 wrote to memory of 2300 1244 BBB1.tmp 38 PID 1244 wrote to memory of 2300 1244 BBB1.tmp 38 PID 1244 wrote to memory of 2300 1244 BBB1.tmp 38 -
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\458455e84390b7cdcc4008e104717ef1255245707e3329978a22e0129374d898.exe"C:\Users\Admin\AppData\Local\Temp\458455e84390b7cdcc4008e104717ef1255245707e3329978a22e0129374d898.exe"1⤵
- Loads dropped DLL
- Drops desktop.ini file(s)
- Sets desktop wallpaper using registry
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Modifies Control Panel
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3044 -
C:\ProgramData\BBB1.tmp"C:\ProgramData\BBB1.tmp"2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:1244 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C DEL /F /Q C:\PROGRA~3\BBB1.tmp >> NUL3⤵
- System Location Discovery: System Language Discovery
PID:2300
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2924
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x1481⤵PID:2968
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
129B
MD55b0071920ac9d44af751b66cfa5e06f9
SHA195ac295a81b4fe0e3487a87ca6f83183c2dca13f
SHA256b2f0c811bea519a1bf88221fc7e89ac367ff03e73caf02f249f2a3b57260c37a
SHA512f7e87b417af76b253c5b8fd8a91e2e1c6cedef0f958fbe7510f29816e47dbe673ee980d89058fc6b2faa4a4a1b5bdd334eabee5e99aaae77302aefb4c02eae8d
-
C:\Users\Admin\AppData\Local\Temp\DDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDD
Filesize160KB
MD5be9ced9ae5ccc077207195ddb4c8b681
SHA18b23c7520fa7ee919999fb41463788bcde75fbf0
SHA2564604dffa6ade545412802ee4534c77026693dfd2cc9179475e8bc8bb8191d021
SHA5121de2d35a518fce90f342dc17f05e410c5c2c4a440763398187590ec41024eb728f451fcc37cb38ca9d9504aabab48ef090ddb794eceae54dc94657d802ccaf88
-
Filesize
6KB
MD533c9444cf7e7eca4866c050fa0303c45
SHA196875a5838049c77cdfcaddd6a08f389b8c82194
SHA2568a02f7e128b720e5a74e65de340282ff637b0d7163839cee7f6ee1392dca01cd
SHA5120118ff08a15c15e149cc4acf3a772552742e310aa3a72950f27a53627d8f0b36814d3a6ce0ea5621e9264bbeb66ba9552a4da6e7a281a810aeba9aa2434602f6
-
Filesize
129B
MD59b189536a6d4169faa18cb76b3592226
SHA1de596a91917e63000badd050629a77bd9e67d9b6
SHA2567a686ce1f148def471232b93615a2bae9646d381c6a86f417cc3a28728f0f171
SHA51225f8834eafd1aa6aabd57e5c1aa24675de6034f88b55f155df4da3d2ba32fde8dc064de13d3a13bec91c8593326b3fe6dbb50db3bde2572fe3fc76ec5635df65
-
Filesize
14KB
MD5294e9f64cb1642dd89229fff0592856b
SHA197b148c27f3da29ba7b18d6aee8a0db9102f47c9
SHA256917e115cc403e29b4388e0d175cbfac3e7e40ca1742299fbdb353847db2de7c2
SHA512b87d531890bf1577b9b4af41dddb2cdbbfa164cf197bd5987df3a3075983645a3acba443e289b7bfd338422978a104f55298fbfe346872de0895bde44adc89cf