Analysis
- max time kernel
78s - max time network
40s - platform
windows7_x64 - resource
win7-20241010-en - resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system - submitted
09/01/2025, 09:25
Behavioral task
behavioral1
Sample
1.exe
Resource
win7-20241010-en
windows7-x64
14 signatures
150 seconds
Behavioral task
behavioral2
Sample
1.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
14 signatures
150 seconds
General
- Target 1.exe
- Size 147KB
- Sample250109-ldly2awkhs
- SHA256 6f3d87f3dcfd248e64d26cf338a19f41a6f93affdde5fab071a631ff38637757
- MD5 c09185c157831e4915c255d7002941f4
- SHA1 beca597f2c2c120c3d74163501a81f56664ff4f7
- SHA512 a843854ca79f4d98938635612d20f3d5b79d8661ee91d1ae130b2deffe95e44d7028f76b8b221c87fab0638afe5baf3c55e8348f8aa10dddc90133167a3c17bf
- SSDEEP 3072:SqJogYkcSNm9V7DnfX/91c6G+Mqc+2EIEMF+T:Sq2kc4m9tDnfXPc6g+2XEMF
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Malware Config
Extracted
Path
-
C:\5VFg9o5tW.README.txt
Ransom Note
- ------Dear managers!------ If you are reading this, it means your network has been attacked. What does that mean? We hacked your network and now all your files, documents, client database, projects and other important data safely encrypted with reliable algorithms. we also have a copy of all your data. WARNING!!! You don't have to go to the POLICE, etc. Otherwise we will not be able to help you. You cannot acces the files right now. But do not worry. You can get it back! It is easy to recover in a few steps. As proof, we can decrypt any 3 files you provide. We are not interested to ruin your business. We want to get ransom and be happy. Please bring this information to your team leaders as soon as possible. In case of a successfull transaction, we will restore your systems within 4-6 hours and also provide security recommendations. -----------------------WARNING----------------------- If you modify files - our decrypt software won't able to recover data If you use third party software - you can damage/modify files (see item 1) You nedd cipher key / our decrypt software to restore you files. The police or authorities will not be able to help you get the cipher key. We encourage you to consider your decisions. -----------------------RECOVERY----------------------- Use email: [email protected] Alternative email address: [email protected] ([email protected]) ID message: c5337115f1d1a
Signatures
- Renames multiple (350) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
- Deletes itself 1 IoCs
pid Process 2192 32C4.tmp - Executes dropped EXE 1 IoCs
pid Process 2192 32C4.tmp - Loads dropped DLL 1 IoCs
pid Process 2460 1.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Drops desktop.ini file(s) 2 IoCs
description ioc Process File opened for modification C:\$Recycle.Bin\S-1-5-21-3692679935-4019334568-335155002-1000\desktop.ini 1.exe File opened for modification F:\$RECYCLE.BIN\S-1-5-21-3692679935-4019334568-335155002-1000\desktop.ini 1.exe - Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
- Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
pid Process 2192 32C4.tmp - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 32C4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe - Suspicious behavior: EnumeratesProcesses 16 IoCs
pid Process 2460 1.exe 2460 1.exe 2460 1.exe 2460 1.exe 2460 1.exe 2460 1.exe 2460 1.exe 2460 1.exe 2460 1.exe 2460 1.exe 2460 1.exe 2460 1.exe 2460 1.exe 2460 1.exe 2460 1.exe 2460 1.exe - Suspicious behavior: RenamesItself 26 IoCs
pid Process 2192 32C4.tmp 2192 32C4.tmp 2192 32C4.tmp 2192 32C4.tmp 2192 32C4.tmp 2192 32C4.tmp 2192 32C4.tmp 2192 32C4.tmp 2192 32C4.tmp 2192 32C4.tmp 2192 32C4.tmp 2192 32C4.tmp 2192 32C4.tmp 2192 32C4.tmp 2192 32C4.tmp 2192 32C4.tmp 2192 32C4.tmp 2192 32C4.tmp 2192 32C4.tmp 2192 32C4.tmp 2192 32C4.tmp 2192 32C4.tmp 2192 32C4.tmp 2192 32C4.tmp 2192 32C4.tmp 2192 32C4.tmp - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeAssignPrimaryTokenPrivilege 2460 1.exe Token: SeBackupPrivilege 2460 1.exe Token: SeDebugPrivilege 2460 1.exe Token: 36 2460 1.exe Token: SeImpersonatePrivilege 2460 1.exe Token: SeIncBasePriorityPrivilege 2460 1.exe Token: SeIncreaseQuotaPrivilege 2460 1.exe Token: 33 2460 1.exe Token: SeManageVolumePrivilege 2460 1.exe Token: SeProfSingleProcessPrivilege 2460 1.exe Token: SeRestorePrivilege 2460 1.exe Token: SeSecurityPrivilege 2460 1.exe Token: SeSystemProfilePrivilege 2460 1.exe Token: SeTakeOwnershipPrivilege 2460 1.exe Token: SeShutdownPrivilege 2460 1.exe Token: SeDebugPrivilege 2460 1.exe Token: SeBackupPrivilege 2460 1.exe Token: SeBackupPrivilege 2460 1.exe Token: SeSecurityPrivilege 2460 1.exe Token: SeSecurityPrivilege 2460 1.exe Token: SeBackupPrivilege 2460 1.exe Token: SeBackupPrivilege 2460 1.exe Token: SeSecurityPrivilege 2460 1.exe Token: SeSecurityPrivilege 2460 1.exe Token: SeBackupPrivilege 2460 1.exe Token: SeBackupPrivilege 2460 1.exe Token: SeSecurityPrivilege 2460 1.exe Token: SeSecurityPrivilege 2460 1.exe Token: SeBackupPrivilege 2460 1.exe Token: SeBackupPrivilege 2460 1.exe Token: SeSecurityPrivilege 2460 1.exe Token: SeSecurityPrivilege 2460 1.exe Token: SeBackupPrivilege 2460 1.exe Token: SeBackupPrivilege 2460 1.exe Token: SeSecurityPrivilege 2460 1.exe Token: SeSecurityPrivilege 2460 1.exe Token: SeBackupPrivilege 2460 1.exe Token: SeBackupPrivilege 2460 1.exe Token: SeSecurityPrivilege 2460 1.exe Token: SeSecurityPrivilege 2460 1.exe Token: SeBackupPrivilege 2460 1.exe Token: SeBackupPrivilege 2460 1.exe Token: SeSecurityPrivilege 2460 1.exe Token: SeSecurityPrivilege 2460 1.exe Token: SeBackupPrivilege 2460 1.exe Token: SeBackupPrivilege 2460 1.exe Token: SeSecurityPrivilege 2460 1.exe Token: SeSecurityPrivilege 2460 1.exe Token: SeBackupPrivilege 2460 1.exe Token: SeBackupPrivilege 2460 1.exe Token: SeSecurityPrivilege 2460 1.exe Token: SeSecurityPrivilege 2460 1.exe Token: SeBackupPrivilege 2460 1.exe Token: SeBackupPrivilege 2460 1.exe Token: SeSecurityPrivilege 2460 1.exe Token: SeSecurityPrivilege 2460 1.exe Token: SeBackupPrivilege 2460 1.exe Token: SeBackupPrivilege 2460 1.exe Token: SeSecurityPrivilege 2460 1.exe Token: SeSecurityPrivilege 2460 1.exe Token: SeBackupPrivilege 2460 1.exe Token: SeBackupPrivilege 2460 1.exe Token: SeSecurityPrivilege 2460 1.exe Token: SeSecurityPrivilege 2460 1.exe - Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 2460 wrote to memory of 2192 2460 1.exe 31 PID 2460 wrote to memory of 2192 2460 1.exe 31 PID 2460 wrote to memory of 2192 2460 1.exe 31 PID 2460 wrote to memory of 2192 2460 1.exe 31 PID 2460 wrote to memory of 2192 2460 1.exe 31 PID 2192 wrote to memory of 2816 2192 32C4.tmp 32 PID 2192 wrote to memory of 2816 2192 32C4.tmp 32 PID 2192 wrote to memory of 2816 2192 32C4.tmp 32 PID 2192 wrote to memory of 2816 2192 32C4.tmp 32
Processes
-
C:\Users\Admin\AppData\Local\Temp\1.exe"C:\Users\Admin\AppData\Local\Temp\1.exe"1⤵
- Loads dropped DLL
- Drops desktop.ini file(s)
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2460 -
C:\ProgramData\32C4.tmp"C:\ProgramData\32C4.tmp"2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:2192 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C DEL /F /Q C:\PROGRA~3\32C4.tmp >> NUL3⤵
- System Location Discovery: System Language Discovery
PID:2816
-
-
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x1501⤵PID:964
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\$Recycle.Bin\S-1-5-21-3692679935-4019334568-335155002-1000\desktop.ini
- Size 129B
- SHA256 c65a7c30e6da479a57c5d85812a2cd7b20f5d5d6c8a985b37c2378d2b229ef29
- MD5 e72265173d3acb7fefa92b04b12f69b1
- SHA1 8f2ac601661b67ab2b9ea034d7da722e02f4d4e2
- SHA512 e3fd648531ba14e6df534cf9759d4cba08511a712d898b069c2e0bbe394be82577bdd83ef5d6f4ce7e91c18c5e7cde73305a2dd0eee68c05b6e232e54caf1ebc
- MD5 SHA1 SHA512
- Path C:\5VFg9o5tW.README.txt
- Size 1KB
- SHA256 94aaefad5d5a9fea79e9271941a5e874951cceac46a110ef0f1de841051f6421
- MD5 17e3459297cd54cf124d089248ff395b
- SHA1 617e2ddd0a69a242d4da510d32670a170ff667fa
- SHA512 280536a672423a4bf4df1cb7cd49bd0a7a3f731dfe4543359a84d3a82d734e3882386b336af62a77e2763cbe7fe9e4ff6ae852241dd61ab702cda1b0d2f02e13
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\DDDDD
- Size 147KB
- SHA256 df0d21b2513b5b72eab9554ac993c694e9803822fad4b4c0658245a13d8749ef
- MD5 3712aa46109fe449b0318aa2f08e8843
- SHA1 e9ca98bce7eb8f9b542f3f24d800cc683ee7ae5a
- SHA512 3b2fd91c9f30c693a472e59c08b5028638dd8cdecb7290a231a3976d75c9879c7261cbf723d02b64dba4b08bd72101a51d59d2c9a1eebc7e271015da20f48f58
- SSDEEP 3072:Dv1WLlFUnGce46c0XjKoYu0eS3v1WLlFUnGce46c0XjKoYu0eS3v1WLlFUy:DqjcagoYZNfqjcagoYZNfq3
- MD5 SHA1 SHA512 SSDEEP
- Path F:\$RECYCLE.BIN\S-1-5-21-3692679935-4019334568-335155002-1000\DDDDDDDDDDD
- Size 129B
- SHA256 9f4b1bbec11972a85b828710b511e42280676853a6308a37607ad1f01694e9bd
- MD5 6f6363c54ff52772ba644f44b4ec9970
- SHA1 119d5bb90f07e3b79708559248900ec8355cf3e0
- SHA512 b3a3f0c389c0be52d55ebd9e76a83227eecdf0ad0b37fa33c596bd5431ae22d258d364b1b17f337ae53202b9d098810ff17d1f15ad855c27f56e44b2d7026b16
- MD5 SHA1 SHA512
- Path \ProgramData\32C4.tmp
- Size 14KB
- SHA256 917e115cc403e29b4388e0d175cbfac3e7e40ca1742299fbdb353847db2de7c2
- MD5 294e9f64cb1642dd89229fff0592856b
- SHA1 97b148c27f3da29ba7b18d6aee8a0db9102f47c9
- SHA512 b87d531890bf1577b9b4af41dddb2cdbbfa164cf197bd5987df3a3075983645a3acba443e289b7bfd338422978a104f55298fbfe346872de0895bde44adc89cf
- SSDEEP 384:5cFP7VtpK4p+31Mzh79W5vM+ZyUgGq4BtMvAxXCRsi:A7Vf9p+qQ02y5HW6kX
- MD5 SHA1 SHA512 SSDEEP