Overview

overview

10

Static

static

10

6f3d87f3dc...57.exe

windows7-x64

10

6f3d87f3dc...57.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    122s
  • max time network
    122s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    10-01-2025 02:36

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    6f3d87f3dcfd248e64d26cf338a19f41a6f93affdde5fab071a631ff38637757.exe

  • Size

    147KB

  • MD5

    c09185c157831e4915c255d7002941f4

  • SHA1

    beca597f2c2c120c3d74163501a81f56664ff4f7

  • SHA256

    6f3d87f3dcfd248e64d26cf338a19f41a6f93affdde5fab071a631ff38637757

  • SHA512

    a843854ca79f4d98938635612d20f3d5b79d8661ee91d1ae130b2deffe95e44d7028f76b8b221c87fab0638afe5baf3c55e8348f8aa10dddc90133167a3c17bf

  • SSDEEP

    3072:SqJogYkcSNm9V7DnfX/91c6G+Mqc+2EIEMF+T:Sq2kc4m9tDnfXPc6g+2XEMF

Score
10/10
defense_evasiondiscoveryransomwarespywarestealer

Malware Config

Extracted

Path

C:\5VFg9o5tW.README.txt

Ransom Note
------Dear managers!------ If you are reading this, it means your network has been attacked. What does that mean? We hacked your network and now all your files, documents, client database, projects and other important data safely encrypted with reliable algorithms. we also have a copy of all your data. WARNING!!! You don't have to go to the POLICE, etc. Otherwise we will not be able to help you. You cannot acces the files right now. But do not worry. You can get it back! It is easy to recover in a few steps. As proof, we can decrypt any 3 files you provide. We are not interested to ruin your business. We want to get ransom and be happy. Please bring this information to your team leaders as soon as possible. In case of a successfull transaction, we will restore your systems within 4-6 hours and also provide security recommendations. -----------------------WARNING----------------------- If you modify files - our decrypt software won't able to recover data If you use third party software - you can damage/modify files (see item 1) You nedd cipher key / our decrypt software to restore you files. The police or authorities will not be able to help you get the cipher key. We encourage you to consider your decisions. -----------------------RECOVERY----------------------- Use email: [email protected] Alternative email address: [email protected] ([email protected]) ID message: c5337115f1d1a

Signatures

  • Renames multiple (357) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware
  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Drops desktop.ini file(s) 2 IoCs
  • Indicator Removal: File Deletion 1 TTPs

    Adversaries may delete files left behind by the actions of their intrusion activity.

    defense_evasion
  • Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 12 IoCs
  • Suspicious behavior: RenamesItself 26 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\6f3d87f3dcfd248e64d26cf338a19f41a6f93affdde5fab071a631ff38637757.exe
    "C:\Users\Admin\AppData\Local\Temp\6f3d87f3dcfd248e64d26cf338a19f41a6f93affdde5fab071a631ff38637757.exe"
    1⤵
    • Loads dropped DLL
    • Drops desktop.ini file(s)
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2320
    • C:\ProgramData\B184.tmp
      "C:\ProgramData\B184.tmp"
      2⤵
      • Deletes itself
      • Executes dropped EXE
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: RenamesItself
      • Suspicious use of WriteProcessMemory
      PID:1616
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /C DEL /F /Q C:\PROGRA~3\B184.tmp >> NUL
        3⤵
        • System Location Discovery: System Language Discovery
        PID:1432
  • C:\Windows\system32\AUDIODG.EXE
    C:\Windows\system32\AUDIODG.EXE 0x14c
    1⤵
      PID:2064

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\$Recycle.Bin\S-1-5-21-4177215427-74451935-3209572229-1000\EEEEEEEEEEE
      Filesize

      129B

      MD5

      5ff9b101ab28bf399fc035a14438bd89

      SHA1

      e2b878a3680acd5cb332ce18ea589bd0e2f57f74

      SHA256

      dadf36b5112c5ac099f8bd89c20b0a9b23c1de50e49da130a41eab9704f85398

      SHA512

      3832a6615077a569a6efe84253e5b777bb8e6bc33e1768f861b907e79e2a56a269cee36e5a70840f33177683b2f5ce04d16b2e2759a014b7ca05ea4ce150b346

      Download Submit

    • C:\5VFg9o5tW.README.txt
      Filesize

      1KB

      MD5

      17e3459297cd54cf124d089248ff395b

      SHA1

      617e2ddd0a69a242d4da510d32670a170ff667fa

      SHA256

      94aaefad5d5a9fea79e9271941a5e874951cceac46a110ef0f1de841051f6421

      SHA512

      280536a672423a4bf4df1cb7cd49bd0a7a3f731dfe4543359a84d3a82d734e3882386b336af62a77e2763cbe7fe9e4ff6ae852241dd61ab702cda1b0d2f02e13

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\DDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDD
      Filesize

      147KB

      MD5

      e018e9f80121488687042b38520b5547

      SHA1

      01052ae899d2df59dd01824dc35f5d12107798ec

      SHA256

      2379e0144ff74de4a6863229bb0bc91e82dbeb0ffd688777873631cb759574f4

      SHA512

      248d5e9cf85abc3e219826565010e7e96d96f399a3ab299fc85a7ce02cef0ff6266b08cd739a12c8f334a54f2e1af283a374321158246d8640acc75542113352

      Download Submit

    • F:\$RECYCLE.BIN\S-1-5-21-4177215427-74451935-3209572229-1000\KKKKKKKKKKK
      Filesize

      129B

      MD5

      160db66415f13d112cb73c41eca33eb9

      SHA1

      897c1bda1c89bf19427941a5fed871cc137db6d9

      SHA256

      086d72999f1bc4f5c925bae0b115c006c4952c3abc6f92a7bf3f600374fe4b9b

      SHA512

      a8a7a5bd98ccb252dcbc6dc71a554ae6aecbad36eb822f631ddcd20b47e07e1f07fbbad5680f346f4f1f1437ac1d7290d2052a9c66d07862df47fa3aed0b2b9e

      Download Submit

    • \ProgramData\B184.tmp
      Filesize

      14KB

      MD5

      294e9f64cb1642dd89229fff0592856b

      SHA1

      97b148c27f3da29ba7b18d6aee8a0db9102f47c9

      SHA256

      917e115cc403e29b4388e0d175cbfac3e7e40ca1742299fbdb353847db2de7c2

      SHA512

      b87d531890bf1577b9b4af41dddb2cdbbfa164cf197bd5987df3a3075983645a3acba443e289b7bfd338422978a104f55298fbfe346872de0895bde44adc89cf

      Download Submit

    • memory/1616-892-0x000000007EF20000-0x000000007EF21000-memory.dmp

      Filesize

      4KB

      Download

    • memory/1616-891-0x000000007EF80000-0x000000007EF81000-memory.dmp

      Filesize

      4KB

      Download

    • memory/1616-890-0x00000000023F0000-0x0000000002430000-memory.dmp

      Filesize

      256KB

      Download

    • memory/1616-888-0x000000007EFA0000-0x000000007EFA1000-memory.dmp

      Filesize

      4KB

      Download

    • memory/1616-889-0x00000000023F0000-0x0000000002430000-memory.dmp

      Filesize

      256KB

      Download

    • memory/1616-922-0x000000007EF60000-0x000000007EF61000-memory.dmp

      Filesize

      4KB

      Download

    • memory/1616-921-0x000000007EF40000-0x000000007EF41000-memory.dmp

      Filesize

      4KB

      Download

    • memory/2320-0-0x0000000000380000-0x00000000003C0000-memory.dmp

      Filesize

      256KB

      Download