Overview

overview

10

Static

static

3

01f1e82d4c...70.exe

windows11-21h2-x64

10

Analysis

  • max time kernel
    72s
  • max time network
    78s
  • platform
    windows11-21h2_x64
  • resource
    win11-20241007-en
  • resource tags

    arch:x64arch:x86image:win11-20241007-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    26/01/2025, 14:50

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    01f1e82d4c2b04a4652348fb18bb480396db2229c4fd22d2be1ea58e6bf4a570.exe

  • Size

    418KB

  • MD5

    2dd7cd2bf15eec7d62689435fca9c49c

  • SHA1

    7db52047c72529d27a39f2e1a9ffb8f1f0ddc774

  • SHA256

    01f1e82d4c2b04a4652348fb18bb480396db2229c4fd22d2be1ea58e6bf4a570

  • SHA512

    29f9129320d8c1223a7a9a9dde3c0f7f0d28de734aa2c960d3f0a80b64af1f60291e6fa59279cab6a1fecc6e12e9ef565440452c0bb6632c3d28b8c119144389

  • SSDEEP

    12288:FnvxplpMAX99S4B009MqyQMKNT7jZBWfAD8xE:FvxplpMAtU4Bl9MdQFT79BWIoS

Score
10/10
dragonforcecredential_accessdiscoveryransomwarespywarestealer

Malware Config

Extracted

Path

C:\ProgramData\readme.txt

Family

dragonforce

Ransom Note
Hello! Your files have been stolen from your network and encrypted with a strong algorithm. We work for money and are not associated with politics. All you need to do is contact us and pay. --- Our communication process: 1. You contact us. 2. We send you a list of files that were stolen. 3. We decrypt 1 file to confirm that our decryptor works. 4. We agree on the amount, which must be paid using BTC. 5. We delete your files, we give you a decryptor. 6. We give you a detailed report on how we compromised your company, and recommendations on how to avoid such situations in the future. --- Client area (use this site to contact us): Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion >>> Use this ID: 020A05DF2E7D6B6C020A05DF2E7D6B6C to begin the recovery process. * In order to access the site, you will need Tor Browser, you can download it from this link: https://www.torproject.org/ --- Additional contacts: Support Tox: 1C054B722BCBF41A918EF3C485712742088F5C3E81B2FDD91ADEA6BA55F4A856D90A65E99D20 --- Recommendations: DO NOT RESET OR SHUTDOWN - files may be damaged. DO NOT RENAME OR MOVE the encrypted and readme files. DO NOT DELETE readme files. --- Important: If you refuse to pay or do not get in touch with us, we start publishing your files. 23/11/2024 00:00 UTC the decryptor will be destroyed and the files will be published on our blog. Blog: http://z3wqggtxft7id3ibr7srivv5gjof5fwg76slewnzwwakjuf3nlhukdid.onion Sincerely, 01000100 01110010 01100001 01100111 01101111 01101110 01000110 01101111 01110010 01100011 01100101
URLs

http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion

http://z3wqggtxft7id3ibr7srivv5gjof5fwg76slewnzwwakjuf3nlhukdid.onion

Signatures

  • DragonForce

    Ransomware family based on Lockbit that was first observed in November 2023.

    ransomwaredragonforce
  • Dragonforce family
    dragonforce
  • Credentials from Password Stores: Windows Credential Manager 1 TTPs

    Suspicious access to Credentials History.

    credential_accessstealer
  • Drops startup file 1 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Drops desktop.ini file(s) 21 IoCs
  • Sets desktop wallpaper using registry 2 TTPs 1 IoCs
    ransomware
  • Drops file in Program Files directory 64 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 2 IoCs
  • Modifies Control Panel 1 IoCs
    defense_evasion
  • Modifies data under HKEY_USERS 6 IoCs
  • Modifies registry class 3 IoCs
  • Opens file in notepad (likely ransom note) 1 IoCs
    ransomware
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 45 IoCs
  • Suspicious use of WriteProcessMemory 21 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\01f1e82d4c2b04a4652348fb18bb480396db2229c4fd22d2be1ea58e6bf4a570.exe
    "C:\Users\Admin\AppData\Local\Temp\01f1e82d4c2b04a4652348fb18bb480396db2229c4fd22d2be1ea58e6bf4a570.exe"
    1⤵
    • Drops startup file
    • Drops desktop.ini file(s)
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Modifies data under HKEY_USERS
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:5788
    • C:\Windows\SYSTEM32\cmd.exe
      cmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{F6C671BC-AB34-41D4-A23B-1F4E2BDB40CC}'" delete
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:5732
      • C:\Windows\System32\wbem\WMIC.exe
        C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{F6C671BC-AB34-41D4-A23B-1F4E2BDB40CC}'" delete
        3⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:2412
  • C:\Windows\system32\vssvc.exe
    C:\Windows\system32\vssvc.exe
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:5500
  • C:\Windows\system32\NOTEPAD.EXE
    "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\readme.txt
    1⤵
    • Opens file in notepad (likely ransom note)
    PID:404
  • C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:5852
    • C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fffc5becc40,0x7fffc5becc4c,0x7fffc5becc58
      2⤵
        PID:2548
    • C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe"
      1⤵
      • Suspicious use of WriteProcessMemory
      PID:5584
      • C:\Program Files\Google\Chrome\Application\chrome.exe
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fffc5becc40,0x7fffc5becc4c,0x7fffc5becc58
        2⤵
          PID:2772
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory=Default
        1⤵
        • Suspicious use of WriteProcessMemory
        PID:2128
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7fffc6153cb8,0x7fffc6153cc8,0x7fffc6153cd8
          2⤵
          • Checks processor information in registry
          • Enumerates system info in registry
          PID:1500
      • C:\Program Files\Mozilla Firefox\firefox.exe
        "C:\Program Files\Mozilla Firefox\firefox.exe"
        1⤵
        • Suspicious use of WriteProcessMemory
        PID:124
        • C:\Program Files\Mozilla Firefox\firefox.exe
          "C:\Program Files\Mozilla Firefox\firefox.exe"
          2⤵
            PID:5440

        Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Program Files\Google\Chrome\Application\debug.log
          Filesize

          174B

          MD5

          554f5f033bc3a9acfcc33801067c1970

          SHA1

          543572914831466c4fff71965e313cbda9115f8c

          SHA256

          2b279b0077b381a0dbf7e4ff27ac5afa0f8586c849ce462117e3b940c315c521

          SHA512

          6650d7356dbe7b6443c0e04ebb8cf2d870b73e1ca05e13675fe8be7c41bba630381e8a47734ea7430c668b3a156aaef84cde5c9ac75c53bada00c4575535fd8c

          Download Submit

        • C:\ProgramData\readme.txt
          Filesize

          1KB

          MD5

          fa6f2ffdf5879ee73f64df9576124c7d

          SHA1

          f710573c1d18355ecdf3131aa69a6dfe8e674758

          SHA256

          ac46b6cf5a7b83c6c38fa0f979a3ac69fa9dc6d213b78d0f92ae6744df12a02b

          SHA512

          633b778aafdde0e535611cfcf04bb81bb7f7db599d71263b5e7d238bb02449d4d8c6a12567bd46e35179499e44e65eb20fa9550270abc14f26dd9aa9f6dc1215

          Download Submit

        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\metadata
          Filesize

          114B

          MD5

          912cbf29d44624257b0339c1e9353369

          SHA1

          897822e5ee9ff0b8b9133c186eb46a7fa81ecf50

          SHA256

          66a62238a6c1c85ab807c6f606c36c05543ff22789b6a4cfd2a8f08aa5dfb6a4

          SHA512

          3b729c8ec0b3e96dbd66cfa503c8e1963a0d4125fc3a14e7e4ae6d684965b9de60a773dfdd4885afd8bec522fce1f7a8c553016c9575b4e7f43b6b0a1da68a57

          Download Submit

        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\reports\66642cce-c580-44ea-a86e-9c442492172d.dmp
          Filesize

          133KB

          MD5

          6e3a0a5f17ed9354d0ef8a26f3afc1f8

          SHA1

          4fa5b90e4679af28ee0e4865ce21a4f11ba6ed1a

          SHA256

          47113b285638a66adc479fd330804e38a7097db26a7676da135ca8ec5dc22f7e

          SHA512

          565b9ab2032dbfe8303e5bd6ba5a6e3543a6987d330b57e3f1a2d90f1f5fbb2b08692fccfc0ffa2c4686edf497fa6c1e6c4cf409f77038e94305dabdbf29474a

          Download Submit

        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat
          Filesize

          40B

          MD5

          fefe7edfa07f528c570d0674727153fc

          SHA1

          2d173d2d6ef07a3e26df4da60000109a4e367eea

          SHA256

          726b9d4b4e8b780f082b1214e442dc43120e45cb15125836f717ef0ecdc3e55d

          SHA512

          aa45e45e04d5011cff7247e8b34052f731e43ae738bbd33a96f37f12b7b7a617e08418286a7270ac4ac6ffba8165cdc675f735944b75d1627152e27503a7a3a9

          Download Submit

        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\metadata
          Filesize

          114B

          MD5

          95962d975ad5c0db862ad69cf99b96da

          SHA1

          9490ded707fdc196339039aed94f118b120020b1

          SHA256

          5cb163d3f7eb78818d385c7395e6f16c1ee46cc069319efb27a9defeda9e5c8b

          SHA512

          8b1c1ddcb73fb9104168c77eb98519cc3d3d2a6b357f01a9f485ce6fd89ae9a3822aae35fbeee00d83aba5598feb53b268714de4a58d371dccb64dd72eab7198

          Download Submit

        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\reports\157b1da7-4003-4d39-b5d1-bdfd9cfa8b7c.dmp
          Filesize

          3.5MB

          MD5

          fe9138ad1d137686499fa5e982b45999

          SHA1

          37d02bb8c3489a39c030f37ba5c80716f3c051c5

          SHA256

          47faffd03574a96618565b4b54ee3db2a0b54eaea9e9605ed45a5216ba371922

          SHA512

          2271b7830c4b4f3dbd3fae868c4cdb66ce550969b8f20bf240372b92e9efdb1948c39aa463cc4678d57160d149bc1cda54a6e67cb8f90c4859cef20fc1a7ac8f

          Download Submit

        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
          Filesize

          152B

          MD5

          c773ed0b0c9baa6457e76a94aa9562c4

          SHA1

          374753ffc6cfd78d886509f5a2e0c840520d9429

          SHA256

          18a5090f81626c81e0d70d0999c8d19430e775f2ce3b80786da83d59ae64224d

          SHA512

          5926aac1bab94246ba3bebb1265c95c02930c789a5a53309b79c2401352cfae0a9056d07f9dfb7edd4e2364e485fe9c28e4ca25ab91abcd7a23fc61dc2ae0458

          Download Submit

        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
          Filesize

          152B

          MD5

          edf5db9a49c0bfbfd279e4888fa7df99

          SHA1

          f2508f942231db55a32aa9ef81a5c8f64d42027c

          SHA256

          49af764e9c9ccf548182a7c60b3087ce4c53809b0d4f62228518c7e93caca9c7

          SHA512

          f8b51d3be2f11ae5c2a5b385c41bc9350824e7313fd72cda2875eeb55f2d1763e1029547e2ff5a94303a7da2569d49894d8c689aead5a69085dd6ba4e4ec4da5

          Download Submit

        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\throttle_store.dat
          Filesize

          20B

          MD5

          9e4e94633b73f4a7680240a0ffd6cd2c

          SHA1

          e68e02453ce22736169a56fdb59043d33668368f

          SHA256

          41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304

          SHA512

          193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337

          Download Submit