Analysis
-
max time kernel
92s -
max time network
145s -
platform
windows10-2004_x64 -
resource
win10v2004-20250314-en -
resource tags
arch:x64arch:x86image:win10v2004-20250314-enlocale:en-usos:windows10-2004-x64system -
submitted
25/03/2025, 18:07
Behavioral task
behavioral1
Sample
3518195c256aa940c607f8534c91b5a9cd453c7417810de3cd4d262e2906d24f.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
3518195c256aa940c607f8534c91b5a9cd453c7417810de3cd4d262e2906d24f.exe
Resource
win10v2004-20250314-en
General
-
Target
3518195c256aa940c607f8534c91b5a9cd453c7417810de3cd4d262e2906d24f.exe
-
Size
421KB
-
MD5
2b825ea77e240d2ab6b6695a602cb07c
-
SHA1
ae6eb3cce06f666934e03dd46269526e56aff3b1
-
SHA256
3518195c256aa940c607f8534c91b5a9cd453c7417810de3cd4d262e2906d24f
-
SHA512
f2029aec439f4727e96436390027e100df521cd6557797a17d50f82335487b2a91ddc04dbd18fb8df96b3deea776ecf429321a55401b7739b1b4979b58db7e39
-
SSDEEP
6144:/u+2b7RNhPmrpQRF/2lfhOJoe7NzgMFgTkoQj6RgLaDMT:nGyRe7STng6KaD
Malware Config
Signatures
-
Detect Rhysida ransomware 3 IoCs
resource yara_rule behavioral2/memory/4036-4247-0x0000000000400000-0x0000000000478000-memory.dmp family_rhysida behavioral2/memory/4036-4248-0x0000000000400000-0x0000000000478000-memory.dmp family_rhysida behavioral2/memory/4036-4260-0x0000000000400000-0x0000000000478000-memory.dmp family_rhysida -
Rhysida
Rhysida is a ransomware that is written in C++ and discovered in 2023.
-
Rhysida family
-
Renames multiple (2273) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell and hide display window.
pid Process 112 powershell.exe -
Credentials from Password Stores: Windows Credential Manager 1 TTPs
Suspicious access to Credentials History.
-
Drops startup file 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\CriticalBreachDetected.pdf 3518195c256aa940c607f8534c91b5a9cd453c7417810de3cd4d262e2906d24f.exe -
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Hide Artifacts: Hidden Window 1 TTPs 2 IoCs
Windows that would typically be displayed when an application carries out an operation can be hidden.
pid Process 1488 cmd.exe 2692 cmd.exe -
Indicator Removal: Clear Persistence 1 TTPs 2 IoCs
Clear artifacts associated with previously established persistence like scheduletasks on a host.
pid Process 1488 cmd.exe 2692 cmd.exe -
Sets desktop wallpaper using registry 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3218366390-1258052702-4267193707-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Public\\bg.jpg" reg.exe -
System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 3 IoCs
Adversaries may check for Internet connectivity on compromised systems.
pid Process 852 cmd.exe 936 cmd.exe 4176 PING.EXE -
Runs ping.exe 1 TTPs 1 IoCs
pid Process 4176 PING.EXE -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 112 powershell.exe 112 powershell.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 112 powershell.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4036 wrote to memory of 4932 4036 3518195c256aa940c607f8534c91b5a9cd453c7417810de3cd4d262e2906d24f.exe 98 PID 4036 wrote to memory of 4932 4036 3518195c256aa940c607f8534c91b5a9cd453c7417810de3cd4d262e2906d24f.exe 98 PID 4932 wrote to memory of 4012 4932 cmd.exe 100 PID 4932 wrote to memory of 4012 4932 cmd.exe 100 PID 4012 wrote to memory of 4980 4012 cmd.exe 101 PID 4012 wrote to memory of 4980 4012 cmd.exe 101 PID 4036 wrote to memory of 2652 4036 3518195c256aa940c607f8534c91b5a9cd453c7417810de3cd4d262e2906d24f.exe 102 PID 4036 wrote to memory of 2652 4036 3518195c256aa940c607f8534c91b5a9cd453c7417810de3cd4d262e2906d24f.exe 102 PID 2652 wrote to memory of 1348 2652 cmd.exe 104 PID 2652 wrote to memory of 1348 2652 cmd.exe 104 PID 1348 wrote to memory of 4500 1348 cmd.exe 105 PID 1348 wrote to memory of 4500 1348 cmd.exe 105 PID 4036 wrote to memory of 2208 4036 3518195c256aa940c607f8534c91b5a9cd453c7417810de3cd4d262e2906d24f.exe 106 PID 4036 wrote to memory of 2208 4036 3518195c256aa940c607f8534c91b5a9cd453c7417810de3cd4d262e2906d24f.exe 106 PID 2208 wrote to memory of 2124 2208 cmd.exe 108 PID 2208 wrote to memory of 2124 2208 cmd.exe 108 PID 2124 wrote to memory of 2436 2124 cmd.exe 109 PID 2124 wrote to memory of 2436 2124 cmd.exe 109 PID 4036 wrote to memory of 1860 4036 3518195c256aa940c607f8534c91b5a9cd453c7417810de3cd4d262e2906d24f.exe 110 PID 4036 wrote to memory of 1860 4036 3518195c256aa940c607f8534c91b5a9cd453c7417810de3cd4d262e2906d24f.exe 110 PID 1860 wrote to memory of 3612 1860 cmd.exe 112 PID 1860 wrote to memory of 3612 1860 cmd.exe 112 PID 3612 wrote to memory of 932 3612 cmd.exe 113 PID 3612 wrote to memory of 932 3612 cmd.exe 113 PID 4036 wrote to memory of 4968 4036 3518195c256aa940c607f8534c91b5a9cd453c7417810de3cd4d262e2906d24f.exe 114 PID 4036 wrote to memory of 4968 4036 3518195c256aa940c607f8534c91b5a9cd453c7417810de3cd4d262e2906d24f.exe 114 PID 4968 wrote to memory of 1432 4968 cmd.exe 116 PID 4968 wrote to memory of 1432 4968 cmd.exe 116 PID 1432 wrote to memory of 1460 1432 cmd.exe 117 PID 1432 wrote to memory of 1460 1432 cmd.exe 117 PID 4036 wrote to memory of 628 4036 3518195c256aa940c607f8534c91b5a9cd453c7417810de3cd4d262e2906d24f.exe 118 PID 4036 wrote to memory of 628 4036 3518195c256aa940c607f8534c91b5a9cd453c7417810de3cd4d262e2906d24f.exe 118 PID 628 wrote to memory of 888 628 cmd.exe 120 PID 628 wrote to memory of 888 628 cmd.exe 120 PID 888 wrote to memory of 4700 888 cmd.exe 121 PID 888 wrote to memory of 4700 888 cmd.exe 121 PID 4036 wrote to memory of 2172 4036 3518195c256aa940c607f8534c91b5a9cd453c7417810de3cd4d262e2906d24f.exe 122 PID 4036 wrote to memory of 2172 4036 3518195c256aa940c607f8534c91b5a9cd453c7417810de3cd4d262e2906d24f.exe 122 PID 2172 wrote to memory of 2632 2172 cmd.exe 124 PID 2172 wrote to memory of 2632 2172 cmd.exe 124 PID 2632 wrote to memory of 3184 2632 cmd.exe 125 PID 2632 wrote to memory of 3184 2632 cmd.exe 125 PID 4036 wrote to memory of 4708 4036 3518195c256aa940c607f8534c91b5a9cd453c7417810de3cd4d262e2906d24f.exe 126 PID 4036 wrote to memory of 4708 4036 3518195c256aa940c607f8534c91b5a9cd453c7417810de3cd4d262e2906d24f.exe 126 PID 4708 wrote to memory of 3148 4708 cmd.exe 128 PID 4708 wrote to memory of 3148 4708 cmd.exe 128 PID 3148 wrote to memory of 3584 3148 cmd.exe 129 PID 3148 wrote to memory of 3584 3148 cmd.exe 129 PID 4036 wrote to memory of 2960 4036 3518195c256aa940c607f8534c91b5a9cd453c7417810de3cd4d262e2906d24f.exe 130 PID 4036 wrote to memory of 2960 4036 3518195c256aa940c607f8534c91b5a9cd453c7417810de3cd4d262e2906d24f.exe 130 PID 2960 wrote to memory of 5044 2960 cmd.exe 132 PID 2960 wrote to memory of 5044 2960 cmd.exe 132 PID 4036 wrote to memory of 1488 4036 3518195c256aa940c607f8534c91b5a9cd453c7417810de3cd4d262e2906d24f.exe 133 PID 4036 wrote to memory of 1488 4036 3518195c256aa940c607f8534c91b5a9cd453c7417810de3cd4d262e2906d24f.exe 133 PID 1488 wrote to memory of 2692 1488 cmd.exe 135 PID 1488 wrote to memory of 2692 1488 cmd.exe 135 PID 2692 wrote to memory of 112 2692 cmd.exe 136 PID 2692 wrote to memory of 112 2692 cmd.exe 136 PID 4036 wrote to memory of 852 4036 3518195c256aa940c607f8534c91b5a9cd453c7417810de3cd4d262e2906d24f.exe 138 PID 4036 wrote to memory of 852 4036 3518195c256aa940c607f8534c91b5a9cd453c7417810de3cd4d262e2906d24f.exe 138 PID 852 wrote to memory of 936 852 cmd.exe 140 PID 852 wrote to memory of 936 852 cmd.exe 140 PID 936 wrote to memory of 4176 936 cmd.exe 141 PID 936 wrote to memory of 4176 936 cmd.exe 141 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\3518195c256aa940c607f8534c91b5a9cd453c7417810de3cd4d262e2906d24f.exe"C:\Users\Admin\AppData\Local\Temp\3518195c256aa940c607f8534c91b5a9cd453c7417810de3cd4d262e2906d24f.exe"1⤵
- Drops startup file
- Suspicious use of WriteProcessMemory
PID:4036 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cmd.exe /c reg delete "HKCU\Contol Panel\Desktop" /v Wallpaper /f2⤵
- Suspicious use of WriteProcessMemory
PID:4932 -
C:\Windows\system32\cmd.execmd.exe /c reg delete "HKCU\Contol Panel\Desktop" /v Wallpaper /f3⤵
- Suspicious use of WriteProcessMemory
PID:4012 -
C:\Windows\system32\reg.exereg delete "HKCU\Contol Panel\Desktop" /v Wallpaper /f4⤵PID:4980
-
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cmd.exe /c reg delete "HKCU\Conttol Panel\Desktop" /v WallpaperStyle /f2⤵
- Suspicious use of WriteProcessMemory
PID:2652 -
C:\Windows\system32\cmd.execmd.exe /c reg delete "HKCU\Conttol Panel\Desktop" /v WallpaperStyle /f3⤵
- Suspicious use of WriteProcessMemory
PID:1348 -
C:\Windows\system32\reg.exereg delete "HKCU\Conttol Panel\Desktop" /v WallpaperStyle /f4⤵PID:4500
-
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cmd.exe /c reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\ActiveDesktop" /v NoChangingWallPaper /t REG_SZ /d 1 /f2⤵
- Suspicious use of WriteProcessMemory
PID:2208 -
C:\Windows\system32\cmd.execmd.exe /c reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\ActiveDesktop" /v NoChangingWallPaper /t REG_SZ /d 1 /f3⤵
- Suspicious use of WriteProcessMemory
PID:2124 -
C:\Windows\system32\reg.exereg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\ActiveDesktop" /v NoChangingWallPaper /t REG_SZ /d 1 /f4⤵PID:2436
-
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cmd.exe /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\ActiveDesktop" /v NoChangingWallPaper /t REG_SZ /d 1 /f2⤵
- Suspicious use of WriteProcessMemory
PID:1860 -
C:\Windows\system32\cmd.execmd.exe /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\ActiveDesktop" /v NoChangingWallPaper /t REG_SZ /d 1 /f3⤵
- Suspicious use of WriteProcessMemory
PID:3612 -
C:\Windows\system32\reg.exereg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\ActiveDesktop" /v NoChangingWallPaper /t REG_SZ /d 1 /f4⤵PID:932
-
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cmd.exe /c reg add "HKCU\Control Panel\Desktop" /v Wallpaper /t REG_SZ /d "C:\Users\Public\bg.jpg" /f2⤵
- Suspicious use of WriteProcessMemory
PID:4968 -
C:\Windows\system32\cmd.execmd.exe /c reg add "HKCU\Control Panel\Desktop" /v Wallpaper /t REG_SZ /d "C:\Users\Public\bg.jpg" /f3⤵
- Suspicious use of WriteProcessMemory
PID:1432 -
C:\Windows\system32\reg.exereg add "HKCU\Control Panel\Desktop" /v Wallpaper /t REG_SZ /d "C:\Users\Public\bg.jpg" /f4⤵
- Sets desktop wallpaper using registry
PID:1460
-
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cmd.exe /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v Wallpaper /t REG_SZ /d "C:\Users\Public\bg.jpg" /f2⤵
- Suspicious use of WriteProcessMemory
PID:628 -
C:\Windows\system32\cmd.execmd.exe /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v Wallpaper /t REG_SZ /d "C:\Users\Public\bg.jpg" /f3⤵
- Suspicious use of WriteProcessMemory
PID:888 -
C:\Windows\system32\reg.exereg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v Wallpaper /t REG_SZ /d "C:\Users\Public\bg.jpg" /f4⤵PID:4700
-
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cmd.exe /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v WallpaperStyle /t REG_SZ /d 2 /f2⤵
- Suspicious use of WriteProcessMemory
PID:2172 -
C:\Windows\system32\cmd.execmd.exe /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v WallpaperStyle /t REG_SZ /d 2 /f3⤵
- Suspicious use of WriteProcessMemory
PID:2632 -
C:\Windows\system32\reg.exereg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v WallpaperStyle /t REG_SZ /d 2 /f4⤵PID:3184
-
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cmd.exe /c reg add "HKCU\Control Panel\Desktop" /v WallpaperStyle /t REG_SZ /d 2 /f2⤵
- Suspicious use of WriteProcessMemory
PID:4708 -
C:\Windows\system32\cmd.execmd.exe /c reg add "HKCU\Control Panel\Desktop" /v WallpaperStyle /t REG_SZ /d 2 /f3⤵
- Suspicious use of WriteProcessMemory
PID:3148 -
C:\Windows\system32\reg.exereg add "HKCU\Control Panel\Desktop" /v WallpaperStyle /t REG_SZ /d 2 /f4⤵PID:3584
-
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c rundll32.exe user32.dll,UpdatePerUserSystemParameters2⤵
- Suspicious use of WriteProcessMemory
PID:2960 -
C:\Windows\system32\rundll32.exerundll32.exe user32.dll,UpdatePerUserSystemParameters3⤵PID:5044
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cmd.exe /c start powershell.exe -WindowStyle Hidden -Command "Sleep -Milliseconds 1000; schtasks /delete /tn Rhsd /f;"2⤵
- Hide Artifacts: Hidden Window
- Indicator Removal: Clear Persistence
- Suspicious use of WriteProcessMemory
PID:1488 -
C:\Windows\system32\cmd.execmd.exe /c start powershell.exe -WindowStyle Hidden -Command "Sleep -Milliseconds 1000; schtasks /delete /tn Rhsd /f;"3⤵
- Hide Artifacts: Hidden Window
- Indicator Removal: Clear Persistence
- Suspicious use of WriteProcessMemory
PID:2692 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -WindowStyle Hidden -Command "Sleep -Milliseconds 1000; schtasks /delete /tn Rhsd /f;"4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:112 -
C:\Windows\system32\schtasks.exe"C:\Windows\system32\schtasks.exe" /delete /tn Rhsd /f5⤵PID:540
-
-
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cmd.exe /c start ping 127.0.0.1 -n 2 > nul && del /f /q "C:\Users\Admin\AppData\Local\Temp\C:\Users\Admin\AppData\Local\Temp\3518195c256aa940c607f8534c91b5a9cd453c7417810de3cd4d262e2906d24f.exe"2⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Suspicious use of WriteProcessMemory
PID:852 -
C:\Windows\system32\cmd.execmd.exe /c start ping 127.0.0.1 -n 23⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Suspicious use of WriteProcessMemory
PID:936 -
C:\Windows\system32\PING.EXEping 127.0.0.1 -n 24⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:4176
-
-
-
Network
MITRE ATT&CK Enterprise v15
Defense Evasion
Hide Artifacts
1Hidden Window
1Indicator Removal
1Clear Persistence
1Modify Registry
1Credential Access
Credentials from Password Stores
2Credentials from Web Browsers
1Windows Credential Manager
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
35KB
MD538c9c6953f1fcb83b1e6e04825f3b4db
SHA15af8caf42b0ab98349c5806f5b22d4402a343de7
SHA256dfd0bd7b4e4f84287ab4b19bb77d5308eb29e12e8724f04cb8c2fc6d4fb66d62
SHA5126ba08b5ff206a5bb53c60e62dac872e6473aa419ffed5c09c1cdbb18f1dde7b2ec268df8abc3080fe484a4f0a32d8fec922f65e959f0dbd91fb8a4272e492ed1