Analysis
-
max time kernel
38s -
max time network
22s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
26/03/2025, 12:07
Behavioral task
behavioral1
Sample
daf55a9d48dd736fa870acd24cf4ced89b079544051d3bd782195ea9b96d6397.exe
Resource
win7-20240903-en
windows7-x64
15 signatures
150 seconds
Behavioral task
behavioral2
Sample
daf55a9d48dd736fa870acd24cf4ced89b079544051d3bd782195ea9b96d6397.exe
Resource
win10v2004-20250314-en
windows10-2004-x64
18 signatures
150 seconds
General
-
Target
daf55a9d48dd736fa870acd24cf4ced89b079544051d3bd782195ea9b96d6397.exe
-
Size
160KB
-
MD5
ed6fa9757400a0de9596d59bd0262ebd
-
SHA1
0836c5ab9bed96b1d9618bc802792185c6ee21ca
-
SHA256
daf55a9d48dd736fa870acd24cf4ced89b079544051d3bd782195ea9b96d6397
-
SHA512
37d93ce4b1796d205d090390645fa149181b99fa7a67c0afcfa548851644659dde27b169049f7f5bfc73e63bc448a59746236e1e6b47335d58a6b0eddd356412
-
SSDEEP
3072:bDDDDDDDDDDDDDDDDDDDE45d/t6sVkgZqltP3368a0y5zxm8yNB41ctER6ptQtR2:15d/zugZqll3bQzmB3tQt5L
Score
9/10
Malware Config
Signatures
-
Renames multiple (165) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Deletes itself 1 IoCs
pid Process 2880 C745.tmp -
Executes dropped EXE 1 IoCs
pid Process 2880 C745.tmp -
Loads dropped DLL 1 IoCs
pid Process 2128 daf55a9d48dd736fa870acd24cf4ced89b079544051d3bd782195ea9b96d6397.exe -
Drops desktop.ini file(s) 2 IoCs
description ioc Process File opened for modification C:\$Recycle.Bin\S-1-5-21-1488793075-819845221-1497111674-1000\desktop.ini daf55a9d48dd736fa870acd24cf4ced89b079544051d3bd782195ea9b96d6397.exe File opened for modification F:\$RECYCLE.BIN\S-1-5-21-1488793075-819845221-1497111674-1000\desktop.ini daf55a9d48dd736fa870acd24cf4ced89b079544051d3bd782195ea9b96d6397.exe -
Sets desktop wallpaper using registry 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Control Panel\Desktop\WallPaper = "C:\\ProgramData\\8ORZ41NKC.bmp" daf55a9d48dd736fa870acd24cf4ced89b079544051d3bd782195ea9b96d6397.exe Set value (str) \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Control Panel\Desktop\Wallpaper = "C:\\ProgramData\\8ORZ41NKC.bmp" daf55a9d48dd736fa870acd24cf4ced89b079544051d3bd782195ea9b96d6397.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 12 IoCs
pid Process 2128 daf55a9d48dd736fa870acd24cf4ced89b079544051d3bd782195ea9b96d6397.exe 2128 daf55a9d48dd736fa870acd24cf4ced89b079544051d3bd782195ea9b96d6397.exe 2128 daf55a9d48dd736fa870acd24cf4ced89b079544051d3bd782195ea9b96d6397.exe 2128 daf55a9d48dd736fa870acd24cf4ced89b079544051d3bd782195ea9b96d6397.exe 2128 daf55a9d48dd736fa870acd24cf4ced89b079544051d3bd782195ea9b96d6397.exe 2128 daf55a9d48dd736fa870acd24cf4ced89b079544051d3bd782195ea9b96d6397.exe 2880 C745.tmp 2880 C745.tmp 2880 C745.tmp 2880 C745.tmp 2880 C745.tmp 2880 C745.tmp -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language daf55a9d48dd736fa870acd24cf4ced89b079544051d3bd782195ea9b96d6397.exe -
Modifies Control Panel 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Control Panel\Desktop daf55a9d48dd736fa870acd24cf4ced89b079544051d3bd782195ea9b96d6397.exe Set value (str) \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Control Panel\Desktop\WallpaperStyle = "10" daf55a9d48dd736fa870acd24cf4ced89b079544051d3bd782195ea9b96d6397.exe -
Modifies registry class 5 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\8ORZ41NKC daf55a9d48dd736fa870acd24cf4ced89b079544051d3bd782195ea9b96d6397.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\8ORZ41NKC\DefaultIcon\ = "C:\\ProgramData\\8ORZ41NKC.ico" daf55a9d48dd736fa870acd24cf4ced89b079544051d3bd782195ea9b96d6397.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.8ORZ41NKC daf55a9d48dd736fa870acd24cf4ced89b079544051d3bd782195ea9b96d6397.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.8ORZ41NKC\ = "8ORZ41NKC" daf55a9d48dd736fa870acd24cf4ced89b079544051d3bd782195ea9b96d6397.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\8ORZ41NKC\DefaultIcon daf55a9d48dd736fa870acd24cf4ced89b079544051d3bd782195ea9b96d6397.exe -
Suspicious behavior: EnumeratesProcesses 12 IoCs
pid Process 2128 daf55a9d48dd736fa870acd24cf4ced89b079544051d3bd782195ea9b96d6397.exe 2128 daf55a9d48dd736fa870acd24cf4ced89b079544051d3bd782195ea9b96d6397.exe 2128 daf55a9d48dd736fa870acd24cf4ced89b079544051d3bd782195ea9b96d6397.exe 2128 daf55a9d48dd736fa870acd24cf4ced89b079544051d3bd782195ea9b96d6397.exe 2128 daf55a9d48dd736fa870acd24cf4ced89b079544051d3bd782195ea9b96d6397.exe 2128 daf55a9d48dd736fa870acd24cf4ced89b079544051d3bd782195ea9b96d6397.exe 2128 daf55a9d48dd736fa870acd24cf4ced89b079544051d3bd782195ea9b96d6397.exe 2128 daf55a9d48dd736fa870acd24cf4ced89b079544051d3bd782195ea9b96d6397.exe 2128 daf55a9d48dd736fa870acd24cf4ced89b079544051d3bd782195ea9b96d6397.exe 2128 daf55a9d48dd736fa870acd24cf4ced89b079544051d3bd782195ea9b96d6397.exe 2128 daf55a9d48dd736fa870acd24cf4ced89b079544051d3bd782195ea9b96d6397.exe 2128 daf55a9d48dd736fa870acd24cf4ced89b079544051d3bd782195ea9b96d6397.exe -
Suspicious behavior: RenamesItself 26 IoCs
pid Process 2880 C745.tmp 2880 C745.tmp 2880 C745.tmp 2880 C745.tmp 2880 C745.tmp 2880 C745.tmp 2880 C745.tmp 2880 C745.tmp 2880 C745.tmp 2880 C745.tmp 2880 C745.tmp 2880 C745.tmp 2880 C745.tmp 2880 C745.tmp 2880 C745.tmp 2880 C745.tmp 2880 C745.tmp 2880 C745.tmp 2880 C745.tmp 2880 C745.tmp 2880 C745.tmp 2880 C745.tmp 2880 C745.tmp 2880 C745.tmp 2880 C745.tmp 2880 C745.tmp -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeAssignPrimaryTokenPrivilege 2128 daf55a9d48dd736fa870acd24cf4ced89b079544051d3bd782195ea9b96d6397.exe Token: SeBackupPrivilege 2128 daf55a9d48dd736fa870acd24cf4ced89b079544051d3bd782195ea9b96d6397.exe Token: SeDebugPrivilege 2128 daf55a9d48dd736fa870acd24cf4ced89b079544051d3bd782195ea9b96d6397.exe Token: 36 2128 daf55a9d48dd736fa870acd24cf4ced89b079544051d3bd782195ea9b96d6397.exe Token: SeImpersonatePrivilege 2128 daf55a9d48dd736fa870acd24cf4ced89b079544051d3bd782195ea9b96d6397.exe Token: SeIncBasePriorityPrivilege 2128 daf55a9d48dd736fa870acd24cf4ced89b079544051d3bd782195ea9b96d6397.exe Token: SeIncreaseQuotaPrivilege 2128 daf55a9d48dd736fa870acd24cf4ced89b079544051d3bd782195ea9b96d6397.exe Token: 33 2128 daf55a9d48dd736fa870acd24cf4ced89b079544051d3bd782195ea9b96d6397.exe Token: SeManageVolumePrivilege 2128 daf55a9d48dd736fa870acd24cf4ced89b079544051d3bd782195ea9b96d6397.exe Token: SeProfSingleProcessPrivilege 2128 daf55a9d48dd736fa870acd24cf4ced89b079544051d3bd782195ea9b96d6397.exe Token: SeRestorePrivilege 2128 daf55a9d48dd736fa870acd24cf4ced89b079544051d3bd782195ea9b96d6397.exe Token: SeSecurityPrivilege 2128 daf55a9d48dd736fa870acd24cf4ced89b079544051d3bd782195ea9b96d6397.exe Token: SeSystemProfilePrivilege 2128 daf55a9d48dd736fa870acd24cf4ced89b079544051d3bd782195ea9b96d6397.exe Token: SeTakeOwnershipPrivilege 2128 daf55a9d48dd736fa870acd24cf4ced89b079544051d3bd782195ea9b96d6397.exe Token: SeShutdownPrivilege 2128 daf55a9d48dd736fa870acd24cf4ced89b079544051d3bd782195ea9b96d6397.exe Token: SeDebugPrivilege 2128 daf55a9d48dd736fa870acd24cf4ced89b079544051d3bd782195ea9b96d6397.exe Token: SeBackupPrivilege 1676 vssvc.exe Token: SeRestorePrivilege 1676 vssvc.exe Token: SeAuditPrivilege 1676 vssvc.exe Token: SeBackupPrivilege 2128 daf55a9d48dd736fa870acd24cf4ced89b079544051d3bd782195ea9b96d6397.exe Token: SeBackupPrivilege 2128 daf55a9d48dd736fa870acd24cf4ced89b079544051d3bd782195ea9b96d6397.exe Token: SeSecurityPrivilege 2128 daf55a9d48dd736fa870acd24cf4ced89b079544051d3bd782195ea9b96d6397.exe Token: SeSecurityPrivilege 2128 daf55a9d48dd736fa870acd24cf4ced89b079544051d3bd782195ea9b96d6397.exe Token: SeBackupPrivilege 2128 daf55a9d48dd736fa870acd24cf4ced89b079544051d3bd782195ea9b96d6397.exe Token: SeBackupPrivilege 2128 daf55a9d48dd736fa870acd24cf4ced89b079544051d3bd782195ea9b96d6397.exe Token: SeSecurityPrivilege 2128 daf55a9d48dd736fa870acd24cf4ced89b079544051d3bd782195ea9b96d6397.exe Token: SeSecurityPrivilege 2128 daf55a9d48dd736fa870acd24cf4ced89b079544051d3bd782195ea9b96d6397.exe Token: SeBackupPrivilege 2128 daf55a9d48dd736fa870acd24cf4ced89b079544051d3bd782195ea9b96d6397.exe Token: SeBackupPrivilege 2128 daf55a9d48dd736fa870acd24cf4ced89b079544051d3bd782195ea9b96d6397.exe Token: SeSecurityPrivilege 2128 daf55a9d48dd736fa870acd24cf4ced89b079544051d3bd782195ea9b96d6397.exe Token: SeSecurityPrivilege 2128 daf55a9d48dd736fa870acd24cf4ced89b079544051d3bd782195ea9b96d6397.exe Token: SeBackupPrivilege 2128 daf55a9d48dd736fa870acd24cf4ced89b079544051d3bd782195ea9b96d6397.exe Token: SeBackupPrivilege 2128 daf55a9d48dd736fa870acd24cf4ced89b079544051d3bd782195ea9b96d6397.exe Token: SeSecurityPrivilege 2128 daf55a9d48dd736fa870acd24cf4ced89b079544051d3bd782195ea9b96d6397.exe Token: SeSecurityPrivilege 2128 daf55a9d48dd736fa870acd24cf4ced89b079544051d3bd782195ea9b96d6397.exe Token: SeBackupPrivilege 2128 daf55a9d48dd736fa870acd24cf4ced89b079544051d3bd782195ea9b96d6397.exe Token: SeBackupPrivilege 2128 daf55a9d48dd736fa870acd24cf4ced89b079544051d3bd782195ea9b96d6397.exe Token: SeSecurityPrivilege 2128 daf55a9d48dd736fa870acd24cf4ced89b079544051d3bd782195ea9b96d6397.exe Token: SeSecurityPrivilege 2128 daf55a9d48dd736fa870acd24cf4ced89b079544051d3bd782195ea9b96d6397.exe Token: SeBackupPrivilege 2128 daf55a9d48dd736fa870acd24cf4ced89b079544051d3bd782195ea9b96d6397.exe Token: SeBackupPrivilege 2128 daf55a9d48dd736fa870acd24cf4ced89b079544051d3bd782195ea9b96d6397.exe Token: SeSecurityPrivilege 2128 daf55a9d48dd736fa870acd24cf4ced89b079544051d3bd782195ea9b96d6397.exe Token: SeSecurityPrivilege 2128 daf55a9d48dd736fa870acd24cf4ced89b079544051d3bd782195ea9b96d6397.exe Token: SeBackupPrivilege 2128 daf55a9d48dd736fa870acd24cf4ced89b079544051d3bd782195ea9b96d6397.exe Token: SeBackupPrivilege 2128 daf55a9d48dd736fa870acd24cf4ced89b079544051d3bd782195ea9b96d6397.exe Token: SeSecurityPrivilege 2128 daf55a9d48dd736fa870acd24cf4ced89b079544051d3bd782195ea9b96d6397.exe Token: SeSecurityPrivilege 2128 daf55a9d48dd736fa870acd24cf4ced89b079544051d3bd782195ea9b96d6397.exe Token: SeBackupPrivilege 2128 daf55a9d48dd736fa870acd24cf4ced89b079544051d3bd782195ea9b96d6397.exe Token: SeBackupPrivilege 2128 daf55a9d48dd736fa870acd24cf4ced89b079544051d3bd782195ea9b96d6397.exe Token: SeSecurityPrivilege 2128 daf55a9d48dd736fa870acd24cf4ced89b079544051d3bd782195ea9b96d6397.exe Token: SeSecurityPrivilege 2128 daf55a9d48dd736fa870acd24cf4ced89b079544051d3bd782195ea9b96d6397.exe Token: SeBackupPrivilege 2128 daf55a9d48dd736fa870acd24cf4ced89b079544051d3bd782195ea9b96d6397.exe Token: SeBackupPrivilege 2128 daf55a9d48dd736fa870acd24cf4ced89b079544051d3bd782195ea9b96d6397.exe Token: SeSecurityPrivilege 2128 daf55a9d48dd736fa870acd24cf4ced89b079544051d3bd782195ea9b96d6397.exe Token: SeSecurityPrivilege 2128 daf55a9d48dd736fa870acd24cf4ced89b079544051d3bd782195ea9b96d6397.exe Token: SeBackupPrivilege 2128 daf55a9d48dd736fa870acd24cf4ced89b079544051d3bd782195ea9b96d6397.exe Token: SeBackupPrivilege 2128 daf55a9d48dd736fa870acd24cf4ced89b079544051d3bd782195ea9b96d6397.exe Token: SeSecurityPrivilege 2128 daf55a9d48dd736fa870acd24cf4ced89b079544051d3bd782195ea9b96d6397.exe Token: SeSecurityPrivilege 2128 daf55a9d48dd736fa870acd24cf4ced89b079544051d3bd782195ea9b96d6397.exe Token: SeBackupPrivilege 2128 daf55a9d48dd736fa870acd24cf4ced89b079544051d3bd782195ea9b96d6397.exe Token: SeBackupPrivilege 2128 daf55a9d48dd736fa870acd24cf4ced89b079544051d3bd782195ea9b96d6397.exe Token: SeSecurityPrivilege 2128 daf55a9d48dd736fa870acd24cf4ced89b079544051d3bd782195ea9b96d6397.exe Token: SeSecurityPrivilege 2128 daf55a9d48dd736fa870acd24cf4ced89b079544051d3bd782195ea9b96d6397.exe Token: SeBackupPrivilege 2128 daf55a9d48dd736fa870acd24cf4ced89b079544051d3bd782195ea9b96d6397.exe -
Suspicious use of WriteProcessMemory 5 IoCs
description pid Process procid_target PID 2128 wrote to memory of 2880 2128 daf55a9d48dd736fa870acd24cf4ced89b079544051d3bd782195ea9b96d6397.exe 34 PID 2128 wrote to memory of 2880 2128 daf55a9d48dd736fa870acd24cf4ced89b079544051d3bd782195ea9b96d6397.exe 34 PID 2128 wrote to memory of 2880 2128 daf55a9d48dd736fa870acd24cf4ced89b079544051d3bd782195ea9b96d6397.exe 34 PID 2128 wrote to memory of 2880 2128 daf55a9d48dd736fa870acd24cf4ced89b079544051d3bd782195ea9b96d6397.exe 34 PID 2128 wrote to memory of 2880 2128 daf55a9d48dd736fa870acd24cf4ced89b079544051d3bd782195ea9b96d6397.exe 34 -
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\daf55a9d48dd736fa870acd24cf4ced89b079544051d3bd782195ea9b96d6397.exe"C:\Users\Admin\AppData\Local\Temp\daf55a9d48dd736fa870acd24cf4ced89b079544051d3bd782195ea9b96d6397.exe"1⤵
- Loads dropped DLL
- Drops desktop.ini file(s)
- Sets desktop wallpaper using registry
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Modifies Control Panel
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2128 -
C:\ProgramData\C745.tmp"C:\ProgramData\C745.tmp"2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: RenamesItself
PID:2880
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1676
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
129B
MD580e20b9717211aa03ae19b2a48606641
SHA10df40ed180108166829b6aa533f5877d5aca7444
SHA25602e5999c13643b892acec90a2532c31871e6d0dc2cd44aa809564a751bdc8077
SHA5125926f728c60021a5db086b1c2665e9eee7bef396de4d2faa28be5eaddb9159929f4fc81634efd67d574115336380eb44391886fe3d9fcb7cff55dc9231ee4e9b
-
Filesize
6KB
MD532f4986df14926762cc5c05a8db626b9
SHA1a1a0d445a63aa28efa733dd4238e2a5d0156fa8c
SHA2568b89b5cba05385a51eda21713fc9ce2597cf3a87b41d4bd8e5a5120dace454cc
SHA512bab7218e33f02e441135503afd86ec9ad198fc354c2857f307789d1fa6be9d3df801bce432c5ce1d2be12244f8b716337ae4d4542598687e938a846107c5a84a
-
C:\Users\Admin\AppData\Local\Temp\DDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDD
Filesize160KB
MD5545a18e11deec0607bb8002d9af8c6c5
SHA1dba0eb02fa9e8968935689a8934aa81649d8fcfb
SHA2561f7d52b4904101184e79ad8606f919a28453acdda2bb028d15f081d78474d178
SHA5129379c94d7664ae930e9955a99dad69c87927d92e030894676566bad02a4fc2d41beb674c36b8ef1e890bf6be18efe00aa1f3c6eeb4083c5ad14fbb6baeb74f46
-
Filesize
129B
MD5c4fc6646a111b09c2b079bf2d1276cf8
SHA18d40520b86ec32112648fc4524f1d0104ac8b871
SHA256c2365b3c7313dcdba208022aaa966f1244e6323d654031cab0482fb413dc342c
SHA51248c7ccb7f5fd0225d904531655ad16522bb2a6657ffeb2071d4aae31951367e6cbf26d3d0edde9765fb0917ddafdf89d29a00e29c1e9802ed385b3c07d41d361
-
Filesize
14KB
MD5294e9f64cb1642dd89229fff0592856b
SHA197b148c27f3da29ba7b18d6aee8a0db9102f47c9
SHA256917e115cc403e29b4388e0d175cbfac3e7e40ca1742299fbdb353847db2de7c2
SHA512b87d531890bf1577b9b4af41dddb2cdbbfa164cf197bd5987df3a3075983645a3acba443e289b7bfd338422978a104f55298fbfe346872de0895bde44adc89cf