Analysis
-
max time kernel
2s -
max time network
131s -
platform
windows10-2004_x64 -
resource
win10v2004-20250314-en -
resource tags
-
submitted
26/03/2025, 12:14
General
-
Target
daf55a9d48dd736fa870acd24cf4ced89b079544051d3bd782195ea9b96d6397.exe
-
Size
160KB
-
MD5
ed6fa9757400a0de9596d59bd0262ebd
-
SHA1
0836c5ab9bed96b1d9618bc802792185c6ee21ca
-
SHA256
daf55a9d48dd736fa870acd24cf4ced89b079544051d3bd782195ea9b96d6397
-
SHA512
37d93ce4b1796d205d090390645fa149181b99fa7a67c0afcfa548851644659dde27b169049f7f5bfc73e63bc448a59746236e1e6b47335d58a6b0eddd356412
-
SSDEEP
3072:bDDDDDDDDDDDDDDDDDDDE45d/t6sVkgZqltP3368a0y5zxm8yNB41ctER6ptQtR2:15d/zugZqll3bQzmB3tQt5L
Malware Config
Signatures
-
Renames multiple (105) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Drops desktop.ini file(s) 2 IoCs
-
Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
-
Suspicious use of NtSetInformationThreadHideFromDebugger 6 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Modifies registry class 5 IoCs
-
Suspicious behavior: EnumeratesProcesses 8 IoCs
-
Suspicious use of AdjustPrivilegeToken 19 IoCs
-
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\daf55a9d48dd736fa870acd24cf4ced89b079544051d3bd782195ea9b96d6397.exe"C:\Users\Admin\AppData\Local\Temp\daf55a9d48dd736fa870acd24cf4ced89b079544051d3bd782195ea9b96d6397.exe"1⤵
- Drops desktop.ini file(s)
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\ProgramData\7D7D.tmp"C:\ProgramData\7D7D.tmp"2⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C DEL /F /Q C:\PROGRA~3\7D7D.tmp >> NUL3⤵
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
129B
MD5638e645f42663174eb205e0d630558e8
SHA15340505c47919b5db79525271460fe6084dab45b
SHA2568759487fda991e3ff5ef2d3b848edbecc018fd67c1521919fdef48bb7b1d6c48
SHA512b2565c002667ca1c7ec1e89c3fd8f0cdddb48bbb7c5c89fc6adb28873381279b1be2683af2c4bba59042ccdb54ed046f92e43525a010d174485085a777ed4fe3
-
Filesize
6KB
MD589fd57e9e30f347f88d4c4c82d84e53a
SHA1cb9640772425fd32fea89ad3896a377a3ac0a513
SHA2560934b039eb9c786543aa3c6f6e6651ebab173b0d01ace8d36d77a77ff58468be
SHA5128c2dde38714bbc8a9562b71c0e4248270bcee0b066cf7188231141aea79490fbf9892b2278ea7a5110d5dbf145bc3f9f035531206e3884fa4107cbd28f674c75
-
Filesize
14KB
MD5294e9f64cb1642dd89229fff0592856b
SHA197b148c27f3da29ba7b18d6aee8a0db9102f47c9
SHA256917e115cc403e29b4388e0d175cbfac3e7e40ca1742299fbdb353847db2de7c2
SHA512b87d531890bf1577b9b4af41dddb2cdbbfa164cf197bd5987df3a3075983645a3acba443e289b7bfd338422978a104f55298fbfe346872de0895bde44adc89cf
-
Filesize
160KB
MD54032b50893d4bfecee1668373099b3cf
SHA1e4c76ffc288e212fa742841bff0cfb6def571d01
SHA2562dd41f7b95644f60071ebf1277275e9e0937dd8d918263cdefb9362206e2dc24
SHA512b6f8feb42f66ba8d13afc49cc59d581cae928349fcbe39da0f5b1193c55dc61fc386ce06b328d12fa456c59ca040e3592d0e50a65065896ccf8697ec67d9676a
-
Filesize
129B
MD5fbbc7aea73d2c604c442f4ac764cfac4
SHA1d243be10dc90740edcdfe79235db4a7c7a76867f
SHA256ab9386b1aed4c63900adb2049d8e1e658b4d481a172ffb717b0c8d0b8c0313de
SHA5125d6ca34cc02c39e63bf08630d89f8dd8cf36874e5ff4d1d2a66c6b1ead003aaf7bf7452695dc58fb2ca09cdafe616c92c489347e228025aa7150a86e7ca5b3b6
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
64KB
-
Filesize
4KB
-
Filesize
64KB
-
Filesize
4KB
-
Filesize
4KB