Analysis
-
max time kernel
121s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
28/03/2025, 06:44
Behavioral task
behavioral1
Sample
e2bda5afc3e70460223a98cd3520e4ab97fd126a48b9fe7d385e1e9730a11407.exe
Resource
win7-20240903-en
windows7-x64
17 signatures
150 seconds
Behavioral task
behavioral2
Sample
e2bda5afc3e70460223a98cd3520e4ab97fd126a48b9fe7d385e1e9730a11407.exe
Resource
win10v2004-20250314-en
windows10-2004-x64
17 signatures
150 seconds
General
-
Target
e2bda5afc3e70460223a98cd3520e4ab97fd126a48b9fe7d385e1e9730a11407.exe
-
Size
160KB
-
MD5
d1986caa455ffa11b46341e837777e52
-
SHA1
c045c2be676ebba04d7403f3636c7adb685a4011
-
SHA256
e2bda5afc3e70460223a98cd3520e4ab97fd126a48b9fe7d385e1e9730a11407
-
SHA512
ea87e4f31a45a4e54c56dc120ce26c369a02af952d0c20411677c4cba4eb442a43b776d094150458a0b72dc65b53ca29fc300739cc56f81c6f7fee5e15043359
-
SSDEEP
3072:gDDDDDDDDDDDDDDDDDDDE45d/t6sVkgZqltP3368Pu7YlTx6gIB8FrN75DyW:K5d/zugZqll3AYrG+
Score
9/10
Malware Config
Signatures
-
Renames multiple (180) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Deletes itself 1 IoCs
pid Process 2860 194B.tmp -
Executes dropped EXE 1 IoCs
pid Process 2860 194B.tmp -
Loads dropped DLL 1 IoCs
pid Process 2276 e2bda5afc3e70460223a98cd3520e4ab97fd126a48b9fe7d385e1e9730a11407.exe -
Drops desktop.ini file(s) 2 IoCs
description ioc Process File opened for modification C:\$Recycle.Bin\S-1-5-21-2872745919-2748461613-2989606286-1000\desktop.ini e2bda5afc3e70460223a98cd3520e4ab97fd126a48b9fe7d385e1e9730a11407.exe File opened for modification F:\$RECYCLE.BIN\S-1-5-21-2872745919-2748461613-2989606286-1000\desktop.ini e2bda5afc3e70460223a98cd3520e4ab97fd126a48b9fe7d385e1e9730a11407.exe -
Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
-
Sets desktop wallpaper using registry 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Control Panel\Desktop\WallPaper = "C:\\ProgramData\\kF0wnCN24.bmp" e2bda5afc3e70460223a98cd3520e4ab97fd126a48b9fe7d385e1e9730a11407.exe Set value (str) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Control Panel\Desktop\Wallpaper = "C:\\ProgramData\\kF0wnCN24.bmp" e2bda5afc3e70460223a98cd3520e4ab97fd126a48b9fe7d385e1e9730a11407.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 12 IoCs
pid Process 2276 e2bda5afc3e70460223a98cd3520e4ab97fd126a48b9fe7d385e1e9730a11407.exe 2276 e2bda5afc3e70460223a98cd3520e4ab97fd126a48b9fe7d385e1e9730a11407.exe 2276 e2bda5afc3e70460223a98cd3520e4ab97fd126a48b9fe7d385e1e9730a11407.exe 2276 e2bda5afc3e70460223a98cd3520e4ab97fd126a48b9fe7d385e1e9730a11407.exe 2276 e2bda5afc3e70460223a98cd3520e4ab97fd126a48b9fe7d385e1e9730a11407.exe 2276 e2bda5afc3e70460223a98cd3520e4ab97fd126a48b9fe7d385e1e9730a11407.exe 2860 194B.tmp 2860 194B.tmp 2860 194B.tmp 2860 194B.tmp 2860 194B.tmp 2860 194B.tmp -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language e2bda5afc3e70460223a98cd3520e4ab97fd126a48b9fe7d385e1e9730a11407.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 194B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe -
Modifies Control Panel 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Control Panel\Desktop e2bda5afc3e70460223a98cd3520e4ab97fd126a48b9fe7d385e1e9730a11407.exe Set value (str) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Control Panel\Desktop\WallpaperStyle = "10" e2bda5afc3e70460223a98cd3520e4ab97fd126a48b9fe7d385e1e9730a11407.exe -
Modifies registry class 5 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.kF0wnCN24 e2bda5afc3e70460223a98cd3520e4ab97fd126a48b9fe7d385e1e9730a11407.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.kF0wnCN24\ = "kF0wnCN24" e2bda5afc3e70460223a98cd3520e4ab97fd126a48b9fe7d385e1e9730a11407.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\kF0wnCN24\DefaultIcon e2bda5afc3e70460223a98cd3520e4ab97fd126a48b9fe7d385e1e9730a11407.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\kF0wnCN24 e2bda5afc3e70460223a98cd3520e4ab97fd126a48b9fe7d385e1e9730a11407.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\kF0wnCN24\DefaultIcon\ = "C:\\ProgramData\\kF0wnCN24.ico" e2bda5afc3e70460223a98cd3520e4ab97fd126a48b9fe7d385e1e9730a11407.exe -
Suspicious behavior: EnumeratesProcesses 12 IoCs
pid Process 2276 e2bda5afc3e70460223a98cd3520e4ab97fd126a48b9fe7d385e1e9730a11407.exe 2276 e2bda5afc3e70460223a98cd3520e4ab97fd126a48b9fe7d385e1e9730a11407.exe 2276 e2bda5afc3e70460223a98cd3520e4ab97fd126a48b9fe7d385e1e9730a11407.exe 2276 e2bda5afc3e70460223a98cd3520e4ab97fd126a48b9fe7d385e1e9730a11407.exe 2276 e2bda5afc3e70460223a98cd3520e4ab97fd126a48b9fe7d385e1e9730a11407.exe 2276 e2bda5afc3e70460223a98cd3520e4ab97fd126a48b9fe7d385e1e9730a11407.exe 2276 e2bda5afc3e70460223a98cd3520e4ab97fd126a48b9fe7d385e1e9730a11407.exe 2276 e2bda5afc3e70460223a98cd3520e4ab97fd126a48b9fe7d385e1e9730a11407.exe 2276 e2bda5afc3e70460223a98cd3520e4ab97fd126a48b9fe7d385e1e9730a11407.exe 2276 e2bda5afc3e70460223a98cd3520e4ab97fd126a48b9fe7d385e1e9730a11407.exe 2276 e2bda5afc3e70460223a98cd3520e4ab97fd126a48b9fe7d385e1e9730a11407.exe 2276 e2bda5afc3e70460223a98cd3520e4ab97fd126a48b9fe7d385e1e9730a11407.exe -
Suspicious behavior: RenamesItself 26 IoCs
pid Process 2860 194B.tmp 2860 194B.tmp 2860 194B.tmp 2860 194B.tmp 2860 194B.tmp 2860 194B.tmp 2860 194B.tmp 2860 194B.tmp 2860 194B.tmp 2860 194B.tmp 2860 194B.tmp 2860 194B.tmp 2860 194B.tmp 2860 194B.tmp 2860 194B.tmp 2860 194B.tmp 2860 194B.tmp 2860 194B.tmp 2860 194B.tmp 2860 194B.tmp 2860 194B.tmp 2860 194B.tmp 2860 194B.tmp 2860 194B.tmp 2860 194B.tmp 2860 194B.tmp -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeAssignPrimaryTokenPrivilege 2276 e2bda5afc3e70460223a98cd3520e4ab97fd126a48b9fe7d385e1e9730a11407.exe Token: SeBackupPrivilege 2276 e2bda5afc3e70460223a98cd3520e4ab97fd126a48b9fe7d385e1e9730a11407.exe Token: SeDebugPrivilege 2276 e2bda5afc3e70460223a98cd3520e4ab97fd126a48b9fe7d385e1e9730a11407.exe Token: 36 2276 e2bda5afc3e70460223a98cd3520e4ab97fd126a48b9fe7d385e1e9730a11407.exe Token: SeImpersonatePrivilege 2276 e2bda5afc3e70460223a98cd3520e4ab97fd126a48b9fe7d385e1e9730a11407.exe Token: SeIncBasePriorityPrivilege 2276 e2bda5afc3e70460223a98cd3520e4ab97fd126a48b9fe7d385e1e9730a11407.exe Token: SeIncreaseQuotaPrivilege 2276 e2bda5afc3e70460223a98cd3520e4ab97fd126a48b9fe7d385e1e9730a11407.exe Token: 33 2276 e2bda5afc3e70460223a98cd3520e4ab97fd126a48b9fe7d385e1e9730a11407.exe Token: SeManageVolumePrivilege 2276 e2bda5afc3e70460223a98cd3520e4ab97fd126a48b9fe7d385e1e9730a11407.exe Token: SeProfSingleProcessPrivilege 2276 e2bda5afc3e70460223a98cd3520e4ab97fd126a48b9fe7d385e1e9730a11407.exe Token: SeRestorePrivilege 2276 e2bda5afc3e70460223a98cd3520e4ab97fd126a48b9fe7d385e1e9730a11407.exe Token: SeSecurityPrivilege 2276 e2bda5afc3e70460223a98cd3520e4ab97fd126a48b9fe7d385e1e9730a11407.exe Token: SeSystemProfilePrivilege 2276 e2bda5afc3e70460223a98cd3520e4ab97fd126a48b9fe7d385e1e9730a11407.exe Token: SeTakeOwnershipPrivilege 2276 e2bda5afc3e70460223a98cd3520e4ab97fd126a48b9fe7d385e1e9730a11407.exe Token: SeShutdownPrivilege 2276 e2bda5afc3e70460223a98cd3520e4ab97fd126a48b9fe7d385e1e9730a11407.exe Token: SeDebugPrivilege 2276 e2bda5afc3e70460223a98cd3520e4ab97fd126a48b9fe7d385e1e9730a11407.exe Token: SeBackupPrivilege 1260 vssvc.exe Token: SeRestorePrivilege 1260 vssvc.exe Token: SeAuditPrivilege 1260 vssvc.exe Token: SeBackupPrivilege 2276 e2bda5afc3e70460223a98cd3520e4ab97fd126a48b9fe7d385e1e9730a11407.exe Token: SeBackupPrivilege 2276 e2bda5afc3e70460223a98cd3520e4ab97fd126a48b9fe7d385e1e9730a11407.exe Token: SeSecurityPrivilege 2276 e2bda5afc3e70460223a98cd3520e4ab97fd126a48b9fe7d385e1e9730a11407.exe Token: SeSecurityPrivilege 2276 e2bda5afc3e70460223a98cd3520e4ab97fd126a48b9fe7d385e1e9730a11407.exe Token: SeBackupPrivilege 2276 e2bda5afc3e70460223a98cd3520e4ab97fd126a48b9fe7d385e1e9730a11407.exe Token: SeBackupPrivilege 2276 e2bda5afc3e70460223a98cd3520e4ab97fd126a48b9fe7d385e1e9730a11407.exe Token: SeSecurityPrivilege 2276 e2bda5afc3e70460223a98cd3520e4ab97fd126a48b9fe7d385e1e9730a11407.exe Token: SeSecurityPrivilege 2276 e2bda5afc3e70460223a98cd3520e4ab97fd126a48b9fe7d385e1e9730a11407.exe Token: SeBackupPrivilege 2276 e2bda5afc3e70460223a98cd3520e4ab97fd126a48b9fe7d385e1e9730a11407.exe Token: SeBackupPrivilege 2276 e2bda5afc3e70460223a98cd3520e4ab97fd126a48b9fe7d385e1e9730a11407.exe Token: SeSecurityPrivilege 2276 e2bda5afc3e70460223a98cd3520e4ab97fd126a48b9fe7d385e1e9730a11407.exe Token: SeSecurityPrivilege 2276 e2bda5afc3e70460223a98cd3520e4ab97fd126a48b9fe7d385e1e9730a11407.exe Token: SeBackupPrivilege 2276 e2bda5afc3e70460223a98cd3520e4ab97fd126a48b9fe7d385e1e9730a11407.exe Token: SeBackupPrivilege 2276 e2bda5afc3e70460223a98cd3520e4ab97fd126a48b9fe7d385e1e9730a11407.exe Token: SeSecurityPrivilege 2276 e2bda5afc3e70460223a98cd3520e4ab97fd126a48b9fe7d385e1e9730a11407.exe Token: SeSecurityPrivilege 2276 e2bda5afc3e70460223a98cd3520e4ab97fd126a48b9fe7d385e1e9730a11407.exe Token: SeBackupPrivilege 2276 e2bda5afc3e70460223a98cd3520e4ab97fd126a48b9fe7d385e1e9730a11407.exe Token: SeBackupPrivilege 2276 e2bda5afc3e70460223a98cd3520e4ab97fd126a48b9fe7d385e1e9730a11407.exe Token: SeSecurityPrivilege 2276 e2bda5afc3e70460223a98cd3520e4ab97fd126a48b9fe7d385e1e9730a11407.exe Token: SeSecurityPrivilege 2276 e2bda5afc3e70460223a98cd3520e4ab97fd126a48b9fe7d385e1e9730a11407.exe Token: SeBackupPrivilege 2276 e2bda5afc3e70460223a98cd3520e4ab97fd126a48b9fe7d385e1e9730a11407.exe Token: SeBackupPrivilege 2276 e2bda5afc3e70460223a98cd3520e4ab97fd126a48b9fe7d385e1e9730a11407.exe Token: SeSecurityPrivilege 2276 e2bda5afc3e70460223a98cd3520e4ab97fd126a48b9fe7d385e1e9730a11407.exe Token: SeSecurityPrivilege 2276 e2bda5afc3e70460223a98cd3520e4ab97fd126a48b9fe7d385e1e9730a11407.exe Token: SeBackupPrivilege 2276 e2bda5afc3e70460223a98cd3520e4ab97fd126a48b9fe7d385e1e9730a11407.exe Token: SeBackupPrivilege 2276 e2bda5afc3e70460223a98cd3520e4ab97fd126a48b9fe7d385e1e9730a11407.exe Token: SeSecurityPrivilege 2276 e2bda5afc3e70460223a98cd3520e4ab97fd126a48b9fe7d385e1e9730a11407.exe Token: SeSecurityPrivilege 2276 e2bda5afc3e70460223a98cd3520e4ab97fd126a48b9fe7d385e1e9730a11407.exe Token: SeBackupPrivilege 2276 e2bda5afc3e70460223a98cd3520e4ab97fd126a48b9fe7d385e1e9730a11407.exe Token: SeBackupPrivilege 2276 e2bda5afc3e70460223a98cd3520e4ab97fd126a48b9fe7d385e1e9730a11407.exe Token: SeSecurityPrivilege 2276 e2bda5afc3e70460223a98cd3520e4ab97fd126a48b9fe7d385e1e9730a11407.exe Token: SeSecurityPrivilege 2276 e2bda5afc3e70460223a98cd3520e4ab97fd126a48b9fe7d385e1e9730a11407.exe Token: SeBackupPrivilege 2276 e2bda5afc3e70460223a98cd3520e4ab97fd126a48b9fe7d385e1e9730a11407.exe Token: SeBackupPrivilege 2276 e2bda5afc3e70460223a98cd3520e4ab97fd126a48b9fe7d385e1e9730a11407.exe Token: SeSecurityPrivilege 2276 e2bda5afc3e70460223a98cd3520e4ab97fd126a48b9fe7d385e1e9730a11407.exe Token: SeSecurityPrivilege 2276 e2bda5afc3e70460223a98cd3520e4ab97fd126a48b9fe7d385e1e9730a11407.exe Token: SeBackupPrivilege 2276 e2bda5afc3e70460223a98cd3520e4ab97fd126a48b9fe7d385e1e9730a11407.exe Token: SeBackupPrivilege 2276 e2bda5afc3e70460223a98cd3520e4ab97fd126a48b9fe7d385e1e9730a11407.exe Token: SeSecurityPrivilege 2276 e2bda5afc3e70460223a98cd3520e4ab97fd126a48b9fe7d385e1e9730a11407.exe Token: SeSecurityPrivilege 2276 e2bda5afc3e70460223a98cd3520e4ab97fd126a48b9fe7d385e1e9730a11407.exe Token: SeBackupPrivilege 2276 e2bda5afc3e70460223a98cd3520e4ab97fd126a48b9fe7d385e1e9730a11407.exe Token: SeBackupPrivilege 2276 e2bda5afc3e70460223a98cd3520e4ab97fd126a48b9fe7d385e1e9730a11407.exe Token: SeSecurityPrivilege 2276 e2bda5afc3e70460223a98cd3520e4ab97fd126a48b9fe7d385e1e9730a11407.exe Token: SeSecurityPrivilege 2276 e2bda5afc3e70460223a98cd3520e4ab97fd126a48b9fe7d385e1e9730a11407.exe Token: SeBackupPrivilege 2276 e2bda5afc3e70460223a98cd3520e4ab97fd126a48b9fe7d385e1e9730a11407.exe -
Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 2276 wrote to memory of 2860 2276 e2bda5afc3e70460223a98cd3520e4ab97fd126a48b9fe7d385e1e9730a11407.exe 34 PID 2276 wrote to memory of 2860 2276 e2bda5afc3e70460223a98cd3520e4ab97fd126a48b9fe7d385e1e9730a11407.exe 34 PID 2276 wrote to memory of 2860 2276 e2bda5afc3e70460223a98cd3520e4ab97fd126a48b9fe7d385e1e9730a11407.exe 34 PID 2276 wrote to memory of 2860 2276 e2bda5afc3e70460223a98cd3520e4ab97fd126a48b9fe7d385e1e9730a11407.exe 34 PID 2276 wrote to memory of 2860 2276 e2bda5afc3e70460223a98cd3520e4ab97fd126a48b9fe7d385e1e9730a11407.exe 34 PID 2860 wrote to memory of 1908 2860 194B.tmp 37 PID 2860 wrote to memory of 1908 2860 194B.tmp 37 PID 2860 wrote to memory of 1908 2860 194B.tmp 37 PID 2860 wrote to memory of 1908 2860 194B.tmp 37 -
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\e2bda5afc3e70460223a98cd3520e4ab97fd126a48b9fe7d385e1e9730a11407.exe"C:\Users\Admin\AppData\Local\Temp\e2bda5afc3e70460223a98cd3520e4ab97fd126a48b9fe7d385e1e9730a11407.exe"1⤵
- Loads dropped DLL
- Drops desktop.ini file(s)
- Sets desktop wallpaper using registry
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Modifies Control Panel
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2276 -
C:\ProgramData\194B.tmp"C:\ProgramData\194B.tmp"2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:2860 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C DEL /F /Q C:\PROGRA~3\194B.tmp >> NUL3⤵
- System Location Discovery: System Language Discovery
PID:1908
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1260
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x1481⤵PID:2904
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
129B
MD5cd07c4e4b01de2397e73eabb6d6641a5
SHA1d9f6531d7c8c1c6aaebb9fd1f645bef171d72f06
SHA25627c841b884751885bc7f5fdd94094152edebf011899485986b7f95f5acaa893e
SHA5127bae4189777d1db88d65eb8acc0df0df32f3d0fc78100376bf08a1f270acfb7371a5d3c859d4e73836d61dae7776cc2fb3a43fe31669b75fbb85116419640cf1
-
C:\Users\Admin\AppData\Local\Temp\DDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDD
Filesize160KB
MD5263f3fa039da097db5e0c2ca2b2bb56c
SHA1fc66f0dbfeffa484fe4d880e89054ef4bc484953
SHA2563eb22b626002d2a81eab97141a5a1a48b2d82d05f18f1d3612598c3a094ddfb5
SHA512eb8f1155b87648dbf07c835ecab0ce8bc7417635759643642c6a4cf9baa24cc1696cc257273beed3839c5877857452cee7f8fb3cc90e78ef12cadad3e4b6365f
-
Filesize
6KB
MD505216a68d043f2be19fc375ca231644e
SHA1f618297a9b5ba0a099c93a64f6a7dbed0cf8423b
SHA2565ba25085aa6e391481e7bfa5dcb4c9cc76efa5284e4d12a30b3d3a695ccf2cff
SHA512dad077d19e860916ba9bddd22c9e942a928661ca29e48ab9d326ed30e5f3065388a89611cb58ca6af70cb7d6d0e0d934e00a2b3997526cb7e36aa1afedd21585
-
Filesize
129B
MD52eb69d02429d2f9987a77e5c590fd899
SHA1788907d2cf8a4ae960c3b203a44aee633b1b9831
SHA256624124b708c8dc64b827e914bae16cfe365f90e0f9beb0b8ca68f3e67d6bc204
SHA512601d41b2e7f19b9b3afafbd5b34699a6fa970dada223d42663d5b23d32e21b11ec3bf76328ddd17fa1b1943027b12cd4c9e5853e35d89c84f643e545da21f6cf
-
Filesize
14KB
MD5294e9f64cb1642dd89229fff0592856b
SHA197b148c27f3da29ba7b18d6aee8a0db9102f47c9
SHA256917e115cc403e29b4388e0d175cbfac3e7e40ca1742299fbdb353847db2de7c2
SHA512b87d531890bf1577b9b4af41dddb2cdbbfa164cf197bd5987df3a3075983645a3acba443e289b7bfd338422978a104f55298fbfe346872de0895bde44adc89cf