Analysis
-
max time kernel
104s -
max time network
134s -
platform
windows10-2004_x64 -
resource
win10v2004-20250314-en -
resource tags
arch:x64arch:x86image:win10v2004-20250314-enlocale:en-usos:windows10-2004-x64system -
submitted
28/03/2025, 06:44
Behavioral task
behavioral1
Sample
e2bda5afc3e70460223a98cd3520e4ab97fd126a48b9fe7d385e1e9730a11407.exe
Resource
win7-20240903-en
windows7-x64
17 signatures
150 seconds
Behavioral task
behavioral2
Sample
e2bda5afc3e70460223a98cd3520e4ab97fd126a48b9fe7d385e1e9730a11407.exe
Resource
win10v2004-20250314-en
windows10-2004-x64
17 signatures
150 seconds
General
-
Target
e2bda5afc3e70460223a98cd3520e4ab97fd126a48b9fe7d385e1e9730a11407.exe
-
Size
160KB
-
MD5
d1986caa455ffa11b46341e837777e52
-
SHA1
c045c2be676ebba04d7403f3636c7adb685a4011
-
SHA256
e2bda5afc3e70460223a98cd3520e4ab97fd126a48b9fe7d385e1e9730a11407
-
SHA512
ea87e4f31a45a4e54c56dc120ce26c369a02af952d0c20411677c4cba4eb442a43b776d094150458a0b72dc65b53ca29fc300739cc56f81c6f7fee5e15043359
-
SSDEEP
3072:gDDDDDDDDDDDDDDDDDDDE45d/t6sVkgZqltP3368Pu7YlTx6gIB8FrN75DyW:K5d/zugZqll3AYrG+
Score
9/10
Malware Config
Signatures
-
Renames multiple (136) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-805952410-2104024357-1716932545-1000\Control Panel\International\Geo\Nation 58BB.tmp -
Deletes itself 1 IoCs
pid Process 2380 58BB.tmp -
Executes dropped EXE 1 IoCs
pid Process 2380 58BB.tmp -
Drops desktop.ini file(s) 2 IoCs
description ioc Process File opened for modification C:\$Recycle.Bin\S-1-5-21-805952410-2104024357-1716932545-1000\desktop.ini e2bda5afc3e70460223a98cd3520e4ab97fd126a48b9fe7d385e1e9730a11407.exe File opened for modification F:\$RECYCLE.BIN\S-1-5-21-805952410-2104024357-1716932545-1000\desktop.ini e2bda5afc3e70460223a98cd3520e4ab97fd126a48b9fe7d385e1e9730a11407.exe -
Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
-
Sets desktop wallpaper using registry 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-805952410-2104024357-1716932545-1000\Control Panel\Desktop\WallPaper = "C:\\ProgramData\\kF0wnCN24.bmp" e2bda5afc3e70460223a98cd3520e4ab97fd126a48b9fe7d385e1e9730a11407.exe Set value (str) \REGISTRY\USER\S-1-5-21-805952410-2104024357-1716932545-1000\Control Panel\Desktop\Wallpaper = "C:\\ProgramData\\kF0wnCN24.bmp" e2bda5afc3e70460223a98cd3520e4ab97fd126a48b9fe7d385e1e9730a11407.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 12 IoCs
pid Process 700 e2bda5afc3e70460223a98cd3520e4ab97fd126a48b9fe7d385e1e9730a11407.exe 700 e2bda5afc3e70460223a98cd3520e4ab97fd126a48b9fe7d385e1e9730a11407.exe 700 e2bda5afc3e70460223a98cd3520e4ab97fd126a48b9fe7d385e1e9730a11407.exe 700 e2bda5afc3e70460223a98cd3520e4ab97fd126a48b9fe7d385e1e9730a11407.exe 700 e2bda5afc3e70460223a98cd3520e4ab97fd126a48b9fe7d385e1e9730a11407.exe 700 e2bda5afc3e70460223a98cd3520e4ab97fd126a48b9fe7d385e1e9730a11407.exe 2380 58BB.tmp 2380 58BB.tmp 2380 58BB.tmp 2380 58BB.tmp 2380 58BB.tmp 2380 58BB.tmp -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 58BB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language e2bda5afc3e70460223a98cd3520e4ab97fd126a48b9fe7d385e1e9730a11407.exe -
Modifies Control Panel 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-805952410-2104024357-1716932545-1000\Control Panel\Desktop e2bda5afc3e70460223a98cd3520e4ab97fd126a48b9fe7d385e1e9730a11407.exe Set value (str) \REGISTRY\USER\S-1-5-21-805952410-2104024357-1716932545-1000\Control Panel\Desktop\WallpaperStyle = "10" e2bda5afc3e70460223a98cd3520e4ab97fd126a48b9fe7d385e1e9730a11407.exe -
Modifies registry class 5 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\kF0wnCN24\DefaultIcon e2bda5afc3e70460223a98cd3520e4ab97fd126a48b9fe7d385e1e9730a11407.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\kF0wnCN24 e2bda5afc3e70460223a98cd3520e4ab97fd126a48b9fe7d385e1e9730a11407.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\kF0wnCN24\DefaultIcon\ = "C:\\ProgramData\\kF0wnCN24.ico" e2bda5afc3e70460223a98cd3520e4ab97fd126a48b9fe7d385e1e9730a11407.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.kF0wnCN24 e2bda5afc3e70460223a98cd3520e4ab97fd126a48b9fe7d385e1e9730a11407.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.kF0wnCN24\ = "kF0wnCN24" e2bda5afc3e70460223a98cd3520e4ab97fd126a48b9fe7d385e1e9730a11407.exe -
Suspicious behavior: EnumeratesProcesses 12 IoCs
pid Process 700 e2bda5afc3e70460223a98cd3520e4ab97fd126a48b9fe7d385e1e9730a11407.exe 700 e2bda5afc3e70460223a98cd3520e4ab97fd126a48b9fe7d385e1e9730a11407.exe 700 e2bda5afc3e70460223a98cd3520e4ab97fd126a48b9fe7d385e1e9730a11407.exe 700 e2bda5afc3e70460223a98cd3520e4ab97fd126a48b9fe7d385e1e9730a11407.exe 700 e2bda5afc3e70460223a98cd3520e4ab97fd126a48b9fe7d385e1e9730a11407.exe 700 e2bda5afc3e70460223a98cd3520e4ab97fd126a48b9fe7d385e1e9730a11407.exe 700 e2bda5afc3e70460223a98cd3520e4ab97fd126a48b9fe7d385e1e9730a11407.exe 700 e2bda5afc3e70460223a98cd3520e4ab97fd126a48b9fe7d385e1e9730a11407.exe 700 e2bda5afc3e70460223a98cd3520e4ab97fd126a48b9fe7d385e1e9730a11407.exe 700 e2bda5afc3e70460223a98cd3520e4ab97fd126a48b9fe7d385e1e9730a11407.exe 700 e2bda5afc3e70460223a98cd3520e4ab97fd126a48b9fe7d385e1e9730a11407.exe 700 e2bda5afc3e70460223a98cd3520e4ab97fd126a48b9fe7d385e1e9730a11407.exe -
Suspicious behavior: RenamesItself 26 IoCs
pid Process 2380 58BB.tmp 2380 58BB.tmp 2380 58BB.tmp 2380 58BB.tmp 2380 58BB.tmp 2380 58BB.tmp 2380 58BB.tmp 2380 58BB.tmp 2380 58BB.tmp 2380 58BB.tmp 2380 58BB.tmp 2380 58BB.tmp 2380 58BB.tmp 2380 58BB.tmp 2380 58BB.tmp 2380 58BB.tmp 2380 58BB.tmp 2380 58BB.tmp 2380 58BB.tmp 2380 58BB.tmp 2380 58BB.tmp 2380 58BB.tmp 2380 58BB.tmp 2380 58BB.tmp 2380 58BB.tmp 2380 58BB.tmp -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeAssignPrimaryTokenPrivilege 700 e2bda5afc3e70460223a98cd3520e4ab97fd126a48b9fe7d385e1e9730a11407.exe Token: SeBackupPrivilege 700 e2bda5afc3e70460223a98cd3520e4ab97fd126a48b9fe7d385e1e9730a11407.exe Token: SeDebugPrivilege 700 e2bda5afc3e70460223a98cd3520e4ab97fd126a48b9fe7d385e1e9730a11407.exe Token: 36 700 e2bda5afc3e70460223a98cd3520e4ab97fd126a48b9fe7d385e1e9730a11407.exe Token: SeImpersonatePrivilege 700 e2bda5afc3e70460223a98cd3520e4ab97fd126a48b9fe7d385e1e9730a11407.exe Token: SeIncBasePriorityPrivilege 700 e2bda5afc3e70460223a98cd3520e4ab97fd126a48b9fe7d385e1e9730a11407.exe Token: SeIncreaseQuotaPrivilege 700 e2bda5afc3e70460223a98cd3520e4ab97fd126a48b9fe7d385e1e9730a11407.exe Token: 33 700 e2bda5afc3e70460223a98cd3520e4ab97fd126a48b9fe7d385e1e9730a11407.exe Token: SeManageVolumePrivilege 700 e2bda5afc3e70460223a98cd3520e4ab97fd126a48b9fe7d385e1e9730a11407.exe Token: SeProfSingleProcessPrivilege 700 e2bda5afc3e70460223a98cd3520e4ab97fd126a48b9fe7d385e1e9730a11407.exe Token: SeRestorePrivilege 700 e2bda5afc3e70460223a98cd3520e4ab97fd126a48b9fe7d385e1e9730a11407.exe Token: SeSecurityPrivilege 700 e2bda5afc3e70460223a98cd3520e4ab97fd126a48b9fe7d385e1e9730a11407.exe Token: SeSystemProfilePrivilege 700 e2bda5afc3e70460223a98cd3520e4ab97fd126a48b9fe7d385e1e9730a11407.exe Token: SeTakeOwnershipPrivilege 700 e2bda5afc3e70460223a98cd3520e4ab97fd126a48b9fe7d385e1e9730a11407.exe Token: SeShutdownPrivilege 700 e2bda5afc3e70460223a98cd3520e4ab97fd126a48b9fe7d385e1e9730a11407.exe Token: SeDebugPrivilege 700 e2bda5afc3e70460223a98cd3520e4ab97fd126a48b9fe7d385e1e9730a11407.exe Token: SeBackupPrivilege 4280 vssvc.exe Token: SeRestorePrivilege 4280 vssvc.exe Token: SeAuditPrivilege 4280 vssvc.exe Token: SeBackupPrivilege 700 e2bda5afc3e70460223a98cd3520e4ab97fd126a48b9fe7d385e1e9730a11407.exe Token: SeBackupPrivilege 700 e2bda5afc3e70460223a98cd3520e4ab97fd126a48b9fe7d385e1e9730a11407.exe Token: SeSecurityPrivilege 700 e2bda5afc3e70460223a98cd3520e4ab97fd126a48b9fe7d385e1e9730a11407.exe Token: SeSecurityPrivilege 700 e2bda5afc3e70460223a98cd3520e4ab97fd126a48b9fe7d385e1e9730a11407.exe Token: SeBackupPrivilege 700 e2bda5afc3e70460223a98cd3520e4ab97fd126a48b9fe7d385e1e9730a11407.exe Token: SeBackupPrivilege 700 e2bda5afc3e70460223a98cd3520e4ab97fd126a48b9fe7d385e1e9730a11407.exe Token: SeSecurityPrivilege 700 e2bda5afc3e70460223a98cd3520e4ab97fd126a48b9fe7d385e1e9730a11407.exe Token: SeSecurityPrivilege 700 e2bda5afc3e70460223a98cd3520e4ab97fd126a48b9fe7d385e1e9730a11407.exe Token: SeBackupPrivilege 700 e2bda5afc3e70460223a98cd3520e4ab97fd126a48b9fe7d385e1e9730a11407.exe Token: SeBackupPrivilege 700 e2bda5afc3e70460223a98cd3520e4ab97fd126a48b9fe7d385e1e9730a11407.exe Token: SeSecurityPrivilege 700 e2bda5afc3e70460223a98cd3520e4ab97fd126a48b9fe7d385e1e9730a11407.exe Token: SeSecurityPrivilege 700 e2bda5afc3e70460223a98cd3520e4ab97fd126a48b9fe7d385e1e9730a11407.exe Token: SeBackupPrivilege 700 e2bda5afc3e70460223a98cd3520e4ab97fd126a48b9fe7d385e1e9730a11407.exe Token: SeBackupPrivilege 700 e2bda5afc3e70460223a98cd3520e4ab97fd126a48b9fe7d385e1e9730a11407.exe Token: SeSecurityPrivilege 700 e2bda5afc3e70460223a98cd3520e4ab97fd126a48b9fe7d385e1e9730a11407.exe Token: SeSecurityPrivilege 700 e2bda5afc3e70460223a98cd3520e4ab97fd126a48b9fe7d385e1e9730a11407.exe Token: SeBackupPrivilege 700 e2bda5afc3e70460223a98cd3520e4ab97fd126a48b9fe7d385e1e9730a11407.exe Token: SeBackupPrivilege 700 e2bda5afc3e70460223a98cd3520e4ab97fd126a48b9fe7d385e1e9730a11407.exe Token: SeSecurityPrivilege 700 e2bda5afc3e70460223a98cd3520e4ab97fd126a48b9fe7d385e1e9730a11407.exe Token: SeSecurityPrivilege 700 e2bda5afc3e70460223a98cd3520e4ab97fd126a48b9fe7d385e1e9730a11407.exe Token: SeBackupPrivilege 700 e2bda5afc3e70460223a98cd3520e4ab97fd126a48b9fe7d385e1e9730a11407.exe Token: SeBackupPrivilege 700 e2bda5afc3e70460223a98cd3520e4ab97fd126a48b9fe7d385e1e9730a11407.exe Token: SeSecurityPrivilege 700 e2bda5afc3e70460223a98cd3520e4ab97fd126a48b9fe7d385e1e9730a11407.exe Token: SeSecurityPrivilege 700 e2bda5afc3e70460223a98cd3520e4ab97fd126a48b9fe7d385e1e9730a11407.exe Token: SeBackupPrivilege 700 e2bda5afc3e70460223a98cd3520e4ab97fd126a48b9fe7d385e1e9730a11407.exe Token: SeBackupPrivilege 700 e2bda5afc3e70460223a98cd3520e4ab97fd126a48b9fe7d385e1e9730a11407.exe Token: SeSecurityPrivilege 700 e2bda5afc3e70460223a98cd3520e4ab97fd126a48b9fe7d385e1e9730a11407.exe Token: SeSecurityPrivilege 700 e2bda5afc3e70460223a98cd3520e4ab97fd126a48b9fe7d385e1e9730a11407.exe Token: SeBackupPrivilege 700 e2bda5afc3e70460223a98cd3520e4ab97fd126a48b9fe7d385e1e9730a11407.exe Token: SeBackupPrivilege 700 e2bda5afc3e70460223a98cd3520e4ab97fd126a48b9fe7d385e1e9730a11407.exe Token: SeSecurityPrivilege 700 e2bda5afc3e70460223a98cd3520e4ab97fd126a48b9fe7d385e1e9730a11407.exe Token: SeSecurityPrivilege 700 e2bda5afc3e70460223a98cd3520e4ab97fd126a48b9fe7d385e1e9730a11407.exe Token: SeBackupPrivilege 700 e2bda5afc3e70460223a98cd3520e4ab97fd126a48b9fe7d385e1e9730a11407.exe Token: SeBackupPrivilege 700 e2bda5afc3e70460223a98cd3520e4ab97fd126a48b9fe7d385e1e9730a11407.exe Token: SeSecurityPrivilege 700 e2bda5afc3e70460223a98cd3520e4ab97fd126a48b9fe7d385e1e9730a11407.exe Token: SeSecurityPrivilege 700 e2bda5afc3e70460223a98cd3520e4ab97fd126a48b9fe7d385e1e9730a11407.exe Token: SeBackupPrivilege 700 e2bda5afc3e70460223a98cd3520e4ab97fd126a48b9fe7d385e1e9730a11407.exe Token: SeBackupPrivilege 700 e2bda5afc3e70460223a98cd3520e4ab97fd126a48b9fe7d385e1e9730a11407.exe Token: SeSecurityPrivilege 700 e2bda5afc3e70460223a98cd3520e4ab97fd126a48b9fe7d385e1e9730a11407.exe Token: SeSecurityPrivilege 700 e2bda5afc3e70460223a98cd3520e4ab97fd126a48b9fe7d385e1e9730a11407.exe Token: SeBackupPrivilege 700 e2bda5afc3e70460223a98cd3520e4ab97fd126a48b9fe7d385e1e9730a11407.exe Token: SeBackupPrivilege 700 e2bda5afc3e70460223a98cd3520e4ab97fd126a48b9fe7d385e1e9730a11407.exe Token: SeSecurityPrivilege 700 e2bda5afc3e70460223a98cd3520e4ab97fd126a48b9fe7d385e1e9730a11407.exe Token: SeSecurityPrivilege 700 e2bda5afc3e70460223a98cd3520e4ab97fd126a48b9fe7d385e1e9730a11407.exe Token: SeBackupPrivilege 700 e2bda5afc3e70460223a98cd3520e4ab97fd126a48b9fe7d385e1e9730a11407.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 700 wrote to memory of 2380 700 e2bda5afc3e70460223a98cd3520e4ab97fd126a48b9fe7d385e1e9730a11407.exe 97 PID 700 wrote to memory of 2380 700 e2bda5afc3e70460223a98cd3520e4ab97fd126a48b9fe7d385e1e9730a11407.exe 97 PID 700 wrote to memory of 2380 700 e2bda5afc3e70460223a98cd3520e4ab97fd126a48b9fe7d385e1e9730a11407.exe 97 PID 700 wrote to memory of 2380 700 e2bda5afc3e70460223a98cd3520e4ab97fd126a48b9fe7d385e1e9730a11407.exe 97 PID 2380 wrote to memory of 4432 2380 58BB.tmp 104 PID 2380 wrote to memory of 4432 2380 58BB.tmp 104 PID 2380 wrote to memory of 4432 2380 58BB.tmp 104 -
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\e2bda5afc3e70460223a98cd3520e4ab97fd126a48b9fe7d385e1e9730a11407.exe"C:\Users\Admin\AppData\Local\Temp\e2bda5afc3e70460223a98cd3520e4ab97fd126a48b9fe7d385e1e9730a11407.exe"1⤵
- Drops desktop.ini file(s)
- Sets desktop wallpaper using registry
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Modifies Control Panel
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:700 -
C:\ProgramData\58BB.tmp"C:\ProgramData\58BB.tmp"2⤵
- Checks computer location settings
- Deletes itself
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:2380 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C DEL /F /Q C:\PROGRA~3\58BB.tmp >> NUL3⤵
- System Location Discovery: System Language Discovery
PID:4432
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4280
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
129B
MD50b62e10141c8a8deac75c15cda4c22f0
SHA19a8e398d8ecee25b222119427a367da8ec98f540
SHA25605f8eae66010a2d015a5dcf78d74a7d107aa756ad205160d46e51588197fe304
SHA512b3924716c4dff75f9a09b77760b425014cf5bc2bb2a14ad5bf939669d986b21a67f23f1ff81633b702135cb738c8609fec9f59f0b4ec3ce7d5d9bd3dad867f73
-
Filesize
14KB
MD5294e9f64cb1642dd89229fff0592856b
SHA197b148c27f3da29ba7b18d6aee8a0db9102f47c9
SHA256917e115cc403e29b4388e0d175cbfac3e7e40ca1742299fbdb353847db2de7c2
SHA512b87d531890bf1577b9b4af41dddb2cdbbfa164cf197bd5987df3a3075983645a3acba443e289b7bfd338422978a104f55298fbfe346872de0895bde44adc89cf
-
C:\Users\Admin\AppData\Local\Temp\DDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDD
Filesize160KB
MD574a45a114fa456611f7846188753634b
SHA189d14e225720de80b8bc8bf3c9ea72f107577424
SHA25637788733de47f32f75451764dc1319509e963d09cb090aa9da88722ef605a844
SHA51226356c0e98863fa24c01b79d798a26ead287365697b558137a7b64d2b61726b063ad05efa410fe71cf7a9c64f25382d1597c8fee6c9fb3c579cdb69663ed98fa
-
Filesize
6KB
MD5296c0dab2850a7fde51a1ffa213275c7
SHA1dceab4db24a738989dbdd009d35d7a614fd9f190
SHA2566a1cdd26cd3d5ec33c5e4d45a897beda50da63c080f61b700065687c479134b9
SHA51261fcbc6a0da8ab9bf94461846c0916ee5ec8fd10c38a67b49e7f04ddc6e7759b2bc6916566bf5f58c761f86cd878e8d7f4c1e5017cf5f2f592fbe38e72051891
-
Filesize
129B
MD57775c7bde887a217af96305d357c4884
SHA199fdbf8b0f37c266cc7e9a18bc0e9be8508c54a7
SHA25692920468c195335cd9101e4ef8153ef7d6c0404d1cd4a78e05621ef6ff3c53a5
SHA512178f13c5eb6891fd0bf07b63314ef4c556c11d05677ca94f2123326a3da80356c56e4f96f14c430b216311d11d972042e0ca42ad91116700d3330001ce6df6d5