Analysis
-
max time kernel
103s -
max time network
135s -
platform
windows10-2004_x64 -
resource
win10v2004-20250502-en -
resource tags
arch:x64arch:x86image:win10v2004-20250502-enlocale:en-usos:windows10-2004-x64system -
submitted
19/05/2025, 14:47
Static task
static1
Behavioral task
behavioral1
Sample
2025-05-19_ac8c5bb28609e1707bfb46cb3547a01b_coinminer_polyvice.exe
Resource
win10v2004-20250502-en
General
-
Target
2025-05-19_ac8c5bb28609e1707bfb46cb3547a01b_coinminer_polyvice.exe
-
Size
4.5MB
-
MD5
ac8c5bb28609e1707bfb46cb3547a01b
-
SHA1
d17bdc16d49bd1cd7521ce8b17ebe88e86f9ce8f
-
SHA256
9cc7f38b240a650bd4edddbbbb8abaf43b6ba62821b37893226bd75fcc969749
-
SHA512
d698245302ef4d2c0039c30e1f3f549a6c88d861ae03bd04a581895d4078589481dfceb0b0d4ecfdbe4db0b2c463a1b1c76003d007cac0d657c21c9601a201fc
-
SSDEEP
98304:+sjzLyUC1WB6F2Kv1mCuyY50vPF+LL4XDpyDc/w1xGxpp+TzbHhX4lbJtFuDZv9T:3jhQFwVcoqGTHHhXobJvwZB
Malware Config
Signatures
-
Renames multiple (560) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Sets desktop wallpaper using registry 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3951986358-4006919840-1009690842-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\\\wallpaper_temp_544.png" 2025-05-19_ac8c5bb28609e1707bfb46cb3547a01b_coinminer_polyvice.exe
Processes
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133906695899785085.txt.enc
Filesize77KB
MD5f5f1b71836699c95465fdbf895140f6e
SHA198f06d7f24265ff06fbdc9caef9ab4394fed0217
SHA2562e3d1a9c16a101547e0131d58ed162ec224566c163159adb32b0a455dd0c0db7
SHA5128ba717e77a0eb2dd3b915e8652888173f3ebbdea952be8fa31e89ea8b0b23bbfef97443685ce4ac4a1b68359c9dab636f34cf1c39241db38f0822a7a18e582ae
-
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133906697109550709.txt.enc
Filesize47KB
MD5bd89637dff7ffa0d1b62011ca645488a
SHA1795d90a7719d7a7634f46de6052ec002ca9add8e
SHA25664b095762b5dc79a79178b3f81ea160d35a49c2cee29aa9b4cac81e94b6cbc3c
SHA5128581d6094d3d34d1a7647cee6e5377d9d1a8171211524f30ea35cf23e3faaaf7f926ffea0d85e477e103a5795557ca905af103e94c317925ce7385841bfd04c6
-
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133906704604346632.txt.enc
Filesize65KB
MD5953fc185b882fca4cf16aeb4a6e09d05
SHA1bdb8d0606a77147a5789675419b53d2f1220a445
SHA25667d6d40ed9f014c71e6a84957b8dbf79213362b3f43aaebf2898be9f8800d876
SHA512877aad864e0faf81bd7bded0d192588932b6b1dbc39561a45783c3ce50d65d6c48486d4caa2bfd4a14af6681d29580c52148999b4cdb34e794348452424052b5