Overview

overview

10

Static

static

10

311edf744c...86.exe

windows10-2004-x64

9

Analysis

  • max time kernel
    32s
  • max time network
    38s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    25-06-2024 18:18

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    311edf744c2e90d7bfc550c893478f43d1d7977694d5dcecf219795f3eb99b86.exe

  • Size

    145KB

  • MD5

    76b23dd72a883d8b1302bb4a514b7967

  • SHA1

    338e19e8a3615c29d8a825ebba66cf55fa0caa2c

  • SHA256

    311edf744c2e90d7bfc550c893478f43d1d7977694d5dcecf219795f3eb99b86

  • SHA512

    39d98f914ec9d8551a894306163bc726f035f9228f3f198de78555988cea5a7b423be8c2a19913c76b996220a81a9b3a257b7f0af67913aa8a50b77321b17735

  • SSDEEP

    1536:azICS4AAwczUUf8y8gvMH+1zGSNAojMP95D1xDtCYU0GsvgtwjECrozUYj3PeAU2:pqJogYkcSNm9V7DtCCGsg+AmYylQhTT

Score
9/10
ransomwarespywarestealer

Malware Config

Signatures

  • Renames multiple (631) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Drops desktop.ini file(s) 2 IoCs
  • Modifies registry class 5 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\311edf744c2e90d7bfc550c893478f43d1d7977694d5dcecf219795f3eb99b86.exe
    "C:\Users\Admin\AppData\Local\Temp\311edf744c2e90d7bfc550c893478f43d1d7977694d5dcecf219795f3eb99b86.exe"
    1⤵
    • Drops desktop.ini file(s)
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:2932
  • C:\Windows\System32\rundll32.exe
    C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
    1⤵
      PID:4932

    Network

    MITRE ATT&CK Matrix ATT&CK v13

    Initial Access

    Execution

    Persistence

    Privilege Escalation

    Defense Evasion

    Credential Access

    Unsecured Credentials

    1
    T1552

    Credentials In Files

    1
    T1552.001

    Discovery

    Lateral Movement

    Collection

    Data from Local System

    1
    T1005

    Exfiltration

    Command and Control

    Impact

    Resource Development

    Reconnaissance

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\$Recycle.Bin\S-1-5-21-4124900551-4068476067-3491212533-1000\desktop.ini
      Filesize

      129B

      MD5

      f33f298d6d6ae4f17e10208b4bd36b6f

      SHA1

      2fdaef10dd898fe29696a1d479122e6f332848dc

      SHA256

      d68704c0bd2f32c1387070f92993a00fb79c3064eb439de9554ee9ee4e0ac86b

      SHA512

      73c5927018a79502cc3ab69aa69e123f6e7bdac092ad3f7a1d47a53ef4a92217b82d31aec792b50bf233959ff951990617145a8336235d6942764ea47392c78c

      Download Submit
    • F:\$RECYCLE.BIN\S-1-5-21-4124900551-4068476067-3491212533-1000\DDDDDDDDDDD
      Filesize

      129B

      MD5

      879b606ce41a6cfdf29f15d661a498b3

      SHA1

      205696f1a2655fc38e0708b89200411eea625600

      SHA256

      6412d7085c0a2d86e9ac819ba60542c0ec6e99a44ed5758b1071f5da9a67282d

      SHA512

      cbc51491da7c8921daf1fb3a079e739cb236f3b4f5fffd2c440ffd0bf709a206a29774abb0fd05e11bd873ccd0ab6f194d476a2c314e6d6e170dd6f3e3cbd07b

      Download Submit
    • memory/2932-1-0x0000000002C60000-0x0000000002C70000-memory.dmp
      Filesize

      64KB

      Download
    • memory/2932-0-0x0000000002C60000-0x0000000002C70000-memory.dmp
      Filesize

      64KB

      Download
    • memory/2932-2-0x0000000002C60000-0x0000000002C70000-memory.dmp
      Filesize

      64KB

      Download