Overview

overview

10

Static

static

b2a27c3b5c...e3.exe

windows7_x64

10

b2a27c3b5c...e3.exe

windows10_x64

10

Resubmissions

04-05-2020 15:13

200504-6r5nmgfcka 10

21-04-2020 05:49

200421-nvrsxxs6e6 9

Analysis

  • max time kernel
    144s
  • max time network
    151s
  • platform
    windows10_x64
  • resource
    win10v200430
  • submitted
    04-05-2020 15:13

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    b2a27c3b5c301b22260722383a889d491431e4909e4a0bf810840ba882cbbce3.exe

  • Size

    12KB

  • MD5

    4a7378c7ef7a9b72aa2b38019aa6fcdc

  • SHA1

    7e19a75d8a91fa2e4e6e7519609eb8c300a8a030

  • SHA256

    b2a27c3b5c301b22260722383a889d491431e4909e4a0bf810840ba882cbbce3

  • SHA512

    8eb4cfcd03315f5984ee6909cd33b3086227e610d78d24dd32525a421a92b440fe012f2b5403dbc10be8db875fa5db83731786578395fef44dde8394ec219441

Score
10/10
ransomwareevasiongarrantydecryptspywarepersistence

Malware Config

Extracted

Path

C:\$Recycle.Bin\S-1-5-21-1231583446-2617009595-2137880041-1000\!read_me!.txt

Family

garrantydecrypt

Ransom Note
Do you want to return your files? Write to our email: azor2020@protonmail.ch azor@rape.lol Or contact us via jabber azor2020@jxmpp.jp Jabber (Pidgin) client installation instructions, you can find on youtube https://www.youtube.com/results?search_query=pidgin+jabber+install ICQ: @azor2020 !!!Any of your attempts to return files will result in complete loss of the database!!! tell your unique ID RB3Vw6N+wzycFELtbbqS0OibTLenhMcPyO+m/uLNleUf6iUSAs4RytgBeU2goZiIl74gHPg0QBTJFOnmWMJ69lGa7vwJPdk5Q6kfMWsmURe6dYEnlF36Zmxg22CGQRZho064AQn5TZ1k8Q3UQuhLWwRdQxdJ2IJYmEviG9NQR0qwZ8oGYbI1Ys7KCURQP5daiW54OjyZ3TgJ9bW5GYw7MoYiAFcrme+0TRx+mxncJQXM4cdwiElMuXXkSbDxdo5OYGTPuWa20AmPwwN+2VoUrQ/NQqUw9Cqsxy597TMZpOwMYQ8Wq6liSo+6XuS1NmCh5yrnp2sujNsxbMsLS1lhvEiYxJ1Sjh2+WXi8UYCcOIKwGO0nve70NtTIiE5NEAEry81wmnfZn3B24tVzlZwiG79TYC6FiPlG3qA0njuMeYLdx7mLyGEVCpwv2bPUVJ4UQF+taqh33e1TT/99AIE4ZqG9q5CxQX76b31t3GMZBJoubwry85DIirqQstSZLZznHJUGUC+nW7OrGxvcCVvng9fnYFlQkNq58+Kk5QBp51Xt8lqVM/AKonU8QFUoCaNft1x1mK1b7x5vNJ/rmW2ktQmjGMylVhvoDi7awSA8k1+Zqt0rMorXWnPenxs+cqy9pynhBflqkYS0HEu9CsoEPl04bitbarPhf/WkP95Du5hWKS9L3UxFGS25aDXiUG8t4lZuDGAHi0juNQM+Xjo2xT7kL8H2pN5ta59tqB5Il3U0i2eGIafoPe35/9c2LdFXgkDvFFfuiXrvSvJ7TDBBKaKVtsyM5NsbnoYsIJDUCTQNjDA8lh3DOnkVLcODSKrmG/98zd9oN7kKk8bBJapbsAuHe0cMP70o60UWTubPc14VFogKZdJVwASrDB2jei0jV4+Q7Xn+86Ug3KdYqvInZ33W1ONK0LfeilkMea5Gi/BGcauXUt19lX/hV+kulmYnVvHeJJL7f/5GgWrTz4u89gjvUP4iY/DdbXOx6LM6eLmbT7jVQip+TFMy/FiNybolAR0UfbaSRHGYS6lDqdLMNkRuXQKKs1fDPRBmFZ+jGKF7/4I1LQkotACEOOKNcSEtDqiTdWL4v7tsHHLr/GpNLJDfa8EDrxz2edBbK4BIxxp1ttLpbHU6KnONA+2Hd0cTo0wNYk/fw+Ydl0QU0EDxnJ49JQCxBzf7MALZkGkp9miAlBjfE69PhV+w719z2uHHgivbah0L0Za7M0dtq7wvVDEocPjyUB/g5qeyKdMc4rsjNNKw7FNPGu2pRVSRssoPQJMruDWlCR+NntgACp5ntadHjLifdorOC10JhxaaKVr/v9F2cMrtnWU+Z405mj9fMtW2A2KFDHPpCF3odPbsgQ==
Emails

azor2020@protonmail.ch

azor@rape.lol

azor2020@jxmpp.jp

Signatures

  • Modifies boot configuration data using bcdedit 1 TTPs 2 IoCs
    ransomwareevasion
  • Modifies service 2 TTPs 5 IoCs
    persistence
  • Modifies Windows Firewall 1 TTPs
    evasion
  • Suspicious use of WriteProcessMemory 14 IoCs
  • GarrantyDecrypt

    Ransomware family first detected in late 2018.

    ransomwaregarrantydecrypt
  • Deletes shadow copies 2 TTPs

    Ransomware often targets backup files to inhibit system recovery.

    ransomware
  • Drops file in Program Files directory 22537 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Sets desktop wallpaper using registry 2 TTPs 1 IoCs
    ransomware
  • Delays execution with timeout.exe 1 IoCs
    evasion
  • Drops desktop.ini file(s) 33 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spyware
  • Drops startup file 1 IoCs
  • Interacts with shadow copies 2 TTPs 1 IoCs

    Shadow copies are often targeted by ransomware to inhibit system recovery.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\b2a27c3b5c301b22260722383a889d491431e4909e4a0bf810840ba882cbbce3.exe
    "C:\Users\Admin\AppData\Local\Temp\b2a27c3b5c301b22260722383a889d491431e4909e4a0bf810840ba882cbbce3.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    • Drops file in Program Files directory
    • Sets desktop wallpaper using registry
    • Drops desktop.ini file(s)
    • Suspicious behavior: EnumeratesProcesses
    • Drops startup file
    PID:1356
    • C:\Windows\System32\vssadmin.exe
      delete shadows /all /quiet
      2⤵
      • Interacts with shadow copies
      PID:1504
    • C:\Windows\System32\cmd.exe
      "C:\Windows\sysnative\cmd.exe" /c bcdedit /set {current} bootstatuspolicy ignoreallfailures
      2⤵
        PID:2464
        • C:\Windows\system32\bcdedit.exe
          bcdedit /set {current} bootstatuspolicy ignoreallfailures
          3⤵
          • Modifies boot configuration data using bcdedit
          PID:3020
      • C:\Windows\System32\cmd.exe
        "C:\Windows\sysnative\cmd.exe" /c bcdedit /set {current} recoveryenabled no
        2⤵
          PID:2604
          • C:\Windows\system32\bcdedit.exe
            bcdedit /set {current} recoveryenabled no
            3⤵
            • Modifies boot configuration data using bcdedit
            PID:3184
        • C:\Windows\System32\cmd.exe
          "C:\Windows\sysnative\cmd.exe" /c netsh advfirewall set allprofiles state off
          2⤵
            PID:2676
            • C:\Windows\system32\netsh.exe
              netsh advfirewall set allprofiles state off
              3⤵
                PID:3972
            • C:\Windows\SysWOW64\cmd.exe
              "C:\Windows\system32\cmd.exe" /c timeout 1 && del "C:\Users\Admin\AppData\Local\Temp\b2a27c3b5c301b22260722383a889d491431e4909e4a0bf810840ba882cbbce3.exe" >> NUL
              2⤵
              • Suspicious use of WriteProcessMemory
              PID:3788
              • C:\Windows\SysWOW64\timeout.exe
                timeout 1
                3⤵
                • Delays execution with timeout.exe
                PID:252
          • C:\Windows\system32\vssvc.exe
            C:\Windows\system32\vssvc.exe
            1⤵
            • Modifies service
            • Suspicious use of AdjustPrivilegeToken
            PID:1816

          Network

          MITRE ATT&CK Matrix ATT&CK v6

          Initial Access

          Execution

          Persistence

          Modify Existing Service

          2
          T1031

          Privilege Escalation

          Defense Evasion

          Modify Registry

          2
          T1112

          File Deletion

          2
          T1107

          Credential Access

          Credentials in Files

          1
          T1081

          Discovery

          Lateral Movement

          Collection

          Data from Local System

          1
          T1005

          Exfiltration

          Command and Control

          Impact

          Inhibit System Recovery

          3
          T1490

          Defacement

          1
          T1491

          Replay Monitor

          Loading Replay Monitor...

          Downloads