Analysis
-
max time kernel
82s -
max time network
151s -
platform
windows7_x64 -
resource
win7v200430 -
submitted
11/05/2020, 15:26
Static task
static1
Behavioral task
behavioral1
Sample
go.exe
Resource
win7v200430
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
go.exe
Resource
win10v200430
windows10_x64
0 signatures
0 seconds
General
-
Target
go.exe
-
Size
2.5MB
-
MD5
f7508239b937b2427649be8f77718f60
-
SHA1
ae85ece228d81f1b4cc8203bab4a8a2e45c2dc05
-
SHA256
fa7465ff52d0725c0ce446ca4f1686a3912c5117e7e37d87c5c4c013ec629599
-
SHA512
005a8cb1408d1049cf7926309bc7bf17689588b8804defd99dbfced6c36795faab4559320dc71d59f5259c7858bdb032d88c83c56f6cde2e9d9f0d28f8f1a66f
Score
10/10
Malware Config
Extracted
Path
C:\Users\Admin\Desktop\LEEME.txt
Family
hackransom
Ransom Note
Todos tus archivos han sido encriptados con un Ransomware.
No te preocupes que no has perdido tus archivos aun.
Solicita la clave de descifrado a la persona que te suministro este archivo.
.
Signatures
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1912 IEXPLORE.EXE -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Checks whether UAC is enabled 2 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA iexplore.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA IEXPLORE.EXE -
Opens file in notepad (likely ransom note) 1 IoCs
pid Process 1784 NOTEPAD.EXE -
Suspicious use of WriteProcessMemory 16 IoCs
description pid Process procid_target PID 804 wrote to memory of 1048 804 go.exe 24 PID 804 wrote to memory of 1048 804 go.exe 24 PID 804 wrote to memory of 1048 804 go.exe 24 PID 1048 wrote to memory of 384 1048 rundll32.exe 25 PID 1048 wrote to memory of 384 1048 rundll32.exe 25 PID 1048 wrote to memory of 384 1048 rundll32.exe 25 PID 804 wrote to memory of 1684 804 go.exe 27 PID 804 wrote to memory of 1684 804 go.exe 27 PID 804 wrote to memory of 1684 804 go.exe 27 PID 1684 wrote to memory of 1784 1684 rundll32.exe 28 PID 1684 wrote to memory of 1784 1684 rundll32.exe 28 PID 1684 wrote to memory of 1784 1684 rundll32.exe 28 PID 384 wrote to memory of 1912 384 iexplore.exe 30 PID 384 wrote to memory of 1912 384 iexplore.exe 30 PID 384 wrote to memory of 1912 384 iexplore.exe 30 PID 384 wrote to memory of 1912 384 iexplore.exe 30 -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 384 iexplore.exe 384 iexplore.exe 1912 IEXPLORE.EXE 1912 IEXPLORE.EXE 1912 IEXPLORE.EXE 1912 IEXPLORE.EXE -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 384 iexplore.exe -
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000\Software\Microsoft\Internet Explorer\DOMStorage\google.com\Total = "51" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.google.com IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000\Software\Microsoft\Internet Explorer\DOMStorage\google.com\Total = "6" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "295982984" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 8035ab5eb927d601 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.google.com\ = "6" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Key created \REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000\Software\Microsoft\Internet Explorer\DOMStorage\google.com IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000\Software\Microsoft\Internet Explorer\International\CpMRU IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "51" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000\Software\Microsoft\Internet Explorer\DOMStorage IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000007cf8d5bd09b0364592b95b96ab3123880000000002000000000010660000000100002000000019b7876df85533ac22781002d5a80abb4109427b5df3dd7a7bc02889986cdc98000000000e800000000200002000000047c9d833729aca9f354101ade088cf9120b87aa77cbd3f442e01da932d1ddf649000000037732f37354258f65a19b161637e088187c493a56d3952bdc154bf280139685d7dc179d88f99d8ac65b9f1f5da227aa8d69c51f6516c2e94037e54e905ff4912ced6682909de8b97c855d781039f4419d2d7083fecb2da1590bd60beb302c84a3e19a1b8861b724c82b16203f3324e7bd32ae886b898e561431312be0f760b721638a7002c22cfb91b82b64185a3d1754000000013aa0e061dd16b5dbcddfa531329e445777bfec6f93eb126c63cc8db02701409a20d626595b8499ad7cb18450177038e86f01b0f458e95b38685fd31e7b5452d iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000\Software\Microsoft\Internet Explorer\DOMStorage\google.com\Total = "0" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.google.com\ = "51" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{95E331B1-93AC-11EA-98F9-566D9AB75D33} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "0" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000\Software\Microsoft\Internet Explorer\DOMStorage\google.com\NumberOfSubdomains = "1" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "6" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000007cf8d5bd09b0364592b95b96ab31238800000000020000000000106600000001000020000000a88a58cd2ea074539c2c9f994b60b04429350fa23461c197f4eff58f3a8db501000000000e8000000002000020000000b7246494a0f518a430a3c05760ad5755549d753654c24fc5237b3ea7328722d320000000e14a12b7cee89221bf0d56eebf5a3fa1352aefba927548fab7a91ac1046aa46a40000000c46d0413cb117b543ea1f80310e4a68e07eec847ea58542b7524a75e5108356260be6df1d551473331f9ca80b01106663c0b102f8b1ce0cb093f22103e89b5dd iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.google.com\ = "0" IEXPLORE.EXE -
HaCk Ransomware
GoLang ransomware which targets Spanish users.
Processes
-
C:\Users\Admin\AppData\Local\Temp\go.exe"C:\Users\Admin\AppData\Local\Temp\go.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:804 -
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe url.dll,FileProtocolHandler https://google.com/2⤵
- Suspicious use of WriteProcessMemory
PID:1048 -
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" https://google.com/3⤵
- Checks whether UAC is enabled
- Suspicious use of WriteProcessMemory
- Suspicious use of SetWindowsHookEx
- Suspicious use of FindShellTrayWindow
- Modifies Internet Explorer settings
PID:384 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:384 CREDAT:275457 /prefetch:24⤵
- Suspicious behavior: GetForegroundWindowSpam
- Checks whether UAC is enabled
- Suspicious use of SetWindowsHookEx
- Modifies Internet Explorer settings
PID:1912
-
-
-
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe url.dll,FileProtocolHandler C:\Users\Admin/Desktop/LEEME.txt2⤵
- Suspicious use of WriteProcessMemory
PID:1684 -
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\LEEME.txt3⤵
- Opens file in notepad (likely ransom note)
PID:1784
-
-