Overview

overview

10

Static

static

ransom.bin.exe

windows7_x64

10

ransom.bin.exe

windows10_x64

10

Analysis

  • max time kernel
    150s
  • max time network
    144s
  • platform
    windows10_x64
  • resource
    win10v200430
  • submitted
    31/05/2020, 11:49

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    ransom.bin.exe

  • Size

    82KB

  • MD5

    50a8eaf7e9aacf554862a4dd4a44f70f

  • SHA1

    81fce02871932bbc6811fb955471ff90b5f29190

  • SHA256

    adc2f5649973f922dc8294df91c63303870178c8a6839c1a9e8c9e4c4516bfd0

  • SHA512

    416e15f6dc1e25c867011a90645775c6a30add95578082b19950641e28a22bd8c049b5f8c02d5d7514e6b5db0e646e91995b09ea3a58ab7bce9726e60a9f2cf4

Score
10/10
ransomwarepersistence

Malware Config

Extracted

Path

C:\Users\Admin\ReadMe.txt

Ransom Note
What happend for my computer? All your files are encrypted due a security issue in your computer. What should i do? You have 48 hours to email us.Otherwise, the decryption price will increase or become impossible. Your email must contain your unique id and the unique key. your unique id is 949CEBC7 your unique key is SLBbNILq7LG+MNH/A/FvB34mMLoaUmcUIQDn/vlLvZtFDLiyRhFUZjM6AhgkyT7TuwFQBz75OCqXBOx5xcr+sfgCTmGtVGKoAfUFMkmn/j670b6RZWhMWwiyp33BTA58h3aRX6p4ae0D1dSuM9UF8cWmp+p3icjfB1vD6+dJQm3E8cefyJz+VvgNSaLYQarI+7PpiugFsvi0KnPHQuw4+rWu2+11kz0hI2/vSacDCkaCOu9vDB9379rTIRDZ+5EAmdqBU5+8EePwc5+klwnKGPeqKAAuSDvYH9kPC+eSk7/zcT4IWCTKsdIpKfTDfBGTk+fkxYEpNUr2/iwzN2JFUNohLInVF7qveGGZNtATEfG297tXvQz/RxGAFEnVePjS801r67CeaFeAfSH+i9rdOjlA3hPuKqykQ/yPYQpChaDcfKH3R+mFZRAa2Gyt0ii6tQCDuSwFfD80b+6P/yEzazcUm4aAoFdp59+kxDde6K/EwqZ48OPP3HWore9CwDR8J2LVb/9MF+z7ydLO82cODbqBeTOygB/t7DAuWI3ySyGa4CX/nQ78+MVZSsgPEKCco7Sg4Z1g1BMACwRP9lPaFsyyVOA7b+E+hUbIlDdobqSvhPBYmeil5XE9lgxJzwHkIZz/a4lI5ldCzMnTmzT4clWiwrwy1i7aexsIqR3aWkA= Email Address: [email protected] If you didn't recive any response till 24 hours,Send email to this address: [email protected] What is our guarantee? We decrypt two files for you Free to be sure that we are able to recover your files.

Signatures

  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Drops startup file 3 IoCs
  • Deletes shadow copies 2 TTPs

    Ransomware often targets backup files to inhibit system recovery.

    ransomware
  • Interacts with shadow copies 2 TTPs 1 IoCs

    Shadow copies are often targeted by ransomware to inhibit system recovery.

    ransomware
  • Modifies service 2 TTPs 5 IoCs
    persistence
  • Drops file in Program Files directory 6790 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs
  • Drops desktop.ini file(s) 35 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\ransom.bin.exe
    "C:\Users\Admin\AppData\Local\Temp\ransom.bin.exe"
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious behavior: EnumeratesProcesses
    • Drops startup file
    • Drops file in Program Files directory
    • Suspicious use of WriteProcessMemory
    • Drops desktop.ini file(s)
    PID:3988
    • C:\Windows\SYSTEM32\cmd.exe
      "cmd.exe"
      2⤵
        PID:820
        • C:\Windows\system32\netsh.exe
          netsh.exe netsh advfirewall set currentprofile state off
          3⤵
            PID:1004
        • C:\Windows\SYSTEM32\cmd.exe
          "cmd.exe"
          2⤵
            PID:1076
            • C:\Windows\system32\netsh.exe
              netsh.exe netsh firewall set opmode mode=disable
              3⤵
                PID:1200
            • C:\Windows\SYSTEM32\cmd.exe
              "cmd" /C vssadmin Delete Shadows /All /Quiet
              2⤵
                PID:1472
                • C:\Windows\system32\vssadmin.exe
                  vssadmin Delete Shadows /All /Quiet
                  3⤵
                  • Interacts with shadow copies
                  PID:1720
            • C:\Windows\system32\vssvc.exe
              C:\Windows\system32\vssvc.exe
              1⤵
              • Suspicious use of AdjustPrivilegeToken
              • Modifies service
              PID:1912

            Network

            MITRE ATT&CK Enterprise v6

            Replay Monitor

            Loading Replay Monitor...

            Downloads