Overview

overview

10

Static

static

b8a190a823...8b.exe

windows7_x64

10

b8a190a823...8b.exe

windows10_x64

10

Analysis

  • max time kernel
    127s
  • max time network
    104s
  • platform
    windows7_x64
  • resource
    win7
  • submitted
    22/06/2020, 15:05

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    b8a190a82389771c1862e35fde67018b.exe

  • Size

    344KB

  • MD5

    b8a190a82389771c1862e35fde67018b

  • SHA1

    fabf3ebc2cf571224e9aae55ecad911873a1a983

  • SHA256

    14599971350afb71e8cb46c8bbb082c9e472db578b1ede02ecbc559d777bdfbb

  • SHA512

    73d4c10b3c795f6d185bb96fc8a675089fcf7f0d39fb724cb3493e0da3915d25892862b52c8b3b52f3fbb244c7f7a69d4f5a1b5b042af99c72b6754eb51bc32e

Score
10/10
ransomwarespywarepersistence

Malware Config

Extracted

Path

C:\$Recycle.Bin\S-1-5-21-1131729243-447456001-3632642222-1000\{RecOveR}-ulcfw__.Txt

Ransom Note
>5&=8%4%=5>3$$.=1"50<0!4>:/ 0%9 >5&=8%4%=5>3$$.=1"50<0!4>:/ 0%9 >5&=8%4%=5>3$$.=1"50<0!4>:/ 0%9 >5&=8%4%=5>3$$.=1"50<0!4>:/ 0%9 NOT YOUR LANGUAGE? USE https://translate.google.com What's the matter with your files? Your data was secured using a strong encryption with RSA4096. Use the link down below to find additional information on the encryption keys using RSA-4096 https://en.wikipedia.org/wiki/RSA_(cryptosystem) What exactly that means? >5&=8%4%=5>3$$.=1"50<0!4>:/ 0%9 >5&=8%4%=5>3$$.=1"50<0!4>:/ 0%9 It means that on a structural level your files have been transformed . You won't be able to use , read , see or work with them anymore . In other words they are useless , however , there is a possibility to restore them with our help . What exactly happened to your files ??? *** Two personal RSA-4096 keys were generated for your PC/Laptop; one key is public, another key is private. *** All your data and files were encrypted by the means of the public key , which you received over the web . *** In order to decrypt your data and gain access to your computer you need a private key and a decryption software, which can be found on one of our secret servers. >5&=8%4%=5>3$$.=1"50<0!4>:/ 0%9 >5&=8%4%=5>3$$.=1"50<0!4>:/ 0%9 What should you do next ? There are several options for you to consider : *** You can wait for a while until the price of a private key will raise, so you will have to pay twice as much to access your files or *** You can start getting BitCoins right now and get access to your data quite fast . In case you have valuable files , we advise you to act fast as there is no other option rather than paying in order to get back your data. In order to obtain specific instructions , please access your personal homepage by choosing one of the few addresses down below : http://h3ds4.maconslab.com/E26FE11FAF29756F http://aq3ef.goimocoa.at/E26FE11FAF29756F http://fl43s.toabolt.at/E26FE11FAF29756F If you can't access your personal homepage or the addresses are not working, complete the following steps: *** Download TOR Browser - http://www.torproject.org/projects/torbrowser.html.en *** Install TOR Browser and open TOR Browser *** Insert the following link in the address bar: xzjvzkgjxebzreap.onion/E26FE11FAF29756F >5&=8%4%=5>3$$.=1"50<0!4>:/ 0%9 >5&=8%4%=5>3$$.=1"50<0!4>:/ 0%9 >5&=8%4%=5>3$$.=1"50<0!4>:/ 0%9 ***************IMPORTANT*****************INFORMATION******************** Your personal homepages http://h3ds4.maconslab.com/E26FE11FAF29756F http://aq3ef.goimocoa.at/E26FE11FAF29756F http://fl43s.toabolt.at/E26FE11FAF29756F Your personal homepage Tor-Browser xzjvzkgjxebzreap.onion/E26FE11FAF29756F Your personal ID E26FE11FAF29756F >5&=8%4%=5>3$$.=1"50<0!4>:/ 0%9 >5&=8%4%=5>3$$.=1"50<0!4>:/ 0%9 >5&=8%4%=5>3$$.=1"50<0!4>:/ 0%9
URLs

http://h3ds4.maconslab.com/E26FE11FAF29756F

http://aq3ef.goimocoa.at/E26FE11FAF29756F

http://fl43s.toabolt.at/E26FE11FAF29756F

http://xzjvzkgjxebzreap.onion/E26FE11FAF29756F

Signatures

  • Drops file in Program Files directory 4335 IoCs
  • Modifies Internet Explorer settings 1 TTPs 31 IoCs
    adwarespyware
  • Suspicious behavior: EnumeratesProcesses 936 IoCs
  • Drops startup file 6 IoCs
  • Checks whether UAC is enabled 2 IoCs
  • Loads dropped DLL 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 84 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spyware
  • Deletes shadow copies 2 TTPs

    Ransomware often targets backup files to inhibit system recovery.

    ransomware
  • Modifies service 2 TTPs 5 IoCs
    persistence
  • Adds Run entry to start application 2 TTPs 2 IoCs
    persistence
  • Suspicious use of WriteProcessMemory 28 IoCs
  • Executes dropped EXE 1 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs
  • System policy modification 1 TTPs 2 IoCs
    evasion

Processes

  • C:\Users\Admin\AppData\Local\Temp\b8a190a82389771c1862e35fde67018b.exe
    "C:\Users\Admin\AppData\Local\Temp\b8a190a82389771c1862e35fde67018b.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:1124
    • C:\Users\Admin\AppData\Roaming\wsmprovhost.exe
      C:\Users\Admin\AppData\Roaming\wsmprovhost.exe
      2⤵
      • Drops file in Program Files directory
      • Suspicious behavior: EnumeratesProcesses
      • Drops startup file
      • Suspicious use of AdjustPrivilegeToken
      • Adds Run entry to start application
      • Suspicious use of WriteProcessMemory
      • Executes dropped EXE
      • System policy modification
      PID:1108
      • C:\Windows\System32\wbem\WMIC.exe
        "C:\Windows\System32\wbem\WMIC.exe" shadowcopy delete /nointeractive
        3⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:1620
      • C:\Windows\SysWOW64\NOTEPAD.EXE
        "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\{RecOveR}-ulcfw__.Txt
        3⤵
          PID:220
        • C:\Program Files\Internet Explorer\iexplore.exe
          "C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\Desktop\{RecOveR}-ulcfw__.Htm
          3⤵
          • Modifies Internet Explorer settings
          • Checks whether UAC is enabled
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of WriteProcessMemory
          • Suspicious use of SetWindowsHookEx
          PID:1932
          • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
            "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1932 CREDAT:275457 /prefetch:2
            4⤵
            • Modifies Internet Explorer settings
            • Checks whether UAC is enabled
            • Suspicious use of SetWindowsHookEx
            PID:1888
        • C:\Windows\System32\wbem\WMIC.exe
          "C:\Windows\System32\wbem\WMIC.exe" shadowcopy delete /nointeractive
          3⤵
          • Suspicious use of AdjustPrivilegeToken
          PID:1392
        • C:\Windows\SysWOW64\cmd.exe
          "C:\Windows\system32\cmd.exe" /c DEL C:\Users\Admin\AppData\Roaming\WSMPRO~1.EXE >> NUL
          3⤵
            PID:1000
        • C:\Windows\SysWOW64\cmd.exe
          "C:\Windows\system32\cmd.exe" /c DEL C:\Users\Admin\AppData\Local\Temp\B8A190~1.EXE >> NUL
          2⤵
            PID:1428
        • C:\Windows\system32\vssvc.exe
          C:\Windows\system32\vssvc.exe
          1⤵
          • Suspicious use of AdjustPrivilegeToken
          • Modifies service
          PID:1100
        • C:\Windows\SysWOW64\DllHost.exe
          C:\Windows\SysWOW64\DllHost.exe /Processid:{76D0CB12-7604-4048-B83C-1005C7DDC503}
          1⤵
          • Suspicious use of FindShellTrayWindow
          PID:1848

        Network

        MITRE ATT&CK Enterprise v6

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • memory/1108-13-0x0000000002CD0000-0x0000000002CE1000-memory.dmp

          Filesize

          68KB

          Download

        • memory/1108-147-0x0000000002CD0000-0x0000000002CE1000-memory.dmp

          Filesize

          68KB

          Download

        • memory/1108-12-0x0000000002CD0000-0x0000000002CE1000-memory.dmp

          Filesize

          68KB

          Download

        • memory/1108-9-0x0000000002CD0000-0x0000000002CE1000-memory.dmp

          Filesize

          68KB

          Download

        • memory/1108-14-0x0000000002CD0000-0x0000000002CE1000-memory.dmp

          Filesize

          68KB

          Download

        • memory/1108-15-0x0000000002CD0000-0x0000000002CE1000-memory.dmp

          Filesize

          68KB

          Download

        • memory/1108-72-0x0000000002CD0000-0x0000000002CE1000-memory.dmp

          Filesize

          68KB

          Download

        • memory/1108-8-0x0000000002CD0000-0x0000000002CE1000-memory.dmp

          Filesize

          68KB

          Download

        • memory/1108-5-0x0000000002CD0000-0x0000000002CE1000-memory.dmp

          Filesize

          68KB

          Download

        • memory/1108-6-0x00000000030E0000-0x00000000030F1000-memory.dmp

          Filesize

          68KB

          Download

        • memory/1108-7-0x0000000002CD0000-0x0000000002CE1000-memory.dmp

          Filesize

          68KB

          Download