Analysis
-
max time kernel
75s -
max time network
148s -
platform
windows10_x64 -
resource
win10v200430 -
submitted
09-07-2020 17:13
Static task
static1
Behavioral task
behavioral1
Sample
262a1s0ssssd7da.exe
Resource
win7
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
262a1s0ssssd7da.exe
Resource
win10v200430
0 signatures
0 seconds
General
-
Target
262a1s0ssssd7da.exe
-
Size
717KB
-
MD5
07ce42f25f61cff26f984e17163edb14
-
SHA1
ee189c7c5e1cc3584fe3e4aa5f7ded0afa23b222
-
SHA256
09344b412ef8dbc6b398dd6e3580f482382bd24b672554039668b17a39661b50
-
SHA512
fada769397f97cf32518a9b426a4c16ca99d0a9076d9e4ad6eeed2c3d7fb84edc5198bd5483de6d5d12a495292fab11c9c566283fd71abe66578c2f643b81795
Score
10/10
Malware Config
Extracted
Path
\??\M:\Read_Me.txt
Ransom Note
Attention!
All your files, documents, photos, databases and other important files are encrypted
The only method of recovering files is to purchase an unique decryptor. Only we can give you this decryptor and only we can recover your files.
The server with your decryptor is in a closed network TOR. You can get there by the following ways:
----------------------------------------------------------------------------------------
1. Download Tor browser - https://www.torproject.org/
2. Install Tor browser
3. Open Tor Browser
4. Open link in TOR browser: http://7rzpyw3hflwe2c7h.onion/?JLNOQRTV
5. Follow the instructions on this page
----------------------------------------------------------------------------------------
On our page you will see instructions on payment and get the opportunity to decrypt 1 file for free.
Alternate communication channel here: http://helpqvrg3cc5mvb3.onion/
URLs
http://7rzpyw3hflwe2c7h.onion/?JLNOQRTV
http://helpqvrg3cc5mvb3.onion/
Signatures
-
Suspicious use of SendNotifyMessage 8 IoCs
Processes:
explorer.exepid process 3328 explorer.exe 3328 explorer.exe 3328 explorer.exe 3328 explorer.exe 3328 explorer.exe 3328 explorer.exe 3328 explorer.exe 3328 explorer.exe -
Modifies Installed Components in the registry 2 TTPs 1 IoCs
Processes:
explorer.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-1231583446-2617009595-2137880041-1000\Software\Microsoft\Active Setup\Installed Components explorer.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
262a1s0ssssd7da.exedescription pid process target process PID 2804 wrote to memory of 2388 2804 262a1s0ssssd7da.exe 262a1s0ssssd7da.exe PID 2804 wrote to memory of 2388 2804 262a1s0ssssd7da.exe 262a1s0ssssd7da.exe PID 2804 wrote to memory of 2388 2804 262a1s0ssssd7da.exe 262a1s0ssssd7da.exe PID 2804 wrote to memory of 2496 2804 262a1s0ssssd7da.exe 262a1s0ssssd7da.exe PID 2804 wrote to memory of 2496 2804 262a1s0ssssd7da.exe 262a1s0ssssd7da.exe PID 2804 wrote to memory of 2496 2804 262a1s0ssssd7da.exe 262a1s0ssssd7da.exe PID 2804 wrote to memory of 2496 2804 262a1s0ssssd7da.exe 262a1s0ssssd7da.exe PID 2804 wrote to memory of 2496 2804 262a1s0ssssd7da.exe 262a1s0ssssd7da.exe PID 2804 wrote to memory of 2496 2804 262a1s0ssssd7da.exe 262a1s0ssssd7da.exe PID 2804 wrote to memory of 2496 2804 262a1s0ssssd7da.exe 262a1s0ssssd7da.exe PID 2804 wrote to memory of 2496 2804 262a1s0ssssd7da.exe 262a1s0ssssd7da.exe PID 2804 wrote to memory of 2496 2804 262a1s0ssssd7da.exe 262a1s0ssssd7da.exe -
Suspicious use of AdjustPrivilegeToken 11 IoCs
Processes:
262a1s0ssssd7da.exeexplorer.exedescription pid process Token: SeDebugPrivilege 2804 262a1s0ssssd7da.exe Token: SeShutdownPrivilege 3328 explorer.exe Token: SeCreatePagefilePrivilege 3328 explorer.exe Token: SeShutdownPrivilege 3328 explorer.exe Token: SeCreatePagefilePrivilege 3328 explorer.exe Token: SeShutdownPrivilege 3328 explorer.exe Token: SeCreatePagefilePrivilege 3328 explorer.exe Token: SeShutdownPrivilege 3328 explorer.exe Token: SeCreatePagefilePrivilege 3328 explorer.exe Token: SeShutdownPrivilege 3328 explorer.exe Token: SeCreatePagefilePrivilege 3328 explorer.exe -
Suspicious behavior: EnumeratesProcesses 3025 IoCs
Processes:
262a1s0ssssd7da.exe262a1s0ssssd7da.exepid process 2804 262a1s0ssssd7da.exe 2804 262a1s0ssssd7da.exe 2496 262a1s0ssssd7da.exe 2496 262a1s0ssssd7da.exe 2496 262a1s0ssssd7da.exe 2496 262a1s0ssssd7da.exe 2496 262a1s0ssssd7da.exe 2496 262a1s0ssssd7da.exe 2496 262a1s0ssssd7da.exe 2496 262a1s0ssssd7da.exe 2496 262a1s0ssssd7da.exe 2496 262a1s0ssssd7da.exe 2496 262a1s0ssssd7da.exe 2496 262a1s0ssssd7da.exe 2496 262a1s0ssssd7da.exe 2496 262a1s0ssssd7da.exe 2496 262a1s0ssssd7da.exe 2496 262a1s0ssssd7da.exe 2496 262a1s0ssssd7da.exe 2496 262a1s0ssssd7da.exe 2496 262a1s0ssssd7da.exe 2496 262a1s0ssssd7da.exe 2496 262a1s0ssssd7da.exe 2496 262a1s0ssssd7da.exe 2496 262a1s0ssssd7da.exe 2496 262a1s0ssssd7da.exe 2496 262a1s0ssssd7da.exe 2496 262a1s0ssssd7da.exe 2496 262a1s0ssssd7da.exe 2496 262a1s0ssssd7da.exe 2496 262a1s0ssssd7da.exe 2496 262a1s0ssssd7da.exe 2496 262a1s0ssssd7da.exe 2496 262a1s0ssssd7da.exe 2496 262a1s0ssssd7da.exe 2496 262a1s0ssssd7da.exe 2496 262a1s0ssssd7da.exe 2496 262a1s0ssssd7da.exe 2496 262a1s0ssssd7da.exe 2496 262a1s0ssssd7da.exe 2496 262a1s0ssssd7da.exe 2496 262a1s0ssssd7da.exe 2496 262a1s0ssssd7da.exe 2496 262a1s0ssssd7da.exe 2496 262a1s0ssssd7da.exe 2496 262a1s0ssssd7da.exe 2496 262a1s0ssssd7da.exe 2496 262a1s0ssssd7da.exe 2496 262a1s0ssssd7da.exe 2496 262a1s0ssssd7da.exe 2496 262a1s0ssssd7da.exe 2496 262a1s0ssssd7da.exe 2496 262a1s0ssssd7da.exe 2496 262a1s0ssssd7da.exe 2496 262a1s0ssssd7da.exe 2496 262a1s0ssssd7da.exe 2496 262a1s0ssssd7da.exe 2496 262a1s0ssssd7da.exe 2496 262a1s0ssssd7da.exe 2496 262a1s0ssssd7da.exe 2496 262a1s0ssssd7da.exe 2496 262a1s0ssssd7da.exe 2496 262a1s0ssssd7da.exe 2496 262a1s0ssssd7da.exe -
Suspicious use of FindShellTrayWindow 4 IoCs
Processes:
explorer.exepid process 3328 explorer.exe 3328 explorer.exe 3328 explorer.exe 3328 explorer.exe -
Modifies registry class 5 IoCs
Processes:
explorer.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-1231583446-2617009595-2137880041-1000_Classes\Local Settings explorer.exe Key created \REGISTRY\USER\S-1-5-21-1231583446-2617009595-2137880041-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell explorer.exe Key created \REGISTRY\USER\S-1-5-21-1231583446-2617009595-2137880041-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-1231583446-2617009595-2137880041-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02 explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-1231583446-2617009595-2137880041-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff explorer.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
262a1s0ssssd7da.exedescription pid process target process PID 2804 set thread context of 2496 2804 262a1s0ssssd7da.exe 262a1s0ssssd7da.exe -
Drops file in Program Files directory 8360 IoCs
Processes:
262a1s0ssssd7da.exedescription ioc process File opened for modification C:\Program Files\VideoLAN\VLC\plugins\access\libudp_plugin.dll 262a1s0ssssd7da.exe File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.ZuneVideo_10.16112.11601.0_neutral_resources.scale-200_8wekyb3d8bbwe\AppxBlockMap.xml 262a1s0ssssd7da.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.equinox.launcher.win32.win32.x86_64_1.1.200.v20141007-2033\launcher.win32.win32.x86_64.properties 262a1s0ssssd7da.exe File created C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\visualvm\modules\locale\Read_Me.txt 262a1s0ssssd7da.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\ODBC\Read_Me.txt 262a1s0ssssd7da.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\TRANSLAT\ESEN\MSB1ESEN.ITS 262a1s0ssssd7da.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.3DBuilder_13.0.10349.0_neutral_split.scale-140_8wekyb3d8bbwe\Assets\Office\Rotate.scale-140.png 262a1s0ssssd7da.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\Assets\Catalog\shape_cube.png 262a1s0ssssd7da.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\icons\send-email-16.png 262a1s0ssssd7da.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\QuickStyles\bwcapitalized.dotx 262a1s0ssssd7da.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\LogoImages\WinWordLogo.contrast-white_scale-100.png 262a1s0ssssd7da.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\O365EduCloudEDUR_SubTrial-ppd.xrm-ms 262a1s0ssssd7da.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\profiler\modules\locale\org-netbeans-lib-profiler-ui_zh_CN.jar 262a1s0ssssd7da.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\OFFICE16\api-ms-win-crt-multibyte-l1-1-0.dll 262a1s0ssssd7da.exe File created C:\Program Files\WindowsApps\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\Microsoft.Msn.Shell\Themes\Read_Me.txt 262a1s0ssssd7da.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\modules\org-netbeans-core-multitabs.jar 262a1s0ssssd7da.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\Excel2019R_OEM_Perp-pl.xrm-ms 262a1s0ssssd7da.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\OutlookVL_MAK-pl.xrm-ms 262a1s0ssssd7da.exe File created C:\Program Files\VideoLAN\VLC\hrtfs\Read_Me.txt 262a1s0ssssd7da.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\css\ui-lightness\images\ui-bg_diagonals-thick_18_b81900_40x40.png 262a1s0ssssd7da.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\css\ui-lightness\images\ui-bg_glass_65_ffffff_1x400.png 262a1s0ssssd7da.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.equinox.p2.jarprocessor_1.0.300.v20131211-1531.jar 262a1s0ssssd7da.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\images\winXPBluHandle.png 262a1s0ssssd7da.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\visualvm\modules\com-sun-tools-visualvm-host-remote.jar 262a1s0ssssd7da.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL118.XML 262a1s0ssssd7da.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\System\vccorlib110.dll 262a1s0ssssd7da.exe File opened for modification C:\Program Files\Windows Defender\DbgHelp.dll 262a1s0ssssd7da.exe File created C:\Program Files\WindowsApps\Microsoft.3DBuilder_13.0.10349.0_neutral_split.scale-180_8wekyb3d8bbwe\Read_Me.txt 262a1s0ssssd7da.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\symbols\symbase.xml 262a1s0ssssd7da.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\AccessR_Trial-ppd.xrm-ms 262a1s0ssssd7da.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ExcelR_Trial-ul-oob.xrm-ms 262a1s0ssssd7da.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\offsymxb.ttf 262a1s0ssssd7da.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\TipRes.dll 262a1s0ssssd7da.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\SATIN\PREVIEW.GIF 262a1s0ssssd7da.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_OEM_Perp2-ppd.xrm-ms 262a1s0ssssd7da.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power Map Excel Add-in\VISUALIZATIONCOMMON.DLL 262a1s0ssssd7da.exe File created C:\Program Files\VideoLAN\VLC\locale\fi\LC_MESSAGES\Read_Me.txt 262a1s0ssssd7da.exe File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.ZuneVideo_10.16112.11601.0_neutral_resources.scale-200_8wekyb3d8bbwe\Assets\contrast-black\WideLogo.scale-200_contrast-black.png 262a1s0ssssd7da.exe File opened for modification C:\Program Files\Common Files\System\msadc\en-US\msdaprsr.dll.mui 262a1s0ssssd7da.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.e4.ui.workbench.renderers.swt.nl_ja_4.4.0.v20140623020002.jar 262a1s0ssssd7da.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentR_Retail-pl.xrm-ms 262a1s0ssssd7da.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\VisioProR_Grace-ul-oob.xrm-ms 262a1s0ssssd7da.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\NAMECONTROLPROXY.DLL 262a1s0ssssd7da.exe File created C:\Program Files\VideoLAN\VLC\locale\es\LC_MESSAGES\Read_Me.txt 262a1s0ssssd7da.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\fr-FR\tipresx.dll.mui 262a1s0ssssd7da.exe File opened for modification C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Corbel.xml 262a1s0ssssd7da.exe File opened for modification C:\Program Files\Internet Explorer\sqmapi.dll 262a1s0ssssd7da.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\modules\locale\org-openide-io_zh_CN.jar 262a1s0ssssd7da.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProjectProO365R_Subscription-ul-oob.xrm-ms 262a1s0ssssd7da.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusinessEntryR_PrepidBypass-ppd.xrm-ms 262a1s0ssssd7da.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Client.Models.dll 262a1s0ssssd7da.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\control\libhotkeys_plugin.dll 262a1s0ssssd7da.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\icons\console_view.png 262a1s0ssssd7da.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ExcelVL_MAK-ul-phn.xrm-ms 262a1s0ssssd7da.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdR_OEM_Perp-ppd.xrm-ms 262a1s0ssssd7da.exe File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsMaps_5.1611.10393.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Car\RTL\contrast-white\MedTile.scale-125.png 262a1s0ssssd7da.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\Assets\Office\EmbossText.scale-100.png 262a1s0ssssd7da.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\ipsplk.xml 262a1s0ssssd7da.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\codec\libavcodec_plugin.dll 262a1s0ssssd7da.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\ECLIPSE\PREVIEW.GIF 262a1s0ssssd7da.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\STUDIO\THMBNAIL.PNG 262a1s0ssssd7da.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\requests\browse.json 262a1s0ssssd7da.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProjectProCO365R_Subscription-ul-oob.xrm-ms 262a1s0ssssd7da.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremDemoR_BypassTrial365-ppd.xrm-ms 262a1s0ssssd7da.exe -
Drops desktop.ini file(s) 3 IoCs
Processes:
262a1s0ssssd7da.exedescription ioc process File opened for modification C:\Program Files\Common Files\microsoft shared\Stationery\Desktop.ini 262a1s0ssssd7da.exe File opened for modification C:\Program Files\desktop.ini 262a1s0ssssd7da.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\DataServices\DESKTOP.INI 262a1s0ssssd7da.exe -
Enumerates connected drives 3 TTPs
Processes
-
C:\Users\Admin\AppData\Local\Temp\262a1s0ssssd7da.exe"C:\Users\Admin\AppData\Local\Temp\262a1s0ssssd7da.exe"1⤵
- Suspicious use of WriteProcessMemory
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Local\Temp\262a1s0ssssd7da.exe"{path}"2⤵
-
C:\Users\Admin\AppData\Local\Temp\262a1s0ssssd7da.exe"{path}"2⤵
- Suspicious behavior: EnumeratesProcesses
- Drops file in Program Files directory
- Drops desktop.ini file(s)
-
C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service1⤵
-
C:\Windows\explorer.exeexplorer.exe1⤵
- Suspicious use of SendNotifyMessage
- Modifies Installed Components in the registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Modifies registry class