Overview

overview

10

Static

static

187a1s0ssssd7da.exe

windows7_x64

10

187a1s0ssssd7da.exe

windows10_x64

10

Analysis

  • max time kernel
    128s
  • max time network
    137s
  • platform
    windows7_x64
  • resource
    win7v200430
  • submitted
    09/07/2020, 17:16

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    187a1s0ssssd7da.exe

  • Size

    717KB

  • MD5

    aaf524a36e19a153c67abe2cea4f1cf8

  • SHA1

    575579051e65006e1ac56206bd440cd9cc9038f1

  • SHA256

    657c48c3e07fed5d334e86e1286ac8289c0269f4f53375e6ce4307fbd59a2f27

  • SHA512

    8d3537bfb957c75092886b483ecea3ed7031e96b6ef4993568d21b3d731de51239c6d80544e76a5b1b984f9d849b9d59d68267bbde19606fa2a2688ec1ba6bbe

Score
10/10
ransomwarepersistencespyware

Malware Config

Extracted

Path

C:\MSOCache\All Users\{90140000-0011-0000-1000-0000000FF1CE}-C\Read_Me.txt

Ransom Note
Attention! All your files, documents, photos, databases and other important files are encrypted The only method of recovering files is to purchase an unique decryptor. Only we can give you this decryptor and only we can recover your files. The server with your decryptor is in a closed network TOR. You can get there by the following ways: ---------------------------------------------------------------------------------------- 1. Download Tor browser - https://www.torproject.org/ 2. Install Tor browser 3. Open Tor Browser 4. Open link in TOR browser: http://7rzpyw3hflwe2c7h.onion/?VVVVVVVV 5. Follow the instructions on this page ---------------------------------------------------------------------------------------- On our page you will see instructions on payment and get the opportunity to decrypt 1 file for free. Alternate communication channel here: http://helpqvrg3cc5mvb3.onion/
URLs

http://7rzpyw3hflwe2c7h.onion/?VVVVVVVV

http://helpqvrg3cc5mvb3.onion/

Signatures

  • Suspicious use of FindShellTrayWindow 84 IoCs
  • Modifies Installed Components in the registry 2 TTPs 4 IoCs
    persistence
  • Modifies service 2 TTPs 6 IoCs
    persistence
  • Drops startup file 1 IoCs
  • Suspicious use of WriteProcessMemory 10 IoCs
  • Suspicious use of AdjustPrivilegeToken 34 IoCs
  • Drops file in Program Files directory 12080 IoCs