Overview

overview

10

Static

static

167a1s0ssssd7da.exe

windows7_x64

10

167a1s0ssssd7da.exe

windows10_x64

10

Analysis

  • max time kernel
    92s
  • max time network
    96s
  • platform
    windows10_x64
  • resource
    win10v200430
  • submitted
    09/07/2020, 17:18

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    167a1s0ssssd7da.exe
  • Size 717KB
  • Sample200709-c8b66t5den
  • SHA256 0837d362bdddd62f2ecafa411a7b97715dda386a5cdf7723d686687b9a1c776c
  • MD5 SHA1 SHA512
Score
10/10
ransomwarepersistenceevasiontrojan

Malware Config

Extracted

Path

  • \??\M:\Read_Me.txt

Ransom Note
  • Attention! All your files, documents, photos, databases and other important files are encrypted The only method of recovering files is to purchase an unique decryptor. Only we can give you this decryptor and only we can recover your files. The server with your decryptor is in a closed network TOR. You can get there by the following ways: ---------------------------------------------------------------------------------------- 1. Download Tor browser - https://www.torproject.org/ 2. Install Tor browser 3. Open Tor Browser 4. Open link in TOR browser: http://7rzpyw3hflwe2c7h.onion/?ZRSUVXZA 5. Follow the instructions on this page ---------------------------------------------------------------------------------------- On our page you will see instructions on payment and get the opportunity to decrypt 1 file for free. Alternate communication channel here: http://helpqvrg3cc5mvb3.onion/
URLs

  • http://7rzpyw3hflwe2c7h.onion/?ZRSUVXZA

  • http://helpqvrg3cc5mvb3.onion/

Signatures

  • Suspicious use of FindShellTrayWindow 44 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Drops file in Program Files directory 7206 IoCs
  • Suspicious behavior: EnumeratesProcesses 1054 IoCs
  • Modifies Installed Components in the registry 2 TTPs 1 IoCs
    persistence
  • Modifies control panel 5 IoCs
    evasion
  • Enumerates system info in registry 2 TTPs 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 39 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Suspicious use of SendNotifyMessage 23 IoCs
  • Modifies registry class 8 IoCs
  • Checks SCSI registry key(s) 3 TTPs 12 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Drops desktop.ini file(s) 4 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs
  • Enumerates connected drives 3 TTPs
  • Checks whether UAC is enabled 1 TTPs 1 IoCs
    evasiontrojan

Processes

  • C:\Users\Admin\AppData\Local\Temp\167a1s0ssssd7da.exe
    "C:\Users\Admin\AppData\Local\Temp\167a1s0ssssd7da.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:1136
    • C:\Users\Admin\AppData\Local\Temp\167a1s0ssssd7da.exe
      "{path}"
      2⤵
        PID:2388
      • C:\Users\Admin\AppData\Local\Temp\167a1s0ssssd7da.exe
        "{path}"
        2⤵
        • Drops file in Program Files directory
        • Suspicious behavior: EnumeratesProcesses
        • Drops desktop.ini file(s)
        PID:2496
    • C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe
      "C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service
      1⤵
        PID:3084
      • C:\Windows\explorer.exe
        explorer.exe
        1⤵
        • Suspicious use of FindShellTrayWindow
        • Modifies Installed Components in the registry
        • Modifies control panel
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of SendNotifyMessage
        • Modifies registry class
        • Checks SCSI registry key(s)
        • Drops desktop.ini file(s)
        • Checks whether UAC is enabled
        PID:2964
      • C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe
        "C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe" -ServerName:App.AppXtk181tbxbce2qsex02s8tw7hfxa9xb3t.mca
        1⤵
        • Suspicious use of SetWindowsHookEx
        • Modifies control panel
        PID:1556
      • C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe
        "C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe" -ServerName:CortanaUI.AppXa50dqqa5gqv4a428c9y1jjw7m3btvepj.mca
        1⤵
        • Suspicious use of SetWindowsHookEx
        • Modifies control panel
        • Enumerates system info in registry
        PID:3772

      Network

            MITRE ATT&CK Enterprise v6

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            memory/2496-0-0x0000000000400000-0x000000000041E000-memory.dmp
            Download

            memory/2496-2-0x0000000000400000-0x000000000041E000-memory.dmp
            Download

            memory/2964-3-0x0000000009120000-0x0000000009221000-memory.dmp
            Download