Overview

overview

10

Static

static

167a1s0ssssd7da.exe

windows7_x64

10

167a1s0ssssd7da.exe

windows10_x64

10

Analysis

  • max time kernel
    92s
  • max time network
    96s
  • platform
    windows10_x64
  • resource
    win10v200430
  • submitted
    09/07/2020, 17:18

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    167a1s0ssssd7da.exe

  • Size

    717KB

  • MD5

    1e62148d865a96d50b93185bc61ad335

  • SHA1

    e3d4d55d2d92e594cee2e1f11779935957521a53

  • SHA256

    0837d362bdddd62f2ecafa411a7b97715dda386a5cdf7723d686687b9a1c776c

  • SHA512

    931caefe454c45cd7f07ce71125b3fd101207c2034370a69ebb1d66208cdff580d49a7041eee9a91f64766003dae99cc423d1312109bdefe5de3bec85755f280

Score
10/10
ransomwarepersistenceevasiontrojan

Malware Config

Extracted

Path

\??\M:\Read_Me.txt

Ransom Note
Attention! All your files, documents, photos, databases and other important files are encrypted The only method of recovering files is to purchase an unique decryptor. Only we can give you this decryptor and only we can recover your files. The server with your decryptor is in a closed network TOR. You can get there by the following ways: ---------------------------------------------------------------------------------------- 1. Download Tor browser - https://www.torproject.org/ 2. Install Tor browser 3. Open Tor Browser 4. Open link in TOR browser: http://7rzpyw3hflwe2c7h.onion/?ZRSUVXZA 5. Follow the instructions on this page ---------------------------------------------------------------------------------------- On our page you will see instructions on payment and get the opportunity to decrypt 1 file for free. Alternate communication channel here: http://helpqvrg3cc5mvb3.onion/
URLs

http://7rzpyw3hflwe2c7h.onion/?ZRSUVXZA

http://helpqvrg3cc5mvb3.onion/

Signatures

  • Suspicious use of FindShellTrayWindow 44 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Drops file in Program Files directory 7206 IoCs
  • Suspicious behavior: EnumeratesProcesses 1054 IoCs
  • Modifies Installed Components in the registry 2 TTPs 1 IoCs
    persistence
  • Modifies control panel 5 IoCs
    evasion
  • Enumerates system info in registry 2 TTPs 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 39 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Suspicious use of SendNotifyMessage 23 IoCs
  • Modifies registry class 8 IoCs
  • Checks SCSI registry key(s) 3 TTPs 12 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Drops desktop.ini file(s) 4 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs
  • Enumerates connected drives 3 TTPs
  • Checks whether UAC is enabled 1 TTPs 1 IoCs
    evasiontrojan

Processes

  • C:\Users\Admin\AppData\Local\Temp\167a1s0ssssd7da.exe
    "C:\Users\Admin\AppData\Local\Temp\167a1s0ssssd7da.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:1136
    • C:\Users\Admin\AppData\Local\Temp\167a1s0ssssd7da.exe
      "{path}"
      2⤵
        PID:2388
      • C:\Users\Admin\AppData\Local\Temp\167a1s0ssssd7da.exe
        "{path}"
        2⤵
        • Drops file in Program Files directory
        • Suspicious behavior: EnumeratesProcesses
        • Drops desktop.ini file(s)
        PID:2496
    • C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe
      "C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service
      1⤵
        PID:3084
      • C:\Windows\explorer.exe
        explorer.exe
        1⤵
        • Suspicious use of FindShellTrayWindow
        • Modifies Installed Components in the registry
        • Modifies control panel
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of SendNotifyMessage
        • Modifies registry class
        • Checks SCSI registry key(s)
        • Drops desktop.ini file(s)
        • Checks whether UAC is enabled
        PID:2964
      • C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe
        "C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe" -ServerName:App.AppXtk181tbxbce2qsex02s8tw7hfxa9xb3t.mca
        1⤵
        • Suspicious use of SetWindowsHookEx
        • Modifies control panel
        PID:1556
      • C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe
        "C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe" -ServerName:CortanaUI.AppXa50dqqa5gqv4a428c9y1jjw7m3btvepj.mca
        1⤵
        • Suspicious use of SetWindowsHookEx
        • Modifies control panel
        • Enumerates system info in registry
        PID:3772

      Network