Analysis
-
max time kernel
98s -
max time network
153s -
platform
windows10_x64 -
resource
win10v200430 -
submitted
09-07-2020 17:16
Static task
static1
Behavioral task
behavioral1
Sample
703a1s0ssssd7da.exe
Resource
win7
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
703a1s0ssssd7da.exe
Resource
win10v200430
0 signatures
0 seconds
General
-
Target
703a1s0ssssd7da.exe
-
Size
717KB
-
MD5
83f6e8129fd4917311956264f46971f0
-
SHA1
183757c527e8f213be0c1397f40b6cd3979c854c
-
SHA256
a7add0057b62fd19144486d1933b3a68331aebab989192d3f32e5c85f07b8590
-
SHA512
1a31f54a50f6d09765ca1be1c39ac1d6a200e8564926155eab7249407e48029aba312976ccc09328679cf9b0629f7af0448af98ecea6ee0c3c68fc24905bb7d8
Score
10/10
Malware Config
Extracted
Path
\??\M:\Read_Me.txt
Ransom Note
Attention!
All your files, documents, photos, databases and other important files are encrypted
The only method of recovering files is to purchase an unique decryptor. Only we can give you this decryptor and only we can recover your files.
The server with your decryptor is in a closed network TOR. You can get there by the following ways:
----------------------------------------------------------------------------------------
1. Download Tor browser - https://www.torproject.org/
2. Install Tor browser
3. Open Tor Browser
4. Open link in TOR browser: http://7rzpyw3hflwe2c7h.onion/?XOQRTVWY
5. Follow the instructions on this page
----------------------------------------------------------------------------------------
On our page you will see instructions on payment and get the opportunity to decrypt 1 file for free.
Alternate communication channel here: http://helpqvrg3cc5mvb3.onion/
URLs
http://7rzpyw3hflwe2c7h.onion/?XOQRTVWY
http://helpqvrg3cc5mvb3.onion/
Signatures
-
Suspicious use of WriteProcessMemory 9 IoCs
Processes:
703a1s0ssssd7da.exedescription pid process target process PID 1616 wrote to memory of 2696 1616 703a1s0ssssd7da.exe 703a1s0ssssd7da.exe PID 1616 wrote to memory of 2696 1616 703a1s0ssssd7da.exe 703a1s0ssssd7da.exe PID 1616 wrote to memory of 2696 1616 703a1s0ssssd7da.exe 703a1s0ssssd7da.exe PID 1616 wrote to memory of 2696 1616 703a1s0ssssd7da.exe 703a1s0ssssd7da.exe PID 1616 wrote to memory of 2696 1616 703a1s0ssssd7da.exe 703a1s0ssssd7da.exe PID 1616 wrote to memory of 2696 1616 703a1s0ssssd7da.exe 703a1s0ssssd7da.exe PID 1616 wrote to memory of 2696 1616 703a1s0ssssd7da.exe 703a1s0ssssd7da.exe PID 1616 wrote to memory of 2696 1616 703a1s0ssssd7da.exe 703a1s0ssssd7da.exe PID 1616 wrote to memory of 2696 1616 703a1s0ssssd7da.exe 703a1s0ssssd7da.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
703a1s0ssssd7da.exedescription pid process target process PID 1616 set thread context of 2696 1616 703a1s0ssssd7da.exe 703a1s0ssssd7da.exe -
Suspicious behavior: EnumeratesProcesses 1374 IoCs
Processes:
703a1s0ssssd7da.exepid process 2696 703a1s0ssssd7da.exe 2696 703a1s0ssssd7da.exe 2696 703a1s0ssssd7da.exe 2696 703a1s0ssssd7da.exe 2696 703a1s0ssssd7da.exe 2696 703a1s0ssssd7da.exe 2696 703a1s0ssssd7da.exe 2696 703a1s0ssssd7da.exe 2696 703a1s0ssssd7da.exe 2696 703a1s0ssssd7da.exe 2696 703a1s0ssssd7da.exe 2696 703a1s0ssssd7da.exe 2696 703a1s0ssssd7da.exe 2696 703a1s0ssssd7da.exe 2696 703a1s0ssssd7da.exe 2696 703a1s0ssssd7da.exe 2696 703a1s0ssssd7da.exe 2696 703a1s0ssssd7da.exe 2696 703a1s0ssssd7da.exe 2696 703a1s0ssssd7da.exe 2696 703a1s0ssssd7da.exe 2696 703a1s0ssssd7da.exe 2696 703a1s0ssssd7da.exe 2696 703a1s0ssssd7da.exe 2696 703a1s0ssssd7da.exe 2696 703a1s0ssssd7da.exe 2696 703a1s0ssssd7da.exe 2696 703a1s0ssssd7da.exe 2696 703a1s0ssssd7da.exe 2696 703a1s0ssssd7da.exe 2696 703a1s0ssssd7da.exe 2696 703a1s0ssssd7da.exe 2696 703a1s0ssssd7da.exe 2696 703a1s0ssssd7da.exe 2696 703a1s0ssssd7da.exe 2696 703a1s0ssssd7da.exe 2696 703a1s0ssssd7da.exe 2696 703a1s0ssssd7da.exe 2696 703a1s0ssssd7da.exe 2696 703a1s0ssssd7da.exe 2696 703a1s0ssssd7da.exe 2696 703a1s0ssssd7da.exe 2696 703a1s0ssssd7da.exe 2696 703a1s0ssssd7da.exe 2696 703a1s0ssssd7da.exe 2696 703a1s0ssssd7da.exe 2696 703a1s0ssssd7da.exe 2696 703a1s0ssssd7da.exe 2696 703a1s0ssssd7da.exe 2696 703a1s0ssssd7da.exe 2696 703a1s0ssssd7da.exe 2696 703a1s0ssssd7da.exe 2696 703a1s0ssssd7da.exe 2696 703a1s0ssssd7da.exe 2696 703a1s0ssssd7da.exe 2696 703a1s0ssssd7da.exe 2696 703a1s0ssssd7da.exe 2696 703a1s0ssssd7da.exe 2696 703a1s0ssssd7da.exe 2696 703a1s0ssssd7da.exe 2696 703a1s0ssssd7da.exe 2696 703a1s0ssssd7da.exe 2696 703a1s0ssssd7da.exe 2696 703a1s0ssssd7da.exe -
Drops desktop.ini file(s) 3 IoCs
Processes:
703a1s0ssssd7da.exedescription ioc process File opened for modification C:\Program Files\desktop.ini 703a1s0ssssd7da.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\DataServices\DESKTOP.INI 703a1s0ssssd7da.exe File opened for modification C:\Program Files\Common Files\microsoft shared\Stationery\Desktop.ini 703a1s0ssssd7da.exe -
Drops file in Program Files directory 7369 IoCs
Processes:
703a1s0ssssd7da.exedescription ioc process File opened for modification C:\Program Files\7-Zip\Lang\zh-tw.txt 703a1s0ssssd7da.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\db\bin\dblook.bat 703a1s0ssssd7da.exe File opened for modification C:\Program Files\Microsoft Office\root\Templates\1033\Pitchbook.potx 703a1s0ssssd7da.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\EQUATION\api-ms-win-crt-conio-l1-1-0.dll 703a1s0ssssd7da.exe File created C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsMaps_5.1611.10393.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Car\LTR\contrast-white\Read_Me.txt 703a1s0ssssd7da.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\ClientCapabilities.json 703a1s0ssssd7da.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.emf.ecore_2.10.1.v20140901-1043\feature.xml 703a1s0ssssd7da.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\lib\gimap.jar 703a1s0ssssd7da.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\DBGCORE.DLL 703a1s0ssssd7da.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\OFFSYMB.TTF 703a1s0ssssd7da.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\playlist\cue.luac 703a1s0ssssd7da.exe File opened for modification C:\Program Files\Internet Explorer\images\bing.ico 703a1s0ssssd7da.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\modules\org-netbeans-modules-editor-mimelookup-impl.jar 703a1s0ssssd7da.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\README.txt 703a1s0ssssd7da.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_Retail-ul-phn.xrm-ms 703a1s0ssssd7da.exe File opened for modification C:\Program Files\Mozilla Firefox\api-ms-win-core-synch-l1-2-0.dll 703a1s0ssssd7da.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\visualvm\modules\com-sun-tools-visualvm-host-views.jar 703a1s0ssssd7da.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\EQUATION\ucrtbase.dll 703a1s0ssssd7da.exe File opened for modification C:\Program Files\Mozilla Firefox\dependentlibs.list 703a1s0ssssd7da.exe File opened for modification C:\Program Files\Windows Defender Advanced Threat Protection\SenseCncPS.dll 703a1s0ssssd7da.exe File opened for modification C:\Program Files\Common Files\microsoft shared\Stationery\Orange Circles.htm 703a1s0ssssd7da.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019XC2RVL_KMS_ClientC2R-ul-oob.xrm-ms 703a1s0ssssd7da.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_Retail-ppd.xrm-ms 703a1s0ssssd7da.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\ACEDAO.DLL 703a1s0ssssd7da.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\codec\libwebvtt_plugin.dll 703a1s0ssssd7da.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\MondoR_Trial-ppd.xrm-ms 703a1s0ssssd7da.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProjectProCO365R_Subscription-ul-oob.xrm-ms 703a1s0ssssd7da.exe File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\System.Workflow.Activities.dll 703a1s0ssssd7da.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.emf.ecore_2.10.1.v20140901-1043\license.html 703a1s0ssssd7da.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\html\cpyr.htm 703a1s0ssssd7da.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\DataServices\+Connect to New Data Source.odc 703a1s0ssssd7da.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power View Excel Add-in\BI-Report.png 703a1s0ssssd7da.exe File created C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsMaps_5.1611.10393.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Work\LTR\contrast-black\Read_Me.txt 703a1s0ssssd7da.exe File created C:\Program Files\Common Files\microsoft shared\ink\ar-SA\Read_Me.txt 703a1s0ssssd7da.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.equinox.p2.metadata_2.2.0.v20131211-1531.jar 703a1s0ssssd7da.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\modules\locale\org-netbeans-modules-core-kit_ja.jar 703a1s0ssssd7da.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\System\vccorlib140.dll 703a1s0ssssd7da.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\profiler\modules\locale\org-netbeans-modules-profiler-selector-api_ja.jar 703a1s0ssssd7da.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProPlusDemoR_BypassTrial180-ppd.xrm-ms 703a1s0ssssd7da.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\fi\LC_MESSAGES\vlc.mo 703a1s0ssssd7da.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\j2pkcs11.dll 703a1s0ssssd7da.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\Standard2019R_Trial-ppd.xrm-ms 703a1s0ssssd7da.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSIPC\hi\msipc.dll.mui 703a1s0ssssd7da.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\OFFICE16\MSO.DLL 703a1s0ssssd7da.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\p2\org.eclipse.equinox.p2.core\cache\binary\com.jrockit.mc.rcp.product_root_5.5.0.165303 703a1s0ssssd7da.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.core.commands_3.6.100.v20140528-1422.jar 703a1s0ssssd7da.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_SubTrial2-ul-oob.xrm-ms 703a1s0ssssd7da.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019XC2RVL_MAKC2R-pl.xrm-ms 703a1s0ssssd7da.exe File created C:\Program Files\VideoLAN\VLC\locale\mai\LC_MESSAGES\Read_Me.txt 703a1s0ssssd7da.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\access\libfilesystem_plugin.dll 703a1s0ssssd7da.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\misc\libaddonsvorepository_plugin.dll 703a1s0ssssd7da.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\stream_out\libstream_out_record_plugin.dll 703a1s0ssssd7da.exe File created C:\Program Files\Java\jdk1.8.0_66\include\win32\Read_Me.txt 703a1s0ssssd7da.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\config\Modules\org-netbeans-modules-editor-mimelookup.xml 703a1s0ssssd7da.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_Trial-pl.xrm-ms 703a1s0ssssd7da.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\LAYERS\Read_Me.txt 703a1s0ssssd7da.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\VBA\Read_Me.txt 703a1s0ssssd7da.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\IpsPlugin.dll 703a1s0ssssd7da.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.equinox.p2.metadata.repository.nl_zh_4.4.0.v20140623020002.jar 703a1s0ssssd7da.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\update_tracking\org-netbeans-bootstrap.xml 703a1s0ssssd7da.exe File opened for modification C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Green Yellow.xml 703a1s0ssssd7da.exe File created C:\Program Files\Microsoft Office\root\Templates\Read_Me.txt 703a1s0ssssd7da.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\jp2iexp.dll 703a1s0ssssd7da.exe File opened for modification C:\Program Files\Microsoft Office\root\fre\StartMenu_Win8_RTL.mp4 703a1s0ssssd7da.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\703a1s0ssssd7da.exe"C:\Users\Admin\AppData\Local\Temp\703a1s0ssssd7da.exe"1⤵
- Suspicious use of WriteProcessMemory
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Local\Temp\703a1s0ssssd7da.exe"{path}"2⤵
- Suspicious behavior: EnumeratesProcesses
- Drops desktop.ini file(s)
- Drops file in Program Files directory
-
C:\Windows\explorer.exeexplorer.exe1⤵