Analysis
-
max time kernel
60s -
max time network
132s -
platform
windows10_x64 -
resource
win10 -
submitted
09-07-2020 17:15
Static task
static1
Behavioral task
behavioral1
Sample
832a1s0ssssd7da.exe
Resource
win7v200430
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
832a1s0ssssd7da.exe
Resource
win10
windows10_x64
0 signatures
0 seconds
General
-
Target
832a1s0ssssd7da.exe
-
Size
717KB
-
MD5
f0d433953b5b19f0401dd3dbf52741f6
-
SHA1
6682267a51e413dc0e38db29e363b6c6999f9393
-
SHA256
f9bbcdd411bd3a80581683e68a84a71f9a6c5c8dff281c6db02d0d1da384eba4
-
SHA512
8fd991fae7f83d50afc19bd0822c3cab9d706f3a990806c4e14a23af9c9525e5aac707f35db9910c29863b849a20724581ad7520b6742d3a9b8a7a320fff9e26
Score
10/10
Malware Config
Extracted
Path
C:\Boot\bg-BG\Read_Me.txt
Ransom Note
Attention!
All your files, documents, photos, databases and other important files are encrypted
The only method of recovering files is to purchase an unique decryptor. Only we can give you this decryptor and only we can recover your files.
The server with your decryptor is in a closed network TOR. You can get there by the following ways:
----------------------------------------------------------------------------------------
1. Download Tor browser - https://www.torproject.org/
2. Install Tor browser
3. Open Tor Browser
4. Open link in TOR browser: http://7rzpyw3hflwe2c7h.onion/?HZACDFHI
5. Follow the instructions on this page
----------------------------------------------------------------------------------------
On our page you will see instructions on payment and get the opportunity to decrypt 1 file for free.
Alternate communication channel here: http://helpqvrg3cc5mvb3.onion/
URLs
http://7rzpyw3hflwe2c7h.onion/?HZACDFHI
http://helpqvrg3cc5mvb3.onion/
Signatures
-
Modifies registry class 5 IoCs
Processes:
explorer.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000_Classes\Local Settings explorer.exe Key created \REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell explorer.exe Key created \REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02 explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff explorer.exe -
Drops file in Program Files directory 8960 IoCs
Processes:
832a1s0ssssd7da.exedescription ioc process File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\com.jrockit.mc.feature.rcp.zh_CN_5.5.0.165303\feature.properties 832a1s0ssssd7da.exe File opened for modification C:\Program Files\Microsoft Office\root\mcxml\x-none\PowerPoint.x-none.msi.16_mondoww.mcxml 832a1s0ssssd7da.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\offsymt.ttf 832a1s0ssssd7da.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ExcelR_Trial-ul-oob.xrm-ms 832a1s0ssssd7da.exe File created C:\Program Files\Microsoft Office\root\Office16\MSIPC\ar\Read_Me.txt 832a1s0ssssd7da.exe File created C:\Program Files\VideoLAN\VLC\locale\es\LC_MESSAGES\Read_Me.txt 832a1s0ssssd7da.exe File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsSoundRecorder_10.1702.301.0_neutral_split.scale-200_8wekyb3d8bbwe\Assets\VoiceRecorderWideTile.scale-200.png 832a1s0ssssd7da.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\Assets\AppTiles\Weather_TileMediumSquare.scale-200.png 832a1s0ssssd7da.exe File opened for modification C:\Program Files\Common Files\microsoft shared\VSTO\10.0\1033\VSTOLoaderUI.dll 832a1s0ssssd7da.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\lib\psfont.properties.ja 832a1s0ssssd7da.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\DataModel\tmcachemgr_xl.dll 832a1s0ssssd7da.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL012.XML 832a1s0ssssd7da.exe File opened for modification C:\Program Files\Mozilla Firefox\browser\VisualElements\VisualElements_150.png 832a1s0ssssd7da.exe File opened for modification C:\Program Files\ResumeSubmit.vsx 832a1s0ssssd7da.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\access\libvcd_plugin.dll 832a1s0ssssd7da.exe File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsAlarms_10.1702.333.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\StopwatchMedTile.contrast-black_scale-125.png 832a1s0ssssd7da.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\indxicon.gif 832a1s0ssssd7da.exe File created C:\Program Files\Microsoft Office\root\vfs\Common AppData\Microsoft\Read_Me.txt 832a1s0ssssd7da.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\CONCRETE\CONCRETE.ELM 832a1s0ssssd7da.exe File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsMaps_5.1611.10393.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\AppTiles\contrast-black\MapsWideTile.scale-125.png 832a1s0ssssd7da.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\auxpad\auxbase.xml 832a1s0ssssd7da.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\bci.dll 832a1s0ssssd7da.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\modules\locale\org-netbeans-modules-templates_ja.jar 832a1s0ssssd7da.exe File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\PresentationCore.dll 832a1s0ssssd7da.exe File opened for modification C:\Program Files\Windows Mail\MSOERES.dll 832a1s0ssssd7da.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\modules\org-netbeans-modules-favorites.jar 832a1s0ssssd7da.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\lib\management-agent.jar 832a1s0ssssd7da.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.OData.Edm.NetFX35.V7.dll 832a1s0ssssd7da.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\th\LC_MESSAGES\vlc.mo 832a1s0ssssd7da.exe File created C:\Program Files\Java\jdk1.8.0_66\jre\lib\applet\Read_Me.txt 832a1s0ssssd7da.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\orbd.exe 832a1s0ssssd7da.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_Retail-pl.xrm-ms 832a1s0ssssd7da.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.3DBuilder_13.0.10349.0_neutral_split.scale-140_8wekyb3d8bbwe\Assets\Office\ProjectionCylindric.scale-140.png 832a1s0ssssd7da.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.osgi.services_3.4.0.v20140312-2051.jar 832a1s0ssssd7da.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\Document Parts\1033\16\Built-In Building Blocks.dotx 832a1s0ssssd7da.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE 832a1s0ssssd7da.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\ACEES.DLL 832a1s0ssssd7da.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.10252.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\contrast-white\AppPackageStoreLogo.scale-125_contrast-white.png 832a1s0ssssd7da.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\css\ui-lightness\images\ui-bg_gloss-wave_35_f6a828_500x100.png 832a1s0ssssd7da.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\video_filter\libgaussianblur_plugin.dll 832a1s0ssssd7da.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\p2\org.eclipse.equinox.p2.engine\profileRegistry\JMC.profile\1423496939244.profile.gz 832a1s0ssssd7da.exe File created C:\Program Files\Microsoft Office\root\Office16\Library\SOLVER\Read_Me.txt 832a1s0ssssd7da.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\DataModel\Microsoft.Data.Odata.dll 832a1s0ssssd7da.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\OFFICE16\ADAL.DLL 832a1s0ssssd7da.exe File created C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsMaps_5.1611.10393.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\SecondaryTiles\Collections\Read_Me.txt 832a1s0ssssd7da.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-host-remote_zh_CN.jar 832a1s0ssssd7da.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_SubTrial3-pl.xrm-ms 832a1s0ssssd7da.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\StandardVL_MAK-ul-phn.xrm-ms 832a1s0ssssd7da.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\eu\LC_MESSAGES\vlc.mo 832a1s0ssssd7da.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\Assets\AppTiles\WeatherImages\210x173\29.jpg 832a1s0ssssd7da.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentDemoR_BypassTrial180-ul-oob.xrm-ms 832a1s0ssssd7da.exe File opened for modification C:\Program Files\Microsoft Office\root\Templates\1033\ChronologicalLetter.dotx 832a1s0ssssd7da.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.jetty.servlet_8.1.14.v20131031.jar 832a1s0ssssd7da.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\modules\locale\org-netbeans-core-output2_ja.jar 832a1s0ssssd7da.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\update_tracking\org-netbeans-modules-applemenu.xml 832a1s0ssssd7da.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\jp2iexp.dll 832a1s0ssssd7da.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\FrequentOfficeUpdateSchedule.xml 832a1s0ssssd7da.exe File opened for modification C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Effects\Glossy.eftx 832a1s0ssssd7da.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\audio_output\libwasapi_plugin.dll 832a1s0ssssd7da.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\Assets\AppPackageMedTile.scale-200.png 832a1s0ssssd7da.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\Assets\Catalog\shape_cube.3mf 832a1s0ssssd7da.exe File created C:\Program Files\VideoLAN\VLC\lua\meta\reader\Read_Me.txt 832a1s0ssssd7da.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\demux\librawvid_plugin.dll 832a1s0ssssd7da.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTrial1-ul-oob.xrm-ms 832a1s0ssssd7da.exe -
Drops desktop.ini file(s) 3 IoCs
Processes:
832a1s0ssssd7da.exedescription ioc process File opened for modification C:\Program Files\desktop.ini 832a1s0ssssd7da.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\DataServices\DESKTOP.INI 832a1s0ssssd7da.exe File opened for modification C:\Program Files\Common Files\microsoft shared\Stationery\Desktop.ini 832a1s0ssssd7da.exe -
Suspicious use of FindShellTrayWindow 4 IoCs
Processes:
explorer.exepid process 3272 explorer.exe 3272 explorer.exe 3272 explorer.exe 3272 explorer.exe -
Modifies Installed Components in the registry 2 TTPs 1 IoCs
Processes:
explorer.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Active Setup\Installed Components explorer.exe -
Suspicious behavior: EnumeratesProcesses 4238 IoCs
Processes:
832a1s0ssssd7da.exepid process 3368 832a1s0ssssd7da.exe 3368 832a1s0ssssd7da.exe 3368 832a1s0ssssd7da.exe 3368 832a1s0ssssd7da.exe 3368 832a1s0ssssd7da.exe 3368 832a1s0ssssd7da.exe 3368 832a1s0ssssd7da.exe 3368 832a1s0ssssd7da.exe 3368 832a1s0ssssd7da.exe 3368 832a1s0ssssd7da.exe 3368 832a1s0ssssd7da.exe 3368 832a1s0ssssd7da.exe 3368 832a1s0ssssd7da.exe 3368 832a1s0ssssd7da.exe 3368 832a1s0ssssd7da.exe 3368 832a1s0ssssd7da.exe 3368 832a1s0ssssd7da.exe 3368 832a1s0ssssd7da.exe 3368 832a1s0ssssd7da.exe 3368 832a1s0ssssd7da.exe 3368 832a1s0ssssd7da.exe 3368 832a1s0ssssd7da.exe 3368 832a1s0ssssd7da.exe 3368 832a1s0ssssd7da.exe 3368 832a1s0ssssd7da.exe 3368 832a1s0ssssd7da.exe 3368 832a1s0ssssd7da.exe 3368 832a1s0ssssd7da.exe 3368 832a1s0ssssd7da.exe 3368 832a1s0ssssd7da.exe 3368 832a1s0ssssd7da.exe 3368 832a1s0ssssd7da.exe 3368 832a1s0ssssd7da.exe 3368 832a1s0ssssd7da.exe 3368 832a1s0ssssd7da.exe 3368 832a1s0ssssd7da.exe 3368 832a1s0ssssd7da.exe 3368 832a1s0ssssd7da.exe 3368 832a1s0ssssd7da.exe 3368 832a1s0ssssd7da.exe 3368 832a1s0ssssd7da.exe 3368 832a1s0ssssd7da.exe 3368 832a1s0ssssd7da.exe 3368 832a1s0ssssd7da.exe 3368 832a1s0ssssd7da.exe 3368 832a1s0ssssd7da.exe 3368 832a1s0ssssd7da.exe 3368 832a1s0ssssd7da.exe 3368 832a1s0ssssd7da.exe 3368 832a1s0ssssd7da.exe 3368 832a1s0ssssd7da.exe 3368 832a1s0ssssd7da.exe 3368 832a1s0ssssd7da.exe 3368 832a1s0ssssd7da.exe 3368 832a1s0ssssd7da.exe 3368 832a1s0ssssd7da.exe 3368 832a1s0ssssd7da.exe 3368 832a1s0ssssd7da.exe 3368 832a1s0ssssd7da.exe 3368 832a1s0ssssd7da.exe 3368 832a1s0ssssd7da.exe 3368 832a1s0ssssd7da.exe 3368 832a1s0ssssd7da.exe 3368 832a1s0ssssd7da.exe -
Suspicious use of AdjustPrivilegeToken 10 IoCs
Processes:
explorer.exedescription pid process Token: SeShutdownPrivilege 3272 explorer.exe Token: SeCreatePagefilePrivilege 3272 explorer.exe Token: SeShutdownPrivilege 3272 explorer.exe Token: SeCreatePagefilePrivilege 3272 explorer.exe Token: SeShutdownPrivilege 3272 explorer.exe Token: SeCreatePagefilePrivilege 3272 explorer.exe Token: SeShutdownPrivilege 3272 explorer.exe Token: SeCreatePagefilePrivilege 3272 explorer.exe Token: SeShutdownPrivilege 3272 explorer.exe Token: SeCreatePagefilePrivilege 3272 explorer.exe -
Suspicious use of SendNotifyMessage 9 IoCs
Processes:
explorer.exepid process 3272 explorer.exe 3272 explorer.exe 3272 explorer.exe 3272 explorer.exe 3272 explorer.exe 3272 explorer.exe 3272 explorer.exe 3272 explorer.exe 3272 explorer.exe -
Enumerates connected drives 3 TTPs
-
Suspicious use of WriteProcessMemory 9 IoCs
Processes:
832a1s0ssssd7da.exedescription pid process target process PID 3068 wrote to memory of 3368 3068 832a1s0ssssd7da.exe 832a1s0ssssd7da.exe PID 3068 wrote to memory of 3368 3068 832a1s0ssssd7da.exe 832a1s0ssssd7da.exe PID 3068 wrote to memory of 3368 3068 832a1s0ssssd7da.exe 832a1s0ssssd7da.exe PID 3068 wrote to memory of 3368 3068 832a1s0ssssd7da.exe 832a1s0ssssd7da.exe PID 3068 wrote to memory of 3368 3068 832a1s0ssssd7da.exe 832a1s0ssssd7da.exe PID 3068 wrote to memory of 3368 3068 832a1s0ssssd7da.exe 832a1s0ssssd7da.exe PID 3068 wrote to memory of 3368 3068 832a1s0ssssd7da.exe 832a1s0ssssd7da.exe PID 3068 wrote to memory of 3368 3068 832a1s0ssssd7da.exe 832a1s0ssssd7da.exe PID 3068 wrote to memory of 3368 3068 832a1s0ssssd7da.exe 832a1s0ssssd7da.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
832a1s0ssssd7da.exedescription pid process target process PID 3068 set thread context of 3368 3068 832a1s0ssssd7da.exe 832a1s0ssssd7da.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\832a1s0ssssd7da.exe"C:\Users\Admin\AppData\Local\Temp\832a1s0ssssd7da.exe"1⤵
- Suspicious use of WriteProcessMemory
- Suspicious use of SetThreadContext
PID:3068 -
C:\Users\Admin\AppData\Local\Temp\832a1s0ssssd7da.exe"{path}"2⤵
- Drops file in Program Files directory
- Drops desktop.ini file(s)
- Suspicious behavior: EnumeratesProcesses
PID:3368
-
C:\Windows\explorer.exeexplorer.exe1⤵
- Modifies registry class
- Suspicious use of FindShellTrayWindow
- Modifies Installed Components in the registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SendNotifyMessage
PID:3272