Analysis

  • max time kernel
    74s
  • max time network
    123s
  • platform
    windows10_x64
  • resource
    win10v200430
  • submitted
    09/07/2020, 17:12

General

  • Target
    289a1s0ssssd7da[1].bin.exe
  • Size 717KB
  • Sample200709-x4dnr655e6
  • SHA256 4fa82bcc428147d23e5abc86fb9bfdc61829d91094659e74250ac43ab9a73ab4
  • MD5 SHA1 SHA512
Score
10/10

Malware Config

Extracted

Path
  • \??\M:\Read_Me.txt

Ransom Note
  • Attention! All your files, documents, photos, databases and other important files are encrypted The only method of recovering files is to purchase an unique decryptor. Only we can give you this decryptor and only we can recover your files. The server with your decryptor is in a closed network TOR. You can get there by the following ways: ---------------------------------------------------------------------------------------- 1. Download Tor browser - https://www.torproject.org/ 2. Install Tor browser 3. Open Tor Browser 4. Open link in TOR browser: http://7rzpyw3hflwe2c7h.onion/?SJLNOQXY 5. Follow the instructions on this page ---------------------------------------------------------------------------------------- On our page you will see instructions on payment and get the opportunity to decrypt 1 file for free. Alternate communication channel here: http://helpqvrg3cc5mvb3.onion/
URLs
  • http://7rzpyw3hflwe2c7h.onion/?SJLNOQXY

  • http://helpqvrg3cc5mvb3.onion/

Signatures

  • Suspicious use of WriteProcessMemory 9 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 3486 IoCs
  • Suspicious use of FindShellTrayWindow 15 IoCs
  • Drops file in Program Files directory 8576 IoCs
  • Enumerates connected drives 3 TTPs
  • Modifies registry class 7 IoCs
  • Suspicious use of AdjustPrivilegeToken 24 IoCs
  • Suspicious use of SendNotifyMessage 11 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Drops desktop.ini file(s) 3 IoCs
  • Modifies Installed Components in the registry 2 TTPs 1 IoCs
  • Modifies control panel 5 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\289a1s0ssssd7da[1].bin.exe
    "C:\Users\Admin\AppData\Local\Temp\289a1s0ssssd7da[1].bin.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    • Suspicious use of SetThreadContext
    PID:3548
    • C:\Users\Admin\AppData\Local\Temp\289a1s0ssssd7da[1].bin.exe
      "{path}"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Drops file in Program Files directory
      • Drops desktop.ini file(s)
      PID:2088
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Suspicious use of FindShellTrayWindow
    • Modifies registry class
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SendNotifyMessage
    • Modifies Installed Components in the registry
    • Modifies control panel
    PID:3848
  • C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe
    "C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe" -ServerName:App.AppXtk181tbxbce2qsex02s8tw7hfxa9xb3t.mca
    1⤵
    • Suspicious use of SetWindowsHookEx
    • Modifies control panel
    PID:644
  • C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe
    "C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe" -ServerName:CortanaUI.AppXa50dqqa5gqv4a428c9y1jjw7m3btvepj.mca
    1⤵
    • Suspicious use of SetWindowsHookEx
    • Modifies control panel
    PID:584

Network

        MITRE ATT&CK Enterprise v6

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        memory/2088-0-0x0000000000400000-0x000000000041E000-memory.dmp

        memory/2088-2-0x0000000000400000-0x000000000041E000-memory.dmp