1d67abe1ec08e6215e08d6bb595ade3d1d33d0e886edf887b29f4d8e1d46e593

General

Target

1d67abe1ec08e6215e08d6bb595ade3d1d33d0e886edf887b29f4d8e1d46e593.exe
Size

4.6MB
MD5

7d9c6313b2e412f0db4380b279eb4fed
SHA1

0675b3958e7eef4090775f665d8201837f167f01
SHA256

1d67abe1ec08e6215e08d6bb595ade3d1d33d0e886edf887b29f4d8e1d46e593
SHA512

ddaa21b661f448442df6556dec57429636e7aa6fa9ce4f098ac218cc702b301903c7bf254b9aee732a90561402b420d977be6bb7940bf49aa55e0e5f9991075e

Score

10^/10

ransomware spyware persistence

Malware Config

Extracted

Path

C:\MSOCache\All Users\{90140000-0011-0000-1000-0000000FF1CE}-C\HOW TO RESTORE YOUR FILES.TXT

Ransom Note

Hello! All your files are encrypted, write to me if you want to return your files - I can do it very quickly! Contact me by email: [email protected] or [email protected] The subject line must contain an encryption extension or the name of your company! Do not rename encrypted files, you may lose them forever. You may be a victim of fraud. Free decryption as a guarantee. Send us up to 3 files for free decryption. The total file size should be no more than 1 MB! (not in the archive), and the files should not contain valuable information. (databases, backups, large Excel spreadsheets, etc.) !!! Do not turn off or restart the NAS equipment. This will lead to data loss !!!

Emails

[email protected]

Signatures

Suspicious use of WriteProcessMemory 21 IoCs

Processes:

1d67abe1ec08e6215e08d6bb595ade3d1d33d0e886edf887b29f4d8e1d46e593.execmd.execmd.exe

description	pid	process	target process
PID 900 wrote to memory of 800	900	1d67abe1ec08e6215e08d6bb595ade3d1d33d0e886edf887b29f4d8e1d46e593.exe	cmd.exe
PID 900 wrote to memory of 800	900	1d67abe1ec08e6215e08d6bb595ade3d1d33d0e886edf887b29f4d8e1d46e593.exe	cmd.exe
PID 900 wrote to memory of 800	900	1d67abe1ec08e6215e08d6bb595ade3d1d33d0e886edf887b29f4d8e1d46e593.exe	cmd.exe
PID 800 wrote to memory of 1096	800	cmd.exe	sc.exe
PID 800 wrote to memory of 1096	800	cmd.exe	sc.exe
PID 800 wrote to memory of 1096	800	cmd.exe	sc.exe
PID 800 wrote to memory of 1080	800	cmd.exe	findstr.exe
PID 800 wrote to memory of 1080	800	cmd.exe	findstr.exe
PID 800 wrote to memory of 1080	800	cmd.exe	findstr.exe
PID 900 wrote to memory of 1516	900	1d67abe1ec08e6215e08d6bb595ade3d1d33d0e886edf887b29f4d8e1d46e593.exe	cmd.exe
PID 900 wrote to memory of 1516	900	1d67abe1ec08e6215e08d6bb595ade3d1d33d0e886edf887b29f4d8e1d46e593.exe	cmd.exe
PID 900 wrote to memory of 1516	900	1d67abe1ec08e6215e08d6bb595ade3d1d33d0e886edf887b29f4d8e1d46e593.exe	cmd.exe
PID 900 wrote to memory of 1904	900	1d67abe1ec08e6215e08d6bb595ade3d1d33d0e886edf887b29f4d8e1d46e593.exe	cmd.exe
PID 900 wrote to memory of 1904	900	1d67abe1ec08e6215e08d6bb595ade3d1d33d0e886edf887b29f4d8e1d46e593.exe	cmd.exe
PID 900 wrote to memory of 1904	900	1d67abe1ec08e6215e08d6bb595ade3d1d33d0e886edf887b29f4d8e1d46e593.exe	cmd.exe
PID 1904 wrote to memory of 1204	1904	cmd.exe	vssadmin.exe
PID 1904 wrote to memory of 1204	1904	cmd.exe	vssadmin.exe
PID 1904 wrote to memory of 1204	1904	cmd.exe	vssadmin.exe
PID 900 wrote to memory of 2020	900	1d67abe1ec08e6215e08d6bb595ade3d1d33d0e886edf887b29f4d8e1d46e593.exe	cmd.exe
PID 900 wrote to memory of 2020	900	1d67abe1ec08e6215e08d6bb595ade3d1d33d0e886edf887b29f4d8e1d46e593.exe	cmd.exe
PID 900 wrote to memory of 2020	900	1d67abe1ec08e6215e08d6bb595ade3d1d33d0e886edf887b29f4d8e1d46e593.exe	cmd.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

vssvc.exe

description pid process

Token: SeBackupPrivilege 1952 vssvc.exe
Token: SeRestorePrivilege 1952 vssvc.exe
Token: SeAuditPrivilege 1952 vssvc.exe
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware

File Deletion
T1107

Inhibit System Recovery
T1490
Interacts with shadow copies 2 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
ransomware

File Deletion
T1107

Inhibit System Recovery
T1490

Processes:

vssadmin.exe

pid process

1204 vssadmin.exe

description	pid	process
Token: SeBackupPrivilege	1952	vssvc.exe
Token: SeRestorePrivilege	1952	vssvc.exe
Token: SeAuditPrivilege	1952	vssvc.exe

pid	process
1204	vssadmin.exe

Modifies service 2 TTPs 5 IoCs

persistence

Modify Registry

T1112

Modify Existing Service

T1031

Processes:

vssvc.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\COM+ REGDB Writer	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\ASR Writer	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\Shadow Copy Optimization Writer	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\Registry Writer	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SwProvider_{b5946137-7b9f-4925-af80-51abd60b20d5}	vssvc.exe

Launches sc.exe
Sc.exe is a Windows utlilty to control services on the system.

Drops file in Program Files directory 14817 IoCs

Processes:

1d67abe1ec08e6215e08d6bb595ade3d1d33d0e886edf887b29f4d8e1d46e593.exe

description	ioc	process
File opened for modification	C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0107148.WMF.tkoinprz	1d67abe1ec08e6215e08d6bb595ade3d1d33d0e886edf887b29f4d8e1d46e593.exe
File opened for modification	C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_Groove.gif.tkoinprz	1d67abe1ec08e6215e08d6bb595ade3d1d33d0e886edf887b29f4d8e1d46e593.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\vi\LC_MESSAGES\vlc.mo	1d67abe1ec08e6215e08d6bb595ade3d1d33d0e886edf887b29f4d8e1d46e593.exe
File opened for modification	C:\Program Files\Microsoft Office\Templates\1033\BillingStatement.xltx.tkoinprz	1d67abe1ec08e6215e08d6bb595ade3d1d33d0e886edf887b29f4d8e1d46e593.exe
File created	C:\Program Files\VideoLAN\VLC\locale\pt_BR\HOW TO RESTORE YOUR FILES.TXT	1d67abe1ec08e6215e08d6bb595ade3d1d33d0e886edf887b29f4d8e1d46e593.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Funafuti	1d67abe1ec08e6215e08d6bb595ade3d1d33d0e886edf887b29f4d8e1d46e593.exe
File opened for modification	C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BL00985_.WMF.tkoinprz	1d67abe1ec08e6215e08d6bb595ade3d1d33d0e886edf887b29f4d8e1d46e593.exe
File opened for modification	C:\Program Files\Microsoft Office\Office14\1033\GR8GALRY.GRA.tkoinprz	1d67abe1ec08e6215e08d6bb595ade3d1d33d0e886edf887b29f4d8e1d46e593.exe
File opened for modification	C:\Program Files\7-Zip\Lang\af.txt.tkoinprz	1d67abe1ec08e6215e08d6bb595ade3d1d33d0e886edf887b29f4d8e1d46e593.exe
File opened for modification	C:\Program Files\Microsoft Office\CLIPART\PUB60COR\SO00152_.WMF	1d67abe1ec08e6215e08d6bb595ade3d1d33d0e886edf887b29f4d8e1d46e593.exe
File opened for modification	C:\Program Files\Microsoft Office\Office14\1033\PUBSPAPR\ZPDIR33F.GIF.tkoinprz	1d67abe1ec08e6215e08d6bb595ade3d1d33d0e886edf887b29f4d8e1d46e593.exe
File opened for modification	C:\Program Files\Microsoft Office\Templates\1033\Access\Faculty.accdt	1d67abe1ec08e6215e08d6bb595ade3d1d33d0e886edf887b29f4d8e1d46e593.exe
File opened for modification	C:\Program Files (x86)\Google\Chrome\Application\83.0.4103.106\MEIPreload\preloaded_data.pb.tkoinprz	1d67abe1ec08e6215e08d6bb595ade3d1d33d0e886edf887b29f4d8e1d46e593.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ky.txt	1d67abe1ec08e6215e08d6bb595ade3d1d33d0e886edf887b29f4d8e1d46e593.exe
File opened for modification	C:\Program Files\Microsoft Office\Office14\1033\GrooveForms5\bg_Earthy.gif	1d67abe1ec08e6215e08d6bb595ade3d1d33d0e886edf887b29f4d8e1d46e593.exe
File opened for modification	C:\Program Files\Microsoft Office\Office14\Groove\ToolBMPs\NotifierDisableUpArrow.jpg	1d67abe1ec08e6215e08d6bb595ade3d1d33d0e886edf887b29f4d8e1d46e593.exe
File opened for modification	C:\Program Files\Microsoft Office\Office14\MEDIA\HAMMER.WAV	1d67abe1ec08e6215e08d6bb595ade3d1d33d0e886edf887b29f4d8e1d46e593.exe
File opened for modification	C:\Program Files\Microsoft Office\MEDIA\OFFICE14\LINES\J0115875.GIF	1d67abe1ec08e6215e08d6bb595ade3d1d33d0e886edf887b29f4d8e1d46e593.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.rcp_4.4.0.v20141007-2301\HOW TO RESTORE YOUR FILES.TXT	1d67abe1ec08e6215e08d6bb595ade3d1d33d0e886edf887b29f4d8e1d46e593.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Godthab	1d67abe1ec08e6215e08d6bb595ade3d1d33d0e886edf887b29f4d8e1d46e593.exe
File opened for modification	C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BS00438_.WMF	1d67abe1ec08e6215e08d6bb595ade3d1d33d0e886edf887b29f4d8e1d46e593.exe
File opened for modification	C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0213243.WMF.tkoinprz	1d67abe1ec08e6215e08d6bb595ade3d1d33d0e886edf887b29f4d8e1d46e593.exe
File opened for modification	C:\Program Files\Microsoft Office\Office14\PUBWIZ\DGWEBSBR.XML.tkoinprz	1d67abe1ec08e6215e08d6bb595ade3d1d33d0e886edf887b29f4d8e1d46e593.exe
File opened for modification	C:\Program Files\Microsoft Office\MEDIA\OFFICE14\AUTOSHAP\BD18182_.WMF	1d67abe1ec08e6215e08d6bb595ade3d1d33d0e886edf887b29f4d8e1d46e593.exe
File opened for modification	C:\Program Files\Microsoft Office\Office14\1033\PUBSPAPR\ZPDIR21F.GIF	1d67abe1ec08e6215e08d6bb595ade3d1d33d0e886edf887b29f4d8e1d46e593.exe
File opened for modification	C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\rtf_underline.gif	1d67abe1ec08e6215e08d6bb595ade3d1d33d0e886edf887b29f4d8e1d46e593.exe
File opened for modification	C:\Program Files\Microsoft Office\Office14\PUBWIZ\BRCHUR11.POC	1d67abe1ec08e6215e08d6bb595ade3d1d33d0e886edf887b29f4d8e1d46e593.exe
File opened for modification	C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0341738.JPG.tkoinprz	1d67abe1ec08e6215e08d6bb595ade3d1d33d0e886edf887b29f4d8e1d46e593.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\dialogs\error_window.html.tkoinprz	1d67abe1ec08e6215e08d6bb595ade3d1d33d0e886edf887b29f4d8e1d46e593.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.greychart.ui.zh_CN_5.5.0.165303.jar	1d67abe1ec08e6215e08d6bb595ade3d1d33d0e886edf887b29f4d8e1d46e593.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.workbench.renderers.swt.nl_ja_4.4.0.v20140623020002.jar	1d67abe1ec08e6215e08d6bb595ade3d1d33d0e886edf887b29f4d8e1d46e593.exe
File opened for modification	C:\Program Files\Microsoft Office\CLIPART\PUB60COR\SO00191_.WMF.tkoinprz	1d67abe1ec08e6215e08d6bb595ade3d1d33d0e886edf887b29f4d8e1d46e593.exe
File opened for modification	C:\Program Files\Microsoft Office\CLIPART\PUB60COR\PARNT_06.MID.tkoinprz	1d67abe1ec08e6215e08d6bb595ade3d1d33d0e886edf887b29f4d8e1d46e593.exe
File opened for modification	C:\Program Files\Microsoft Office\CLIPART\Publisher\Backgrounds\J0143743.GIF	1d67abe1ec08e6215e08d6bb595ade3d1d33d0e886edf887b29f4d8e1d46e593.exe
File opened for modification	C:\Program Files\Microsoft Office\Templates\1033\MedianLetter.Dotx	1d67abe1ec08e6215e08d6bb595ade3d1d33d0e886edf887b29f4d8e1d46e593.exe
File opened for modification	C:\Program Files\Microsoft Office\Document Themes 14\Horizon.thmx	1d67abe1ec08e6215e08d6bb595ade3d1d33d0e886edf887b29f4d8e1d46e593.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\ended_review_or_form.gif	1d67abe1ec08e6215e08d6bb595ade3d1d33d0e886edf887b29f4d8e1d46e593.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Costa_Rica	1d67abe1ec08e6215e08d6bb595ade3d1d33d0e886edf887b29f4d8e1d46e593.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Halifax.tkoinprz	1d67abe1ec08e6215e08d6bb595ade3d1d33d0e886edf887b29f4d8e1d46e593.exe
File opened for modification	C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0187837.WMF	1d67abe1ec08e6215e08d6bb595ade3d1d33d0e886edf887b29f4d8e1d46e593.exe
File opened for modification	C:\Program Files\Microsoft Office\CLIPART\PUB60COR\PH03014_.GIF.tkoinprz	1d67abe1ec08e6215e08d6bb595ade3d1d33d0e886edf887b29f4d8e1d46e593.exe
File opened for modification	C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0152590.WMF	1d67abe1ec08e6215e08d6bb595ade3d1d33d0e886edf887b29f4d8e1d46e593.exe
File opened for modification	C:\Program Files\Microsoft Office\CLIPART\PUB60COR\TN00330_.WMF	1d67abe1ec08e6215e08d6bb595ade3d1d33d0e886edf887b29f4d8e1d46e593.exe
File opened for modification	C:\Program Files\Microsoft Office\Office14\PUBWIZ\CERT.DPV	1d67abe1ec08e6215e08d6bb595ade3d1d33d0e886edf887b29f4d8e1d46e593.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-openide-dialogs.xml.tkoinprz	1d67abe1ec08e6215e08d6bb595ade3d1d33d0e886edf887b29f4d8e1d46e593.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\America\Argentina\Buenos_Aires.tkoinprz	1d67abe1ec08e6215e08d6bb595ade3d1d33d0e886edf887b29f4d8e1d46e593.exe
File opened for modification	C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BL00148_.WMF.tkoinprz	1d67abe1ec08e6215e08d6bb595ade3d1d33d0e886edf887b29f4d8e1d46e593.exe
File opened for modification	C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0105328.WMF	1d67abe1ec08e6215e08d6bb595ade3d1d33d0e886edf887b29f4d8e1d46e593.exe
File created	C:\Program Files\Microsoft Office\Document Themes 14\Theme Fonts\HOW TO RESTORE YOUR FILES.TXT	1d67abe1ec08e6215e08d6bb595ade3d1d33d0e886edf887b29f4d8e1d46e593.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.directorywatcher.nl_zh_4.4.0.v20140623020002.jar	1d67abe1ec08e6215e08d6bb595ade3d1d33d0e886edf887b29f4d8e1d46e593.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-jvmstat_zh_CN.jar	1d67abe1ec08e6215e08d6bb595ade3d1d33d0e886edf887b29f4d8e1d46e593.exe
File opened for modification	C:\Program Files\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Desert.css	1d67abe1ec08e6215e08d6bb595ade3d1d33d0e886edf887b29f4d8e1d46e593.exe
File created	C:\Program Files\VideoLAN\VLC\locale\si\LC_MESSAGES\HOW TO RESTORE YOUR FILES.TXT	1d67abe1ec08e6215e08d6bb595ade3d1d33d0e886edf887b29f4d8e1d46e593.exe
File opened for modification	C:\Program Files\Microsoft Office\CLIPART\PUB60COR\FD00564_.WMF.tkoinprz	1d67abe1ec08e6215e08d6bb595ade3d1d33d0e886edf887b29f4d8e1d46e593.exe
File opened for modification	C:\Program Files\Microsoft Office\CLIPART\PUB60COR\SO02025_.WMF.tkoinprz	1d67abe1ec08e6215e08d6bb595ade3d1d33d0e886edf887b29f4d8e1d46e593.exe
File opened for modification	C:\Program Files\Microsoft Office\Office14\Groove\Sounds\Things\SPLASH.WAV	1d67abe1ec08e6215e08d6bb595ade3d1d33d0e886edf887b29f4d8e1d46e593.exe
File opened for modification	C:\Program Files\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Biscay\TAB_ON.GIF.tkoinprz	1d67abe1ec08e6215e08d6bb595ade3d1d33d0e886edf887b29f4d8e1d46e593.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Antarctica\Mawson.tkoinprz	1d67abe1ec08e6215e08d6bb595ade3d1d33d0e886edf887b29f4d8e1d46e593.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\images\winXPBlue.png.tkoinprz	1d67abe1ec08e6215e08d6bb595ade3d1d33d0e886edf887b29f4d8e1d46e593.exe
File opened for modification	C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0151041.WMF.tkoinprz	1d67abe1ec08e6215e08d6bb595ade3d1d33d0e886edf887b29f4d8e1d46e593.exe
File opened for modification	C:\Program Files\Microsoft Office\CLIPART\PUB60COR\TR00494_.WMF.tkoinprz	1d67abe1ec08e6215e08d6bb595ade3d1d33d0e886edf887b29f4d8e1d46e593.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\audio_mixer\HOW TO RESTORE YOUR FILES.TXT	1d67abe1ec08e6215e08d6bb595ade3d1d33d0e886edf887b29f4d8e1d46e593.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.forms_3.6.100.v20140422-1825.jar.tkoinprz	1d67abe1ec08e6215e08d6bb595ade3d1d33d0e886edf887b29f4d8e1d46e593.exe
File opened for modification	C:\Program Files\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD14830_.GIF.tkoinprz	1d67abe1ec08e6215e08d6bb595ade3d1d33d0e886edf887b29f4d8e1d46e593.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware

Data from Local System
T1005

Credentials in Files
T1081

Drops startup file 2 IoCs

Processes:

1d67abe1ec08e6215e08d6bb595ade3d1d33d0e886edf887b29f4d8e1d46e593.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\HOW TO RESTORE YOUR FILES.TXT	1d67abe1ec08e6215e08d6bb595ade3d1d33d0e886edf887b29f4d8e1d46e593.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\HOW TO RESTORE YOUR FILES.TXT	1d67abe1ec08e6215e08d6bb595ade3d1d33d0e886edf887b29f4d8e1d46e593.exe

C:\Users\Admin\AppData\Local\Temp\1d67abe1ec08e6215e08d6bb595ade3d1d33d0e886edf887b29f4d8e1d46e593.exe
"C:\Users\Admin\AppData\Local\Temp\1d67abe1ec08e6215e08d6bb595ade3d1d33d0e886edf887b29f4d8e1d46e593.exe"
1⤵
- Suspicious use of WriteProcessMemory
- Drops file in Program Files directory
- Drops startup file
PID:900