Overview

overview

10

Static

static

895vv53.exe

windows7_x64

10

895vv53.exe

windows10_x64

3

Analysis

  • max time kernel
    134s
  • max time network
    67s
  • platform
    windows7_x64
  • resource
    win7
  • submitted
    13/07/2020, 09:35

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    895vv53.exe
  • Size 156KB
  • Sample200713-capbkejmcs
  • SHA256 77ed644af65306cd4cea3eddf6019e5626fe16cbbd0f8c49d76dd21e9683ae5f
  • MD5 SHA1 SHA512
Score
10/10
ransomwarepersistencespyware

Malware Config

Extracted

Path

  • C:\MSOCache\All Users\{90140000-0011-0000-1000-0000000FF1CE}-C\Read_Me.txt

Ransom Note
  • Attention! All your files, documents, photos, databases and other important files are encrypted The only method of recovering files is to purchase an unique decryptor. Only we can give you this decryptor and only we can recover your files. The server with your decryptor is in a closed network TOR. You can get there by the following ways: ---------------------------------------------------------------------------------------- 1. Download Tor browser - https://www.torproject.org/ 2. Install Tor browser 3. Open Tor Browser 4. Open link in TOR browser: http://7rzpyw3hflwe2c7h.onion/?AAAAAAAA 5. Follow the instructions on this page ---------------------------------------------------------------------------------------- On our page you will see instructions on payment and get the opportunity to decrypt 1 file for free. Alternate communication channel here: http://helpqvrg3cc5mvb3.onion/
URLs

  • http://7rzpyw3hflwe2c7h.onion/?AAAAAAAA

  • http://helpqvrg3cc5mvb3.onion/

Signatures

  • Modifies service 2 TTPs 4 IoCs
    persistence
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spyware
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Drops file in Windows directory 42 IoCs
  • Suspicious use of FindShellTrayWindow 82 IoCs
  • Modifies Installed Components in the registry 2 TTPs 4 IoCs
    persistence
  • Modifies registry class 208 IoCs
  • Registers COM server for autorun 1 TTPs 24 IoCs
    persistence
  • Suspicious use of WriteProcessMemory 27 IoCs
  • Suspicious behavior: EnumeratesProcesses 4530 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Drops desktop.ini file(s) 41 IoCs
  • Loads dropped DLL 43 IoCs
  • Enumerates connected drives 3 TTPs
  • Drops startup file 1 IoCs
  • Drops file in Program Files directory 12094 IoCs
  • Modifies data under HKEY_USERS 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 1006 IoCs
  • Suspicious use of SendNotifyMessage 88 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\895vv53.exe
    "C:\Users\Admin\AppData\Local\Temp\895vv53.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    • Suspicious use of SetThreadContext
    PID:1324
    • C:\Users\Admin\AppData\Local\Temp\895vv53.exe
      "{path}"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Drops desktop.ini file(s)
      • Drops startup file
      • Drops file in Program Files directory
      PID:108
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Modifies service
    • Suspicious use of FindShellTrayWindow
    • Modifies Installed Components in the registry
    • Modifies registry class
    • Drops desktop.ini file(s)
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SendNotifyMessage
    PID:1380
  • C:\Windows\system32\msiexec.exe
    C:\Windows\system32\msiexec.exe /V
    1⤵
    • Drops file in Windows directory
    • Modifies registry class
    • Registers COM server for autorun
    • Suspicious use of WriteProcessMemory
    • Loads dropped DLL
    • Modifies data under HKEY_USERS
    • Suspicious use of AdjustPrivilegeToken
    PID:1112
    • C:\Windows\system32\MsiExec.exe
      C:\Windows\system32\MsiExec.exe -Embedding E18103B7BA71D424A7275E29B249A1A3
      2⤵
      • Loads dropped DLL
      PID:736
    • C:\Windows\syswow64\MsiExec.exe
      C:\Windows\syswow64\MsiExec.exe -Embedding A0DC8CF3F87DE9810CAD63338E2E70D0
      2⤵
      • Loads dropped DLL
      PID:1484
    • C:\Windows\system32\MsiExec.exe
      C:\Windows\system32\MsiExec.exe -Embedding 7657DCE80F1503058BB6409681430E6A M Global\MSI0000
      2⤵
      • Loads dropped DLL
      PID:1932
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Suspicious use of FindShellTrayWindow
    • Modifies Installed Components in the registry
    • Modifies registry class
    • Suspicious use of SendNotifyMessage
    PID:1384
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Suspicious use of FindShellTrayWindow
    • Modifies Installed Components in the registry
    • Modifies registry class
    • Loads dropped DLL
    • Suspicious use of SendNotifyMessage
    PID:2028
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Modifies service
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of FindShellTrayWindow
    • Modifies Installed Components in the registry
    • Modifies registry class
    • Suspicious use of SendNotifyMessage
    PID:1796

Network

        MITRE ATT&CK Enterprise v6

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        memory/108-4-0x0000000000400000-0x000000000041E000-memory.dmp
        Download

        memory/108-2-0x0000000000400000-0x000000000041E000-memory.dmp
        Download

        memory/1112-116-0x0000000000DB0000-0x0000000000DB4000-memory.dmp
        Download

        memory/1112-139-0x0000000005BE0000-0x0000000005BE4000-memory.dmp
        Download

        memory/1112-96-0x0000000000DB0000-0x0000000000DB4000-memory.dmp
        Download

        memory/1112-145-0x0000000005BE0000-0x0000000005BE4000-memory.dmp
        Download

        memory/1112-147-0x0000000000DB0000-0x0000000000DB4000-memory.dmp
        Download

        memory/1112-148-0x0000000001330000-0x0000000001334000-memory.dmp
        Download

        memory/1112-86-0x00000000010B0000-0x00000000010B4000-memory.dmp
        Download

        memory/1112-87-0x0000000000DB0000-0x0000000000DB4000-memory.dmp
        Download

        memory/1380-7-0x0000000009700000-0x0000000009704000-memory.dmp
        Download

        memory/1380-8-0x0000000004F00000-0x0000000004F04000-memory.dmp
        Download

        memory/1380-5-0x0000000003C80000-0x0000000003C81000-memory.dmp
        Download

        memory/1380-6-0x0000000003C80000-0x0000000003C81000-memory.dmp
        Download

        memory/1384-32-0x00000000095A0000-0x00000000095A4000-memory.dmp
        Download

        memory/1384-33-0x0000000004FE0000-0x0000000004FE4000-memory.dmp
        Download

        memory/1384-28-0x0000000003B60000-0x0000000003B61000-memory.dmp
        Download

        memory/1384-30-0x0000000003B60000-0x0000000003B61000-memory.dmp
        Download

        memory/1796-150-0x00000000040F0000-0x00000000040F1000-memory.dmp
        Download

        memory/2028-42-0x0000000003F60000-0x0000000003F61000-memory.dmp
        Download

        memory/2028-43-0x0000000009160000-0x0000000009164000-memory.dmp
        Download

        memory/2028-44-0x0000000004BA0000-0x0000000004BA4000-memory.dmp
        Download