Analysis
-
max time kernel
140s -
max time network
54s -
platform
windows10_x64 -
resource
win10v200722 -
submitted
04-08-2020 07:15
Static task
static1
Behavioral task
behavioral1
Sample
1ee39f6cd500940ad97c444778dc717361e01ce5579a28d761aedae86e85af64.exe
Resource
win7
Behavioral task
behavioral2
Sample
1ee39f6cd500940ad97c444778dc717361e01ce5579a28d761aedae86e85af64.exe
Resource
win10v200722
General
-
Target
1ee39f6cd500940ad97c444778dc717361e01ce5579a28d761aedae86e85af64.exe
-
Size
5.7MB
-
MD5
e3204b2e61223989b1562f5dee40eee0
-
SHA1
7bd50a3b0e3f9b4a543f750869ca3ee29b4798e1
-
SHA256
1ee39f6cd500940ad97c444778dc717361e01ce5579a28d761aedae86e85af64
-
SHA512
19df0eb4c803e6eeb41abb1fb425f4d9cd6e4262aaeb8bbf7eb959a30f3db2533fd6aed13e055a9781371e9de37de4212d80a32862798368e5dd798763012bc4
Malware Config
Extracted
C:\Boot\bg-BG\read_me.txt
death@firemail.cc
death@cumallover.me
Signatures
-
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
Processes:
1ee39f6cd500940ad97c444778dc717361e01ce5579a28d761aedae86e85af64.exepid process 3984 1ee39f6cd500940ad97c444778dc717361e01ce5579a28d761aedae86e85af64.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
1ee39f6cd500940ad97c444778dc717361e01ce5579a28d761aedae86e85af64.exepid process 3984 1ee39f6cd500940ad97c444778dc717361e01ce5579a28d761aedae86e85af64.exe 3984 1ee39f6cd500940ad97c444778dc717361e01ce5579a28d761aedae86e85af64.exe -
Drops desktop.ini file(s) 23 IoCs
Processes:
1ee39f6cd500940ad97c444778dc717361e01ce5579a28d761aedae86e85af64.exedescription ioc process File opened for modification C:\Users\Admin\Music\desktop.ini 1ee39f6cd500940ad97c444778dc717361e01ce5579a28d761aedae86e85af64.exe File opened for modification C:\Users\Admin\Pictures\Saved Pictures\desktop.ini 1ee39f6cd500940ad97c444778dc717361e01ce5579a28d761aedae86e85af64.exe File opened for modification C:\Users\Admin\Pictures\desktop.ini 1ee39f6cd500940ad97c444778dc717361e01ce5579a28d761aedae86e85af64.exe File opened for modification C:\Users\Public\Videos\desktop.ini 1ee39f6cd500940ad97c444778dc717361e01ce5579a28d761aedae86e85af64.exe File opened for modification C:\Users\Admin\Desktop\desktop.ini 1ee39f6cd500940ad97c444778dc717361e01ce5579a28d761aedae86e85af64.exe File opened for modification C:\Users\Admin\Downloads\desktop.ini 1ee39f6cd500940ad97c444778dc717361e01ce5579a28d761aedae86e85af64.exe File opened for modification C:\Users\Public\desktop.ini 1ee39f6cd500940ad97c444778dc717361e01ce5579a28d761aedae86e85af64.exe File opened for modification C:\Users\Public\Desktop\desktop.ini 1ee39f6cd500940ad97c444778dc717361e01ce5579a28d761aedae86e85af64.exe File opened for modification C:\Users\Public\Documents\desktop.ini 1ee39f6cd500940ad97c444778dc717361e01ce5579a28d761aedae86e85af64.exe File opened for modification C:\Users\Admin\Contacts\desktop.ini 1ee39f6cd500940ad97c444778dc717361e01ce5579a28d761aedae86e85af64.exe File opened for modification C:\Users\Admin\Favorites\desktop.ini 1ee39f6cd500940ad97c444778dc717361e01ce5579a28d761aedae86e85af64.exe File opened for modification C:\Users\Admin\Favorites\Links\desktop.ini 1ee39f6cd500940ad97c444778dc717361e01ce5579a28d761aedae86e85af64.exe File opened for modification C:\Users\Admin\OneDrive\desktop.ini 1ee39f6cd500940ad97c444778dc717361e01ce5579a28d761aedae86e85af64.exe File opened for modification C:\Users\Admin\Saved Games\desktop.ini 1ee39f6cd500940ad97c444778dc717361e01ce5579a28d761aedae86e85af64.exe File opened for modification C:\Users\Admin\Searches\desktop.ini 1ee39f6cd500940ad97c444778dc717361e01ce5579a28d761aedae86e85af64.exe File opened for modification C:\Users\Public\Downloads\desktop.ini 1ee39f6cd500940ad97c444778dc717361e01ce5579a28d761aedae86e85af64.exe File opened for modification C:\Users\Public\Libraries\desktop.ini 1ee39f6cd500940ad97c444778dc717361e01ce5579a28d761aedae86e85af64.exe File opened for modification C:\Users\Admin\Documents\desktop.ini 1ee39f6cd500940ad97c444778dc717361e01ce5579a28d761aedae86e85af64.exe File opened for modification C:\Users\Public\Pictures\desktop.ini 1ee39f6cd500940ad97c444778dc717361e01ce5579a28d761aedae86e85af64.exe File opened for modification C:\Users\Admin\Pictures\Camera Roll\desktop.ini 1ee39f6cd500940ad97c444778dc717361e01ce5579a28d761aedae86e85af64.exe File opened for modification C:\Users\Public\AccountPictures\desktop.ini 1ee39f6cd500940ad97c444778dc717361e01ce5579a28d761aedae86e85af64.exe File opened for modification C:\Users\Public\Music\desktop.ini 1ee39f6cd500940ad97c444778dc717361e01ce5579a28d761aedae86e85af64.exe File opened for modification C:\Users\Admin\Links\desktop.ini 1ee39f6cd500940ad97c444778dc717361e01ce5579a28d761aedae86e85af64.exe -
Modifies extensions of user files 10 IoCs
Ransomware generally changes the extension on encrypted files.
Processes:
1ee39f6cd500940ad97c444778dc717361e01ce5579a28d761aedae86e85af64.exedescription ioc process File renamed C:\Users\Admin\Pictures\CheckpointSuspend.png => C:\Users\Admin\Pictures\CheckpointSuspend.png.wctc 1ee39f6cd500940ad97c444778dc717361e01ce5579a28d761aedae86e85af64.exe File opened for modification C:\Users\Admin\Pictures\LockBackup.tiff 1ee39f6cd500940ad97c444778dc717361e01ce5579a28d761aedae86e85af64.exe File opened for modification C:\Users\Admin\Pictures\ResolveFind.tiff 1ee39f6cd500940ad97c444778dc717361e01ce5579a28d761aedae86e85af64.exe File renamed C:\Users\Admin\Pictures\ResolveFind.tiff => C:\Users\Admin\Pictures\ResolveFind.tiff.wctc 1ee39f6cd500940ad97c444778dc717361e01ce5579a28d761aedae86e85af64.exe File renamed C:\Users\Admin\Pictures\ExportSwitch.png => C:\Users\Admin\Pictures\ExportSwitch.png.wctc 1ee39f6cd500940ad97c444778dc717361e01ce5579a28d761aedae86e85af64.exe File renamed C:\Users\Admin\Pictures\GrantProtect.png => C:\Users\Admin\Pictures\GrantProtect.png.wctc 1ee39f6cd500940ad97c444778dc717361e01ce5579a28d761aedae86e85af64.exe File renamed C:\Users\Admin\Pictures\HideSuspend.tif => C:\Users\Admin\Pictures\HideSuspend.tif.wctc 1ee39f6cd500940ad97c444778dc717361e01ce5579a28d761aedae86e85af64.exe File renamed C:\Users\Admin\Pictures\LockBackup.tiff => C:\Users\Admin\Pictures\LockBackup.tiff.wctc 1ee39f6cd500940ad97c444778dc717361e01ce5579a28d761aedae86e85af64.exe File opened for modification C:\Users\Admin\Pictures\RedoHide.tiff 1ee39f6cd500940ad97c444778dc717361e01ce5579a28d761aedae86e85af64.exe File renamed C:\Users\Admin\Pictures\RedoHide.tiff => C:\Users\Admin\Pictures\RedoHide.tiff.wctc 1ee39f6cd500940ad97c444778dc717361e01ce5579a28d761aedae86e85af64.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\1ee39f6cd500940ad97c444778dc717361e01ce5579a28d761aedae86e85af64.exe"C:\Users\Admin\AppData\Local\Temp\1ee39f6cd500940ad97c444778dc717361e01ce5579a28d761aedae86e85af64.exe"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Drops desktop.ini file(s)
- Modifies extensions of user files