Overview

overview

10

Static

static

DCryptSoft.bin.exe

windows7_x64

10

DCryptSoft.bin.exe

windows10_x64

10

Analysis

  • max time kernel
    124s
  • max time network
    70s
  • platform
    windows7_x64
  • resource
    win7v200722
  • submitted
    14-08-2020 10:41

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    DCryptSoft.bin.exe

  • Size

    106KB

  • MD5

    8ba537f8d00a73d6cc1cc5dffa566ed1

  • SHA1

    08419f52af8acc1bdac239bd65f64414597a8d96

  • SHA256

    aac2024789ffd2bfce97d6a509136ecf7c43b18c2a83280b596e62d988cedb10

  • SHA512

    7bc28f475d504e945d690ad998987d4184269dac8f7470842f356a50f9ff59dd1595b6cf87b2015844d7c3cf84e39f989a648700d28561251dc59428177a14f7

Score
10/10
ransomwarepersistencespyware

Malware Config

Extracted

Path

\??\M:\Boot\cs-CZ\Read_Me.txt

Ransom Note
Attention! All your files, documents, photos, databases and other important files are encrypted The only method of recovering files is to purchase an unique decryptor. Only we can give you this decryptor and only we can recover your files. The server with your decryptor is in a closed network TOR. You can get there by the following ways: ---------------------------------------------------------------------------------------- 1. Download Tor browser - https://www.torproject.org/ 2. Install Tor browser 3. Open Tor Browser 4. Open link in TOR browser: http://54fjmcwsszltlixn.onion/?QQQQQQQQ 5. Follow the instructions on this page ---------------------------------------------------------------------------------------- On our page you will see instructions on payment and get the opportunity to decrypt 1 file for free. Alternate communication channel here: http://helpqvrg3cc5mvb3.onion/
URLs

http://54fjmcwsszltlixn.onion/?QQQQQQQQ

http://helpqvrg3cc5mvb3.onion/

Signatures

  • Registers COM server for autorun 1 TTPs
    persistence
  • Modifies Installed Components in the registry 2 TTPs
    persistence
  • Modifies extensions of user files 3 IoCs

    Ransomware generally changes the extension on encrypted files.

    ransomware
  • Drops startup file 1 IoCs
  • Loads dropped DLL 42 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spyware
  • Drops desktop.ini file(s) 41 IoCs
  • Enumerates connected drives 3 TTPs
  • JavaScript code in executable 5 IoCs
  • Modifies service 2 TTPs 4 IoCs
    persistence
  • Drops file in Program Files directory 12075 IoCs
  • Drops file in Windows directory 44 IoCs
  • Modifies data under HKEY_USERS 3 IoCs
  • Modifies registry class 268 IoCs
  • Suspicious behavior: EnumeratesProcesses 4514 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1089 IoCs
  • Suspicious use of FindShellTrayWindow 98 IoCs
  • Suspicious use of SendNotifyMessage 115 IoCs
  • Suspicious use of WriteProcessMemory 32 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\DCryptSoft.bin.exe
    "C:\Users\Admin\AppData\Local\Temp\DCryptSoft.bin.exe"
    1⤵
    • Modifies extensions of user files
    • Drops startup file
    • Drops desktop.ini file(s)
    • Drops file in Program Files directory
    • Suspicious behavior: EnumeratesProcesses
    PID:828
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Drops desktop.ini file(s)
    • Modifies service
    • Modifies registry class
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    PID:796
  • C:\Windows\system32\msiexec.exe
    C:\Windows\system32\msiexec.exe /V
    1⤵
    • Drops file in Windows directory
    • Modifies data under HKEY_USERS
    • Modifies registry class
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1684
    • C:\Windows\system32\MsiExec.exe
      C:\Windows\system32\MsiExec.exe -Embedding 4927525E2EA4DF38A1EE24C2E156BBDF
      2⤵
      • Loads dropped DLL
      PID:1944
    • C:\Windows\syswow64\MsiExec.exe
      C:\Windows\syswow64\MsiExec.exe -Embedding 714E150F4331D8FC73C1F3245146333C
      2⤵
      • Loads dropped DLL
      PID:864
    • C:\Windows\system32\MsiExec.exe
      C:\Windows\system32\MsiExec.exe -Embedding B66CA7BBB76453ADF451DE3285AD22DD M Global\MSI0000
      2⤵
      • Loads dropped DLL
      PID:1880
    • C:\Windows\syswow64\MsiExec.exe
      C:\Windows\syswow64\MsiExec.exe -Embedding D00ED027D9C1D40072F54DA87F32A331 M Global\MSI0000
      2⤵
      • Loads dropped DLL
      • Suspicious use of WriteProcessMemory
      PID:1668
      • C:\Windows\syswow64\wevtutil.exe
        "wevtutil.exe" im "C:\Program Files\Microsoft Office\Office14\BCSEvents.man"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:1992
        • C:\Windows\System32\wevtutil.exe
          "wevtutil.exe" im "C:\Program Files\Microsoft Office\Office14\BCSEvents.man" /fromwow64
          4⤵
            PID:1612
    • C:\Windows\explorer.exe
      explorer.exe
      1⤵
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:1412
    • C:\Windows\explorer.exe
      explorer.exe
      1⤵
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:1380
    • C:\Windows\explorer.exe
      explorer.exe
      1⤵
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:1904
    • C:\Windows\explorer.exe
      explorer.exe
      1⤵
      • Modifies registry class
      PID:2036
    • C:\Windows\explorer.exe
      explorer.exe
      1⤵
      • Modifies service
      • Modifies registry class
      • Suspicious behavior: GetForegroundWindowSpam
      PID:976

    Network

    MITRE ATT&CK Matrix ATT&CK v6

    Initial Access

    Execution

    Persistence

    Registry Run Keys / Startup Folder

    2
    T1060

    Modify Existing Service

    1
    T1031

    Privilege Escalation

    Defense Evasion

    Modify Registry

    2
    T1112

    Credential Access

    Credentials in Files

    1
    T1081

    Discovery

    Query Registry

    1
    T1012

    Peripheral Device Discovery

    1
    T1120

    System Information Discovery

    1
    T1082

    Lateral Movement

    Collection

    Data from Local System

    1
    T1005

    Exfiltration

    Command and Control

    Impact

    Replay Monitor

    Loading Replay Monitor...

    Downloads