Analysis
-
max time kernel
100s -
max time network
116s -
platform
windows10_x64 -
resource
win10 -
submitted
23/08/2020, 17:14
Static task
static1
Behavioral task
behavioral1
Sample
DirectX_Update.bin.exe
Resource
win7v200722
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
DirectX_Update.bin.exe
Resource
win10
windows10_x64
0 signatures
0 seconds
General
-
Target
DirectX_Update.bin.exe
-
Size
401KB
-
MD5
feaccffc7990693228933d5a5f67b833
-
SHA1
adcad8fe079bfcfdcf09cca72920d5e93d61594a
-
SHA256
30718dcdb6fc8e48a442f5b1f63e413e69f6cf2a279fed1c7c80e9517a133317
-
SHA512
739151a037f3a27699c4f14df4e613e0f86bc6e39988fbceb978935c6a048de3c4ce8117b413a17bc8a1a1d0f4dbb5867a96eb5d0fa369c020a8c39e40535c03
Score
10/10
Malware Config
Extracted
Path
C:\ATTENTION-acbbf-README.txt
Ransom Note
Sorry, but your files are locked due to a critical error in your system. If you yourself want to decrypt the files - you will lose them FOREVER.
You have to pay BITCOINS to get your file decoder. DO NOT TAKE TIME, you have SEVERAL DAYS to pay, otherwise the cost of the decoder will double. How to do it is written below.
If you cannot do it yourself, then search the Internet for file recovery services in your country or city.
Go to the page through the browser: http://restore-now.top/online-chat/
If your site does not open, then download the TOR browser (https://torproject.org/). If you can�t access the download page of the TOR browser, then download the VPN!
After you install the TOR browser on your computer go to the site: http://i6jppiczqa5moqfl57gssi33npwfseqppdsnz7rriiv7suf4pf4w42id.onion
After going to the site, enter the information:
Your ID: 09302895631
Personal key: aGppaW0oSGt0cHUoN0A6Nzk/QDw9OjgoSkEnOTw8Njk6PydOaUM2aXlFJw==
Your Email
URLs
http://restore-now.top/online-chat/
http://i6jppiczqa5moqfl57gssi33npwfseqppdsnz7rriiv7suf4pf4w42id.onion
Signatures
-
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Modifies extensions of user files 7 IoCs
Ransomware generally changes the extension on encrypted files.
description ioc Process File renamed C:\Users\Admin\Pictures\GrantUnlock.raw => C:\Users\Admin\Pictures\GrantUnlock.raw.acbbf DirectX_Update.bin.exe File opened for modification C:\Users\Admin\Pictures\ResolveSwitch.tiff DirectX_Update.bin.exe File renamed C:\Users\Admin\Pictures\ResolveSwitch.tiff => C:\Users\Admin\Pictures\ResolveSwitch.tiff.acbbf DirectX_Update.bin.exe File renamed C:\Users\Admin\Pictures\StepConvertFrom.raw => C:\Users\Admin\Pictures\StepConvertFrom.raw.acbbf DirectX_Update.bin.exe File renamed C:\Users\Admin\Pictures\ApproveAssert.crw => C:\Users\Admin\Pictures\ApproveAssert.crw.acbbf DirectX_Update.bin.exe File renamed C:\Users\Admin\Pictures\DisableUnregister.tif => C:\Users\Admin\Pictures\DisableUnregister.tif.acbbf DirectX_Update.bin.exe File renamed C:\Users\Admin\Pictures\DismountSplit.tif => C:\Users\Admin\Pictures\DismountSplit.tif.acbbf DirectX_Update.bin.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run DirectX_Update.bin.exe Set value (str) \REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Windows\CurrentVersion\Run\Fuck_this_PC = "C:\\Users\\Admin\\AppData\\Local\\Temp\\DirectX_Update.bin.exe" DirectX_Update.bin.exe -
Drops desktop.ini file(s) 24 IoCs
description ioc Process File created C:\Users\Admin\Videos\desktop.ini DirectX_Update.bin.exe File created C:\Users\Public\desktop.ini DirectX_Update.bin.exe File created C:\Users\Admin\Documents\desktop.ini DirectX_Update.bin.exe File created C:\Users\Admin\Downloads\desktop.ini DirectX_Update.bin.exe File created C:\Users\Admin\Links\desktop.ini DirectX_Update.bin.exe File created C:\Users\Admin\Pictures\Camera Roll\desktop.ini DirectX_Update.bin.exe File created C:\Users\Admin\Saved Games\desktop.ini DirectX_Update.bin.exe File created C:\Users\Admin\Searches\desktop.ini DirectX_Update.bin.exe File created C:\Users\Public\Documents\desktop.ini DirectX_Update.bin.exe File created C:\Users\Public\Libraries\desktop.ini DirectX_Update.bin.exe File created C:\Users\Admin\Contacts\desktop.ini DirectX_Update.bin.exe File created C:\Users\Admin\Favorites\desktop.ini DirectX_Update.bin.exe File created C:\Users\Admin\OneDrive\desktop.ini DirectX_Update.bin.exe File created C:\Users\Admin\Pictures\desktop.ini DirectX_Update.bin.exe File created C:\Users\Public\AccountPictures\desktop.ini DirectX_Update.bin.exe File created C:\Users\Public\Desktop\desktop.ini DirectX_Update.bin.exe File created C:\Users\Public\Videos\desktop.ini DirectX_Update.bin.exe File created C:\Users\Public\Pictures\desktop.ini DirectX_Update.bin.exe File created C:\Users\Admin\Desktop\desktop.ini DirectX_Update.bin.exe File created C:\Users\Admin\Favorites\Links\desktop.ini DirectX_Update.bin.exe File created C:\Users\Admin\Music\desktop.ini DirectX_Update.bin.exe File created C:\Users\Admin\Pictures\Saved Pictures\desktop.ini DirectX_Update.bin.exe File created C:\Users\Public\Downloads\desktop.ini DirectX_Update.bin.exe File created C:\Users\Public\Music\desktop.ini DirectX_Update.bin.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Modifies service 2 TTPs 4 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\Registry Writer vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\COM+ REGDB Writer vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\ASR Writer vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\Shadow Copy Optimization Writer vssvc.exe -
Enumerates system info in registry 2 TTPs 2 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\DiskController\0\DiskPeripheral\0\Identifier DirectX_Update.bin.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\DiskController\0\DiskPeripheral\0 DirectX_Update.bin.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3588 DirectX_Update.bin.exe 3588 DirectX_Update.bin.exe 3588 DirectX_Update.bin.exe 3588 DirectX_Update.bin.exe 3588 DirectX_Update.bin.exe 3588 DirectX_Update.bin.exe 3588 DirectX_Update.bin.exe 3588 DirectX_Update.bin.exe 3588 DirectX_Update.bin.exe 3588 DirectX_Update.bin.exe 3588 DirectX_Update.bin.exe 3588 DirectX_Update.bin.exe 3588 DirectX_Update.bin.exe 3588 DirectX_Update.bin.exe 3588 DirectX_Update.bin.exe 3588 DirectX_Update.bin.exe 3588 DirectX_Update.bin.exe 3588 DirectX_Update.bin.exe 3588 DirectX_Update.bin.exe 3588 DirectX_Update.bin.exe 3588 DirectX_Update.bin.exe 3588 DirectX_Update.bin.exe 3588 DirectX_Update.bin.exe 3588 DirectX_Update.bin.exe 3588 DirectX_Update.bin.exe 3588 DirectX_Update.bin.exe 3588 DirectX_Update.bin.exe 3588 DirectX_Update.bin.exe 3588 DirectX_Update.bin.exe 3588 DirectX_Update.bin.exe 3588 DirectX_Update.bin.exe 3588 DirectX_Update.bin.exe 3588 DirectX_Update.bin.exe 3588 DirectX_Update.bin.exe 3588 DirectX_Update.bin.exe 3588 DirectX_Update.bin.exe 3588 DirectX_Update.bin.exe 3588 DirectX_Update.bin.exe 3588 DirectX_Update.bin.exe 3588 DirectX_Update.bin.exe 3588 DirectX_Update.bin.exe 3588 DirectX_Update.bin.exe 3588 DirectX_Update.bin.exe 3588 DirectX_Update.bin.exe 3588 DirectX_Update.bin.exe 3588 DirectX_Update.bin.exe 3588 DirectX_Update.bin.exe 3588 DirectX_Update.bin.exe 3588 DirectX_Update.bin.exe 3588 DirectX_Update.bin.exe 3588 DirectX_Update.bin.exe 3588 DirectX_Update.bin.exe 3588 DirectX_Update.bin.exe 3588 DirectX_Update.bin.exe 3588 DirectX_Update.bin.exe 3588 DirectX_Update.bin.exe 3588 DirectX_Update.bin.exe 3588 DirectX_Update.bin.exe 3588 DirectX_Update.bin.exe 3588 DirectX_Update.bin.exe 3588 DirectX_Update.bin.exe 3588 DirectX_Update.bin.exe 3588 DirectX_Update.bin.exe 3588 DirectX_Update.bin.exe -
Suspicious use of AdjustPrivilegeToken 45 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 504 WMIC.exe Token: SeSecurityPrivilege 504 WMIC.exe Token: SeTakeOwnershipPrivilege 504 WMIC.exe Token: SeLoadDriverPrivilege 504 WMIC.exe Token: SeSystemProfilePrivilege 504 WMIC.exe Token: SeSystemtimePrivilege 504 WMIC.exe Token: SeProfSingleProcessPrivilege 504 WMIC.exe Token: SeIncBasePriorityPrivilege 504 WMIC.exe Token: SeCreatePagefilePrivilege 504 WMIC.exe Token: SeBackupPrivilege 504 WMIC.exe Token: SeRestorePrivilege 504 WMIC.exe Token: SeShutdownPrivilege 504 WMIC.exe Token: SeDebugPrivilege 504 WMIC.exe Token: SeSystemEnvironmentPrivilege 504 WMIC.exe Token: SeRemoteShutdownPrivilege 504 WMIC.exe Token: SeUndockPrivilege 504 WMIC.exe Token: SeManageVolumePrivilege 504 WMIC.exe Token: 33 504 WMIC.exe Token: 34 504 WMIC.exe Token: 35 504 WMIC.exe Token: 36 504 WMIC.exe Token: SeIncreaseQuotaPrivilege 504 WMIC.exe Token: SeSecurityPrivilege 504 WMIC.exe Token: SeTakeOwnershipPrivilege 504 WMIC.exe Token: SeLoadDriverPrivilege 504 WMIC.exe Token: SeSystemProfilePrivilege 504 WMIC.exe Token: SeSystemtimePrivilege 504 WMIC.exe Token: SeProfSingleProcessPrivilege 504 WMIC.exe Token: SeIncBasePriorityPrivilege 504 WMIC.exe Token: SeCreatePagefilePrivilege 504 WMIC.exe Token: SeBackupPrivilege 504 WMIC.exe Token: SeRestorePrivilege 504 WMIC.exe Token: SeShutdownPrivilege 504 WMIC.exe Token: SeDebugPrivilege 504 WMIC.exe Token: SeSystemEnvironmentPrivilege 504 WMIC.exe Token: SeRemoteShutdownPrivilege 504 WMIC.exe Token: SeUndockPrivilege 504 WMIC.exe Token: SeManageVolumePrivilege 504 WMIC.exe Token: 33 504 WMIC.exe Token: 34 504 WMIC.exe Token: 35 504 WMIC.exe Token: 36 504 WMIC.exe Token: SeBackupPrivilege 376 vssvc.exe Token: SeRestorePrivilege 376 vssvc.exe Token: SeAuditPrivilege 376 vssvc.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 3588 wrote to memory of 2204 3588 DirectX_Update.bin.exe 68 PID 3588 wrote to memory of 2204 3588 DirectX_Update.bin.exe 68 PID 3588 wrote to memory of 2204 3588 DirectX_Update.bin.exe 68 PID 2204 wrote to memory of 504 2204 cmd.exe 70 PID 2204 wrote to memory of 504 2204 cmd.exe 70 PID 2204 wrote to memory of 504 2204 cmd.exe 70
Processes
-
C:\Users\Admin\AppData\Local\Temp\DirectX_Update.bin.exe"C:\Users\Admin\AppData\Local\Temp\DirectX_Update.bin.exe"1⤵
- Modifies extensions of user files
- Adds Run key to start application
- Drops desktop.ini file(s)
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3588 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c wmic.exe shadowcopy delete2⤵
- Suspicious use of WriteProcessMemory
PID:2204 -
C:\Windows\SysWOW64\Wbem\WMIC.exewmic.exe shadowcopy delete3⤵
- Suspicious use of AdjustPrivilegeToken
PID:504
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Modifies service
- Suspicious use of AdjustPrivilegeToken
PID:376