Overview

overview

10

Static

static

f79275288b...05.exe

windows7_x64

10

f79275288b...05.exe

windows10_x64

10

Resubmissions

05-09-2020 15:54

200905-8whhad83m2 10

Analysis

  • max time kernel
    151s
  • max time network
    139s
  • platform
    windows7_x64
  • resource
    win7
  • submitted
    05-09-2020 15:54

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    f79275288b3c6595220430984cc2a75576d8998b8f19e624c9fe6327e2602b05.exe

  • Size

    588KB

  • MD5

    d4f2318beec5fb9fbe1c8e33472159a4

  • SHA1

    55f05db53254f8d129c3fabc91e1b46d93c81b92

  • SHA256

    f79275288b3c6595220430984cc2a75576d8998b8f19e624c9fe6327e2602b05

  • SHA512

    b1b23730841240b051034c36d9e8c69400212ae51f43a3c9f8f4ac79c860a1d2d7af9727e1ff1303a87f9146b22fbad5091f2a1879925b1a01922b949379d1e9

Score
10/10
ransomwarepersistence

Malware Config

Extracted

Path

C:\R3ADM3.txt

Ransom Note
The network is LOCKED. Do not try to use other software. For decryption tool write HERE: guifullcharti1970@protonmail.com phrasitliter1981@protonmail.com If you do not pay, we will publish private data on our news site.
Emails

guifullcharti1970@protonmail.com

phrasitliter1981@protonmail.com

Signatures

  • Modifies extensions of user files 5 IoCs

    Ransomware generally changes the extension on encrypted files.

    ransomware
  • Drops desktop.ini file(s) 32 IoCs
  • Modifies service 2 TTPs 5 IoCs
    persistence
  • Drops file in Program Files directory 6854 IoCs
  • Suspicious behavior: EnumeratesProcesses 162 IoCs
  • Suspicious use of AdjustPrivilegeToken 447 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 77 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\f79275288b3c6595220430984cc2a75576d8998b8f19e624c9fe6327e2602b05.exe
    "C:\Users\Admin\AppData\Local\Temp\f79275288b3c6595220430984cc2a75576d8998b8f19e624c9fe6327e2602b05.exe"
    1⤵
    • Modifies extensions of user files
    • Drops desktop.ini file(s)
    • Drops file in Program Files directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1124
    • C:\Windows\system32\cmd.exe
      cmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{4566BDE7-D9BC-40E9-914E-75B6FE041A60}'" delete
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:1984
      • C:\Windows\System32\wbem\WMIC.exe
        C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{4566BDE7-D9BC-40E9-914E-75B6FE041A60}'" delete
        3⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:1960
    • C:\Windows\system32\cmd.exe
      cmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{262AED25-86BF-4ECA-BE2B-0A721721225D}'" delete
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:436
      • C:\Windows\System32\wbem\WMIC.exe
        C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{262AED25-86BF-4ECA-BE2B-0A721721225D}'" delete
        3⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:320
    • C:\Windows\system32\cmd.exe
      cmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{57CAC47B-5DA4-4A8C-9F4A-1CBEED32B4CD}'" delete
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:824
      • C:\Windows\System32\wbem\WMIC.exe
        C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{57CAC47B-5DA4-4A8C-9F4A-1CBEED32B4CD}'" delete
        3⤵
          PID:324
      • C:\Windows\system32\cmd.exe
        cmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{83E41C58-363E-480D-A822-23328CC0CE08}'" delete
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:1172
        • C:\Windows\System32\wbem\WMIC.exe
          C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{83E41C58-363E-480D-A822-23328CC0CE08}'" delete
          3⤵
            PID:688
        • C:\Windows\system32\cmd.exe
          cmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{3FD94DD0-A65A-4932-9BBE-3002637A79AC}'" delete
          2⤵
          • Suspicious use of WriteProcessMemory
          PID:368
          • C:\Windows\System32\wbem\WMIC.exe
            C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{3FD94DD0-A65A-4932-9BBE-3002637A79AC}'" delete
            3⤵
              PID:836
          • C:\Windows\system32\cmd.exe
            cmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{D0F7AE9A-4D9C-48FD-BB80-5303C83278D1}'" delete
            2⤵
            • Suspicious use of WriteProcessMemory
            PID:1184
            • C:\Windows\System32\wbem\WMIC.exe
              C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{D0F7AE9A-4D9C-48FD-BB80-5303C83278D1}'" delete
              3⤵
                PID:1976
            • C:\Windows\system32\cmd.exe
              cmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{EFE7B7E3-757D-4FAB-8633-C3490AA8CCB6}'" delete
              2⤵
              • Suspicious use of WriteProcessMemory
              PID:1960
              • C:\Windows\System32\wbem\WMIC.exe
                C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{EFE7B7E3-757D-4FAB-8633-C3490AA8CCB6}'" delete
                3⤵
                  PID:528
              • C:\Windows\system32\cmd.exe
                cmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{20A2D9DB-6F14-4EB3-B35E-C81771212B1F}'" delete
                2⤵
                • Suspicious use of WriteProcessMemory
                PID:320
                • C:\Windows\System32\wbem\WMIC.exe
                  C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{20A2D9DB-6F14-4EB3-B35E-C81771212B1F}'" delete
                  3⤵
                    PID:1100
                • C:\Windows\system32\cmd.exe
                  cmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{ACE5448B-4A74-4875-9B43-E377AC8BEC7F}'" delete
                  2⤵
                  • Suspicious use of WriteProcessMemory
                  PID:324
                  • C:\Windows\System32\wbem\WMIC.exe
                    C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{ACE5448B-4A74-4875-9B43-E377AC8BEC7F}'" delete
                    3⤵
                      PID:976
                  • C:\Windows\system32\cmd.exe
                    cmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{2C007F17-791E-46A6-A59B-071D466B3D84}'" delete
                    2⤵
                      PID:308
                      • C:\Windows\System32\wbem\WMIC.exe
                        C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{2C007F17-791E-46A6-A59B-071D466B3D84}'" delete
                        3⤵
                          PID:1472
                      • C:\Windows\system32\cmd.exe
                        cmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{ADF8E430-F00C-4266-B408-F8C18C9C4243}'" delete
                        2⤵
                          PID:1064
                          • C:\Windows\System32\wbem\WMIC.exe
                            C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{ADF8E430-F00C-4266-B408-F8C18C9C4243}'" delete
                            3⤵
                              PID:2024
                        • C:\Windows\system32\vssvc.exe
                          C:\Windows\system32\vssvc.exe
                          1⤵
                          • Modifies service
                          • Suspicious use of AdjustPrivilegeToken
                          PID:1572
                        • C:\Windows\system32\AUDIODG.EXE
                          C:\Windows\system32\AUDIODG.EXE 0x5a0
                          1⤵
                            PID:344

                          Network

                          MITRE ATT&CK Matrix ATT&CK v6

                          Initial Access

                          Execution

                          Persistence

                          Modify Existing Service

                          1
                          T1031

                          Privilege Escalation

                          Defense Evasion

                          Modify Registry

                          1
                          T1112

                          Credential Access

                          Discovery

                          Lateral Movement

                          Collection

                          Exfiltration

                          Command and Control

                          Impact

                          Replay Monitor

                          Loading Replay Monitor...

                          Downloads

                          • memory/308-20-0x0000000000000000-mapping.dmp
                            Download
                          • memory/320-16-0x0000000000000000-mapping.dmp
                            Download
                          • memory/320-5-0x0000000000000000-mapping.dmp
                            Download
                          • memory/324-18-0x0000000000000000-mapping.dmp
                            Download
                          • memory/324-7-0x0000000000000000-mapping.dmp
                            Download
                          • memory/368-10-0x0000000000000000-mapping.dmp
                            Download
                          • memory/436-4-0x0000000000000000-mapping.dmp
                            Download
                          • memory/528-15-0x0000000000000000-mapping.dmp
                            Download
                          • memory/688-9-0x0000000000000000-mapping.dmp
                            Download
                          • memory/824-6-0x0000000000000000-mapping.dmp
                            Download
                          • memory/836-11-0x0000000000000000-mapping.dmp
                            Download
                          • memory/976-19-0x0000000000000000-mapping.dmp
                            Download
                          • memory/1064-22-0x0000000000000000-mapping.dmp
                            Download
                          • memory/1100-17-0x0000000000000000-mapping.dmp
                            Download
                          • memory/1124-0-0x0000000001C90000-0x0000000001CBD000-memory.dmp
                            Filesize

                            180KB

                            Download
                          • memory/1124-1-0x0000000001DC0000-0x0000000001DEB000-memory.dmp
                            Filesize

                            172KB

                            Download
                          • memory/1172-8-0x0000000000000000-mapping.dmp
                            Download
                          • memory/1184-12-0x0000000000000000-mapping.dmp
                            Download
                          • memory/1472-21-0x0000000000000000-mapping.dmp
                            Download
                          • memory/1960-3-0x0000000000000000-mapping.dmp
                            Download
                          • memory/1960-14-0x0000000000000000-mapping.dmp
                            Download
                          • memory/1976-13-0x0000000000000000-mapping.dmp
                            Download
                          • memory/1984-2-0x0000000000000000-mapping.dmp
                            Download
                          • memory/2024-23-0x0000000000000000-mapping.dmp
                            Download