Overview

overview

10

Static

static

ky.bin.exe

windows7_x64

10

ky.bin.exe

windows10_x64

10

Analysis

  • max time kernel
    142s
  • max time network
    128s
  • platform
    windows10_x64
  • resource
    win10v200722
  • submitted
    02-10-2020 18:04

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    ky.bin.exe

  • Size

    421KB

  • MD5

    80143152971ee77d14bb77c8d10346ec

  • SHA1

    6c6e9ebe1e11714bd4c3584fc5b732ccfb782a05

  • SHA256

    7860832a25f403c43865c00bd072fa58b2da66bc81152eec30582ad0a72932e6

  • SHA512

    133f5a81542f5475597b5d2dea84af932ff49df5286a27dc9ce0dfdaa200d52f6cec8fd9f44c07e86e2585195c278874953e4dcd15a5b1a7845f704125e0c36b

Score
10/10
ransomwarepersistencespyware

Malware Config

Extracted

Path

C:\$Recycle.Bin\S-1-5-21-1400429095-533421673-2598934218-1000\SYMMYWARE.TXT

Ransom Note
*-------=SymmiWare=-------* All your files was ciphered by Strong algorythm AES-128. Take your time, no one will be able to decrypt your files without our decryption service. To decrypt files, pay $ 0 in Bitcoins. If you do not have 0 bitcoins (everyone has it) then go to the site localbitcoins.com and there send to our wallet (which we do not have) and write to the mail simmyware@protonmail.ch to get the key and the decoder. We advise you not to mess around because you still do not restore their hands. We've also encrypted all your drives, files on your hard drives and network drives. AES-128 is the Most reliable military-grade cryptographic algorithm. There's no way to hack it, not even with a supercomputer. The file cutter will start in 48 hours. Don't be stupid and ugly like Patrick. Any hacking attempts can fuck all of your data and the locker will turn them into pee-pee. Good luck. Goodbye. P.S I'm not spreading, and I can't. P.P.S. The best time to send a letter: after November 25 (while we register the mail), and the fact that we wrote about 48 hours - it was a joke. We do not count down the time until the system is removed. *-------=SymmiWare=-------*
Emails

simmyware@protonmail.ch

Signatures

  • Executes dropped EXE 2 IoCs
  • Modifies Installed Components in the registry 2 TTPs
    persistence
  • Modifies extensions of user files 4 IoCs

    Ransomware generally changes the extension on encrypted files.

    ransomware
  • Drops startup file 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spyware
  • Enumerates connected drives 3 TTPs 1 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
  • Checks SCSI registry key(s) 3 TTPs 12 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 2 IoCs
  • Modifies Control Panel 5 IoCs
    evasion
  • Modifies registry class 30 IoCs
  • Suspicious behavior: EnumeratesProcesses 77 IoCs
  • Suspicious use of AdjustPrivilegeToken 65 IoCs
  • Suspicious use of FindShellTrayWindow 49 IoCs
  • Suspicious use of SendNotifyMessage 24 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\ky.bin.exe
    "C:\Users\Admin\AppData\Local\Temp\ky.bin.exe"
    1⤵
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:3288
    • C:\Windows\System32\cmd.exe
      "C:\Windows\sysnative\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\D353.tmp\D354.bat C:\Users\Admin\AppData\Local\Temp\ky.bin.exe"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:3656
      • C:\Users\Admin\AppData\Local\Temp\PsExec.exe
        psexec hyBrDFjOidLuty.exe /accepteula -s -high
        3⤵
        • Executes dropped EXE
        • Suspicious use of WriteProcessMemory
        PID:3968
        • C:\Users\Admin\AppData\Local\Temp\hyBrDFjOidLuty.exe
          "hyBrDFjOidLuty.exe" /accepteula -s -high
          4⤵
          • Executes dropped EXE
          • Modifies extensions of user files
          • Drops startup file
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:1716
          • C:\Windows\explorer.exe
            "C:\Windows\explorer.exe"
            5⤵
            • Enumerates connected drives
            • Checks SCSI registry key(s)
            • Modifies Control Panel
            • Modifies registry class
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of FindShellTrayWindow
            • Suspicious use of SendNotifyMessage
            PID:492
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
      PID:1600
    • C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe
      "C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe" -ServerName:CortanaUI.AppXa50dqqa5gqv4a428c9y1jjw7m3btvepj.mca
      1⤵
      • Enumerates system info in registry
      • Modifies Control Panel
      • Modifies registry class
      • Suspicious use of SetWindowsHookEx
      PID:3672
    • C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe
      "C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe" -ServerName:App.AppXtk181tbxbce2qsex02s8tw7hfxa9xb3t.mca
      1⤵
      • Modifies Control Panel
      • Suspicious use of SetWindowsHookEx
      PID:1948

    Network

    MITRE ATT&CK Matrix ATT&CK v6

    Initial Access

    Execution

    Persistence

    Registry Run Keys / Startup Folder

    1
    T1060

    Privilege Escalation

    Defense Evasion

    Modify Registry

    1
    T1112

    Credential Access

    Credentials in Files

    1
    T1081

    Discovery

    Query Registry

    3
    T1012

    Peripheral Device Discovery

    2
    T1120

    System Information Discovery

    3
    T1082

    Lateral Movement

    Collection

    Data from Local System

    1
    T1005

    Exfiltration

    Command and Control

    Impact

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\D353.tmp\D354.bat
      MD5

      ed53b8acfbea918e8c95e7a39c286d83

      SHA1

      19dc601925d5602cb135b9012da4032947b533ac

      SHA256

      46c77d27fab56e047a51a472e9cdd1371e510d7a878bbb693d53dfee37130472

      SHA512

      e2f1bf41ac80f66a45cdc076325f23cb88628c1bc27a166e7f4cd82df357d6abbbe68a42c946b0754ef859aef1a3f4e227d2d2108e20140e3b9e67cd1a88dc73

      Download Submit
    • C:\Users\Admin\AppData\Local\Temp\PsExec.exe
      MD5

      27304b246c7d5b4e149124d5f93c5b01

      SHA1

      e50d9e3bd91908e13a26b3e23edeaf577fb3a095

      SHA256

      3337e3875b05e0bfba69ab926532e3f179e8cfbf162ebb60ce58a0281437a7ef

      SHA512

      bec172a2f92a95796199cfc83f544a78685b52a94061ce0ffb46b265070ee0bcc018c4f548f56018bf3ff1e74952811b2afb6df79ab8d09f1ec73c9477af636b

      Download Submit
    • C:\Users\Admin\AppData\Local\Temp\PsExec.exe
      MD5

      27304b246c7d5b4e149124d5f93c5b01

      SHA1

      e50d9e3bd91908e13a26b3e23edeaf577fb3a095

      SHA256

      3337e3875b05e0bfba69ab926532e3f179e8cfbf162ebb60ce58a0281437a7ef

      SHA512

      bec172a2f92a95796199cfc83f544a78685b52a94061ce0ffb46b265070ee0bcc018c4f548f56018bf3ff1e74952811b2afb6df79ab8d09f1ec73c9477af636b

      Download Submit
    • C:\Users\Admin\AppData\Local\Temp\hyBrDFjOidLuty.exe
      MD5

      9ca339da8a96656779074b5caaa76c63

      SHA1

      f6813078253f72bf25c136debe45ac54cfbb7012

      SHA256

      da50730580bd7fe14fca5c3547eb54882b6f79b42cd474530b9b07dd5de4f1ac

      SHA512

      2971f3cbfd65340f33381346fb60e6425282316077b28dd22cd5abc0c5854842cf8dd2936e818204dfa7d3a53ef8b2e924cd1183ae5234513f39b43eb096912d

      Download Submit
    • C:\Users\Admin\AppData\Local\Temp\hyBrDFjOidLuty.exe
      MD5

      9ca339da8a96656779074b5caaa76c63

      SHA1

      f6813078253f72bf25c136debe45ac54cfbb7012

      SHA256

      da50730580bd7fe14fca5c3547eb54882b6f79b42cd474530b9b07dd5de4f1ac

      SHA512

      2971f3cbfd65340f33381346fb60e6425282316077b28dd22cd5abc0c5854842cf8dd2936e818204dfa7d3a53ef8b2e924cd1183ae5234513f39b43eb096912d

      Download Submit
    • C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\File Explorer.lnk.SYMMYWARE
      MD5

      1da5d0b4d7ac5acf4b1749915bc83d91

      SHA1

      2e1725c5b1240d44cec7951463049734f6f1f9ad

      SHA256

      a06aa30795875ec12df0ee2f4dfb1b70bddec6fa6569d7dee7eaf685cddbdaad

      SHA512

      409d5161354b622e026b5d1973b69ed42c3cf086f582f625d985e21ac25173622520201490e35a53779befd96a39e21d307a36cd4263471a3222cff39173e9ec

      Download Submit
    • C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Firefox.lnk.SYMMYWARE
      MD5

      77c9348d94dfbefc592558effa1e41a9

      SHA1

      281b1288a4c352a53ac229408bc21beeb786562f

      SHA256

      13939449e79f91153c3dc5815040b22a5dabfb274a92ff63483b39042de7d20f

      SHA512

      483855c60239894f82b82f34268d2d8d2691fb507fc361ed6ba68eb4beaca93f48462f00f971a9a953e3d9da18781b35859d13f24f07e0c0a4351e4ae0938159

      Download Submit
    • memory/492-12-0x0000000000000000-mapping.dmp
      Download
    • memory/1716-9-0x00007FF96C600000-0x00007FF96CFEC000-memory.dmp
      Filesize

      9.9MB

      Download
    • memory/1716-10-0x00000000002B0000-0x00000000002B1000-memory.dmp
      Filesize

      4KB

      Download
    • memory/1716-6-0x0000000000000000-mapping.dmp
      Download
    • memory/3288-0-0x0000000000640000-0x0000000000642000-memory.dmp
      Filesize

      8KB

      Download
    • memory/3656-1-0x0000000000000000-mapping.dmp
      Download
    • memory/3968-3-0x0000000000000000-mapping.dmp
      Download