Overview

overview

10

Static

static

f247ae6db5...in.exe

windows7_x64

10

f247ae6db5...in.exe

windows10_x64

10

Resubmissions

08-06-2024 15:19

240608-sqmvesch2s 10

06-11-2020 15:33

201106-nz68d98cw2 10

Analysis

  • max time kernel
    155s
  • max time network
    138s
  • platform
    windows7_x64
  • resource
    win7v20201028
  • submitted
    06-11-2020 15:33

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    f247ae6db52989c9a598c3c7fbc1ae2db54f5c65be862880e11578b8583731cb.bin.exe

  • Size

    212KB

  • MD5

    723825ad69a5d55a1e5ed3d1ee831f0d

  • SHA1

    7e082df63c3de0f8bf9d38edf72ba5268078275a

  • SHA256

    f247ae6db52989c9a598c3c7fbc1ae2db54f5c65be862880e11578b8583731cb

  • SHA512

    dbd1fd80c8e1224c79ecea419919df3590186c95bfd2f606d6573d759374bc54db8331478207e3b543114431c2ed8eede83b7eca74d4313e7dee16bd527c2c78

Score
10/10
persistenceransomware

Malware Config

Extracted

Path

C:\RECOVERY DATA INFORMATION.TXT

Ransom Note
Hello! If you see this message - this means your files are now encrypted and are in a non-working state! Now only we can help you recover. If you are ready to restore the work - send us an email to the address [email protected] In the letter, specify your personal identifier, which you will see below. In the reply letter we will inform you the cost of decrypting your files. Also from your servers files, documents, databases SQL, PDF were uploaded to our cloud storage After we agree, you will receive a decryption program, as well as all your files on our server will be deleted. Otherwise, they will fall into the open access of the Internet! Before payment you can send us 1-2 files for test decryption. We will decrypt the files you requested and send you back. This ensures that we own the key to recover your data. The total file size should be no more than 3 MB, the files should not contain valuable information (databases, backups, large Excel spreadsheets ...). Please be sure that we will find common languge. We will restore all the data. Email to contact us - [email protected] Attention! * Do not rename encrypted files. * Do not try to decrypt your data using third party software, it may cause permanent data loss. Your personal ID: 342-09B-CF1

Signatures

  • Deletes shadow copies 2 TTPs

    Ransomware often targets backup files to inhibit system recovery.

    ransomware
  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 3 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 24 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Legitimate hosting services abused for malware hosting/C2 1 TTPs
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Modifies service 2 TTPs 4 IoCs
    persistence
  • Drops file in Program Files directory 4253 IoCs
  • Interacts with shadow copies 2 TTPs 2 IoCs

    Shadow copies are often targeted by ransomware to inhibit system recovery.

    ransomware
  • Modifies system certificate store 2 TTPs 7 IoCs
    evasionspywaretrojan
  • Suspicious use of AdjustPrivilegeToken 83 IoCs
  • Suspicious use of WriteProcessMemory 48 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\f247ae6db52989c9a598c3c7fbc1ae2db54f5c65be862880e11578b8583731cb.bin.exe
    "C:\Users\Admin\AppData\Local\Temp\f247ae6db52989c9a598c3c7fbc1ae2db54f5c65be862880e11578b8583731cb.bin.exe"
    1⤵
    • Loads dropped DLL
    • Adds Run key to start application
    • Modifies system certificate store
    • Suspicious use of WriteProcessMemory
    PID:1816
    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\spoolsv.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\spoolsv.exe" -start
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Enumerates connected drives
      • Modifies system certificate store
      • Suspicious use of WriteProcessMemory
      PID:1836
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\system32\cmd.exe" /C wmic shadowcopy delete
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:1680
        • C:\Windows\SysWOW64\Wbem\WMIC.exe
          wmic shadowcopy delete
          4⤵
          • Suspicious use of AdjustPrivilegeToken
          PID:1880
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\system32\cmd.exe" /C bcdedit /set {default} recoveryenabled no
        3⤵
          PID:1652
        • C:\Windows\SysWOW64\cmd.exe
          "C:\Windows\system32\cmd.exe" /C bcdedit /set {default} bootstatuspolicy ignoreallfailures
          3⤵
            PID:1520
          • C:\Windows\SysWOW64\cmd.exe
            "C:\Windows\system32\cmd.exe" /C wbadmin delete catalog -quiet
            3⤵
              PID:1708
            • C:\Windows\SysWOW64\cmd.exe
              "C:\Windows\system32\cmd.exe" /C vssadmin delete shadows /all /quiet
              3⤵
              • Suspicious use of WriteProcessMemory
              PID:944
              • C:\Windows\SysWOW64\vssadmin.exe
                vssadmin delete shadows /all /quiet
                4⤵
                • Interacts with shadow copies
                PID:2008
            • C:\Windows\SysWOW64\cmd.exe
              "C:\Windows\system32\cmd.exe" /C C:\Users\Admin\AppData\Local\Temp\~temp001.bat
              3⤵
              • Suspicious use of WriteProcessMemory
              PID:1424
              • C:\Windows\SysWOW64\Wbem\WMIC.exe
                wmic shadowcopy delete
                4⤵
                • Suspicious use of AdjustPrivilegeToken
                PID:112
              • C:\Windows\SysWOW64\vssadmin.exe
                vssadmin delete shadows /all /quiet
                4⤵
                • Interacts with shadow copies
                PID:932
            • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\spoolsv.exe
              "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\spoolsv.exe" -agent 0
              3⤵
              • Executes dropped EXE
              • Drops file in Program Files directory
              PID:1524
        • C:\Windows\system32\vssvc.exe
          C:\Windows\system32\vssvc.exe
          1⤵
          • Modifies service
          • Suspicious use of AdjustPrivilegeToken
          PID:1616

        Network

        MITRE ATT&CK Matrix ATT&CK v6

        Initial Access

        Execution

        Persistence

        Registry Run Keys / Startup Folder

        1
        T1060

        Modify Existing Service

        1
        T1031

        Privilege Escalation

        Defense Evasion

        File Deletion

        2
        T1107

        Modify Registry

        3
        T1112

        Install Root Certificate

        1
        T1130

        Credential Access

        Discovery

        Query Registry

        1
        T1012

        Peripheral Device Discovery

        1
        T1120

        System Information Discovery

        1
        T1082

        Lateral Movement

        Collection

        Exfiltration

        Command and Control

        Web Service

        1
        T1102

        Impact

        Inhibit System Recovery

        2
        T1490

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\07CEF2F654E3ED6050FFC9B6EB844250_3F26ED5DE6B4E859CCCA6035ECB8D9CB
          MD5

          94b4ad73963959e339923ddcabf6b331

          SHA1

          aa2c6af08dd5478d326c90ef2146c3ee2a7b55b2

          SHA256

          8945240c6d037d35d6124ac4b9815a8d74d785fa30c2c4b2fd54ed2fb68f58f4

          SHA512

          aefafb7d184e5564bdc65311e52619950f603fb89259de2af3b8f9fa05c346bf9e3f33b9cbe05a01389ef97642c7e37299ce8b9b4f3cb9f6d4e9a6877c537126

          Download Submit
        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\204C1AA6F6114E6A513754A2AB5760FA_0673414C08DE7F919AE3F6C4CC65AEEE
          MD5

          3208da0c038576623565b095fcea4ad1

          SHA1

          bc421f8eb4b9c6100aa444edece988c01dd63b26

          SHA256

          16ca708624c0f83871bbb8349e31fba20e5591f298ee91ddf08faf2919041f4b

          SHA512

          17fd810bdb400ce06167d6009a23cbdafdeb5eb0cb5c18456ec3a833546ad050429b003bdec753aa591d5b370cbb1290633abc1cc71f3ae29e81d58c56b8408c

          Download Submit
        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711E
          MD5

          c6f27d5d1ee450d3400bf13e0804fce6

          SHA1

          2d0505f90eca6a49ca15b742aa5ef9ef01c7af41

          SHA256

          2c01ba329cfb39b6141b3c98d662ba24eb458e051fb7de79f975e681e8b4327a

          SHA512

          75687ddffd7021a033d19049f0cc05bbccd97a1433c06738a04590ed660996f669838514fe9f3b7c4b2eb494cf8a594f54bab1446cc915da4a042c3a327adc3d

          Download Submit
        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\07CEF2F654E3ED6050FFC9B6EB844250_3F26ED5DE6B4E859CCCA6035ECB8D9CB
          MD5

          2b8543d7ed94b03fd40958ef8378b8ad

          SHA1

          91e164d0d5090b639b9b15332e7cbb6778ef324b

          SHA256

          dd83b32ee7c14b065c965fd0a51f9e1f954080e8dfd863c45da3233e2983baf2

          SHA512

          9b45c9ebf3cb3d9c6a14154bcdb38de3f17adf4cea32f463294d04124b604114c2e372415b2967cd1482587090cf4d0ebb1839b7fd7109cd312257c45a3231fb

          Download Submit
        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\204C1AA6F6114E6A513754A2AB5760FA_0673414C08DE7F919AE3F6C4CC65AEEE
          MD5

          4e821a1ad005656bacc49481361fe41a

          SHA1

          761d37ba990fe6433332fc6d9c4835c48f9d84aa

          SHA256

          db42788325c0a1d0ec8c651b474eb0b3a1539cff9724826d162ea46077d83f90

          SHA512

          4ded13bad6d11316471aeeed3cd7f81d1a312a9f33142f8b25835049f18058b639ab851dd6c50e41fdf78c8657e95670f9f9342210bcc25fa97090ed8165d6da

          Download Submit
        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
          MD5

          e8ca5d5ac9c39d0f8eeb46320cce8132

          SHA1

          36b4770964ab88ea17dc0830af92594a143c42bf

          SHA256

          6c67965c5142445e42b15da1f88a8b8e1342a3348b41e1db01c0dfe98c44d8ba

          SHA512

          380b9f9ca7a5f27958a2fbd9c1de20940d0cdf500b5c2107590321be7b530493620669f9988bf5cf0330acd0866b60e9ce4e7a1d704f102a4ce0f74e9a4d21e5

          Download Submit
        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711E
          MD5

          1658aa9ebbc8abddcbbe7e34800695d5

          SHA1

          b2f8bc5b5184ceda4fbf6935dd38c8237b1422d2

          SHA256

          cb85251174ab9abdf5105bc263758021e88e208a7f7f8f0999180cf6ca8cfb9a

          SHA512

          5fc45424d18ab9d5c0409e71955284e2e599659c6f9540fb106e795f59bfd5e750755d3ede7aa95a797be715f12c36fa02e684ed96760e1a16fe2d2980bb6d80

          Download Submit
        • C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\3O0J2C38\Y8N9TH45.htm
          MD5

          8615e70875c2cc0b9db16027b9adf11d

          SHA1

          4ed62cf405311c0ff562a3c59334a15ddc4f1bf9

          SHA256

          da96949ba6b0567343f144486505c8c8fa1d892fd88c9cbc3ef3d751a570724d

          SHA512

          cd9dfc88dc2af9438b7d6b618d1b62029b3bdf739fc4daa5b37397afd12c4528561b3bf2fc3f3f2adf3fd1f582d5524332441fd30248fcd078e41aa91e17cb73

          Download Submit
        • C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\7ISB2KAC\LHL1WXN2.htm
          MD5

          b1cd7c031debba3a5c77b39b6791c1a7

          SHA1

          e5d91e14e9c685b06f00e550d9e189deb2075f76

          SHA256

          57ba053f075e0b80f747f3102ed985687c16a8754d109e7c4d33633269a36aaa

          SHA512

          d2bbefdc1effb52a38964c4cec5990a5a226248eca36f99e446c0c5704436f666bf1cb514e73b8991411d497d3325ecc646cbd5065c364e92ab6b9c5f1ad4a72

          Download Submit
        • C:\Users\Admin\AppData\Local\Temp\~temp001.bat
          MD5

          78215698f8f9dc7941c9c287642bd02c

          SHA1

          633cd0a6c76f080cdb6e0c98034b0b5dd7283a47

          SHA256

          dc94e21e80522b2cee097064c31a7720d70a02d0c55f290d59030fd0c995cac5

          SHA512

          c0a05f8cc400855c40b8e8eb3e7f027b06553cc592eb2ab6ad0a8c33ed2d196c7eda358977edc3f34ce1fdbff30efe288725eb10ea463e622ee9eb8085e48f7d

          Download Submit
        • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\spoolsv.exe
          MD5

          723825ad69a5d55a1e5ed3d1ee831f0d

          SHA1

          7e082df63c3de0f8bf9d38edf72ba5268078275a

          SHA256

          f247ae6db52989c9a598c3c7fbc1ae2db54f5c65be862880e11578b8583731cb

          SHA512

          dbd1fd80c8e1224c79ecea419919df3590186c95bfd2f606d6573d759374bc54db8331478207e3b543114431c2ed8eede83b7eca74d4313e7dee16bd527c2c78

          Download Submit
        • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\spoolsv.exe
          MD5

          723825ad69a5d55a1e5ed3d1ee831f0d

          SHA1

          7e082df63c3de0f8bf9d38edf72ba5268078275a

          SHA256

          f247ae6db52989c9a598c3c7fbc1ae2db54f5c65be862880e11578b8583731cb

          SHA512

          dbd1fd80c8e1224c79ecea419919df3590186c95bfd2f606d6573d759374bc54db8331478207e3b543114431c2ed8eede83b7eca74d4313e7dee16bd527c2c78

          Download Submit
        • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\spoolsv.exe
          MD5

          723825ad69a5d55a1e5ed3d1ee831f0d

          SHA1

          7e082df63c3de0f8bf9d38edf72ba5268078275a

          SHA256

          f247ae6db52989c9a598c3c7fbc1ae2db54f5c65be862880e11578b8583731cb

          SHA512

          dbd1fd80c8e1224c79ecea419919df3590186c95bfd2f606d6573d759374bc54db8331478207e3b543114431c2ed8eede83b7eca74d4313e7dee16bd527c2c78

          Download Submit
        • \Users\Admin\AppData\Roaming\Microsoft\Windows\spoolsv.exe
          MD5

          723825ad69a5d55a1e5ed3d1ee831f0d

          SHA1

          7e082df63c3de0f8bf9d38edf72ba5268078275a

          SHA256

          f247ae6db52989c9a598c3c7fbc1ae2db54f5c65be862880e11578b8583731cb

          SHA512

          dbd1fd80c8e1224c79ecea419919df3590186c95bfd2f606d6573d759374bc54db8331478207e3b543114431c2ed8eede83b7eca74d4313e7dee16bd527c2c78

          Download Submit
        • \Users\Admin\AppData\Roaming\Microsoft\Windows\spoolsv.exe
          MD5

          723825ad69a5d55a1e5ed3d1ee831f0d

          SHA1

          7e082df63c3de0f8bf9d38edf72ba5268078275a

          SHA256

          f247ae6db52989c9a598c3c7fbc1ae2db54f5c65be862880e11578b8583731cb

          SHA512

          dbd1fd80c8e1224c79ecea419919df3590186c95bfd2f606d6573d759374bc54db8331478207e3b543114431c2ed8eede83b7eca74d4313e7dee16bd527c2c78

          Download Submit
        • \Users\Admin\AppData\Roaming\Microsoft\Windows\spoolsv.exe
          MD5

          723825ad69a5d55a1e5ed3d1ee831f0d

          SHA1

          7e082df63c3de0f8bf9d38edf72ba5268078275a

          SHA256

          f247ae6db52989c9a598c3c7fbc1ae2db54f5c65be862880e11578b8583731cb

          SHA512

          dbd1fd80c8e1224c79ecea419919df3590186c95bfd2f606d6573d759374bc54db8331478207e3b543114431c2ed8eede83b7eca74d4313e7dee16bd527c2c78

          Download Submit
        • memory/112-27-0x0000000000000000-mapping.dmp
          Download
        • memory/932-28-0x0000000000000000-mapping.dmp
          Download
        • memory/944-18-0x0000000000000000-mapping.dmp
          Download
        • memory/1424-19-0x0000000000000000-mapping.dmp
          Download
        • memory/1520-16-0x0000000000000000-mapping.dmp
          Download
        • memory/1524-22-0x0000000000000000-mapping.dmp
          Download
        • memory/1652-15-0x0000000000000000-mapping.dmp
          Download
        • memory/1668-0-0x000007FEF79D0000-0x000007FEF7C4A000-memory.dmp
          Filesize

          2.5MB

          Download
        • memory/1680-14-0x0000000000000000-mapping.dmp
          Download
        • memory/1708-17-0x0000000000000000-mapping.dmp
          Download
        • memory/1836-3-0x0000000000000000-mapping.dmp
          Download
        • memory/1880-25-0x0000000000000000-mapping.dmp
          Download
        • memory/2008-24-0x0000000000000000-mapping.dmp
          Download