Overview

overview

10

Static

static

10

1.exe

windows7_x64

1

1.exe

windows10_x64

10

Analysis

  • max time kernel
    149s
  • max time network
    153s
  • platform
    windows10_x64
  • resource
    win10v20201028
  • submitted
    09-11-2020 20:37

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    1.exe

  • Size

    2.7MB

  • MD5

    5a4135a79283d211cf21820a67e01a4f

  • SHA1

    fd1a1709b4346a4ca307d01cb85b5d6beb633733

  • SHA256

    2ba2c20a826f51ed753f4f4dd78118d6f371a2fd5b4b0a2ff640c8f046d4fb55

  • SHA512

    c6aa36b7326a461179dc0c8c14dc3552ccbf22d72490ee1d7ca90b3c9177538eff8e16258a2e42ab59b4c5999c25e420981dfc9e2fb6d4a1cc509c2c9534813b

Score
10/10
ransomwarespyware

Malware Config

Extracted

Path

C:\How_To_Decrypt_Files.txt

Ransom Note
All Your Files Has Been Locked! Finding a way to decrypt the file makes us happy but all your files are protected by strong encryption with AES RSA 256 using military-grade encryption algorithm This is a private ransomware developed by our team and there is no decryption file for it In our view it is not possible to decrypt without a key Your (Unique decryption file) For Trust You can Send us Test Files And We Decrypt That And Send To You. The time of our country may be different from yours, so be patient, we will answer you as soon as possible. Email addresses are blocked quickly, so contact us sooner The first email may be blocked, so contact all of the following emails Your unique Id : WDHJFRVD Contact us : [email protected] [email protected] If you do not receive a reply from us, please contact us via Telegram Secure Messenger Telegram ID : http://t.me/yourfile2020 Short video on how to decrypt files: https://streamable.com/7h914 What are the guarantees that I can decrypt my files after paying the ransom? Your main guarantee is the ability to decrypt test files. This means that we can decrypt all your files after paying the ransom. We have no reason to deceive you after receiving the ransom, since we are not barbarians and moreover it will harm our business. You Have 24 hours to Decide to Pay after 2 Days Decryption Price will Be Double And after 1 week it will be triple Try to Contact late and You will know Therefore, we recommend that you make payment within a few hours. Those who get in touch with us faster We also mention your security issues and how to get hacked so that you won't be hacked again by others. It's just a business
URLs

http://t.me/yourfile2020

https://streamable.com/7h914

Signatures

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spyware
  • JavaScript code in executable 12 IoCs
  • Drops file in Program Files directory 8977 IoCs
  • Enumerates system info in registry 2 TTPs 2 IoCs
  • Kills process with taskkill 3 IoCs
    evasion
  • Modifies Control Panel 1 IoCs
    evasion
  • Modifies registry class 43 IoCs
  • Runs net.exe
  • Suspicious use of AdjustPrivilegeToken 6 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 30 IoCs
  • Views/modifies file attributes 1 TTPs 1 IoCs
    evasion

Processes

  • C:\Users\Admin\AppData\Local\Temp\1.exe
    "C:\Users\Admin\AppData\Local\Temp\1.exe"
    1⤵
    • Drops file in Program Files directory
    • Suspicious use of WriteProcessMemory
    PID:1304
    • C:\Windows\system32\cmd.exe
      cmd /C "taskkill /F /IM sqlservr.exe /T"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:3172
      • C:\Windows\system32\taskkill.exe
        taskkill /F /IM sqlservr.exe /T
        3⤵
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:3864
    • C:\Windows\system32\cmd.exe
      cmd /C "taskkill /F /IM sqlceip.exe /T"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:3176
      • C:\Windows\system32\taskkill.exe
        taskkill /F /IM sqlceip.exe /T
        3⤵
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:2584
    • C:\Windows\system32\cmd.exe
      cmd /C "taskkill /F /IM sqlwriter.exe /T"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:360
      • C:\Windows\system32\taskkill.exe
        taskkill /F /IM sqlwriter.exe /T
        3⤵
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:372
    • C:\Windows\system32\cmd.exe
      cmd /C "rmdir C:\Users\Admin\AppData /s /q"
      2⤵
        PID:200
      • C:\Windows\system32\cmd.exe
        cmd /C "rmdir C:\Users\Default\AppData /s /q"
        2⤵
          PID:648
        • C:\Windows\system32\cmd.exe
          cmd /C "rmdir C:\Users\Public\AppData /s /q"
          2⤵
            PID:96
          • C:\Windows\system32\cmd.exe
            cmd /C "attrib +h +s Crypto.exe"
            2⤵
            • Suspicious use of WriteProcessMemory
            PID:1864
            • C:\Windows\system32\attrib.exe
              attrib +h +s Crypto.exe
              3⤵
              • Views/modifies file attributes
              PID:3680
          • C:\Windows\system32\cmd.exe
            cmd /C "net stop MSSQL$SQLEXPRESS"
            2⤵
            • Suspicious use of WriteProcessMemory
            PID:2648
            • C:\Windows\system32\net.exe
              net stop MSSQL$SQLEXPRESS
              3⤵
              • Suspicious use of WriteProcessMemory
              PID:808
              • C:\Windows\system32\net1.exe
                C:\Windows\system32\net1 stop MSSQL$SQLEXPRESS
                4⤵
                  PID:3296
            • C:\Windows\system32\cmd.exe
              cmd /C "rmdir C:\$Recycle.Bin /s /q"
              2⤵
                PID:728
            • C:\Windows\system32\rundll32.exe
              "C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#125 S-1-15-2-1861897761-1695161497-2927542615-642690995-327840285-2659745135-2630312742
              1⤵
                PID:2128
              • C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe
                "C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe" -ServerName:CortanaUI.AppXa50dqqa5gqv4a428c9y1jjw7m3btvepj.mca
                1⤵
                • Enumerates system info in registry
                • Modifies Control Panel
                • Modifies registry class
                • Suspicious use of AdjustPrivilegeToken
                • Suspicious use of SetWindowsHookEx
                PID:196

              Network

              MITRE ATT&CK Enterprise v6

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              • memory/1304-0-0x0000000000400000-0x00000000006E0000-memory.dmp

                Filesize

                2.9MB

                Download