Overview

overview

10

Static

static

6

windows-up...fw.exe

windows7_x64

10

windows-up...fw.exe

windows10_x64

10

Resubmissions

28/12/2020, 17:21

201228-w8s6w2cpm210

28/12/2020, 11:12

201228-bctexhqz8s10

Sharing

Copy URL Twitter E-mail

General

  • Target
    windows-update-cve-wfw.exe
  • Size 2.7MB
  • Sample201228-w8s6w2cpm2
  • SHA256 1fda7a2eeb2478c97b59f75f094c546d585923b286d8d7a52d4afe2795f186e7
  • MD5 SHA1 SHA512
Score
10/10
evasionransomwarespywaretrojan

Malware Config

Extracted

Path

  • C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\READMEV1.txt

Ransom Note
  • How to decrypt: Download Tor Browser (https://www.torproject.org/dist/torbrowser/10.0.7/torbrowser-install-10.0.7_en-US.exe) and install. Open http://decryptu7o2cckt5.onion with Tor Browser. Paste yor KEY 03b76-1c61afa6b-ca44645589-e266e and follow instructions Your KEY 03b76-1c61afa6b-ca44645589-e266e
URLs

  • http://decryptu7o2cckt5.onion

Targets

    • Target
      windows-update-cve-wfw.exe
    • Size 2.7MB
    • SHA256 1fda7a2eeb2478c97b59f75f094c546d585923b286d8d7a52d4afe2795f186e7
    • MD5 SHA1 SHA512
    Score
    10/10
    evasionransomwarespywaretrojan

    • UAC bypass

      evasiontrojan

    • Deletes shadow copies

      Ransomware often targets backup files to inhibit system recovery.

      ransomware

    • Enumerates VirtualBox DLL files

    • Looks for VirtualBox drivers on disk

      evasion

    • Executes dropped EXE

    • Looks for VMWare drivers on disk

      evasion

    • Deletes itself

    • Drops startup file

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spyware

    • JavaScript code in executable

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks