Overview

overview

10

Static

static

bb1b5b72a8...in.exe

windows7_x64

10

bb1b5b72a8...in.exe

windows10_x64

10

Analysis

  • max time kernel
    150s
  • max time network
    151s
  • platform
    windows7_x64
  • resource
    win7v20201028
  • submitted
    18-01-2021 22:36

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    bb1b5b72a867a401876a6ad6a9bcc1f4af9f4e4fdb568ef7ce2b812796b48c7a.bin.exe

  • Size

    11KB

  • MD5

    f3d78f15bf85aa14f71979585d310ae7

  • SHA1

    1e73b89abd5e0e0e74291d5ebb4f10574a9ef2e2

  • SHA256

    bb1b5b72a867a401876a6ad6a9bcc1f4af9f4e4fdb568ef7ce2b812796b48c7a

  • SHA512

    ef251e35c6047df225d937b568ded6ad9ee8e72235fac6ce6c04e9287f01aad65c63ada7e65e304ac094029f0a768d2697c3960dde818f7cf0f73cd81283e087

Score
10/10
persistenceransomwarespyware

Malware Config

Extracted

Path

C:\Users\Admin\Desktop\READ_ME.hta

Ransom Note
E P S I L O N Ransomware ⠀ As you can see, all your files got encrypted. Thats why your files are no longer readable. If you want them back, please contact us at our email below. You can send us a couple of files and we will return the restored ones to prove that only we can do it. [email protected] You can ask for more details and more help by email. You can learn more about bitcoin and encryption on wikipedia. https://wikipedia.org/wiki/Bitcoinhttps://wikipedia.org/wiki/Encryption ⠀ If you already submited your payement, you will receive your private key and another decryption key with the special decryption software. More informations: 1. the infection was due to vulnerabilities in your software. 2. our goal is to return your data, but if you don't contact us, we will not succeed. IMPORTANT: 1. if you want to make sure that it is impossible to recover files using third-party software, do this not on all files, otherwise you may lose all data. 2. only communication through our email can guarantee file recover for you. We are not responsible for the actions of third parties who promise to help you - most often they are scammers. 3. please, do not try to rename encrypted files.
URLs

https://wikipedia.org/wiki/Bitcoinhttps://wikipedia.org/wiki/Encryption

Signatures

  • Deletes shadow copies 2 TTPs

    Ransomware often targets backup files to inhibit system recovery.

    ransomware
  • Executes dropped EXE 1 IoCs
  • Drops startup file 1 IoCs
  • Loads dropped DLL 2 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spyware
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Drops file in System32 directory 2 IoCs
  • Drops file in Program Files directory 1001 IoCs
  • Drops file in Windows directory 319 IoCs
  • Interacts with shadow copies 2 TTPs 3 IoCs

    Shadow copies are often targeted by ransomware to inhibit system recovery.

    ransomware
  • Modifies Internet Explorer settings 1 TTPs 1 IoCs
    adwarespyware
  • Modifies system certificate store 2 TTPs 4 IoCs
    evasionspywaretrojan
  • Suspicious use of AdjustPrivilegeToken 135 IoCs
  • Suspicious use of WriteProcessMemory 72 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\bb1b5b72a867a401876a6ad6a9bcc1f4af9f4e4fdb568ef7ce2b812796b48c7a.bin.exe
    "C:\Users\Admin\AppData\Local\Temp\bb1b5b72a867a401876a6ad6a9bcc1f4af9f4e4fdb568ef7ce2b812796b48c7a.bin.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1944
    • C:\Users\Admin\AppData\Local\Temp\TaskHostHelper.exe
      "C:\Users\Admin\AppData\Local\Temp\TaskHostHelper.exe"
      2⤵
      • Executes dropped EXE
      • Drops startup file
      • Adds Run key to start application
      • Drops file in System32 directory
      • Drops file in Program Files directory
      • Drops file in Windows directory
      • Modifies system certificate store
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:1668
      • C:\Windows\SysWOW64\mshta.exe
        "C:\Windows\SysWOW64\mshta.exe" "C:\Users\Admin\Desktop\READ_ME.hta"
        3⤵
        • Modifies Internet Explorer settings
        PID:1660
      • C:\Windows\SysWOW64\WScript.exe
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\4F1T6LCU.vbs"
        3⤵
          PID:764
        • C:\Windows\SysWOW64\cmd.exe
          "C:\Windows\System32\cmd.exe" /C vssadmin.exe delete shadows /all /quiet
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:1980
          • C:\Windows\SysWOW64\vssadmin.exe
            vssadmin.exe delete shadows /all /quiet
            4⤵
            • Interacts with shadow copies
            PID:528
        • C:\Windows\SysWOW64\cmd.exe
          "C:\Windows\System32\cmd.exe" /C wmic shadowcopy delete
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:1904
          • C:\Windows\SysWOW64\Wbem\WMIC.exe
            wmic shadowcopy delete
            4⤵
            • Suspicious use of AdjustPrivilegeToken
            PID:952
        • C:\Windows\SysWOW64\cmd.exe
          "C:\Windows\System32\cmd.exe" /C wbadmin delete catalog -quiet
          3⤵
            PID:1436
          • C:\Windows\SysWOW64\cmd.exe
            "C:\Windows\System32\cmd.exe" /C vssadmin.exe delete shadows /all /quiet
            3⤵
            • Suspicious use of WriteProcessMemory
            PID:976
            • C:\Windows\SysWOW64\vssadmin.exe
              vssadmin.exe delete shadows /all /quiet
              4⤵
              • Interacts with shadow copies
              PID:2064
          • C:\Windows\SysWOW64\cmd.exe
            "C:\Windows\System32\cmd.exe" /C wmic shadowcopy delete
            3⤵
            • Suspicious use of WriteProcessMemory
            PID:1404
            • C:\Windows\SysWOW64\Wbem\WMIC.exe
              wmic shadowcopy delete
              4⤵
              • Suspicious use of AdjustPrivilegeToken
              PID:2100
          • C:\Windows\SysWOW64\cmd.exe
            "C:\Windows\System32\cmd.exe" /C wbadmin delete catalog -quiet
            3⤵
              PID:1388
            • C:\Windows\SysWOW64\cmd.exe
              "C:\Windows\System32\cmd.exe" /C vssadmin.exe delete shadows /all /quiet
              3⤵
                PID:2160
                • C:\Windows\SysWOW64\vssadmin.exe
                  vssadmin.exe delete shadows /all /quiet
                  4⤵
                  • Interacts with shadow copies
                  PID:2224
              • C:\Windows\SysWOW64\cmd.exe
                "C:\Windows\System32\cmd.exe" /C wmic shadowcopy delete
                3⤵
                  PID:2172
                  • C:\Windows\SysWOW64\Wbem\WMIC.exe
                    wmic shadowcopy delete
                    4⤵
                      PID:2264
                  • C:\Windows\SysWOW64\cmd.exe
                    "C:\Windows\System32\cmd.exe" /C wbadmin delete catalog -quiet
                    3⤵
                      PID:2200
                • C:\Windows\system32\vssvc.exe
                  C:\Windows\system32\vssvc.exe
                  1⤵
                  • Suspicious use of AdjustPrivilegeToken
                  PID:980
                • C:\Windows\SysWOW64\DllHost.exe
                  C:\Windows\SysWOW64\DllHost.exe /Processid:{3F6B5E16-092A-41ED-930B-0B4125D91D4E}
                  1⤵
                    PID:564
                  • C:\Windows\system32\AUDIODG.EXE
                    C:\Windows\system32\AUDIODG.EXE 0x55c
                    1⤵
                    • Suspicious use of AdjustPrivilegeToken
                    PID:1956

                  Network

                  MITRE ATT&CK Enterprise v6

                  Replay Monitor

                  Loading Replay Monitor...

                  Downloads

                  • C:\Users\Admin\AppData\Local\Temp\4F1T6LCU.vbs
                    MD5

                    07641762ad9c0d4b5983babccecb071b

                    SHA1

                    84afb077fccaa75f82338c30c5d03f4b67e39c62

                    SHA256

                    c65ff4443a32b8144455278a1fd98d442e1ad76f738a82668b2229acd7a2a117

                    SHA512

                    4be951540e9ad6c0eba31a1c31899ee1b327b4f37410cfc1f8a2fa8b27d705a265053f4ace0e8997b2ba337d293adb8d122860a85b775c41dfea5e1f252977ff

                    Download Submit

                  • C:\Users\Admin\AppData\Local\Temp\TaskHostHelper.exe
                    MD5

                    c6ec91aaa2bba2deb31fb645a2f9b9e4

                    SHA1

                    a921f8a827897250ebbc9847ea113f56dbb1c18d

                    SHA256

                    b5e178f6b78d77fa92e271409eb3d0472c5608df13fbb7de1f8501f0ee87a8d0

                    SHA512

                    13571cf45881b5d4ef0904f2aa0e091e9fe895bf038b71075f09a051318cf052e0737ad1fab5549e5143e866fda816ce282a2330dea128357e201948b8ce7019

                    Download Submit

                  • C:\Users\Admin\AppData\Local\Temp\TaskHostHelper.exe
                    MD5

                    c6ec91aaa2bba2deb31fb645a2f9b9e4

                    SHA1

                    a921f8a827897250ebbc9847ea113f56dbb1c18d

                    SHA256

                    b5e178f6b78d77fa92e271409eb3d0472c5608df13fbb7de1f8501f0ee87a8d0

                    SHA512

                    13571cf45881b5d4ef0904f2aa0e091e9fe895bf038b71075f09a051318cf052e0737ad1fab5549e5143e866fda816ce282a2330dea128357e201948b8ce7019

                    Download Submit

                  • C:\Users\Admin\Desktop\READ_ME.hta
                    MD5

                    a076b2df780ea7d573ffd70ce0c603ea

                    SHA1

                    226531b08d9cdccf6de988172ed1e144b1d0be57

                    SHA256

                    6d5c611b01516055bbc4a56e992e7d90fcab562448d5b56a179d0f286c4b356a

                    SHA512

                    aa610f6f9c1b7cefe0f4bffe6acaae668b33e19430e137523193a51f30dd89b096b9fd29f323e9c1f71da0e6d99b8d8cb2eb334275db5ac02375af447a0e7fdd

                    Download Submit

                  • \Users\Admin\AppData\Local\Temp\TaskHostHelper.exe
                    MD5

                    c6ec91aaa2bba2deb31fb645a2f9b9e4

                    SHA1

                    a921f8a827897250ebbc9847ea113f56dbb1c18d

                    SHA256

                    b5e178f6b78d77fa92e271409eb3d0472c5608df13fbb7de1f8501f0ee87a8d0

                    SHA512

                    13571cf45881b5d4ef0904f2aa0e091e9fe895bf038b71075f09a051318cf052e0737ad1fab5549e5143e866fda816ce282a2330dea128357e201948b8ce7019

                    Download Submit

                  • \Users\Admin\AppData\Local\Temp\TaskHostHelper.exe
                    MD5

                    c6ec91aaa2bba2deb31fb645a2f9b9e4

                    SHA1

                    a921f8a827897250ebbc9847ea113f56dbb1c18d

                    SHA256

                    b5e178f6b78d77fa92e271409eb3d0472c5608df13fbb7de1f8501f0ee87a8d0

                    SHA512

                    13571cf45881b5d4ef0904f2aa0e091e9fe895bf038b71075f09a051318cf052e0737ad1fab5549e5143e866fda816ce282a2330dea128357e201948b8ce7019

                    Download Submit

                  • memory/528-26-0x0000000000000000-mapping.dmp

                    Download

                  • memory/764-17-0x0000000000000000-mapping.dmp

                    Download

                  • memory/952-25-0x0000000000000000-mapping.dmp

                    Download

                  • memory/976-28-0x0000000000000000-mapping.dmp

                    Download

                  • memory/1184-27-0x000007FEF6680000-0x000007FEF68FA000-memory.dmp

                    Filesize

                    2.5MB

                    Download

                  • memory/1388-30-0x0000000000000000-mapping.dmp

                    Download

                  • memory/1404-29-0x0000000000000000-mapping.dmp

                    Download

                  • memory/1436-24-0x0000000000000000-mapping.dmp

                    Download

                  • memory/1660-19-0x0000000075AE1000-0x0000000075AE3000-memory.dmp

                    Filesize

                    8KB

                    Download

                  • memory/1660-16-0x0000000000000000-mapping.dmp

                    Download

                  • memory/1668-8-0x0000000000000000-mapping.dmp

                    Download

                  • memory/1668-14-0x0000000000B00000-0x0000000000B01000-memory.dmp

                    Filesize

                    4KB

                    Download

                  • memory/1668-11-0x00000000736B0000-0x0000000073D9E000-memory.dmp

                    Filesize

                    6.9MB

                    Download

                  • memory/1668-15-0x0000000000B05000-0x0000000000B16000-memory.dmp

                    Filesize

                    68KB

                    Download

                  • memory/1668-12-0x0000000000B70000-0x0000000000B71000-memory.dmp

                    Filesize

                    4KB

                    Download

                  • memory/1904-20-0x0000000000000000-mapping.dmp

                    Download

                  • memory/1944-5-0x00000000012B0000-0x00000000012B1000-memory.dmp

                    Filesize

                    4KB

                    Download

                  • memory/1944-3-0x0000000001370000-0x0000000001371000-memory.dmp

                    Filesize

                    4KB

                    Download

                  • memory/1944-2-0x00000000742C0000-0x00000000749AE000-memory.dmp

                    Filesize

                    6.9MB

                    Download

                  • memory/1980-18-0x0000000000000000-mapping.dmp

                    Download

                  • memory/2064-31-0x0000000000000000-mapping.dmp

                    Download

                  • memory/2100-32-0x0000000000000000-mapping.dmp

                    Download

                  • memory/2160-33-0x0000000000000000-mapping.dmp

                    Download

                  • memory/2172-34-0x0000000000000000-mapping.dmp

                    Download

                  • memory/2200-35-0x0000000000000000-mapping.dmp

                    Download

                  • memory/2224-36-0x0000000000000000-mapping.dmp

                    Download

                  • memory/2264-37-0x0000000000000000-mapping.dmp

                    Download