Analysis
-
max time kernel
139s -
max time network
110s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
18-01-2021 22:48
General
-
Target
b5e178f6b78d77fa92e271409eb3d0472c5608df13fbb7de1f8501f0ee87a8d0.exe
-
Size
29KB
-
MD5
c6ec91aaa2bba2deb31fb645a2f9b9e4
-
SHA1
a921f8a827897250ebbc9847ea113f56dbb1c18d
-
SHA256
b5e178f6b78d77fa92e271409eb3d0472c5608df13fbb7de1f8501f0ee87a8d0
-
SHA512
13571cf45881b5d4ef0904f2aa0e091e9fe895bf038b71075f09a051318cf052e0737ad1fab5549e5143e866fda816ce282a2330dea128357e201948b8ce7019
Score
10/10
Malware Config
Extracted
Path
C:\Users\Admin\Desktop\READ_ME.hta
Ransom Note
E P S I L O N Ransomware
⠀
As you can see, all your files got encrypted. Thats why your files are no longer readable.
If you want them back, please contact us at our email below.
You can send us a couple of files and we will return the restored ones to prove that only we can do it.
[email protected]
You can ask for more details and more help by email.
You can learn more about bitcoin and encryption on wikipedia.
https://wikipedia.org/wiki/Bitcoinhttps://wikipedia.org/wiki/Encryption
⠀
If you already submited your payement, you will receive your private key and another decryption key with the special decryption software.
More informations:
1. the infection was due to vulnerabilities in your software.
2. our goal is to return your data, but if you don't contact us, we will not succeed.
IMPORTANT:
1. if you want to make sure that it is impossible to recover files using third-party software, do this not on all files, otherwise you may lose all data.
2. only communication through our email can guarantee file recover for you. We are not responsible for the actions of third parties who promise to help you - most often they are scammers.
3. please, do not try to rename encrypted files.
Emails
URLs
https://wikipedia.org/wiki/Bitcoinhttps://wikipedia.org/wiki/Encryption
Signatures
-
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Drops startup file 1 IoCs
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Drops file in System32 directory 1 IoCs
-
Drops file in Program Files directory 1674 IoCs
-
Drops file in Windows directory 386 IoCs
-
Interacts with shadow copies 2 TTPs 3 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
-
Modifies registry class 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 138 IoCs
-
Suspicious use of WriteProcessMemory 51 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\b5e178f6b78d77fa92e271409eb3d0472c5608df13fbb7de1f8501f0ee87a8d0.exe"C:\Users\Admin\AppData\Local\Temp\b5e178f6b78d77fa92e271409eb3d0472c5608df13fbb7de1f8501f0ee87a8d0.exe"1⤵
- Drops startup file
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\SysWOW64\mshta.exe" "C:\Users\Admin\Desktop\READ_ME.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}2⤵
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\M6B32XB9.vbs"2⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C vssadmin.exe delete shadows /all /quiet2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\vssadmin.exevssadmin.exe delete shadows /all /quiet3⤵
- Interacts with shadow copies
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C wmic shadowcopy delete2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\Wbem\WMIC.exewmic shadowcopy delete3⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C wbadmin delete catalog -quiet2⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C vssadmin.exe delete shadows /all /quiet2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\vssadmin.exevssadmin.exe delete shadows /all /quiet3⤵
- Interacts with shadow copies
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C wmic shadowcopy delete2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\Wbem\WMIC.exewmic shadowcopy delete3⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C wbadmin delete catalog -quiet2⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C vssadmin.exe delete shadows /all /quiet2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\vssadmin.exevssadmin.exe delete shadows /all /quiet3⤵
- Interacts with shadow copies
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C wbadmin delete catalog -quiet2⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C wmic shadowcopy delete2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\Wbem\WMIC.exewmic shadowcopy delete3⤵
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x3d01⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\M6B32XB9.vbsMD5
07641762ad9c0d4b5983babccecb071b
SHA184afb077fccaa75f82338c30c5d03f4b67e39c62
SHA256c65ff4443a32b8144455278a1fd98d442e1ad76f738a82668b2229acd7a2a117
SHA5124be951540e9ad6c0eba31a1c31899ee1b327b4f37410cfc1f8a2fa8b27d705a265053f4ace0e8997b2ba337d293adb8d122860a85b775c41dfea5e1f252977ff
-
C:\Users\Admin\Desktop\READ_ME.htaMD5
a076b2df780ea7d573ffd70ce0c603ea
SHA1226531b08d9cdccf6de988172ed1e144b1d0be57
SHA2566d5c611b01516055bbc4a56e992e7d90fcab562448d5b56a179d0f286c4b356a
SHA512aa610f6f9c1b7cefe0f4bffe6acaae668b33e19430e137523193a51f30dd89b096b9fd29f323e9c1f71da0e6d99b8d8cb2eb334275db5ac02375af447a0e7fdd
-
memory/208-13-0x0000000000000000-mapping.dmp
-
memory/740-9-0x0000000005153000-0x0000000005155000-memory.dmpFilesize
8KB
-
memory/740-3-0x0000000000770000-0x0000000000771000-memory.dmpFilesize
4KB
-
memory/740-8-0x0000000005040000-0x0000000005041000-memory.dmpFilesize
4KB
-
memory/740-2-0x0000000073EE0000-0x00000000745CE000-memory.dmpFilesize
6.9MB
-
memory/740-7-0x0000000005150000-0x0000000005151000-memory.dmpFilesize
4KB
-
memory/740-5-0x00000000055A0000-0x00000000055A1000-memory.dmpFilesize
4KB
-
memory/740-6-0x0000000004F90000-0x0000000004F91000-memory.dmpFilesize
4KB
-
memory/960-10-0x0000000000000000-mapping.dmp
-
memory/1036-14-0x0000000000000000-mapping.dmp
-
memory/1648-21-0x0000000000000000-mapping.dmp
-
memory/1812-19-0x0000000000000000-mapping.dmp
-
memory/1896-27-0x0000000000000000-mapping.dmp
-
memory/2280-22-0x0000000000000000-mapping.dmp
-
memory/2624-28-0x0000000000000000-mapping.dmp
-
memory/2740-24-0x0000000000000000-mapping.dmp
-
memory/2920-11-0x0000000000000000-mapping.dmp
-
memory/3004-17-0x0000000000000000-mapping.dmp
-
memory/3024-12-0x0000000000000000-mapping.dmp
-
memory/3424-18-0x0000000000000000-mapping.dmp
-
memory/3604-23-0x0000000000000000-mapping.dmp
-
memory/3688-25-0x0000000000000000-mapping.dmp
-
memory/3928-26-0x0000000000000000-mapping.dmp
-
memory/3988-20-0x0000000000000000-mapping.dmp