Overview

overview

10

Static

static

b5e178f6b7...in.exe

windows7_x64

10

b5e178f6b7...in.exe

windows10_x64

10

Analysis

  • max time kernel
    142s
  • max time network
    112s
  • platform
    windows10_x64
  • resource
    win10v20201028
  • submitted
    18-01-2021 22:20

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    b5e178f6b78d77fa92e271409eb3d0472c5608df13fbb7de1f8501f0ee87a8d0.bin.exe

  • Size

    29KB

  • MD5

    c6ec91aaa2bba2deb31fb645a2f9b9e4

  • SHA1

    a921f8a827897250ebbc9847ea113f56dbb1c18d

  • SHA256

    b5e178f6b78d77fa92e271409eb3d0472c5608df13fbb7de1f8501f0ee87a8d0

  • SHA512

    13571cf45881b5d4ef0904f2aa0e091e9fe895bf038b71075f09a051318cf052e0737ad1fab5549e5143e866fda816ce282a2330dea128357e201948b8ce7019

Score
10/10
persistenceransomwarespyware

Malware Config

Extracted

Path

C:\Users\Admin\Desktop\READ_ME.hta

Ransom Note
E P S I L O N Ransomware ⠀ As you can see, all your files got encrypted. Thats why your files are no longer readable. If you want them back, please contact us at our email below. You can send us a couple of files and we will return the restored ones to prove that only we can do it. [email protected] You can ask for more details and more help by email. You can learn more about bitcoin and encryption on wikipedia. https://wikipedia.org/wiki/Bitcoinhttps://wikipedia.org/wiki/Encryption ⠀ If you already submited your payement, you will receive your private key and another decryption key with the special decryption software. More informations: 1. the infection was due to vulnerabilities in your software. 2. our goal is to return your data, but if you don't contact us, we will not succeed. IMPORTANT: 1. if you want to make sure that it is impossible to recover files using third-party software, do this not on all files, otherwise you may lose all data. 2. only communication through our email can guarantee file recover for you. We are not responsible for the actions of third parties who promise to help you - most often they are scammers. 3. please, do not try to rename encrypted files.
URLs

https://wikipedia.org/wiki/Bitcoinhttps://wikipedia.org/wiki/Encryption

Signatures

  • Deletes shadow copies 2 TTPs

    Ransomware often targets backup files to inhibit system recovery.

    ransomware
  • Drops startup file 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spyware
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Drops file in System32 directory 1 IoCs
  • Drops file in Program Files directory 1671 IoCs
  • Drops file in Windows directory 386 IoCs
  • Interacts with shadow copies 2 TTPs 3 IoCs

    Shadow copies are often targeted by ransomware to inhibit system recovery.

    ransomware
  • Modifies registry class 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 138 IoCs
  • Suspicious use of WriteProcessMemory 51 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\b5e178f6b78d77fa92e271409eb3d0472c5608df13fbb7de1f8501f0ee87a8d0.bin.exe
    "C:\Users\Admin\AppData\Local\Temp\b5e178f6b78d77fa92e271409eb3d0472c5608df13fbb7de1f8501f0ee87a8d0.bin.exe"
    1⤵
    • Drops startup file
    • Adds Run key to start application
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Modifies registry class
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4028
    • C:\Windows\SysWOW64\mshta.exe
      "C:\Windows\SysWOW64\mshta.exe" "C:\Users\Admin\Desktop\READ_ME.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}
      2⤵
        PID:2444
      • C:\Windows\SysWOW64\WScript.exe
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\D31MZGQF.vbs"
        2⤵
          PID:756
        • C:\Windows\SysWOW64\cmd.exe
          "C:\Windows\System32\cmd.exe" /C vssadmin.exe delete shadows /all /quiet
          2⤵
          • Suspicious use of WriteProcessMemory
          PID:1484
          • C:\Windows\SysWOW64\vssadmin.exe
            vssadmin.exe delete shadows /all /quiet
            3⤵
            • Interacts with shadow copies
            PID:2684
        • C:\Windows\SysWOW64\cmd.exe
          "C:\Windows\System32\cmd.exe" /C wmic shadowcopy delete
          2⤵
          • Suspicious use of WriteProcessMemory
          PID:3608
          • C:\Windows\SysWOW64\Wbem\WMIC.exe
            wmic shadowcopy delete
            3⤵
            • Suspicious use of AdjustPrivilegeToken
            PID:3136
        • C:\Windows\SysWOW64\cmd.exe
          "C:\Windows\System32\cmd.exe" /C wbadmin delete catalog -quiet
          2⤵
            PID:2276
          • C:\Windows\SysWOW64\cmd.exe
            "C:\Windows\System32\cmd.exe" /C vssadmin.exe delete shadows /all /quiet
            2⤵
            • Suspicious use of WriteProcessMemory
            PID:4040
            • C:\Windows\SysWOW64\vssadmin.exe
              vssadmin.exe delete shadows /all /quiet
              3⤵
              • Interacts with shadow copies
              PID:2940
          • C:\Windows\SysWOW64\cmd.exe
            "C:\Windows\System32\cmd.exe" /C wmic shadowcopy delete
            2⤵
            • Suspicious use of WriteProcessMemory
            PID:3200
            • C:\Windows\SysWOW64\Wbem\WMIC.exe
              wmic shadowcopy delete
              3⤵
              • Suspicious use of AdjustPrivilegeToken
              PID:2244
          • C:\Windows\SysWOW64\cmd.exe
            "C:\Windows\System32\cmd.exe" /C wbadmin delete catalog -quiet
            2⤵
              PID:3256
            • C:\Windows\SysWOW64\cmd.exe
              "C:\Windows\System32\cmd.exe" /C wbadmin delete catalog -quiet
              2⤵
                PID:4060
              • C:\Windows\SysWOW64\cmd.exe
                "C:\Windows\System32\cmd.exe" /C wmic shadowcopy delete
                2⤵
                • Suspicious use of WriteProcessMemory
                PID:3840
                • C:\Windows\SysWOW64\Wbem\WMIC.exe
                  wmic shadowcopy delete
                  3⤵
                    PID:2356
                • C:\Windows\SysWOW64\cmd.exe
                  "C:\Windows\System32\cmd.exe" /C vssadmin.exe delete shadows /all /quiet
                  2⤵
                  • Suspicious use of WriteProcessMemory
                  PID:3440
                  • C:\Windows\SysWOW64\vssadmin.exe
                    vssadmin.exe delete shadows /all /quiet
                    3⤵
                    • Interacts with shadow copies
                    PID:4092
              • C:\Windows\system32\vssvc.exe
                C:\Windows\system32\vssvc.exe
                1⤵
                • Suspicious use of AdjustPrivilegeToken
                PID:2696
              • C:\Windows\system32\AUDIODG.EXE
                C:\Windows\system32\AUDIODG.EXE 0x3ac
                1⤵
                  PID:1308

                Network

                MITRE ATT&CK Enterprise v6

                Replay Monitor

                Loading Replay Monitor...

                Downloads

                • C:\Users\Admin\AppData\Local\Temp\D31MZGQF.vbs
                  MD5

                  07641762ad9c0d4b5983babccecb071b

                  SHA1

                  84afb077fccaa75f82338c30c5d03f4b67e39c62

                  SHA256

                  c65ff4443a32b8144455278a1fd98d442e1ad76f738a82668b2229acd7a2a117

                  SHA512

                  4be951540e9ad6c0eba31a1c31899ee1b327b4f37410cfc1f8a2fa8b27d705a265053f4ace0e8997b2ba337d293adb8d122860a85b775c41dfea5e1f252977ff

                  Download Submit

                • C:\Users\Admin\Desktop\READ_ME.hta
                  MD5

                  a076b2df780ea7d573ffd70ce0c603ea

                  SHA1

                  226531b08d9cdccf6de988172ed1e144b1d0be57

                  SHA256

                  6d5c611b01516055bbc4a56e992e7d90fcab562448d5b56a179d0f286c4b356a

                  SHA512

                  aa610f6f9c1b7cefe0f4bffe6acaae668b33e19430e137523193a51f30dd89b096b9fd29f323e9c1f71da0e6d99b8d8cb2eb334275db5ac02375af447a0e7fdd

                  Download Submit

                • memory/756-11-0x0000000000000000-mapping.dmp

                  Download

                • memory/1484-12-0x0000000000000000-mapping.dmp

                  Download

                • memory/2244-23-0x0000000000000000-mapping.dmp

                  Download

                • memory/2276-14-0x0000000000000000-mapping.dmp

                  Download

                • memory/2356-27-0x0000000000000000-mapping.dmp

                  Download

                • memory/2444-10-0x0000000000000000-mapping.dmp

                  Download

                • memory/2684-16-0x0000000000000000-mapping.dmp

                  Download

                • memory/2940-22-0x0000000000000000-mapping.dmp

                  Download

                • memory/3136-17-0x0000000000000000-mapping.dmp

                  Download

                • memory/3200-20-0x0000000000000000-mapping.dmp

                  Download

                • memory/3256-21-0x0000000000000000-mapping.dmp

                  Download

                • memory/3440-24-0x0000000000000000-mapping.dmp

                  Download

                • memory/3608-13-0x0000000000000000-mapping.dmp

                  Download

                • memory/3840-25-0x0000000000000000-mapping.dmp

                  Download

                • memory/4028-9-0x0000000005093000-0x0000000005095000-memory.dmp

                  Filesize

                  8KB

                  Download

                • memory/4028-8-0x0000000004E20000-0x0000000004E21000-memory.dmp

                  Filesize

                  4KB

                  Download

                • memory/4028-7-0x0000000005090000-0x0000000005091000-memory.dmp

                  Filesize

                  4KB

                  Download

                • memory/4028-2-0x0000000073940000-0x000000007402E000-memory.dmp

                  Filesize

                  6.9MB

                  Download

                • memory/4028-6-0x0000000004EB0000-0x0000000004EB1000-memory.dmp

                  Filesize

                  4KB

                  Download

                • memory/4028-5-0x0000000005310000-0x0000000005311000-memory.dmp

                  Filesize

                  4KB

                  Download

                • memory/4028-3-0x00000000005F0000-0x00000000005F1000-memory.dmp

                  Filesize

                  4KB

                  Download

                • memory/4040-19-0x0000000000000000-mapping.dmp

                  Download

                • memory/4060-26-0x0000000000000000-mapping.dmp

                  Download

                • memory/4092-28-0x0000000000000000-mapping.dmp

                  Download