Overview

overview

10

Static

static

_$.exe

windows7_x64

10

_$.exe

windows10_x64

10

Analysis

  • max time kernel
    95s
  • max time network
    110s
  • platform
    windows10_x64
  • resource
    win10v20201028
  • submitted
    13/02/2021, 10:58

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    _$.exe

  • Size

    50KB

  • MD5

    7c93a02c3a90f915530df1acaa07fec9

  • SHA1

    1353fc85e84a431d43e519c8eef3d789b2a84be5

  • SHA256

    db5964ee570a1cbcbd1a0c7c8a7e4aadb44f64c27061ab25fde24a7f21d73f45

  • SHA512

    e8fa76667098d6d9caf3348dfd784ad68e14f44879d0a25a087486599478debc7f337669e16b444e3e056368faf7036ff39a2c60beb408af4bca2d4d151608f2

Score
10/10
ransomwarespyware

Malware Config

Extracted

Path

C:\Users\Admin\Desktop\info.hta

Ransom Note
🔒 ALL YOUR DATA TURNED TO USELESS BINARY CODE 🔒 Your computer is infected with a virus. Send an email [email protected] , specify in the subject your unique identifier ESM8IZN6 and you will definitly be helped to recover. NOTE: You can send 2 files as proof that we can return all your data. If the provided email doesn't work, please contact us at [email protected] Algorithms used are AES and RSA. IMPORTANT: 1. The infection was due to vulnerabilities in your software. 2. If you want to make sure that it is impossible to recover files using third-party software, do this not on all files, otherwise you may lose all data. 3. Only communication through our email can guarantee file recover for you. We are not responsible for the actions of third parties who promise to help you - most often they are scammers. 4. Please, do not try to rename encrypted files. 5. Our goal is to return your data, but if you don't contact us, we will not succeed.

Signatures

  • Deletes shadow copies 2 TTPs

    Ransomware often targets backup files to inhibit system recovery.

    ransomware
  • Executes dropped EXE 2 IoCs
  • Modifies extensions of user files 3 IoCs

    Ransomware generally changes the extension on encrypted files.

    ransomware
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spyware
  • Drops file in System32 directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 64 IoCs
  • Interacts with shadow copies 2 TTPs 3 IoCs

    Shadow copies are often targeted by ransomware to inhibit system recovery.

    ransomware
  • Kills process with taskkill 1 IoCs
    evasion
  • Modifies registry class 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\_$.exe
    "C:\Users\Admin\AppData\Local\Temp\_$.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:812
    • \??\c:\windows\system32\cmstp.exe
      "c:\windows\system32\cmstp.exe" /au C:\Windows\temp\30zrxhkv.inf
      2⤵
        PID:3780
    • C:\Windows\system32\cmd.exe
      cmd /c start C:\Windows\temp\z4calwqf.exe
      1⤵
      • Suspicious use of WriteProcessMemory
      PID:2916
      • C:\Windows\temp\z4calwqf.exe
        C:\Windows\temp\z4calwqf.exe
        2⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:584
        • C:\Users\Admin\AppData\Roaming\TaskHost.exe
          "C:\Users\Admin\AppData\Roaming\TaskHost.exe"
          3⤵
          • Executes dropped EXE
          • Modifies extensions of user files
          • Drops file in System32 directory
          • Drops file in Program Files directory
          • Drops file in Windows directory
          • Modifies registry class
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:1324
          • C:\Windows\SysWOW64\cmd.exe
            "C:\Windows\System32\cmd.exe" /C vssadmin.exe delete shadows /all /quiet
            4⤵
            • Suspicious use of WriteProcessMemory
            PID:3768
            • C:\Windows\SysWOW64\vssadmin.exe
              vssadmin.exe delete shadows /all /quiet
              5⤵
              • Interacts with shadow copies
              PID:356
          • C:\Windows\SysWOW64\cmd.exe
            "C:\Windows\System32\cmd.exe" /C wmic shadowcopy delete
            4⤵
            • Suspicious use of WriteProcessMemory
            PID:2344
            • C:\Windows\SysWOW64\Wbem\WMIC.exe
              wmic shadowcopy delete
              5⤵
              • Suspicious use of AdjustPrivilegeToken
              PID:3820
          • C:\Windows\SysWOW64\cmd.exe
            "C:\Windows\System32\cmd.exe" /C wbadmin delete catalog -quiet
            4⤵
              PID:3992
            • C:\Windows\SysWOW64\cmd.exe
              "C:\Windows\System32\cmd.exe" /C vssadmin.exe delete shadows /all /quiet
              4⤵
              • Suspicious use of WriteProcessMemory
              PID:2336
              • C:\Windows\SysWOW64\vssadmin.exe
                vssadmin.exe delete shadows /all /quiet
                5⤵
                • Interacts with shadow copies
                PID:2052
            • C:\Windows\SysWOW64\cmd.exe
              "C:\Windows\System32\cmd.exe" /C wmic shadowcopy delete
              4⤵
              • Suspicious use of WriteProcessMemory
              PID:3392
              • C:\Windows\SysWOW64\Wbem\WMIC.exe
                wmic shadowcopy delete
                5⤵
                • Suspicious use of AdjustPrivilegeToken
                PID:2572
            • C:\Windows\SysWOW64\cmd.exe
              "C:\Windows\System32\cmd.exe" /C wbadmin delete catalog -quiet
              4⤵
                PID:3508
              • C:\Windows\SysWOW64\cmd.exe
                "C:\Windows\System32\cmd.exe" /C vssadmin.exe delete shadows /all /quiet
                4⤵
                • Suspicious use of WriteProcessMemory
                PID:3488
                • C:\Windows\SysWOW64\vssadmin.exe
                  vssadmin.exe delete shadows /all /quiet
                  5⤵
                  • Interacts with shadow copies
                  PID:976
              • C:\Windows\SysWOW64\cmd.exe
                "C:\Windows\System32\cmd.exe" /C wbadmin delete catalog -quiet
                4⤵
                  PID:3832
                • C:\Windows\SysWOW64\cmd.exe
                  "C:\Windows\System32\cmd.exe" /C wmic shadowcopy delete
                  4⤵
                  • Suspicious use of WriteProcessMemory
                  PID:3252
                  • C:\Windows\SysWOW64\Wbem\WMIC.exe
                    wmic shadowcopy delete
                    5⤵
                      PID:3840
                  • C:\Windows\SysWOW64\mshta.exe
                    "C:\Windows\SysWOW64\mshta.exe" "C:\Users\Admin\Desktop\info.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}
                    4⤵
                      PID:1068
                    • C:\Windows\SysWOW64\cmd.exe
                      "C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 1 & Del "C:\Users\Admin\AppData\Roaming\TaskHost.exe"
                      4⤵
                        PID:3836
                        • C:\Windows\SysWOW64\choice.exe
                          choice /C Y /N /D Y /T 1
                          5⤵
                            PID:1352
                      • C:\Windows\SysWOW64\cmd.exe
                        "C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 1 & Del "C:\Windows\temp\z4calwqf.exe"
                        3⤵
                        • Suspicious use of WriteProcessMemory
                        PID:1376
                        • C:\Windows\SysWOW64\choice.exe
                          choice /C Y /N /D Y /T 1
                          4⤵
                            PID:3948
                    • C:\Windows\system32\taskkill.exe
                      taskkill /IM cmstp.exe /F
                      1⤵
                      • Kills process with taskkill
                      • Suspicious use of AdjustPrivilegeToken
                      PID:4092
                    • C:\Windows\system32\vssvc.exe
                      C:\Windows\system32\vssvc.exe
                      1⤵
                      • Suspicious use of AdjustPrivilegeToken
                      PID:1008

                    Network

                    MITRE ATT&CK Enterprise v6

                    Replay Monitor

                    Loading Replay Monitor...

                    Downloads

                    • memory/584-23-0x00000000006E0000-0x00000000006E1000-memory.dmp

                      Filesize

                      4KB

                      Download

                    • memory/584-22-0x0000000074070000-0x000000007475E000-memory.dmp

                      Filesize

                      6.9MB

                      Download

                    • memory/812-17-0x000000001AF34000-0x000000001AF36000-memory.dmp

                      Filesize

                      8KB

                      Download

                    • memory/812-16-0x000000001AF32000-0x000000001AF34000-memory.dmp

                      Filesize

                      8KB

                      Download

                    • memory/812-15-0x000000001AF30000-0x000000001AF32000-memory.dmp

                      Filesize

                      8KB

                      Download

                    • memory/812-2-0x00007FFB852D0000-0x00007FFB85CBC000-memory.dmp

                      Filesize

                      9.9MB

                      Download

                    • memory/812-3-0x0000000000380000-0x0000000000381000-memory.dmp

                      Filesize

                      4KB

                      Download

                    • memory/1324-33-0x0000000005730000-0x0000000005731000-memory.dmp

                      Filesize

                      4KB

                      Download

                    • memory/1324-36-0x0000000005930000-0x0000000005931000-memory.dmp

                      Filesize

                      4KB

                      Download

                    • memory/1324-29-0x0000000000ED0000-0x0000000000ED1000-memory.dmp

                      Filesize

                      4KB

                      Download

                    • memory/1324-31-0x0000000005D50000-0x0000000005D51000-memory.dmp

                      Filesize

                      4KB

                      Download

                    • memory/1324-28-0x0000000074070000-0x000000007475E000-memory.dmp

                      Filesize

                      6.9MB

                      Download

                    • memory/1324-35-0x0000000005700000-0x0000000005701000-memory.dmp

                      Filesize

                      4KB

                      Download

                    • memory/3780-9-0x00000217F8610000-0x00000217F8611000-memory.dmp

                      Filesize

                      4KB

                      Download

                    • memory/3780-12-0x00000217F8670000-0x00000217F8671000-memory.dmp

                      Filesize

                      4KB

                      Download

                    • memory/3780-7-0x00000217F8610000-0x00000217F8611000-memory.dmp

                      Filesize

                      4KB

                      Download