Overview

overview

10

Static

static

8

cadbbf76fd...le.exe

windows7_x64

10

cadbbf76fd...le.exe

windows10_x64

10

Analysis

  • max time kernel
    142s
  • max time network
    133s
  • platform
    windows7_x64
  • resource
    win7v20201028
  • submitted
    18/02/2021, 17:54

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    cadbbf76fd42b925147d01cc74e82bc8b2b6b03a82a63ca39d2ef1c2877eb536.bin.sample.exe

  • Size

    369KB

  • MD5

    df919a46da2377f913e99fa5d4997ae9

  • SHA1

    03cd2235f0e68f297020dd40ad48395fad78bd8d

  • SHA256

    cadbbf76fd42b925147d01cc74e82bc8b2b6b03a82a63ca39d2ef1c2877eb536

  • SHA512

    22870750ef402c958353faefaaa77d4549c3d3a6f1f0bf36da77d881db0d0f5ebdb758e5cef21629f407d80e155dad62de747c472624424436125ba3835e9a61

Score
10/10
evasionpersistenceransomwarespyware

Malware Config

Extracted

Path

C:\$Recycle.Bin\S-1-5-21-3825035466-2522850611-591511364-1000\HOW_TO_RETURN_FILES.txt

Ransom Note
Dear manager, your database server has been locked, your databases files are encrypted and you have unfortunately "lost" all your data, Encryption was produced using unique key AES-256 generated for this server. To decrypt files you need to obtain the decryption key and tool. All encrypted files ends with .charm To obtain the program for this server, which will decrypt all files, you need to write me to email: "[email protected]" Before payment you can send us one small file (100..500 kilobytes) and we will decrypt it - it's your guarantee that we have decryption tool. And send us your userkey We don't know who are you, All what we need is some money. Don't panic if we don't answer you during 24 hours. It means that we didn't received your letter and write us again. You can use one of that bitcoin exchangers for transfering bitcoin: https://localbitcoins.com https://www.kraken.com You dont need install bitcoin programs - you need only use one of this exchangers or other exchanger that you can find in www.google.com for your country. Please use english language in your letters. If you don't speak english then use https://translate.google.com to translate your letter on english language. You don't have enough time to think each day payment will increase and after one week your key will be deleted and your files will be locked forever. USERKEY: kZLnCucHvzB6094DFvYv/scHXO3lH8+q2SlGrWjRi80WNMlBxDbT/2H/petXbjN4frj+i1RsgLBAdbiVS5IXGLR8dt7hERf5SKyiDzD3+2q00PjYosmxkNzs+ysI82jmvdOvlVKCejlbKSCXF59JKhKxjYPxjzrLLExIkyplTbu3liT+sJ6/DSeQENfWrVLzk9aL/LNB8Njw/oUp/LinIVTA7e2prhrWwOG5xfSVyQaxlt1pjP9XiOmP2cAhRjImlc9ICG7QWR68ZhAHLKhtKWFRM7dpI2fgFSDxnTbikpGHO70BBp1GoXK6rJSdJt4OAu4adwxrVZsjBR08HtlAlQ==

Signatures

  • Deletes shadow copies 2 TTPs

    Ransomware often targets backup files to inhibit system recovery.

    ransomware
  • Modifies Installed Components in the registry 2 TTPs
    persistence
  • Modifies extensions of user files 14 IoCs

    Ransomware generally changes the extension on encrypted files.

    ransomware
  • Stops running service(s) 3 TTPs
    evasion
  • Drops startup file 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spyware
  • Drops desktop.ini file(s) 1 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 2 IoCs
  • Launches sc.exe

    Sc.exe is a Windows utlilty to control services on the system.

  • Program crash 1 IoCs
  • Kills process with taskkill 4 IoCs
    evasion
  • Modifies Internet Explorer settings 1 TTPs 2 IoCs
    adwarespyware
  • Modifies registry class 5 IoCs
  • Opens file in notepad (likely ransom note) 1 IoCs
    ransomware
  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 61 IoCs
  • Suspicious use of FindShellTrayWindow 26 IoCs
  • Suspicious use of SendNotifyMessage 26 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\cadbbf76fd42b925147d01cc74e82bc8b2b6b03a82a63ca39d2ef1c2877eb536.bin.sample.exe
    "C:\Users\Admin\AppData\Local\Temp\cadbbf76fd42b925147d01cc74e82bc8b2b6b03a82a63ca39d2ef1c2877eb536.bin.sample.exe"
    1⤵
    • Modifies extensions of user files
    • Drops startup file
    • Drops desktop.ini file(s)
    • Drops file in Program Files directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:1432
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c NET stop MSSQLSERVER /Y
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:1428
      • C:\Windows\SysWOW64\net.exe
        NET stop MSSQLSERVER /Y
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:1116
        • C:\Windows\SysWOW64\net1.exe
          C:\Windows\system32\net1 stop MSSQLSERVER /Y
          4⤵
            PID:1968
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c NET stop MSSQL$SQLEXPRESS /Y
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:2004
        • C:\Windows\SysWOW64\net.exe
          NET stop MSSQL$SQLEXPRESS /Y
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:1932
          • C:\Windows\SysWOW64\net1.exe
            C:\Windows\system32\net1 stop MSSQL$SQLEXPRESS /Y
            4⤵
              PID:1912
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c NET STOP acrsch2svc /Y
          2⤵
          • Suspicious use of WriteProcessMemory
          PID:2040
          • C:\Windows\SysWOW64\net.exe
            NET STOP acrsch2svc /Y
            3⤵
            • Suspicious use of WriteProcessMemory
            PID:1220
            • C:\Windows\SysWOW64\net1.exe
              C:\Windows\system32\net1 STOP acrsch2svc /Y
              4⤵
                PID:364
          • C:\Windows\SysWOW64\cmd.exe
            C:\Windows\system32\cmd.exe /c NET STOP acronisagent /Y
            2⤵
            • Suspicious use of WriteProcessMemory
            PID:332
            • C:\Windows\SysWOW64\net.exe
              NET STOP acronisagent /Y
              3⤵
              • Suspicious use of WriteProcessMemory
              PID:592
              • C:\Windows\SysWOW64\net1.exe
                C:\Windows\system32\net1 STOP acronisagent /Y
                4⤵
                  PID:1608
            • C:\Windows\SysWOW64\cmd.exe
              C:\Windows\system32\cmd.exe /c NET STOP arsm /Y
              2⤵
              • Suspicious use of WriteProcessMemory
              PID:820
              • C:\Windows\SysWOW64\net.exe
                NET STOP arsm /Y
                3⤵
                • Suspicious use of WriteProcessMemory
                PID:1444
                • C:\Windows\SysWOW64\net1.exe
                  C:\Windows\system32\net1 STOP arsm /Y
                  4⤵
                    PID:1040
              • C:\Windows\SysWOW64\cmd.exe
                C:\Windows\system32\cmd.exe /c NET STOP FirebirdServerDefaultInstance /Y
                2⤵
                  PID:816
                  • C:\Windows\SysWOW64\net.exe
                    NET STOP FirebirdServerDefaultInstance /Y
                    3⤵
                      PID:1500
                      • C:\Windows\SysWOW64\net1.exe
                        C:\Windows\system32\net1 STOP FirebirdServerDefaultInstance /Y
                        4⤵
                          PID:1132
                    • C:\Windows\SysWOW64\cmd.exe
                      C:\Windows\system32\cmd.exe /c NET STOP FirebirdGuardianDefaultInstance /Y
                      2⤵
                        PID:580
                        • C:\Windows\SysWOW64\net.exe
                          NET STOP FirebirdGuardianDefaultInstance /Y
                          3⤵
                            PID:1372
                            • C:\Windows\SysWOW64\net1.exe
                              C:\Windows\system32\net1 STOP FirebirdGuardianDefaultInstance /Y
                              4⤵
                                PID:308
                          • C:\Windows\SysWOW64\cmd.exe
                            C:\Windows\system32\cmd.exe /c NET STOP MuzzleServer /Y
                            2⤵
                              PID:2028
                              • C:\Windows\SysWOW64\net.exe
                                NET STOP MuzzleServer /Y
                                3⤵
                                  PID:1036
                                  • C:\Windows\SysWOW64\net1.exe
                                    C:\Windows\system32\net1 STOP MuzzleServer /Y
                                    4⤵
                                      PID:1120
                                • C:\Windows\SysWOW64\cmd.exe
                                  C:\Windows\system32\cmd.exe /c taskkill /im 1cv7s.exe /T /F
                                  2⤵
                                    PID:1620
                                    • C:\Windows\SysWOW64\taskkill.exe
                                      taskkill /im 1cv7s.exe /T /F
                                      3⤵
                                      • Kills process with taskkill
                                      • Suspicious use of AdjustPrivilegeToken
                                      PID:1836
                                  • C:\Windows\SysWOW64\cmd.exe
                                    C:\Windows\system32\cmd.exe /c taskkill /im 1cv8s.exe /T /F
                                    2⤵
                                      PID:2012
                                      • C:\Windows\SysWOW64\taskkill.exe
                                        taskkill /im 1cv8s.exe /T /F
                                        3⤵
                                        • Kills process with taskkill
                                        • Suspicious use of AdjustPrivilegeToken
                                        PID:1940
                                    • C:\Windows\SysWOW64\cmd.exe
                                      C:\Windows\system32\cmd.exe /c taskkill /im 1cv7.exe /T /F
                                      2⤵
                                        PID:1236
                                        • C:\Windows\SysWOW64\taskkill.exe
                                          taskkill /im 1cv7.exe /T /F
                                          3⤵
                                          • Kills process with taskkill
                                          • Suspicious use of AdjustPrivilegeToken
                                          PID:636
                                      • C:\Windows\SysWOW64\cmd.exe
                                        C:\Windows\system32\cmd.exe /c taskkill /im 1cv8.exe /T /F
                                        2⤵
                                          PID:240
                                          • C:\Windows\SysWOW64\taskkill.exe
                                            taskkill /im 1cv8.exe /T /F
                                            3⤵
                                            • Kills process with taskkill
                                            • Suspicious use of AdjustPrivilegeToken
                                            PID:1040
                                        • C:\Windows\SysWOW64\cmd.exe
                                          C:\Windows\system32\cmd.exe /c wmic shadowcopy delete
                                          2⤵
                                            PID:304
                                            • C:\Windows\SysWOW64\Wbem\WMIC.exe
                                              wmic shadowcopy delete
                                              3⤵
                                              • Suspicious use of AdjustPrivilegeToken
                                              PID:1500
                                          • C:\Windows\SysWOW64\cmd.exe
                                            C:\Windows\system32\cmd.exe /c sc stop "Acronis VSS Provider" /y
                                            2⤵
                                              PID:1972
                                              • C:\Windows\SysWOW64\sc.exe
                                                sc stop "Acronis VSS Provider" /y
                                                3⤵
                                                  PID:1664
                                              • C:\Windows\SysWOW64\cmd.exe
                                                C:\Windows\system32\cmd.exe /c sc stop "Enterprise Client Service" /y
                                                2⤵
                                                  PID:1860
                                                  • C:\Windows\SysWOW64\sc.exe
                                                    sc stop "Enterprise Client Service" /y
                                                    3⤵
                                                      PID:1588
                                                  • C:\Windows\SysWOW64\cmd.exe
                                                    C:\Windows\system32\cmd.exe /c sc stop "Sophos Agent" /y
                                                    2⤵
                                                      PID:1080
                                                      • C:\Windows\SysWOW64\sc.exe
                                                        sc stop "Sophos Agent" /y
                                                        3⤵
                                                          PID:2004
                                                      • C:\Windows\SysWOW64\cmd.exe
                                                        C:\Windows\system32\cmd.exe /c sc stop "Sophos AutoUpdate Service" /y
                                                        2⤵
                                                          PID:1932
                                                          • C:\Windows\SysWOW64\sc.exe
                                                            sc stop "Sophos AutoUpdate Service" /y
                                                            3⤵
                                                              PID:576
                                                          • C:\Windows\SysWOW64\cmd.exe
                                                            C:\Windows\system32\cmd.exe /c sc stop "Sophos Clean Service" /y
                                                            2⤵
                                                              PID:2040
                                                              • C:\Windows\SysWOW64\sc.exe
                                                                sc stop "Sophos Clean Service" /y
                                                                3⤵
                                                                  PID:1444
                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                C:\Windows\system32\cmd.exe /c sc stop "Sophos Device Control Service" /y
                                                                2⤵
                                                                  PID:1636
                                                                  • C:\Windows\SysWOW64\sc.exe
                                                                    sc stop "Sophos Device Control Service" /y
                                                                    3⤵
                                                                      PID:1084
                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                    C:\Windows\system32\cmd.exe /c sc stop "Sophos File Scanner Service" /y
                                                                    2⤵
                                                                      PID:1760
                                                                      • C:\Windows\SysWOW64\sc.exe
                                                                        sc stop "Sophos File Scanner Service" /y
                                                                        3⤵
                                                                          PID:524
                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                        C:\Windows\system32\cmd.exe /c sc stop "Sophos Health Service" /y
                                                                        2⤵
                                                                          PID:304
                                                                          • C:\Windows\SysWOW64\sc.exe
                                                                            sc stop "Sophos Health Service" /y
                                                                            3⤵
                                                                              PID:1968
                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                            C:\Windows\system32\cmd.exe /c sc stop "Sophos MCS Agent" /y
                                                                            2⤵
                                                                              PID:896
                                                                              • C:\Windows\SysWOW64\sc.exe
                                                                                sc stop "Sophos MCS Agent" /y
                                                                                3⤵
                                                                                  PID:1928
                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                C:\Windows\system32\cmd.exe /c sc stop "Sophos MCS Client" /y
                                                                                2⤵
                                                                                  PID:1620
                                                                                  • C:\Windows\SysWOW64\sc.exe
                                                                                    sc stop "Sophos MCS Client" /y
                                                                                    3⤵
                                                                                      PID:432
                                                                                • C:\Windows\system32\vssvc.exe
                                                                                  C:\Windows\system32\vssvc.exe
                                                                                  1⤵
                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                  PID:1324
                                                                                • C:\Windows\system32\WerFault.exe
                                                                                  C:\Windows\system32\WerFault.exe -u -p 1260 -s 2864
                                                                                  1⤵
                                                                                  • Program crash
                                                                                  • Suspicious behavior: EnumeratesProcesses
                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                  PID:1748
                                                                                  • C:\Windows\Explorer.EXE
                                                                                    "C:\Windows\Explorer.EXE"
                                                                                    2⤵
                                                                                    • Drops file in Windows directory
                                                                                    • Modifies Internet Explorer settings
                                                                                    • Modifies registry class
                                                                                    • Suspicious behavior: GetForegroundWindowSpam
                                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                                    • Suspicious use of FindShellTrayWindow
                                                                                    • Suspicious use of SendNotifyMessage
                                                                                    PID:1396
                                                                                    • C:\Windows\system32\NOTEPAD.EXE
                                                                                      "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Public\Desktop\HOW_TO_RETURN_FILES.txt
                                                                                      3⤵
                                                                                      • Opens file in notepad (likely ransom note)
                                                                                      PID:1924
                                                                                • C:\Windows\system32\AUDIODG.EXE
                                                                                  C:\Windows\system32\AUDIODG.EXE 0x590
                                                                                  1⤵
                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                  PID:1708

                                                                                Network

                                                                                MITRE ATT&CK Enterprise v6

                                                                                Replay Monitor

                                                                                Loading Replay Monitor...

                                                                                Downloads

                                                                                • memory/1396-95-0x00000000040A0000-0x00000000040A1000-memory.dmp

                                                                                  Filesize

                                                                                  4KB

                                                                                  Download

                                                                                • memory/1396-60-0x000007FEFB431000-0x000007FEFB433000-memory.dmp

                                                                                  Filesize

                                                                                  8KB

                                                                                  Download

                                                                                • memory/1748-56-0x000007FEFBB21000-0x000007FEFBB23000-memory.dmp

                                                                                  Filesize

                                                                                  8KB

                                                                                  Download

                                                                                • memory/1748-57-0x0000000001DA0000-0x0000000001DB1000-memory.dmp

                                                                                  Filesize

                                                                                  68KB

                                                                                  Download

                                                                                • memory/1748-58-0x0000000002380000-0x0000000002381000-memory.dmp

                                                                                  Filesize

                                                                                  4KB

                                                                                  Download

                                                                                • memory/1808-98-0x000007FEF74A0000-0x000007FEF771A000-memory.dmp

                                                                                  Filesize

                                                                                  2.5MB

                                                                                  Download