Analysis
-
max time kernel
59s -
max time network
31s -
platform
windows7_x64 -
resource
win7v20201028 -
submitted
12-03-2021 06:50
Static task
static1
Behavioral task
behavioral1
Sample
s1.exe
Resource
win7v20201028
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
s1.exe
Resource
win10v20201028
windows10_x64
0 signatures
0 seconds
General
-
Target
s1.exe
-
Size
1.3MB
-
MD5
0e55ead3b8fd305d9a54f78c7b56741a
-
SHA1
f7b084e581a8dcea450c2652f8058d93797413c3
-
SHA256
2b9838da7edb0decd32b086e47a31e8f5733b5981ad8247a2f9508e232589bff
-
SHA512
5c3d58d1001dce6f2d23f33861e9c7fef766b7fe0a86972e9f1eeb70bfad970b02561da6b6d193cf24bc3c1aaf2a42a950fa6e5dff36386653b8aa725c9abaaa
Score
10/10
Malware Config
Extracted
Path
C:\PROGRAM FILES\WINDOWS SIDEBAR\GADGETS\SLIDESHOW.GADGET\IMAGES\ON_DESKTOP\readme.txt
Family
dearcry
Ransom Note
Your file has been encrypted!
If you want to decrypt, please contact us.
[email protected] or [email protected]
And please send me the following hash!
638428e5021d4ae247b21acf9c0bf6f6
Signatures
-
DearCry
DearCry is a ransomware first seen after the 2021 Microsoft Exchange hacks.
-
Modifies extensions of user files 3 IoCs
Ransomware generally changes the extension on encrypted files.
Processes:
s1.exedescription ioc Process File created C:\Users\Admin\Pictures\RepairReset.tif.CRYPT s1.exe File opened for modification C:\Users\Admin\Pictures\UnprotectDisconnect.tiff s1.exe File created C:\Users\Admin\Pictures\UnprotectDisconnect.tiff.CRYPT s1.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops desktop.ini file(s) 64 IoCs
Processes:
s1.exedescription ioc Process File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini s1.exe File opened for modification C:\Users\Public\Libraries\desktop.ini s1.exe File opened for modification C:\Users\Public\Pictures\desktop.ini s1.exe File opened for modification C:\Users\Public\Pictures\Sample Pictures\desktop.ini s1.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Desktop.ini s1.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\X6969WXQ\desktop.ini s1.exe File opened for modification C:\Users\Admin\Music\desktop.ini s1.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Desktop.ini s1.exe File opened for modification C:\Users\Public\Videos\desktop.ini s1.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\XHJ74TZW\desktop.ini s1.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\History\desktop.ini s1.exe File opened for modification C:\Users\Admin\Favorites\desktop.ini s1.exe File opened for modification C:\Users\Admin\Favorites\Links for United States\desktop.ini s1.exe File opened for modification C:\Users\Admin\Videos\desktop.ini s1.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\desktop.ini s1.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Games\desktop.ini s1.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\History\History.IE5\desktop.ini s1.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Accessibility\Desktop.ini s1.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini s1.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\DataServices\DESKTOP.INI s1.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\5JH7AFHU\desktop.ini s1.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\E1R8L62F\desktop.ini s1.exe File opened for modification C:\Users\Admin\Links\desktop.ini s1.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\desktop.ini s1.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn\desktop.ini s1.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\desktop.ini s1.exe File opened for modification C:\Users\Admin\Downloads\desktop.ini s1.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\Desktop.ini s1.exe File opened for modification C:\Users\Public\Downloads\desktop.ini s1.exe File opened for modification C:\Users\Public\Music\desktop.ini s1.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Tablet PC\Desktop.ini s1.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\6O9TWDTA\desktop.ini s1.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Desktop.ini s1.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\Stationery\Desktop.ini s1.exe File opened for modification C:\Users\Admin\Contacts\desktop.ini s1.exe File opened for modification C:\Users\Public\desktop.ini s1.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini s1.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini s1.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\desktop.ini s1.exe File opened for modification C:\$Recycle.Bin\S-1-5-21-293278959-2699126792-324916226-1000\desktop.ini s1.exe File opened for modification C:\ProgramData\Microsoft\Windows\Ringtones\desktop.ini s1.exe File opened for modification C:\Users\Public\Documents\desktop.ini s1.exe File opened for modification C:\Users\Public\Music\Sample Music\desktop.ini s1.exe File opened for modification C:\Users\Public\Recorded TV\desktop.ini s1.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\Stationery\Desktop.ini s1.exe File opened for modification C:\Users\Admin\Searches\desktop.ini s1.exe File opened for modification C:\Program Files (x86)\desktop.ini s1.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\SS7I88SX\desktop.ini s1.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini s1.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\GLQ59KOM\desktop.ini s1.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows Mail\Stationery\Desktop.ini s1.exe File opened for modification C:\Users\Admin\Saved Games\desktop.ini s1.exe File opened for modification C:\Users\Public\Recorded TV\Sample Media\desktop.ini s1.exe File opened for modification C:\Program Files\desktop.ini s1.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Desktop.ini s1.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\desktop.ini s1.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\desktop.ini s1.exe File opened for modification C:\Users\Public\Videos\Sample Videos\desktop.ini s1.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\2BO6MI1N\desktop.ini s1.exe File opened for modification C:\Users\Admin\Desktop\desktop.ini s1.exe File opened for modification C:\Users\Admin\Favorites\Links\desktop.ini s1.exe File opened for modification C:\Users\Admin\Pictures\desktop.ini s1.exe File opened for modification C:\Users\Public\Desktop\desktop.ini s1.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Accessibility\Desktop.ini s1.exe -
Drops file in Program Files directory 64 IoCs
Processes:
s1.exedescription ioc Process File opened for modification C:\Program Files (x86)\Microsoft Sync Framework\v1.0\Runtime\x86\FeedSync.dll s1.exe File created C:\Program Files\7-Zip\Lang\ga.txt.CRYPT s1.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\en-US\boxed-join.avi s1.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\lua\liblua_plugin.dll s1.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Fonts\Apothecary.xml s1.exe File created C:\Program Files (x86)\Microsoft Office\Office14\1033\OUTFORM.DAT.CRYPT s1.exe File opened for modification C:\Program Files\Common Files\SpeechEngines\Microsoft\TTS20\MSTTSEngine.dll s1.exe File created C:\Program Files\Mozilla Firefox\api-ms-win-core-localization-l1-2-0.dll.CRYPT s1.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\MediaCenter.Gadget\images\Gadget_Star_Full.png s1.exe File created C:\Program Files (x86)\Common Files\microsoft shared\Smart Tag\MOFL.DLL.CRYPT s1.exe File created C:\Program Files (x86)\Microsoft Office\Office14\WORDICON.EXE.CRYPT s1.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\images\win7.png.CRYPT s1.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\access_output\libaccess_output_shout_plugin.dll s1.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\SONORA\THMBNAIL.PNG s1.exe File created C:\Program Files (x86)\Google\Update\1.3.35.452\goopdateres_fil.dll.CRYPT s1.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\VIEW.JS s1.exe File opened for modification C:\Program Files\Internet Explorer\perf_nt.dll s1.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\docked_black_moon-waning-gibbous.png s1.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0341551.JPG s1.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\GreenTea.css s1.exe File opened for modification C:\Program Files (x86)\Windows Media Player\WMPMediaSharing.dll s1.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-openide-actions.xml s1.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\images\25.png s1.exe File opened for modification C:\Program Files\Windows NT\TableTextService\TableTextServiceYi.txt s1.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\CONTAB32.DLL s1.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolBMPs\NotifierUpArrow.jpg s1.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PAGESIZE\PGLBL002.XML s1.exe File created C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\DGWEBAD.XML.CRYPT s1.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\whitevignette1047.png s1.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\logo.png s1.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\Stationery\Bears.htm s1.exe File created C:\Program Files (x86)\Google\Update\1.3.35.452\GoogleUpdateCore.exe.CRYPT s1.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PAGESIZE\PGLBL111.XML s1.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\InkDiv.dll s1.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\images\trad_m.png s1.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\1033\ALRTINTL.DLL s1.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.35.452\goopdateres_fil.dll s1.exe File created C:\Program Files (x86)\Microsoft Office\Office14\InfoPathOM\InfoPathOMV12\Microsoft.Office.InfoPath.xml.CRYPT s1.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\services_discovery\libwindrive_plugin.dll s1.exe File opened for modification C:\Program Files (x86)\Common Files\System\Ole DB\sqlxmlx.dll s1.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PSTPRX32.DLL s1.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\images\docked_black_few-showers.png s1.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\passport.png s1.exe File created C:\Program Files\VideoLAN\VLC\plugins\control\liboldrc_plugin.dll.CRYPT s1.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\VSTA\8.0\x86\vsta_ep32.exe.config s1.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolBMPs\StopIconMask.bmp s1.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\RSSFeeds.Gadget\en-US\gadget.xml s1.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\video_filter\libcanvas_plugin.dll s1.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe AIR\Versions\1.0\NPSWF32.dll s1.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PAGESIZE\PG_INDEX.XML s1.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\wlsrvc.dll s1.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\logo.png s1.exe File created C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0101861.BMP.CRYPT s1.exe File opened for modification C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\System.Data.DataSetExtensions.dll s1.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\images\18.png s1.exe File created C:\Program Files\Common Files\Microsoft Shared\Stationery\Desktop.ini.CRYPT s1.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\23.png s1.exe File created C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\LICLUA.EXE.CRYPT s1.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Reader\rt3d.dll.CRYPT s1.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\specialmainsubpicture.png s1.exe File created C:\Program Files\Java\jdk1.7.0_80\bin\jabswitch.exe.CRYPT s1.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\bin\jfr.dll.CRYPT s1.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\update_tracking\com-sun-tools-visualvm-modules-appui.xml.CRYPT s1.exe File created C:\Program Files\VideoLAN\VLC\plugins\access\libshm_plugin.dll.CRYPT s1.exe -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target Process procid_target 1320 1224 WerFault.exe 13 -
Suspicious behavior: EnumeratesProcesses 5 IoCs
Processes:
WerFault.exepid Process 1320 WerFault.exe 1320 WerFault.exe 1320 WerFault.exe 1320 WerFault.exe 1320 WerFault.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
WerFault.exedescription pid Process Token: SeDebugPrivilege 1320 WerFault.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\s1.exe"C:\Users\Admin\AppData\Local\Temp\s1.exe"1⤵
- Modifies extensions of user files
- Drops desktop.ini file(s)
- Drops file in Program Files directory
PID:1044
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 1224 -s 29121⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1320