Analysis
-
max time kernel
121s -
max time network
122s -
platform
windows7_x64 -
resource
win7v20201028 -
submitted
12/03/2021, 08:12
Static task
static1
Behavioral task
behavioral1
Sample
ransomw.exe
Resource
win7v20201028
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
ransomw.exe
Resource
win10v20201028
windows10_x64
0 signatures
0 seconds
General
-
Target
ransomw.exe
-
Size
2.5MB
-
MD5
8243dc32479532fcb82669da4b81a9d1
-
SHA1
3580a4719ded43c0bbc40d2e26abc0868811a03f
-
SHA256
4ad3332742b46d2a60a21ca009941fd85a3e58cd635df5a1c3ed0888061a1fda
-
SHA512
8a88c38f4507e64b4cfe6d13c7e4e98ad86dc15df9051badc5fb283f1a24f4549c0c14055a3d42a59f31b8d5da074cc3f8356acce9683190dd4a95fe7ae0da4d
Score
6/10
Malware Config
Signatures
-
Drops desktop.ini file(s) 28 IoCs
description ioc Process File opened for modification C:\Users\Public\Music\Sample Music\desktop.ini ransomw.exe File opened for modification C:\Users\Public\Pictures\Sample Pictures\desktop.ini ransomw.exe File opened for modification C:\Users\Admin\AppData\Local\Temp\desktop.ini ransomw.exe File opened for modification C:\Users\Admin\Downloads\desktop.ini ransomw.exe File opened for modification C:\Users\Admin\Favorites\Links\desktop.ini ransomw.exe File created C:\Users\Admin\AppData\Local\Temp\desktop.ini ransomw.exe File opened for modification C:\Users\Admin\Documents\desktop.ini ransomw.exe File opened for modification C:\Users\Admin\Music\desktop.ini ransomw.exe File opened for modification C:\Users\Public\Documents\desktop.ini ransomw.exe File opened for modification C:\Users\Public\Libraries\desktop.ini ransomw.exe File opened for modification C:\Users\Admin\Links\desktop.ini ransomw.exe File opened for modification C:\Users\Admin\Pictures\desktop.ini ransomw.exe File opened for modification C:\Users\Admin\Saved Games\desktop.ini ransomw.exe File opened for modification C:\Users\Admin\Contacts\desktop.ini ransomw.exe File opened for modification C:\Users\Admin\Favorites\desktop.ini ransomw.exe File opened for modification C:\Users\Public\Pictures\desktop.ini ransomw.exe File opened for modification C:\Users\Public\desktop.ini ransomw.exe File opened for modification C:\Users\Admin\Desktop\desktop.ini ransomw.exe File opened for modification C:\Users\Public\Desktop\desktop.ini ransomw.exe File opened for modification C:\Users\Public\Downloads\desktop.ini ransomw.exe File opened for modification C:\Users\Admin\Searches\desktop.ini ransomw.exe File opened for modification C:\Users\Public\Music\desktop.ini ransomw.exe File opened for modification C:\Users\Public\Recorded TV\desktop.ini ransomw.exe File opened for modification C:\Users\Public\Videos\Sample Videos\desktop.ini ransomw.exe File opened for modification C:\Users\Public\Videos\desktop.ini ransomw.exe File opened for modification C:\Users\Admin\Favorites\Links for United States\desktop.ini ransomw.exe File opened for modification C:\Users\Admin\Videos\desktop.ini ransomw.exe File opened for modification C:\Users\Public\Recorded TV\Sample Media\desktop.ini ransomw.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\MINIE iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{4BEC6CA1-830B-11EB-8500-DE8B8BF990D6} = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\MINIE iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000089444994758115468340cf9673d6eac400000000020000000000106600000001000020000000b5670c3834fb3c439fdbe36e590deb35ee1a36e06c7297b11743a750e0e1c754000000000e8000000002000020000000c15e96df006c29348b58bccb6042cb5f7721d54138cbc95578867a20501bb1fc90000000a4654d8b79f60603d5908b65ed79d0c1dc7d1eda3c333cdb52a3977262056599282a3447b94e9d9adb8659a991931ba58f222bb48d5c6206763615a1873c7e5ac4a2f7e099b9cf9dfa1fe11485dbf89c59256a46ecfe151ca8ebcadf1fc0962a75d2cdd0b61aa528f27175dca0f454d8ac9fbf80816e80265071f9a5ba5aa6c7a51e44029a4ceac9437f3a2c873faccf400000002012dea1e3dbb83364b3323702563956f5d112801d74fed67a72caa5ffe3e62ed131700cf976e8e8d594080dc4867637f1331cc2057b16b64ecc216230dd5d98 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{46E4A4C1-830B-11EB-8500-DE8B8BF990D6} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000089444994758115468340cf9673d6eac4000000000200000000001066000000010000200000007624c37dcd77b1e1e6537386989a7c8db472ad1889b88700850dc24eeaa74428000000000e8000000002000020000000e566214c0d4cc71a989dc64c56f5bb19032d1fcbc9928c9a4357136a2077d09c20000000504a18a974f298d29a06da47f670245796f214d6d99eef894557405d094611ee400000009f3391d4252a52d1310d671b05a6cb17355c9f6b3a78dda732d024dc01a3647bfacfa084f19f551d36e7ea85bb1c832a7ce51b804da528c7296d10610b144fb2 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 3029371c1817d701 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe -
Opens file in notepad (likely ransom note) 1 IoCs
pid Process 112 NOTEPAD.EXE -
Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: 33 976 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 976 AUDIODG.EXE Token: 33 976 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 976 AUDIODG.EXE -
Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 1360 iexplore.exe 1348 iexplore.exe -
Suspicious use of SetWindowsHookEx 8 IoCs
pid Process 1360 iexplore.exe 1360 iexplore.exe 308 IEXPLORE.EXE 308 IEXPLORE.EXE 1348 iexplore.exe 1348 iexplore.exe 936 IEXPLORE.EXE 936 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 1360 wrote to memory of 308 1360 iexplore.exe 35 PID 1360 wrote to memory of 308 1360 iexplore.exe 35 PID 1360 wrote to memory of 308 1360 iexplore.exe 35 PID 1360 wrote to memory of 308 1360 iexplore.exe 35 PID 1348 wrote to memory of 936 1348 iexplore.exe 37 PID 1348 wrote to memory of 936 1348 iexplore.exe 37 PID 1348 wrote to memory of 936 1348 iexplore.exe 37 PID 1348 wrote to memory of 936 1348 iexplore.exe 37
Processes
-
C:\Users\Admin\AppData\Local\Temp\ransomw.exe"C:\Users\Admin\AppData\Local\Temp\ransomw.exe"1⤵
- Drops desktop.ini file(s)
PID:1676
-
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\BAD_GOPHER.txt1⤵
- Opens file in notepad (likely ransom note)
PID:112
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\Desktop\FILES_ENCRYPTED.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1360 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1360 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:308
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\Desktop\READ_TO_DECRYPT.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1348 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1348 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:936
-
-
C:\Windows\explorer.exe"C:\Windows\explorer.exe"1⤵PID:1280
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x2f41⤵
- Suspicious use of AdjustPrivilegeToken
PID:976