Overview

overview

10

Static

static

lsass.exe

windows7_x64

10

lsass.exe

windows10_x64

9

Analysis

  • max time kernel
    145s
  • max time network
    10s
  • platform
    windows7_x64
  • resource
    win7v20201028
  • submitted
    08-04-2021 07:43

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    lsass.exe

  • Size

    115KB

  • MD5

    5a73d01f81ff11ec92dbc2233c05e15f

  • SHA1

    1a05f691f72406155136ecfdf5ddee8e9bfa20ce

  • SHA256

    68ea179770a48ab47976303c9b6db79df2a5213b505fa913201ee6ceabf63a76

  • SHA512

    b58097ddc44ef98d7db107634c1fc8db18b0e1828096e8304aa5864bc14fda3fdc82d69c631c8af39cfbc32a23d6795b3a9d4b717f99860fa7b6bb048fcaecf1

Score
10/10
ransomwarespywarestealer

Malware Config

Extracted

Path

C:\Users\Admin\Desktop\DecryptGuide.txt

Ransom Note
[ATTENTION] All of your files are encrypted with RSA-2048 and AES-128 ciphers. Decrypting of your files is only possible with the private key and decrypt program. Backups were either encrypted. Shadow copies also removed, so F8 or any other methods may damage encrypted data but not recover. We exclusively have decryption software for your situation. No decryption software is available in the public. DO NOT RESET OR SHUTDOWN -files may be damaged. DO NOT DELETE this file. To confirm your decryption software, please send 2 or 3 different random files and you will get them decrypted. To get decryption, please contact us. ha7medtit@tutanota.com or araujosantos@protonmail.com You will receive btc address for payment in the reply letter. !!!Your CODE is : AAABAFxXlqBiGEoIVCFtKr20ZRvXxz
Emails

ha7medtit@tutanota.com

araujosantos@protonmail.com

Signatures

  • Deletes shadow copies 2 TTPs

    Ransomware often targets backup files to inhibit system recovery.

    ransomware
  • Modifies extensions of user files 2 IoCs

    Ransomware generally changes the extension on encrypted files.

    ransomware
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Drops desktop.ini file(s) 1 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Interacts with shadow copies 2 TTPs 1 IoCs

    Shadow copies are often targeted by ransomware to inhibit system recovery.

    ransomware
  • Opens file in notepad (likely ransom note) 1 IoCs
    ransomware
  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\lsass.exe
    "C:\Users\Admin\AppData\Local\Temp\lsass.exe"
    1⤵
    • Modifies extensions of user files
    • Drops desktop.ini file(s)
    • Drops file in Program Files directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:1904
    • C:\Windows\SysWOW64\vssadmin.exe
      vssadmin.exe delete shadows /all /quiet
      2⤵
      • Interacts with shadow copies
      PID:1200
  • C:\Windows\system32\vssvc.exe
    C:\Windows\system32\vssvc.exe
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:316
  • C:\Windows\explorer.exe
    "C:\Windows\explorer.exe"
    1⤵
      PID:1192
    • C:\Windows\system32\NOTEPAD.EXE
      "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\DecryptGuide.txt
      1⤵
      • Opens file in notepad (likely ransom note)
      PID:1776

    Network

    MITRE ATT&CK Matrix ATT&CK v6

    Initial Access

    Execution

    Persistence

    Privilege Escalation

    Defense Evasion

    File Deletion

    2
    T1107

    Credential Access

    Credentials in Files

    1
    T1081

    Discovery

    System Information Discovery

    1
    T1082

    Lateral Movement

    Collection

    Data from Local System

    1
    T1005

    Exfiltration

    Command and Control

    Impact

    Inhibit System Recovery

    2
    T1490

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\Desktop\DecryptGuide.txt
      MD5

      d599019c35bcad72f7b8694d4eeafcc9

      SHA1

      4e641bcdc69cdf65e7f0f6ce715068580f743a3d

      SHA256

      904b1783e38a288962e7d10f1d242c88250ca0843925abefc8d8f4851f4d96dc

      SHA512

      45176b6c7f00ad3f9e7dde74ed856289f49f74a13589e7f2dc5e966ca0c1007eb144a0d39d9f090f161e138e02f37b637abc9a522500858e58e1f3e7a1501f6d

      Download Submit
    • memory/932-7-0x000007FEF63D0000-0x000007FEF664A000-memory.dmp
      Filesize

      2.5MB

      Download
    • memory/1192-4-0x000007FEFBDE1000-0x000007FEFBDE3000-memory.dmp
      Filesize

      8KB

      Download
    • memory/1200-3-0x0000000000000000-mapping.dmp
      Download
    • memory/1904-2-0x00000000766F1000-0x00000000766F3000-memory.dmp
      Filesize

      8KB

      Download