Analysis
-
max time kernel
111s -
max time network
117s -
platform
windows10_x64 -
resource
win10v20210408 -
submitted
04-05-2021 02:02
Static task
static1
Behavioral task
behavioral1
Sample
1b0c57b4_by_Libranalysis.exe
Resource
win7v20210410
Behavioral task
behavioral2
Sample
1b0c57b4_by_Libranalysis.exe
Resource
win10v20210408
General
-
Target
1b0c57b4_by_Libranalysis.exe
-
Size
2.2MB
-
MD5
1b0c57b4b2f28b92d0fa8b71b2f1bce5
-
SHA1
85c495a2c17dc5e8fca669c346ab5ec2560853db
-
SHA256
166eec273d472577682b777f9e12b63697db76c21823abf8c228a8b8b506a4b8
-
SHA512
e00795b3fb74c1fe8ed7d9f4698604bb7ab366cd93621174e24acc805a9e82d8d543942032d37ca9d71ad65a6f7e2eb15bfc2084f7ea927aa13307c53c6e9209
Malware Config
Extracted
C:\Boot\Fonts\HOW TO RESTORE YOUR FILES.TXT
Veranderinbt5f@protonmail.com
rogerurste@yahoo.com
Signatures
-
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Modifies extensions of user files 10 IoCs
Ransomware generally changes the extension on encrypted files.
description ioc Process File opened for modification C:\Users\Admin\Pictures\LimitReceive.raw.yqbdpevbz 1b0c57b4_by_Libranalysis.exe File renamed C:\Users\Admin\Pictures\ImportInvoke.tif => C:\Users\Admin\Pictures\ImportInvoke.tif.yqbdpevbz 1b0c57b4_by_Libranalysis.exe File opened for modification C:\Users\Admin\Pictures\ImportInvoke.tif.yqbdpevbz 1b0c57b4_by_Libranalysis.exe File renamed C:\Users\Admin\Pictures\LimitReceive.raw => C:\Users\Admin\Pictures\LimitReceive.raw.yqbdpevbz 1b0c57b4_by_Libranalysis.exe File opened for modification C:\Users\Admin\Pictures\SearchUnpublish.raw.yqbdpevbz 1b0c57b4_by_Libranalysis.exe File opened for modification C:\Users\Admin\Pictures\WritePush.crw.yqbdpevbz 1b0c57b4_by_Libranalysis.exe File renamed C:\Users\Admin\Pictures\DismountMount.tif => C:\Users\Admin\Pictures\DismountMount.tif.yqbdpevbz 1b0c57b4_by_Libranalysis.exe File opened for modification C:\Users\Admin\Pictures\DismountMount.tif.yqbdpevbz 1b0c57b4_by_Libranalysis.exe File renamed C:\Users\Admin\Pictures\SearchUnpublish.raw => C:\Users\Admin\Pictures\SearchUnpublish.raw.yqbdpevbz 1b0c57b4_by_Libranalysis.exe File renamed C:\Users\Admin\Pictures\WritePush.crw => C:\Users\Admin\Pictures\WritePush.crw.yqbdpevbz 1b0c57b4_by_Libranalysis.exe -
Drops startup file 2 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\HOW TO RESTORE YOUR FILES.TXT 1b0c57b4_by_Libranalysis.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\HOW TO RESTORE YOUR FILES.TXT 1b0c57b4_by_Libranalysis.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1611.10393.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Home\RTL\HOW TO RESTORE YOUR FILES.TXT 1b0c57b4_by_Libranalysis.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\images\8268_48x48x32.png 1b0c57b4_by_Libranalysis.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\Cartridges\sql90.xsl 1b0c57b4_by_Libranalysis.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\images\10290_20x20x32.png 1b0c57b4_by_Libranalysis.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\scan-2x.png 1b0c57b4_by_Libranalysis.exe File opened for modification C:\Program Files\Microsoft Office\root\vreg\powerpivot.x-none.msi.16.x-none.vreg.dat 1b0c57b4_by_Libranalysis.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppPackageAppList.targetsize-16_contrast-black.png 1b0c57b4_by_Libranalysis.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.SkypeApp_11.8.204.0_x64__kzf8qxf38zg5c\SkypeApp\Designs\Flags\small\um_16x11.png 1b0c57b4_by_Libranalysis.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\js\nls\ar-ae\HOW TO RESTORE YOUR FILES.TXT 1b0c57b4_by_Libranalysis.exe File created C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\HOW TO RESTORE YOUR FILES.TXT 1b0c57b4_by_Libranalysis.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_17.7668.58071.0_x64__8wekyb3d8bbwe\images\1251_48x48x32.png 1b0c57b4_by_Libranalysis.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\images\6440_40x40x32.png 1b0c57b4_by_Libranalysis.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\walk-through\js\nls\HOW TO RESTORE YOUR FILES.TXT 1b0c57b4_by_Libranalysis.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\sk-sk\ui-strings.js.yqbdpevbz 1b0c57b4_by_Libranalysis.exe File created C:\Program Files\VideoLAN\VLC\locale\bn\HOW TO RESTORE YOUR FILES.TXT 1b0c57b4_by_Libranalysis.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\LogoImages\WinWordLogo.scale-180.png.yqbdpevbz 1b0c57b4_by_Libranalysis.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\an\LC_MESSAGES\vlc.mo.yqbdpevbz 1b0c57b4_by_Libranalysis.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.SkypeApp_11.8.204.0_x64__kzf8qxf38zg5c\SkypeApp\Designs\Flags\large\mf_60x42.png 1b0c57b4_by_Libranalysis.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\tr-tr\HOW TO RESTORE YOUR FILES.TXT 1b0c57b4_by_Libranalysis.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\sv-se\ui-strings.js.yqbdpevbz 1b0c57b4_by_Libranalysis.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\AppxManifest.xml 1b0c57b4_by_Libranalysis.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\Arkadium.Win10.Xaml.Toolkit\Assets\Buttons\Menu\Menu_black-press.png 1b0c57b4_by_Libranalysis.exe File opened for modification C:\Program Files\Microsoft Office\root\rsod\office.x-none.msi.16.x-none.tree.dat.yqbdpevbz 1b0c57b4_by_Libranalysis.exe File opened for modification C:\Program Files\Microsoft Office\root\rsod\officemui.msi.16.en-us.boot.tree.dat.yqbdpevbz 1b0c57b4_by_Libranalysis.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\OFFICE16\en-us\oregres.dll.mui.yqbdpevbz 1b0c57b4_by_Libranalysis.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\gd\LC_MESSAGES\vlc.mo 1b0c57b4_by_Libranalysis.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\is\LC_MESSAGES\vlc.mo.yqbdpevbz 1b0c57b4_by_Libranalysis.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\intf\telnet.luac.yqbdpevbz 1b0c57b4_by_Libranalysis.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\lib\deploy\messages_zh_CN.properties.yqbdpevbz 1b0c57b4_by_Libranalysis.exe File created C:\Program Files\WindowsApps\Microsoft.Wallet_1.0.16328.0_neutral_~_8wekyb3d8bbwe\AppxMetadata\HOW TO RESTORE YOUR FILES.TXT 1b0c57b4_by_Libranalysis.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_10.1702.333.0_x64__8wekyb3d8bbwe\TimeAppService.winmd 1b0c57b4_by_Libranalysis.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\zh-cn\ui-strings.js 1b0c57b4_by_Libranalysis.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\fi-fi\ui-strings.js.yqbdpevbz 1b0c57b4_by_Libranalysis.exe File created C:\Program Files\Microsoft Office\root\Office16\1036\HOW TO RESTORE YOUR FILES.TXT 1b0c57b4_by_Libranalysis.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\Assets\Themes\Classic\classic_1s.png 1b0c57b4_by_Libranalysis.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\images\5630_48x48x32.png 1b0c57b4_by_Libranalysis.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\sl-sl\HOW TO RESTORE YOUR FILES.TXT 1b0c57b4_by_Libranalysis.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019VL_MAK_AE-ppd.xrm-ms.yqbdpevbz 1b0c57b4_by_Libranalysis.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\AccessMessageDismissal.txt 1b0c57b4_by_Libranalysis.exe File created C:\Program Files\WindowsApps\Microsoft.People_10.1.10531.0_x64__8wekyb3d8bbwe\HOW TO RESTORE YOUR FILES.TXT 1b0c57b4_by_Libranalysis.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.1612.10312.0_x64__8wekyb3d8bbwe\Assets\InsiderHubAppList.scale-200_contrast-black.png 1b0c57b4_by_Libranalysis.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\images\contrast-white\ExchangeBadge.scale-125.png 1b0c57b4_by_Libranalysis.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\hr-hr\ui-strings.js.yqbdpevbz 1b0c57b4_by_Libranalysis.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\fi-fi\ui-strings.js 1b0c57b4_by_Libranalysis.exe File created C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\HOW TO RESTORE YOUR FILES.TXT 1b0c57b4_by_Libranalysis.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\profiler\update_tracking\org-netbeans-lib-profiler.xml.yqbdpevbz 1b0c57b4_by_Libranalysis.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\Arkadium.Win10.StarClub\Assets\star.png 1b0c57b4_by_Libranalysis.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\Assets\ThemePreview\Themes\classic.jpg 1b0c57b4_by_Libranalysis.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\Close.png.yqbdpevbz 1b0c57b4_by_Libranalysis.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\themes\dark\core_icons_retina.png 1b0c57b4_by_Libranalysis.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PersonaSpy\personaspybridge.js.yqbdpevbz 1b0c57b4_by_Libranalysis.exe File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.XboxApp_25.25.13009.0_neutral_split.scale-200_8wekyb3d8bbwe\Assets\GamesXboxHubWideTile.scale-200_contrast-white.png 1b0c57b4_by_Libranalysis.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\images\HxMailAppList.scale-100.png 1b0c57b4_by_Libranalysis.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\zh-cn\HOW TO RESTORE YOUR FILES.TXT 1b0c57b4_by_Libranalysis.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\s_invite_24.svg.yqbdpevbz 1b0c57b4_by_Libranalysis.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\QUAD\PREVIEW.GIF 1b0c57b4_by_Libranalysis.exe File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsSoundRecorder_10.1702.301.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\VoiceRecorderWideTile.scale-125.png 1b0c57b4_by_Libranalysis.exe File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsStore_11701.1001.87.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\AppTiles\contrast-white\StoreLargeTile.scale-100.png 1b0c57b4_by_Libranalysis.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\images\sat_logo_2x.png 1b0c57b4_by_Libranalysis.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\images\HxCalendarAppList.targetsize-72.png 1b0c57b4_by_Libranalysis.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\fr-fr\HOW TO RESTORE YOUR FILES.TXT 1b0c57b4_by_Libranalysis.exe File opened for modification C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Effects\Milk Glass.eftx 1b0c57b4_by_Libranalysis.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_Retail2-ppd.xrm-ms.yqbdpevbz 1b0c57b4_by_Libranalysis.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MEDIA\VOLTAGE.WAV.yqbdpevbz 1b0c57b4_by_Libranalysis.exe -
Launches sc.exe
Sc.exe is a Windows utlilty to control services on the system.
-
Interacts with shadow copies 2 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
pid Process 1888 vssadmin.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeBackupPrivilege 212 vssvc.exe Token: SeRestorePrivilege 212 vssvc.exe Token: SeAuditPrivilege 212 vssvc.exe -
Suspicious use of WriteProcessMemory 21 IoCs
description pid Process procid_target PID 1108 wrote to memory of 3892 1108 1b0c57b4_by_Libranalysis.exe 75 PID 1108 wrote to memory of 3892 1108 1b0c57b4_by_Libranalysis.exe 75 PID 1108 wrote to memory of 3892 1108 1b0c57b4_by_Libranalysis.exe 75 PID 3892 wrote to memory of 852 3892 cmd.exe 77 PID 3892 wrote to memory of 852 3892 cmd.exe 77 PID 3892 wrote to memory of 852 3892 cmd.exe 77 PID 3892 wrote to memory of 3036 3892 cmd.exe 78 PID 3892 wrote to memory of 3036 3892 cmd.exe 78 PID 3892 wrote to memory of 3036 3892 cmd.exe 78 PID 1108 wrote to memory of 3044 1108 1b0c57b4_by_Libranalysis.exe 79 PID 1108 wrote to memory of 3044 1108 1b0c57b4_by_Libranalysis.exe 79 PID 1108 wrote to memory of 3044 1108 1b0c57b4_by_Libranalysis.exe 79 PID 1108 wrote to memory of 3888 1108 1b0c57b4_by_Libranalysis.exe 81 PID 1108 wrote to memory of 3888 1108 1b0c57b4_by_Libranalysis.exe 81 PID 1108 wrote to memory of 3888 1108 1b0c57b4_by_Libranalysis.exe 81 PID 3888 wrote to memory of 1888 3888 cmd.exe 83 PID 3888 wrote to memory of 1888 3888 cmd.exe 83 PID 3888 wrote to memory of 1888 3888 cmd.exe 83 PID 1108 wrote to memory of 908 1108 1b0c57b4_by_Libranalysis.exe 85 PID 1108 wrote to memory of 908 1108 1b0c57b4_by_Libranalysis.exe 85 PID 1108 wrote to memory of 908 1108 1b0c57b4_by_Libranalysis.exe 85
Processes
-
C:\Users\Admin\AppData\Local\Temp\1b0c57b4_by_Libranalysis.exe"C:\Users\Admin\AppData\Local\Temp\1b0c57b4_by_Libranalysis.exe"1⤵
- Modifies extensions of user files
- Drops startup file
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:1108 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\ncpjwdejbuqv.bat2⤵
- Suspicious use of WriteProcessMemory
PID:3892 -
C:\Windows\SysWOW64\sc.exeSC QUERY3⤵PID:852
-
-
C:\Windows\SysWOW64\findstr.exeFINDSTR SERVICE_NAME3⤵PID:3036
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\ecyvxkwtmqdnlxel.bat2⤵PID:3044
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\cjgaaettgg.bat2⤵
- Suspicious use of WriteProcessMemory
PID:3888 -
C:\Windows\SysWOW64\vssadmin.exevssadmin delete shadows /all /quiet3⤵
- Interacts with shadow copies
PID:1888
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\xptivujwagugxpnc.bat2⤵PID:908
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:212