Overview

overview

10

Static

static

edf9912bf2...df.exe

windows7_x64

9

edf9912bf2...df.exe

windows10_x64

10

Analysis

  • max time kernel
    94s
  • max time network
    119s
  • platform
    windows10_x64
  • resource
    win10v20210410
  • submitted
    28/05/2021, 10:06

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    edf9912bf2c8c7d9048bc6322900231810de7cc34267acc12e1a256fbecdbbdf.exe

  • Size

    893KB

  • MD5

    8856669b9a76eeb19e5673db6c4491ab

  • SHA1

    2d328721640ebb3ddeb971316141fd2b3a84ae84

  • SHA256

    edf9912bf2c8c7d9048bc6322900231810de7cc34267acc12e1a256fbecdbbdf

  • SHA512

    96af5e42d4aab9ffbe10f4db0e2811d7e00ceebed7ed52b8e679164a92011bfa8eb7c33864be3b3e92358ba3b30ba87bab25cde9ee9163b325a7b542eea621e3

Score
10/10
evasionpersistenceransomwarespywarestealer

Malware Config

Extracted

Path

\??\c:\teslarvng2.hta

Ransom Note
all data in your machine turned to useless binary code your databses and important files have been downloaded and will be published after 12days if not paid to return files and prevent publishing email us at : [email protected] , [email protected] (send copy to both, your id as subject) your id : xUBLMi2I tips: no one else can help you ,don't waste your business time you ask for proof that we have your data ,and you can see our old target that their data have been published if not paid after 12days Google your Campany Name and you wil see your private and custorres data in there ,happy will legal and bussiness challenges of data leak after for decryption anyone/any company offering help will get extra fee(some times even more than ours!) added to ours or simplly will scam you (dont pay us after getting test file, lie and scam you) so if you want a Intermediary chose a trusted one to avoid scams , and get your data for decryption you send a few Sample files for test before any payment we won;t be available for long DONT DELETE FILES AT c:\teslarvng2 dont play with encrypted files that will corrupt them and make unrecoverable. due raas(it means the email you talk will give percentage to devs ) to avoid scam never pay anyone without testfile (us or any dealer),never ever pay outside of this 2 emails,ONLY PAY TO THE WALLET ADDRESS YOU RECEIVE WITH DECRYPTED SAMPLE FILE ,scam can't happen if this tips are followed . use google translate (if you don't know english)

Signatures

  • Deletes shadow copies 2 TTPs

    Ransomware often targets backup files to inhibit system recovery.

    ransomware
  • Creates new service(s) 1 TTPs
    persistence
  • Deletes backup catalog 3 TTPs 1 IoCs

    Uses wbadmin.exe to inhibit system recovery.

    ransomware
  • Stops running service(s) 3 TTPs
    evasion
  • Drops startup file 3 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Drops desktop.ini file(s) 64 IoCs
  • Enumerates connected drives 3 TTPs 2 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in System32 directory 1 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 2 IoCs
  • Launches sc.exe

    Sc.exe is a Windows utlilty to control services on the system.

  • Checks SCSI registry key(s) 3 TTPs 4 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistence
  • Enumerates processes with tasklist 1 TTPs 1 IoCs
  • Interacts with shadow copies 2 TTPs 3 IoCs

    Shadow copies are often targeted by ransomware to inhibit system recovery.

    ransomware
  • Modifies data under HKEY_USERS 64 IoCs
  • Runs ping.exe 1 TTPs 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 47 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 44 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\edf9912bf2c8c7d9048bc6322900231810de7cc34267acc12e1a256fbecdbbdf.exe
    "C:\Users\Admin\AppData\Local\Temp\edf9912bf2c8c7d9048bc6322900231810de7cc34267acc12e1a256fbecdbbdf.exe"
    1⤵
    • Enumerates connected drives
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4060
    • C:\windows\system32\sc.exe
      "C:\windows\system32\sc.exe" create defragsrv binpath= "C:\Users\Admin\AppData\Local\Temp\edf9912bf2c8c7d9048bc6322900231810de7cc34267acc12e1a256fbecdbbdf.exe" start= auto
      2⤵
        PID:316
      • \??\c:\windows\system32\cmd.exe
        "c:\windows\system32\cmd.exe" /c c:\windows\logg.bat
        2⤵
          PID:3360
        • \??\c:\Windows\system32\vssadmin.exe
          "c:\Windows\system32\vssadmin.exe" Delete Shadows /All /Quiet
          2⤵
          • Interacts with shadow copies
          PID:1120
        • \??\c:\windows\system32\sc.exe
          "c:\windows\system32\sc.exe" create defragsrv binpath= "C:\Users\Admin\AppData\Local\Temp\edf9912bf2c8c7d9048bc6322900231810de7cc34267acc12e1a256fbecdbbdf.exe" start= auto
          2⤵
            PID:4888
          • \??\c:\windows\system32\sc.exe
            "c:\windows\system32\sc.exe" start defragsrv
            2⤵
              PID:4944
          • C:\Windows\system32\vssvc.exe
            C:\Windows\system32\vssvc.exe
            1⤵
            • Suspicious use of AdjustPrivilegeToken
            PID:5116
          • C:\Users\Admin\AppData\Local\Temp\edf9912bf2c8c7d9048bc6322900231810de7cc34267acc12e1a256fbecdbbdf.exe
            C:\Users\Admin\AppData\Local\Temp\edf9912bf2c8c7d9048bc6322900231810de7cc34267acc12e1a256fbecdbbdf.exe
            1⤵
            • Drops startup file
            • Drops desktop.ini file(s)
            • Enumerates connected drives
            • Drops file in Program Files directory
            • Drops file in Windows directory
            • Checks processor information in registry
            • Modifies data under HKEY_USERS
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of WriteProcessMemory
            PID:4996
            • \??\c:\windows\system32\cmd.exe
              "c:\windows\system32\cmd.exe" /c c:\windows\logg.bat
              2⤵
                PID:5040
              • \??\c:\Windows\system32\vssadmin.exe
                "c:\Windows\system32\vssadmin.exe" Delete Shadows /All /Quiet
                2⤵
                • Interacts with shadow copies
                PID:5052
              • \??\c:\windows\system32\sc.exe
                "c:\windows\system32\sc.exe" delete defragsrv
                2⤵
                  PID:200
                • \??\c:\windows\system32\wbadmin.exe
                  "c:\windows\system32\wbadmin.exe" delete catalog -quiet
                  2⤵
                  • Deletes backup catalog
                  PID:2720
                • \??\c:\Windows\system32\vssadmin.exe
                  "c:\Windows\system32\vssadmin.exe" Delete Shadows /All /Quiet
                  2⤵
                  • Interacts with shadow copies
                  PID:2224
                • \??\c:\Windows\System32\wbem\WMIC.exe
                  "c:\Windows\System32\wbem\WMIC.exe" shadowcopy delete
                  2⤵
                  • Suspicious use of AdjustPrivilegeToken
                  PID:4116
                • \??\c:\windows\system32\mshta.exe
                  "c:\windows\system32\mshta.exe" "c:\teslarvng2.hta"
                  2⤵
                  • Drops file in System32 directory
                  • Modifies data under HKEY_USERS
                  PID:4448
                • \??\c:\windows\system32\cmd.exe
                  "c:\windows\system32\cmd.exe" /c c:\windows\logg.bat
                  2⤵
                    PID:4460
                  • \??\c:\windows\system32\cmd.exe
                    "c:\windows\system32\cmd.exe" /c SCHTASKS /create /tn logg /sc MINUTE /mo 10 /tr "c:\windows\logg.bat" /ru "NT AUTHORITY\SYSTEM"&&SCHTASKS /run /tn logg
                    2⤵
                    • Suspicious use of WriteProcessMemory
                    PID:4476
                    • C:\Windows\system32\schtasks.exe
                      SCHTASKS /create /tn logg /sc MINUTE /mo 10 /tr "c:\windows\logg.bat" /ru "NT AUTHORITY\SYSTEM"
                      3⤵
                      • Creates scheduled task(s)
                      PID:4672
                    • C:\Windows\system32\schtasks.exe
                      SCHTASKS /run /tn logg
                      3⤵
                        PID:2292
                    • \??\c:\windows\system32\cmd.exe
                      "c:\windows\system32\cmd.exe" /c "C:\Windows\TEMP\wait.bat"
                      2⤵
                      • Suspicious use of WriteProcessMemory
                      PID:4500
                      • C:\Windows\system32\tasklist.exe
                        tasklist
                        3⤵
                        • Enumerates processes with tasklist
                        • Suspicious use of AdjustPrivilegeToken
                        PID:440
                      • C:\Windows\system32\find.exe
                        find /i "SDELETE.exe"
                        3⤵
                          PID:2320
                        • C:\Windows\system32\shutdown.exe
                          shutdown /p /f
                          3⤵
                          • Suspicious use of AdjustPrivilegeToken
                          PID:2400
                      • \??\c:\windows\system32\cmd.exe
                        "c:\windows\system32\cmd.exe" /c ping 127.0.0.1 -w 1000 -n 30 & del /Q /F "C:\Users\Admin\AppData\Local\Temp\edf9912bf2c8c7d9048bc6322900231810de7cc34267acc12e1a256fbecdbbdf.exe"
                        2⤵
                        • Suspicious use of WriteProcessMemory
                        PID:4528
                        • C:\Windows\system32\PING.EXE
                          ping 127.0.0.1 -w 1000 -n 30
                          3⤵
                          • Runs ping.exe
                          PID:3740
                    • C:\Windows\system32\wbengine.exe
                      "C:\Windows\system32\wbengine.exe"
                      1⤵
                      • Suspicious use of AdjustPrivilegeToken
                      PID:4276
                    • C:\Windows\System32\vdsldr.exe
                      C:\Windows\System32\vdsldr.exe -Embedding
                      1⤵
                        PID:4364
                      • C:\Windows\System32\vds.exe
                        C:\Windows\System32\vds.exe
                        1⤵
                        • Checks SCSI registry key(s)
                        PID:4424
                      • C:\Windows\SYSTEM32\cmd.exe
                        C:\Windows\SYSTEM32\cmd.exe /c "c:\windows\logg.bat"
                        1⤵
                          PID:4692
                        • C:\Windows\system32\LogonUI.exe
                          "LogonUI.exe" /flags:0x0 /state0:0xa3ad6055 /state1:0x41c64e6d
                          1⤵
                          • Modifies data under HKEY_USERS
                          • Suspicious use of SetWindowsHookEx
                          PID:668

                        Network

                        MITRE ATT&CK Enterprise v6

                        Replay Monitor

                        Loading Replay Monitor...

                        Downloads