Overview

overview

10

Static

static

10

155eaec829...23.exe

windows7_x64

10

155eaec829...23.exe

windows10_x64

10

8a68388787...97.exe

windows7_x64

10

8a68388787...97.exe

windows10_x64

10

9a9bf626d4...d6.exe

windows7_x64

10

9a9bf626d4...d6.exe

windows10_x64

10

a9fb354944...06.exe

windows7_x64

10

a9fb354944...06.exe

windows10_x64

10

Analysis

  • max time kernel
    135s
  • max time network
    37s
  • platform
    windows7_x64
  • resource
    win7v20210410
  • submitted
    01-07-2021 04:38

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    8a68388787a97c83448898eedb045f620f225538992467bae0ee5c1a1ca4dc97.exe

  • Size

    208KB

  • MD5

    7ee92bcaa1305c7964a993e7f1c3761c

  • SHA1

    6351e156b5fe1d3ae91fec6eb367782b1373111c

  • SHA256

    8a68388787a97c83448898eedb045f620f225538992467bae0ee5c1a1ca4dc97

  • SHA512

    3b5114e9b3e53ac7711df9fa5ad3dc66ce309ade04768cd334f1e1f1b311a9c36f43e6cf167d338e94116ee08dc686c0a000064a40bb2913e1e8b6b8b143c387

Score
10/10
persistenceransomwarespywarestealer

Malware Config

Extracted

Path

C:\$Recycle.Bin\S-1-5-21-2513283230-931923277-594887482-1000\HOW TO DECRYPT FILES.txt

Ransom Note
Hi, as you can see, all your files are encrypted. Don't panic, you can decrypt them, you just have to pay me for the ransom. Payment is made only by bitcoin, and the amount you have to pay is 0.03 BITCOIN You can buy very easily from these sites: www.localbitcoins.com www.paxful.com A list of several sites where you can buy bitcoin can be found here: https://bitcoin.org/en/exchanges Make sure the address where you will send the bitcoin is: 1DENGvxJZofU9BVfiScrgZHhhntJ3sAPSd After sending, contact us at this email address: [email protected] With this subject: ZUCANO03TUTA394821 After confirming the payment, you will receive a tutorial and the keys for decrypting the files.
Wallets

1DENGvxJZofU9BVfiScrgZHhhntJ3sAPSd

Signatures

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Drops desktop.ini file(s) 40 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Program crash 1 IoCs
  • Modifies registry class 10 IoCs
  • Suspicious behavior: EnumeratesProcesses 5 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\8a68388787a97c83448898eedb045f620f225538992467bae0ee5c1a1ca4dc97.exe
    "C:\Users\Admin\AppData\Local\Temp\8a68388787a97c83448898eedb045f620f225538992467bae0ee5c1a1ca4dc97.exe"
    1⤵
    • Adds Run key to start application
    • Drops desktop.ini file(s)
    • Drops file in Program Files directory
    • Modifies registry class
    PID:1996
  • C:\Windows\system32\WerFault.exe
    C:\Windows\system32\WerFault.exe -u -p 1220 -s 2828
    1⤵
    • Program crash
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of AdjustPrivilegeToken
    PID:1172

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1172-61-0x000007FEFB931000-0x000007FEFB933000-memory.dmp

    Filesize

    8KB

    Download

  • memory/1172-62-0x0000000000330000-0x0000000000331000-memory.dmp

    Filesize

    4KB

    Download

  • memory/1996-59-0x0000000075D41000-0x0000000075D43000-memory.dmp

    Filesize

    8KB

    Download