Overview

overview

10

Static

static

e972af26d5...le.exe

windows7_x64

10

e972af26d5...le.exe

windows10_x64

10

Analysis

  • max time kernel
    154s
  • max time network
    135s
  • platform
    windows10_x64
  • resource
    win10v20210408
  • submitted
    26-07-2021 12:40

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    e972af26d5261da3daa1e12e11f357e1e4ce19cd43997f6b7a925a5b9cc8614c.sample.exe

  • Size

    7KB

  • MD5

    ebbc82f619471384f392efd5c4d05883

  • SHA1

    17d91b45c8615d0f09d1100d2be396cbcba21fde

  • SHA256

    e972af26d5261da3daa1e12e11f357e1e4ce19cd43997f6b7a925a5b9cc8614c

  • SHA512

    3e33bd22c440e9ab4a065d216467c1220780aa2a39a38ea4aec81d050d3e6048e87244341fbeac2cdefebae9fe987b713e0d4fcf34adf1390b5ccda6dd448241

Score
10/10
ransomware

Malware Config

Extracted

Path

C:\odt\!_READ_ME_!.txt

Ransom Note
Your files are encrypted with RSA-1024 algorithm. To recovery your files you need to buy our decryptor. To buy decrypting tool contact us at: saveinfo89@yahoo.com === BEGIN === AD7D6889 010200000168000000A40000BD7DB4E2EBEE1544 BEB9D99571A8D84A7040F22B0ADB6E3B833BCF2E C5D4F995343F6EDF3093A92CFA8FBD94D168F792 6C9C083E7B47B200F51447AB4F543AB74F873474 733C6A6C982B49CB40F4DABEB74CB526713A9A6C 28A36B0BAAFED1D100DCDFCD66AE0B46AA71F64C C85D9710D96244EF863BCFEE2A54DB405DC40B30 === END ===
Emails

saveinfo89@yahoo.com

Signatures

  • Deletes itself 1 IoCs
  • Enumerates connected drives 3 TTPs 22 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Program Files directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Modifies registry class 1 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\e972af26d5261da3daa1e12e11f357e1e4ce19cd43997f6b7a925a5b9cc8614c.sample.exe
    "C:\Users\Admin\AppData\Local\Temp\e972af26d5261da3daa1e12e11f357e1e4ce19cd43997f6b7a925a5b9cc8614c.sample.exe"
    1⤵
    • Enumerates connected drives
    • Drops file in Program Files directory
    • Modifies registry class
    • Suspicious use of WriteProcessMemory
    PID:3128
    • C:\Windows\SysWOW64\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\e972af26d5261da3daa1e12e11f357e1e4ce19cd43997f6b7a925a5b9cc8614c.sample.vbs"
      2⤵
      • Deletes itself
      PID:3804

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1
T1012

Peripheral Device Discovery

1
T1120

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\e972af26d5261da3daa1e12e11f357e1e4ce19cd43997f6b7a925a5b9cc8614c.sample.vbs
    MD5

    aadec5d9ed737fb7491d58088cf11345

    SHA1

    caaed15d7bbd693020a7dcf4a6a9866c17c6d8d9

    SHA256

    c8d7e47fcb3a4345202f7ef3fd0db90eb1a1b9cab44e91a9befab3ec3dfa6476

    SHA512

    abfdde6d7176384b5f5a92a1373f8ae41789f8a3d1d88313d1c85bd742e4d824a203430db2efa2a09bd6c43595219cf2dfdd00281de68c001fa62bc70cafb1ac

    Download Submit
  • memory/3804-114-0x0000000000000000-mapping.dmp
    Download