Analysis
-
max time kernel
121s -
max time network
163s -
platform
windows7_x64 -
resource
win7v20210410 -
submitted
26-07-2021 12:59
Static task
static1
Behavioral task
behavioral1
Sample
e9662b468135f758a9487a1be50159ef57f3050b753de2915763b4ed78839ead.sample.exe
Resource
win7v20210410
Behavioral task
behavioral2
Sample
e9662b468135f758a9487a1be50159ef57f3050b753de2915763b4ed78839ead.sample.exe
Resource
win10v20210410
General
-
Target
e9662b468135f758a9487a1be50159ef57f3050b753de2915763b4ed78839ead.sample.exe
-
Size
504KB
-
MD5
e9454a2ff16897e177d8a11083850ec7
-
SHA1
6b6855931e69d27f5f2e2d828fbeb4db91688996
-
SHA256
e9662b468135f758a9487a1be50159ef57f3050b753de2915763b4ed78839ead
-
SHA512
9bd01ed32887cecefe3987991f3ae3a0375c1cb1bff8b49f795b000076c26a1bb938476e4383b60a3f1ac5de79f7cd3cf2520ef695908815c0fee55a17dcb021
Malware Config
Signatures
-
Mespinoza Ransomware 2 TTPs
Also known as Pysa. Ransomware-as-a-servoce which first appeared in 2020.
-
Modifies extensions of user files 14 IoCs
Ransomware generally changes the extension on encrypted files.
description ioc Process File opened for modification C:\Users\Admin\Pictures\FormatSelect.raw.pysa e9662b468135f758a9487a1be50159ef57f3050b753de2915763b4ed78839ead.sample.exe File renamed C:\Users\Admin\Pictures\ResolveOpen.tiff => C:\Users\Admin\Pictures\ResolveOpen.tiff.pysa e9662b468135f758a9487a1be50159ef57f3050b753de2915763b4ed78839ead.sample.exe File opened for modification C:\Users\Admin\Pictures\StepDisable.crw.pysa e9662b468135f758a9487a1be50159ef57f3050b753de2915763b4ed78839ead.sample.exe File renamed C:\Users\Admin\Pictures\ExpandStart.crw => C:\Users\Admin\Pictures\ExpandStart.crw.pysa e9662b468135f758a9487a1be50159ef57f3050b753de2915763b4ed78839ead.sample.exe File opened for modification C:\Users\Admin\Pictures\SearchUndo.tiff.pysa e9662b468135f758a9487a1be50159ef57f3050b753de2915763b4ed78839ead.sample.exe File opened for modification C:\Users\Admin\Pictures\UnprotectRead.raw.pysa e9662b468135f758a9487a1be50159ef57f3050b753de2915763b4ed78839ead.sample.exe File renamed C:\Users\Admin\Pictures\FormatSelect.raw => C:\Users\Admin\Pictures\FormatSelect.raw.pysa e9662b468135f758a9487a1be50159ef57f3050b753de2915763b4ed78839ead.sample.exe File renamed C:\Users\Admin\Pictures\ResumeRead.tif => C:\Users\Admin\Pictures\ResumeRead.tif.pysa e9662b468135f758a9487a1be50159ef57f3050b753de2915763b4ed78839ead.sample.exe File opened for modification C:\Users\Admin\Pictures\ResumeRead.tif.pysa e9662b468135f758a9487a1be50159ef57f3050b753de2915763b4ed78839ead.sample.exe File renamed C:\Users\Admin\Pictures\SearchUndo.tiff => C:\Users\Admin\Pictures\SearchUndo.tiff.pysa e9662b468135f758a9487a1be50159ef57f3050b753de2915763b4ed78839ead.sample.exe File opened for modification C:\Users\Admin\Pictures\ExpandStart.crw.pysa e9662b468135f758a9487a1be50159ef57f3050b753de2915763b4ed78839ead.sample.exe File opened for modification C:\Users\Admin\Pictures\ResolveOpen.tiff.pysa e9662b468135f758a9487a1be50159ef57f3050b753de2915763b4ed78839ead.sample.exe File renamed C:\Users\Admin\Pictures\StepDisable.crw => C:\Users\Admin\Pictures\StepDisable.crw.pysa e9662b468135f758a9487a1be50159ef57f3050b753de2915763b4ed78839ead.sample.exe File renamed C:\Users\Admin\Pictures\UnprotectRead.raw => C:\Users\Admin\Pictures\UnprotectRead.raw.pysa e9662b468135f758a9487a1be50159ef57f3050b753de2915763b4ed78839ead.sample.exe -
Deletes itself 1 IoCs
pid Process 1840 cmd.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Internet Explorer\images\bing.ico.pysa e9662b468135f758a9487a1be50159ef57f3050b753de2915763b4ed78839ead.sample.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Etc\GMT+5.pysa e9662b468135f758a9487a1be50159ef57f3050b753de2915763b4ed78839ead.sample.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\LICENSE.pysa e9662b468135f758a9487a1be50159ef57f3050b753de2915763b4ed78839ead.sample.exe File created C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\en-US\css\Readme.README e9662b468135f758a9487a1be50159ef57f3050b753de2915763b4ed78839ead.sample.exe File created C:\Program Files (x86)\Google\Policies\Readme.README e9662b468135f758a9487a1be50159ef57f3050b753de2915763b4ed78839ead.sample.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.browser.jdp_5.5.0.165303.jar.pysa e9662b468135f758a9487a1be50159ef57f3050b753de2915763b4ed78839ead.sample.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-profiler_zh_CN.jar.pysa e9662b468135f758a9487a1be50159ef57f3050b753de2915763b4ed78839ead.sample.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\lib\deployed\jdk15\Readme.README e9662b468135f758a9487a1be50159ef57f3050b753de2915763b4ed78839ead.sample.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Guam.pysa e9662b468135f758a9487a1be50159ef57f3050b753de2915763b4ed78839ead.sample.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\lib\locale\org-openide-util-lookup_zh_CN.jar.pysa e9662b468135f758a9487a1be50159ef57f3050b753de2915763b4ed78839ead.sample.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.app_1.3.200.v20130910-1609.jar.pysa e9662b468135f758a9487a1be50159ef57f3050b753de2915763b4ed78839ead.sample.exe File opened for modification C:\Program Files\Java\jre7\lib\deploy\messages_sv.properties.pysa e9662b468135f758a9487a1be50159ef57f3050b753de2915763b4ed78839ead.sample.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-modules-queries.xml.pysa e9662b468135f758a9487a1be50159ef57f3050b753de2915763b4ed78839ead.sample.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AMT\AUMProduct.cer.pysa e9662b468135f758a9487a1be50159ef57f3050b753de2915763b4ed78839ead.sample.exe File created C:\Program Files\Java\jdk1.7.0_80\db\bin\Readme.README e9662b468135f758a9487a1be50159ef57f3050b753de2915763b4ed78839ead.sample.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\include\win32\bridge\AccessBridgePackages.h.pysa e9662b468135f758a9487a1be50159ef57f3050b753de2915763b4ed78839ead.sample.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.greychartplugin_5.5.0.165303.jar.pysa e9662b468135f758a9487a1be50159ef57f3050b753de2915763b4ed78839ead.sample.exe File created C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\en-US\js\Readme.README e9662b468135f758a9487a1be50159ef57f3050b753de2915763b4ed78839ead.sample.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\PROFILE\PROFILE.INF.pysa e9662b468135f758a9487a1be50159ef57f3050b753de2915763b4ed78839ead.sample.exe File opened for modification C:\Program Files\7-Zip\Lang\ug.txt.pysa e9662b468135f758a9487a1be50159ef57f3050b753de2915763b4ed78839ead.sample.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.touchpoint.natives.nl_zh_4.4.0.v20140623020002.jar.pysa e9662b468135f758a9487a1be50159ef57f3050b753de2915763b4ed78839ead.sample.exe File opened for modification C:\Program Files\Java\jre7\lib\ext\zipfs.jar.pysa e9662b468135f758a9487a1be50159ef57f3050b753de2915763b4ed78839ead.sample.exe File created C:\Program Files\VideoLAN\VLC\locale\az\LC_MESSAGES\Readme.README e9662b468135f758a9487a1be50159ef57f3050b753de2915763b4ed78839ead.sample.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\EQUATION\MTEXTRA.TTF.pysa e9662b468135f758a9487a1be50159ef57f3050b753de2915763b4ed78839ead.sample.exe File created C:\Program Files (x86)\Common Files\microsoft shared\EQUATION\Readme.README e9662b468135f758a9487a1be50159ef57f3050b753de2915763b4ed78839ead.sample.exe File created C:\Program Files (x86)\Common Files\microsoft shared\ink\en-US\Readme.README e9662b468135f758a9487a1be50159ef57f3050b753de2915763b4ed78839ead.sample.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-modules-editor-mimelookup.xml.pysa e9662b468135f758a9487a1be50159ef57f3050b753de2915763b4ed78839ead.sample.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\com-sun-tools-visualvm-sa.jar.pysa e9662b468135f758a9487a1be50159ef57f3050b753de2915763b4ed78839ead.sample.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.net_1.2.200.v20120807-0927.jar.pysa e9662b468135f758a9487a1be50159ef57f3050b753de2915763b4ed78839ead.sample.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-jmx_zh_CN.jar.pysa e9662b468135f758a9487a1be50159ef57f3050b753de2915763b4ed78839ead.sample.exe File opened for modification C:\Program Files\Java\jre7\lib\security\local_policy.jar.pysa e9662b468135f758a9487a1be50159ef57f3050b753de2915763b4ed78839ead.sample.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\America\North_Dakota\Beulah.pysa e9662b468135f758a9487a1be50159ef57f3050b753de2915763b4ed78839ead.sample.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Pangnirtung.pysa e9662b468135f758a9487a1be50159ef57f3050b753de2915763b4ed78839ead.sample.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.docs.ja_5.5.0.165303.jar.pysa e9662b468135f758a9487a1be50159ef57f3050b753de2915763b4ed78839ead.sample.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Brunei.pysa e9662b468135f758a9487a1be50159ef57f3050b753de2915763b4ed78839ead.sample.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Europe\Moscow.pysa e9662b468135f758a9487a1be50159ef57f3050b753de2915763b4ed78839ead.sample.exe File opened for modification C:\Program Files\7-Zip\Lang\hy.txt.pysa e9662b468135f758a9487a1be50159ef57f3050b753de2915763b4ed78839ead.sample.exe File opened for modification C:\Program Files\7-Zip\Lang\pa-in.txt.pysa e9662b468135f758a9487a1be50159ef57f3050b753de2915763b4ed78839ead.sample.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Pacific\Galapagos.pysa e9662b468135f758a9487a1be50159ef57f3050b753de2915763b4ed78839ead.sample.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\javafx-mx.jar.pysa e9662b468135f758a9487a1be50159ef57f3050b753de2915763b4ed78839ead.sample.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-openide-execution.xml.pysa e9662b468135f758a9487a1be50159ef57f3050b753de2915763b4ed78839ead.sample.exe File opened for modification C:\Program Files\Java\jre7\lib\security\javafx.policy.pysa e9662b468135f758a9487a1be50159ef57f3050b753de2915763b4ed78839ead.sample.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\America\North_Dakota\New_Salem.pysa e9662b468135f758a9487a1be50159ef57f3050b753de2915763b4ed78839ead.sample.exe File created C:\Program Files (x86)\Common Files\SpeechEngines\Readme.README e9662b468135f758a9487a1be50159ef57f3050b753de2915763b4ed78839ead.sample.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Warsaw.pysa e9662b468135f758a9487a1be50159ef57f3050b753de2915763b4ed78839ead.sample.exe File opened for modification C:\Program Files\Java\jre7\lib\images\cursors\win32_LinkDrop32x32.gif.pysa e9662b468135f758a9487a1be50159ef57f3050b753de2915763b4ed78839ead.sample.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.equinox.p2.rcp.feature_1.2.0.v20140523-0116\feature.xml.pysa e9662b468135f758a9487a1be50159ef57f3050b753de2915763b4ed78839ead.sample.exe File created C:\Program Files\VideoLAN\VLC\plugins\audio_mixer\Readme.README e9662b468135f758a9487a1be50159ef57f3050b753de2915763b4ed78839ead.sample.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Asia\Gaza.pysa e9662b468135f758a9487a1be50159ef57f3050b753de2915763b4ed78839ead.sample.exe File opened for modification C:\Program Files\Java\jre7\LICENSE.pysa e9662b468135f758a9487a1be50159ef57f3050b753de2915763b4ed78839ead.sample.exe File created C:\Program Files\VideoLAN\VLC\locale\ga\LC_MESSAGES\Readme.README e9662b468135f758a9487a1be50159ef57f3050b753de2915763b4ed78839ead.sample.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\dialogs\stream_config_window.html.pysa e9662b468135f758a9487a1be50159ef57f3050b753de2915763b4ed78839ead.sample.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\PROOF\MSWDS_ES.LEX.pysa e9662b468135f758a9487a1be50159ef57f3050b753de2915763b4ed78839ead.sample.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Wake.pysa e9662b468135f758a9487a1be50159ef57f3050b753de2915763b4ed78839ead.sample.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-autoupdate-cli_ja.jar.pysa e9662b468135f758a9487a1be50159ef57f3050b753de2915763b4ed78839ead.sample.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Asia\Kolkata.pysa e9662b468135f758a9487a1be50159ef57f3050b753de2915763b4ed78839ead.sample.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\css\ui-lightness\images\ui-icons_ffd27a_256x240.png.pysa e9662b468135f758a9487a1be50159ef57f3050b753de2915763b4ed78839ead.sample.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\update_tracking\org-netbeans-modules-profiler-selector-ui.xml.pysa e9662b468135f758a9487a1be50159ef57f3050b753de2915763b4ed78839ead.sample.exe File created C:\Program Files\VideoLAN\VLC\locale\gu\Readme.README e9662b468135f758a9487a1be50159ef57f3050b753de2915763b4ed78839ead.sample.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\BREEZE\BREEZE.INF.pysa e9662b468135f758a9487a1be50159ef57f3050b753de2915763b4ed78839ead.sample.exe File opened for modification C:\Program Files\7-Zip\Lang\ga.txt.pysa e9662b468135f758a9487a1be50159ef57f3050b753de2915763b4ed78839ead.sample.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-openide-loaders_zh_CN.jar.pysa e9662b468135f758a9487a1be50159ef57f3050b753de2915763b4ed78839ead.sample.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Irkutsk.pysa e9662b468135f758a9487a1be50159ef57f3050b753de2915763b4ed78839ead.sample.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.common_2.10.1.v20140901-1043\feature.properties.pysa e9662b468135f758a9487a1be50159ef57f3050b753de2915763b4ed78839ead.sample.exe -
Drops file in Windows directory 1 IoCs
description ioc Process File created C:\Windows\Readme.README e9662b468135f758a9487a1be50159ef57f3050b753de2915763b4ed78839ead.sample.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 672 wrote to memory of 1840 672 e9662b468135f758a9487a1be50159ef57f3050b753de2915763b4ed78839ead.sample.exe 32 PID 672 wrote to memory of 1840 672 e9662b468135f758a9487a1be50159ef57f3050b753de2915763b4ed78839ead.sample.exe 32 PID 672 wrote to memory of 1840 672 e9662b468135f758a9487a1be50159ef57f3050b753de2915763b4ed78839ead.sample.exe 32 PID 672 wrote to memory of 1840 672 e9662b468135f758a9487a1be50159ef57f3050b753de2915763b4ed78839ead.sample.exe 32 PID 672 wrote to memory of 1840 672 e9662b468135f758a9487a1be50159ef57f3050b753de2915763b4ed78839ead.sample.exe 32 PID 672 wrote to memory of 1840 672 e9662b468135f758a9487a1be50159ef57f3050b753de2915763b4ed78839ead.sample.exe 32 PID 672 wrote to memory of 1840 672 e9662b468135f758a9487a1be50159ef57f3050b753de2915763b4ed78839ead.sample.exe 32 -
System policy modification 1 TTPs 2 IoCs
description ioc Process Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\legalnoticetext = 48006900200043006f006d00700061006e0079002c000d000a000d000a00450076006500720079002000620079007400650020006f006e00200061006e00790020007400790070006500730020006f006600200079006f0075007200200064006500760069006300650073002000770061007300200065006e0063007200790070007400650064002e000d000a0044006f006e00270074002000740072007900200074006f00200075007300650020006200610063006b007500700073002000620065006300610075007300650020006900740020007700650072006500200065006e006300720079007000740065006400200074006f006f002e000d000a000d000a0054006f002000670065007400200061006c006c00200079006f00750072002000640061007400610020006200610063006b00200063006f006e0074006100630074002000750073003a000d000a007200610069006e00670065006d006100780069006d006f004000700072006f0074006f006e006d00610069006c002e0063006f006d000d000a006700610072006500740068002e006d0063006b006900650033006c004000700072006f0074006f006e006d00610069006c002e0063006f006d000d000a002d002d002d002d002d002d002d002d002d002d002d002d002d002d000d000a000d000a004600410051003a000d000a000d000a0031002e000d000a0020002000200051003a00200048006f0077002000630061006e002000490020006d0061006b00650020007300750072006500200079006f007500200064006f006e0027007400200066006f006f006c0069006e00670020006d0065003f000d000a0020002000200041003a00200059006f0075002000630061006e002000730065006e006400200075007300200032002000660069006c006500730028006d0061007800200032006d00620029002e000d000a000d000a0032002e000d000a0020002000200051003a0020005700680061007400200074006f00200064006f00200074006f002000670065007400200061006c006c002000640061007400610020006200610063006b003f000d000a0020002000200041003a00200044006f006e0027007400200072006500730074006100720074002000740068006500200063006f006d00700075007400650072002c00200064006f006e002700740020006d006f00760065002000660069006c0065007300200061006e0064002000770072006900740065002000750073002e000d000a000d000a0033002e000d000a0020002000200051003a0020005700680061007400200074006f002000740065006c006c0020006d007900200062006f00730073003f000d000a0020002000200041003a002000500072006f007400650063007400200059006f00750072002000530079007300740065006d00200041006d00690067006f002e000d000a000d000a000000 e9662b468135f758a9487a1be50159ef57f3050b753de2915763b4ed78839ead.sample.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\legalnoticecaption = 50005900530041000000 e9662b468135f758a9487a1be50159ef57f3050b753de2915763b4ed78839ead.sample.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\e9662b468135f758a9487a1be50159ef57f3050b753de2915763b4ed78839ead.sample.exe"C:\Users\Admin\AppData\Local\Temp\e9662b468135f758a9487a1be50159ef57f3050b753de2915763b4ed78839ead.sample.exe"1⤵
- Modifies extensions of user files
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
- System policy modification
PID:672 -
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\update.bat" "2⤵
- Deletes itself
PID:1840
-