Resubmissions
31-08-2021 13:22
210831-v7yp62p3a2 1003-08-2021 06:34
210803-w6vry4xe5x 1002-08-2021 18:36
210802-whb9t8hbz6 10Analysis
-
max time kernel
43s -
max time network
47s -
platform
windows10_x64 -
resource
win10v20210408 -
submitted
03-08-2021 06:34
Static task
static1
Behavioral task
behavioral1
Sample
Windows.Encryptor.exe
Resource
win7v20210410
Behavioral task
behavioral2
Sample
Windows.Encryptor.exe
Resource
win10v20210408
Errors
General
-
Target
Windows.Encryptor.exe
-
Size
66KB
-
MD5
ba375d0625001102fc1f2ccb6f582d91
-
SHA1
379ebd1eff6f8685f4ff72657626bf6df5383d87
-
SHA256
c6e2ef30a86baa670590bd21acf5b91822117e0cbe6060060bc5fe0182dace99
-
SHA512
795b10a638e289729192de6a6d9964b5ad3b8084f84d58da077ca8ec08c8b8cb1acadb5240962d4ccacf66242bab1430923fc77bdbbfacd0badd64df2ba1487f
Malware Config
Extracted
C:\UCzUExPUL.README.txt
http://supp24yy6a66hwszu2piygicgwzdtbwftb76htfj7vnip3getgqnzxid.onion/GDBJS76DH3D4IKQD2QO7R
Signatures
-
Modifies extensions of user files 19 IoCs
Ransomware generally changes the extension on encrypted files.
description ioc Process File renamed C:\Users\Admin\Pictures\MergeTrace.raw => C:\Users\Admin\Pictures\MergeTrace.raw.UCzUExPUL Windows.Encryptor.exe File opened for modification C:\Users\Admin\Pictures\OptimizeApprove.png.UCzUExPUL Windows.Encryptor.exe File opened for modification C:\Users\Admin\Pictures\ShowDisconnect.tif.UCzUExPUL Windows.Encryptor.exe File opened for modification C:\Users\Admin\Pictures\ClearConvertFrom.tif.UCzUExPUL Windows.Encryptor.exe File opened for modification C:\Users\Admin\Pictures\CompareRevoke.tif.UCzUExPUL Windows.Encryptor.exe File opened for modification C:\Users\Admin\Pictures\EnableUnlock.crw.UCzUExPUL Windows.Encryptor.exe File opened for modification C:\Users\Admin\Pictures\MergeSearch.tiff Windows.Encryptor.exe File renamed C:\Users\Admin\Pictures\MergeSearch.tiff => C:\Users\Admin\Pictures\MergeSearch.tiff.UCzUExPUL Windows.Encryptor.exe File renamed C:\Users\Admin\Pictures\UnlockTest.png => C:\Users\Admin\Pictures\UnlockTest.png.UCzUExPUL Windows.Encryptor.exe File renamed C:\Users\Admin\Pictures\WaitPop.tif => C:\Users\Admin\Pictures\WaitPop.tif.UCzUExPUL Windows.Encryptor.exe File opened for modification C:\Users\Admin\Pictures\WaitPop.tif.UCzUExPUL Windows.Encryptor.exe File renamed C:\Users\Admin\Pictures\EnableUnlock.crw => C:\Users\Admin\Pictures\EnableUnlock.crw.UCzUExPUL Windows.Encryptor.exe File renamed C:\Users\Admin\Pictures\ClearConvertFrom.tif => C:\Users\Admin\Pictures\ClearConvertFrom.tif.UCzUExPUL Windows.Encryptor.exe File opened for modification C:\Users\Admin\Pictures\MergeSearch.tiff.UCzUExPUL Windows.Encryptor.exe File opened for modification C:\Users\Admin\Pictures\MergeTrace.raw.UCzUExPUL Windows.Encryptor.exe File renamed C:\Users\Admin\Pictures\OptimizeApprove.png => C:\Users\Admin\Pictures\OptimizeApprove.png.UCzUExPUL Windows.Encryptor.exe File renamed C:\Users\Admin\Pictures\ShowDisconnect.tif => C:\Users\Admin\Pictures\ShowDisconnect.tif.UCzUExPUL Windows.Encryptor.exe File renamed C:\Users\Admin\Pictures\CompareRevoke.tif => C:\Users\Admin\Pictures\CompareRevoke.tif.UCzUExPUL Windows.Encryptor.exe File opened for modification C:\Users\Admin\Pictures\UnlockTest.png.UCzUExPUL Windows.Encryptor.exe -
Enumerates connected drives 3 TTPs 1 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\Z: Windows.Encryptor.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 6 IoCs
pid Process 640 Windows.Encryptor.exe 640 Windows.Encryptor.exe 640 Windows.Encryptor.exe 640 Windows.Encryptor.exe 640 Windows.Encryptor.exe 640 Windows.Encryptor.exe -
Modifies Control Panel 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Control Panel\International Windows.Encryptor.exe -
Modifies data under HKEY_USERS 15 IoCs
description ioc Process Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365271" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglowBalance = "10" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentColorMenu = "4292311040" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColorBalance = "89" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationBlurBalance = "1" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\EnableWindowColorization = "1" LogonUI.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent LogonUI.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\AccentColor = "4292311040" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglow = "3288365271" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationGlassAttribute = "1" LogonUI.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = a6d8ff0076b9ed00429ce3000078d700005a9e000042750000264200f7630c00 LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\StartColorMenu = "4288567808" LogonUI.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM LogonUI.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 640 Windows.Encryptor.exe 640 Windows.Encryptor.exe 640 Windows.Encryptor.exe 640 Windows.Encryptor.exe -
Suspicious use of AdjustPrivilegeToken 17 IoCs
description pid Process Token: SeBackupPrivilege 640 Windows.Encryptor.exe Token: SeDebugPrivilege 640 Windows.Encryptor.exe Token: 36 640 Windows.Encryptor.exe Token: SeImpersonatePrivilege 640 Windows.Encryptor.exe Token: SeIncBasePriorityPrivilege 640 Windows.Encryptor.exe Token: SeIncreaseQuotaPrivilege 640 Windows.Encryptor.exe Token: 33 640 Windows.Encryptor.exe Token: SeManageVolumePrivilege 640 Windows.Encryptor.exe Token: SeProfSingleProcessPrivilege 640 Windows.Encryptor.exe Token: SeRestorePrivilege 640 Windows.Encryptor.exe Token: SeSecurityPrivilege 640 Windows.Encryptor.exe Token: SeSystemProfilePrivilege 640 Windows.Encryptor.exe Token: SeTakeOwnershipPrivilege 640 Windows.Encryptor.exe Token: SeShutdownPrivilege 640 Windows.Encryptor.exe Token: SeBackupPrivilege 2664 vssvc.exe Token: SeRestorePrivilege 2664 vssvc.exe Token: SeAuditPrivilege 2664 vssvc.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 512 LogonUI.exe 512 LogonUI.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Windows.Encryptor.exe"C:\Users\Admin\AppData\Local\Temp\Windows.Encryptor.exe"1⤵
- Modifies extensions of user files
- Enumerates connected drives
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Modifies Control Panel
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:640
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2664
-
C:\Windows\system32\LogonUI.exe"LogonUI.exe" /flags:0x0 /state0:0xa3ad4855 /state1:0x41c64e6d1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:512