Overview

overview

10

Static

static

10

415321444d...a3.exe

windows7_x64

10

415321444d...a3.exe

windows10_x64

10

Analysis

  • max time kernel
    142s
  • max time network
    119s
  • platform
    windows10_x64
  • resource
    win10v20210410
  • submitted
    11-08-2021 04:30

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    415321444d2ab732e84ff7acb4739e09827ee2fcc748d0fa1d7504bae1d133a3.exe

  • Size

    128KB

  • MD5

    af8c28577e447bb43f80cc81c518d146

  • SHA1

    206f2335b0d7e42553bac9841e67b7f3c8e2d645

  • SHA256

    415321444d2ab732e84ff7acb4739e09827ee2fcc748d0fa1d7504bae1d133a3

  • SHA512

    39d7f007a9b439107140382b19a192ce3ec12824eeda71a62dcbfc97afe7e78fff7f203a86a460b7147c629a67f080db4a087284c30ad9933e6db68e81cd624e

Score
10/10
targetcompanyevasionransomware

Malware Config

Extracted

Path

C:\$Recycle.Bin\How to decrypt files.txt

Family

targetcompany

Ransom Note
Your personal identifier: DF8NMQN4DLD All files on Hellenic Recovery Recycling Corporation SA network have been encrypted due to insufficient security. The only way to quickly and reliably regain access to your files is to contact us. The price depends on how fast you write to us. In other cases, you risk losing your time and access to data. Usually time is much more valuable than money. In addition, we have ~170 gb of data from your network. We can see your partners and if you don't get in contact, we will let them know that you were the source of the data leak. We are aware of the strictness of the European data protection law (GPRD) and we are sure that you are not interested in publishing it. FAQ Q: How to contact us A: * Download Tor Browser - https://www.torproject.org/ * Open link in Tor Browser http://eghv5cpdsmuj5e6tpyjk5icgq642hqubildf6yrfnqlq3rmsqk2zanid.onion/contact * Follow the instructions on the website. Q: What guarantees? A: Before paying, we can decrypt several of your test files. Files should not contain valuable information. Q: Can I decrypt my data for free or through intermediaries? A: Use third party programs and intermediaries at your own risk. Third party software may cause permanent data loss. Decryption of your files with the help of third parties may cause increased price or you can become a victim of a scam. �
URLs

http://eghv5cpdsmuj5e6tpyjk5icgq642hqubildf6yrfnqlq3rmsqk2zanid.onion/contact

Signatures

  • TargetCompany

    Ransomware which encrypts files using a combination of ChaCha20, AES-128, and Curve25519, first seen in June 2021.

    ransomwaretargetcompany
  • Deletes shadow copies 2 TTPs

    Ransomware often targets backup files to inhibit system recovery.

    ransomware
  • Modifies boot configuration data using bcdedit 1 TTPs 2 IoCs
    ransomwareevasion
  • Enumerates connected drives 3 TTPs 24 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Program Files directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Interacts with shadow copies 2 TTPs 1 IoCs

    Shadow copies are often targeted by ransomware to inhibit system recovery.

    ransomware
  • Runs ping.exe 1 TTPs 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 5 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of WriteProcessMemory 14 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\415321444d2ab732e84ff7acb4739e09827ee2fcc748d0fa1d7504bae1d133a3.exe
    "C:\Users\Admin\AppData\Local\Temp\415321444d2ab732e84ff7acb4739e09827ee2fcc748d0fa1d7504bae1d133a3.exe"
    1⤵
    • Enumerates connected drives
    • Drops file in Program Files directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:3904
    • C:\Windows\System32\vssadmin.exe
      "C:\Windows\sysnative\vssadmin.exe" delete shadows /all /quiet
      2⤵
      • Interacts with shadow copies
      PID:2164
    • C:\Windows\System32\cmd.exe
      "C:\Windows\sysnative\cmd.exe" /c bcdedit /set {current} bootstatuspolicy ignoreallfailures
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:2388
      • C:\Windows\system32\bcdedit.exe
        bcdedit /set {current} bootstatuspolicy ignoreallfailures
        3⤵
        • Modifies boot configuration data using bcdedit
        PID:2932
    • C:\Windows\System32\cmd.exe
      "C:\Windows\sysnative\cmd.exe" /c bcdedit /set {current} recoveryenabled no
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:2516
      • C:\Windows\system32\bcdedit.exe
        bcdedit /set {current} recoveryenabled no
        3⤵
        • Modifies boot configuration data using bcdedit
        PID:4044
    • C:\Windows\System32\cmd.exe
      "C:\Windows\sysnative\cmd.exe" /c ping 127.0.0.1 && del "C:\Users\Admin\AppData\Local\Temp\415321444d2ab732e84ff7acb4739e09827ee2fcc748d0fa1d7504bae1d133a3.exe" >> NUL
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:1200
      • C:\Windows\system32\PING.EXE
        ping 127.0.0.1
        3⤵
        • Runs ping.exe
        PID:2628
  • C:\Windows\system32\vssvc.exe
    C:\Windows\system32\vssvc.exe
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:2636
  • C:\Windows\system32\NOTEPAD.EXE
    "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\How to decrypt files.txt
    1⤵
    • Suspicious use of FindShellTrayWindow
    PID:2696

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File Deletion

2
T1107

Credential Access

Discovery

Query Registry

1
T1012

Peripheral Device Discovery

1
T1120

System Information Discovery

2
T1082

Remote System Discovery

1
T1018

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Inhibit System Recovery

3
T1490

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\Desktop\How to decrypt files.txt
    MD5

    3ad61e4ee64fa9f5413ba46c81b153ad

    SHA1

    95dbf962c09660850fb03d44aacde1dbe418d978

    SHA256

    b5a32ef84f1c554a41bde2114c3965228b789178a7ebf87b5e54fd800bfdff77

    SHA512

    f22a6effa7f30ff8ea0a93f60d74dd58d6fbcf4765a65dfef4cf39ab79b52baba682ca954176fb56a55cae7210606194232785ecf501f3e3b59d92640eec0fa5

    Download Submit
  • memory/1200-120-0x0000000000000000-mapping.dmp
    Download
  • memory/2164-114-0x0000000000000000-mapping.dmp
    Download
  • memory/2388-115-0x0000000000000000-mapping.dmp
    Download
  • memory/2516-116-0x0000000000000000-mapping.dmp
    Download
  • memory/2628-121-0x0000000000000000-mapping.dmp
    Download
  • memory/2932-118-0x0000000000000000-mapping.dmp
    Download
  • memory/4044-117-0x0000000000000000-mapping.dmp
    Download