Overview

overview

10

Static

static

44f0b6ee09...78.exe

windows7_x64

10

44f0b6ee09...78.exe

windows10_x64

10

Analysis

  • max time kernel
    113s
  • max time network
    116s
  • platform
    windows10_x64
  • resource
    win10v20210408
  • submitted
    07-09-2021 13:56

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    44f0b6ee096aeb62aa585a0c37decaae0177eae22c18e40b0e823d9eaf856b78.exe

  • Size

    1.1MB

  • MD5

    fc95d7841f298dbe638cbe63d7878d89

  • SHA1

    919324ceb106a872866c9b78612094666644b03d

  • SHA256

    44f0b6ee096aeb62aa585a0c37decaae0177eae22c18e40b0e823d9eaf856b78

  • SHA512

    b7a581dda18cf09b9b4f69e922244efb90b8494536e1281b01a86a5dcc25cf0a3edc1361895b4bbd305eb8368471a37b811c4ce956f8e047f8aab7365fb2b45f

Score
10/10
ransomwarespywarestealer

Malware Config

Extracted

Path

C:\ReadMe.txt

Ransom Note
Gentlemen! Your business is at serios risk . There is a significant hole in the security system of your company. We have easily penetrated your network. You should thank the Lord for being hacked by serios people not some stupid schoolboys or dangerous punks. They can damage all your important data just for fun. All files on each host in the network have been encrypted with a strong algorithm Now your files are crypted with the strongest millitary algorithms RSA4096 and AES-256. No one can help you to restore files without our special decoder. Photorec, RannoDecryptor etc. repair tools Are useless and can destroy your files irreversibly. If you want to restore your files write to emails (contacts are at the bottom of the sheet ) and attach 2 encrypted files (Less than 5 Mb each, non-archived and your files should not contain valuable information (Databases, backups, large excel sheets, etc. )) You will receive decrypted samples and our conditions how to get the decoder. Please don't forget to write the name of your company in the subject of your e-mail. You have to pay for decryption in Bitcoins. The final price depends on how fast you write to us. Every day of delay will cost you additional BTC Nothing personal just business As soon as we get bitcoins you'll get all your decrypted data back. Moreover you will get instructions how to close the hole in security and how to avoid such problems in the future we will recommend you special software that makes the most problems to hackers. Attention! One more time ! Do not rename encrypted files. Do not try to decrypt your data using third party software. P.S. Remember, we are not scammers. We dont need your files and your information. But after 2 weeks all your files and keys will be deleted automatically. Just send a request immediately after infection. All data will be restored absolutely. Your warranty - decrypted samples. Contact emails Primary email : unibovwood1984@protonmail.com Secondary email : ormecha19@tutanota.com
Emails

unibovwood1984@protonmail.com

ormecha19@tutanota.com

Signatures

  • Drops startup file 2 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Enumerates connected drives 3 TTPs 24 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Program Files directory 18 IoCs
  • Drops file in Windows directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious behavior: EnumeratesProcesses 48 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\44f0b6ee096aeb62aa585a0c37decaae0177eae22c18e40b0e823d9eaf856b78.exe
    "C:\Users\Admin\AppData\Local\Temp\44f0b6ee096aeb62aa585a0c37decaae0177eae22c18e40b0e823d9eaf856b78.exe"
    1⤵
    • Drops startup file
    • Enumerates connected drives
    • Drops file in Program Files directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:568
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\44F0B6~1.BAT
      2⤵
        PID:3748
    • C:\Windows\system32\mspaint.exe
      "C:\Windows\system32\mspaint.exe" "C:\Users\Admin\Desktop\Recovery.bmp"
      1⤵
      • Drops file in Windows directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of SetWindowsHookEx
      PID:1300
    • \??\c:\windows\system32\svchost.exe
      c:\windows\system32\svchost.exe -k localsystemnetworkrestricted -s DeviceAssociationService
      1⤵
        PID:3588

      Network

      MITRE ATT&CK Matrix ATT&CK v6

      Initial Access

      Execution

      Persistence

      Privilege Escalation

      Defense Evasion

      Credential Access

      Credentials in Files

      1
      T1081

      Discovery

      Query Registry

      1
      T1012

      Peripheral Device Discovery

      1
      T1120

      System Information Discovery

      2
      T1082

      Lateral Movement

      Collection

      Data from Local System

      1
      T1005

      Exfiltration

      Command and Control

      Impact

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Local\Temp\44f0b6ee096aeb62aa585a0c37decaae0177eae22c18e40b0e823d9eaf856b78.exe.bat
        MD5

        837c409563fc188640223174a9af63c7

        SHA1

        f67029d8acc3322e0b3be0498ec8ce68476fa3db

        SHA256

        57976e286311302bb9c2bc4b379984002fdaf4dd44a47e969827f96aebd87a47

        SHA512

        3008f150f91a8e8a180f53fe1c8a6acc55364e732f5e54f8c78d6169459a16817d0a6e389355b26d641348ece017e3148a9c2daf0e3150ef507382cd960d3ca0

        Download Submit
      • C:\Users\Admin\Desktop\Recovery.bmp
        MD5

        a0f1161d8e3acb5729f1b137a3e60596

        SHA1

        3c0437a0f38b9e8c3a19d7bf55f9bf101ca3b695

        SHA256

        2dff19f59b6cb456b07d71e74d79493a8ac31c51e66feec3a0bb50c50bafff0e

        SHA512

        56ac8f19aa092a680c1476308dc389e2df7fa1487be80adcf3b48cdb7a5ac62add5f1f9b73d67ce689e6f2e479240d5556c01aced4358ac9f5d6eba6e29d64aa

        Download Submit
      • memory/3748-114-0x0000000000000000-mapping.dmp
        Download