Overview

overview

10

Static

static

10

fee74e1a60...le.exe

windows7_x64

10

fee74e1a60...le.exe

windows10_x64

10

Resubmissions

14-09-2021 08:44

210914-knk9taadcq 10

08-09-2021 13:09

210908-qd156shfgk 10

Analysis

  • max time kernel
    1724s
  • max time network
    1742s
  • platform
    windows7_x64
  • resource
    win7-en
  • submitted
    14-09-2021 08:44

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    fee74e1a60a9bfe9f976fad24d9f63651e6cc479004e9036d2e83a7c561b243b.bin.sample.exe

  • Size

    122KB

  • MD5

    1df36997a8f9096272006b365a68a76d

  • SHA1

    2496712427d789d1bd804835e81d5a210fb5bff8

  • SHA256

    fee74e1a60a9bfe9f976fad24d9f63651e6cc479004e9036d2e83a7c561b243b

  • SHA512

    c2701d71d52854a08f1daacb0d523d12e40096c33feef161fc992a3dda2a16f58de997dfde33c66cb1128a3a61a6a8e1e5425a936bc0f2ba83b3ad6696bf9b3d

Score
10/10
evasionransomware

Malware Config

Extracted

Path

C:\nq7wr59-readme.txt

Ransom Note
---=== Welcome. Again. ===--- [-] Whats HapPen? [-] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension nq7wr59. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practice - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/FA46CC3BDC2A9E4E 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decoder.re/FA46CC3BDC2A9E4E Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: n8TKDlSe8V/FSpf0QCptPVbhomrY3SUITfz5nuI5ydQv4dn04n5EPMKcOpQNvMRQ js/k1NLEF33IXYquUhDnMNnN/kwLCuONrRHhF2RR5Q0tfLiqbn1Lfh8x4nrQIm+q py+WHd3iN44IPxsboH9XfVotpYC0EzReBYUYmL7vz3SoEBmrxVaut0u09M61xa0B SZZIXthqkj/O9vcRAl2xr9Kl9X8XLaIHzva5zguvU2V2l/O/wK2hcKB8gf8/8SLF fFojlC4SVqUfV0djjsrslB1fSGiXI6yeMKVLHlEK+Db5K3oOxg9dovn/ga+JuGe7 G47R9Cs8oepmQcqmKXoCN5d28xjeEPckvbqlp/ckBELU5B5sw/tz5ZTwcvWyL7zt Vc+ocaxJZ37xp4U2hPUkTMC0lj8wDUFkecy1DeitTzVukK+OkA20E6pnDN1UdiAY 3x7HCHeUwp1Q63Zh012Ev7B1ACyCw7WLdkt3fTesxiVwSaDKPfpk3zSqeRsCK4aX xBpChLbxDBtzyE/OoaOxmeGmiwCmOKMYAQsMX0YD8gi2gmleMB7qZyZV4b3R0qvA cO6QMxKUV0SO48eGftWjgH9Dwe39LDwGJHb/CiywVNp45IxQPbVswv8lcOliLUk6 xGAHU57gO6o6S6ZcYzu8IWAWZ5Fm001FOHqlKb9Z2EG4PL1PjV9QyAlvs8mfI8/y MzJQtozpJO6Jl2v5O1g/tAr37iNWw3gMSHZ+9FclszSL7wDw1ZAFDFD49rUOJg0Q lv0DJsDsnbI2IBlN6r6FsRUANXp0a6W9H7P+cyp4mfaGgcjiMBC0SN0v+WBTXkfg 0SDjRa3C/Zyix0FpRbSWloEfc0XCwJjbpnEIIEAZRszZrJ07tukVCgV6fxzLiT55 NBnbNyoEh4qXOVjPAcasQZm26ptRArvWpRlzL7ciwPJxs5oRuN4uqRSr4XUvrHBy umKzs4+qUO+l0vQ+ajDfrfHeC/B7pVd6cC0TE6dD+Vo00GnDIOigbOIwyevOysev YGh/9M8j46yDu6AnFzsszJ2UW+QgUBAY2w0c+/8xqiEe9ANcMf/NEzyYZBH72zEu cXyqmgHc+ckAHtSulAE411241H8HzbE7toThP6kBZcTrTbpKJTsYDT1jbtRJJSt1 cXq2lPSeAT4ILuL6Wl/oVClFYx7CsTZmav7B/WlGekBMJ48byIrzYmKgHp4P9wVf via+JsEUgil4HlNkE9nP/NNqo++PZOgcJOuBnvqQRUiu8LRSBGAgSSywVE22kEAT B2MiCHFPh41moa27cr5RnCf42bbchRtc ----------------------------------------------------------------------------------------- !!! DANGER !!! DON'T try to change files by yourself, DON'T use any third party software for restoring your data or antivirus solutions - its may entail damage of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/FA46CC3BDC2A9E4E

http://decoder.re/FA46CC3BDC2A9E4E

Signatures

  • Modifies Windows Firewall 1 TTPs
    evasion
  • Modifies extensions of user files 9 IoCs

    Ransomware generally changes the extension on encrypted files.

    ransomware
  • Enumerates connected drives 3 TTPs 25 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Sets desktop wallpaper using registry 2 TTPs 1 IoCs
    ransomware
  • Drops file in Program Files directory 20 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious behavior: EnumeratesProcesses 5 IoCs
  • Suspicious use of AdjustPrivilegeToken 5 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\fee74e1a60a9bfe9f976fad24d9f63651e6cc479004e9036d2e83a7c561b243b.bin.sample.exe
    "C:\Users\Admin\AppData\Local\Temp\fee74e1a60a9bfe9f976fad24d9f63651e6cc479004e9036d2e83a7c561b243b.bin.sample.exe"
    1⤵
    • Modifies extensions of user files
    • Enumerates connected drives
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1032
    • C:\Windows\SysWOW64\netsh.exe
      netsh advfirewall firewall set rule group="Network Discovery" new enable=Yes
      2⤵
        PID:592
    • C:\Windows\system32\wbem\unsecapp.exe
      C:\Windows\system32\wbem\unsecapp.exe -Embedding
      1⤵
        PID:1784
      • C:\Windows\system32\vssvc.exe
        C:\Windows\system32\vssvc.exe
        1⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:548

      Network

      MITRE ATT&CK Enterprise v6

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • memory/592-53-0x0000000000000000-mapping.dmp
        Download
      • memory/1032-52-0x0000000075B51000-0x0000000075B53000-memory.dmp
        Filesize

        8KB

        Download