Overview

overview

10

Static

static

10

fee74e1a60...le.exe

windows7_x64

10

fee74e1a60...le.exe

windows10_x64

10

Resubmissions

14-09-2021 08:44

210914-knk9taadcq 10

08-09-2021 13:09

210908-qd156shfgk 10

Analysis

  • max time kernel
    762s
  • max time network
    1719s
  • platform
    windows10_x64
  • resource
    win10v20210408
  • submitted
    14-09-2021 08:44

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    fee74e1a60a9bfe9f976fad24d9f63651e6cc479004e9036d2e83a7c561b243b.bin.sample.exe

  • Size

    122KB

  • MD5

    1df36997a8f9096272006b365a68a76d

  • SHA1

    2496712427d789d1bd804835e81d5a210fb5bff8

  • SHA256

    fee74e1a60a9bfe9f976fad24d9f63651e6cc479004e9036d2e83a7c561b243b

  • SHA512

    c2701d71d52854a08f1daacb0d523d12e40096c33feef161fc992a3dda2a16f58de997dfde33c66cb1128a3a61a6a8e1e5425a936bc0f2ba83b3ad6696bf9b3d

Score
10/10
evasionransomware

Malware Config

Extracted

Path

C:\vzts0-readme.txt

Ransom Note
---=== Welcome. Again. ===--- [-] Whats HapPen? [-] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension vzts0. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practice - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/75D30EC5588FDE81 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decoder.re/75D30EC5588FDE81 Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: 64yJG0kWSyBt+geRJ+4aVm/wzSorOvuMn0QIrli5p9p50hwbW/4rRmL6VHVPJuZe tNs86fBaHKhNP53fgz/hZARJQE98/0xr4yZMkKEOkP7+5tyx71ah0pdatO2EwpHG p/vXtGvSU2oi8+3ykgl4f6MDqLhEPmPOQ97UEUW7rJVH+ZbnoqEwAAgKIJAfU1ER 3oS6VHQfgud5HOdfBQruDckeUhl2MnI+xnnieMUQ3hm/ZUs7eZJ+a20Wtw7e12Na hGsDNwYGUKjnsusdmGwYKeJxpVF6zY3WN7NtM4yUPBefMQN8eGENS2eUokIc1MGL 19Elw5bLD1aMTQPyjG1tKGSozwcDEtwNv215KZOi+dyYpt3YyrySHcjGScQygokS 3ol++lMJKrKj+UNfVeKvV7rsZPH4Pm+SfgGc60t08i7XNH8x7+EwD+GfI0OvjKI1 tPV9nReWej5U6jGzj07j6endCQYRrbO/zlhldEiiMxT3sE7+mDAi1PWIF4qP5WZ4 BTHhxc2UgpwQGAKBoli3UnN+lZW8vHTzOZblW7WxWIOFn80az4hVD386ZYSMpQeL g0v3JY8g/0J+WrcOSvVlx+FDfn3MmDevlILsO1zz9dCYTfuu3KE4dqWm+41CWr2D xxZc3QGZyBtjS0b2P+RGdxN+UCc7susuzClfP+YZiRFxIJchp1ZM2bbotSOnEjd9 wDxEqv9/KyqzjYmLL5ZyqPG8Befy+DHeBDPntrFS8vgRUYJKq+h/IS9cOQ5cx+Wz GKgtYvSuCuZc0+LdsdV+YNKpsPo/BT4fltsDqqLr+1iZUl0bsBYCRFw1cJiyyD4A n+Og3vEKz4Y0CZeHVf8SdvOnjha+cPc3TO1KNc76sqWNK8sVPqpLQ4JYYc3e+zGS Eo0uEwTv9LWmE/eFZzwvoV+FSfylVC0/iSZ3NDgefxD4pa8Oh1bs1dbRGVPmO4Oh jrBBukoXwkiHxp+sT4vr3VbOYQbU5W+RuoEQoMaMM3LSufBa+I78nezwlkVz5Mtz QVO1UMsZt1Luvrz2W3PXLB6FLta0OeVutNWZrXg7SllVSpUFuDC1mCTo8XO/81qc K86KkYgpSIU2pma/KCE6Lj4QcxPqXjuIx19ygpTDZGWLRocMPdUgmvA4XYjRsZt3 gbrAQ3aw1KffAHmExkF1T4DhCWgthtMlxpTxiS3fMsBONEFcTSKGDhHhL88MUK/Y YNcl2F74epYqwaRwpOqBnCMwJcRuJ/S9lA4LkTP3aRqexUmLZrs0SBpgsBGM4e5U LAxSuQ== ----------------------------------------------------------------------------------------- !!! DANGER !!! DON'T try to change files by yourself, DON'T use any third party software for restoring your data or antivirus solutions - its may entail damage of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/75D30EC5588FDE81

http://decoder.re/75D30EC5588FDE81

Signatures

  • Modifies Windows Firewall 1 TTPs
    evasion
  • Modifies extensions of user files 16 IoCs

    Ransomware generally changes the extension on encrypted files.

    ransomware
  • Enumerates connected drives 3 TTPs 25 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Sets desktop wallpaper using registry 2 TTPs 1 IoCs
    ransomware
  • Drops file in Program Files directory 14 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious behavior: EnumeratesProcesses 10 IoCs
  • Suspicious use of AdjustPrivilegeToken 5 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\fee74e1a60a9bfe9f976fad24d9f63651e6cc479004e9036d2e83a7c561b243b.bin.sample.exe
    "C:\Users\Admin\AppData\Local\Temp\fee74e1a60a9bfe9f976fad24d9f63651e6cc479004e9036d2e83a7c561b243b.bin.sample.exe"
    1⤵
    • Modifies extensions of user files
    • Enumerates connected drives
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:580
    • C:\Windows\SysWOW64\netsh.exe
      netsh advfirewall firewall set rule group="Network Discovery" new enable=Yes
      2⤵
        PID:3976
    • C:\Windows\system32\wbem\unsecapp.exe
      C:\Windows\system32\wbem\unsecapp.exe -Embedding
      1⤵
        PID:4044
      • C:\Windows\system32\vssvc.exe
        C:\Windows\system32\vssvc.exe
        1⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:3392

      Network

      MITRE ATT&CK Enterprise v6

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • memory/3976-114-0x0000000000000000-mapping.dmp
        Download