Resubmissions

09-10-2021 11:33

211009-nn4ypsfcbm 10

09-10-2021 06:21

211009-g4aw8sfae6 10

Analysis

  • max time kernel
    170s
  • max time network
    296s
  • platform
    windows10_x64
  • resource
    win10-en-20210920
  • submitted
    09-10-2021 06:21

General

  • Target

    SayLessRnm Window.exe

  • Size

    557KB

  • MD5

    52c527df9e7554e940c3c45b4e9b3e30

  • SHA1

    ae182f41baae6a5f3c05803933ba77578772233c

  • SHA256

    a6339f9ef7c91bc792626ff3765a46809dcada083c93a7e63fd01b0e91c1bb90

  • SHA512

    eabb6293309e5ac13a9530efe8f3f75d6fa1102a6fed2a1825022fff584836796fc6eab97b42fe88cb618c987907b2c3224cfa79bec8b8f332f72a0f9412752c

Score
10/10

Malware Config

Extracted

Path

C:\Users\Admin\Desktop\SAYLESS-RANSOMWARE.saylessrsnm.txt

Ransom Note
Your computer has been infected by SayLess-Ransomware. All your data and files have been encrypted with a MILITARY-GRADE LEVEL ENCRYPTION. To unlock them, send 500$ to the BTC adress below to get decryption key and restore your data... Or else your files are lost! DO NOT TURN OFF YOUR PC, IF YOU SO ALL YOUR FILES WILL BE CORRUPTED FOREVER. Encryption Log: ==================================== C:\Users\Admin\Desktop\AddRemove.mid C:\Users\Admin\Desktop\CompressJoin.ocx C:\Users\Admin\Desktop\CopyPing.3gpp C:\Users\Admin\Desktop\DebugPush.xla C:\Users\Admin\Desktop\DenyUnlock.ppsm C:\Users\Admin\Desktop\desktop.ini C:\Users\Admin\Desktop\DisableOut.au3 C:\Users\Admin\Desktop\EditCopy.kix C:\Users\Admin\Desktop\EnableTrace.ini C:\Users\Admin\Desktop\EnterEnable.crw C:\Users\Admin\Desktop\JoinDisable.mpv2 C:\Users\Admin\Desktop\JoinFormat.iso C:\Users\Admin\Desktop\MeasureUse.html C:\Users\Admin\Desktop\MountSubmit.ttf C:\Users\Admin\Desktop\MoveResume.doc C:\Users\Admin\Desktop\ProtectRead.ppt C:\Users\Admin\Desktop\RedoConvertTo.wma C:\Users\Admin\Desktop\RepairShow.au3 C:\Users\Admin\Desktop\RestartClose.vstm C:\Users\Admin\Desktop\ResumeRegister.scf C:\Users\Admin\Desktop\StartClose.wdp C:\Users\Admin\Desktop\StopGrant.i64 C:\Users\Admin\Desktop\SwitchStart.AAC C:\Users\Admin\Desktop\SyncMerge.xlsx C:\Users\Admin\Desktop\UnprotectClose.mht C:\Users\Admin\Desktop\UnregisterResolve.ADT C:\Users\Admin\Desktop\WatchFormat.dxf C:\Users\Admin\Pictures\CompressAssert.tiff C:\Users\Admin\Pictures\ConvertToCompare.gif C:\Users\Admin\Pictures\DenySwitch.svgz C:\Users\Admin\Pictures\desktop.ini C:\Users\Admin\Pictures\EditPush.emz C:\Users\Admin\Pictures\ExportCompare.jpg C:\Users\Admin\Pictures\FindDisconnect.eps C:\Users\Admin\Pictures\ImportFind.pcx C:\Users\Admin\Pictures\InvokeSelect.ico C:\Users\Admin\Pictures\InvokeUnregister.tif C:\Users\Admin\Pictures\LockRead.crw C:\Users\Admin\Pictures\LockResume.jpeg C:\Users\Admin\Pictures\OutConvert.crw C:\Users\Admin\Pictures\PingDebug.crw C:\Users\Admin\Pictures\RenameCopy.pcx C:\Users\Admin\Pictures\ResolveAssert.tif C:\Users\Admin\Pictures\ResolveEnable.png C:\Users\Admin\Pictures\SyncReceive.dib C:\Users\Admin\Pictures\UninstallRename.jpg C:\Users\Admin\Pictures\UnlockMerge.tiff C:\Users\Admin\Pictures\Wallpaper.jpg C:\Users\Admin\Pictures\Camera Roll\desktop.ini C:\Users\Admin\Pictures\Saved Pictures\desktop.ini C:\Users\Admin\Documents\AddProtect.vssm C:\Users\Admin\Documents\Are.docx C:\Users\Admin\Documents\AssertExport.vsw C:\Users\Admin\Documents\BackupConvertTo.mpp C:\Users\Admin\Documents\BlockApprove.vsd C:\Users\Admin\Documents\CompleteFind.vstx C:\Users\Admin\Documents\ConnectWrite.dot C:\Users\Admin\Documents\desktop.ini C:\Users\Admin\Documents\Files.docx C:\Users\Admin\Documents\FormatRedo.pub C:\Users\Admin\Documents\HideRestore.vssx C:\Users\Admin\Documents\InitializeRevoke.potm C:\Users\Admin\Documents\JoinUninstall.odt C:\Users\Admin\Documents\OpenBlock.potx C:\Users\Admin\Documents\Opened.docx C:\Users\Admin\Documents\OutMove.dotx C:\Users\Admin\Documents\OutResize.ods C:\Users\Admin\Documents\PingSplit.potm C:\Users\Admin\Documents\PublishResolve.dotx C:\Users\Admin\Documents\Recently.docx C:\Users\Admin\Documents\RedoResize.mht C:\Users\Admin\Documents\RegisterTest.vsw C:\Users\Admin\Documents\RegisterWrite.pps C:\Users\Admin\Documents\ResizeCheckpoint.pptm C:\Users\Admin\Documents\ResizeExit.htm C:\Users\Admin\Documents\ResumeMeasure.csv C:\Users\Admin\Documents\ResumeSync.vstx C:\Users\Admin\Documents\RevokeStart.pptx C:\Users\Admin\Documents\SaveUninstall.odp C:\Users\Admin\Documents\SaveUnregister.pptx C:\Users\Admin\Documents\StepEnable.html C:\Users\Admin\Documents\SubmitResume.dot C:\Users\Admin\Documents\SubmitSearch.pub C:\Users\Admin\Documents\SubmitUnprotect.xlsm C:\Users\Admin\Documents\SuspendReset.xlt C:\Users\Admin\Documents\These.docx C:\Users\Admin\Documents\WriteDisable.txt

Signatures

  • Modifies extensions of user files 10 IoCs

    Ransomware generally changes the extension on encrypted files.

  • Drops desktop.ini file(s) 5 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\SayLessRnm Window.exe
    "C:\Users\Admin\AppData\Local\Temp\SayLessRnm Window.exe"
    1⤵
    • Modifies extensions of user files
    • Drops desktop.ini file(s)
    PID:1684

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1684-115-0x0000000000900000-0x0000000000901000-memory.dmp
    Filesize

    4KB

  • memory/1684-117-0x0000000005840000-0x0000000005841000-memory.dmp
    Filesize

    4KB

  • memory/1684-118-0x00000000051C0000-0x00000000051C1000-memory.dmp
    Filesize

    4KB

  • memory/1684-119-0x0000000002E60000-0x0000000002E61000-memory.dmp
    Filesize

    4KB

  • memory/1684-120-0x0000000005340000-0x000000000583E000-memory.dmp
    Filesize

    5.0MB

  • memory/1684-121-0x0000000005340000-0x000000000583E000-memory.dmp
    Filesize

    5.0MB