Analysis
-
max time kernel
25s -
max time network
45s -
platform
windows7_x64 -
resource
win7-en-20210920 -
submitted
15-10-2021 19:54
Behavioral task
behavioral1
Sample
ea310cc4fd4e8669e014ff417286da5edf2d3bef20abfb0a4f4951afe260d33d.bin.exe
Resource
win7-en-20210920
Behavioral task
behavioral2
Sample
ea310cc4fd4e8669e014ff417286da5edf2d3bef20abfb0a4f4951afe260d33d.bin.exe
Resource
win10-en-20211014
General
-
Target
ea310cc4fd4e8669e014ff417286da5edf2d3bef20abfb0a4f4951afe260d33d.bin.exe
-
Size
1.8MB
-
MD5
7d4550dd4c6996057147ecc996b14e9a
-
SHA1
d0d68281f8459b5558559fbbf8c6c8ab4ddfec8b
-
SHA256
ea310cc4fd4e8669e014ff417286da5edf2d3bef20abfb0a4f4951afe260d33d
-
SHA512
e0653ac9c92bd134ff43886b4a8a36016660294c134ff11c6cddefe50494923fdcf370c3d96d5538d2c7ef20d216b4d15b914d40002c982c69021ee8998f57df
Malware Config
Extracted
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\HOW-TO-DECRYPT-gn9cj.txt
Extracted
C:\MSOCache\All Users\{90140000-0116-0409-1000-0000000FF1CE}-C\HOW-TO-DECRYPT-gn9cj.txt
Signatures
-
Processes:
resource yara_rule \Users\Admin\AppData\Roaming\ExplorerInterface\Msde cryptone \Users\Admin\AppData\Roaming\ExplorerInterface\Msde cryptone C:\Users\Admin\AppData\Roaming\ExplorerInterface\Msde cryptone C:\Users\Admin\AppData\Roaming\ExplorerInterface\Msde cryptone -
Executes dropped EXE 1 IoCs
Processes:
Msdepid process 1720 Msde -
Modifies extensions of user files 24 IoCs
Ransomware generally changes the extension on encrypted files.
Processes:
Msdedescription ioc process File renamed C:\Users\Admin\Pictures\DisconnectPop.tif => C:\Users\Admin\Pictures\DisconnectPop.tif.gn9cj Msde File renamed C:\Users\Admin\Pictures\DismountSubmit.tiff => C:\Users\Admin\Pictures\DismountSubmit.tiff.gn9cj Msde File opened for modification C:\Users\Admin\Pictures\EnableSuspend.png.gn9cj Msde File opened for modification C:\Users\Admin\Pictures\ExpandRegister.png.gn9cj Msde File opened for modification C:\Users\Admin\Pictures\InitializeRepair.tiff.gn9cj Msde File opened for modification C:\Users\Admin\Pictures\MeasureSelect.raw.gn9cj Msde File opened for modification C:\Users\Admin\Pictures\AssertInstall.tif.gn9cj Msde File renamed C:\Users\Admin\Pictures\CompressRestart.tif => C:\Users\Admin\Pictures\CompressRestart.tif.gn9cj Msde File opened for modification C:\Users\Admin\Pictures\DenyUnregister.raw.gn9cj Msde File opened for modification C:\Users\Admin\Pictures\DisconnectPop.tif.gn9cj Msde File renamed C:\Users\Admin\Pictures\EnableSuspend.png => C:\Users\Admin\Pictures\EnableSuspend.png.gn9cj Msde File renamed C:\Users\Admin\Pictures\ExpandRegister.png => C:\Users\Admin\Pictures\ExpandRegister.png.gn9cj Msde File renamed C:\Users\Admin\Pictures\UnregisterMount.crw => C:\Users\Admin\Pictures\UnregisterMount.crw.gn9cj Msde File opened for modification C:\Users\Admin\Pictures\CompressRestart.tif.gn9cj Msde File renamed C:\Users\Admin\Pictures\DenyUnregister.raw => C:\Users\Admin\Pictures\DenyUnregister.raw.gn9cj Msde File renamed C:\Users\Admin\Pictures\InitializeRepair.tiff => C:\Users\Admin\Pictures\InitializeRepair.tiff.gn9cj Msde File opened for modification C:\Users\Admin\Pictures\MountRegister.tif.gn9cj Msde File renamed C:\Users\Admin\Pictures\MeasureSelect.raw => C:\Users\Admin\Pictures\MeasureSelect.raw.gn9cj Msde File renamed C:\Users\Admin\Pictures\MountRegister.tif => C:\Users\Admin\Pictures\MountRegister.tif.gn9cj Msde File renamed C:\Users\Admin\Pictures\ReadMount.tif => C:\Users\Admin\Pictures\ReadMount.tif.gn9cj Msde File opened for modification C:\Users\Admin\Pictures\ReadMount.tif.gn9cj Msde File opened for modification C:\Users\Admin\Pictures\UnregisterMount.crw.gn9cj Msde File renamed C:\Users\Admin\Pictures\AssertInstall.tif => C:\Users\Admin\Pictures\AssertInstall.tif.gn9cj Msde File opened for modification C:\Users\Admin\Pictures\DismountSubmit.tiff.gn9cj Msde -
Deletes itself 1 IoCs
Processes:
cmd.exepid process 1528 cmd.exe -
Loads dropped DLL 2 IoCs
Processes:
ea310cc4fd4e8669e014ff417286da5edf2d3bef20abfb0a4f4951afe260d33d.bin.exepid process 1200 ea310cc4fd4e8669e014ff417286da5edf2d3bef20abfb0a4f4951afe260d33d.bin.exe 1200 ea310cc4fd4e8669e014ff417286da5edf2d3bef20abfb0a4f4951afe260d33d.bin.exe -
Suspicious use of WriteProcessMemory 21 IoCs
Processes:
ea310cc4fd4e8669e014ff417286da5edf2d3bef20abfb0a4f4951afe260d33d.bin.exeMsdecmd.execmd.exedescription pid process target process PID 1200 wrote to memory of 1720 1200 ea310cc4fd4e8669e014ff417286da5edf2d3bef20abfb0a4f4951afe260d33d.bin.exe Msde PID 1200 wrote to memory of 1720 1200 ea310cc4fd4e8669e014ff417286da5edf2d3bef20abfb0a4f4951afe260d33d.bin.exe Msde PID 1200 wrote to memory of 1720 1200 ea310cc4fd4e8669e014ff417286da5edf2d3bef20abfb0a4f4951afe260d33d.bin.exe Msde PID 1720 wrote to memory of 816 1720 Msde cmd.exe PID 1720 wrote to memory of 816 1720 Msde cmd.exe PID 1720 wrote to memory of 816 1720 Msde cmd.exe PID 1200 wrote to memory of 1528 1200 ea310cc4fd4e8669e014ff417286da5edf2d3bef20abfb0a4f4951afe260d33d.bin.exe cmd.exe PID 1200 wrote to memory of 1528 1200 ea310cc4fd4e8669e014ff417286da5edf2d3bef20abfb0a4f4951afe260d33d.bin.exe cmd.exe PID 1200 wrote to memory of 1528 1200 ea310cc4fd4e8669e014ff417286da5edf2d3bef20abfb0a4f4951afe260d33d.bin.exe cmd.exe PID 816 wrote to memory of 432 816 cmd.exe waitfor.exe PID 816 wrote to memory of 432 816 cmd.exe waitfor.exe PID 816 wrote to memory of 432 816 cmd.exe waitfor.exe PID 1528 wrote to memory of 1644 1528 cmd.exe waitfor.exe PID 1528 wrote to memory of 1644 1528 cmd.exe waitfor.exe PID 1528 wrote to memory of 1644 1528 cmd.exe waitfor.exe PID 816 wrote to memory of 1188 816 cmd.exe attrib.exe PID 816 wrote to memory of 1188 816 cmd.exe attrib.exe PID 816 wrote to memory of 1188 816 cmd.exe attrib.exe PID 1528 wrote to memory of 2040 1528 cmd.exe attrib.exe PID 1528 wrote to memory of 2040 1528 cmd.exe attrib.exe PID 1528 wrote to memory of 2040 1528 cmd.exe attrib.exe -
Views/modifies file attributes 1 TTPs 2 IoCs
Processes:
attrib.exeattrib.exepid process 2040 attrib.exe 1188 attrib.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\ea310cc4fd4e8669e014ff417286da5edf2d3bef20abfb0a4f4951afe260d33d.bin.exe"C:\Users\Admin\AppData\Local\Temp\ea310cc4fd4e8669e014ff417286da5edf2d3bef20abfb0a4f4951afe260d33d.bin.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\ExplorerInterface\MsdeC:\Users\Admin\AppData\Roaming\ExplorerInterface\Msde /go2⤵
- Executes dropped EXE
- Modifies extensions of user files
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.execmd /c waitfor /t 10 pause /d y & attrib -h "C:\Users\Admin\AppData\Roaming\ExplorerInterface\Msde" & del "C:\Users\Admin\AppData\Roaming\ExplorerInterface\Msde" & rd "C:\Users\Admin\AppData\Roaming\ExplorerInterface\"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\waitfor.exewaitfor /t 10 pause /d y4⤵
-
C:\Windows\system32\attrib.exeattrib -h "C:\Users\Admin\AppData\Roaming\ExplorerInterface\Msde"4⤵
- Views/modifies file attributes
-
C:\Windows\system32\cmd.execmd /c waitfor /t 10 pause /d y & attrib -h "C:\Users\Admin\AppData\Local\Temp\ea310cc4fd4e8669e014ff417286da5edf2d3bef20abfb0a4f4951afe260d33d.bin.exe" & del "C:\Users\Admin\AppData\Local\Temp\ea310cc4fd4e8669e014ff417286da5edf2d3bef20abfb0a4f4951afe260d33d.bin.exe" & rd "C:\Users\Admin\AppData\Local\Temp\"2⤵
- Deletes itself
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\waitfor.exewaitfor /t 10 pause /d y3⤵
-
C:\Windows\system32\attrib.exeattrib -h "C:\Users\Admin\AppData\Local\Temp\ea310cc4fd4e8669e014ff417286da5edf2d3bef20abfb0a4f4951afe260d33d.bin.exe"3⤵
- Views/modifies file attributes
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\ExplorerInterface\MsdeMD5
7d4550dd4c6996057147ecc996b14e9a
SHA1d0d68281f8459b5558559fbbf8c6c8ab4ddfec8b
SHA256ea310cc4fd4e8669e014ff417286da5edf2d3bef20abfb0a4f4951afe260d33d
SHA512e0653ac9c92bd134ff43886b4a8a36016660294c134ff11c6cddefe50494923fdcf370c3d96d5538d2c7ef20d216b4d15b914d40002c982c69021ee8998f57df
-
C:\Users\Admin\AppData\Roaming\ExplorerInterface\MsdeMD5
7d4550dd4c6996057147ecc996b14e9a
SHA1d0d68281f8459b5558559fbbf8c6c8ab4ddfec8b
SHA256ea310cc4fd4e8669e014ff417286da5edf2d3bef20abfb0a4f4951afe260d33d
SHA512e0653ac9c92bd134ff43886b4a8a36016660294c134ff11c6cddefe50494923fdcf370c3d96d5538d2c7ef20d216b4d15b914d40002c982c69021ee8998f57df
-
\Users\Admin\AppData\Roaming\ExplorerInterface\MsdeMD5
7d4550dd4c6996057147ecc996b14e9a
SHA1d0d68281f8459b5558559fbbf8c6c8ab4ddfec8b
SHA256ea310cc4fd4e8669e014ff417286da5edf2d3bef20abfb0a4f4951afe260d33d
SHA512e0653ac9c92bd134ff43886b4a8a36016660294c134ff11c6cddefe50494923fdcf370c3d96d5538d2c7ef20d216b4d15b914d40002c982c69021ee8998f57df
-
\Users\Admin\AppData\Roaming\ExplorerInterface\MsdeMD5
7d4550dd4c6996057147ecc996b14e9a
SHA1d0d68281f8459b5558559fbbf8c6c8ab4ddfec8b
SHA256ea310cc4fd4e8669e014ff417286da5edf2d3bef20abfb0a4f4951afe260d33d
SHA512e0653ac9c92bd134ff43886b4a8a36016660294c134ff11c6cddefe50494923fdcf370c3d96d5538d2c7ef20d216b4d15b914d40002c982c69021ee8998f57df
-
memory/432-67-0x0000000000000000-mapping.dmp
-
memory/816-65-0x0000000000000000-mapping.dmp
-
memory/1188-69-0x0000000000000000-mapping.dmp
-
memory/1200-54-0x0000000140000000-0x00000001401D8000-memory.dmpFilesize
1.8MB
-
memory/1200-57-0x0000000001B70000-0x0000000001D32000-memory.dmpFilesize
1.8MB
-
memory/1528-66-0x0000000000000000-mapping.dmp
-
memory/1644-68-0x0000000000000000-mapping.dmp
-
memory/1720-60-0x0000000000000000-mapping.dmp
-
memory/1720-62-0x0000000140000000-0x00000001401D8000-memory.dmpFilesize
1.8MB
-
memory/2040-70-0x0000000000000000-mapping.dmp