Overview

overview

10

Static

static

3

SS.exe

windows7_x64

10

SS.exe

windows10_x64

10

Analysis

  • max time kernel
    209s
  • max time network
    123s
  • platform
    windows7_x64
  • resource
    win7-en-20210920
  • submitted
    30/10/2021, 03:59

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    SS.exe

  • Size

    30.3MB

  • MD5

    d6d78e94de610fad6749338f855edbcc

  • SHA1

    0fb9d7b713ae158bf35f480f62d20255b6d14a97

  • SHA256

    f0f90338553ab244d779b2f172c2e6c82f7fc5725cba6ddb8d09c48d5f481e07

  • SHA512

    33f36597a642af214f2e349015f5a0a625014536ae00016e9fdc110f2a37ea84cdfb7c6e9039a02830730314fc8358bc7076c7fdfec12c140f4394cfb0e4079f

Score
10/10
evasionransomwarespywarestealer

Malware Config

Extracted

Path

C:\Windows\Vss\ReadIt.txt

Ransom Note
Hello my friend Your system was vulnerable I'm here to teach you a lesson,The Security Lesson!!!! All your files are encrypted and the important one stolen You must pay an anount of Bitcoin in exchange for decrypting files and understanding the flaws in your system And prevent your files from becoming public Don't worry about the amount, it's spent on the security of your system and it's fair. To show our good intentions and trust, you can send us a small, worthless file to test the decryption. This is your ID : FFF456E1 And this is my email :[email protected] Send your ID to my email to speack about it If I don't respond for 8 hours, send messages to these emails : - [email protected] - [email protected] Don't forget if you try to decypt them yourself, never come back to us. So the first thing you have to do is email us because no one can decrypt them.

Signatures

  • Deletes shadow copies 2 TTPs

    Ransomware often targets backup files to inhibit system recovery.

    ransomware
  • Disables Task Manager via registry modification
    evasion
  • Drops startup file 2 IoCs
  • Loads dropped DLL 59 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 2 IoCs
  • Interacts with shadow copies 2 TTPs 1 IoCs

    Shadow copies are often targeted by ransomware to inhibit system recovery.

    ransomware
  • Modifies registry key 1 TTPs 1 IoCs
  • Opens file in notepad (likely ransom note) 1 IoCs
    ransomware
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 10 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of WriteProcessMemory 24 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\SS.exe
    "C:\Users\Admin\AppData\Local\Temp\SS.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1452
    • C:\Users\Admin\AppData\Local\Temp\SS.exe
      "C:\Users\Admin\AppData\Local\Temp\SS.exe"
      2⤵
      • Drops startup file
      • Loads dropped DLL
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • Drops file in Program Files directory
      • Drops file in Windows directory
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:1000
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c powershell.exe -C Set-MpPreference -DisableRealtimeMonitoring $true ;
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:1868
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell.exe -C Set-MpPreference -DisableRealtimeMonitoring $true ;
          4⤵
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:1080
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c powershell.exe -C vssadmin Delete Shadows /all /quiet ;
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:764
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell.exe -C vssadmin Delete Shadows /all /quiet ;
          4⤵
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:1496
          • C:\Windows\system32\vssadmin.exe
            "C:\Windows\system32\vssadmin.exe" Delete Shadows /all /quiet
            5⤵
            • Interacts with shadow copies
            PID:2032
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c REG add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:1156
        • C:\Windows\system32\reg.exe
          REG add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
          4⤵
          • Modifies registry key
          PID:972
  • C:\Windows\system32\vssvc.exe
    C:\Windows\system32\vssvc.exe
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:1600
  • C:\Windows\system32\AUDIODG.EXE
    C:\Windows\system32\AUDIODG.EXE 0x440
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:1056
  • C:\Windows\system32\NOTEPAD.EXE
    "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\ReadIt.txt
    1⤵
    • Opens file in notepad (likely ransom note)
    • Suspicious use of FindShellTrayWindow
    PID:1224

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1000-138-0x0000000006E30000-0x0000000006E31000-memory.dmp

    Filesize

    4KB

    Download

  • memory/1080-122-0x000007FEF1D50000-0x000007FEF28AD000-memory.dmp

    Filesize

    11.4MB

    Download

  • memory/1080-130-0x000000000239B000-0x00000000023BA000-memory.dmp

    Filesize

    124KB

    Download

  • memory/1080-125-0x0000000002394000-0x0000000002397000-memory.dmp

    Filesize

    12KB

    Download

  • memory/1080-123-0x0000000002390000-0x0000000002392000-memory.dmp

    Filesize

    8KB

    Download

  • memory/1080-121-0x000007FEFBF91000-0x000007FEFBF93000-memory.dmp

    Filesize

    8KB

    Download

  • memory/1080-124-0x0000000002392000-0x0000000002394000-memory.dmp

    Filesize

    8KB

    Download

  • memory/1496-129-0x000007FEF1D40000-0x000007FEF289D000-memory.dmp

    Filesize

    11.4MB

    Download

  • memory/1496-131-0x0000000002970000-0x0000000002972000-memory.dmp

    Filesize

    8KB

    Download

  • memory/1496-132-0x0000000002972000-0x0000000002974000-memory.dmp

    Filesize

    8KB

    Download

  • memory/1496-133-0x000000000297B000-0x000000000299A000-memory.dmp

    Filesize

    124KB

    Download

  • memory/1496-134-0x0000000002974000-0x0000000002977000-memory.dmp

    Filesize

    12KB

    Download