Overview

overview

10

Static

static

10

file000_spoolcv.exe

windows7_x64

10

file000_spoolcv.exe

windows10_x64

10

Analysis

  • max time kernel
    600s
  • max time network
    600s
  • platform
    windows7_x64
  • resource
    win7-en-20211104
  • submitted
    15-11-2021 14:57

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    file000_spoolcv.exe

  • Size

    400KB

  • MD5

    e6688d5a1565053e114263a98daca7de

  • SHA1

    eb9c95ee5c0835406e27478099020ac1eee2c479

  • SHA256

    f4dbc868579e467f9e05766f67497ae6d8f4b3be91165d40df4a18ec912e5e89

  • SHA512

    c152cf41b58017466823e3d329265fb0dcf82fde8751587799d678ae46ab3745190d1e3686ecb97106abbd0990786eea90afe70b6ee10951b209f1e00583b9db

Score
10/10
hakbitransomware

Malware Config

Extracted

Path

C:\Users\Admin\Desktop\HELP_ME_RECOVER_MY_FILES.txt

Family

hakbit

Ransom Note
Atention! all your important files were encrypted! to get your files back send 300 USD worth in Bitcoins and contact us with proof of payment and your Unique Identifier Key. We will send you a decryption tool with your personal decryption password. Where can you buy Bitcoins: https://www.coinbase.com https://localbitcoins.com Contact: [email protected]. Bitcoin wallet to make the transfer to is: 12grtxACJZkgT2nGAvMesgoM4ADHJ6NTaW Unique Identifier Key (must be sent to us together with proof of payment): EAAAADszq34tWBb5b8Zy07RLXzeTqUaKAScgC0IqupZihirEc8LRbGcK+nlUKcxV391MzaYXaYeevF0WuZxv8Urf4jY= Number of files that you could have potentially lost forever can be as high as: 1980
Wallets

12grtxACJZkgT2nGAvMesgoM4ADHJ6NTaW

Signatures

  • Contains code to disable Windows Defender 2 IoCs

    A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

  • Hakbit

    Ransomware which encrypts files using AES, first seen in November 2019.

    ransomwarehakbit
  • Deletes shadow copies 2 TTPs

    Ransomware often targets backup files to inhibit system recovery.

    ransomware
  • Executes dropped EXE 1 IoCs
  • Modifies extensions of user files 3 IoCs

    Ransomware generally changes the extension on encrypted files.

    ransomware
  • Deletes itself 1 IoCs
  • Drops startup file 2 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Interacts with shadow copies 2 TTPs 1 IoCs

    Shadow copies are often targeted by ransomware to inhibit system recovery.

    ransomware
  • Modifies system certificate store 2 TTPs 2 IoCs
    evasionspywaretrojan
  • Opens file in notepad (likely ransom note) 1 IoCs
    ransomware
  • Suspicious use of AdjustPrivilegeToken 5 IoCs
  • Suspicious use of WriteProcessMemory 21 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\file000_spoolcv.exe
    "C:\Users\Admin\AppData\Local\Temp\file000_spoolcv.exe"
    1⤵
    • Drops startup file
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1588
    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\mysqld.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\mysqld.exe"
      2⤵
      • Executes dropped EXE
      • Modifies extensions of user files
      • Drops file in Program Files directory
      • Modifies system certificate store
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:932
      • C:\Windows\system32\vssadmin.exe
        "vssadmin" delete shadows /all /quiet
        3⤵
        • Interacts with shadow copies
        PID:540
      • C:\Windows\System32\notepad.exe
        "C:\Windows\System32\notepad.exe" C:\Users\Admin\Desktop\HELP_ME_RECOVER_MY_FILES.txt
        3⤵
        • Opens file in notepad (likely ransom note)
        PID:1036
      • C:\Windows\System32\cmd.exe
        "C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\mysqld.exe
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:1708
        • C:\Windows\system32\choice.exe
          choice /C Y /N /D Y /T 3
          4⤵
            PID:432
      • C:\Windows\System32\cmd.exe
        "C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\file000_spoolcv.exe
        2⤵
        • Deletes itself
        • Suspicious use of WriteProcessMemory
        PID:1340
        • C:\Windows\system32\choice.exe
          choice /C Y /N /D Y /T 3
          3⤵
            PID:1064
      • C:\Windows\system32\vssvc.exe
        C:\Windows\system32\vssvc.exe
        1⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:1548

      Network

      MITRE ATT&CK Enterprise v6

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • memory/932-66-0x000000001AF50000-0x000000001AF52000-memory.dmp

        Filesize

        8KB

        Download

      • memory/932-61-0x0000000000E10000-0x0000000000E11000-memory.dmp

        Filesize

        4KB

        Download

      • memory/1588-55-0x00000000003B0000-0x00000000003B1000-memory.dmp

        Filesize

        4KB

        Download

      • memory/1588-57-0x000007FEFBE91000-0x000007FEFBE93000-memory.dmp

        Filesize

        8KB

        Download