Overview

overview

10

Static

static

7c1f5cf8f2...42.exe

windows7_x64

10

7c1f5cf8f2...42.exe

windows10_x64

10

Analysis

  • max time kernel
    65s
  • max time network
    3s
  • platform
    windows7_x64
  • resource
    win7-en-20211104
  • submitted
    21/11/2021, 13:12

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    7c1f5cf8f242dfbd920180d8423777a4e540c37c09d787d4674b259bdbe0dc42.exe

  • Size

    13KB

  • MD5

    d109e80eff2ed00ee76147306057b78e

  • SHA1

    ebdcaa6e32ae696725158482e0a7480d4c8433e5

  • SHA256

    7c1f5cf8f242dfbd920180d8423777a4e540c37c09d787d4674b259bdbe0dc42

  • SHA512

    23ef87e942a02f9347b07044a3fa291558b425c57c6bc66f14a367fcd89f61617785da560e175d8a225398189a37745295e199d93d3ead75118ebee792e3dada

Score
10/10
ransomwarespywarestealer

Malware Config

Extracted

Path

C:\$Recycle.Bin\#File.decrypt#.txt

Ransom Note
Hello my dear friend Unfortunately for you, a major IT security weakness left you open to attack, your files have been encrypted If you want to restore them, write your ID to us e-mail1: [email protected] e-mail2: [email protected] Attention! Do not rename encrypted files. Do not try to decrypt your data using third party software, it may cause permanent data loss. We are always ready to cooperate and find the best way to solve your problem. The faster you write, the more favorable the conditions will be for you. Our company values its reputation. We give all guarantees of your files decryption IF WE DONT SEE MESSAGES FROM YOU IN 72 HOURS - WE WILL SELL YOUR DATABASES AND IMPORTANT INFORMATION TO YOUR COMPETITORS,AFTER YOU WILL SEE IT AT OPEN SOURCE AND DARKNET tell your unique ID c/HyE6gKyDweL/jeGA17g6KoSpvGOqEw8NQOw8L4x669UBcugjFAq/ZW7scT7yjOpGibRiBnaHYiAGDkew6/IU63i8OREkO5w4v5zEiGMJg3HnaMzH7NE8QDLR0tAYNRFOpOM8DdTOTcFZDgKC2pok8/SZpZ1LFvCIzEpoEvKgeXqV4Oth7LP0UYznVnB7KLTSLRv8OH0agO4zBycN78/40E4li/eBq043rJ6eFfQZMSpG68gJWsIBi8DoFKB6oPPQC7+FrSDSAVABJMqqncdg+GRDMkLnez/ss0Obks21hBN+Re8wTs2hmK+QejC1Lx+YPa7vZXOR3MRZ5Wj/mUJGJtHaFIdzzqMICiH4aTNO4nLAiSRPBHaCljxvINWIiRJ17F1XxGYgzAOWkpqmtBswA8Dit0SUo95ygarm5II5ReGx2LbP4NGwxuEpu7FsIQE3drAIBrZgYOYxr39UFOIVIVc5+P1pKIxD6qMNegwH6CrpiSl6toGzXkEYhOVYZGa6+ys37SdgN5KRaMgTamfKCg2QIuwFE8kMWz4SWwZ3pQZQFXBTorCWvrrvPtYkzD9zIMp2CCrw6wya2/9DBh8o8E7mmVP/91ZjSNvnz/8FnO8cW4omEytbDCPCWttxI3uc2j7+7MKDBoGXVngQpgjWIgsK79FQhAMAR7mjgrI4SKQwC67VJfcaTG5IWxLfUDdlqdSePTUj4fSrwtVtme3pyjZYlsWM7syKdx/ne1rTR8sYzjZ2LNosJDgvCR4Locp4IkPHeo5Y97siwbsDHVgyzAZkvUnedb8qc1ImXHcqcYwidRa2uf5s6MBcxOLXr2hxO76bJ0Xbz+KhRB1cI4IN/k0clpXjpm+rXs7/pXwpJlgOxmz6BwQi+PjvZvoQiOEn2uXYJJDtPx6ChCp/dqAcjL0B3naLcVa5F+Bw6kfy6VI6FpJB5bJ86blybp+qeGr9UoVjyWEB/eLuVmPkWDl7fhfBYoFjEIaOoECiJaEYWrH4YJ4nOLnV6ZySgYCAVJNqiBcPvZ6dYd0V1O8SHbp/GqP4TiaaQaD2dBJKOZmub4keIRnw38mJa3Mgj8KB0aZBcUI2uQ11+/DzSvTWVP7x8Cf3PEzxJGtbbzc7qJJpNsGO7k7ySCWwwoeNsRGeBS9sbYWmy8Xyhd8kN4ofLSKcyb2NEj/2dEQAw7zrtwMUKKhzVz3fJiTlTjfw/yWkO/1oF/h/H2ntWqYrz3TmFkTjMuwKX+RkmzXQTEVKu93wwKtCiOSDw7fNo2/wHLgPpxBdHwD+ppppUItxj/pSydxKDq9GPo1A/Zt7YPzRKCdYb+lGQTNDoJ9pi/3vlLpf8W2EKHBJT8UeoEsE4hZgbGjA==

Signatures

  • Deletes shadow copies 2 TTPs

    Ransomware often targets backup files to inhibit system recovery.

    ransomware
  • Modifies extensions of user files 10 IoCs

    Ransomware generally changes the extension on encrypted files.

    ransomware
  • Deletes itself 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Drops desktop.ini file(s) 48 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Delays execution with timeout.exe 1 IoCs
    evasion
  • Interacts with shadow copies 2 TTPs 1 IoCs

    Shadow copies are often targeted by ransomware to inhibit system recovery.

    ransomware
  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 7 IoCs
  • Suspicious use of WriteProcessMemory 24 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\7c1f5cf8f242dfbd920180d8423777a4e540c37c09d787d4674b259bdbe0dc42.exe
    "C:\Users\Admin\AppData\Local\Temp\7c1f5cf8f242dfbd920180d8423777a4e540c37c09d787d4674b259bdbe0dc42.exe"
    1⤵
    • Modifies extensions of user files
    • Drops desktop.ini file(s)
    • Drops file in Program Files directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:1364
    • C:\Windows\system32\vssadmin.exe
      delete shadows /all /quiet
      2⤵
      • Interacts with shadow copies
      PID:528
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" bcdedit /set {current} bootstatuspolicy ignoreallfailures
      2⤵
        PID:392
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\system32\cmd.exe" bcdedit /set {current} recoveryenabled no
        2⤵
          PID:764
        • C:\Windows\SysWOW64\cmd.exe
          "C:\Windows\system32\cmd.exe" netsh advfirewall set allprofiles state off
          2⤵
            PID:1816
          • C:\Windows\SysWOW64\cmd.exe
            "C:\Windows\system32\cmd.exe" /c timeout 1 && del "C:\Users\Admin\AppData\Local\Temp\7c1f5cf8f242dfbd920180d8423777a4e540c37c09d787d4674b259bdbe0dc42.exe" >> NUL
            2⤵
            • Deletes itself
            • Suspicious use of WriteProcessMemory
            PID:584
            • C:\Windows\SysWOW64\timeout.exe
              timeout 1
              3⤵
              • Delays execution with timeout.exe
              PID:1772
        • C:\Windows\system32\vssvc.exe
          C:\Windows\system32\vssvc.exe
          1⤵
          • Suspicious use of AdjustPrivilegeToken
          PID:576
        • C:\Windows\system32\NOTEPAD.EXE
          "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Public\Desktop\#File.decrypt#.txt
          1⤵
            PID:900
          • C:\Windows\system32\AUDIODG.EXE
            C:\Windows\system32\AUDIODG.EXE 0x2fc
            1⤵
            • Suspicious use of AdjustPrivilegeToken
            PID:836

          Network

          MITRE ATT&CK Enterprise v6

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • memory/900-60-0x000007FEFB9A1000-0x000007FEFB9A3000-memory.dmp

            Filesize

            8KB

            Download

          • memory/1364-55-0x0000000075AB1000-0x0000000075AB3000-memory.dmp

            Filesize

            8KB

            Download