Overview

overview

10

Static

static

7c1f5cf8f2...42.exe

windows7_x64

10

7c1f5cf8f2...42.exe

windows10_x64

10

Analysis

  • max time kernel
    73s
  • max time network
    66s
  • platform
    windows10_x64
  • resource
    win10-en-20211104
  • submitted
    21/11/2021, 13:12

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    7c1f5cf8f242dfbd920180d8423777a4e540c37c09d787d4674b259bdbe0dc42.exe

  • Size

    13KB

  • MD5

    d109e80eff2ed00ee76147306057b78e

  • SHA1

    ebdcaa6e32ae696725158482e0a7480d4c8433e5

  • SHA256

    7c1f5cf8f242dfbd920180d8423777a4e540c37c09d787d4674b259bdbe0dc42

  • SHA512

    23ef87e942a02f9347b07044a3fa291558b425c57c6bc66f14a367fcd89f61617785da560e175d8a225398189a37745295e199d93d3ead75118ebee792e3dada

Score
10/10
ransomwarespywarestealer

Malware Config

Extracted

Path

C:\Program Files\Microsoft Office\Updates\Apply\#File.decrypt#.txt

Ransom Note
Hello my dear friend Unfortunately for you, a major IT security weakness left you open to attack, your files have been encrypted If you want to restore them, write your ID to us e-mail1: [email protected] e-mail2: [email protected] Attention! Do not rename encrypted files. Do not try to decrypt your data using third party software, it may cause permanent data loss. We are always ready to cooperate and find the best way to solve your problem. The faster you write, the more favorable the conditions will be for you. Our company values its reputation. We give all guarantees of your files decryption IF WE DONT SEE MESSAGES FROM YOU IN 72 HOURS - WE WILL SELL YOUR DATABASES AND IMPORTANT INFORMATION TO YOUR COMPETITORS,AFTER YOU WILL SEE IT AT OPEN SOURCE AND DARKNET tell your unique ID nUzaY3n0IKHhTNhf/bOnb+NqPmiNW9h7m/71UzGse+NtuUmULUz5N1LoalUOVyDt2MJh/Ydk4brrHX7N/DlS1ydy3PIvZwrXn3G48wfTFN1GRU/0aHrP55eNbFeCyiw3vZv/eQzYJaVHDH9ivzavko7pwcLv02lXIfL9PVNZNxmAupLFSB+n3mngMHMcH6Wjg/LIRxgUqMNc3rHPhQ7vZhLusuIQRbe7mxXUK/nadntuarbCvw7w6rODlUR6sOmJseTJOiejDvdvHd2det3/A17nvG1vLVQR3rS98slMCEvL+lLdskagcp03Xqt03KZ05kE6bHfJFY2FELFLdos0az8kxUmY7cOmmdNu0dA9Lvr3t8Go6mLlVDbQaLrZhg//Fz6+so0JUmQRVdQHoca7BdrT1OXkRtx7yc/2cr8cYG98Xar7k8Jl8WC0kgvRXypMSxMuEo2mnmOgFttAdphVZQq7bFg46ueqjg2QhKApNkKr1pHhrSGVdWCemqClM4/fJzg3cd3mf5aScovzx7A4tirFqxbHq6fAxCoSPouUQPkqZYg+pNclgn1J5qxDDlSfI2V5TmFNA3O06PR5chxwRWthLDD17+7Iv1Jw6ESd9N9jAeYmniVn1NX9+2z8Gly4QWmdMNq4h0UE+fJM33TCNawzcDOGLgWqpmoa7sjijjfQh1RP6T4kdMvc9+zOg8LU6b7/J6yDK7s+vhp+NGWnJbLiz1/xXNTmoRa0i1m6ywJdWzY9dsUyPMaX9xurS7zpoRMD2zeKD5qjLnO1NDbxMQ5aAbryawO2EjJkVOcgF6DalP6eXh4JQXMTwZcqb9JgnNGS120DE9DkpQ2hfcWA8KI/rQidQ6QOgq5vcb/yFf32W28f6RSBxxg811XOhQ33pDNKd4Q4hgMfb+LOmXCNxEFuyZqDVdxzXbBth7dCH4y3l4iyptDhDgB3DFAhuWtvQSXkUTLDCvf1JKbyekdxNXmsS7Uf1FzdpkmZv9+MwUIi6FRuU+2rTO9ryEvYaCPhrOU7uafGc59z2vVFVodiYqUpwV9NSYzLTVy3yDiPKMP4up/i/QKubGvLumB0vPVygSOhMeVvv3q+wK0APe1Nb0/vkd7XhgtsXv0LeRr3VMohZ+0DuLf6HHWwi/n4ZrtP+D/r1OpySb+yMbvxSHwHq0J1dAvQGi2e4LhABQ1cy8qQjd7GxIqGYyxBIDWl3fav9QNH6MTtr7GZvD2HMfnS7uUqKvaGBa2R8ll8FoH3zZXAsxlF+m8+bpdGguRbKbciQNGXOs8KKH1vC7Qr5Xp2idyRZ475rL9FeAfn+19P1YU3o/23z+3TKExMAxc3WbVakXCIQn7wd3uJQc16jl7ckw==

Signatures

  • Deletes shadow copies 2 TTPs

    Ransomware often targets backup files to inhibit system recovery.

    ransomware
  • Modifies extensions of user files 6 IoCs

    Ransomware generally changes the extension on encrypted files.

    ransomware
  • Drops startup file 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Drops desktop.ini file(s) 30 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Interacts with shadow copies 2 TTPs 1 IoCs

    Shadow copies are often targeted by ransomware to inhibit system recovery.

    ransomware
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of WriteProcessMemory 11 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\7c1f5cf8f242dfbd920180d8423777a4e540c37c09d787d4674b259bdbe0dc42.exe
    "C:\Users\Admin\AppData\Local\Temp\7c1f5cf8f242dfbd920180d8423777a4e540c37c09d787d4674b259bdbe0dc42.exe"
    1⤵
    • Modifies extensions of user files
    • Drops startup file
    • Drops desktop.ini file(s)
    • Drops file in Program Files directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:3164
    • C:\Windows\System32\vssadmin.exe
      delete shadows /all /quiet
      2⤵
      • Interacts with shadow copies
      PID:3760
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" bcdedit /set {current} bootstatuspolicy ignoreallfailures
      2⤵
        PID:1192
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\system32\cmd.exe" bcdedit /set {current} recoveryenabled no
        2⤵
          PID:2068
        • C:\Windows\SysWOW64\cmd.exe
          "C:\Windows\system32\cmd.exe" netsh advfirewall set allprofiles state off
          2⤵
            PID:1692
        • C:\Windows\system32\vssvc.exe
          C:\Windows\system32\vssvc.exe
          1⤵
          • Suspicious use of AdjustPrivilegeToken
          PID:3508

        Network

        MITRE ATT&CK Enterprise v6

        Replay Monitor

        Loading Replay Monitor...

        Downloads