Overview

overview

10

Static

static

d85f4448d5...le.exe

windows7_x64

10

d85f4448d5...le.exe

windows10_x64

10

Analysis

  • max time kernel
    121s
  • max time network
    125s
  • platform
    windows10_x64
  • resource
    win10-en-20211104
  • submitted
    30-11-2021 13:30

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    d85f4448d5aea240d68c07bec6f363986d71940c3c1a3e49053d55fd1741c41e.bin.sample.exe

  • Size

    156KB

  • MD5

    b36c45a9548330108c3e5731607eb7fb

  • SHA1

    24e773aa271fc0636cda6b0966a6034b65cb3052

  • SHA256

    d85f4448d5aea240d68c07bec6f363986d71940c3c1a3e49053d55fd1741c41e

  • SHA512

    1bdb0b3772057cef466e496d5f1bf248fde7337d4bc8bf1ce94a1b56eafed3f83d82b1bc9c607c055641a303f604689297f8aa1c53e33568de0d455a07950889

Score
10/10
ransomexx_winevasionransomware

Malware Config

Extracted

Path

C:\Users\Admin\.oracle_jre_usage\!TXDOT_READ_ME!.txt

Ransom Note
Greetings, Texas Department of Transportation! Read this message CAREFULLY and contact someone from IT department. Your files are securely ENCRYPTED. No third party decryption software EXISTS. MODIFICATION or RENAMING encrypted files may cause decryption failure. You can send us an encrypted file (not greater than 400KB) and we will decrypt it FOR FREE, so you have no doubts in possibility to restore all files from all affected systems ANY TIME. Encrypted file SHOULD NOT contain sensitive information (technical, backups, databases, large documents). The rest of data will be available after the PAYMENT. Infrastructure rebuild will cost you MUCH more. Contact us ONLY if you officially represent the whole affected network. The ONLY attachments we accept are non archived encrypted files for test decryption. Speak ENGLISH when contacting us. Mail us: [email protected] We kindly ask you not to use GMAIL, YAHOO or LIVE to contact us. The PRICE depends on how quickly you do it. �

Signatures

  • Deletes NTFS Change Journal 2 TTPs

    The USN change journal is a persistent log of all changes made to local files used by Windows Server systems.

    ransomware
  • RansomEXX Ransomware

    Targeted ransomware with variants which affect Windows and Linux systems.

    ransomwareransomexx_win
  • Clears Windows event logs 1 TTPs
    evasionransomware
  • Modifies boot configuration data using bcdedit 1 TTPs 2 IoCs
    ransomwareevasion
  • Deletes backup catalog 3 TTPs 1 IoCs

    Uses wbadmin.exe to inhibit system recovery.

    ransomware
  • Disables use of System Restore points 1 TTPs
    evasion
  • Modifies extensions of user files 7 IoCs

    Ransomware generally changes the extension on encrypted files.

    ransomware
  • Overwrites deleted data with Cipher tool 1 TTPs

    Cipher is a Windows tool which be used to securely wipe deallocated HDD space, preventing recovery of deleted data.

    ransomware
  • Enumerates connected drives 3 TTPs 1 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Checks SCSI registry key(s) 3 TTPs 4 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Suspicious behavior: EnumeratesProcesses 16 IoCs
  • Suspicious use of AdjustPrivilegeToken 13 IoCs
  • Suspicious use of WriteProcessMemory 26 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\d85f4448d5aea240d68c07bec6f363986d71940c3c1a3e49053d55fd1741c41e.bin.sample.exe
    "C:\Users\Admin\AppData\Local\Temp\d85f4448d5aea240d68c07bec6f363986d71940c3c1a3e49053d55fd1741c41e.bin.sample.exe"
    1⤵
    • Modifies extensions of user files
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:4064
    • C:\Windows\SysWOW64\cipher.exe
      "C:\Windows\System32\cipher.exe" /w:C:
      2⤵
        PID:1044
      • C:\Windows\System32\wevtutil.exe
        "C:\Windows\System32\wevtutil.exe" cl Security
        2⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:2016
      • C:\Windows\System32\bcdedit.exe
        "C:\Windows\System32\bcdedit.exe" /set {default} bootstatuspolicy ignoreallfailures
        2⤵
        • Modifies boot configuration data using bcdedit
        PID:2156
      • C:\Windows\System32\fsutil.exe
        "C:\Windows\System32\fsutil.exe" usn deletejournal /D C:
        2⤵
          PID:1928
        • C:\Windows\System32\wevtutil.exe
          "C:\Windows\System32\wevtutil.exe" sl Security /e:false
          2⤵
          • Suspicious use of AdjustPrivilegeToken
          PID:592
        • C:\Windows\System32\wevtutil.exe
          "C:\Windows\System32\wevtutil.exe" cl System
          2⤵
          • Suspicious use of AdjustPrivilegeToken
          PID:348
        • C:\Windows\SysWOW64\cipher.exe
          "C:\Windows\System32\cipher.exe" /w:D:
          2⤵
          • Enumerates connected drives
          PID:700
        • C:\Windows\System32\wevtutil.exe
          "C:\Windows\System32\wevtutil.exe" cl Application
          2⤵
          • Suspicious use of AdjustPrivilegeToken
          PID:872
        • C:\Windows\System32\schtasks.exe
          "C:\Windows\System32\schtasks.exe" /Change /TN "\Microsoft\Windows\SystemRestore\SR" /disable
          2⤵
            PID:392
          • C:\Windows\System32\bcdedit.exe
            "C:\Windows\System32\bcdedit.exe" /set {default} recoveryenabled no
            2⤵
            • Modifies boot configuration data using bcdedit
            PID:204
          • C:\Windows\System32\wbadmin.exe
            "C:\Windows\System32\wbadmin.exe" delete catalog -quiet
            2⤵
            • Deletes backup catalog
            PID:188
          • C:\Windows\System32\wevtutil.exe
            "C:\Windows\System32\wevtutil.exe" cl Setup
            2⤵
            • Suspicious use of AdjustPrivilegeToken
            PID:1016
        • C:\Windows\system32\wbengine.exe
          "C:\Windows\system32\wbengine.exe"
          1⤵
          • Suspicious use of AdjustPrivilegeToken
          PID:3612
        • C:\Windows\System32\vdsldr.exe
          C:\Windows\System32\vdsldr.exe -Embedding
          1⤵
            PID:932
          • C:\Windows\System32\vds.exe
            C:\Windows\System32\vds.exe
            1⤵
            • Checks SCSI registry key(s)
            PID:2160

          Network

          MITRE ATT&CK Enterprise v6

          Replay Monitor

          Loading Replay Monitor...

          Downloads