Overview

overview

10

Static

static

xd.exe

windows7_x64

10

xd.exe

windows10_x64

10

Analysis

  • max time kernel
    600s
  • max time network
    603s
  • platform
    windows7_x64
  • resource
    win7-en-20211014
  • submitted
    02/12/2021, 10:30

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    xd.exe

  • Size

    42KB

  • MD5

    a034f79273e3f61d34eeadf38f12dee2

  • SHA1

    9c8feeab65f71344713d63f4879e247aba49dce4

  • SHA256

    903c04976fa6e6721c596354f383a4d4272c6730b29eee00b0ec599265963e74

  • SHA512

    f88ae1a3fdc901e49c3ddae6008f80c3b647f2fb88d32c9d726d91f52f65d5af5b2c6c0bdc9dba556f797e9c9075befb4d639a1b6ff990b060bdb081f2945caf

Score
10/10
ransomware

Malware Config

Extracted

Path

C:\PerfLogs\Hello.txt

Ransom Note
.;tLG008000000GLt:. .1G80Lt;:.. .,:itC08Ci ,f80t: :f88t. 1@0i 188i .C@t .L@f C@i t@f t@t ..,,:::. .:::,,.. C@i .88..CGG000000G8@; 1@0G000000GGL :@G :@G 0@1.... G@: i@L ....f@L .8@. :@C ,G8t:..,i0@1 f@Gi,..:f@C. 0@. :@C iC0000Gf, :fG0000C; 0@. :@C .. :i111;, ... 0@. :@C :L80GCLCG00f, 0@. ,tCGGCt,,@C f@G;. .i0@t 0@,iLGGGLi t@01;;1G@0@C f@t L@1 0@88f;;if@G, :@G ,f0@f, 8@. ,@G iG@Ci ;@L .0@; .iG@f .8@0000000000000@G :08L: .L@1 ,L@G1. :: ,,,,,,,,,,,,,,,,. .:. :L80i ,f88f, iG@C; iG@G; ,f88f, :L801. ;L80i. ;@@8f :08@@. :@C:: .;.0@. ░█──░█ █──█ █▀▀█ ▀▀█▀▀ 　 ░█─░█ █▀▀█ █▀▀█ █▀▀█ █▀▀ █▀▀▄ ▀█ ░█░█░█ █▀▀█ █▄▄█ ──█── 　 ░█▀▀█ █▄▄█ █──█ █──█ █▀▀ █──█ █▀ ░█▄▀▄█ ▀──▀ ▀──▀ ──▀── 　 ░█─░█ ▀──▀ █▀▀▀ █▀▀▀ ▀▀▀ ▀──▀ ▄─ Not so long ago, we discovered a serious problem with your network and decided to help you. So what happened? All files are encrypted with Integrated Encryption Scheme. The file structure was not damaged. You have been assigned a unique identifier. After infection, you have 96 hours to declare decryption. After the expiration of 96 hours, decryption cost will be automatically increased. █░█ █▀▀ █░░ █░░ █▀█   ▀▄▀ █▀▄ Now you should send us █▀█ ██▄ █▄▄ █▄▄ █▄█   █░█ █▄▀ message with your personal identifier, which is at the bottom of the message. We hope that you understand the importance of the work we have done, if the vulnerability were found by someone else, it is possible that the consequences of the attack could be much more sensitive than the usual payment of money due to us for work. Free decryption as guarantee! Before paying you can send us 2 files for free decryption. The total size of files must be less than 1Mb (non archived), and files should not contain valuable information (databases, backups, large excel sheets, etc.). ▄▀█ ▀█▀ ▀█▀ █▀▀ █▄░█ ▀█▀ █ █▀█ █▄░█ █ DO!! NOT!! TRY!!! █▀█ ░█░ ░█░ ██▄ █░▀█ ░█░ █ █▄█ █░▀█ ▄ TO!! CHANGE!! or apply any other influence encrypted files by yourself!!! If you willtry to use any third party software for restoring your data or antivirus solutions - this can lead to complete damage to all files and their irrecoverable loss, since it will no longer be possible to restore them Any changes in encrypted files may entail damage of the private key and, as result, the loss all data. ...!XD :: your personal id: 9889E042B07F83DA :: our TOX below >:) A746E398A5BC9AD9F281F5D10CF861546092D0F2107F12EA9F107EFB7D21CA41F312B73FB114 You can download TOX here: https://tox.chat/download.html
URLs

https://tox.chat/download.html

Signatures

  • Deletes shadow copies 2 TTPs

    Ransomware often targets backup files to inhibit system recovery.

    ransomware
  • Modifies extensions of user files 18 IoCs

    Ransomware generally changes the extension on encrypted files.

    ransomware
  • Deletes itself 1 IoCs
  • Enumerates connected drives 3 TTPs 24 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Program Files directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Interacts with shadow copies 2 TTPs 2 IoCs

    Shadow copies are often targeted by ransomware to inhibit system recovery.

    ransomware
  • Opens file in notepad (likely ransom note) 1 IoCs
    ransomware
  • Runs ping.exe 1 TTPs 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of WriteProcessMemory 18 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\xd.exe
    "C:\Users\Admin\AppData\Local\Temp\xd.exe"
    1⤵
    • Modifies extensions of user files
    • Enumerates connected drives
    • Drops file in Program Files directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:1708
    • C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /c vssadmin.exe delete shadows /all /quiet
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:1648
      • C:\Windows\system32\vssadmin.exe
        vssadmin.exe delete shadows /all /quiet
        3⤵
        • Interacts with shadow copies
        PID:1072
    • C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /c vssadmin.exe delete shadows /all /quiet
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:1728
      • C:\Windows\system32\vssadmin.exe
        vssadmin.exe delete shadows /all /quiet
        3⤵
        • Interacts with shadow copies
        PID:744
    • C:\Windows\system32\cmd.exe
      cmd.exe /C ping 1.1.1.1 -n 1 -w 3000 > Nul & Del /f /q "C:\Users\Admin\AppData\Local\Temp\xd.exe"
      2⤵
      • Deletes itself
      • Suspicious use of WriteProcessMemory
      PID:1916
      • C:\Windows\system32\PING.EXE
        ping 1.1.1.1 -n 1 -w 3000
        3⤵
        • Runs ping.exe
        PID:1856
  • C:\Windows\system32\vssvc.exe
    C:\Windows\system32\vssvc.exe
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:1048
  • C:\Windows\system32\NOTEPAD.EXE
    "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Public\Desktop\Hello.txt
    1⤵
    • Opens file in notepad (likely ransom note)
    • Suspicious use of FindShellTrayWindow
    PID:1456

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1708-55-0x000007FEFBA81000-0x000007FEFBA83000-memory.dmp

    Filesize

    8KB

    Download