3d7cf20ca6476e14e0a026f9bdd8ff1f26995cdc5854c3adb41a6135ef11ba83

Resubmissions

20/01/2022, 19:26

220120-x5jhrsbcdl10

17/01/2022, 16:56

220117-vf67esbcd810

17/01/2022, 16:16

220117-tqyscsbedr10

09/12/2021, 23:18

211209-299yqseee91

Analysis

max time kernel
149s
max time network
150s
platform
windows7_x64
resource
win7-en-20211208
submitted
17/01/2022, 16:56

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
3d7cf20ca6476e14e0a026f9bdd8ff1f26995cdc5854c3adb41a6135ef11ba83.bin.exe
Size 2.2MB
Sample220117-vf67esbcd8
SHA256 3d7cf20ca6476e14e0a026f9bdd8ff1f26995cdc5854c3adb41a6135ef11ba83
MD5 aea5d3cced6725f37e2c3797735e6467
SHA1 087497940a41d96e4e907b6dc92f75f4a38d861a
SHA512 5489753ae1c3ba0dbd3e0ce1b78b0ccba045e534e77fb87c80d56b16229f928c46a15721020142bbc6bd4d1ba5c295f4bec3596efa7b46c906889c156dadbd66
MD5 SHA1 SHA512

Score

10^/10

ransomware

Malware Config

Extracted

Path

C:\RECOVER-sykffle-FILES.txt

Ransom Note

>> Introduction Important files on your system was ENCRYPTED and now they have have "sykffle" extension. In order to recover your files you need to follow instructions below. >> Sensitive Data Sensitive data on your system was DOWNLOADED and it will be PUBLISHED if you refuse to cooperate. Data includes: - Employees personal data, CVs, DL, SSN. - Complete network map including credentials for local and remote services. - Financial information including clients data, bills, budgets, annual reports, bank statements. - Complete datagrams/schemas/drawings for manufacturing in solidworks format - And more... Private preview is published here: http://zujgzbu5y64xbmvc42addp4lxkoosb4tslf5mehnh7pvqjpwxn5gokyd.onion/b21e1fb6-ff88-425b-8339-3523179a1e3e/886cf430a907bbe9a3fd38fb704d524dbd199c1b042ad6f65dc72ad78704e21 >> CAUTION DO NOT MODIFY FILES YOURSELF. DO NOT USE THIRD PARTY SOFTWARE TO RESTORE YOUR DATA. YOU MAY DAMAGE YOUR FILES, IT WILL RESULT IN PERMANENT DATA LOSS. YOUR DATA IS STRONGLY ENCRYPTED, YOU CAN NOT DECRYPT IT WITHOUT CIPHER KEY. >> Recovery procedure Follow these simple steps to get in touch and recover your data: 1) Download and install Tor Browser from: https://torproject.org/ 2) Navigate to: http://mu75ltv3lxd24dbyu6gtvmnwybecigs5auki7fces437xvvflzva2nqd.onion/?access-key=LWJr7bVcSMGcY5YdPVmFb0ZON%2BF7%2Bau322FPnwcE9LwdS6oF%2BqsTezNE%2BJ3CeIrVWP04sFKfZyDthKAU9FNF54clf32wnXRakIh6nUeIjJL4Gn%2FYPHs5cVfPKaMFdTRGKKFP1JWeQ2Fne7wWRfD0eCgmTAKCagsjtwAQMfzZJfV1wKtj%2BRVh87pyjXP%2BA1G7IBmjVgEbLP1dWQR4XdYwvaaM%2FE1ge51BV3MJEcg5rHmsnCK%2BFjqDeJR5sEbdckGW7cxZ1aVBMAScg8WU%2FI3uFbntzOvipK4%2BFofW0p81%2F23Ssz7qmAQuRCEYcLWT0nt87F%2Fq6HYV09Q9YoOjlrvPKw%3D%3D

URLs

http://zujgzbu5y64xbmvc42addp4lxkoosb4tslf5mehnh7pvqjpwxn5gokyd.onion/b21e1fb6-ff88-425b-8339-3523179a1e3e/886cf430a907bbe9a3fd38fb704d524dbd199c1b042ad6f65dc72ad78704e21
http://mu75ltv3lxd24dbyu6gtvmnwybecigs5auki7fces437xvvflzva2nqd.onion/?access-key=LWJr7bVcSMGcY5YdPVmFb0ZON%2BF7%2Bau322FPnwcE9LwdS6oF%2BqsTezNE%2BJ3CeIrVWP04sFKfZyDthKAU9FNF54clf32wnXRakIh6nUeIjJL4Gn%2FYPHs5cVfPKaMFdTRGKKFP1JWeQ2Fne7wWRfD0eCgmTAKCagsjtwAQMfzZJfV1wKtj%2BRVh87pyjXP%2BA1G7IBmjVgEbLP1dWQR4XdYwvaaM%2FE1ge51BV3MJEcg5rHmsnCK%2BFjqDeJR5sEbdckGW7cxZ1aVBMAScg8WU%2FI3uFbntzOvipK4%2BFofW0p81%2F23Ssz7qmAQuRCEYcLWT0nt87F%2Fq6HYV09Q9YoOjlrvPKw%3D%3D

Signatures

Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware

File Deletion
T1107

Inhibit System Recovery
T1490

Modifies extensions of user files 21 IoCs

Ransomware generally changes the extension on encrypted files.

ransomware

description	ioc	Process
File opened for modification	C:\Users\Admin\Pictures\CheckpointPush.raw.sykffle	woof.exe
File renamed	C:\Users\Admin\Pictures\ConnectInvoke.tiff => C:\Users\Admin\Pictures\ConnectInvoke.tiff.sykffle	woof.exe
File opened for modification	C:\Users\Admin\Pictures\ExitWait.crw.sykffle	woof.exe
File renamed	C:\Users\Admin\Pictures\ExpandConvertTo.png => C:\Users\Admin\Pictures\ExpandConvertTo.png.sykffle	woof.exe
File opened for modification	C:\Users\Admin\Pictures\SyncRestore.tif.sykffle	woof.exe
File renamed	C:\Users\Admin\Pictures\TestCopy.crw => C:\Users\Admin\Pictures\TestCopy.crw.sykffle	woof.exe
File opened for modification	C:\Users\Admin\Pictures\ConvertFromUse.png.sykffle	woof.exe
File opened for modification	C:\Users\Admin\Pictures\NewSuspend.tif.sykffle	woof.exe
File renamed	C:\Users\Admin\Pictures\ResumeBackup.tif => C:\Users\Admin\Pictures\ResumeBackup.tif.sykffle	woof.exe
File opened for modification	C:\Users\Admin\Pictures\ResumeBackup.tif.sykffle	woof.exe
File opened for modification	C:\Users\Admin\Pictures\SetMerge.crw.sykffle	woof.exe
File renamed	C:\Users\Admin\Pictures\SyncRestore.tif => C:\Users\Admin\Pictures\SyncRestore.tif.sykffle	woof.exe
File opened for modification	C:\Users\Admin\Pictures\ConnectInvoke.tiff	woof.exe
File renamed	C:\Users\Admin\Pictures\CheckpointPush.raw => C:\Users\Admin\Pictures\CheckpointPush.raw.sykffle	woof.exe
File opened for modification	C:\Users\Admin\Pictures\ConnectInvoke.tiff.sykffle	woof.exe
File renamed	C:\Users\Admin\Pictures\ConvertFromUse.png => C:\Users\Admin\Pictures\ConvertFromUse.png.sykffle	woof.exe
File renamed	C:\Users\Admin\Pictures\ExitWait.crw => C:\Users\Admin\Pictures\ExitWait.crw.sykffle	woof.exe
File renamed	C:\Users\Admin\Pictures\SetMerge.crw => C:\Users\Admin\Pictures\SetMerge.crw.sykffle	woof.exe
File opened for modification	C:\Users\Admin\Pictures\ExpandConvertTo.png.sykffle	woof.exe
File renamed	C:\Users\Admin\Pictures\NewSuspend.tif => C:\Users\Admin\Pictures\NewSuspend.tif.sykffle	woof.exe
File opened for modification	C:\Users\Admin\Pictures\TestCopy.crw.sykffle	woof.exe

Enumerates connected drives 3 TTPs 1 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\Z:	woof.exe

Sets desktop wallpaper using registry 2 TTPs 2 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Control Panel\Desktop\WallPaper = "C:\\Users\\Admin\\Desktop\\RECOVER-sykffle-FILES.txt.png"	woof.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\Desktop\\RECOVER-sykffle-FILES.txt.png"	woof.exe

Interacts with shadow copies 2 TTPs 2 IoCs

Shadow copies are often targeted by ransomware to inhibit system recovery.

ransomware

File Deletion

T1107

Inhibit System Recovery

T1490

pid	Process
1648	vssadmin.exe
1340	vssadmin.exe

Modifies Control Panel 1 IoCs

evasion

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Control Panel\Desktop\WallpaperStyle = "0"	woof.exe

Suspicious behavior: CmdExeWriteProcessMemorySpam 5 IoCs

pid	Process
1532	woof.exe
396	woof.exe
1664	woof.exe
1668	woof.exe
240	woof.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
240	woof.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
668	cmd.exe

Suspicious use of AdjustPrivilegeToken 46 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	1372	WMIC.exe
Token: SeSecurityPrivilege	1372	WMIC.exe
Token: SeTakeOwnershipPrivilege	1372	WMIC.exe
Token: SeLoadDriverPrivilege	1372	WMIC.exe
Token: SeSystemProfilePrivilege	1372	WMIC.exe
Token: SeSystemtimePrivilege	1372	WMIC.exe
Token: SeProfSingleProcessPrivilege	1372	WMIC.exe
Token: SeIncBasePriorityPrivilege	1372	WMIC.exe
Token: SeCreatePagefilePrivilege	1372	WMIC.exe
Token: SeBackupPrivilege	1372	WMIC.exe
Token: SeRestorePrivilege	1372	WMIC.exe
Token: SeShutdownPrivilege	1372	WMIC.exe
Token: SeDebugPrivilege	1372	WMIC.exe
Token: SeSystemEnvironmentPrivilege	1372	WMIC.exe
Token: SeRemoteShutdownPrivilege	1372	WMIC.exe
Token: SeUndockPrivilege	1372	WMIC.exe
Token: SeManageVolumePrivilege	1372	WMIC.exe
Token: 33	1372	WMIC.exe
Token: 34	1372	WMIC.exe
Token: 35	1372	WMIC.exe
Token: SeIncreaseQuotaPrivilege	1372	WMIC.exe
Token: SeSecurityPrivilege	1372	WMIC.exe
Token: SeTakeOwnershipPrivilege	1372	WMIC.exe
Token: SeLoadDriverPrivilege	1372	WMIC.exe
Token: SeSystemProfilePrivilege	1372	WMIC.exe
Token: SeSystemtimePrivilege	1372	WMIC.exe
Token: SeProfSingleProcessPrivilege	1372	WMIC.exe
Token: SeIncBasePriorityPrivilege	1372	WMIC.exe
Token: SeCreatePagefilePrivilege	1372	WMIC.exe
Token: SeBackupPrivilege	1372	WMIC.exe
Token: SeRestorePrivilege	1372	WMIC.exe
Token: SeShutdownPrivilege	1372	WMIC.exe
Token: SeDebugPrivilege	1372	WMIC.exe
Token: SeSystemEnvironmentPrivilege	1372	WMIC.exe
Token: SeRemoteShutdownPrivilege	1372	WMIC.exe
Token: SeUndockPrivilege	1372	WMIC.exe
Token: SeManageVolumePrivilege	1372	WMIC.exe
Token: 33	1372	WMIC.exe
Token: 34	1372	WMIC.exe
Token: 35	1372	WMIC.exe
Token: SeBackupPrivilege	1604	vssvc.exe
Token: SeRestorePrivilege	1604	vssvc.exe
Token: SeAuditPrivilege	1604	vssvc.exe
Token: SeBackupPrivilege	1628	vssvc.exe
Token: SeRestorePrivilege	1628	vssvc.exe
Token: SeAuditPrivilege	1628	vssvc.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 668 wrote to memory of 1532	668	cmd.exe	31
PID 668 wrote to memory of 1532	668	cmd.exe	31
PID 668 wrote to memory of 1532	668	cmd.exe	31
PID 668 wrote to memory of 1532	668	cmd.exe	31
PID 668 wrote to memory of 396	668	cmd.exe	32
PID 668 wrote to memory of 396	668	cmd.exe	32
PID 668 wrote to memory of 396	668	cmd.exe	32
PID 668 wrote to memory of 396	668	cmd.exe	32
PID 668 wrote to memory of 1664	668	cmd.exe	33
PID 668 wrote to memory of 1664	668	cmd.exe	33
PID 668 wrote to memory of 1664	668	cmd.exe	33
PID 668 wrote to memory of 1664	668	cmd.exe	33
PID 668 wrote to memory of 1668	668	cmd.exe	34
PID 668 wrote to memory of 1668	668	cmd.exe	34
PID 668 wrote to memory of 1668	668	cmd.exe	34
PID 668 wrote to memory of 1668	668	cmd.exe	34
PID 668 wrote to memory of 240	668	cmd.exe	35
PID 668 wrote to memory of 240	668	cmd.exe	35
PID 668 wrote to memory of 240	668	cmd.exe	35
PID 668 wrote to memory of 240	668	cmd.exe	35
PID 240 wrote to memory of 1164	240	woof.exe	36
PID 240 wrote to memory of 1164	240	woof.exe	36
PID 240 wrote to memory of 1164	240	woof.exe	36
PID 240 wrote to memory of 1164	240	woof.exe	36
PID 1164 wrote to memory of 1372	1164	cmd.exe	38
PID 1164 wrote to memory of 1372	1164	cmd.exe	38
PID 1164 wrote to memory of 1372	1164	cmd.exe	38
PID 1164 wrote to memory of 1372	1164	cmd.exe	38
PID 240 wrote to memory of 2016	240	woof.exe	40
PID 240 wrote to memory of 2016	240	woof.exe	40
PID 240 wrote to memory of 2016	240	woof.exe	40
PID 240 wrote to memory of 2016	240	woof.exe	40
PID 2016 wrote to memory of 1560	2016	cmd.exe	42
PID 2016 wrote to memory of 1560	2016	cmd.exe	42
PID 2016 wrote to memory of 1560	2016	cmd.exe	42
PID 2016 wrote to memory of 1560	2016	cmd.exe	42
PID 240 wrote to memory of 1748	240	woof.exe	43
PID 240 wrote to memory of 1748	240	woof.exe	43
PID 240 wrote to memory of 1748	240	woof.exe	43
PID 240 wrote to memory of 1748	240	woof.exe	43
PID 1748 wrote to memory of 1588	1748	cmd.exe	45
PID 1748 wrote to memory of 1588	1748	cmd.exe	45
PID 1748 wrote to memory of 1588	1748	cmd.exe	45
PID 1748 wrote to memory of 1588	1748	cmd.exe	45
PID 240 wrote to memory of 1736	240	woof.exe	48
PID 240 wrote to memory of 1736	240	woof.exe	48
PID 240 wrote to memory of 1736	240	woof.exe	48
PID 240 wrote to memory of 1736	240	woof.exe	48
PID 240 wrote to memory of 1920	240	woof.exe	46
PID 240 wrote to memory of 1920	240	woof.exe	46
PID 240 wrote to memory of 1920	240	woof.exe	46
PID 240 wrote to memory of 1920	240	woof.exe	46
PID 1736 wrote to memory of 1648	1736	cmd.exe	50
PID 1736 wrote to memory of 1648	1736	cmd.exe	50
PID 1736 wrote to memory of 1648	1736	cmd.exe	50
PID 240 wrote to memory of 808	240	woof.exe	52
PID 240 wrote to memory of 808	240	woof.exe	52
PID 240 wrote to memory of 808	240	woof.exe	52
PID 240 wrote to memory of 808	240	woof.exe	52
PID 808 wrote to memory of 1556	808	cmd.exe	56
PID 808 wrote to memory of 1556	808	cmd.exe	56
PID 808 wrote to memory of 1556	808	cmd.exe	56
PID 808 wrote to memory of 1556	808	cmd.exe	56
PID 240 wrote to memory of 1944	240	woof.exe	58

C:\Users\Admin\AppData\Local\Temp\3d7cf20ca6476e14e0a026f9bdd8ff1f26995cdc5854c3adb41a6135ef11ba83.bin.exe
"C:\Users\Admin\AppData\Local\Temp\3d7cf20ca6476e14e0a026f9bdd8ff1f26995cdc5854c3adb41a6135ef11ba83.bin.exe"
1⤵
PID:1504

C:\Windows\system32\cmd.exe
"C:\Windows\system32\cmd.exe"
1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:668
- C:\Users\Admin\AppData\Local\Temp\woof.exe
  woof --ui
  2⤵
  - Suspicious behavior: CmdExeWriteProcessMemorySpam
  PID:1532
- C:\Users\Admin\AppData\Local\Temp\woof.exe
  woof --UI
  2⤵
  - Suspicious behavior: CmdExeWriteProcessMemorySpam
  PID:396
- C:\Users\Admin\AppData\Local\Temp\woof.exe
  woof.exe -V
  2⤵
  - Suspicious behavior: CmdExeWriteProcessMemorySpam
  PID:1664
- C:\Users\Admin\AppData\Local\Temp\woof.exe
  woof.exe --version
  2⤵
  - Suspicious behavior: CmdExeWriteProcessMemorySpam
  PID:1668
- C:\Users\Admin\AppData\Local\Temp\woof.exe
  woof.exe -asdfadsfadsf
  2⤵
  - Modifies extensions of user files
  - Enumerates connected drives
  - Sets desktop wallpaper using registry
  - Modifies Control Panel
  - Suspicious behavior: CmdExeWriteProcessMemorySpam
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:240
- - C:\Windows\SysWOW64\cmd.exe
    "cmd" /c "wmic csproduct get UUID"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1164
  - - C:\Windows\SysWOW64\Wbem\WMIC.exe
      wmic csproduct get UUID
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:1372
- - C:\Windows\SysWOW64\cmd.exe
    "cmd" /c "fsutil behavior set SymlinkEvaluation R2L:1"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2016
  - - C:\Windows\SysWOW64\fsutil.exe
      fsutil behavior set SymlinkEvaluation R2L:1
      4⤵
      PID:1560
- - C:\Windows\SysWOW64\cmd.exe
    "cmd" /c "fsutil behavior set SymlinkEvaluation R2R:1"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1748
  - - C:\Windows\SysWOW64\fsutil.exe
      fsutil behavior set SymlinkEvaluation R2R:1
      4⤵
      PID:1588
- - C:\Windows\SysWOW64\cmd.exe
    "cmd" /c "reg add HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters /v MaxMpxCt /d 65535 /t REG_DWORD /f"
    3⤵
    PID:1920
  - - C:\Windows\SysWOW64\reg.exe
      reg add HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters /v MaxMpxCt /d 65535 /t REG_DWORD /f
      4⤵
      PID:980
- - C:\Windows\system32\cmd.exe
    "cmd" /c "vssadmin.exe delete shadows /all /quiet"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1736
  - - C:\Windows\system32\vssadmin.exe
      vssadmin.exe delete shadows /all /quiet
      4⤵
      Interacts with shadow copies
      PID:1648
- - C:\Windows\SysWOW64\cmd.exe
    "cmd" /c "arp -a"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:808
  - - C:\Windows\SysWOW64\ARP.EXE
      arp -a
      4⤵
      PID:1556
- - C:\Windows\system32\cmd.exe
    "cmd" /c "vssadmin.exe delete shadows /all /quiet"
    3⤵
    PID:1944
  - - C:\Windows\system32\vssadmin.exe
      vssadmin.exe delete shadows /all /quiet
      4⤵
      Interacts with shadow copies
      PID:1340

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1604

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1628

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File Deletion

T1107

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Defacement

T1491

Inhibit System Recovery

T1490

Resubmissions

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads