3d7cf20ca6476e14e0a026f9bdd8ff1f26995cdc5854c3adb41a6135ef11ba83

General

Target

3d7cf20ca6476e14e0a026f9bdd8ff1f26995cdc5854c3adb41a6135ef11ba83.bin.exe
Size

2.2MB
MD5

aea5d3cced6725f37e2c3797735e6467
SHA1

087497940a41d96e4e907b6dc92f75f4a38d861a
SHA256

3d7cf20ca6476e14e0a026f9bdd8ff1f26995cdc5854c3adb41a6135ef11ba83
SHA512

5489753ae1c3ba0dbd3e0ce1b78b0ccba045e534e77fb87c80d56b16229f928c46a15721020142bbc6bd4d1ba5c295f4bec3596efa7b46c906889c156dadbd66

Score

10^/10

ransomware

Malware Config

Extracted

Path

C:\RECOVER-sykffle-FILES.txt

Ransom Note

>> Introduction Important files on your system was ENCRYPTED and now they have have "sykffle" extension. In order to recover your files you need to follow instructions below. >> Sensitive Data Sensitive data on your system was DOWNLOADED and it will be PUBLISHED if you refuse to cooperate. Data includes: - Employees personal data, CVs, DL, SSN. - Complete network map including credentials for local and remote services. - Financial information including clients data, bills, budgets, annual reports, bank statements. - Complete datagrams/schemas/drawings for manufacturing in solidworks format - And more... Private preview is published here: http://zujgzbu5y64xbmvc42addp4lxkoosb4tslf5mehnh7pvqjpwxn5gokyd.onion/b21e1fb6-ff88-425b-8339-3523179a1e3e/886cf430a907bbe9a3fd38fb704d524dbd199c1b042ad6f65dc72ad78704e21 >> CAUTION DO NOT MODIFY FILES YOURSELF. DO NOT USE THIRD PARTY SOFTWARE TO RESTORE YOUR DATA. YOU MAY DAMAGE YOUR FILES, IT WILL RESULT IN PERMANENT DATA LOSS. YOUR DATA IS STRONGLY ENCRYPTED, YOU CAN NOT DECRYPT IT WITHOUT CIPHER KEY. >> Recovery procedure Follow these simple steps to get in touch and recover your data: 1) Download and install Tor Browser from: https://torproject.org/ 2) Navigate to: http://mu75ltv3lxd24dbyu6gtvmnwybecigs5auki7fces437xvvflzva2nqd.onion/?access-key=LWJr7bVcSMGcY5YdPVmFb0ZON%2BF7%2Bau322FPnwcE9LwdS6oF%2BqsTezNE%2BJ3CeIrVWP04sFKfZyDthKAU9FNF54clf32wnXRakIh6nUeIjJL4Gn%2FYPHs5cVfPKaMFdTRGKKFP1JWeQ2Fne7wWRfD0eCgmTAKCagsjtwAQMfzZJfV1wKtj%2BRVh87pyjXP%2BA1G7IBmjVgEbLP1dWQR4XdYwvaaM%2FE1ge51BV3MJEcg5rHmsnCK%2BFjqDeJR5sEbdckGW7cxZ1aVBMAScg8WU%2FI3uFbntzOvipK4%2BFofW0p81%2F23Ssz7qmAQuRCEYcLWT0nt87F%2Fq6HYV09Q9YoOjlrvPKw%3D%3D

URLs

http://zujgzbu5y64xbmvc42addp4lxkoosb4tslf5mehnh7pvqjpwxn5gokyd.onion/b21e1fb6-ff88-425b-8339-3523179a1e3e/886cf430a907bbe9a3fd38fb704d524dbd199c1b042ad6f65dc72ad78704e21

http://mu75ltv3lxd24dbyu6gtvmnwybecigs5auki7fces437xvvflzva2nqd.onion/?access-key=LWJr7bVcSMGcY5YdPVmFb0ZON%2BF7%2Bau322FPnwcE9LwdS6oF%2BqsTezNE%2BJ3CeIrVWP04sFKfZyDthKAU9FNF54clf32wnXRakIh6nUeIjJL4Gn%2FYPHs5cVfPKaMFdTRGKKFP1JWeQ2Fne7wWRfD0eCgmTAKCagsjtwAQMfzZJfV1wKtj%2BRVh87pyjXP%2BA1G7IBmjVgEbLP1dWQR4XdYwvaaM%2FE1ge51BV3MJEcg5rHmsnCK%2BFjqDeJR5sEbdckGW7cxZ1aVBMAScg8WU%2FI3uFbntzOvipK4%2BFofW0p81%2F23Ssz7qmAQuRCEYcLWT0nt87F%2Fq6HYV09Q9YoOjlrvPKw%3D%3D

Signatures

Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware

File Deletion
T1107

Inhibit System Recovery
T1490

Modifies extensions of user files 21 IoCs

Ransomware generally changes the extension on encrypted files.

ransomware

Processes:

woof.exe

description	ioc	process
File opened for modification	C:\Users\Admin\Pictures\CheckpointPush.raw.sykffle	woof.exe
File renamed	C:\Users\Admin\Pictures\ConnectInvoke.tiff => C:\Users\Admin\Pictures\ConnectInvoke.tiff.sykffle	woof.exe
File opened for modification	C:\Users\Admin\Pictures\ExitWait.crw.sykffle	woof.exe
File renamed	C:\Users\Admin\Pictures\ExpandConvertTo.png => C:\Users\Admin\Pictures\ExpandConvertTo.png.sykffle	woof.exe
File opened for modification	C:\Users\Admin\Pictures\SyncRestore.tif.sykffle	woof.exe
File renamed	C:\Users\Admin\Pictures\TestCopy.crw => C:\Users\Admin\Pictures\TestCopy.crw.sykffle	woof.exe
File opened for modification	C:\Users\Admin\Pictures\ConvertFromUse.png.sykffle	woof.exe
File opened for modification	C:\Users\Admin\Pictures\NewSuspend.tif.sykffle	woof.exe
File renamed	C:\Users\Admin\Pictures\ResumeBackup.tif => C:\Users\Admin\Pictures\ResumeBackup.tif.sykffle	woof.exe
File opened for modification	C:\Users\Admin\Pictures\ResumeBackup.tif.sykffle	woof.exe
File opened for modification	C:\Users\Admin\Pictures\SetMerge.crw.sykffle	woof.exe
File renamed	C:\Users\Admin\Pictures\SyncRestore.tif => C:\Users\Admin\Pictures\SyncRestore.tif.sykffle	woof.exe
File opened for modification	C:\Users\Admin\Pictures\ConnectInvoke.tiff	woof.exe
File renamed	C:\Users\Admin\Pictures\CheckpointPush.raw => C:\Users\Admin\Pictures\CheckpointPush.raw.sykffle	woof.exe
File opened for modification	C:\Users\Admin\Pictures\ConnectInvoke.tiff.sykffle	woof.exe
File renamed	C:\Users\Admin\Pictures\ConvertFromUse.png => C:\Users\Admin\Pictures\ConvertFromUse.png.sykffle	woof.exe
File renamed	C:\Users\Admin\Pictures\ExitWait.crw => C:\Users\Admin\Pictures\ExitWait.crw.sykffle	woof.exe
File renamed	C:\Users\Admin\Pictures\SetMerge.crw => C:\Users\Admin\Pictures\SetMerge.crw.sykffle	woof.exe
File opened for modification	C:\Users\Admin\Pictures\ExpandConvertTo.png.sykffle	woof.exe
File renamed	C:\Users\Admin\Pictures\NewSuspend.tif => C:\Users\Admin\Pictures\NewSuspend.tif.sykffle	woof.exe
File opened for modification	C:\Users\Admin\Pictures\TestCopy.crw.sykffle	woof.exe

Enumerates connected drives 3 TTPs 1 IoCs
Attempts to read the root path of hard drives other than the default C: drive.

Query Registry
T1012

Peripheral Device Discovery
T1120

System Information Discovery
T1082

Processes:

woof.exe

description ioc process

File opened (read-only) \??\Z: woof.exe

description	ioc	process
File opened (read-only)	\??\Z:	woof.exe

Sets desktop wallpaper using registry 2 TTPs 2 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

Processes:

woof.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Control Panel\Desktop\WallPaper = "C:\\Users\\Admin\\Desktop\\RECOVER-sykffle-FILES.txt.png"	woof.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\Desktop\\RECOVER-sykffle-FILES.txt.png"	woof.exe

Interacts with shadow copies 2 TTPs 2 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
ransomware

File Deletion
T1107

Inhibit System Recovery
T1490

Processes:

vssadmin.exevssadmin.exe

pid process

1648 vssadmin.exe
1340 vssadmin.exe
Modifies Control Panel 1 IoCs
evasion

Processes:

woof.exe

description ioc process

Set value (str) \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Control Panel\Desktop\WallpaperStyle = "0" woof.exe
Suspicious behavior: CmdExeWriteProcessMemorySpam 5 IoCs

Processes:

woof.exewoof.exewoof.exewoof.exewoof.exe

pid process

1532 woof.exe
396 woof.exe
1664 woof.exe
1668 woof.exe
240 woof.exe
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

woof.exe

pid process

240 woof.exe
Suspicious behavior: RenamesItself 1 IoCs

Processes:

cmd.exe

pid process

668 cmd.exe

pid	process
1648	vssadmin.exe
1340	vssadmin.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Control Panel\Desktop\WallpaperStyle = "0"	woof.exe

pid	process
1532	woof.exe
396	woof.exe
1664	woof.exe
1668	woof.exe
240	woof.exe

pid	process
240	woof.exe

pid	process
668	cmd.exe

Suspicious use of AdjustPrivilegeToken 46 IoCs

Processes:

WMIC.exevssvc.exevssvc.exe

description	pid	process
Token: SeIncreaseQuotaPrivilege	1372	WMIC.exe
Token: SeSecurityPrivilege	1372	WMIC.exe
Token: SeTakeOwnershipPrivilege	1372	WMIC.exe
Token: SeLoadDriverPrivilege	1372	WMIC.exe
Token: SeSystemProfilePrivilege	1372	WMIC.exe
Token: SeSystemtimePrivilege	1372	WMIC.exe
Token: SeProfSingleProcessPrivilege	1372	WMIC.exe
Token: SeIncBasePriorityPrivilege	1372	WMIC.exe
Token: SeCreatePagefilePrivilege	1372	WMIC.exe
Token: SeBackupPrivilege	1372	WMIC.exe
Token: SeRestorePrivilege	1372	WMIC.exe
Token: SeShutdownPrivilege	1372	WMIC.exe
Token: SeDebugPrivilege	1372	WMIC.exe
Token: SeSystemEnvironmentPrivilege	1372	WMIC.exe
Token: SeRemoteShutdownPrivilege	1372	WMIC.exe
Token: SeUndockPrivilege	1372	WMIC.exe
Token: SeManageVolumePrivilege	1372	WMIC.exe
Token: 33	1372	WMIC.exe
Token: 34	1372	WMIC.exe
Token: 35	1372	WMIC.exe
Token: SeIncreaseQuotaPrivilege	1372	WMIC.exe
Token: SeSecurityPrivilege	1372	WMIC.exe
Token: SeTakeOwnershipPrivilege	1372	WMIC.exe
Token: SeLoadDriverPrivilege	1372	WMIC.exe
Token: SeSystemProfilePrivilege	1372	WMIC.exe
Token: SeSystemtimePrivilege	1372	WMIC.exe
Token: SeProfSingleProcessPrivilege	1372	WMIC.exe
Token: SeIncBasePriorityPrivilege	1372	WMIC.exe
Token: SeCreatePagefilePrivilege	1372	WMIC.exe
Token: SeBackupPrivilege	1372	WMIC.exe
Token: SeRestorePrivilege	1372	WMIC.exe
Token: SeShutdownPrivilege	1372	WMIC.exe
Token: SeDebugPrivilege	1372	WMIC.exe
Token: SeSystemEnvironmentPrivilege	1372	WMIC.exe
Token: SeRemoteShutdownPrivilege	1372	WMIC.exe
Token: SeUndockPrivilege	1372	WMIC.exe
Token: SeManageVolumePrivilege	1372	WMIC.exe
Token: 33	1372	WMIC.exe
Token: 34	1372	WMIC.exe
Token: 35	1372	WMIC.exe
Token: SeBackupPrivilege	1604	vssvc.exe
Token: SeRestorePrivilege	1604	vssvc.exe
Token: SeAuditPrivilege	1604	vssvc.exe
Token: SeBackupPrivilege	1628	vssvc.exe
Token: SeRestorePrivilege	1628	vssvc.exe
Token: SeAuditPrivilege	1628	vssvc.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

cmd.exewoof.execmd.execmd.execmd.execmd.execmd.exe

description	pid	process	target process
PID 668 wrote to memory of 1532	668	cmd.exe	woof.exe
PID 668 wrote to memory of 1532	668	cmd.exe	woof.exe
PID 668 wrote to memory of 1532	668	cmd.exe	woof.exe
PID 668 wrote to memory of 1532	668	cmd.exe	woof.exe
PID 668 wrote to memory of 396	668	cmd.exe	woof.exe
PID 668 wrote to memory of 396	668	cmd.exe	woof.exe
PID 668 wrote to memory of 396	668	cmd.exe	woof.exe
PID 668 wrote to memory of 396	668	cmd.exe	woof.exe
PID 668 wrote to memory of 1664	668	cmd.exe	woof.exe
PID 668 wrote to memory of 1664	668	cmd.exe	woof.exe
PID 668 wrote to memory of 1664	668	cmd.exe	woof.exe
PID 668 wrote to memory of 1664	668	cmd.exe	woof.exe
PID 668 wrote to memory of 1668	668	cmd.exe	woof.exe
PID 668 wrote to memory of 1668	668	cmd.exe	woof.exe
PID 668 wrote to memory of 1668	668	cmd.exe	woof.exe
PID 668 wrote to memory of 1668	668	cmd.exe	woof.exe
PID 668 wrote to memory of 240	668	cmd.exe	woof.exe
PID 668 wrote to memory of 240	668	cmd.exe	woof.exe
PID 668 wrote to memory of 240	668	cmd.exe	woof.exe
PID 668 wrote to memory of 240	668	cmd.exe	woof.exe
PID 240 wrote to memory of 1164	240	woof.exe	cmd.exe
PID 240 wrote to memory of 1164	240	woof.exe	cmd.exe
PID 240 wrote to memory of 1164	240	woof.exe	cmd.exe
PID 240 wrote to memory of 1164	240	woof.exe	cmd.exe
PID 1164 wrote to memory of 1372	1164	cmd.exe	WMIC.exe
PID 1164 wrote to memory of 1372	1164	cmd.exe	WMIC.exe
PID 1164 wrote to memory of 1372	1164	cmd.exe	WMIC.exe
PID 1164 wrote to memory of 1372	1164	cmd.exe	WMIC.exe
PID 240 wrote to memory of 2016	240	woof.exe	cmd.exe
PID 240 wrote to memory of 2016	240	woof.exe	cmd.exe
PID 240 wrote to memory of 2016	240	woof.exe	cmd.exe
PID 240 wrote to memory of 2016	240	woof.exe	cmd.exe
PID 2016 wrote to memory of 1560	2016	cmd.exe	fsutil.exe
PID 2016 wrote to memory of 1560	2016	cmd.exe	fsutil.exe
PID 2016 wrote to memory of 1560	2016	cmd.exe	fsutil.exe
PID 2016 wrote to memory of 1560	2016	cmd.exe	fsutil.exe
PID 240 wrote to memory of 1748	240	woof.exe	cmd.exe
PID 240 wrote to memory of 1748	240	woof.exe	cmd.exe
PID 240 wrote to memory of 1748	240	woof.exe	cmd.exe
PID 240 wrote to memory of 1748	240	woof.exe	cmd.exe
PID 1748 wrote to memory of 1588	1748	cmd.exe	fsutil.exe
PID 1748 wrote to memory of 1588	1748	cmd.exe	fsutil.exe
PID 1748 wrote to memory of 1588	1748	cmd.exe	fsutil.exe
PID 1748 wrote to memory of 1588	1748	cmd.exe	fsutil.exe
PID 240 wrote to memory of 1736	240	woof.exe	cmd.exe
PID 240 wrote to memory of 1736	240	woof.exe	cmd.exe
PID 240 wrote to memory of 1736	240	woof.exe	cmd.exe
PID 240 wrote to memory of 1736	240	woof.exe	cmd.exe
PID 240 wrote to memory of 1920	240	woof.exe	cmd.exe
PID 240 wrote to memory of 1920	240	woof.exe	cmd.exe
PID 240 wrote to memory of 1920	240	woof.exe	cmd.exe
PID 240 wrote to memory of 1920	240	woof.exe	cmd.exe
PID 1736 wrote to memory of 1648	1736	cmd.exe	vssadmin.exe
PID 1736 wrote to memory of 1648	1736	cmd.exe	vssadmin.exe
PID 1736 wrote to memory of 1648	1736	cmd.exe	vssadmin.exe
PID 240 wrote to memory of 808	240	woof.exe	cmd.exe
PID 240 wrote to memory of 808	240	woof.exe	cmd.exe
PID 240 wrote to memory of 808	240	woof.exe	cmd.exe
PID 240 wrote to memory of 808	240	woof.exe	cmd.exe
PID 808 wrote to memory of 1556	808	cmd.exe	ARP.EXE
PID 808 wrote to memory of 1556	808	cmd.exe	ARP.EXE
PID 808 wrote to memory of 1556	808	cmd.exe	ARP.EXE
PID 808 wrote to memory of 1556	808	cmd.exe	ARP.EXE
PID 240 wrote to memory of 1944	240	woof.exe	cmd.exe

C:\Users\Admin\AppData\Local\Temp\3d7cf20ca6476e14e0a026f9bdd8ff1f26995cdc5854c3adb41a6135ef11ba83.bin.exe
"C:\Users\Admin\AppData\Local\Temp\3d7cf20ca6476e14e0a026f9bdd8ff1f26995cdc5854c3adb41a6135ef11ba83.bin.exe"
1⤵
PID:1504

C:\Windows\system32\cmd.exe
"C:\Windows\system32\cmd.exe"
1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:668

C:\Users\Admin\AppData\Local\Temp\woof.exe
woof --ui
2⤵
- Suspicious behavior: CmdExeWriteProcessMemorySpam
PID:1532

C:\Users\Admin\AppData\Local\Temp\woof.exe
woof --UI
2⤵
- Suspicious behavior: CmdExeWriteProcessMemorySpam
PID:396

C:\Users\Admin\AppData\Local\Temp\woof.exe
woof.exe -V
2⤵
- Suspicious behavior: CmdExeWriteProcessMemorySpam
PID:1664

C:\Users\Admin\AppData\Local\Temp\woof.exe
woof.exe --version
2⤵
- Suspicious behavior: CmdExeWriteProcessMemorySpam
PID:1668

C:\Users\Admin\AppData\Local\Temp\woof.exe
woof.exe -asdfadsfadsf
2⤵
- Modifies extensions of user files
- Enumerates connected drives
- Sets desktop wallpaper using registry
- Modifies Control Panel
- Suspicious behavior: CmdExeWriteProcessMemorySpam
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:240

C:\Windows\SysWOW64\cmd.exe
"cmd" /c "wmic csproduct get UUID"
3⤵
- Suspicious use of WriteProcessMemory
PID:1164

C:\Windows\SysWOW64\Wbem\WMIC.exe
wmic csproduct get UUID
4⤵
- Suspicious use of AdjustPrivilegeToken
PID:1372

C:\Windows\SysWOW64\cmd.exe
"cmd" /c "fsutil behavior set SymlinkEvaluation R2L:1"
3⤵
- Suspicious use of WriteProcessMemory
PID:2016

C:\Windows\SysWOW64\fsutil.exe
fsutil behavior set SymlinkEvaluation R2L:1
4⤵
PID:1560

C:\Windows\SysWOW64\cmd.exe
"cmd" /c "fsutil behavior set SymlinkEvaluation R2R:1"
3⤵
- Suspicious use of WriteProcessMemory
PID:1748

C:\Windows\SysWOW64\fsutil.exe
fsutil behavior set SymlinkEvaluation R2R:1
4⤵
PID:1588

C:\Windows\SysWOW64\cmd.exe
"cmd" /c "reg add HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters /v MaxMpxCt /d 65535 /t REG_DWORD /f"
3⤵
PID:1920

C:\Windows\SysWOW64\reg.exe
reg add HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters /v MaxMpxCt /d 65535 /t REG_DWORD /f
4⤵
PID:980