Overview

overview

10

Static

static

0e55ead3b8...1a.exe

windows7_x64

10

0e55ead3b8...1a.exe

windows10-2004_x64

10

Analysis

  • max time kernel
    139s
  • max time network
    158s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-en-20220112
  • submitted
    19-01-2022 18:48

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    0e55ead3b8fd305d9a54f78c7b56741a.exe

  • Size

    1.3MB

  • MD5

    0e55ead3b8fd305d9a54f78c7b56741a

  • SHA1

    f7b084e581a8dcea450c2652f8058d93797413c3

  • SHA256

    2b9838da7edb0decd32b086e47a31e8f5733b5981ad8247a2f9508e232589bff

  • SHA512

    5c3d58d1001dce6f2d23f33861e9c7fef766b7fe0a86972e9f1eeb70bfad970b02561da6b6d193cf24bc3c1aaf2a42a950fa6e5dff36386653b8aa725c9abaaa

Score
10/10
dearcrypersistenceransomwarespywarestealer

Malware Config

Extracted

Path

C:\USERS\PUBLIC\DESKTOP\README.TXT

Family

dearcry

Ransom Note
Your file has been encrypted! If you want to decrypt, please contact us. [email protected] or [email protected] And please send me the following hash! 638428e5021d4ae247b21acf9c0bf6f6

Signatures

  • DearCry

    DearCry is a ransomware first seen after the 2021 Microsoft Exchange hacks.

    ransomwaredearcry
  • Suspicious use of NtCreateProcessExOtherParentProcess 2 IoCs
  • Modifies Installed Components in the registry 2 TTPs
    persistence
  • Modifies extensions of user files 10 IoCs

    Ransomware generally changes the extension on encrypted files.

    ransomware
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Drops desktop.ini file(s) 55 IoCs
  • Enumerates connected drives 3 TTPs 1 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Program Files directory 64 IoCs
  • Program crash 4 IoCs
  • Checks SCSI registry key(s) 3 TTPs 28 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 6 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 6 IoCs
  • Modifies registry class 15 IoCs
  • Opens file in notepad (likely ransom note) 1 IoCs
    ransomware
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 27 IoCs
  • Suspicious use of FindShellTrayWindow 42 IoCs
  • Suspicious use of SendNotifyMessage 17 IoCs
  • Suspicious use of SetWindowsHookEx 5 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
      PID:2564
      • C:\Users\Admin\AppData\Local\Temp\0e55ead3b8fd305d9a54f78c7b56741a.exe
        "C:\Users\Admin\AppData\Local\Temp\0e55ead3b8fd305d9a54f78c7b56741a.exe"
        2⤵
        • Modifies extensions of user files
        • Drops desktop.ini file(s)
        • Drops file in Program Files directory
        PID:3904
      • C:\Windows\system32\WerFault.exe
        C:\Windows\system32\WerFault.exe -u -p 2564 -s 1012
        2⤵
        • Program crash
        • Checks processor information in registry
        • Enumerates system info in registry
        • Suspicious behavior: EnumeratesProcesses
        PID:4044
    • C:\Windows\system32\svchost.exe
      C:\Windows\system32\svchost.exe -k LocalService
      1⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:2872
    • C:\Windows\system32\WerFault.exe
      C:\Windows\system32\WerFault.exe -pss -s 408 -p 2564 -ip 2564
      1⤵
      • Suspicious use of NtCreateProcessExOtherParentProcess
      • Suspicious use of WriteProcessMemory
      PID:4048
    • C:\Windows\explorer.exe
      explorer.exe
      1⤵
      • Enumerates connected drives
      • Checks SCSI registry key(s)
      • Modifies registry class
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of SetWindowsHookEx
      PID:540
      • C:\Windows\system32\NOTEPAD.EXE
        "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\readme.txt
        2⤵
        • Opens file in notepad (likely ransom note)
        PID:2956
    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
      1⤵
      • Modifies registry class
      • Suspicious use of SetWindowsHookEx
      PID:1540
    • C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe
      "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe" -ServerName:InputApp.AppX9jnwykgrccxc8by3hsrsh07r423xzvav.mca
      1⤵
      • Suspicious use of SetWindowsHookEx
      PID:2260
    • C:\Windows\system32\WerFault.exe
      C:\Windows\system32\WerFault.exe -pss -s 524 -p 3052 -ip 3052
      1⤵
      • Suspicious use of NtCreateProcessExOtherParentProcess
      • Suspicious use of WriteProcessMemory
      PID:3108
    • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
      "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
      1⤵
      • Enumerates system info in registry
      • Modifies registry class
      • Suspicious use of SetWindowsHookEx
      PID:2884
    • C:\Windows\system32\WerFault.exe
      C:\Windows\system32\WerFault.exe -u -p 3052 -s 1332
      1⤵
      • Program crash
      • Checks processor information in registry
      • Enumerates system info in registry
      • Suspicious behavior: EnumeratesProcesses
      PID:2296
    • C:\Windows\system32\WerFault.exe
      C:\Windows\system32\WerFault.exe -pss -s 184 -p 3284 -ip 3284
      1⤵
        PID:1364
      • C:\Windows\system32\WerFault.exe
        C:\Windows\system32\WerFault.exe -u -p 3284 -s 1184
        1⤵
        • Program crash
        PID:3656
      • C:\Windows\system32\DllHost.exe
        C:\Windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}
        1⤵
          PID:3052
        • C:\Windows\system32\WerFault.exe
          C:\Windows\system32\WerFault.exe -pss -s 536 -p 3976 -ip 3976
          1⤵
            PID:2988
          • C:\Windows\system32\WerFault.exe
            C:\Windows\system32\WerFault.exe -u -p 3976 -s 2308
            1⤵
            • Program crash
            PID:2500

          Network

          MITRE ATT&CK Enterprise v6

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\ProgramData\Microsoft\Windows\Caches\cversions.2.db
            MD5

            4534f12102d235344cf8dda748f0cabf

            SHA1

            7db67baceeecb3a420bf37a7beca4a45185f8f3c

            SHA256

            1bd4db450abc8914c2fac721cace2704ff4c16028e6d07293154dad289835694

            SHA512

            7b4dacdbc6a2fccdd3818eb41b7fa23eeec51f333af0e842d9185c7ae45eba1623369b1caa27b824cba10c4cd6a2cdbf7f127ab2c6f7656eedce5fe25a0b84a2

            Download Submit

          • C:\USERS\PUBLIC\DESKTOP\README.TXT
            MD5

            dbac9649c4bd702f55fbd1afafe87c44

            SHA1

            0d914f4a809cfe400ca111ebfbd0ad552d500785

            SHA256

            b9dfa3b30224bd5eef298531c945d5f2f6bb978b7ef42e5ef09715a535172127

            SHA512

            86d7786b400303b1fb722689aba7e8ef6a01ad7e2776194c5d545a7d7357dd91e7079296790587210683db7f4385f98f281272fd3d1ad6770dabf401709a6415

            Download Submit

          • C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\cversions.3.db
            MD5

            4534f12102d235344cf8dda748f0cabf

            SHA1

            7db67baceeecb3a420bf37a7beca4a45185f8f3c

            SHA256

            1bd4db450abc8914c2fac721cace2704ff4c16028e6d07293154dad289835694

            SHA512

            7b4dacdbc6a2fccdd3818eb41b7fa23eeec51f333af0e842d9185c7ae45eba1623369b1caa27b824cba10c4cd6a2cdbf7f127ab2c6f7656eedce5fe25a0b84a2

            Download Submit

          • C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\{03BA58C4-B905-4D30-88C9-B63C603DA134}.3.ver0x0000000000000001.db.CRYPT
            MD5

            210e093a609cbcf00b17ddb9b9ec8d46

            SHA1

            988a195a6452f77debcf35486f7e9cd31819d315

            SHA256

            e01db2738b9023d3c8a65f87e1b1beb8dad8b10c9dd2e14875b1b1fca1df9a84

            SHA512

            28bfc02771dea7681c7426bb10cecdec338d41bedf32f1b44b00b3d5d3426734b1001615e93cfc0cfafde9a266878d97386c0aef52b3650c2aebd99f31f38cb2

            Download Submit

          • C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\{3DA71D5A-20CC-432F-A115-DFE92379E91F}.3.ver0x0000000000000026.db
            MD5

            723f979cec05a2fa548ae70376551a62

            SHA1

            75b6ac53b738ba9aad9f30f9ada677d6de5f9ae3

            SHA256

            86b1fa606a54b4a1b3fa3e786599f80b21c35ae635b46ee185fbec297c5179a4

            SHA512

            e9081bbfaca6e25f058d107e96ab7b1d3b67ce6056f24a7a58efda87e24e653ab07bfa6c61433af70e1a7d5b85cb7c5cdb29196ad066af9d7241fdd881d1116b

            Download Submit

          • C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\{3DA71D5A-20CC-432F-A115-DFE92379E91F}.3.ver0x0000000000000026.db.CRYPT
            MD5

            5b7ed79a794e1521f1e41ba3d42d6c03

            SHA1

            aef1321afd0226c8480d4a3f20b2fbe2dc2da9cb

            SHA256

            df93e307228db1ab323e5dc48a6eb7c52d9d0738817549cfc80d8f8dd950045c

            SHA512

            dbf17d62e6dea03ee684124b0c6074bd6639090a712f1fa8fd508e94da26e02ec165af7560f0c784a76e38ec13236898cf76c4867b2a6880c4208c4ac8b7d135

            Download Submit

          • C:\Users\Admin\Desktop\readme.txt
            MD5

            dbac9649c4bd702f55fbd1afafe87c44

            SHA1

            0d914f4a809cfe400ca111ebfbd0ad552d500785

            SHA256

            b9dfa3b30224bd5eef298531c945d5f2f6bb978b7ef42e5ef09715a535172127

            SHA512

            86d7786b400303b1fb722689aba7e8ef6a01ad7e2776194c5d545a7d7357dd91e7079296790587210683db7f4385f98f281272fd3d1ad6770dabf401709a6415

            Download Submit

          • memory/540-141-0x0000000002300000-0x0000000002301000-memory.dmp

            Filesize

            4KB

            Download

          • memory/2884-433-0x000001A673610000-0x000001A673618000-memory.dmp

            Filesize

            32KB

            Download