Overview

overview

10

Static

static

0b71d4d1c7...ec.exe

windows7_x64

10

0b71d4d1c7...ec.exe

windows10_x64

10

Analysis

  • max time kernel
    128s
  • max time network
    117s
  • platform
    windows7_x64
  • resource
    win7-en-20211208
  • submitted
    24/01/2022, 07:00

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    0b71d4d1c712ea86e949ea7e9d22eaec.exe
  • Size 835KB
  • Sample220124-hsn56adfcl
  • SHA256 5c90dc8a2bebed531a198159e4fc02c11aabf4a53eb6ce1036795db807e0fe44
  • MD5 SHA1 SHA512
Score
10/10
evasionpersistenceransomware

Malware Config

Extracted

Path

  • \??\M:\Boot\cs-CZ\Read_Me.txt

Ransom Note
  • Attention! All your files, documents, photos, databases and other important files are encrypted The only method of recovering files is to purchase an unique decryptor. Only we can give you this decryptor and only we can recover your files. The server with your decryptor is in a closed network TOR. You can get there by the following ways: ---------------------------------------------------------------------------------------- 1. Download Tor browser - https://www.torproject.org/ 2. Install Tor browser 3. Open Tor Browser 4. Open link in TOR browser: http://mmeeiix2ejdwkmseycljetmpiwebdvgjts75c63camjofn2cjdoulzqd.onion/?101DDDDDDDD 5. and open ticket ---------------------------------------------------------------------------------------- Alternate communication channel here: https://yip.su/2QstD5
URLs

  • http://mmeeiix2ejdwkmseycljetmpiwebdvgjts75c63camjofn2cjdoulzqd.onion/?101DDDDDDDD

  • https://yip.su/2QstD5

Signatures

  • Looks for VirtualBox Guest Additions in registry 2 TTPs
    evasion
  • Looks for VMWare Tools registry key 2 TTPs
    evasion
  • Modifies Installed Components in the registry 2 TTPs
    persistence
  • Modifies extensions of user files 4 IoCs

    Ransomware generally changes the extension on encrypted files.

    ransomware
  • Checks BIOS information in registry 2 TTPs 2 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Drops desktop.ini file(s) 48 IoCs
  • Enumerates connected drives 3 TTPs 24 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Maps connected drives based on registry 3 TTPs 2 IoCs

    Disk information is often read in order to detect sandboxing environments.

  • Suspicious use of SetThreadContext 1 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Modifies registry class 15 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 3 IoCs
  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 29 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 55 IoCs
  • Suspicious use of WriteProcessMemory 14 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\0b71d4d1c712ea86e949ea7e9d22eaec.exe
    "C:\Users\Admin\AppData\Local\Temp\0b71d4d1c712ea86e949ea7e9d22eaec.exe"
    1⤵
    • Checks BIOS information in registry
    • Maps connected drives based on registry
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:964
    • C:\Windows\SysWOW64\setup16.exe
      "C:\Windows\SysWOW64\setup16.exe"
      2⤵
      • Modifies extensions of user files
      • Drops desktop.ini file(s)
      • Enumerates connected drives
      • Drops file in Program Files directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: RenamesItself
      PID:1204
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Drops desktop.ini file(s)
    • Modifies registry class
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    PID:1508
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Modifies registry class
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    PID:1176
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Modifies registry class
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    PID:924

Network

        MITRE ATT&CK Enterprise v6

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        memory/924-117-0x0000000004090000-0x0000000004191000-memory.dmp
        Download

        memory/964-56-0x0000000000C40000-0x0000000000C41000-memory.dmp
        Download

        memory/964-55-0x0000000000270000-0x0000000000284000-memory.dmp
        Download

        memory/964-53-0x0000000001370000-0x0000000001446000-memory.dmp
        Download

        memory/964-54-0x0000000000A80000-0x0000000000B28000-memory.dmp
        Download

        memory/1176-77-0x000007FEF83D1000-0x000007FEF83D3000-memory.dmp
        Download

        memory/1204-61-0x0000000000400000-0x000000000041F000-memory.dmp
        Download

        memory/1204-60-0x0000000000400000-0x000000000041F000-memory.dmp
        Download

        memory/1204-58-0x0000000000400000-0x000000000041F000-memory.dmp
        Download

        memory/1204-62-0x0000000000400000-0x000000000041F000-memory.dmp
        Download

        memory/1204-63-0x0000000000400000-0x000000000041F000-memory.dmp
        Download

        memory/1204-64-0x0000000075D61000-0x0000000075D63000-memory.dmp
        Download

        memory/1204-65-0x0000000000400000-0x000000000041F000-memory.dmp
        Download

        memory/1204-66-0x0000000000400000-0x000000000041F000-memory.dmp
        Download

        memory/1204-59-0x0000000000400000-0x000000000041F000-memory.dmp
        Download

        memory/1204-57-0x0000000000400000-0x000000000041F000-memory.dmp
        Download

        memory/1508-69-0x000007FEFB161000-0x000007FEFB163000-memory.dmp
        Download