Analysis
- max time kernel
63s - max time network
125s - platform
windows10_x64 - resource
win10-en-20211208 - submitted
24/01/2022, 07:00
Static task
static1
Behavioral task
behavioral1
Sample
0b71d4d1c712ea86e949ea7e9d22eaec.exe
Resource
win7-en-20211208
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
0b71d4d1c712ea86e949ea7e9d22eaec.exe
Resource
win10-en-20211208
windows10_x64
0 signatures
0 seconds
General
- Target 0b71d4d1c712ea86e949ea7e9d22eaec.exe
- Size 835KB
- Sample220124-hsn56adfcl
- SHA256 5c90dc8a2bebed531a198159e4fc02c11aabf4a53eb6ce1036795db807e0fe44
- MD5 0b71d4d1c712ea86e949ea7e9d22eaec
- SHA1 c079555c39aff8fcb83174fc7785fb1fae2a4bdd
- SHA512 0404fb1ceaa471ee12b2e8f81f32e88fb6598927e090ae83f8ac7202ffc3712cc47ccf7b7b03ff209c56686d9d29bcd04e1d0a4dd59c74685c06bd4416863b24
- MD5 SHA1 SHA512
Score
10/10
Malware Config
Extracted
Path
-
\??\M:\Boot\bg-BG\Read_Me.txt
Ransom Note
- Attention! All your files, documents, photos, databases and other important files are encrypted The only method of recovering files is to purchase an unique decryptor. Only we can give you this decryptor and only we can recover your files. The server with your decryptor is in a closed network TOR. You can get there by the following ways: ---------------------------------------------------------------------------------------- 1. Download Tor browser - https://www.torproject.org/ 2. Install Tor browser 3. Open Tor Browser 4. Open link in TOR browser: http://mmeeiix2ejdwkmseycljetmpiwebdvgjts75c63camjofn2cjdoulzqd.onion/?101NFGIKLNO 5. and open ticket ---------------------------------------------------------------------------------------- Alternate communication channel here: https://yip.su/2QstD5
URLs
-
http://mmeeiix2ejdwkmseycljetmpiwebdvgjts75c63camjofn2cjdoulzqd.onion/?101NFGIKLNO
-
https://yip.su/2QstD5
Signatures
- Looks for VirtualBox Guest Additions in registry 2 TTPs
- Looks for VMWare Tools registry key 2 TTPs
- Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion 0b71d4d1c712ea86e949ea7e9d22eaec.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion 0b71d4d1c712ea86e949ea7e9d22eaec.exe - Drops desktop.ini file(s) 3 IoCs
description ioc Process File opened for modification C:\Program Files\Common Files\microsoft shared\Stationery\Desktop.ini shrpubw.exe File opened for modification C:\Program Files\desktop.ini shrpubw.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\DataServices\DESKTOP.INI shrpubw.exe - Enumerates connected drives 3 TTPs 24 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\F: shrpubw.exe File opened (read-only) \??\B: shrpubw.exe File opened (read-only) \??\Q: shrpubw.exe File opened (read-only) \??\W: shrpubw.exe File opened (read-only) \??\I: shrpubw.exe File opened (read-only) \??\K: shrpubw.exe File opened (read-only) \??\V: shrpubw.exe File opened (read-only) \??\N: shrpubw.exe File opened (read-only) \??\H: shrpubw.exe File opened (read-only) \??\T: shrpubw.exe File opened (read-only) \??\Y: shrpubw.exe File opened (read-only) \??\O: shrpubw.exe File opened (read-only) \??\P: shrpubw.exe File opened (read-only) \??\A: shrpubw.exe File opened (read-only) \??\S: shrpubw.exe File opened (read-only) \??\G: shrpubw.exe File opened (read-only) \??\Z: shrpubw.exe File opened (read-only) \??\M: shrpubw.exe File opened (read-only) \??\E: shrpubw.exe File opened (read-only) \??\R: shrpubw.exe File opened (read-only) \??\U: shrpubw.exe File opened (read-only) \??\J: shrpubw.exe File opened (read-only) \??\L: shrpubw.exe File opened (read-only) \??\X: shrpubw.exe - Maps connected drives based on registry 3 TTPs 2 IoCs
Disk information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum 0b71d4d1c712ea86e949ea7e9d22eaec.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum\0 0b71d4d1c712ea86e949ea7e9d22eaec.exe - Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2568 set thread context of 2460 2568 0b71d4d1c712ea86e949ea7e9d22eaec.exe 69 - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\p2\org.eclipse.equinox.p2.engine\profileRegistry\JMC.profile\1423496939244.profile.gz shrpubw.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\lib\rt.jar shrpubw.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ExcelVL_MAK-ul-phn.xrm-ms shrpubw.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\QuickStyles\linessimple.dotx shrpubw.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\video_chroma\libi420_10_p010_plugin.dll shrpubw.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdXC2RVL_MAKC2R-pl.xrm-ms shrpubw.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\api-ms-win-core-file-l1-2-0.dll shrpubw.exe File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\Microsoft.Build.Engine.dll shrpubw.exe File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsMaps_5.1611.10393.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\Images\Ratings\Yelp3.scale-125.png shrpubw.exe File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsMaps_5.1611.10393.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\SecondaryTiles\Work\contrast-white\LargeTile.scale-125.png shrpubw.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\Assets\LoadIconRTL_contrast-black.png shrpubw.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\lib\tzmappings shrpubw.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ODBCTRAC.DLL shrpubw.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\pkeyconfig-office.xrm-ms shrpubw.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\BLUEPRNT\PREVIEW.GIF shrpubw.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\bn_IN\LC_MESSAGES\vlc.mo shrpubw.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppPackageAppList.targetsize-72_contrast-white.png shrpubw.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.nb-no.dll shrpubw.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\xjc.exe shrpubw.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.babel.nls_eclipse_ja_4.4.0.v20140623020002\about.html shrpubw.exe File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsMaps_5.1611.10393.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Home\RTL\contrast-black\WideTile.scale-125.png shrpubw.exe File created C:\Program Files\WindowsApps\Microsoft.BingWeather_4.18.56.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\AppTiles\contrast-black\Read_Me.txt shrpubw.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\Assets\AppTiles\Weather_TileSmallSquare.scale-200.png shrpubw.exe File created C:\Program Files\WindowsApps\Microsoft.Messaging_3.26.24002.0_x64__8wekyb3d8bbwe\Assets\Sounds\Read_Me.txt shrpubw.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.hr-hr.dll shrpubw.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\gstreamer-lite.dll shrpubw.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdVL_KMS_Client-ul-oob.xrm-ms shrpubw.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\Word2019R_Grace-ppd.xrm-ms shrpubw.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\lib\sound.properties shrpubw.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\modules\org-netbeans-api-search.jar shrpubw.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusEDUR_Subscription-ppd.xrm-ms shrpubw.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\TRANSLAT\ESEN\Read_Me.txt shrpubw.exe File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.XboxApp_25.25.13009.0_neutral_split.scale-200_8wekyb3d8bbwe\Assets\GamesXboxHubAppList.scale-200_contrast-white.png shrpubw.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\Publisher2019R_Retail-ul-oob.xrm-ms shrpubw.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\INTLDATE.DLL shrpubw.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\DataModel\Microsoft.Excel.Amo.Core.dll shrpubw.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Messaging_3.26.24002.0_x64__8wekyb3d8bbwe\Microsoft.People.Relevance.winmd shrpubw.exe File opened for modification C:\Program Files\Common Files\System\DirectDB.dll shrpubw.exe File created C:\Program Files\VideoLAN\VLC\locale\kk\LC_MESSAGES\Read_Me.txt shrpubw.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Messaging_3.26.24002.0_x64__8wekyb3d8bbwe\Assets\starttile.dualsim2.sad.small.scale-200.png shrpubw.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\sv-SE\tipresx.dll.mui shrpubw.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\orbd.exe shrpubw.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.core.commands.nl_zh_4.4.0.v20140623020002.jar shrpubw.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\MondoR_BypassTrial180-ppd.xrm-ms shrpubw.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019MSDNR_Retail-ul-phn.xrm-ms shrpubw.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\api-ms-win-crt-locale-l1-1-0.dll shrpubw.exe File created C:\Program Files\VideoLAN\VLC\locale\ar\LC_MESSAGES\Read_Me.txt shrpubw.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogoSmall.contrast-white_scale-80.png shrpubw.exe File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsMaps_5.1611.10393.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\AppTiles\MapsSmallTile.scale-125.png shrpubw.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\Assets\GetStartedAppList.targetsize-96_altform-unplated.png shrpubw.exe File created C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\com.jrockit.mc.feature.core_5.5.0.165303\Read_Me.txt shrpubw.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusiness2019R_Retail-ppd.xrm-ms shrpubw.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\STSLIST.DLL shrpubw.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\RMNSQUE\Read_Me.txt shrpubw.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\WISC30.DLL shrpubw.exe File opened for modification C:\Program Files\VideoLAN\VLC\Documentation.url shrpubw.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\video_filter\libgradient_plugin.dll shrpubw.exe File opened for modification C:\Program Files\Microsoft Office\root\Client\api-ms-win-core-localization-l1-2-0.dll shrpubw.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019R_OEM_Perp-pl.xrm-ms shrpubw.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\Bibliography\Style\GB.XSL shrpubw.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\LogoImages\PowerPntLogoSmall.contrast-white_scale-140.png shrpubw.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\video_output\libglwin32_plugin.dll shrpubw.exe File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsMaps_5.1611.10393.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Place\LTR\contrast-white\WideTile.scale-125.png shrpubw.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\Assets\AppTiles\WeatherIcons\30x30\187.png shrpubw.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2568 0b71d4d1c712ea86e949ea7e9d22eaec.exe 2568 0b71d4d1c712ea86e949ea7e9d22eaec.exe 2568 0b71d4d1c712ea86e949ea7e9d22eaec.exe 2568 0b71d4d1c712ea86e949ea7e9d22eaec.exe 2568 0b71d4d1c712ea86e949ea7e9d22eaec.exe 2568 0b71d4d1c712ea86e949ea7e9d22eaec.exe 2568 0b71d4d1c712ea86e949ea7e9d22eaec.exe 2568 0b71d4d1c712ea86e949ea7e9d22eaec.exe 2568 0b71d4d1c712ea86e949ea7e9d22eaec.exe 2568 0b71d4d1c712ea86e949ea7e9d22eaec.exe 2460 shrpubw.exe 2460 shrpubw.exe 2460 shrpubw.exe 2460 shrpubw.exe 2460 shrpubw.exe 2460 shrpubw.exe 2460 shrpubw.exe 2460 shrpubw.exe 2460 shrpubw.exe 2460 shrpubw.exe 2460 shrpubw.exe 2460 shrpubw.exe 2460 shrpubw.exe 2460 shrpubw.exe 2460 shrpubw.exe 2460 shrpubw.exe 2460 shrpubw.exe 2460 shrpubw.exe 2460 shrpubw.exe 2460 shrpubw.exe 2460 shrpubw.exe 2460 shrpubw.exe 2460 shrpubw.exe 2460 shrpubw.exe 2460 shrpubw.exe 2460 shrpubw.exe 2460 shrpubw.exe 2460 shrpubw.exe 2460 shrpubw.exe 2460 shrpubw.exe 2460 shrpubw.exe 2460 shrpubw.exe 2460 shrpubw.exe 2460 shrpubw.exe 2460 shrpubw.exe 2460 shrpubw.exe 2460 shrpubw.exe 2460 shrpubw.exe 2460 shrpubw.exe 2460 shrpubw.exe 2460 shrpubw.exe 2460 shrpubw.exe 2460 shrpubw.exe 2460 shrpubw.exe 2460 shrpubw.exe 2460 shrpubw.exe 2460 shrpubw.exe 2460 shrpubw.exe 2460 shrpubw.exe 2460 shrpubw.exe 2460 shrpubw.exe 2460 shrpubw.exe 2460 shrpubw.exe 2460 shrpubw.exe - Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2568 0b71d4d1c712ea86e949ea7e9d22eaec.exe - Suspicious use of WriteProcessMemory 10 IoCs
description pid Process procid_target PID 2568 wrote to memory of 2460 2568 0b71d4d1c712ea86e949ea7e9d22eaec.exe 69 PID 2568 wrote to memory of 2460 2568 0b71d4d1c712ea86e949ea7e9d22eaec.exe 69 PID 2568 wrote to memory of 2460 2568 0b71d4d1c712ea86e949ea7e9d22eaec.exe 69 PID 2568 wrote to memory of 2460 2568 0b71d4d1c712ea86e949ea7e9d22eaec.exe 69 PID 2568 wrote to memory of 2460 2568 0b71d4d1c712ea86e949ea7e9d22eaec.exe 69 PID 2568 wrote to memory of 2460 2568 0b71d4d1c712ea86e949ea7e9d22eaec.exe 69 PID 2568 wrote to memory of 2460 2568 0b71d4d1c712ea86e949ea7e9d22eaec.exe 69 PID 2568 wrote to memory of 2460 2568 0b71d4d1c712ea86e949ea7e9d22eaec.exe 69 PID 2568 wrote to memory of 2460 2568 0b71d4d1c712ea86e949ea7e9d22eaec.exe 69 PID 2568 wrote to memory of 2460 2568 0b71d4d1c712ea86e949ea7e9d22eaec.exe 69
Processes
-
C:\Users\Admin\AppData\Local\Temp\0b71d4d1c712ea86e949ea7e9d22eaec.exe"C:\Users\Admin\AppData\Local\Temp\0b71d4d1c712ea86e949ea7e9d22eaec.exe"1⤵
- Checks BIOS information in registry
- Maps connected drives based on registry
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2568 -
C:\Windows\SysWOW64\shrpubw.exe"C:\Windows\SysWOW64\shrpubw.exe"2⤵
- Drops desktop.ini file(s)
- Enumerates connected drives
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
PID:2460
-
-
C:\Windows\explorer.exeexplorer.exe1⤵PID:1100