Analysis
- max time kernel
24s - max time network
27s - platform
windows10_x64 - resource
win10-en-20211208 - submitted
26/01/2022, 22:22
General
- Target kings.exe
- Size 72KB
- Sample220126-2aezbabbfq
- SHA256 36e4a3de5c4395d295bdf1d70a215d9669b626c58083ec2d8ab29513830faaa6
Score
10/10
Malware Config
Extracted
Path
-
C:\RestoreFiles.txt
Ransom Note
- Hello, friends! Your system has been compromised by our team.We have blocked your files and also uploaded useful data from your computers(doc, docx, pdf, xls and other office extensions) to our servers. You have 2 days to contact us to discuss the terms of payment for our services to restore your files.If you do not contact us or refuse to pay, we will place your stolen files in the public domain. Do not change the file namesand extensions.Do not try to decrypt the files yourself, they are encrypted using a good encryption algorithm. Main Mail: [email protected] Backup mail(if we don't reply 24 hours): [email protected] At the first contact, you can write to both emails for reliability.
Signatures
- Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
- Modifies extensions of user files 2 IoCs
Ransomware generally changes the extension on encrypted files.
- Enumerates connected drives 3 TTPs 24 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Interacts with shadow copies 2 TTPs 2 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 3 IoCs
- Suspicious use of WriteProcessMemory 8 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\kings.exe"C:\Users\Admin\AppData\Local\Temp\kings.exe"1⤵
- Modifies extensions of user files
- Enumerates connected drives
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c vssadmin.exe delete shadows /all /quiet2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\vssadmin.exevssadmin.exe delete shadows /all /quiet3⤵
- Interacts with shadow copies
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c vssadmin.exe delete shadows /all /quiet2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\vssadmin.exevssadmin.exe delete shadows /all /quiet3⤵
- Interacts with shadow copies
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken