Analysis
-
max time kernel
117s -
max time network
117s -
platform
windows7_x64 -
resource
win7-en-20211208 -
submitted
28-01-2022 17:16
Static task
static1
Behavioral task
behavioral1
Sample
ffe577ed01255bf462c0257a2333e6a0c1cf3472c92171885fdad45ae958e56d.exe
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
ffe577ed01255bf462c0257a2333e6a0c1cf3472c92171885fdad45ae958e56d.exe
Resource
win10-en-20211208
General
-
Target
ffe577ed01255bf462c0257a2333e6a0c1cf3472c92171885fdad45ae958e56d.exe
-
Size
139KB
-
MD5
e66baf5880f9749f87acc02e35a0bf33
-
SHA1
d12198f570ca3c1febe9974d4ce7934e71458144
-
SHA256
ffe577ed01255bf462c0257a2333e6a0c1cf3472c92171885fdad45ae958e56d
-
SHA512
e4b857fb1f786e990eaef6f7c728ef54dc34a676bb8dec09255d8502e2601e0184913e7de463c7881eb6fb29632639dcc3c12984cb5a472a6f36bc0288e199a7
Malware Config
Extracted
C:\XSRSPX-DECRYPT.txt
http://gandcrabmfe6mnef.onion/adaf9d71dc371955
Signatures
-
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Modifies extensions of user files 10 IoCs
Ransomware generally changes the extension on encrypted files.
Processes:
ffe577ed01255bf462c0257a2333e6a0c1cf3472c92171885fdad45ae958e56d.exedescription ioc process File renamed C:\Users\Admin\Pictures\BlockSkip.crw => C:\Users\Admin\Pictures\BlockSkip.crw.xsrspx ffe577ed01255bf462c0257a2333e6a0c1cf3472c92171885fdad45ae958e56d.exe File renamed C:\Users\Admin\Pictures\BlockSync.png => C:\Users\Admin\Pictures\BlockSync.png.xsrspx ffe577ed01255bf462c0257a2333e6a0c1cf3472c92171885fdad45ae958e56d.exe File renamed C:\Users\Admin\Pictures\MountLimit.png => C:\Users\Admin\Pictures\MountLimit.png.xsrspx ffe577ed01255bf462c0257a2333e6a0c1cf3472c92171885fdad45ae958e56d.exe File renamed C:\Users\Admin\Pictures\SetExit.crw => C:\Users\Admin\Pictures\SetExit.crw.xsrspx ffe577ed01255bf462c0257a2333e6a0c1cf3472c92171885fdad45ae958e56d.exe File renamed C:\Users\Admin\Pictures\UnprotectSubmit.crw => C:\Users\Admin\Pictures\UnprotectSubmit.crw.xsrspx ffe577ed01255bf462c0257a2333e6a0c1cf3472c92171885fdad45ae958e56d.exe File renamed C:\Users\Admin\Pictures\ExpandUnlock.crw => C:\Users\Admin\Pictures\ExpandUnlock.crw.xsrspx ffe577ed01255bf462c0257a2333e6a0c1cf3472c92171885fdad45ae958e56d.exe File opened for modification C:\Users\Admin\Pictures\GrantReceive.tiff ffe577ed01255bf462c0257a2333e6a0c1cf3472c92171885fdad45ae958e56d.exe File renamed C:\Users\Admin\Pictures\GrantReceive.tiff => C:\Users\Admin\Pictures\GrantReceive.tiff.xsrspx ffe577ed01255bf462c0257a2333e6a0c1cf3472c92171885fdad45ae958e56d.exe File renamed C:\Users\Admin\Pictures\TestConfirm.tif => C:\Users\Admin\Pictures\TestConfirm.tif.xsrspx ffe577ed01255bf462c0257a2333e6a0c1cf3472c92171885fdad45ae958e56d.exe File renamed C:\Users\Admin\Pictures\UpdateUninstall.tif => C:\Users\Admin\Pictures\UpdateUninstall.tif.xsrspx ffe577ed01255bf462c0257a2333e6a0c1cf3472c92171885fdad45ae958e56d.exe -
Deletes itself 1 IoCs
Processes:
cmd.exepid process 740 cmd.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Enumerates connected drives 3 TTPs 24 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
ffe577ed01255bf462c0257a2333e6a0c1cf3472c92171885fdad45ae958e56d.exedescription ioc process File opened (read-only) \??\E: ffe577ed01255bf462c0257a2333e6a0c1cf3472c92171885fdad45ae958e56d.exe File opened (read-only) \??\F: ffe577ed01255bf462c0257a2333e6a0c1cf3472c92171885fdad45ae958e56d.exe File opened (read-only) \??\I: ffe577ed01255bf462c0257a2333e6a0c1cf3472c92171885fdad45ae958e56d.exe File opened (read-only) \??\L: ffe577ed01255bf462c0257a2333e6a0c1cf3472c92171885fdad45ae958e56d.exe File opened (read-only) \??\M: ffe577ed01255bf462c0257a2333e6a0c1cf3472c92171885fdad45ae958e56d.exe File opened (read-only) \??\N: ffe577ed01255bf462c0257a2333e6a0c1cf3472c92171885fdad45ae958e56d.exe File opened (read-only) \??\O: ffe577ed01255bf462c0257a2333e6a0c1cf3472c92171885fdad45ae958e56d.exe File opened (read-only) \??\B: ffe577ed01255bf462c0257a2333e6a0c1cf3472c92171885fdad45ae958e56d.exe File opened (read-only) \??\T: ffe577ed01255bf462c0257a2333e6a0c1cf3472c92171885fdad45ae958e56d.exe File opened (read-only) \??\G: ffe577ed01255bf462c0257a2333e6a0c1cf3472c92171885fdad45ae958e56d.exe File opened (read-only) \??\K: ffe577ed01255bf462c0257a2333e6a0c1cf3472c92171885fdad45ae958e56d.exe File opened (read-only) \??\P: ffe577ed01255bf462c0257a2333e6a0c1cf3472c92171885fdad45ae958e56d.exe File opened (read-only) \??\R: ffe577ed01255bf462c0257a2333e6a0c1cf3472c92171885fdad45ae958e56d.exe File opened (read-only) \??\Z: ffe577ed01255bf462c0257a2333e6a0c1cf3472c92171885fdad45ae958e56d.exe File opened (read-only) \??\A: ffe577ed01255bf462c0257a2333e6a0c1cf3472c92171885fdad45ae958e56d.exe File opened (read-only) \??\J: ffe577ed01255bf462c0257a2333e6a0c1cf3472c92171885fdad45ae958e56d.exe File opened (read-only) \??\S: ffe577ed01255bf462c0257a2333e6a0c1cf3472c92171885fdad45ae958e56d.exe File opened (read-only) \??\V: ffe577ed01255bf462c0257a2333e6a0c1cf3472c92171885fdad45ae958e56d.exe File opened (read-only) \??\X: ffe577ed01255bf462c0257a2333e6a0c1cf3472c92171885fdad45ae958e56d.exe File opened (read-only) \??\H: ffe577ed01255bf462c0257a2333e6a0c1cf3472c92171885fdad45ae958e56d.exe File opened (read-only) \??\U: ffe577ed01255bf462c0257a2333e6a0c1cf3472c92171885fdad45ae958e56d.exe File opened (read-only) \??\W: ffe577ed01255bf462c0257a2333e6a0c1cf3472c92171885fdad45ae958e56d.exe File opened (read-only) \??\Y: ffe577ed01255bf462c0257a2333e6a0c1cf3472c92171885fdad45ae958e56d.exe File opened (read-only) \??\Q: ffe577ed01255bf462c0257a2333e6a0c1cf3472c92171885fdad45ae958e56d.exe -
Sets desktop wallpaper using registry 2 TTPs 1 IoCs
Processes:
ffe577ed01255bf462c0257a2333e6a0c1cf3472c92171885fdad45ae958e56d.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2329389628-4064185017-3901522362-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\\\pidor.bmp" ffe577ed01255bf462c0257a2333e6a0c1cf3472c92171885fdad45ae958e56d.exe -
Drops file in Program Files directory 38 IoCs
Processes:
ffe577ed01255bf462c0257a2333e6a0c1cf3472c92171885fdad45ae958e56d.exedescription ioc process File opened for modification C:\Program Files\ReceiveWatch.aifc ffe577ed01255bf462c0257a2333e6a0c1cf3472c92171885fdad45ae958e56d.exe File created C:\Program Files (x86)\Microsoft SQL Server Compact Edition\XSRSPX-DECRYPT.txt ffe577ed01255bf462c0257a2333e6a0c1cf3472c92171885fdad45ae958e56d.exe File created C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\XSRSPX-DECRYPT.txt ffe577ed01255bf462c0257a2333e6a0c1cf3472c92171885fdad45ae958e56d.exe File opened for modification C:\Program Files\ApproveRestore.dot ffe577ed01255bf462c0257a2333e6a0c1cf3472c92171885fdad45ae958e56d.exe File opened for modification C:\Program Files\GrantDisable.AAC ffe577ed01255bf462c0257a2333e6a0c1cf3472c92171885fdad45ae958e56d.exe File opened for modification C:\Program Files\GrantStop.dot ffe577ed01255bf462c0257a2333e6a0c1cf3472c92171885fdad45ae958e56d.exe File opened for modification C:\Program Files\ReadConnect.m4v ffe577ed01255bf462c0257a2333e6a0c1cf3472c92171885fdad45ae958e56d.exe File opened for modification C:\Program Files\RegisterConnect.vdw ffe577ed01255bf462c0257a2333e6a0c1cf3472c92171885fdad45ae958e56d.exe File opened for modification C:\Program Files\UndoUnblock.001 ffe577ed01255bf462c0257a2333e6a0c1cf3472c92171885fdad45ae958e56d.exe File opened for modification C:\Program Files\PopRepair.m1v ffe577ed01255bf462c0257a2333e6a0c1cf3472c92171885fdad45ae958e56d.exe File created C:\Program Files (x86)\XSRSPX-DECRYPT.txt ffe577ed01255bf462c0257a2333e6a0c1cf3472c92171885fdad45ae958e56d.exe File created C:\Program Files (x86)\dc371eb6dc371952214.lock ffe577ed01255bf462c0257a2333e6a0c1cf3472c92171885fdad45ae958e56d.exe File opened for modification C:\Program Files\DenyGroup.php ffe577ed01255bf462c0257a2333e6a0c1cf3472c92171885fdad45ae958e56d.exe File opened for modification C:\Program Files\ExportBackup.ps1 ffe577ed01255bf462c0257a2333e6a0c1cf3472c92171885fdad45ae958e56d.exe File opened for modification C:\Program Files\MergeUninstall.wdp ffe577ed01255bf462c0257a2333e6a0c1cf3472c92171885fdad45ae958e56d.exe File opened for modification C:\Program Files\PushRemove.pot ffe577ed01255bf462c0257a2333e6a0c1cf3472c92171885fdad45ae958e56d.exe File created C:\Program Files (x86)\Microsoft SQL Server Compact Edition\dc371eb6dc371952214.lock ffe577ed01255bf462c0257a2333e6a0c1cf3472c92171885fdad45ae958e56d.exe File opened for modification C:\Program Files\RequestGrant.html ffe577ed01255bf462c0257a2333e6a0c1cf3472c92171885fdad45ae958e56d.exe File opened for modification C:\Program Files\RestoreResume.wma ffe577ed01255bf462c0257a2333e6a0c1cf3472c92171885fdad45ae958e56d.exe File opened for modification C:\Program Files\UnblockClear.3g2 ffe577ed01255bf462c0257a2333e6a0c1cf3472c92171885fdad45ae958e56d.exe File created C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\dc371eb6dc371952214.lock ffe577ed01255bf462c0257a2333e6a0c1cf3472c92171885fdad45ae958e56d.exe File opened for modification C:\Program Files\BackupMerge.iso ffe577ed01255bf462c0257a2333e6a0c1cf3472c92171885fdad45ae958e56d.exe File opened for modification C:\Program Files\InvokeClear.M2T ffe577ed01255bf462c0257a2333e6a0c1cf3472c92171885fdad45ae958e56d.exe File opened for modification C:\Program Files\OutEdit.emf ffe577ed01255bf462c0257a2333e6a0c1cf3472c92171885fdad45ae958e56d.exe File opened for modification C:\Program Files\ResetUninstall.tiff ffe577ed01255bf462c0257a2333e6a0c1cf3472c92171885fdad45ae958e56d.exe File created C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\Desktop\dc371eb6dc371952214.lock ffe577ed01255bf462c0257a2333e6a0c1cf3472c92171885fdad45ae958e56d.exe File created C:\Program Files\dc371eb6dc371952214.lock ffe577ed01255bf462c0257a2333e6a0c1cf3472c92171885fdad45ae958e56d.exe File opened for modification C:\Program Files\DisconnectRequest.vbs ffe577ed01255bf462c0257a2333e6a0c1cf3472c92171885fdad45ae958e56d.exe File opened for modification C:\Program Files\LimitRevoke.kix ffe577ed01255bf462c0257a2333e6a0c1cf3472c92171885fdad45ae958e56d.exe File opened for modification C:\Program Files\RepairUnpublish.M2TS ffe577ed01255bf462c0257a2333e6a0c1cf3472c92171885fdad45ae958e56d.exe File created C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\Desktop\XSRSPX-DECRYPT.txt ffe577ed01255bf462c0257a2333e6a0c1cf3472c92171885fdad45ae958e56d.exe File created C:\Program Files\XSRSPX-DECRYPT.txt ffe577ed01255bf462c0257a2333e6a0c1cf3472c92171885fdad45ae958e56d.exe File opened for modification C:\Program Files\OpenRemove.m3u ffe577ed01255bf462c0257a2333e6a0c1cf3472c92171885fdad45ae958e56d.exe File opened for modification C:\Program Files\PingSkip.ppsx ffe577ed01255bf462c0257a2333e6a0c1cf3472c92171885fdad45ae958e56d.exe File opened for modification C:\Program Files\StopExport.zip ffe577ed01255bf462c0257a2333e6a0c1cf3472c92171885fdad45ae958e56d.exe File opened for modification C:\Program Files\InstallClose.au3 ffe577ed01255bf462c0257a2333e6a0c1cf3472c92171885fdad45ae958e56d.exe File opened for modification C:\Program Files\RemoveWatch.odt ffe577ed01255bf462c0257a2333e6a0c1cf3472c92171885fdad45ae958e56d.exe File opened for modification C:\Program Files\SendCompress.AAC ffe577ed01255bf462c0257a2333e6a0c1cf3472c92171885fdad45ae958e56d.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
ffe577ed01255bf462c0257a2333e6a0c1cf3472c92171885fdad45ae958e56d.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 ffe577ed01255bf462c0257a2333e6a0c1cf3472c92171885fdad45ae958e56d.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString ffe577ed01255bf462c0257a2333e6a0c1cf3472c92171885fdad45ae958e56d.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier ffe577ed01255bf462c0257a2333e6a0c1cf3472c92171885fdad45ae958e56d.exe -
Delays execution with timeout.exe 1 IoCs
Processes:
timeout.exepid process 1764 timeout.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
ffe577ed01255bf462c0257a2333e6a0c1cf3472c92171885fdad45ae958e56d.exepid process 1524 ffe577ed01255bf462c0257a2333e6a0c1cf3472c92171885fdad45ae958e56d.exe 1524 ffe577ed01255bf462c0257a2333e6a0c1cf3472c92171885fdad45ae958e56d.exe -
Suspicious use of AdjustPrivilegeToken 43 IoCs
Processes:
wmic.exevssvc.exedescription pid process Token: SeIncreaseQuotaPrivilege 564 wmic.exe Token: SeSecurityPrivilege 564 wmic.exe Token: SeTakeOwnershipPrivilege 564 wmic.exe Token: SeLoadDriverPrivilege 564 wmic.exe Token: SeSystemProfilePrivilege 564 wmic.exe Token: SeSystemtimePrivilege 564 wmic.exe Token: SeProfSingleProcessPrivilege 564 wmic.exe Token: SeIncBasePriorityPrivilege 564 wmic.exe Token: SeCreatePagefilePrivilege 564 wmic.exe Token: SeBackupPrivilege 564 wmic.exe Token: SeRestorePrivilege 564 wmic.exe Token: SeShutdownPrivilege 564 wmic.exe Token: SeDebugPrivilege 564 wmic.exe Token: SeSystemEnvironmentPrivilege 564 wmic.exe Token: SeRemoteShutdownPrivilege 564 wmic.exe Token: SeUndockPrivilege 564 wmic.exe Token: SeManageVolumePrivilege 564 wmic.exe Token: 33 564 wmic.exe Token: 34 564 wmic.exe Token: 35 564 wmic.exe Token: SeIncreaseQuotaPrivilege 564 wmic.exe Token: SeSecurityPrivilege 564 wmic.exe Token: SeTakeOwnershipPrivilege 564 wmic.exe Token: SeLoadDriverPrivilege 564 wmic.exe Token: SeSystemProfilePrivilege 564 wmic.exe Token: SeSystemtimePrivilege 564 wmic.exe Token: SeProfSingleProcessPrivilege 564 wmic.exe Token: SeIncBasePriorityPrivilege 564 wmic.exe Token: SeCreatePagefilePrivilege 564 wmic.exe Token: SeBackupPrivilege 564 wmic.exe Token: SeRestorePrivilege 564 wmic.exe Token: SeShutdownPrivilege 564 wmic.exe Token: SeDebugPrivilege 564 wmic.exe Token: SeSystemEnvironmentPrivilege 564 wmic.exe Token: SeRemoteShutdownPrivilege 564 wmic.exe Token: SeUndockPrivilege 564 wmic.exe Token: SeManageVolumePrivilege 564 wmic.exe Token: 33 564 wmic.exe Token: 34 564 wmic.exe Token: 35 564 wmic.exe Token: SeBackupPrivilege 1052 vssvc.exe Token: SeRestorePrivilege 1052 vssvc.exe Token: SeAuditPrivilege 1052 vssvc.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
ffe577ed01255bf462c0257a2333e6a0c1cf3472c92171885fdad45ae958e56d.execmd.exedescription pid process target process PID 1524 wrote to memory of 564 1524 ffe577ed01255bf462c0257a2333e6a0c1cf3472c92171885fdad45ae958e56d.exe wmic.exe PID 1524 wrote to memory of 564 1524 ffe577ed01255bf462c0257a2333e6a0c1cf3472c92171885fdad45ae958e56d.exe wmic.exe PID 1524 wrote to memory of 564 1524 ffe577ed01255bf462c0257a2333e6a0c1cf3472c92171885fdad45ae958e56d.exe wmic.exe PID 1524 wrote to memory of 564 1524 ffe577ed01255bf462c0257a2333e6a0c1cf3472c92171885fdad45ae958e56d.exe wmic.exe PID 1524 wrote to memory of 740 1524 ffe577ed01255bf462c0257a2333e6a0c1cf3472c92171885fdad45ae958e56d.exe cmd.exe PID 1524 wrote to memory of 740 1524 ffe577ed01255bf462c0257a2333e6a0c1cf3472c92171885fdad45ae958e56d.exe cmd.exe PID 1524 wrote to memory of 740 1524 ffe577ed01255bf462c0257a2333e6a0c1cf3472c92171885fdad45ae958e56d.exe cmd.exe PID 1524 wrote to memory of 740 1524 ffe577ed01255bf462c0257a2333e6a0c1cf3472c92171885fdad45ae958e56d.exe cmd.exe PID 740 wrote to memory of 1764 740 cmd.exe timeout.exe PID 740 wrote to memory of 1764 740 cmd.exe timeout.exe PID 740 wrote to memory of 1764 740 cmd.exe timeout.exe PID 740 wrote to memory of 1764 740 cmd.exe timeout.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\ffe577ed01255bf462c0257a2333e6a0c1cf3472c92171885fdad45ae958e56d.exe"C:\Users\Admin\AppData\Local\Temp\ffe577ed01255bf462c0257a2333e6a0c1cf3472c92171885fdad45ae958e56d.exe"1⤵
- Modifies extensions of user files
- Enumerates connected drives
- Sets desktop wallpaper using registry
- Drops file in Program Files directory
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\wbem\wmic.exe"C:\Windows\system32\wbem\wmic.exe" shadowcopy delete2⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c timeout -c 5 & del "C:\Users\Admin\AppData\Local\Temp\ffe577ed01255bf462c0257a2333e6a0c1cf3472c92171885fdad45ae958e56d.exe" /f /q2⤵
- Deletes itself
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\timeout.exetimeout -c 53⤵
- Delays execution with timeout.exe
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1524-55-0x0000000075AB1000-0x0000000075AB3000-memory.dmpFilesize
8KB