Analysis
-
max time kernel
120s -
max time network
133s -
platform
windows10_x64 -
resource
win10-en-20211208 -
submitted
28-01-2022 17:16
Static task
static1
Behavioral task
behavioral1
Sample
ffe577ed01255bf462c0257a2333e6a0c1cf3472c92171885fdad45ae958e56d.exe
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
ffe577ed01255bf462c0257a2333e6a0c1cf3472c92171885fdad45ae958e56d.exe
Resource
win10-en-20211208
General
-
Target
ffe577ed01255bf462c0257a2333e6a0c1cf3472c92171885fdad45ae958e56d.exe
-
Size
139KB
-
MD5
e66baf5880f9749f87acc02e35a0bf33
-
SHA1
d12198f570ca3c1febe9974d4ce7934e71458144
-
SHA256
ffe577ed01255bf462c0257a2333e6a0c1cf3472c92171885fdad45ae958e56d
-
SHA512
e4b857fb1f786e990eaef6f7c728ef54dc34a676bb8dec09255d8502e2601e0184913e7de463c7881eb6fb29632639dcc3c12984cb5a472a6f36bc0288e199a7
Malware Config
Extracted
C:\HJQNL-DECRYPT.txt
http://gandcrabmfe6mnef.onion/bf4132b42e7da76c
Signatures
-
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Modifies extensions of user files 6 IoCs
Ransomware generally changes the extension on encrypted files.
Processes:
ffe577ed01255bf462c0257a2333e6a0c1cf3472c92171885fdad45ae958e56d.exedescription ioc process File renamed C:\Users\Admin\Pictures\ConvertToLock.tif => C:\Users\Admin\Pictures\ConvertToLock.tif.hjqnl ffe577ed01255bf462c0257a2333e6a0c1cf3472c92171885fdad45ae958e56d.exe File renamed C:\Users\Admin\Pictures\FormatSplit.crw => C:\Users\Admin\Pictures\FormatSplit.crw.hjqnl ffe577ed01255bf462c0257a2333e6a0c1cf3472c92171885fdad45ae958e56d.exe File renamed C:\Users\Admin\Pictures\ReceiveSkip.png => C:\Users\Admin\Pictures\ReceiveSkip.png.hjqnl ffe577ed01255bf462c0257a2333e6a0c1cf3472c92171885fdad45ae958e56d.exe File opened for modification C:\Users\Admin\Pictures\SyncExport.tiff ffe577ed01255bf462c0257a2333e6a0c1cf3472c92171885fdad45ae958e56d.exe File renamed C:\Users\Admin\Pictures\SyncExport.tiff => C:\Users\Admin\Pictures\SyncExport.tiff.hjqnl ffe577ed01255bf462c0257a2333e6a0c1cf3472c92171885fdad45ae958e56d.exe File renamed C:\Users\Admin\Pictures\UpdateDismount.raw => C:\Users\Admin\Pictures\UpdateDismount.raw.hjqnl ffe577ed01255bf462c0257a2333e6a0c1cf3472c92171885fdad45ae958e56d.exe -
Drops startup file 2 IoCs
Processes:
ffe577ed01255bf462c0257a2333e6a0c1cf3472c92171885fdad45ae958e56d.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\HJQNL-DECRYPT.txt ffe577ed01255bf462c0257a2333e6a0c1cf3472c92171885fdad45ae958e56d.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\2e7da08c2e7da76674.lock ffe577ed01255bf462c0257a2333e6a0c1cf3472c92171885fdad45ae958e56d.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Enumerates connected drives 3 TTPs 24 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
ffe577ed01255bf462c0257a2333e6a0c1cf3472c92171885fdad45ae958e56d.exedescription ioc process File opened (read-only) \??\K: ffe577ed01255bf462c0257a2333e6a0c1cf3472c92171885fdad45ae958e56d.exe File opened (read-only) \??\L: ffe577ed01255bf462c0257a2333e6a0c1cf3472c92171885fdad45ae958e56d.exe File opened (read-only) \??\O: ffe577ed01255bf462c0257a2333e6a0c1cf3472c92171885fdad45ae958e56d.exe File opened (read-only) \??\R: ffe577ed01255bf462c0257a2333e6a0c1cf3472c92171885fdad45ae958e56d.exe File opened (read-only) \??\U: ffe577ed01255bf462c0257a2333e6a0c1cf3472c92171885fdad45ae958e56d.exe File opened (read-only) \??\A: ffe577ed01255bf462c0257a2333e6a0c1cf3472c92171885fdad45ae958e56d.exe File opened (read-only) \??\E: ffe577ed01255bf462c0257a2333e6a0c1cf3472c92171885fdad45ae958e56d.exe File opened (read-only) \??\G: ffe577ed01255bf462c0257a2333e6a0c1cf3472c92171885fdad45ae958e56d.exe File opened (read-only) \??\S: ffe577ed01255bf462c0257a2333e6a0c1cf3472c92171885fdad45ae958e56d.exe File opened (read-only) \??\V: ffe577ed01255bf462c0257a2333e6a0c1cf3472c92171885fdad45ae958e56d.exe File opened (read-only) \??\W: ffe577ed01255bf462c0257a2333e6a0c1cf3472c92171885fdad45ae958e56d.exe File opened (read-only) \??\X: ffe577ed01255bf462c0257a2333e6a0c1cf3472c92171885fdad45ae958e56d.exe File opened (read-only) \??\F: ffe577ed01255bf462c0257a2333e6a0c1cf3472c92171885fdad45ae958e56d.exe File opened (read-only) \??\M: ffe577ed01255bf462c0257a2333e6a0c1cf3472c92171885fdad45ae958e56d.exe File opened (read-only) \??\N: ffe577ed01255bf462c0257a2333e6a0c1cf3472c92171885fdad45ae958e56d.exe File opened (read-only) \??\H: ffe577ed01255bf462c0257a2333e6a0c1cf3472c92171885fdad45ae958e56d.exe File opened (read-only) \??\Z: ffe577ed01255bf462c0257a2333e6a0c1cf3472c92171885fdad45ae958e56d.exe File opened (read-only) \??\P: ffe577ed01255bf462c0257a2333e6a0c1cf3472c92171885fdad45ae958e56d.exe File opened (read-only) \??\Q: ffe577ed01255bf462c0257a2333e6a0c1cf3472c92171885fdad45ae958e56d.exe File opened (read-only) \??\T: ffe577ed01255bf462c0257a2333e6a0c1cf3472c92171885fdad45ae958e56d.exe File opened (read-only) \??\Y: ffe577ed01255bf462c0257a2333e6a0c1cf3472c92171885fdad45ae958e56d.exe File opened (read-only) \??\B: ffe577ed01255bf462c0257a2333e6a0c1cf3472c92171885fdad45ae958e56d.exe File opened (read-only) \??\I: ffe577ed01255bf462c0257a2333e6a0c1cf3472c92171885fdad45ae958e56d.exe File opened (read-only) \??\J: ffe577ed01255bf462c0257a2333e6a0c1cf3472c92171885fdad45ae958e56d.exe -
Sets desktop wallpaper using registry 2 TTPs 1 IoCs
Processes:
ffe577ed01255bf462c0257a2333e6a0c1cf3472c92171885fdad45ae958e56d.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\\\pidor.bmp" ffe577ed01255bf462c0257a2333e6a0c1cf3472c92171885fdad45ae958e56d.exe -
Drops file in Program Files directory 30 IoCs
Processes:
ffe577ed01255bf462c0257a2333e6a0c1cf3472c92171885fdad45ae958e56d.exedescription ioc process File opened for modification C:\Program Files\MountComplete.vsdx ffe577ed01255bf462c0257a2333e6a0c1cf3472c92171885fdad45ae958e56d.exe File opened for modification C:\Program Files\StopExport.jpg ffe577ed01255bf462c0257a2333e6a0c1cf3472c92171885fdad45ae958e56d.exe File opened for modification C:\Program Files\EditEnable.temp ffe577ed01255bf462c0257a2333e6a0c1cf3472c92171885fdad45ae958e56d.exe File opened for modification C:\Program Files\RequestUndo.vdw ffe577ed01255bf462c0257a2333e6a0c1cf3472c92171885fdad45ae958e56d.exe File opened for modification C:\Program Files\TestMeasure.mpg ffe577ed01255bf462c0257a2333e6a0c1cf3472c92171885fdad45ae958e56d.exe File opened for modification C:\Program Files\TraceResolve.xla ffe577ed01255bf462c0257a2333e6a0c1cf3472c92171885fdad45ae958e56d.exe File created C:\Program Files\HJQNL-DECRYPT.txt ffe577ed01255bf462c0257a2333e6a0c1cf3472c92171885fdad45ae958e56d.exe File opened for modification C:\Program Files\OutBackup.potm ffe577ed01255bf462c0257a2333e6a0c1cf3472c92171885fdad45ae958e56d.exe File opened for modification C:\Program Files\UnblockReceive.zip ffe577ed01255bf462c0257a2333e6a0c1cf3472c92171885fdad45ae958e56d.exe File created C:\Program Files (x86)\HJQNL-DECRYPT.txt ffe577ed01255bf462c0257a2333e6a0c1cf3472c92171885fdad45ae958e56d.exe File opened for modification C:\Program Files\InstallCompare.odt ffe577ed01255bf462c0257a2333e6a0c1cf3472c92171885fdad45ae958e56d.exe File opened for modification C:\Program Files\InitializeEnable.jpe ffe577ed01255bf462c0257a2333e6a0c1cf3472c92171885fdad45ae958e56d.exe File opened for modification C:\Program Files\LockRequest.docm ffe577ed01255bf462c0257a2333e6a0c1cf3472c92171885fdad45ae958e56d.exe File opened for modification C:\Program Files\OutSync.tif ffe577ed01255bf462c0257a2333e6a0c1cf3472c92171885fdad45ae958e56d.exe File opened for modification C:\Program Files\ReadUndo.kix ffe577ed01255bf462c0257a2333e6a0c1cf3472c92171885fdad45ae958e56d.exe File opened for modification C:\Program Files\SetEnter.mid ffe577ed01255bf462c0257a2333e6a0c1cf3472c92171885fdad45ae958e56d.exe File opened for modification C:\Program Files\ConvertReset.zip ffe577ed01255bf462c0257a2333e6a0c1cf3472c92171885fdad45ae958e56d.exe File opened for modification C:\Program Files\RequestDebug.xml ffe577ed01255bf462c0257a2333e6a0c1cf3472c92171885fdad45ae958e56d.exe File opened for modification C:\Program Files\ResetRepair.dotm ffe577ed01255bf462c0257a2333e6a0c1cf3472c92171885fdad45ae958e56d.exe File opened for modification C:\Program Files\ShowDisable.docm ffe577ed01255bf462c0257a2333e6a0c1cf3472c92171885fdad45ae958e56d.exe File opened for modification C:\Program Files\UnprotectGet.mpeg3 ffe577ed01255bf462c0257a2333e6a0c1cf3472c92171885fdad45ae958e56d.exe File opened for modification C:\Program Files\ConnectInstall.wmx ffe577ed01255bf462c0257a2333e6a0c1cf3472c92171885fdad45ae958e56d.exe File opened for modification C:\Program Files\NewDebug.asf ffe577ed01255bf462c0257a2333e6a0c1cf3472c92171885fdad45ae958e56d.exe File opened for modification C:\Program Files\PingGet.vssm ffe577ed01255bf462c0257a2333e6a0c1cf3472c92171885fdad45ae958e56d.exe File opened for modification C:\Program Files\CloseMove.vdw ffe577ed01255bf462c0257a2333e6a0c1cf3472c92171885fdad45ae958e56d.exe File opened for modification C:\Program Files\FormatTest.mp3 ffe577ed01255bf462c0257a2333e6a0c1cf3472c92171885fdad45ae958e56d.exe File opened for modification C:\Program Files\RedoTrace.png ffe577ed01255bf462c0257a2333e6a0c1cf3472c92171885fdad45ae958e56d.exe File opened for modification C:\Program Files\UnblockDeny.php ffe577ed01255bf462c0257a2333e6a0c1cf3472c92171885fdad45ae958e56d.exe File created C:\Program Files (x86)\2e7da08c2e7da76674.lock ffe577ed01255bf462c0257a2333e6a0c1cf3472c92171885fdad45ae958e56d.exe File created C:\Program Files\2e7da08c2e7da76674.lock ffe577ed01255bf462c0257a2333e6a0c1cf3472c92171885fdad45ae958e56d.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
ffe577ed01255bf462c0257a2333e6a0c1cf3472c92171885fdad45ae958e56d.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier ffe577ed01255bf462c0257a2333e6a0c1cf3472c92171885fdad45ae958e56d.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 ffe577ed01255bf462c0257a2333e6a0c1cf3472c92171885fdad45ae958e56d.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString ffe577ed01255bf462c0257a2333e6a0c1cf3472c92171885fdad45ae958e56d.exe -
Delays execution with timeout.exe 1 IoCs
Processes:
timeout.exepid process 376 timeout.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
ffe577ed01255bf462c0257a2333e6a0c1cf3472c92171885fdad45ae958e56d.exepid process 2092 ffe577ed01255bf462c0257a2333e6a0c1cf3472c92171885fdad45ae958e56d.exe 2092 ffe577ed01255bf462c0257a2333e6a0c1cf3472c92171885fdad45ae958e56d.exe 2092 ffe577ed01255bf462c0257a2333e6a0c1cf3472c92171885fdad45ae958e56d.exe 2092 ffe577ed01255bf462c0257a2333e6a0c1cf3472c92171885fdad45ae958e56d.exe -
Suspicious use of AdjustPrivilegeToken 45 IoCs
Processes:
wmic.exevssvc.exedescription pid process Token: SeIncreaseQuotaPrivilege 772 wmic.exe Token: SeSecurityPrivilege 772 wmic.exe Token: SeTakeOwnershipPrivilege 772 wmic.exe Token: SeLoadDriverPrivilege 772 wmic.exe Token: SeSystemProfilePrivilege 772 wmic.exe Token: SeSystemtimePrivilege 772 wmic.exe Token: SeProfSingleProcessPrivilege 772 wmic.exe Token: SeIncBasePriorityPrivilege 772 wmic.exe Token: SeCreatePagefilePrivilege 772 wmic.exe Token: SeBackupPrivilege 772 wmic.exe Token: SeRestorePrivilege 772 wmic.exe Token: SeShutdownPrivilege 772 wmic.exe Token: SeDebugPrivilege 772 wmic.exe Token: SeSystemEnvironmentPrivilege 772 wmic.exe Token: SeRemoteShutdownPrivilege 772 wmic.exe Token: SeUndockPrivilege 772 wmic.exe Token: SeManageVolumePrivilege 772 wmic.exe Token: 33 772 wmic.exe Token: 34 772 wmic.exe Token: 35 772 wmic.exe Token: 36 772 wmic.exe Token: SeIncreaseQuotaPrivilege 772 wmic.exe Token: SeSecurityPrivilege 772 wmic.exe Token: SeTakeOwnershipPrivilege 772 wmic.exe Token: SeLoadDriverPrivilege 772 wmic.exe Token: SeSystemProfilePrivilege 772 wmic.exe Token: SeSystemtimePrivilege 772 wmic.exe Token: SeProfSingleProcessPrivilege 772 wmic.exe Token: SeIncBasePriorityPrivilege 772 wmic.exe Token: SeCreatePagefilePrivilege 772 wmic.exe Token: SeBackupPrivilege 772 wmic.exe Token: SeRestorePrivilege 772 wmic.exe Token: SeShutdownPrivilege 772 wmic.exe Token: SeDebugPrivilege 772 wmic.exe Token: SeSystemEnvironmentPrivilege 772 wmic.exe Token: SeRemoteShutdownPrivilege 772 wmic.exe Token: SeUndockPrivilege 772 wmic.exe Token: SeManageVolumePrivilege 772 wmic.exe Token: 33 772 wmic.exe Token: 34 772 wmic.exe Token: 35 772 wmic.exe Token: 36 772 wmic.exe Token: SeBackupPrivilege 404 vssvc.exe Token: SeRestorePrivilege 404 vssvc.exe Token: SeAuditPrivilege 404 vssvc.exe -
Suspicious use of WriteProcessMemory 9 IoCs
Processes:
ffe577ed01255bf462c0257a2333e6a0c1cf3472c92171885fdad45ae958e56d.execmd.exedescription pid process target process PID 2092 wrote to memory of 772 2092 ffe577ed01255bf462c0257a2333e6a0c1cf3472c92171885fdad45ae958e56d.exe wmic.exe PID 2092 wrote to memory of 772 2092 ffe577ed01255bf462c0257a2333e6a0c1cf3472c92171885fdad45ae958e56d.exe wmic.exe PID 2092 wrote to memory of 772 2092 ffe577ed01255bf462c0257a2333e6a0c1cf3472c92171885fdad45ae958e56d.exe wmic.exe PID 2092 wrote to memory of 604 2092 ffe577ed01255bf462c0257a2333e6a0c1cf3472c92171885fdad45ae958e56d.exe cmd.exe PID 2092 wrote to memory of 604 2092 ffe577ed01255bf462c0257a2333e6a0c1cf3472c92171885fdad45ae958e56d.exe cmd.exe PID 2092 wrote to memory of 604 2092 ffe577ed01255bf462c0257a2333e6a0c1cf3472c92171885fdad45ae958e56d.exe cmd.exe PID 604 wrote to memory of 376 604 cmd.exe timeout.exe PID 604 wrote to memory of 376 604 cmd.exe timeout.exe PID 604 wrote to memory of 376 604 cmd.exe timeout.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\ffe577ed01255bf462c0257a2333e6a0c1cf3472c92171885fdad45ae958e56d.exe"C:\Users\Admin\AppData\Local\Temp\ffe577ed01255bf462c0257a2333e6a0c1cf3472c92171885fdad45ae958e56d.exe"1⤵
- Modifies extensions of user files
- Drops startup file
- Enumerates connected drives
- Sets desktop wallpaper using registry
- Drops file in Program Files directory
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\wbem\wmic.exe"C:\Windows\system32\wbem\wmic.exe" shadowcopy delete2⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c timeout -c 5 & del "C:\Users\Admin\AppData\Local\Temp\ffe577ed01255bf462c0257a2333e6a0c1cf3472c92171885fdad45ae958e56d.exe" /f /q2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\timeout.exetimeout -c 53⤵
- Delays execution with timeout.exe
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken