Analysis
- max time kernel
154s - max time network
158s - platform
windows10-2004_x64 - resource
win10v2004-en-20220113 - submitted
13/02/2022, 12:21
Static task
static1
Behavioral task
behavioral1
Sample
68ee03ab15e22934ed61dab828c9fb4d504746d3798d2f95311628c3594e47ed.exe
Resource
win7-en-20211208
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
68ee03ab15e22934ed61dab828c9fb4d504746d3798d2f95311628c3594e47ed.exe
Resource
win10v2004-en-20220113
windows10-2004_x64
0 signatures
0 seconds
General
- Target 68ee03ab15e22934ed61dab828c9fb4d504746d3798d2f95311628c3594e47ed.exe
- Size 108KB
- Sample220213-pjs63sbgcj
- SHA256 68ee03ab15e22934ed61dab828c9fb4d504746d3798d2f95311628c3594e47ed
- MD5 3891f28b03951612f08d1bfd59ca56ea
- SHA1 fcb3fdec404bbf5c0ff087c8efb2c82da1e724a4
- SHA512 11cb504e9d15f8d8cd56fe31cf8d34d300bc68921769aa533bb5adfc8481fd203a8236fe259541158c05621dffce6d40e0a7429cae5dd7cd7fa8f3b888a4b219
- MD5 SHA1 SHA512
Score
10/10
Malware Config
Extracted
Path
-
C:\Users\Admin\AppData\Local\Temp\!satana!.txt
Ransom Note
- You had bad luck.There was crypting of all your files in a FS bootkit virus <!SATANA!> To decrypt you need send on this E-mail: [email protected] your private code: 18B25953E328E11606833463C8A10A63 and pay on a Bitcoin Wallet: XckRGrfki7heuskuFavvh14wmRiaAucrPn total 0,5 btc After that during 1 - 2 days the software will be sent to you - decryptor - and the necessary instructions. All changes in hardware configurations of your computer can make the decryption of your files absolutely impossible! Decryption of your files is possible only on your PC! Recovery is possible during 7 days, after which the program - decryptor - can not ask for the necessary signature from a public certificate server. Please contact via e-mail, which you can find as yet in the form of a text document in a folder with encrypted files, as well as in the name of all encrypted files.If you do not appreciate your files we recommend you format all your disks and reinstall the system. Read carefully this warning as it is no longer able to see at startup of the computer. We remind once again- it is all serious! Do not touch the configuration of your computer! E-mail: [email protected] - this is our mail CODE: 18B25953E328E11606833463C8A10A63 this is code; you must send BTC: XckRGrfki7heuskuFavvh14wmRiaAucrPn here need to pay 0,5 bitcoins How to pay on the Bitcoin wallet you can easily find on the Internet. Enter your unlock code, obtained by E-mail here and press "ENTER" to continue the normal download on your computer. Good luck! May God help you! <!SATANA!>
Emails
Signatures
- Satana
Ransomware family which also encrypts the system's Master Boot Record (MBR).
- Executes dropped EXE 1 IoCs
pid Process 1500 sbzllof.exe - Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Control Panel\International\Geo\Nation 68ee03ab15e22934ed61dab828c9fb4d504746d3798d2f95311628c3594e47ed.exe - Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 68ee03ab15e22934ed61dab828c9fb4d504746d3798d2f95311628c3594e47ed.exe Set value (str) \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\kcvhymi = "C:\\Users\\Admin\\AppData\\Local\\Temp\\!satana!.txt" 68ee03ab15e22934ed61dab828c9fb4d504746d3798d2f95311628c3594e47ed.exe - Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
description ioc Process File opened for modification \??\PHYSICALDRIVE0 sbzllof.exe - Drops file in Windows directory 8 IoCs
description ioc Process File opened for modification C:\Windows\WinSxS\pending.xml TiWorker.exe File opened for modification C:\Windows\WindowsUpdate.log svchost.exe File opened for modification C:\Windows\SoftwareDistribution\DataStore\Logs\edb.chk svchost.exe File opened for modification C:\Windows\SoftwareDistribution\DataStore\Logs\edb.log svchost.exe File opened for modification C:\Windows\SoftwareDistribution\DataStore\DataStore.edb svchost.exe File opened for modification C:\Windows\SoftwareDistribution\DataStore\DataStore.jfm svchost.exe File opened for modification C:\Windows\SoftwareDistribution\ReportingEvents.log svchost.exe File opened for modification C:\Windows\Logs\CBS\CBS.log TiWorker.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 1532 svchost.exe Token: SeCreatePagefilePrivilege 1532 svchost.exe Token: SeShutdownPrivilege 1532 svchost.exe Token: SeCreatePagefilePrivilege 1532 svchost.exe Token: SeShutdownPrivilege 1532 svchost.exe Token: SeCreatePagefilePrivilege 1532 svchost.exe Token: SeIncBasePriorityPrivilege 1500 sbzllof.exe Token: SeSecurityPrivilege 2312 TiWorker.exe Token: SeRestorePrivilege 2312 TiWorker.exe Token: SeBackupPrivilege 2312 TiWorker.exe Token: SeBackupPrivilege 2312 TiWorker.exe Token: SeRestorePrivilege 2312 TiWorker.exe Token: SeSecurityPrivilege 2312 TiWorker.exe Token: SeBackupPrivilege 2312 TiWorker.exe Token: SeRestorePrivilege 2312 TiWorker.exe Token: SeSecurityPrivilege 2312 TiWorker.exe Token: SeBackupPrivilege 2312 TiWorker.exe Token: SeRestorePrivilege 2312 TiWorker.exe Token: SeSecurityPrivilege 2312 TiWorker.exe Token: SeBackupPrivilege 2312 TiWorker.exe Token: SeRestorePrivilege 2312 TiWorker.exe Token: SeSecurityPrivilege 2312 TiWorker.exe Token: SeBackupPrivilege 2312 TiWorker.exe Token: SeRestorePrivilege 2312 TiWorker.exe Token: SeSecurityPrivilege 2312 TiWorker.exe Token: SeBackupPrivilege 2312 TiWorker.exe Token: SeRestorePrivilege 2312 TiWorker.exe Token: SeSecurityPrivilege 2312 TiWorker.exe Token: SeBackupPrivilege 2312 TiWorker.exe Token: SeRestorePrivilege 2312 TiWorker.exe Token: SeSecurityPrivilege 2312 TiWorker.exe Token: SeBackupPrivilege 2312 TiWorker.exe Token: SeRestorePrivilege 2312 TiWorker.exe Token: SeSecurityPrivilege 2312 TiWorker.exe Token: SeBackupPrivilege 2312 TiWorker.exe Token: SeRestorePrivilege 2312 TiWorker.exe Token: SeSecurityPrivilege 2312 TiWorker.exe Token: SeBackupPrivilege 2312 TiWorker.exe Token: SeRestorePrivilege 2312 TiWorker.exe Token: SeSecurityPrivilege 2312 TiWorker.exe Token: SeBackupPrivilege 2312 TiWorker.exe Token: SeRestorePrivilege 2312 TiWorker.exe Token: SeSecurityPrivilege 2312 TiWorker.exe Token: SeBackupPrivilege 2312 TiWorker.exe Token: SeRestorePrivilege 2312 TiWorker.exe Token: SeSecurityPrivilege 2312 TiWorker.exe Token: SeBackupPrivilege 2312 TiWorker.exe Token: SeRestorePrivilege 2312 TiWorker.exe Token: SeSecurityPrivilege 2312 TiWorker.exe Token: SeBackupPrivilege 2312 TiWorker.exe Token: SeRestorePrivilege 2312 TiWorker.exe Token: SeSecurityPrivilege 2312 TiWorker.exe Token: SeBackupPrivilege 2312 TiWorker.exe Token: SeRestorePrivilege 2312 TiWorker.exe Token: SeSecurityPrivilege 2312 TiWorker.exe Token: SeBackupPrivilege 2312 TiWorker.exe Token: SeRestorePrivilege 2312 TiWorker.exe Token: SeSecurityPrivilege 2312 TiWorker.exe Token: SeBackupPrivilege 2312 TiWorker.exe Token: SeRestorePrivilege 2312 TiWorker.exe Token: SeSecurityPrivilege 2312 TiWorker.exe Token: SeBackupPrivilege 2312 TiWorker.exe Token: SeRestorePrivilege 2312 TiWorker.exe Token: SeSecurityPrivilege 2312 TiWorker.exe - Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2256 wrote to memory of 1500 2256 68ee03ab15e22934ed61dab828c9fb4d504746d3798d2f95311628c3594e47ed.exe 93 PID 2256 wrote to memory of 1500 2256 68ee03ab15e22934ed61dab828c9fb4d504746d3798d2f95311628c3594e47ed.exe 93 PID 2256 wrote to memory of 1500 2256 68ee03ab15e22934ed61dab828c9fb4d504746d3798d2f95311628c3594e47ed.exe 93
Processes
-
C:\Users\Admin\AppData\Local\Temp\68ee03ab15e22934ed61dab828c9fb4d504746d3798d2f95311628c3594e47ed.exe"C:\Users\Admin\AppData\Local\Temp\68ee03ab15e22934ed61dab828c9fb4d504746d3798d2f95311628c3594e47ed.exe"1⤵
- Checks computer location settings
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2256 -
C:\Users\Admin\AppData\Local\Temp\sbzllof.exe"C:\Users\Admin\AppData\Local\Temp\sbzllof.exe" {ea90e9d2-74a7-11ec-b993-806e6f6e6963} "C:\Users\Admin\AppData\Local\Temp\68EE03~1.EXE"2⤵
- Executes dropped EXE
- Writes to the Master Boot Record (MBR)
- Suspicious use of AdjustPrivilegeToken
PID:1500
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s wuauserv1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:1532
-
C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exeC:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe -Embedding1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:2312