Overview

overview

10

Static

static

10

foo.exe

windows7_x64

10

foo.exe

windows10-2004_x64

10

Analysis

  • max time kernel
    659s
  • max time network
    668s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-en-20220112
  • submitted
    17-02-2022 00:54

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    foo.exe

  • Size

    94KB

  • MD5

    993b73d6490bc5a7e23e02210b317247

  • SHA1

    6fd314af34409e945504e166eb8cd88127c1070e

  • SHA256

    de04d2402154f676f757cf1380671f396f3fc9f7dbb683d9461edd2718c4e09d

  • SHA512

    417f55a066896695ce1b8d998767f706005d3d6f1792f2b86261a235034a6c3bb1deae6920857fbc710d22b833479b2cbeafd92735381f1cc357adcc8a74c55d

Score
10/10
netwalkerpersistenceransomware

Malware Config

Extracted

Path

C:\odt\C6ED5-Readme.txt

Family

netwalker

Ransom Note
Hi! Your files are encrypted. All encrypted files for this computer has extension: .c6ed5 -- If for some reason you read this text before the encryption ended, this can be understood by the fact that the computer slows down, and your heart rate has increased due to the ability to turn it off, then we recommend that you move away from the computer and accept that you have been compromised, rebooting/shutdown will cause you to lose files without the possibility of recovery and even god will not be able to help you, it could be files on the network belonging to other users, sure you want to take that responsibility? -- Our encryption algorithms are very strong and your files are very well protected, you can't hope to recover them without our help. The only way to get your files back is to cooperate with us and get the decrypter program. Do not try to recover your files without a decrypt program, you may damage them and then they will be impossible to recover. We advise you to contact us as soon as possible, otherwise there is a possibility that your files will never be returned. For us this is just business and to prove to you our seriousness, we will decrypt you some files for free, but we will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision. Contact us: 1.knoocknoo@cock.li 2.eeeooppaaaxxx@tuta.io Don't forget to include your code in the email: {code_1b1ea859_c6ed5: Xaw12/IrUsfm38pdIdYgcs6bNVlfLP9TWSeb2zHnueg1PwWVfI 5PfaHHSxeIOxhLEAIKi236+IU5EYJCdGV4P7SNY1ABDv09Wage G8CBTM2TPGsBtSgX6zCD2mGUH0nSKQdgxHMCtUbjdniPdkGL0h gL3l8e9prZAJIo1V4fkkrkk9LSM8Jk4OYW/cRlPoXlx2XoMtFc 6FvAfTCsdTStzg7EF57ZTIrc17jnvT9mD1dt5qUcoasW//wj5f I4ewYbCXyeGn5qUne4UPiEGBEN3cp7qu8=}
Emails

knoocknoo@cock.li

eeeooppaaaxxx@tuta.io

Signatures

  • Detected Netwalker Ransomware 2 IoCs

    Detected unpacked Netwalker executable.

  • Netwalker Ransomware

    Ransomware family with multiple versions. Also known as MailTo.

    ransomwarenetwalker
  • Deletes shadow copies 2 TTPs

    Ransomware often targets backup files to inhibit system recovery.

    ransomware
  • Modifies extensions of user files 1 IoCs

    Ransomware generally changes the extension on encrypted files.

    ransomware
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Suspicious use of SetThreadContext 1 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 3 IoCs
  • Program crash 1 IoCs
  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 4 IoCs
  • Interacts with shadow copies 2 TTPs 1 IoCs

    Shadow copies are often targeted by ransomware to inhibit system recovery.

    ransomware
  • Modifies data under HKEY_USERS 53 IoCs
  • Modifies registry class 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: MapViewOfSection 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 11 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\foo.exe
    "C:\Users\Admin\AppData\Local\Temp\foo.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious behavior: MapViewOfSection
    • Suspicious use of WriteProcessMemory
    PID:3836
    • C:\Windows\SysWOW64\explorer.exe
      "C:\Windows\system32\explorer.exe"
      2⤵
      • Modifies extensions of user files
      • Adds Run key to start application
      • Drops file in Program Files directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: MapViewOfSection
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:3524
      • C:\Windows\SysWOW64\explorer.exe
        "C:\Windows\system32\explorer.exe"
        3⤵
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:3464
        • C:\Windows\system32\vssadmin.exe
          C:\Windows\system32\vssadmin.exe delete shadows /all /quiet
          4⤵
          • Interacts with shadow copies
          PID:656
  • C:\Windows\system32\MusNotifyIcon.exe
    %systemroot%\system32\MusNotifyIcon.exe NotifyTrayIcon 13
    1⤵
    • Checks processor information in registry
    PID:1412
  • C:\Windows\System32\svchost.exe
    C:\Windows\System32\svchost.exe -k NetworkService -p
    1⤵
    • Drops file in Windows directory
    • Modifies data under HKEY_USERS
    PID:956
  • C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe
    C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe -Embedding
    1⤵
    • Drops file in Windows directory
    • Suspicious use of AdjustPrivilegeToken
    PID:2576
  • C:\Windows\system32\vssvc.exe
    C:\Windows\system32\vssvc.exe
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:784
  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
    1⤵
    • Enumerates system info in registry
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:6112
  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
    1⤵
    • Enumerates system info in registry
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:9076
    • C:\Windows\system32\WerFault.exe
      C:\Windows\system32\WerFault.exe -u -p 9076 -s 3988
      2⤵
      • Program crash
      PID:4416
  • C:\Windows\system32\WerFault.exe
    C:\Windows\system32\WerFault.exe -pss -s 404 -p 9076 -ip 9076
    1⤵
      PID:1412

    Network

    MITRE ATT&CK Matrix ATT&CK v6

    Initial Access

    Execution

    Persistence

    Registry Run Keys / Startup Folder

    1
    T1060

    Privilege Escalation

    Defense Evasion

    File Deletion

    2
    T1107

    Modify Registry

    1
    T1112

    Credential Access

    Discovery

    Query Registry

    2
    T1012

    System Information Discovery

    2
    T1082

    Lateral Movement

    Collection

    Exfiltration

    Command and Control

    Impact

    Inhibit System Recovery

    2
    T1490

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\ProgramData\USOShared\Logs\User\NotifyIcon.af73693e-0704-4137-815f-a0846e4a65ae.1.etl
      MD5

      babcb5dbaa33e8af76aed6aa5eff0a87

      SHA1

      46a697427c387a572bf23ef4af019999ff0b75aa

      SHA256

      8a49d7023f4dc089ba3d179d3954f91d17ab7c77a0fd48bc4c32baa057e7a5c2

      SHA512

      1bbe67a2fbaac56ca42a98e4bf2dec9643da3725556d5ffefac5ded17181379eda2d4f97b9d6b545f6a83a0296abd0d897dad584e6eed091320d213cee6e8f09

      Download Submit
    • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\CryptnetUrlCache\Content\6BADA8974A10C4BD62CC921D13E43B18_711ED44619924BA6DC33E69F97E7FF63
      MD5

      83cdb602fa676688adec36b61fcf8f29

      SHA1

      70e85ca576a49ad620b97e455616d72a1294567b

      SHA256

      4c05dc1826ada9e8ceb7c3c839669e4f2ef2b34ed94593cd228b60f8f7276bb7

      SHA512

      53cd16271bdc1d6a9913426a98e00a686757010ba0866892ada2aaf2e7cf5308717dc45eb380433ef8270b6064b0ced6d7cd46a2176326f9d8b08236e9ee09a1

      Download Submit
    • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\CryptnetUrlCache\MetaData\6BADA8974A10C4BD62CC921D13E43B18_711ED44619924BA6DC33E69F97E7FF63
      MD5

      2fe2e65b632977355923244d4d17a266

      SHA1

      8cc3371f81611bce80a7c29d19276f1193a9f9b2

      SHA256

      3718fe88fa14c2acd86c8f674f605d918d5fffb045804d2e7b636230efa4453d

      SHA512

      005810dd06d700509cadde6335d5a7b60a10675b53d7a17a36df9cb12b9f7975af117920aa606fec416ce6992a07b6a8ada9125414528eedcf2e4a574da520dc

      Download Submit
    • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\RU1N0LOI\www.bing[1].xml
      MD5

      a674a13f95e07ad76d9769cd99324042

      SHA1

      99655f79e918d0f41de20b88b26e93a60c5bca48

      SHA256

      a6ffa82c081659ca6842790daadc4dd60632f21ade1a2e98d6daae41bb9a95dd

      SHA512

      64f94ae87ea499b2930ec8b79eb0ef6d00bbcf4ab3d9693736dc9db2fa5d4dee0a2a58ea50489f9836d0cf08fc84b7a5db2cffce0355d76ea5a8b0bd29808568

      Download Submit
    • memory/3464-131-0x0000000002F00000-0x0000000002F1B000-memory.dmp
      Filesize

      108KB

      Download
    • memory/3524-130-0x00000000001C0000-0x00000000001DB000-memory.dmp
      Filesize

      108KB

      Download