Analysis
- max time kernel
141s - max time network
169s - platform
windows10-2004_x64 - resource
win10v2004-en-20220113 - submitted
17/02/2022, 18:04
Static task
static1
Behavioral task
behavioral1
Sample
sample.exe
Resource
win7-en-20211208
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
sample.exe
Resource
win10v2004-en-20220113
windows10-2004_x64
0 signatures
0 seconds
General
- Target sample.exe
- Size 30KB
- Sample220217-wnmcnacha2
- SHA256 af24612700c0105cf990148b19e5140314a55701c7022ccd2811e8ee29d68d74
- MD5 2222479d681f7a554976a9797f315fd2
- SHA1 d535dfc613ab1081dcf0bb9dd92c0f533fa3a6b5
- SHA512 5dbf583e232d662cebbc191e7e9b2c73bfd04e0c455f599b88c5428354f777ea4cf47b8a06551b34519912861d05d78c4b2e2159a6e330749a943c7476925fc4
- MD5 SHA1 SHA512
Score
10/10
Malware Config
Extracted
Path
-
C:\restore-files.txt
Ransom Note
- ╔════════════════╗ ═╣ What happened? ╠═ ╚════════════════╝ All of your important files have been encrypted and all sensitive data was stolen. The only way to restore your files and keep your data from going public is to contact us. After a payment has been made you will be given access to decryption software. As a quarantee we will decrypt 3 files for free. If you don't contact us within 72 hours the price will be doubled. ╔══════════════╗ ═╣ Instructions ╠═ ╚══════════════╝ - Download qTOX messanger from https://qtox.github.io/ - Send message to this Tox ID: 3728E933284CE638D06FCF1CBE921096E102508BD370D6D23137D3271EE5733825F63F56805E Your message should contain your Unique Key: 53566134903697098455
URLs
-
https://qtox.github.io/
Signatures
- Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs
description pid Process procid_target PID 4464 created 1324 4464 WerFault.exe 108 - Modifies extensions of user files 10 IoCs
Ransomware generally changes the extension on encrypted files.
description ioc Process File opened for modification C:\Users\Admin\Pictures\SaveExpand.png.locked sample.exe File renamed C:\Users\Admin\Pictures\UnblockSkip.raw => C:\Users\Admin\Pictures\UnblockSkip.raw.locked sample.exe File opened for modification C:\Users\Admin\Pictures\ConfirmUnpublish.tif.locked sample.exe File renamed C:\Users\Admin\Pictures\ConvertToSwitch.raw => C:\Users\Admin\Pictures\ConvertToSwitch.raw.locked sample.exe File opened for modification C:\Users\Admin\Pictures\ConvertToSwitch.raw.locked sample.exe File renamed C:\Users\Admin\Pictures\SaveExpand.png => C:\Users\Admin\Pictures\SaveExpand.png.locked sample.exe File opened for modification C:\Users\Admin\Pictures\UnblockSkip.raw.locked sample.exe File renamed C:\Users\Admin\Pictures\CompareGroup.png => C:\Users\Admin\Pictures\CompareGroup.png.locked sample.exe File opened for modification C:\Users\Admin\Pictures\CompareGroup.png.locked sample.exe File renamed C:\Users\Admin\Pictures\ConfirmUnpublish.tif => C:\Users\Admin\Pictures\ConfirmUnpublish.tif.locked sample.exe - Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Control Panel\International\Geo\Nation sample.exe - Drops startup file 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\restore-files.txt sample.exe - Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Drops file in Windows directory 8 IoCs
description ioc Process File opened for modification C:\Windows\Logs\CBS\CBS.log TiWorker.exe File opened for modification C:\Windows\WinSxS\pending.xml TiWorker.exe File opened for modification C:\Windows\WindowsUpdate.log svchost.exe File opened for modification C:\Windows\SoftwareDistribution\DataStore\Logs\edb.chk svchost.exe File opened for modification C:\Windows\SoftwareDistribution\DataStore\Logs\edb.log svchost.exe File opened for modification C:\Windows\SoftwareDistribution\DataStore\DataStore.edb svchost.exe File opened for modification C:\Windows\SoftwareDistribution\DataStore\DataStore.jfm svchost.exe File opened for modification C:\Windows\SoftwareDistribution\ReportingEvents.log svchost.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Program crash 1 IoCs
pid pid_target Process procid_target 4736 1324 WerFault.exe 108 - Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WerFault.exe - Enumerates system info in registry 2 TTPs 2 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WerFault.exe - Kills process with taskkill 1 IoCs
pid Process 4120 taskkill.exe - Modifies data under HKEY_USERS 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections svchost.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4932 sample.exe 4932 sample.exe 4932 sample.exe 4932 sample.exe 4932 sample.exe 4932 sample.exe 4932 sample.exe 4932 sample.exe 4932 sample.exe 4932 sample.exe 4932 sample.exe 4932 sample.exe 4932 sample.exe 4932 sample.exe 4932 sample.exe 4932 sample.exe 4932 sample.exe 4932 sample.exe 4932 sample.exe 4932 sample.exe 4932 sample.exe 4932 sample.exe 4932 sample.exe 4932 sample.exe 4932 sample.exe 4932 sample.exe 4932 sample.exe 4932 sample.exe 4932 sample.exe 4932 sample.exe 4932 sample.exe 4932 sample.exe 4932 sample.exe 4932 sample.exe 4932 sample.exe 4932 sample.exe 4932 sample.exe 4932 sample.exe 4932 sample.exe 4932 sample.exe 4932 sample.exe 4932 sample.exe 4932 sample.exe 4932 sample.exe 4932 sample.exe 4932 sample.exe 4932 sample.exe 4932 sample.exe 4932 sample.exe 4932 sample.exe 4932 sample.exe 4932 sample.exe 4932 sample.exe 4932 sample.exe 4932 sample.exe 4932 sample.exe 4932 sample.exe 4932 sample.exe 4932 sample.exe 4932 sample.exe 4932 sample.exe 4932 sample.exe 4932 sample.exe 4932 sample.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 4752 sample.exe Token: SeDebugPrivilege 4932 sample.exe Token: SeBackupPrivilege 360 vssvc.exe Token: SeRestorePrivilege 360 vssvc.exe Token: SeAuditPrivilege 360 vssvc.exe Token: SeDebugPrivilege 4120 taskkill.exe Token: SeShutdownPrivilege 5024 svchost.exe Token: SeCreatePagefilePrivilege 5024 svchost.exe Token: SeShutdownPrivilege 5024 svchost.exe Token: SeCreatePagefilePrivilege 5024 svchost.exe Token: SeShutdownPrivilege 5024 svchost.exe Token: SeCreatePagefilePrivilege 5024 svchost.exe Token: SeSecurityPrivilege 2412 TiWorker.exe Token: SeRestorePrivilege 2412 TiWorker.exe Token: SeBackupPrivilege 2412 TiWorker.exe Token: SeBackupPrivilege 2412 TiWorker.exe Token: SeRestorePrivilege 2412 TiWorker.exe Token: SeSecurityPrivilege 2412 TiWorker.exe Token: SeBackupPrivilege 2412 TiWorker.exe Token: SeRestorePrivilege 2412 TiWorker.exe Token: SeSecurityPrivilege 2412 TiWorker.exe Token: SeBackupPrivilege 2412 TiWorker.exe Token: SeRestorePrivilege 2412 TiWorker.exe Token: SeSecurityPrivilege 2412 TiWorker.exe Token: SeBackupPrivilege 2412 TiWorker.exe Token: SeRestorePrivilege 2412 TiWorker.exe Token: SeSecurityPrivilege 2412 TiWorker.exe Token: SeBackupPrivilege 2412 TiWorker.exe Token: SeRestorePrivilege 2412 TiWorker.exe Token: SeSecurityPrivilege 2412 TiWorker.exe Token: SeBackupPrivilege 2412 TiWorker.exe Token: SeRestorePrivilege 2412 TiWorker.exe Token: SeSecurityPrivilege 2412 TiWorker.exe Token: SeBackupPrivilege 2412 TiWorker.exe Token: SeRestorePrivilege 2412 TiWorker.exe Token: SeSecurityPrivilege 2412 TiWorker.exe Token: SeBackupPrivilege 2412 TiWorker.exe Token: SeRestorePrivilege 2412 TiWorker.exe Token: SeSecurityPrivilege 2412 TiWorker.exe Token: SeBackupPrivilege 2412 TiWorker.exe Token: SeRestorePrivilege 2412 TiWorker.exe Token: SeSecurityPrivilege 2412 TiWorker.exe Token: SeBackupPrivilege 2412 TiWorker.exe Token: SeRestorePrivilege 2412 TiWorker.exe Token: SeSecurityPrivilege 2412 TiWorker.exe Token: SeBackupPrivilege 2412 TiWorker.exe Token: SeRestorePrivilege 2412 TiWorker.exe Token: SeSecurityPrivilege 2412 TiWorker.exe Token: SeBackupPrivilege 2412 TiWorker.exe Token: SeRestorePrivilege 2412 TiWorker.exe Token: SeSecurityPrivilege 2412 TiWorker.exe Token: SeBackupPrivilege 2412 TiWorker.exe Token: SeRestorePrivilege 2412 TiWorker.exe Token: SeSecurityPrivilege 2412 TiWorker.exe Token: SeBackupPrivilege 2412 TiWorker.exe Token: SeRestorePrivilege 2412 TiWorker.exe Token: SeSecurityPrivilege 2412 TiWorker.exe Token: SeBackupPrivilege 2412 TiWorker.exe Token: SeRestorePrivilege 2412 TiWorker.exe Token: SeSecurityPrivilege 2412 TiWorker.exe Token: SeBackupPrivilege 2412 TiWorker.exe Token: SeRestorePrivilege 2412 TiWorker.exe Token: SeSecurityPrivilege 2412 TiWorker.exe Token: SeBackupPrivilege 2412 TiWorker.exe - Suspicious use of WriteProcessMemory 10 IoCs
description pid Process procid_target PID 4752 wrote to memory of 4932 4752 sample.exe 82 PID 4752 wrote to memory of 4932 4752 sample.exe 82 PID 4752 wrote to memory of 3692 4752 sample.exe 84 PID 4752 wrote to memory of 3692 4752 sample.exe 84 PID 4752 wrote to memory of 216 4752 sample.exe 90 PID 4752 wrote to memory of 216 4752 sample.exe 90 PID 216 wrote to memory of 4120 216 cmd.exe 92 PID 216 wrote to memory of 4120 216 cmd.exe 92 PID 4464 wrote to memory of 1324 4464 WerFault.exe 108 PID 4464 wrote to memory of 1324 4464 WerFault.exe 108
Processes
-
C:\Users\Admin\AppData\Local\Temp\sample.exe"C:\Users\Admin\AppData\Local\Temp\sample.exe"1⤵
- Modifies extensions of user files
- Checks computer location settings
- Drops startup file
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4752 -
C:\Users\Admin\AppData\Local\Temp\sample.exe"C:\Users\Admin\AppData\Local\Temp\sample.exe" 12⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4932
-
-
C:\Users\Admin\AppData\Local\Temp\sample.exe"C:\Users\Admin\AppData\Local\Temp\sample.exe" 02⤵PID:3692
-
-
\??\c:\windows\system32\cmd.exe"c:\windows\system32\cmd.exe" /c taskkill /im sample.exe & del C:\Users\Admin\AppData\Local\Temp\sample.exe2⤵
- Suspicious use of WriteProcessMemory
PID:216 -
C:\Windows\system32\taskkill.exetaskkill /im sample.exe3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4120
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:360
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s wuauserv1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:5024
-
C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exeC:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe -Embedding1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:2412
-
C:\Windows\system32\backgroundTaskHost.exe"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:ShellFeedsUI.AppXnj65k2d1a1rnztt2t2nng5ctmk3e76pn.mca1⤵PID:1324
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 1324 -s 20442⤵
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
PID:4736
-
-
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Public\Desktop\restore-files.txt1⤵PID:1460
-
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Public\Desktop\restore-files.txt1⤵PID:2008
-
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Public\Desktop\restore-files.txt1⤵PID:4932
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -pss -s 440 -p 1324 -ip 13241⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Suspicious use of WriteProcessMemory
PID:4464
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k netsvcs -p -s BITS1⤵
- Modifies data under HKEY_USERS
PID:4920