Analysis
-
max time kernel
121s -
max time network
143s -
platform
windows10-2004_x64 -
resource
win10v2004-en-20220113 -
submitted
11/03/2022, 23:07
Static task
static1
Behavioral task
behavioral1
Sample
fefd1117c2f0ab88d8090bc3bdcb8213daf8065f12de1ee6a6c641e888a27eab.exe
Resource
win7-20220310-en
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
fefd1117c2f0ab88d8090bc3bdcb8213daf8065f12de1ee6a6c641e888a27eab.exe
Resource
win10v2004-en-20220113
windows10-2004_x64
0 signatures
0 seconds
General
-
Target
fefd1117c2f0ab88d8090bc3bdcb8213daf8065f12de1ee6a6c641e888a27eab.exe
-
Size
38KB
-
MD5
22a006b6d19558c3cebd708b2b0543bc
-
SHA1
2d92468b5982fbbb39776030fab6ac35c4a9b889
-
SHA256
fefd1117c2f0ab88d8090bc3bdcb8213daf8065f12de1ee6a6c641e888a27eab
-
SHA512
821833b5ffbb2f80f12214d969c033c23126fc2f4ef44f30d8b88236906512db5631e029f55d13869a4dc90e7bbee27fcfb8a391300178e4f055e22213d7b97b
Score
10/10
Malware Config
Extracted
Path
C:\NOKOYAWA_readme.txt
Ransom Note
Dear usernamme, your files were encrypted, some are compromised.
Be sure, you can't restore it without our help.
You need a private key that only we have.
Contact us to reach an agreement or we will leak your black shit to media:
[email protected]
[email protected]
亲爱的用户名，您的文件已加密，有些已被泄露。
请确保，如果没有我们的帮助，您将无法恢复它。
您需要一个只有我们拥有的私钥。
联系我们以达成协议，否则我们会将您的黑屎泄露给媒体：
[email protected]
[email protected]
Signatures
-
Modifies extensions of user files 4 IoCs
Ransomware generally changes the extension on encrypted files.
description ioc Process File opened for modification C:\Users\Admin\Pictures\ConnectResolve.tiff fefd1117c2f0ab88d8090bc3bdcb8213daf8065f12de1ee6a6c641e888a27eab.exe File renamed C:\Users\Admin\Pictures\ConnectResolve.tiff => C:\Users\Admin\Pictures\ConnectResolve.tiff.NOKOYAWA fefd1117c2f0ab88d8090bc3bdcb8213daf8065f12de1ee6a6c641e888a27eab.exe File renamed C:\Users\Admin\Pictures\LockMerge.crw => C:\Users\Admin\Pictures\LockMerge.crw.NOKOYAWA fefd1117c2f0ab88d8090bc3bdcb8213daf8065f12de1ee6a6c641e888a27eab.exe File renamed C:\Users\Admin\Pictures\RepairConvertFrom.crw => C:\Users\Admin\Pictures\RepairConvertFrom.crw.NOKOYAWA fefd1117c2f0ab88d8090bc3bdcb8213daf8065f12de1ee6a6c641e888a27eab.exe -
Drops desktop.ini file(s) 24 IoCs
description ioc Process File opened for modification C:\Users\Admin\Favorites\Links\desktop.ini fefd1117c2f0ab88d8090bc3bdcb8213daf8065f12de1ee6a6c641e888a27eab.exe File opened for modification C:\Users\Admin\Pictures\desktop.ini fefd1117c2f0ab88d8090bc3bdcb8213daf8065f12de1ee6a6c641e888a27eab.exe File opened for modification C:\Users\Admin\Saved Games\desktop.ini fefd1117c2f0ab88d8090bc3bdcb8213daf8065f12de1ee6a6c641e888a27eab.exe File opened for modification C:\Users\Public\Libraries\desktop.ini fefd1117c2f0ab88d8090bc3bdcb8213daf8065f12de1ee6a6c641e888a27eab.exe File opened for modification C:\Users\Public\Pictures\desktop.ini fefd1117c2f0ab88d8090bc3bdcb8213daf8065f12de1ee6a6c641e888a27eab.exe File opened for modification C:\Users\Admin\Videos\desktop.ini fefd1117c2f0ab88d8090bc3bdcb8213daf8065f12de1ee6a6c641e888a27eab.exe File opened for modification C:\Users\Public\AccountPictures\desktop.ini fefd1117c2f0ab88d8090bc3bdcb8213daf8065f12de1ee6a6c641e888a27eab.exe File opened for modification C:\Users\Public\Documents\desktop.ini fefd1117c2f0ab88d8090bc3bdcb8213daf8065f12de1ee6a6c641e888a27eab.exe File opened for modification C:\Users\Admin\3D Objects\desktop.ini fefd1117c2f0ab88d8090bc3bdcb8213daf8065f12de1ee6a6c641e888a27eab.exe File opened for modification C:\Users\Admin\Contacts\desktop.ini fefd1117c2f0ab88d8090bc3bdcb8213daf8065f12de1ee6a6c641e888a27eab.exe File opened for modification C:\Users\Admin\Documents\desktop.ini fefd1117c2f0ab88d8090bc3bdcb8213daf8065f12de1ee6a6c641e888a27eab.exe File opened for modification C:\Users\Admin\Downloads\desktop.ini fefd1117c2f0ab88d8090bc3bdcb8213daf8065f12de1ee6a6c641e888a27eab.exe File opened for modification C:\Users\Admin\Links\desktop.ini fefd1117c2f0ab88d8090bc3bdcb8213daf8065f12de1ee6a6c641e888a27eab.exe File opened for modification C:\Users\Public\Downloads\desktop.ini fefd1117c2f0ab88d8090bc3bdcb8213daf8065f12de1ee6a6c641e888a27eab.exe File opened for modification C:\Users\Admin\Favorites\desktop.ini fefd1117c2f0ab88d8090bc3bdcb8213daf8065f12de1ee6a6c641e888a27eab.exe File opened for modification C:\Users\Admin\Music\desktop.ini fefd1117c2f0ab88d8090bc3bdcb8213daf8065f12de1ee6a6c641e888a27eab.exe File opened for modification C:\Users\Admin\Pictures\Saved Pictures\desktop.ini fefd1117c2f0ab88d8090bc3bdcb8213daf8065f12de1ee6a6c641e888a27eab.exe File opened for modification C:\Users\Public\Desktop\desktop.ini fefd1117c2f0ab88d8090bc3bdcb8213daf8065f12de1ee6a6c641e888a27eab.exe File opened for modification C:\Users\Public\desktop.ini fefd1117c2f0ab88d8090bc3bdcb8213daf8065f12de1ee6a6c641e888a27eab.exe File opened for modification C:\Users\Admin\Desktop\desktop.ini fefd1117c2f0ab88d8090bc3bdcb8213daf8065f12de1ee6a6c641e888a27eab.exe File opened for modification C:\Users\Admin\Pictures\Camera Roll\desktop.ini fefd1117c2f0ab88d8090bc3bdcb8213daf8065f12de1ee6a6c641e888a27eab.exe File opened for modification C:\Users\Admin\Searches\desktop.ini fefd1117c2f0ab88d8090bc3bdcb8213daf8065f12de1ee6a6c641e888a27eab.exe File opened for modification C:\Users\Public\Music\desktop.ini fefd1117c2f0ab88d8090bc3bdcb8213daf8065f12de1ee6a6c641e888a27eab.exe File opened for modification C:\Users\Public\Videos\desktop.ini fefd1117c2f0ab88d8090bc3bdcb8213daf8065f12de1ee6a6c641e888a27eab.exe -
Enumerates connected drives 3 TTPs 22 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\F: fefd1117c2f0ab88d8090bc3bdcb8213daf8065f12de1ee6a6c641e888a27eab.exe File opened (read-only) \??\G: fefd1117c2f0ab88d8090bc3bdcb8213daf8065f12de1ee6a6c641e888a27eab.exe File opened (read-only) \??\N: fefd1117c2f0ab88d8090bc3bdcb8213daf8065f12de1ee6a6c641e888a27eab.exe File opened (read-only) \??\P: fefd1117c2f0ab88d8090bc3bdcb8213daf8065f12de1ee6a6c641e888a27eab.exe File opened (read-only) \??\X: fefd1117c2f0ab88d8090bc3bdcb8213daf8065f12de1ee6a6c641e888a27eab.exe File opened (read-only) \??\Y: fefd1117c2f0ab88d8090bc3bdcb8213daf8065f12de1ee6a6c641e888a27eab.exe File opened (read-only) \??\I: fefd1117c2f0ab88d8090bc3bdcb8213daf8065f12de1ee6a6c641e888a27eab.exe File opened (read-only) \??\R: fefd1117c2f0ab88d8090bc3bdcb8213daf8065f12de1ee6a6c641e888a27eab.exe File opened (read-only) \??\U: fefd1117c2f0ab88d8090bc3bdcb8213daf8065f12de1ee6a6c641e888a27eab.exe File opened (read-only) \??\Z: fefd1117c2f0ab88d8090bc3bdcb8213daf8065f12de1ee6a6c641e888a27eab.exe File opened (read-only) \??\W: fefd1117c2f0ab88d8090bc3bdcb8213daf8065f12de1ee6a6c641e888a27eab.exe File opened (read-only) \??\H: fefd1117c2f0ab88d8090bc3bdcb8213daf8065f12de1ee6a6c641e888a27eab.exe File opened (read-only) \??\J: fefd1117c2f0ab88d8090bc3bdcb8213daf8065f12de1ee6a6c641e888a27eab.exe File opened (read-only) \??\M: fefd1117c2f0ab88d8090bc3bdcb8213daf8065f12de1ee6a6c641e888a27eab.exe File opened (read-only) \??\O: fefd1117c2f0ab88d8090bc3bdcb8213daf8065f12de1ee6a6c641e888a27eab.exe File opened (read-only) \??\Q: fefd1117c2f0ab88d8090bc3bdcb8213daf8065f12de1ee6a6c641e888a27eab.exe File opened (read-only) \??\V: fefd1117c2f0ab88d8090bc3bdcb8213daf8065f12de1ee6a6c641e888a27eab.exe File opened (read-only) \??\E: fefd1117c2f0ab88d8090bc3bdcb8213daf8065f12de1ee6a6c641e888a27eab.exe File opened (read-only) \??\K: fefd1117c2f0ab88d8090bc3bdcb8213daf8065f12de1ee6a6c641e888a27eab.exe File opened (read-only) \??\L: fefd1117c2f0ab88d8090bc3bdcb8213daf8065f12de1ee6a6c641e888a27eab.exe File opened (read-only) \??\S: fefd1117c2f0ab88d8090bc3bdcb8213daf8065f12de1ee6a6c641e888a27eab.exe File opened (read-only) \??\T: fefd1117c2f0ab88d8090bc3bdcb8213daf8065f12de1ee6a6c641e888a27eab.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\fefd1117c2f0ab88d8090bc3bdcb8213daf8065f12de1ee6a6c641e888a27eab.exe"C:\Users\Admin\AppData\Local\Temp\fefd1117c2f0ab88d8090bc3bdcb8213daf8065f12de1ee6a6c641e888a27eab.exe"1⤵
- Modifies extensions of user files
- Drops desktop.ini file(s)
- Enumerates connected drives
PID:1684