Resubmissions
14/03/2022, 17:54
220314-wgxvtaafb4 8Analysis
-
max time kernel
168s -
max time network
180s -
platform
windows10-2004_x64 -
resource
win10v2004-20220310-en -
submitted
14/03/2022, 17:54
Static task
static1
Behavioral task
behavioral1
Sample
9f3c1668ee44bfcd1afd599215f5bd73c76609776b78cb04bb6ef1121cc80d37.exe
Resource
win7-20220310-en
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
9f3c1668ee44bfcd1afd599215f5bd73c76609776b78cb04bb6ef1121cc80d37.exe
Resource
win10v2004-20220310-en
windows10-2004_x64
0 signatures
0 seconds
General
-
Target
9f3c1668ee44bfcd1afd599215f5bd73c76609776b78cb04bb6ef1121cc80d37.exe
-
Size
490KB
-
MD5
3b3a50b242841e1789a919b1291051f1
-
SHA1
7b74a50352bb16ba94201c8a9e35b3c1d8a9dc8c
-
SHA256
9f3c1668ee44bfcd1afd599215f5bd73c76609776b78cb04bb6ef1121cc80d37
-
SHA512
ee56efff743ace5d667536acc2134d1f8add17cf8c19787e37a0b86d1a12cf975a26e8920cdf5b5941b698fc0fc5d1450852f80afef95de0e84f254433e39e77
Score
8/10
Malware Config
Signatures
-
Modifies extensions of user files 10 IoCs
Ransomware generally changes the extension on encrypted files.
description ioc Process File opened for modification C:\Users\Admin\Pictures\CompleteWait.tif.putinwillburninhell 9f3c1668ee44bfcd1afd599215f5bd73c76609776b78cb04bb6ef1121cc80d37.exe File opened for modification C:\Users\Admin\Pictures\CopyUnlock.tif.putinwillburninhell 9f3c1668ee44bfcd1afd599215f5bd73c76609776b78cb04bb6ef1121cc80d37.exe File opened for modification C:\Users\Admin\Pictures\SwitchStop.crw.putinwillburninhell 9f3c1668ee44bfcd1afd599215f5bd73c76609776b78cb04bb6ef1121cc80d37.exe File renamed C:\Users\Admin\Pictures\WaitUnlock.crw => C:\Users\Admin\Pictures\WaitUnlock.crw.putinwillburninhell 9f3c1668ee44bfcd1afd599215f5bd73c76609776b78cb04bb6ef1121cc80d37.exe File opened for modification C:\Users\Admin\Pictures\WaitUnlock.crw.putinwillburninhell 9f3c1668ee44bfcd1afd599215f5bd73c76609776b78cb04bb6ef1121cc80d37.exe File renamed C:\Users\Admin\Pictures\CompleteWait.tif => C:\Users\Admin\Pictures\CompleteWait.tif.putinwillburninhell 9f3c1668ee44bfcd1afd599215f5bd73c76609776b78cb04bb6ef1121cc80d37.exe File renamed C:\Users\Admin\Pictures\CopyUnlock.tif => C:\Users\Admin\Pictures\CopyUnlock.tif.putinwillburninhell 9f3c1668ee44bfcd1afd599215f5bd73c76609776b78cb04bb6ef1121cc80d37.exe File renamed C:\Users\Admin\Pictures\ExportRevoke.raw => C:\Users\Admin\Pictures\ExportRevoke.raw.putinwillburninhell 9f3c1668ee44bfcd1afd599215f5bd73c76609776b78cb04bb6ef1121cc80d37.exe File opened for modification C:\Users\Admin\Pictures\ExportRevoke.raw.putinwillburninhell 9f3c1668ee44bfcd1afd599215f5bd73c76609776b78cb04bb6ef1121cc80d37.exe File renamed C:\Users\Admin\Pictures\SwitchStop.crw => C:\Users\Admin\Pictures\SwitchStop.crw.putinwillburninhell 9f3c1668ee44bfcd1afd599215f5bd73c76609776b78cb04bb6ef1121cc80d37.exe -
Enumerates connected drives 3 TTPs 24 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\W: 9f3c1668ee44bfcd1afd599215f5bd73c76609776b78cb04bb6ef1121cc80d37.exe File opened (read-only) \??\R: 9f3c1668ee44bfcd1afd599215f5bd73c76609776b78cb04bb6ef1121cc80d37.exe File opened (read-only) \??\T: 9f3c1668ee44bfcd1afd599215f5bd73c76609776b78cb04bb6ef1121cc80d37.exe File opened (read-only) \??\I: 9f3c1668ee44bfcd1afd599215f5bd73c76609776b78cb04bb6ef1121cc80d37.exe File opened (read-only) \??\G: 9f3c1668ee44bfcd1afd599215f5bd73c76609776b78cb04bb6ef1121cc80d37.exe File opened (read-only) \??\J: 9f3c1668ee44bfcd1afd599215f5bd73c76609776b78cb04bb6ef1121cc80d37.exe File opened (read-only) \??\B: 9f3c1668ee44bfcd1afd599215f5bd73c76609776b78cb04bb6ef1121cc80d37.exe File opened (read-only) \??\E: 9f3c1668ee44bfcd1afd599215f5bd73c76609776b78cb04bb6ef1121cc80d37.exe File opened (read-only) \??\O: 9f3c1668ee44bfcd1afd599215f5bd73c76609776b78cb04bb6ef1121cc80d37.exe File opened (read-only) \??\A: 9f3c1668ee44bfcd1afd599215f5bd73c76609776b78cb04bb6ef1121cc80d37.exe File opened (read-only) \??\S: 9f3c1668ee44bfcd1afd599215f5bd73c76609776b78cb04bb6ef1121cc80d37.exe File opened (read-only) \??\K: 9f3c1668ee44bfcd1afd599215f5bd73c76609776b78cb04bb6ef1121cc80d37.exe File opened (read-only) \??\Z: 9f3c1668ee44bfcd1afd599215f5bd73c76609776b78cb04bb6ef1121cc80d37.exe File opened (read-only) \??\M: 9f3c1668ee44bfcd1afd599215f5bd73c76609776b78cb04bb6ef1121cc80d37.exe File opened (read-only) \??\Q: 9f3c1668ee44bfcd1afd599215f5bd73c76609776b78cb04bb6ef1121cc80d37.exe File opened (read-only) \??\U: 9f3c1668ee44bfcd1afd599215f5bd73c76609776b78cb04bb6ef1121cc80d37.exe File opened (read-only) \??\P: 9f3c1668ee44bfcd1afd599215f5bd73c76609776b78cb04bb6ef1121cc80d37.exe File opened (read-only) \??\F: 9f3c1668ee44bfcd1afd599215f5bd73c76609776b78cb04bb6ef1121cc80d37.exe File opened (read-only) \??\X: 9f3c1668ee44bfcd1afd599215f5bd73c76609776b78cb04bb6ef1121cc80d37.exe File opened (read-only) \??\V: 9f3c1668ee44bfcd1afd599215f5bd73c76609776b78cb04bb6ef1121cc80d37.exe File opened (read-only) \??\Y: 9f3c1668ee44bfcd1afd599215f5bd73c76609776b78cb04bb6ef1121cc80d37.exe File opened (read-only) \??\H: 9f3c1668ee44bfcd1afd599215f5bd73c76609776b78cb04bb6ef1121cc80d37.exe File opened (read-only) \??\L: 9f3c1668ee44bfcd1afd599215f5bd73c76609776b78cb04bb6ef1121cc80d37.exe File opened (read-only) \??\N: 9f3c1668ee44bfcd1afd599215f5bd73c76609776b78cb04bb6ef1121cc80d37.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2403053463-4052593947-3703345493-1000_Classes\Local Settings\MuiCache ShellExperienceHost.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 3860 9f3c1668ee44bfcd1afd599215f5bd73c76609776b78cb04bb6ef1121cc80d37.exe 3860 9f3c1668ee44bfcd1afd599215f5bd73c76609776b78cb04bb6ef1121cc80d37.exe 852 msedge.exe 852 msedge.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeRestorePrivilege 556 7zG.exe Token: 35 556 7zG.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 3900 ShellExperienceHost.exe 3900 ShellExperienceHost.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3308 wrote to memory of 2072 3308 msedge.exe 94 PID 3308 wrote to memory of 2072 3308 msedge.exe 94 PID 3308 wrote to memory of 2296 3308 msedge.exe 97 PID 3308 wrote to memory of 2296 3308 msedge.exe 97 PID 3308 wrote to memory of 2296 3308 msedge.exe 97 PID 3308 wrote to memory of 2296 3308 msedge.exe 97 PID 3308 wrote to memory of 2296 3308 msedge.exe 97 PID 3308 wrote to memory of 2296 3308 msedge.exe 97 PID 3308 wrote to memory of 2296 3308 msedge.exe 97 PID 3308 wrote to memory of 2296 3308 msedge.exe 97 PID 3308 wrote to memory of 2296 3308 msedge.exe 97 PID 3308 wrote to memory of 2296 3308 msedge.exe 97 PID 3308 wrote to memory of 2296 3308 msedge.exe 97 PID 3308 wrote to memory of 2296 3308 msedge.exe 97 PID 3308 wrote to memory of 2296 3308 msedge.exe 97 PID 3308 wrote to memory of 2296 3308 msedge.exe 97 PID 3308 wrote to memory of 2296 3308 msedge.exe 97 PID 3308 wrote to memory of 2296 3308 msedge.exe 97 PID 3308 wrote to memory of 2296 3308 msedge.exe 97 PID 3308 wrote to memory of 2296 3308 msedge.exe 97 PID 3308 wrote to memory of 2296 3308 msedge.exe 97 PID 3308 wrote to memory of 2296 3308 msedge.exe 97 PID 3308 wrote to memory of 2296 3308 msedge.exe 97 PID 3308 wrote to memory of 2296 3308 msedge.exe 97 PID 3308 wrote to memory of 2296 3308 msedge.exe 97 PID 3308 wrote to memory of 2296 3308 msedge.exe 97 PID 3308 wrote to memory of 2296 3308 msedge.exe 97 PID 3308 wrote to memory of 2296 3308 msedge.exe 97 PID 3308 wrote to memory of 2296 3308 msedge.exe 97 PID 3308 wrote to memory of 2296 3308 msedge.exe 97 PID 3308 wrote to memory of 2296 3308 msedge.exe 97 PID 3308 wrote to memory of 2296 3308 msedge.exe 97 PID 3308 wrote to memory of 2296 3308 msedge.exe 97 PID 3308 wrote to memory of 2296 3308 msedge.exe 97 PID 3308 wrote to memory of 2296 3308 msedge.exe 97 PID 3308 wrote to memory of 2296 3308 msedge.exe 97 PID 3308 wrote to memory of 2296 3308 msedge.exe 97 PID 3308 wrote to memory of 2296 3308 msedge.exe 97 PID 3308 wrote to memory of 2296 3308 msedge.exe 97 PID 3308 wrote to memory of 2296 3308 msedge.exe 97 PID 3308 wrote to memory of 2296 3308 msedge.exe 97 PID 3308 wrote to memory of 2296 3308 msedge.exe 97 PID 3308 wrote to memory of 852 3308 msedge.exe 98 PID 3308 wrote to memory of 852 3308 msedge.exe 98 PID 3308 wrote to memory of 3664 3308 msedge.exe 100 PID 3308 wrote to memory of 3664 3308 msedge.exe 100 PID 3308 wrote to memory of 3664 3308 msedge.exe 100 PID 3308 wrote to memory of 3664 3308 msedge.exe 100 PID 3308 wrote to memory of 3664 3308 msedge.exe 100 PID 3308 wrote to memory of 3664 3308 msedge.exe 100 PID 3308 wrote to memory of 3664 3308 msedge.exe 100 PID 3308 wrote to memory of 3664 3308 msedge.exe 100 PID 3308 wrote to memory of 3664 3308 msedge.exe 100 PID 3308 wrote to memory of 3664 3308 msedge.exe 100 PID 3308 wrote to memory of 3664 3308 msedge.exe 100 PID 3308 wrote to memory of 3664 3308 msedge.exe 100 PID 3308 wrote to memory of 3664 3308 msedge.exe 100 PID 3308 wrote to memory of 3664 3308 msedge.exe 100 PID 3308 wrote to memory of 3664 3308 msedge.exe 100 PID 3308 wrote to memory of 3664 3308 msedge.exe 100 PID 3308 wrote to memory of 3664 3308 msedge.exe 100 PID 3308 wrote to memory of 3664 3308 msedge.exe 100 PID 3308 wrote to memory of 3664 3308 msedge.exe 100 PID 3308 wrote to memory of 3664 3308 msedge.exe 100
Processes
-
C:\Users\Admin\AppData\Local\Temp\9f3c1668ee44bfcd1afd599215f5bd73c76609776b78cb04bb6ef1121cc80d37.exe"C:\Users\Admin\AppData\Local\Temp\9f3c1668ee44bfcd1afd599215f5bd73c76609776b78cb04bb6ef1121cc80d37.exe"1⤵
- Modifies extensions of user files
- Enumerates connected drives
- Suspicious behavior: EnumeratesProcesses
PID:3860
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\Desktop\RUSSKIJ VOENNIJ KORABL IDI NAHUJ.html1⤵
- Suspicious use of WriteProcessMemory
PID:3308 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ff960ed46f8,0x7ff960ed4708,0x7ff960ed47182⤵PID:2072
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2128,16751676217329767073,1602389076757895047,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2120 /prefetch:22⤵PID:2296
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2128,16751676217329767073,1602389076757895047,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2860 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:852
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2128,16751676217329767073,1602389076757895047,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2500 /prefetch:82⤵PID:3664
-
-
C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe"C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe" -ServerName:App.AppXtk181tbxbce2qsex02s8tw7hfxa9xb3t.mca1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:3900
-
C:\Program Files\7-Zip\7zG.exe"C:\Program Files\7-Zip\7zG.exe" a -i#7zMap21536:124:7zEvent23240 -tzip -sae -- "C:\Users\Admin\Desktop\RUSSKIJ VOENNIJ KORABL IDI NAHUJ.zip"1⤵
- Suspicious use of AdjustPrivilegeToken
PID:556