Overview

overview

10

Static

static

8

5b56c5d863...7b.exe

windows7_x64

10

5b56c5d863...7b.exe

windows10-2004_x64

10

Analysis

  • max time kernel
    145s
  • max time network
    174s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220310-en
  • submitted
    16-03-2022 07:48

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    5b56c5d86347e164c6e571c86dbf5b1535eae6b979fede6ed66b01e79ea33b7b.exe

  • Size

    218KB

  • MD5

    0c4a84b66832a08dccc42b478d9d5e1b

  • SHA1

    160320b920a5ef22ac17b48146152ffbef60461f

  • SHA256

    5b56c5d86347e164c6e571c86dbf5b1535eae6b979fede6ed66b01e79ea33b7b

  • SHA512

    56e4b07baca1c4c82e518088cc713b97eb2aa4e096d39bd7076396e075621bc47a20fd6a65fb897dc974d77c01f242a872532136d4bd3097a57c4664d8430872

Score
10/10
ransomware

Malware Config

Extracted

Path

C:\Restore_My_Files.txt

Ransom Note
### What happened? #### !!!Your files are encrypted!!! *All your files are protected by strong encryption with RSA-2048.* *There is no public decryption software.* *We have successfully stolen your confidential document data, finances, emails, employee information, customers, research and development products...* #### What is the price? *The price depends on how fast you can write to us.* *After payment, we will send you the decryption tool which will decrypt all your files.* #### What should I do? *There is only one way to get your files back -->>Contact us, pay and get decryption software.* *If you decline payment, we will share your data files with the world.* *You can browse your data breach here: http://vbfqeh5nugm6r2u2qvghsdxm3fotf5wbxb5ltv6vw77vus5frdpuaiid.onion* (you should download and install TOR browser first hxxps://torproject.org) #### !!!Decryption Guaranteed!!! *Free decryption As a guarantee, you can send us up to 3 free decrypted files before payment.* #### !!!Contact us!!! email: contact@pandoraxyz.xyz #### !!!Warning!!! *Do not attempt to decrypt your data using third-party software, this may result in permanent data loss.* *Decrypting your files with the help of a third party may result in a price increase (they charge us a fee), or you may fall victim to a scam.* *Don't try to delete programs or run antivirus tools. It won't work.* *Attempting to self-decrypt the file will result in the loss of your data.*
Emails

contact@pandoraxyz.xyz

URLs

http://vbfqeh5nugm6r2u2qvghsdxm3fotf5wbxb5ltv6vw77vus5frdpuaiid.onion*

Signatures

  • Deletes shadow copies 2 TTPs

    Ransomware often targets backup files to inhibit system recovery.

    ransomware
  • Modifies extensions of user files 12 IoCs

    Ransomware generally changes the extension on encrypted files.

    ransomware
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Enumerates connected drives 3 TTPs 24 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in System32 directory 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 2 IoCs
  • Interacts with shadow copies 2 TTPs 1 IoCs

    Shadow copies are often targeted by ransomware to inhibit system recovery.

    ransomware
  • Modifies data under HKEY_USERS 6 IoCs
  • Opens file in notepad (likely ransom note) 6 IoCs
    ransomware
  • Suspicious behavior: EnumeratesProcesses 30 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Windows\System32\svchost.exe
    C:\Windows\System32\svchost.exe -k netsvcs -p
    1⤵
    • Drops file in System32 directory
    • Checks processor information in registry
    • Enumerates system info in registry
    PID:3296
  • C:\Users\Admin\AppData\Local\Temp\5b56c5d86347e164c6e571c86dbf5b1535eae6b979fede6ed66b01e79ea33b7b.exe
    "C:\Users\Admin\AppData\Local\Temp\5b56c5d86347e164c6e571c86dbf5b1535eae6b979fede6ed66b01e79ea33b7b.exe"
    1⤵
    • Modifies extensions of user files
    • Checks computer location settings
    • Enumerates connected drives
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:3796
    • C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /c vssadmin.exe delete shadows /all /quiet
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:4176
      • C:\Windows\system32\vssadmin.exe
        vssadmin.exe delete shadows /all /quiet
        3⤵
        • Interacts with shadow copies
        PID:2768
  • C:\Windows\System32\svchost.exe
    C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager
    1⤵
    • Modifies data under HKEY_USERS
    PID:1288
  • C:\Windows\system32\vssvc.exe
    C:\Windows\system32\vssvc.exe
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:4604
  • C:\Windows\system32\NOTEPAD.EXE
    "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Restore_My_Files.txt
    1⤵
    • Opens file in notepad (likely ransom note)
    PID:4112
  • C:\Windows\system32\NOTEPAD.EXE
    "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Restore_My_Files.txt
    1⤵
    • Opens file in notepad (likely ransom note)
    PID:3188
  • C:\Windows\system32\NOTEPAD.EXE
    "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Restore_My_Files.txt
    1⤵
    • Opens file in notepad (likely ransom note)
    • Suspicious use of FindShellTrayWindow
    PID:5108
  • C:\Windows\system32\NOTEPAD.EXE
    "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Restore_My_Files.txt
    1⤵
    • Opens file in notepad (likely ransom note)
    PID:5076
  • C:\Windows\system32\NOTEPAD.EXE
    "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Restore_My_Files.txt
    1⤵
    • Opens file in notepad (likely ransom note)
    PID:3908
  • C:\Windows\system32\NOTEPAD.EXE
    "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Restore_My_Files.txt
    1⤵
    • Opens file in notepad (likely ransom note)
    PID:3040

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File Deletion

2
T1107

Credential Access

Discovery

Query Registry

4
T1012

System Information Discovery

5
T1082

Peripheral Device Discovery

1
T1120

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Inhibit System Recovery

2
T1490

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\Desktop\Restore_My_Files.txt
    MD5

    667e8eb6a857d892d3fd53c18dd6e284

    SHA1

    cf40c1d329976081ddc1e03fa8d27cd8a1a31d88

    SHA256

    442f18c233c0a7672d4f163cfbe946987fc9b63da48734893ae4cf975d7de07a

    SHA512

    94c0548f2475f5f4dc645eb383ca9d2dbc862670d149c4bb9646409bd0373bb2acf694606db572a64b901eb966379e0bbf7830846b1fd6a939ab1ef660460d4f

    Download Submit
  • memory/3796-134-0x00007FFD09850000-0x00007FFD09A45000-memory.dmp
    Filesize

    2.0MB

    Download
  • memory/3796-135-0x00007FFD09850000-0x00007FFD09A45000-memory.dmp
    Filesize

    2.0MB

    Download
  • memory/3796-136-0x00007FFD07C00000-0x00007FFD07F55000-memory.dmp
    Filesize

    3.3MB

    Download