Analysis
- max time kernel
148s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20220310-en - submitted
22/03/2022, 12:54
General
- Target 7862d6e083c5792c40a6a570c1d3824ddab12cebc902ea965393fe057b717c0a.exe
- Size 586KB
- Sample220322-p476qsbebq
- SHA256 7862d6e083c5792c40a6a570c1d3824ddab12cebc902ea965393fe057b717c0a
Malware Config
Extracted
-
C:\Users\Admin\AppData\Local\Temp\!-Recovery_Instructions-!.txt
- ! YOUR NETWORK HAS BEEN COMPROMISED ! All your important files have been encrypted! ANY ATTEMPT TO RESTORE A FILE WITH THIRD-PARTY SOFTWARE WILL PERMANENTLY CORRUPT IT. No software available on internet can help you. We are the only ones able to solve your problem. We gathered data from different segment of your network. These data are currently stored on a private server and will be immediately destroyed after your payment. If you decide to not pay, we will keep your data stored and contact press or re-seller or expose it on our partner's website. We only seek money and do not want to damage your reputation or prevent your business from running. If you take wise choice to pay, all of this will be solved very soon and smoothly. You will can send us 2-3 non-important files and we will decrypt it for free to prove we are able to give your files back. Contact us. [email protected] [email protected] In the subject write - id-VA994b5ede65
Signatures
- Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
- Modifies extensions of user files 11 IoCs
Ransomware generally changes the extension on encrypted files.
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Drops desktop.ini file(s) 25 IoCs
- Drops file in Windows directory 23 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Delays execution with timeout.exe 1 IoCs
- Interacts with shadow copies 2 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 3 IoCs
- Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\7862d6e083c5792c40a6a570c1d3824ddab12cebc902ea965393fe057b717c0a.exe"C:\Users\Admin\AppData\Local\Temp\7862d6e083c5792c40a6a570c1d3824ddab12cebc902ea965393fe057b717c0a.exe"1⤵
- Modifies extensions of user files
- Checks computer location settings
- Drops desktop.ini file(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\vssadmin.exevssadmin delete shadows /all /quiet2⤵
- Interacts with shadow copies
-
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /c timeout 1 && del "C:\Users\Admin\AppData\Local\Temp\7862d6e083c5792c40a6a570c1d3824ddab12cebc902ea965393fe057b717c0a.exe" >> NUL2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\timeout.exetimeout 13⤵
- Delays execution with timeout.exe
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k netsvcs -p -s BITS1⤵
- Drops file in Windows directory
-
C:\Windows\System32\Upfc.exeC:\Windows\System32\Upfc.exe /launchtype periodic /cv vnmZEoxk7k6Jz+G579WJCg.01⤵
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/556-134-0x00000151AB740000-0x00000151AB750000-memory.dmp
memory/556-135-0x00000151AB7A0000-0x00000151AB7B0000-memory.dmp
memory/556-136-0x00000151AE620000-0x00000151AE621000-memory.dmp
memory/556-137-0x00000151AE6C0000-0x00000151AE6C4000-memory.dmp
memory/556-138-0x00000151AE6C0000-0x00000151AE6C4000-memory.dmp
memory/556-139-0x00000151AE810000-0x00000151AE814000-memory.dmp
memory/556-140-0x00000151AE810000-0x00000151AE814000-memory.dmp
memory/556-141-0x00000151AE780000-0x00000151AE784000-memory.dmp
memory/556-142-0x00000151AECE0000-0x00000151AECE4000-memory.dmp
memory/556-143-0x00000151AECE0000-0x00000151AECE4000-memory.dmp