Overview

overview

10

Static

static

7862d6e083...0a.exe

windows7_x64

10

7862d6e083...0a.exe

windows10-2004_x64

10

Analysis

  • max time kernel
    148s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220310-en
  • submitted
    22-03-2022 12:54

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    7862d6e083c5792c40a6a570c1d3824ddab12cebc902ea965393fe057b717c0a.exe

  • Size

    586KB

  • MD5

    55b95e36469a3600abb995e58f61d4c9

  • SHA1

    de6717493246599d8702e7d1fd6914aab5bd015d

  • SHA256

    7862d6e083c5792c40a6a570c1d3824ddab12cebc902ea965393fe057b717c0a

  • SHA512

    9b2eceff54340057b3eae7391b7c5205c3b2d6d13299b4b918fb1d1a5f6f1006079fc4c58b9dd589738927cf0580f5050c4e61448dd82a8d089f2ea9ddcb5e0a

Score
10/10
ransomware

Malware Config

Extracted

Path

C:\Users\Admin\AppData\Local\Temp\!-Recovery_Instructions-!.txt

Ransom Note
! YOUR NETWORK HAS BEEN COMPROMISED ! All your important files have been encrypted! ANY ATTEMPT TO RESTORE A FILE WITH THIRD-PARTY SOFTWARE WILL PERMANENTLY CORRUPT IT. No software available on internet can help you. We are the only ones able to solve your problem. We gathered data from different segment of your network. These data are currently stored on a private server and will be immediately destroyed after your payment. If you decide to not pay, we will keep your data stored and contact press or re-seller or expose it on our partner's website. We only seek money and do not want to damage your reputation or prevent your business from running. If you take wise choice to pay, all of this will be solved very soon and smoothly. You will can send us 2-3 non-important files and we will decrypt it for free to prove we are able to give your files back. Contact us. restoreassistance_net@wholeness.business restoreassistance_net@decorous.cyou In the subject write - id-VA994b5ede65
Emails

restoreassistance_net@wholeness.business

restoreassistance_net@decorous.cyou

Signatures

  • Deletes shadow copies 2 TTPs

    Ransomware often targets backup files to inhibit system recovery.

    ransomware
  • Modifies extensions of user files 11 IoCs

    Ransomware generally changes the extension on encrypted files.

    ransomware
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops desktop.ini file(s) 25 IoCs
  • Drops file in Windows directory 23 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Delays execution with timeout.exe 1 IoCs
    evasion
  • Interacts with shadow copies 2 TTPs 1 IoCs

    Shadow copies are often targeted by ransomware to inhibit system recovery.

    ransomware
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\7862d6e083c5792c40a6a570c1d3824ddab12cebc902ea965393fe057b717c0a.exe
    "C:\Users\Admin\AppData\Local\Temp\7862d6e083c5792c40a6a570c1d3824ddab12cebc902ea965393fe057b717c0a.exe"
    1⤵
    • Modifies extensions of user files
    • Checks computer location settings
    • Drops desktop.ini file(s)
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:1916
    • C:\Windows\SYSTEM32\vssadmin.exe
      vssadmin delete shadows /all /quiet
      2⤵
      • Interacts with shadow copies
      PID:5076
    • C:\Windows\system32\cmd.exe
      "C:\Windows\system32\cmd.exe" /c timeout 1 && del "C:\Users\Admin\AppData\Local\Temp\7862d6e083c5792c40a6a570c1d3824ddab12cebc902ea965393fe057b717c0a.exe" >> NUL
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:3168
      • C:\Windows\system32\timeout.exe
        timeout 1
        3⤵
        • Delays execution with timeout.exe
        PID:2244
  • C:\Windows\system32\vssvc.exe
    C:\Windows\system32\vssvc.exe
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:2748
  • C:\Windows\System32\svchost.exe
    C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
    1⤵
    • Drops file in Windows directory
    PID:556
  • C:\Windows\System32\Upfc.exe
    C:\Windows\System32\Upfc.exe /launchtype periodic /cv vnmZEoxk7k6Jz+G579WJCg.0
    1⤵
      PID:1632

    Network

    MITRE ATT&CK Matrix ATT&CK v6

    Initial Access

    Execution

    Persistence

    Privilege Escalation

    Defense Evasion

    File Deletion

    2
    T1107

    Credential Access

    Discovery

    Query Registry

    1
    T1012

    System Information Discovery

    2
    T1082

    Lateral Movement

    Collection

    Exfiltration

    Command and Control

    Impact

    Inhibit System Recovery

    2
    T1490

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/556-134-0x00000151AB740000-0x00000151AB750000-memory.dmp
      Filesize

      64KB

      Download
    • memory/556-135-0x00000151AB7A0000-0x00000151AB7B0000-memory.dmp
      Filesize

      64KB

      Download
    • memory/556-136-0x00000151AE620000-0x00000151AE621000-memory.dmp
      Filesize

      4KB

      Download
    • memory/556-137-0x00000151AE6C0000-0x00000151AE6C4000-memory.dmp
      Filesize

      16KB

      Download
    • memory/556-138-0x00000151AE6C0000-0x00000151AE6C4000-memory.dmp
      Filesize

      16KB

      Download
    • memory/556-139-0x00000151AE810000-0x00000151AE814000-memory.dmp
      Filesize

      16KB

      Download
    • memory/556-140-0x00000151AE810000-0x00000151AE814000-memory.dmp
      Filesize

      16KB

      Download
    • memory/556-141-0x00000151AE780000-0x00000151AE784000-memory.dmp
      Filesize

      16KB

      Download
    • memory/556-142-0x00000151AECE0000-0x00000151AECE4000-memory.dmp
      Filesize

      16KB

      Download
    • memory/556-143-0x00000151AECE0000-0x00000151AECE4000-memory.dmp
      Filesize

      16KB

      Download