Overview

overview

10

Static

static

7f6dbd9fa0...07.exe

windows7_x64

10

7f6dbd9fa0...07.exe

windows10-2004_x64

10

Analysis

  • max time kernel
    90s
  • max time network
    152s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220331-en
  • submitted
    11-04-2022 15:54

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    7f6dbd9fa0cb7ba2487464c824b6d7e16ace9d4cd15e4452df4c9a9fd6bd1907.exe

  • Size

    175KB

  • MD5

    f746ea39c0c5ff9d0a1f2d250170ad80

  • SHA1

    dac28369f5a4436b2556f9b4f875e78d5c233edb

  • SHA256

    7f6dbd9fa0cb7ba2487464c824b6d7e16ace9d4cd15e4452df4c9a9fd6bd1907

  • SHA512

    dffb4eaa4119df790eb6b85ae341ee2ba4438d7983d0023320f19a4f2df201a3fc3d4d3cc4f1a67c6d1cad4809ac1b914bdad584da7df1b500354386f07fbc30

Score
10/10
ransomwarespywarestealer

Malware Config

Extracted

Path

C:\R3ADM3.txt

Ransom Note
_ ______ ____ _____ | \ | || ___ \/ ___|| ___| | \| || |_/ / /___ |___ \ | . ` || ___ \ ___ \ \ \ | |\ || |_/ / \_/ |/\__/ / \_| \_/\____/\_____/\____/ By now it's probably painfully apparent that your environment has been infected with ransomware. You can thank Conti for that. We've modified the code in a way that will prevent you from decrypting it with their decryptor. We've exfiltrated a significant amount of data including private emails, financial information, contacts, etc. Now, if you wish to contact us in order to save your files from permanent encryption you can do so by emailing network_battalion_0065@riseup.net. You have 3 days to establish contact. Failing to do so will result in that data remaining permenantly encrypted. While we have very little sympathy for the situation you find yourselves in right now, we will honor our agreement to restore your files across the affected environment once contact is established and payment is made. Until that time we will take no action. Be aware that we have compromised your entire network. We're watching very closely. Your President should not have commited war crimes. If you're searching for someone to blame for your current situation look no further than Vladimir Putin.
Emails

network_battalion_0065@riseup.net

Signatures

  • Modifies extensions of user files 4 IoCs

    Ransomware generally changes the extension on encrypted files.

    ransomware
  • Drops startup file 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Drops desktop.ini file(s) 31 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 45 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\7f6dbd9fa0cb7ba2487464c824b6d7e16ace9d4cd15e4452df4c9a9fd6bd1907.exe
    "C:\Users\Admin\AppData\Local\Temp\7f6dbd9fa0cb7ba2487464c824b6d7e16ace9d4cd15e4452df4c9a9fd6bd1907.exe"
    1⤵
    • Modifies extensions of user files
    • Drops startup file
    • Drops desktop.ini file(s)
    • Drops file in Program Files directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:4736
    • C:\Windows\SYSTEM32\cmd.exe
      cmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{B8018728-3992-4FD2-8701-E88FF6CA3E91}'" delete
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:3112
      • C:\Windows\System32\wbem\WMIC.exe
        C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{B8018728-3992-4FD2-8701-E88FF6CA3E91}'" delete
        3⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:3636
  • C:\Windows\system32\vssvc.exe
    C:\Windows\system32\vssvc.exe
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:4896

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

1
T1081

Discovery

Lateral Movement

Collection

Data from Local System

1
T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/3112-124-0x0000000000000000-mapping.dmp
    Download
  • memory/3636-125-0x0000000000000000-mapping.dmp
    Download