Overview

overview

10

Static

static

8

627ede421e...bb.exe

windows7_x64

10

627ede421e...bb.exe

windows10-2004_x64

10

Resubmissions

04-05-2022 18:54

220504-xkbmesedd4 10

03-05-2022 21:06

220503-zx5r5sfcam 10

Analysis

  • max time kernel
    43s
  • max time network
    46s
  • platform
    windows7_x64
  • resource
    win7-20220414-en
  • submitted
    03-05-2022 21:06

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    627ede421ee51a7153ee896f657169665c1e9f79ef0ba4af1f6450d816900cbb.exe

  • Size

    220KB

  • MD5

    adc3438992114c797a33b0a2ed415185

  • SHA1

    568979d0548bef3a113fd03f75b6d1c64aa4e0d9

  • SHA256

    627ede421ee51a7153ee896f657169665c1e9f79ef0ba4af1f6450d816900cbb

  • SHA512

    1f3d7551ee1621641b98da20dbc6444e6845af5fdc63f04339c5ab4a5d57fe12465e328edc91fd57c87c9ce64da89a0c8cbf155d0a3214d9a03c395812bfebf0

Score
10/10
ransomware

Malware Config

Extracted

Path

C:\Restore_My_Files.txt

Ransom Note
### What happened? #### !!!Your files are encrypted!!! *All your files are protected by strong encryption with RSA-2048.* *There is no public decryption software.* *We have successfully stolen your confidential document data, finances, emails, employee information, customers, research and development products...* #### What is the price? *The price depends on how fast you can write to us.* *After payment, we will send you the decryption tool which will decrypt all your files.* #### What should I do? *There is only one way to get your files back -->>Contact us, pay and get decryption software.* *If you decline payment, we will share your data files with the world.* *You can browse your data breach here: http://vbfqeh5nugm6r2u2qvghsdxm3fotf5wbxb5ltv6vw77vus5frdpuaiid.onion* (you should download and install TOR browser first hxxps://torproject.org) #### !!!Decryption Guaranteed!!! *Free decryption As a guarantee, you can send us up to 3 free decrypted files before payment.* #### !!!Contact us!!! email: contact@pandoraxyz.xyz #### !!!Warning!!! *Do not attempt to decrypt your data using third-party software, this may result in permanent data loss.* *Decrypting your files with the help of a third party may result in a price increase (they charge us a fee), or you may fall victim to a scam.* *Don't try to delete programs or run antivirus tools. It won't work.* *Attempting to self-decrypt the file will result in the loss of your data.*
Emails

contact@pandoraxyz.xyz

URLs

http://vbfqeh5nugm6r2u2qvghsdxm3fotf5wbxb5ltv6vw77vus5frdpuaiid.onion*

Signatures

  • Deletes shadow copies 2 TTPs

    Ransomware often targets backup files to inhibit system recovery.

    ransomware
  • Modifies extensions of user files 5 IoCs

    Ransomware generally changes the extension on encrypted files.

    ransomware
  • Enumerates connected drives 3 TTPs 24 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Interacts with shadow copies 2 TTPs 1 IoCs

    Shadow copies are often targeted by ransomware to inhibit system recovery.

    ransomware
  • Suspicious behavior: EnumeratesProcesses 30 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\627ede421ee51a7153ee896f657169665c1e9f79ef0ba4af1f6450d816900cbb.exe
    "C:\Users\Admin\AppData\Local\Temp\627ede421ee51a7153ee896f657169665c1e9f79ef0ba4af1f6450d816900cbb.exe"
    1⤵
    • Modifies extensions of user files
    • Enumerates connected drives
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1648
    • C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /c vssadmin.exe delete shadows /all /quiet
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:1980
      • C:\Windows\system32\vssadmin.exe
        vssadmin.exe delete shadows /all /quiet
        3⤵
        • Interacts with shadow copies
        PID:2044
  • C:\Windows\system32\vssvc.exe
    C:\Windows\system32\vssvc.exe
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:1832

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File Deletion

2
T1107

Credential Access

Discovery

Query Registry

1
T1012

Peripheral Device Discovery

1
T1120

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Inhibit System Recovery

2
T1490

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1648-54-0x000007FEFBAF1000-0x000007FEFBAF3000-memory.dmp
    Filesize

    8KB

    Download
  • memory/1980-55-0x0000000000000000-mapping.dmp
    Download
  • memory/2044-56-0x0000000000000000-mapping.dmp
    Download