Overview

overview

10

Static

static

861340ff00...11.ps1

windows7_x64

10

861340ff00...11.ps1

windows10-2004_x64

10

Analysis

  • max time kernel
    158s
  • max time network
    157s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220414-en
  • submitted
    20-05-2022 13:36

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    861340ff0057af288032d94212eb0252ca6b37c53653e28a607620e597221711.ps1

  • Size

    909KB

  • MD5

    0abc6981dc66033e0fae0351025d6399

  • SHA1

    ebe3b9509911f6af5438df3162a0cd756253bbaf

  • SHA256

    861340ff0057af288032d94212eb0252ca6b37c53653e28a607620e597221711

  • SHA512

    3cd6aa783390d6f619394169884fe739230e7de4a25195715d1770614374fd6038f23d0bffc5f0508730eee2ab1c37bac67022b0d7cb6f43bd7e98989a9a0c39

Score
10/10
netwalkerransomware

Malware Config

Extracted

Path

C:\odt\962775-Readme.txt

Family

netwalker

Ransom Note
Hi! Your files are encrypted. All encrypted files for this computer has extension: .962775 -- If for some reason you read this text before the encryption ended, this can be understood by the fact that the computer slows down, and your heart rate has increased due to the ability to turn it off, then we recommend that you move away from the computer and accept that you have been compromised. Rebooting/shutdown will cause you to lose files without the possibility of recovery. -- Our encryption algorithms are very strong and your files are very well protected, the only way to get your files back is to cooperate with us and get the decrypter program. Do not try to recover your files without a decrypter program, you may damage them and then they will be impossible to recover. For us this is just business and to prove to you our seriousness, we will decrypt you one file for free. Just open our website, upload the encrypted file and get the decrypted file for free. Additionally, your data may have been stolen and if you do not cooperate with us, it will become publicly available on our blog. -- Steps to get access on our website: 1.Download and install tor-browser: https://torproject.org/ 2.Open our website: pb36hu4spl6cyjdfhing7h3pw6dhpk32ifemawkujj4gp33ejzdq3did.onion If the website is not available, open another one: rnfdsgm6wb6j6su5txkekw4u4y47kp2eatvu7d6xhyn5cs4lt4pdrqqd.onion 3.Put your personal code in the input form: {code_962775: ZBxdQ6D3eSvAk9NQJJAiMBHrjkL90J/RILvznpb5OzpkUhr2Co zYCeXaFfOd3QHRay+GupfESZpbpB3CYohhzJLjbfyAIE5pDDvF yBrp4Vt8Cm7FiMgpHHJ6I5CRRsWto02kxQ8WLJR/i+Kcqa6feZ 23dPETjl0tPBhVNNXpjovxsbMhSk9GJztgYLpoXnPqVbaPYVTF GQnwKuVc3m1roScnNMcWlbMqSMQwQ2BTrH+CIwx7OP9kg0uuGK 5/XtpkUQIRtHYUpmV8dR8xp0Vdk2Ltb7SWV+9wOQ==}
URLs

http://pb36hu4spl6cyjdfhing7h3pw6dhpk32ifemawkujj4gp33ejzdq3did.onion

http://rnfdsgm6wb6j6su5txkekw4u4y47kp2eatvu7d6xhyn5cs4lt4pdrqqd.onion

Signatures

  • Netwalker Ransomware

    Ransomware family with multiple versions. Also known as MailTo.

    ransomwarenetwalker
  • Modifies extensions of user files 1 IoCs

    Ransomware generally changes the extension on encrypted files.

    ransomware
  • Drops file in Program Files directory 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 10 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
    • Modifies extensions of user files
    • Drops file in Program Files directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of AdjustPrivilegeToken
    PID:2408
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\861340ff0057af288032d94212eb0252ca6b37c53653e28a607620e597221711.ps1
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:1396
      • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
        "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\upxggxhx\upxggxhx.cmdline"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:1724
        • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
          C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESA6CF.tmp" "c:\Users\Admin\AppData\Local\Temp\upxggxhx\CSCC504AC6D23A496796AD51BBB38619FA.TMP"
          4⤵
            PID:4716
        • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
          "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\en2ath2v\en2ath2v.cmdline"
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:4628
          • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
            C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESBA38.tmp" "c:\Users\Admin\AppData\Local\Temp\en2ath2v\CSCC167E02AC52C4AA594C61FD4497776.TMP"
            4⤵
              PID:4616
      • C:\Windows\system32\vssvc.exe
        C:\Windows\system32\vssvc.exe
        1⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:3676

      Network

      MITRE ATT&CK Matrix

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Local\Temp\RESA6CF.tmp
        Filesize

        1KB

        MD5

        24902e328fd15eb98baaf2293f6e1d76

        SHA1

        299cd37e189b7258154701552280af0754e9b5b2

        SHA256

        317ea93f02e7c2e02a30476fd3cbdbb525a05b8a2f1032372602f93e4c5ef3a0

        SHA512

        be5698979d012478a1dfccbc2f0545551751fc85484518d2e8d0720fde34fbe4a0c673ae26263cc51fa7916000fbdca3bd9c7bdeb154849851ea64af6270eb8b

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\RESBA38.tmp
        Filesize

        1KB

        MD5

        1904549c4abe542a6fc9beb8e5d02060

        SHA1

        3e987416fdf94c1eaff5add0cef2a791d8a9824f

        SHA256

        abac61fe9e453282dbc7f1d647f3ef276e4a104a6039b2adfc1143a3d43d7a80

        SHA512

        adc83e017ac778b5c3981c647b7b5ce1bad5d6336f99d76dad334e96e2a6f0bb643782c2b6b0f00bfb848eb71c33bf146d5c449dcf1171cd9d15b8aeaf3c3c1f

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\en2ath2v\en2ath2v.dll
        Filesize

        4KB

        MD5

        f7a92bd4066483579621ffc969588041

        SHA1

        ccc64645fa9aff2aaf339d425fae13733bcef05b

        SHA256

        e84762d7c640b03a50fcfdc866908032cc6cc19cc367ca9a0499feb336a23030

        SHA512

        364dc9e082bf49cc0b1c86123e384c668e1180a23030fd7932bfef93198fe87212aeb8ec4c9ab98b12fccd4c9b61838538a4cb340ef18bcea9b63ef4ad99d818

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\upxggxhx\upxggxhx.dll
        Filesize

        6KB

        MD5

        48846092df67b00497211e7e0513ca74

        SHA1

        6a9ed95a0d310d400282eca7fff4dfc9327c8c7b

        SHA256

        955e99acf5a67af465a15eee92803f6b53e0166bd0cd42ae1082496c3752cbbd

        SHA512

        5918e7926b444c3f31444fb352d02bdd5e6845d8b40194fa41f278a4e1e96577d1872542d1fb30bf55cf9bf4e1316c658ed175850e21c27bd82ad3a97bb7a9d4

        Download Submit

      • \??\c:\Users\Admin\AppData\Local\Temp\en2ath2v\CSCC167E02AC52C4AA594C61FD4497776.TMP
        Filesize

        652B

        MD5

        97344732a92e7d3aaf4491e8bf0c7166

        SHA1

        2dc3c6c75340b7c802e0dbaaa06f6116daebd59a

        SHA256

        f4d154f5dc401a131b6b319fa12fbabe8c557592b0b46da2b9c26b46d2c7612e

        SHA512

        14236048ac12b3b7e7461ae1c577bd7ae4f0c5b2fa96023d09943a02851a3a0458800c17d4e1602e9b256a5ec7d9f6a0570ecc7113b0821d99672d9c708087be

        Download Submit

      • \??\c:\Users\Admin\AppData\Local\Temp\en2ath2v\en2ath2v.0.cs
        Filesize

        2KB

        MD5

        d491bc3537450532785880e98f087e97

        SHA1

        bf5a817e3776cff4554c03206159c54717ca09f2

        SHA256

        7e7bd87416a61d72128f5c5bdeb3b3054631393d22acfd84bc0a351e4cc6b491

        SHA512

        ebbd7f91049304640f30697cadea49eb8f69a26dc1581dc2e58fbf16421769ed5df67b4fe4bfc1dd6c58367adea0449c52aa26c0286e7ab153c6571b7fd59856

        Download Submit

      • \??\c:\Users\Admin\AppData\Local\Temp\en2ath2v\en2ath2v.cmdline
        Filesize

        369B

        MD5

        e520660ac74de11155d6cfdbe01123e7

        SHA1

        895f51d1bd1e3d98864f02a355b331a3d998488d

        SHA256

        2b79b0d27773765eb1616d68195a7ba0f94a63f6d0d2c2a3d2f8f78db2938eeb

        SHA512

        83af8ad5a41bae999322b643a46591ff80168d772383149d73c0408abbf3475b9f57bf80bc5bb72fc94988009f70f3e91f488980d45386f609fa2f4923a0eabc

        Download Submit

      • \??\c:\Users\Admin\AppData\Local\Temp\upxggxhx\CSCC504AC6D23A496796AD51BBB38619FA.TMP
        Filesize

        652B

        MD5

        58696f1c3289f19a9414dd584be9a27b

        SHA1

        695639e785e855d2bf78f04bbcedbac7cc3dae4e

        SHA256

        75b61c2b40505c1150d4e441d738bfce3e9576ab5667f960559f758f0288d289

        SHA512

        804aaa5d7709a5a8d19dc69b154e1ecd2ac536ca4a244875918de5ca9292d72d016cdd58835d09dacdecbc5aaed895abbcbf9a70342570b9b453a65aa7f95b8c

        Download Submit

      • \??\c:\Users\Admin\AppData\Local\Temp\upxggxhx\upxggxhx.0.cs
        Filesize

        9KB

        MD5

        77db487c078b0fa51e7fcace9b258cf1

        SHA1

        f73dc69329586dd07c5f4e273c03ee9164dc4936

        SHA256

        20a335545d41bad6dd654205fe7e8e38c807634307edc4463661f172d8b575de

        SHA512

        471f92bfb9a32090fa925e4cea14b218a290560e27ec5726ae65b8999293eaf3bb0f7b1b45595076a93d1406d00a5b61a1aa0c2b79294f355ef6df0f25f36cac

        Download Submit

      • \??\c:\Users\Admin\AppData\Local\Temp\upxggxhx\upxggxhx.cmdline
        Filesize

        369B

        MD5

        d7bb6f63b120a8e1517ce3f00296c422

        SHA1

        c0f93c9876602e3acd94289329fef1e3f18c641d

        SHA256

        bb109c33b582ea51641daed89772f71d8b156f5fa1379e05330c45ded35eecd6

        SHA512

        d0a04a47e1fc4eb80ee7e6f42d1e18bdd557fc6a2bd0da71fb7571a813c35bfe44c0fde63d09e9aebc5c2400279c546eebe1b436f08e404a96e5c65a4f6c6bb4

        Download Submit

      • memory/1396-130-0x00000226F3F60000-0x00000226F3F82000-memory.dmp

        Filesize

        136KB

        Download

      • memory/1396-131-0x00007FFAC76D0000-0x00007FFAC8191000-memory.dmp

        Filesize

        10.8MB

        Download

      • memory/2408-146-0x0000000000580000-0x00000000005A2000-memory.dmp

        Filesize

        136KB

        Download