13f476ec8dba856b93c2b799dbf9994191d14e9dbc2c6d75c9ec3d8054144b3f

Analysis

max time kernel
57s
max time network
53s
platform
windows7_x64
resource
win7-20220414-en
submitted
03-06-2022 02:44

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

36c3-malwarexchg-part3/5oaxnx86.exe
Size

1.1MB
MD5

6b91b9d9660180bc67106a78ad63ab1c
SHA1

68ae10ad50721aa915944020cfe1eaa30d28c6e1
SHA256

2a1eca5bba62227a6d1f4fb1686b8c65ba2e6fbdc457de6f6771df72d30e8023
SHA512

e5aab3db9dfdc1449d6dbec83930936acd881885bcca84786309bb4ae3d9d47ef02ccde86e30ff6c182bff9557545afb7b6ef785ef5b2cd6baf11e5b8bbc0036

Score

10^/10

ransomware spyware stealer upx

Malware Config

Extracted

Path

C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\README_5OAXN_DATA.txt

Ransom Note

Hello! Your all your files are encrypted and only I can decrypt them. Contact for me e-mail: support4568@mail.fr or support7164@firemail.cc Write me if you want to return your files - I can do it very quickly! The header of the letter must contain the extension of the encryptor Do not rename encrypted files. You may lose your files permanently. You may be a victim of fraud. To prove that I can recover your files, I am ready to decrypt any three files for free (except databases, Excel and backups) !!! Do not turn off or restart the NAS equipment. This will result in data loss !!!

Emails

support4568@mail.fr

support7164@firemail.cc

Signatures

Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware

File Deletion
T1107

Inhibit System Recovery
T1490

Modifies extensions of user files 13 IoCs

Ransomware generally changes the extension on encrypted files.

ransomware

Processes:

5oaxnx86.exe

description	ioc	process
File renamed	C:\Users\Admin\Pictures\RenameStep.png => C:\Users\Admin\Pictures\RenameStep.png.5oaxn	5oaxnx86.exe
File opened for modification	C:\Users\Admin\Pictures\RenameStep.png.5oaxn	5oaxnx86.exe
File renamed	C:\Users\Admin\Pictures\CompleteResolve.crw => C:\Users\Admin\Pictures\CompleteResolve.crw.5oaxn	5oaxnx86.exe
File renamed	C:\Users\Admin\Pictures\StopInvoke.png => C:\Users\Admin\Pictures\StopInvoke.png.5oaxn	5oaxnx86.exe
File opened for modification	C:\Users\Admin\Pictures\ProtectConfirm.png.5oaxn	5oaxnx86.exe
File renamed	C:\Users\Admin\Pictures\RegisterUninstall.png => C:\Users\Admin\Pictures\RegisterUninstall.png.5oaxn	5oaxnx86.exe
File opened for modification	C:\Users\Admin\Pictures\RegisterUninstall.png.5oaxn	5oaxnx86.exe
File renamed	C:\Users\Admin\Pictures\RenameRestart.tiff => C:\Users\Admin\Pictures\RenameRestart.tiff.5oaxn	5oaxnx86.exe
File opened for modification	C:\Users\Admin\Pictures\CompleteResolve.crw.5oaxn	5oaxnx86.exe
File opened for modification	C:\Users\Admin\Pictures\StopInvoke.png.5oaxn	5oaxnx86.exe
File renamed	C:\Users\Admin\Pictures\ProtectConfirm.png => C:\Users\Admin\Pictures\ProtectConfirm.png.5oaxn	5oaxnx86.exe
File opened for modification	C:\Users\Admin\Pictures\RenameRestart.tiff	5oaxnx86.exe
File opened for modification	C:\Users\Admin\Pictures\RenameRestart.tiff.5oaxn	5oaxnx86.exe

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral3/memory/960-56-0x0000000000400000-0x00000000006BE000-memory.dmp	upx
behavioral3/memory/960-57-0x0000000000400000-0x00000000006BE000-memory.dmp	upx
behavioral3/memory/960-60-0x0000000000400000-0x00000000006BE000-memory.dmp	upx

Deletes itself 1 IoCs

Processes:

CMD.exe

pid process

324 CMD.exe
Drops startup file 1 IoCs

Processes:

5oaxnx86.exe

description ioc process

File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\README_5OAXN_DATA.txt 5oaxnx86.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

pid	process
324	CMD.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\README_5OAXN_DATA.txt	5oaxnx86.exe

Drops file in Program Files directory 64 IoCs

Processes:

5oaxnx86.exe

description	ioc	process
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Bougainville	5oaxnx86.exe
File opened for modification	C:\Program Files\UnprotectConvertTo.htm	5oaxnx86.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\BORDERS\MSART5.BDR.5oaxn	5oaxnx86.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0105378.WMF	5oaxnx86.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\NA01472_.WMF	5oaxnx86.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD14983_.GIF.5oaxn	5oaxnx86.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\LABEL.XML.5oaxn	5oaxnx86.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\VDKHome\VDK10.SYX.5oaxn	5oaxnx86.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\NA02125_.WMF.5oaxn	5oaxnx86.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\PE05710_.WMF	5oaxnx86.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveDocumentReview\ActiveTabImage.jpg.5oaxn	5oaxnx86.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\db\lib\derbyLocale_es.jar	5oaxnx86.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\CLIP.WMF.5oaxn	5oaxnx86.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0107288.WMF	5oaxnx86.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0387337.JPG	5oaxnx86.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\IPIRMV.XML	5oaxnx86.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\ACCSBAR.POC	5oaxnx86.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Riga	5oaxnx86.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\Asia\Baku.5oaxn	5oaxnx86.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\HH00443_.WMF	5oaxnx86.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0387882.JPG.5oaxn	5oaxnx86.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD21533_.GIF.5oaxn	5oaxnx86.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Stationery\1033\JUNGLE.HTM	5oaxnx86.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.security_1.2.0.v20130424-1801.jar	5oaxnx86.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\core\locale\com-sun-tools-visualvm-modules-startup_zh_CN.jar	5oaxnx86.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0099184.WMF	5oaxnx86.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\FORMS\1033\SIGN.CFG	5oaxnx86.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\button_right_over.gif	5oaxnx86.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-openide-dialogs_ja.jar.5oaxn	5oaxnx86.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\DD01176_.WMF.5oaxn	5oaxnx86.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Templates\1033\Access\Part\2 Top.accdt.5oaxn	5oaxnx86.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Templates\1033\PersonalMonthlyBudget.xltx	5oaxnx86.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0105398.WMF.5oaxn	5oaxnx86.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\SIDEBARVERTBB.DPV	5oaxnx86.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\SystemV\PST8PDT.5oaxn	5oaxnx86.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\DD01143_.WMF.5oaxn	5oaxnx86.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\PH03224I.JPG.5oaxn	5oaxnx86.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\FINCL_02.MID.5oaxn	5oaxnx86.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0105360.WMF	5oaxnx86.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\BrightYellow\TAB_ON.GIF	5oaxnx86.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\fonts\LucidaSansDemiBold.ttf	5oaxnx86.exe
File opened for modification	C:\Program Files\7-Zip\Lang\co.txt.5oaxn	5oaxnx86.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\89.0.4389.114\Locales\pl.pak.5oaxn	5oaxnx86.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0285822.WMF	5oaxnx86.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBSPAPR\ZPDIR4F.GIF	5oaxnx86.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\PAGESIZE\PGLBL078.XML.5oaxn	5oaxnx86.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\PH00601G.GIF.5oaxn	5oaxnx86.exe
File created	C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\GrayCheck\README_5OAXN_DATA.txt	5oaxnx86.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\89.0.4389.114\Locales\hi.pak	5oaxnx86.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\ext\zipfs.jar.5oaxn	5oaxnx86.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\jconsole.jar.5oaxn	5oaxnx86.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\NA01680_.WMF	5oaxnx86.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveProjectToolset\ProjectTaskIconMask.bmp	5oaxnx86.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\Asia\Shanghai.5oaxn	5oaxnx86.exe
File created	C:\Program Files\VideoLAN\VLC\lua\http\requests\README_5OAXN_DATA.txt	5oaxnx86.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\AN04267_.WMF	5oaxnx86.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0341561.JPG.5oaxn	5oaxnx86.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\INFOPATH.HXS.5oaxn	5oaxnx86.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolBMPs\SketchIconImages.bmp.5oaxn	5oaxnx86.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-keyring-fallback_ja.jar.5oaxn	5oaxnx86.exe
File created	C:\Program Files\Java\jre7\lib\images\README_5OAXN_DATA.txt	5oaxnx86.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0105240.WMF	5oaxnx86.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\MEDIA\CAGCAT10\J0222015.WMF.5oaxn	5oaxnx86.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\CommonData\AlertImage_High.jpg.5oaxn	5oaxnx86.exe

Launches sc.exe 1 IoCs
Sc.exe is a Windows utlilty to control services on the system.

Processes:

sc.exe

pid process

1000 sc.exe
Interacts with shadow copies 2 TTPs 2 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
ransomware

File Deletion
T1107

Inhibit System Recovery
T1490

Processes:

vssadmin.exevssadmin.exe

pid process

240 vssadmin.exe
1980 vssadmin.exe
Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery
T1018

Processes:

PING.EXE

pid process

588 PING.EXE
Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

vssvc.exe

description pid process

Token: SeBackupPrivilege 1160 vssvc.exe
Token: SeRestorePrivilege 1160 vssvc.exe
Token: SeAuditPrivilege 1160 vssvc.exe

pid	process
1000	sc.exe

pid	process
240	vssadmin.exe
1980	vssadmin.exe

pid	process
588	PING.EXE

description	pid	process
Token: SeBackupPrivilege	1160	vssvc.exe
Token: SeRestorePrivilege	1160	vssvc.exe
Token: SeAuditPrivilege	1160	vssvc.exe

Suspicious use of WriteProcessMemory 20 IoCs

Processes:

5oaxnx86.exeCMD.exe

description	pid	process	target process
PID 960 wrote to memory of 1000	960	5oaxnx86.exe	sc.exe
PID 960 wrote to memory of 1000	960	5oaxnx86.exe	sc.exe
PID 960 wrote to memory of 1000	960	5oaxnx86.exe	sc.exe
PID 960 wrote to memory of 1000	960	5oaxnx86.exe	sc.exe
PID 960 wrote to memory of 240	960	5oaxnx86.exe	vssadmin.exe
PID 960 wrote to memory of 240	960	5oaxnx86.exe	vssadmin.exe
PID 960 wrote to memory of 240	960	5oaxnx86.exe	vssadmin.exe
PID 960 wrote to memory of 240	960	5oaxnx86.exe	vssadmin.exe
PID 960 wrote to memory of 1980	960	5oaxnx86.exe	vssadmin.exe
PID 960 wrote to memory of 1980	960	5oaxnx86.exe	vssadmin.exe
PID 960 wrote to memory of 1980	960	5oaxnx86.exe	vssadmin.exe
PID 960 wrote to memory of 1980	960	5oaxnx86.exe	vssadmin.exe
PID 960 wrote to memory of 324	960	5oaxnx86.exe	CMD.exe
PID 960 wrote to memory of 324	960	5oaxnx86.exe	CMD.exe
PID 960 wrote to memory of 324	960	5oaxnx86.exe	CMD.exe
PID 960 wrote to memory of 324	960	5oaxnx86.exe	CMD.exe
PID 324 wrote to memory of 588	324	CMD.exe	PING.EXE
PID 324 wrote to memory of 588	324	CMD.exe	PING.EXE
PID 324 wrote to memory of 588	324	CMD.exe	PING.EXE
PID 324 wrote to memory of 588	324	CMD.exe	PING.EXE

C:\Users\Admin\AppData\Local\Temp\36c3-malwarexchg-part3\5oaxnx86.exe
"C:\Users\Admin\AppData\Local\Temp\36c3-malwarexchg-part3\5oaxnx86.exe"
1⤵
- Modifies extensions of user files
- Drops startup file
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:960

C:\Windows\SysWOW64\sc.exe
sc queryex type= service
2⤵
- Launches sc.exe
PID:1000

C:\Windows\SysWOW64\vssadmin.exe
vssadmin delete shadows /all /quiet
2⤵
- Interacts with shadow copies
PID:240

C:\Windows\SysWOW64\vssadmin.exe
vssadmin delete shadows /all /quiet
2⤵
- Interacts with shadow copies
PID:1980

C:\Windows\SysWOW64\CMD.exe
CMD /C PING 127.0.0.1 & DEL /F C:\Users\Admin\AppData\Local\Temp\36c3-malwarexchg-part3\5oaxnx86.exe
2⤵
- Deletes itself
- Suspicious use of WriteProcessMemory
PID:324

C:\Windows\SysWOW64\PING.EXE
PING 127.0.0.1
3⤵
- Runs ping.exe
PID:588

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1160

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File Deletion

T1107

Credential Access

Credentials in Files

T1081

Discovery

Remote System Discovery

T1018

Lateral Movement

Collection

Data from Local System

T1005

Exfiltration

Command and Control

Impact

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

memory/240-55-0x0000000000000000-mapping.dmp

Download
memory/324-59-0x0000000000000000-mapping.dmp

Download
memory/588-61-0x0000000000000000-mapping.dmp

Download
memory/960-56-0x0000000000400000-0x00000000006BE000-memory.dmp

Filesize
2.7MB

Download
memory/960-57-0x0000000000400000-0x00000000006BE000-memory.dmp

Filesize
2.7MB

Download
memory/960-60-0x0000000000400000-0x00000000006BE000-memory.dmp

Filesize
2.7MB

Download
memory/1000-54-0x0000000000000000-mapping.dmp

Download
memory/1980-58-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads