Overview
overview
10Static
static
1036c3-malwa.../1.exe
windows7_x64
1036c3-malwa.../1.exe
windows10-2004_x64
1036c3-malwa...86.exe
windows7_x64
1036c3-malwa...86.exe
windows10-2004_x64
1036c3-malwa...52.dll
windows7_x64
136c3-malwa...52.dll
windows10-2004_x64
636c3-malwa...V2.exe
windows7_x64
1036c3-malwa...V2.exe
windows10-2004_x64
1036c3-malwa....9.exe
windows7_x64
1036c3-malwa....9.exe
windows10-2004_x64
1036c3-malwa...aa.exe
windows7_x64
1036c3-malwa...aa.exe
windows10-2004_x64
1036c3-malwa...ty.exe
windows7_x64
1036c3-malwa...ty.exe
windows10-2004_x64
10Analysis
-
max time kernel
57s -
max time network
53s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
03-06-2022 02:44
Static task
static1
Behavioral task
behavioral1
Sample
36c3-malwarexchg-part3/1.exe
Resource
win7-20220414-en
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
36c3-malwarexchg-part3/1.exe
Resource
win10v2004-20220414-en
windows10-2004_x64
0 signatures
0 seconds
Behavioral task
behavioral3
Sample
36c3-malwarexchg-part3/5oaxnx86.exe
Resource
win7-20220414-en
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral4
Sample
36c3-malwarexchg-part3/5oaxnx86.exe
Resource
win10v2004-20220414-en
windows10-2004_x64
0 signatures
0 seconds
Behavioral task
behavioral5
Sample
36c3-malwarexchg-part3/6cb6fda0b353d411a30c5b945e53ea52.dll
Resource
win7-20220414-en
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral6
Sample
36c3-malwarexchg-part3/6cb6fda0b353d411a30c5b945e53ea52.dll
Resource
win10v2004-20220414-en
windows10-2004_x64
0 signatures
0 seconds
Behavioral task
behavioral7
Sample
36c3-malwarexchg-part3/DR_V2.exe
Resource
win7-20220414-en
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral8
Sample
36c3-malwarexchg-part3/DR_V2.exe
Resource
win10v2004-20220414-en
windows10-2004_x64
0 signatures
0 seconds
Behavioral task
behavioral9
Sample
36c3-malwarexchg-part3/GandCrabV5.0.9.exe
Resource
win7-20220414-en
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral10
Sample
36c3-malwarexchg-part3/GandCrabV5.0.9.exe
Resource
win10v2004-20220414-en
windows10-2004_x64
0 signatures
0 seconds
Behavioral task
behavioral11
Sample
36c3-malwarexchg-part3/ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
Resource
win7-20220414-en
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral12
Sample
36c3-malwarexchg-part3/ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
Resource
win10v2004-20220414-en
windows10-2004_x64
0 signatures
0 seconds
Behavioral task
behavioral13
Sample
36c3-malwarexchg-part3/pinebook-sality.exe
Resource
win7-20220414-en
windows7_x64
0 signatures
0 seconds
General
-
Target
36c3-malwarexchg-part3/5oaxnx86.exe
-
Size
1.1MB
-
MD5
6b91b9d9660180bc67106a78ad63ab1c
-
SHA1
68ae10ad50721aa915944020cfe1eaa30d28c6e1
-
SHA256
2a1eca5bba62227a6d1f4fb1686b8c65ba2e6fbdc457de6f6771df72d30e8023
-
SHA512
e5aab3db9dfdc1449d6dbec83930936acd881885bcca84786309bb4ae3d9d47ef02ccde86e30ff6c182bff9557545afb7b6ef785ef5b2cd6baf11e5b8bbc0036
Score
10/10
Malware Config
Extracted
Path
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\README_5OAXN_DATA.txt
Ransom Note
Hello!
Your all your files are encrypted and only I can decrypt them. Contact for me e-mail:
[email protected] or [email protected]
Write me if you want to return your files - I can do it very quickly!
The header of the letter must contain the extension of the encryptor
Do not rename encrypted files.
You may lose your files permanently.
You may be a victim of fraud.
To prove that I can recover your files, I am ready to decrypt any three files for free (except databases, Excel and backups)
!!! Do not turn off or restart the NAS equipment. This will result in data loss !!!
Signatures
-
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Modifies extensions of user files 13 IoCs
Ransomware generally changes the extension on encrypted files.
description ioc Process File renamed C:\Users\Admin\Pictures\RenameStep.png => C:\Users\Admin\Pictures\RenameStep.png.5oaxn 5oaxnx86.exe File opened for modification C:\Users\Admin\Pictures\RenameStep.png.5oaxn 5oaxnx86.exe File renamed C:\Users\Admin\Pictures\CompleteResolve.crw => C:\Users\Admin\Pictures\CompleteResolve.crw.5oaxn 5oaxnx86.exe File renamed C:\Users\Admin\Pictures\StopInvoke.png => C:\Users\Admin\Pictures\StopInvoke.png.5oaxn 5oaxnx86.exe File opened for modification C:\Users\Admin\Pictures\ProtectConfirm.png.5oaxn 5oaxnx86.exe File renamed C:\Users\Admin\Pictures\RegisterUninstall.png => C:\Users\Admin\Pictures\RegisterUninstall.png.5oaxn 5oaxnx86.exe File opened for modification C:\Users\Admin\Pictures\RegisterUninstall.png.5oaxn 5oaxnx86.exe File renamed C:\Users\Admin\Pictures\RenameRestart.tiff => C:\Users\Admin\Pictures\RenameRestart.tiff.5oaxn 5oaxnx86.exe File opened for modification C:\Users\Admin\Pictures\CompleteResolve.crw.5oaxn 5oaxnx86.exe File opened for modification C:\Users\Admin\Pictures\StopInvoke.png.5oaxn 5oaxnx86.exe File renamed C:\Users\Admin\Pictures\ProtectConfirm.png => C:\Users\Admin\Pictures\ProtectConfirm.png.5oaxn 5oaxnx86.exe File opened for modification C:\Users\Admin\Pictures\RenameRestart.tiff 5oaxnx86.exe File opened for modification C:\Users\Admin\Pictures\RenameRestart.tiff.5oaxn 5oaxnx86.exe -
resource yara_rule behavioral3/memory/960-56-0x0000000000400000-0x00000000006BE000-memory.dmp upx behavioral3/memory/960-57-0x0000000000400000-0x00000000006BE000-memory.dmp upx behavioral3/memory/960-60-0x0000000000400000-0x00000000006BE000-memory.dmp upx -
Deletes itself 1 IoCs
pid Process 324 CMD.exe -
Drops startup file 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\README_5OAXN_DATA.txt 5oaxnx86.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Bougainville 5oaxnx86.exe File opened for modification C:\Program Files\UnprotectConvertTo.htm 5oaxnx86.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\BORDERS\MSART5.BDR.5oaxn 5oaxnx86.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0105378.WMF 5oaxnx86.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\NA01472_.WMF 5oaxnx86.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD14983_.GIF.5oaxn 5oaxnx86.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\LABEL.XML.5oaxn 5oaxnx86.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\VDKHome\VDK10.SYX.5oaxn 5oaxnx86.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\NA02125_.WMF.5oaxn 5oaxnx86.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\PE05710_.WMF 5oaxnx86.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveDocumentReview\ActiveTabImage.jpg.5oaxn 5oaxnx86.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\db\lib\derbyLocale_es.jar 5oaxnx86.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\CLIP.WMF.5oaxn 5oaxnx86.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0107288.WMF 5oaxnx86.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0387337.JPG 5oaxnx86.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\IPIRMV.XML 5oaxnx86.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\ACCSBAR.POC 5oaxnx86.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Riga 5oaxnx86.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Asia\Baku.5oaxn 5oaxnx86.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\HH00443_.WMF 5oaxnx86.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0387882.JPG.5oaxn 5oaxnx86.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD21533_.GIF.5oaxn 5oaxnx86.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Stationery\1033\JUNGLE.HTM 5oaxnx86.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.security_1.2.0.v20130424-1801.jar 5oaxnx86.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\core\locale\com-sun-tools-visualvm-modules-startup_zh_CN.jar 5oaxnx86.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0099184.WMF 5oaxnx86.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\FORMS\1033\SIGN.CFG 5oaxnx86.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\button_right_over.gif 5oaxnx86.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-openide-dialogs_ja.jar.5oaxn 5oaxnx86.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\DD01176_.WMF.5oaxn 5oaxnx86.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Templates\1033\Access\Part\2 Top.accdt.5oaxn 5oaxnx86.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Templates\1033\PersonalMonthlyBudget.xltx 5oaxnx86.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0105398.WMF.5oaxn 5oaxnx86.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\SIDEBARVERTBB.DPV 5oaxnx86.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\SystemV\PST8PDT.5oaxn 5oaxnx86.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\DD01143_.WMF.5oaxn 5oaxnx86.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\PH03224I.JPG.5oaxn 5oaxnx86.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\FINCL_02.MID.5oaxn 5oaxnx86.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0105360.WMF 5oaxnx86.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\BrightYellow\TAB_ON.GIF 5oaxnx86.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\fonts\LucidaSansDemiBold.ttf 5oaxnx86.exe File opened for modification C:\Program Files\7-Zip\Lang\co.txt.5oaxn 5oaxnx86.exe File opened for modification C:\Program Files\Google\Chrome\Application\89.0.4389.114\Locales\pl.pak.5oaxn 5oaxnx86.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0285822.WMF 5oaxnx86.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBSPAPR\ZPDIR4F.GIF 5oaxnx86.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PAGESIZE\PGLBL078.XML.5oaxn 5oaxnx86.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\PH00601G.GIF.5oaxn 5oaxnx86.exe File created C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\GrayCheck\README_5OAXN_DATA.txt 5oaxnx86.exe File opened for modification C:\Program Files\Google\Chrome\Application\89.0.4389.114\Locales\hi.pak 5oaxnx86.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\ext\zipfs.jar.5oaxn 5oaxnx86.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\jconsole.jar.5oaxn 5oaxnx86.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\NA01680_.WMF 5oaxnx86.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveProjectToolset\ProjectTaskIconMask.bmp 5oaxnx86.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Asia\Shanghai.5oaxn 5oaxnx86.exe File created C:\Program Files\VideoLAN\VLC\lua\http\requests\README_5OAXN_DATA.txt 5oaxnx86.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\AN04267_.WMF 5oaxnx86.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0341561.JPG.5oaxn 5oaxnx86.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\INFOPATH.HXS.5oaxn 5oaxnx86.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolBMPs\SketchIconImages.bmp.5oaxn 5oaxnx86.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-keyring-fallback_ja.jar.5oaxn 5oaxnx86.exe File created C:\Program Files\Java\jre7\lib\images\README_5OAXN_DATA.txt 5oaxnx86.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0105240.WMF 5oaxnx86.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\CAGCAT10\J0222015.WMF.5oaxn 5oaxnx86.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\CommonData\AlertImage_High.jpg.5oaxn 5oaxnx86.exe -
Launches sc.exe 1 IoCs
Sc.exe is a Windows utlilty to control services on the system.
pid Process 1000 sc.exe -
Interacts with shadow copies 2 TTPs 2 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
pid Process 240 vssadmin.exe 1980 vssadmin.exe -
Runs ping.exe 1 TTPs 1 IoCs
pid Process 588 PING.EXE -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeBackupPrivilege 1160 vssvc.exe Token: SeRestorePrivilege 1160 vssvc.exe Token: SeAuditPrivilege 1160 vssvc.exe -
Suspicious use of WriteProcessMemory 20 IoCs
description pid Process procid_target PID 960 wrote to memory of 1000 960 5oaxnx86.exe 27 PID 960 wrote to memory of 1000 960 5oaxnx86.exe 27 PID 960 wrote to memory of 1000 960 5oaxnx86.exe 27 PID 960 wrote to memory of 1000 960 5oaxnx86.exe 27 PID 960 wrote to memory of 240 960 5oaxnx86.exe 29 PID 960 wrote to memory of 240 960 5oaxnx86.exe 29 PID 960 wrote to memory of 240 960 5oaxnx86.exe 29 PID 960 wrote to memory of 240 960 5oaxnx86.exe 29 PID 960 wrote to memory of 1980 960 5oaxnx86.exe 32 PID 960 wrote to memory of 1980 960 5oaxnx86.exe 32 PID 960 wrote to memory of 1980 960 5oaxnx86.exe 32 PID 960 wrote to memory of 1980 960 5oaxnx86.exe 32 PID 960 wrote to memory of 324 960 5oaxnx86.exe 34 PID 960 wrote to memory of 324 960 5oaxnx86.exe 34 PID 960 wrote to memory of 324 960 5oaxnx86.exe 34 PID 960 wrote to memory of 324 960 5oaxnx86.exe 34 PID 324 wrote to memory of 588 324 CMD.exe 37 PID 324 wrote to memory of 588 324 CMD.exe 37 PID 324 wrote to memory of 588 324 CMD.exe 37 PID 324 wrote to memory of 588 324 CMD.exe 37
Processes
-
C:\Users\Admin\AppData\Local\Temp\36c3-malwarexchg-part3\5oaxnx86.exe"C:\Users\Admin\AppData\Local\Temp\36c3-malwarexchg-part3\5oaxnx86.exe"1⤵
- Modifies extensions of user files
- Drops startup file
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:960 -
C:\Windows\SysWOW64\sc.exesc queryex type= service2⤵
- Launches sc.exe
PID:1000
-
-
C:\Windows\SysWOW64\vssadmin.exevssadmin delete shadows /all /quiet2⤵
- Interacts with shadow copies
PID:240
-
-
C:\Windows\SysWOW64\vssadmin.exevssadmin delete shadows /all /quiet2⤵
- Interacts with shadow copies
PID:1980
-
-
C:\Windows\SysWOW64\CMD.exeCMD /C PING 127.0.0.1 & DEL /F C:\Users\Admin\AppData\Local\Temp\36c3-malwarexchg-part3\5oaxnx86.exe2⤵
- Deletes itself
- Suspicious use of WriteProcessMemory
PID:324 -
C:\Windows\SysWOW64\PING.EXEPING 127.0.0.13⤵
- Runs ping.exe
PID:588
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1160