13f476ec8dba856b93c2b799dbf9994191d14e9dbc2c6d75c9ec3d8054144b3f

Analysis

max time kernel
116s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20220414-en
submitted
03-06-2022 02:44

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

36c3-malwarexchg-part3/5oaxnx86.exe
Size

1.1MB
MD5

6b91b9d9660180bc67106a78ad63ab1c
SHA1

68ae10ad50721aa915944020cfe1eaa30d28c6e1
SHA256

2a1eca5bba62227a6d1f4fb1686b8c65ba2e6fbdc457de6f6771df72d30e8023
SHA512

e5aab3db9dfdc1449d6dbec83930936acd881885bcca84786309bb4ae3d9d47ef02ccde86e30ff6c182bff9557545afb7b6ef785ef5b2cd6baf11e5b8bbc0036

Score

10^/10

ransomware spyware stealer upx

Malware Config

Extracted

Path

C:\Program Files\7-Zip\Lang\README_5OAXN_DATA.txt

Ransom Note

Hello! Your all your files are encrypted and only I can decrypt them. Contact for me e-mail: support4568@mail.fr or support7164@firemail.cc Write me if you want to return your files - I can do it very quickly! The header of the letter must contain the extension of the encryptor Do not rename encrypted files. You may lose your files permanently. You may be a victim of fraud. To prove that I can recover your files, I am ready to decrypt any three files for free (except databases, Excel and backups) !!! Do not turn off or restart the NAS equipment. This will result in data loss !!!

Emails

support4568@mail.fr

support7164@firemail.cc

Signatures

Modifies extensions of user files 12 IoCs

Ransomware generally changes the extension on encrypted files.

ransomware

Processes:

5oaxnx86.exe

description	ioc	process
File opened for modification	C:\Users\Admin\Pictures\ConfirmReceive.tiff	5oaxnx86.exe
File renamed	C:\Users\Admin\Pictures\ConfirmReceive.tiff => C:\Users\Admin\Pictures\ConfirmReceive.tiff.5oaxn	5oaxnx86.exe
File renamed	C:\Users\Admin\Pictures\DismountOut.tif => C:\Users\Admin\Pictures\DismountOut.tif.5oaxn	5oaxnx86.exe
File opened for modification	C:\Users\Admin\Pictures\FindSwitch.tiff	5oaxnx86.exe
File opened for modification	C:\Users\Admin\Pictures\FindSwitch.tiff.5oaxn	5oaxnx86.exe
File opened for modification	C:\Users\Admin\Pictures\RemoveUnlock.crw.5oaxn	5oaxnx86.exe
File opened for modification	C:\Users\Admin\Pictures\SubmitAssert.png.5oaxn	5oaxnx86.exe
File opened for modification	C:\Users\Admin\Pictures\ConfirmReceive.tiff.5oaxn	5oaxnx86.exe
File opened for modification	C:\Users\Admin\Pictures\DismountOut.tif.5oaxn	5oaxnx86.exe
File renamed	C:\Users\Admin\Pictures\FindSwitch.tiff => C:\Users\Admin\Pictures\FindSwitch.tiff.5oaxn	5oaxnx86.exe
File renamed	C:\Users\Admin\Pictures\RemoveUnlock.crw => C:\Users\Admin\Pictures\RemoveUnlock.crw.5oaxn	5oaxnx86.exe
File renamed	C:\Users\Admin\Pictures\SubmitAssert.png => C:\Users\Admin\Pictures\SubmitAssert.png.5oaxn	5oaxnx86.exe

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral4/memory/4732-131-0x0000000000400000-0x00000000006BE000-memory.dmp	upx
behavioral4/memory/4732-132-0x0000000000400000-0x00000000006BE000-memory.dmp	upx
behavioral4/memory/4732-134-0x0000000000400000-0x00000000006BE000-memory.dmp	upx

Drops startup file 2 IoCs

Processes:

5oaxnx86.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\README_5OAXN_DATA.txt	5oaxnx86.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\README_5OAXN_DATA.txt	5oaxnx86.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Drops file in Program Files directory 64 IoCs

Processes:

5oaxnx86.exe

description	ioc	process
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTest4-ul-oob.xrm-ms	5oaxnx86.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\cgg\LC_MESSAGES\vlc.mo	5oaxnx86.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\images\themes\dark\s_listview_18.svg	5oaxnx86.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\ExchangeBadge.scale-125.png	5oaxnx86.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\db\bin\startNetworkServer.bat	5oaxnx86.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\SETLANG.HXS.5oaxn	5oaxnx86.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\SecondaryTiles\Car\RTL\contrast-black\SmallTile.scale-100.png	5oaxnx86.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\Cultures\OFFICE.ODF.5oaxn	5oaxnx86.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\S_IlluEmptyFolder_160.svg.5oaxn	5oaxnx86.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\jre\lib\amd64\jvm.cfg	5oaxnx86.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_OEM_Perp4-ul-oob.xrm-ms.5oaxn	5oaxnx86.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\cardview\lib\native-common\assets\cardview-checkmark@3x.png	5oaxnx86.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\s_sortedby_18.svg	5oaxnx86.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\zh-cn\ui-strings.js.5oaxn	5oaxnx86.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\nls\it-it\ui-strings.js.5oaxn	5oaxnx86.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusiness2019R_Grace-ul-oob.xrm-ms	5oaxnx86.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Fonts\private\MTEXTRA.TTF.5oaxn	5oaxnx86.exe
File created	C:\Program Files\WindowsPowerShell\Modules\PSReadline\2.0.0\README_5OAXN_DATA.txt	5oaxnx86.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.e4.ui.workbench.renderers.swt.nl_ja_4.4.0.v20140623020002.jar	5oaxnx86.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\dialogs\stream_config_window.html	5oaxnx86.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\nls\sv-se\ui-strings.js.5oaxn	5oaxnx86.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\file_types\comment.svg.5oaxn	5oaxnx86.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\ro-ro\README_5OAXN_DATA.txt	5oaxnx86.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\ro-ro\README_5OAXN_DATA.txt	5oaxnx86.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\config\Modules\org-openide-options.xml	5oaxnx86.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL096.XML	5oaxnx86.exe
File opened for modification	C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagement\es-ES\MSFT_PackageManagement.schema.mfl	5oaxnx86.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WebMediaExtensions_1.0.20875.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppList.targetsize-72_contrast-white.png	5oaxnx86.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\ContactPhoto.scale-100.png	5oaxnx86.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\js\nls\uk-ua\ui-strings.js.5oaxn	5oaxnx86.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\Font\MyriadPro-BoldIt.otf.5oaxn	5oaxnx86.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\OutlookR_Trial-ul-oob.xrm-ms.5oaxn	5oaxnx86.exe
File opened for modification	C:\Program Files\UnregisterResume.kix.5oaxn	5oaxnx86.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.0.22742.0_x64__8wekyb3d8bbwe\Assets\contrast-white\WideTile.scale-100_contrast-white.png	5oaxnx86.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019R_Trial-ppd.xrm-ms.5oaxn	5oaxnx86.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\OFFSYMSL.TTF	5oaxnx86.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\playlist\vimeo.luac.5oaxn	5oaxnx86.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Assets\Lighting\Dark\Silhouette.png	5oaxnx86.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_10.1906.2182.0_x64__8wekyb3d8bbwe\Assets\AlarmsAppList.targetsize-80.png	5oaxnx86.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\db\lib\derbyLocale_cs.jar	5oaxnx86.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.equinox.p2.garbagecollector.nl_ja_4.4.0.v20140623020002.jar.5oaxn	5oaxnx86.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\modules\org-openide-loaders.jar	5oaxnx86.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\sk-sk\ui-strings.js	5oaxnx86.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\js\nls\sl-si\ui-strings.js.5oaxn	5oaxnx86.exe
File created	C:\Program Files (x86)\Adobe\README_5OAXN_DATA.txt	5oaxnx86.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Car\RTL\contrast-black\README_5OAXN_DATA.txt	5oaxnx86.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\fi-fi\ui-strings.js.5oaxn	5oaxnx86.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\ru-ru\ui-strings.js	5oaxnx86.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogoSmall.contrast-white_scale-180.png	5oaxnx86.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\ro-ro\ui-strings.js	5oaxnx86.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\viewer\nls\fr-fr\ui-strings.js.5oaxn	5oaxnx86.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\README_5OAXN_DATA.txt	5oaxnx86.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\update_tracking\org-openide-compat.xml.5oaxn	5oaxnx86.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\EXCEL_COL.HXT.5oaxn	5oaxnx86.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\cardview\lib\native-common\assets\cardview-linkedentity-dark@2x.png.5oaxn	5oaxnx86.exe
File created	C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Common.View.UWP\Strings\lo-LA\README_5OAXN_DATA.txt	5oaxnx86.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_10.1906.2182.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\StopwatchSmallTile.contrast-black_scale-100.png	5oaxnx86.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\HxA-Advanced-Dark.scale-100.png	5oaxnx86.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\HxCalendarBadge.scale-400.png	5oaxnx86.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\HxMailSplashLogo.scale-100.png	5oaxnx86.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\com.jrockit.mc.greychartplugin_5.5.0.165303.jar	5oaxnx86.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\LogoImages\WinWordLogoSmall.contrast-black_scale-180.png	5oaxnx86.exe
File opened for modification	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsStore_11910.1002.5.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\AppTiles\contrast-black\LibrarySquare71x71Logo.scale-125_contrast-black.png	5oaxnx86.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\file_types\aic_file_icons.png	5oaxnx86.exe

Launches sc.exe 1 IoCs
Sc.exe is a Windows utlilty to control services on the system.

Processes:

sc.exe

pid process

5092 sc.exe
Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery
T1018

Processes:

PING.EXE

pid process

4128 PING.EXE

pid	process
5092	sc.exe

pid	process
4128	PING.EXE

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

5oaxnx86.exeCMD.exe

description	pid	process	target process
PID 4732 wrote to memory of 5092	4732	5oaxnx86.exe	sc.exe
PID 4732 wrote to memory of 5092	4732	5oaxnx86.exe	sc.exe
PID 4732 wrote to memory of 5092	4732	5oaxnx86.exe	sc.exe
PID 4732 wrote to memory of 4828	4732	5oaxnx86.exe	CMD.exe
PID 4732 wrote to memory of 4828	4732	5oaxnx86.exe	CMD.exe
PID 4732 wrote to memory of 4828	4732	5oaxnx86.exe	CMD.exe
PID 4828 wrote to memory of 4128	4828	CMD.exe	PING.EXE
PID 4828 wrote to memory of 4128	4828	CMD.exe	PING.EXE
PID 4828 wrote to memory of 4128	4828	CMD.exe	PING.EXE

C:\Users\Admin\AppData\Local\Temp\36c3-malwarexchg-part3\5oaxnx86.exe
"C:\Users\Admin\AppData\Local\Temp\36c3-malwarexchg-part3\5oaxnx86.exe"
1⤵
- Modifies extensions of user files
- Drops startup file
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:4732

C:\Windows\SysWOW64\sc.exe
sc queryex type= service
2⤵
- Launches sc.exe
PID:5092

C:\Windows\SysWOW64\CMD.exe
CMD /C PING 127.0.0.1 & DEL /F C:\Users\Admin\AppData\Local\Temp\36c3-malwarexchg-part3\5oaxnx86.exe
2⤵
- Suspicious use of WriteProcessMemory
PID:4828

C:\Windows\SysWOW64\PING.EXE
PING 127.0.0.1
3⤵
- Runs ping.exe
PID:4128

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

T1081

Discovery

Remote System Discovery

T1018

Lateral Movement

Collection

Data from Local System

T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4128-135-0x0000000000000000-mapping.dmp

Download
memory/4732-131-0x0000000000400000-0x00000000006BE000-memory.dmp

Filesize
2.7MB

Download
memory/4732-132-0x0000000000400000-0x00000000006BE000-memory.dmp

Filesize
2.7MB

Download
memory/4732-134-0x0000000000400000-0x00000000006BE000-memory.dmp

Filesize
2.7MB

Download
memory/4828-133-0x0000000000000000-mapping.dmp

Download
memory/5092-130-0x0000000000000000-mapping.dmp

Download