Overview

overview

10

Static

static

a8117abc27...54.exe

windows7_x64

10

a8117abc27...54.exe

windows10-2004_x64

9

Analysis

  • max time kernel
    128s
  • max time network
    50s
  • platform
    windows7_x64
  • resource
    win7-20220414-en
  • submitted
    07-06-2022 18:28

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    a8117abc27d70f18eaec3b6569e105edb2604c81b6e33dc81719e3e6247f5154.exe

  • Size

    62KB

  • MD5

    131a20e9f579bc9f7dd9832b4c5f25bd

  • SHA1

    83979db718962e3a0b45e5f70320fe5b4f009b7c

  • SHA256

    a8117abc27d70f18eaec3b6569e105edb2604c81b6e33dc81719e3e6247f5154

  • SHA512

    92e83892f635efb13d6f268ccab884b2079451a82a1e53a8482c632e126b14d3453c5ab17463d55b4cd2341d6b44034eb523867258932a9cd47deba435494f1c

Score
10/10
hakbitransomwarespywarestealer

Malware Config

Extracted

Path

C:\Users\Admin\Desktop\HELP_ME_RECOVER_MY_FILES.txt

Family

hakbit

Ransom Note
Atention! all your important files were encrypted! to get your files back send 1 Bitcoins and contact us with proof of payment and your Unique Identifier Key. We will send you a decryption tool with your personal decryption password. Where can you buy Bitcoins: https://www.coinbase.com https://localbitcoins.com Contact: [email protected] [email protected] Bitcoin wallet to make the transfer to is: 1F9i1vpfGfKXaUqhhgTmxe9Y2aS8stSGvR1F9i1vpfGfKXaUqhhgTmxe9Y2aS8stSGvR Unique Identifier Key (must be sent to us together with proof of payment): ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ JF2ae85uI+qcJGrh/PT5oWG8IAmo/+JAXYzpaqtvTaj2JEnTJ9yBQOSV6ApaKD/C9UlRWF7uGWeOUzyX5NYqdSLJr2ZKVlRBxZzRSIs1j7wqvHbVB6deFJspSspk6p6KjPkg5TOK9LofUgvPwPk6/PAF5Xvk8OtX1qbeopJLzoJ1v0OViMvPOS9V/TV6tshC1XNIwTYKCo6MmK8j+Gg+5mC4tkrOMXiCr1WT7WXKCzf4Lmi5mA2Tzgp0EpXG1tkFRn0S2Cgs3QBPQ5VlG1jZTccorKLk1xEB1ZjZ9/9jp3xBi4bEtbn3TJj5Ryscc4gPf039Oiuyxlph/LBDw1rmGA== ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------

Signatures

  • Hakbit

    Ransomware which encrypts files using AES, first seen in November 2019.

    ransomwarehakbit
  • Deletes shadow copies 2 TTPs

    Ransomware often targets backup files to inhibit system recovery.

    ransomware
  • Modifies extensions of user files 4 IoCs

    Ransomware generally changes the extension on encrypted files.

    ransomware
  • Deletes itself 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Enumerates connected drives 3 TTPs 18 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Legitimate hosting services abused for malware hosting/C2 1 TTPs
  • Launches sc.exe 4 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Interacts with shadow copies 2 TTPs 14 IoCs

    Shadow copies are often targeted by ransomware to inhibit system recovery.

    ransomware
  • Kills process with taskkill 3 IoCs
    evasion
  • Opens file in notepad (likely ransom note) 1 IoCs
    ransomware
  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 7 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\a8117abc27d70f18eaec3b6569e105edb2604c81b6e33dc81719e3e6247f5154.exe
    "C:\Users\Admin\AppData\Local\Temp\a8117abc27d70f18eaec3b6569e105edb2604c81b6e33dc81719e3e6247f5154.exe"
    1⤵
    • Modifies extensions of user files
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1320
    • C:\Windows\system32\net.exe
      "net.exe" stop avpsus /y
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:956
      • C:\Windows\system32\net1.exe
        C:\Windows\system32\net1 stop avpsus /y
        3⤵
          PID:1312
      • C:\Windows\system32\net.exe
        "net.exe" stop McAfeeDLPAgentService /y
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:816
        • C:\Windows\system32\net1.exe
          C:\Windows\system32\net1 stop McAfeeDLPAgentService /y
          3⤵
            PID:1156
        • C:\Windows\system32\net.exe
          "net.exe" stop mfewc /y
          2⤵
          • Suspicious use of WriteProcessMemory
          PID:1772
        • C:\Windows\system32\net.exe
          "net.exe" stop BMR Boot Service /y
          2⤵
          • Suspicious use of WriteProcessMemory
          PID:1488
          • C:\Windows\system32\net1.exe
            C:\Windows\system32\net1 stop BMR Boot Service /y
            3⤵
              PID:1720
          • C:\Windows\system32\net.exe
            "net.exe" stop NetBackup BMR MTFTP Service /y
            2⤵
            • Suspicious use of WriteProcessMemory
            PID:584
            • C:\Windows\system32\net1.exe
              C:\Windows\system32\net1 stop NetBackup BMR MTFTP Service /y
              3⤵
                PID:840
            • C:\Windows\system32\sc.exe
              "sc.exe" config SQLTELEMETRY start= disabled
              2⤵
              • Launches sc.exe
              PID:1064
            • C:\Windows\system32\sc.exe
              "sc.exe" config SQLTELEMETRY$ECWDB2 start= disabled
              2⤵
              • Launches sc.exe
              PID:1504
            • C:\Windows\system32\sc.exe
              "sc.exe" config SQLWriter start= disabled
              2⤵
              • Launches sc.exe
              PID:1512
            • C:\Windows\system32\sc.exe
              "sc.exe" config SstpSvc start= disabled
              2⤵
              • Launches sc.exe
              PID:1352
            • C:\Windows\system32\taskkill.exe
              "taskkill.exe" /IM mspub.exe /F
              2⤵
              • Kills process with taskkill
              • Suspicious use of AdjustPrivilegeToken
              PID:1976
            • C:\Windows\system32\taskkill.exe
              "taskkill.exe" /IM mydesktopqos.exe /F
              2⤵
              • Kills process with taskkill
              • Suspicious use of AdjustPrivilegeToken
              PID:564
            • C:\Windows\system32\taskkill.exe
              "taskkill.exe" /IM mydesktopservice.exe /F
              2⤵
              • Kills process with taskkill
              • Suspicious use of AdjustPrivilegeToken
              PID:1696
            • C:\Windows\system32\vssadmin.exe
              "vssadmin.exe" Delete Shadows /all /quiet
              2⤵
              • Interacts with shadow copies
              PID:560
            • C:\Windows\system32\vssadmin.exe
              "vssadmin.exe" resize shadowstorage /for=c: /on=c: /maxsize=401MB
              2⤵
              • Interacts with shadow copies
              PID:1388
            • C:\Windows\system32\vssadmin.exe
              "vssadmin.exe" resize shadowstorage /for=c: /on=c: /maxsize=unbounded
              2⤵
              • Interacts with shadow copies
              PID:1272
            • C:\Windows\system32\vssadmin.exe
              "vssadmin.exe" resize shadowstorage /for=d: /on=d: /maxsize=401MB
              2⤵
              • Enumerates connected drives
              • Interacts with shadow copies
              PID:828
            • C:\Windows\system32\vssadmin.exe
              "vssadmin.exe" resize shadowstorage /for=d: /on=d: /maxsize=unbounded
              2⤵
              • Enumerates connected drives
              • Interacts with shadow copies
              PID:1584
            • C:\Windows\system32\vssadmin.exe
              "vssadmin.exe" resize shadowstorage /for=e: /on=e: /maxsize=401MB
              2⤵
              • Enumerates connected drives
              • Interacts with shadow copies
              PID:1888
            • C:\Windows\system32\vssadmin.exe
              "vssadmin.exe" resize shadowstorage /for=e: /on=e: /maxsize=unbounded
              2⤵
              • Enumerates connected drives
              • Interacts with shadow copies
              PID:1988
            • C:\Windows\system32\vssadmin.exe
              "vssadmin.exe" resize shadowstorage /for=f: /on=f: /maxsize=401MB
              2⤵
              • Enumerates connected drives
              • Interacts with shadow copies
              PID:1004
            • C:\Windows\system32\vssadmin.exe
              "vssadmin.exe" resize shadowstorage /for=f: /on=f: /maxsize=unbounded
              2⤵
              • Enumerates connected drives
              • Interacts with shadow copies
              PID:1072
            • C:\Windows\system32\vssadmin.exe
              "vssadmin.exe" resize shadowstorage /for=g: /on=g: /maxsize=401MB
              2⤵
              • Enumerates connected drives
              • Interacts with shadow copies
              PID:924
            • C:\Windows\system32\vssadmin.exe
              "vssadmin.exe" resize shadowstorage /for=g: /on=g: /maxsize=unbounded
              2⤵
              • Enumerates connected drives
              • Interacts with shadow copies
              PID:232
            • C:\Windows\system32\vssadmin.exe
              "vssadmin.exe" resize shadowstorage /for=h: /on=h: /maxsize=401MB
              2⤵
              • Enumerates connected drives
              • Interacts with shadow copies
              PID:1180
            • C:\Windows\system32\vssadmin.exe
              "vssadmin.exe" resize shadowstorage /for=h: /on=h: /maxsize=unbounded
              2⤵
              • Enumerates connected drives
              • Interacts with shadow copies
              PID:1760
            • C:\Windows\system32\vssadmin.exe
              "vssadmin.exe" Delete Shadows /all /quiet
              2⤵
              • Interacts with shadow copies
              PID:1576
            • C:\Windows\system32\arp.exe
              "arp" -a
              2⤵
                PID:1676
              • C:\Windows\System32\notepad.exe
                "C:\Windows\System32\notepad.exe" C:\Users\Admin\Desktop\HELP_ME_RECOVER_MY_FILES.txt
                2⤵
                • Opens file in notepad (likely ransom note)
                PID:224
              • C:\Windows\System32\cmd.exe
                "C:\Windows\System32\cmd.exe" "/C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\a8117abc27d70f18eaec3b6569e105edb2604c81b6e33dc81719e3e6247f5154.exe
                2⤵
                • Deletes itself
                PID:216
                • C:\Windows\system32\choice.exe
                  choice /C Y /N /D Y /T 3
                  3⤵
                    PID:632
              • C:\Windows\system32\net1.exe
                C:\Windows\system32\net1 stop mfewc /y
                1⤵
                  PID:276
                • C:\Windows\system32\vssvc.exe
                  C:\Windows\system32\vssvc.exe
                  1⤵
                  • Suspicious use of AdjustPrivilegeToken
                  PID:764

                Network

                MITRE ATT&CK Enterprise v6

                Replay Monitor

                Loading Replay Monitor...

                Downloads

                • C:\Users\Admin\Desktop\HELP_ME_RECOVER_MY_FILES.txt
                  Filesize

                  1KB

                  MD5

                  8eeaf94e5bee22d7d1b45741ca864fea

                  SHA1

                  1ed97386d363f123338777928dcfa16f4e234fcc

                  SHA256

                  71000bcee4c6a84dfc2bec4d9fc86843e1038cdd10741f44932505883b9706d4

                  SHA512

                  fa4870a61fd7264ee8c0f8a3957e62c4601b8ddc86b802b8a6909dffde4beaedf4091cea50485ae91371dd5ca343af85a7d1a71566439194de27eb108ca6e4ee

                  Download Submit

                • memory/1320-86-0x000007FEFBE61000-0x000007FEFBE63000-memory.dmp

                  Filesize

                  8KB

                  Download

                • memory/1320-54-0x0000000000C70000-0x0000000000C86000-memory.dmp

                  Filesize

                  88KB

                  Download