Overview

overview

10

Static

static

f3caa040ef...f5.exe

windows7_x64

10

f3caa040ef...f5.exe

windows10-2004_x64

10

Analysis

  • max time kernel
    69s
  • max time network
    47s
  • platform
    windows7_x64
  • resource
    win7-20220414-en
  • submitted
    08-07-2022 10:15

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    f3caa040efb298878b99f883a898f76d92554e07a8958e90ff70e7ff3cfabdf5.exe

  • Size

    235KB

  • MD5

    b7a182db3ba75e737f75bda1bc76331a

  • SHA1

    cf0fe28214ad4106c48ec5867327319eaa82b3c3

  • SHA256

    f3caa040efb298878b99f883a898f76d92554e07a8958e90ff70e7ff3cfabdf5

  • SHA512

    5e8d7f65ae231020056a3940d3ca31546986a6130a7956374edc0bc4f139f66f467bf27b66b5cdff73f52dc48ad00f84a9a618fec6db2727c61c44807fb650e8

Score
10/10
ransomware

Malware Config

Extracted

Path

C:\Restore_Your_Files.txt

Ransom Note
All your important files have been encrypted and stolen! Contact us for price and get decryption software. You have 3 days to contact us for negotiation. If you don't contact within three days, we'll start leaking data. 1) Contact our tox. Tox download address: https://tox.chat/ Our poison ID: 59B542C61F574BD8B3255E55651FC7C49EB53546FC6AD0698C7A12D97D193C7D6DBA9758A282 * Note that this server is available via Tor browser only Follow the instructions to open the link: 1. Type the addres "https://www.torproject.org" in your Internet browser. It opens the Tor site. 2. Press "Download Tor", then press "Download Tor Browser Bundle", install and run it. 3. Now you have Tor browser. In the Tor Browser open : http://yeuajcizwytgmrntijhxphs6wn5txp2prs6rpndafbsapek3zd4ubcid.onion
URLs

https://tox.chat/

http://yeuajcizwytgmrntijhxphs6wn5txp2prs6rpndafbsapek3zd4ubcid.onion

Signatures

  • Modifies extensions of user files 10 IoCs

    Ransomware generally changes the extension on encrypted files.

    ransomware
  • Enumerates connected drives 3 TTPs 24 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Modifies registry class 2 IoCs
  • Opens file in notepad (likely ransom note) 2 IoCs
    ransomware
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\f3caa040efb298878b99f883a898f76d92554e07a8958e90ff70e7ff3cfabdf5.exe
    "C:\Users\Admin\AppData\Local\Temp\f3caa040efb298878b99f883a898f76d92554e07a8958e90ff70e7ff3cfabdf5.exe"
    1⤵
    • Modifies extensions of user files
    • Enumerates connected drives
    • Suspicious behavior: EnumeratesProcesses
    PID:1684
  • C:\Windows\system32\NOTEPAD.EXE
    "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Public\Desktop\Restore_Your_Files.txt
    1⤵
    • Opens file in notepad (likely ransom note)
    PID:592
  • C:\Windows\system32\rundll32.exe
    "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\Desktop\SelectSuspend.vb.lilith
    1⤵
    • Modifies registry class
    • Suspicious use of WriteProcessMemory
    PID:672
    • C:\Windows\system32\NOTEPAD.EXE
      "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\SelectSuspend.vb.lilith
      2⤵
      • Opens file in notepad (likely ransom note)
      PID:1552

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1
T1012

Peripheral Device Discovery

1
T1120

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\Desktop\SelectSuspend.vb.lilith
    Filesize

    273KB

    MD5

    c44c2f8aa5002c3abc94a8242545f7f4

    SHA1

    465be03c6571cf01a8c5049a7154f71916502213

    SHA256

    53942c723360e9857dcd0040c28eed06d03c40c39e1a99bdb0969289bf2f87cb

    SHA512

    412ffcb194af6b3add28fd9c48caf476869ec3d0daa188206a90436c2fa72874474f9b2f250bf7ab97057569fc72228acb6bfcb40b68253a69a76f5901c8936b

    Download Submit
  • C:\Users\Public\Desktop\Restore_Your_Files.txt
    Filesize

    789B

    MD5

    adf02d7498cc7b3379ba694647c1f051

    SHA1

    8ace40a1487e1d78058b1f42111c41583d537ddb

    SHA256

    e63ae8bb47c3aa3339a02bb3937c893deb396c3b8bc8646abf5a91e90f2ffbc6

    SHA512

    25f3f289d50951607ba1ebee4a2ceb79a80782e35418773192fdb9300a7b11bf71a38775dc0ae659d82f743bf92e80dac9b5623004a51fde4dd895f480569148

    Download Submit
  • memory/592-56-0x000007FEFC511000-0x000007FEFC513000-memory.dmp
    Filesize

    8KB

    Download
  • memory/1552-59-0x0000000000000000-mapping.dmp
    Download
  • memory/1684-54-0x000007FEFD2B0000-0x000007FEFD2FE000-memory.dmp
    Filesize

    312KB

    Download
  • memory/1684-55-0x000007FEFF800000-0x000007FEFFA03000-memory.dmp
    Filesize

    2.0MB

    Download