Analysis
-
max time kernel
69s -
max time network
47s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
08/07/2022, 10:15
Static task
static1
Behavioral task
behavioral1
Sample
f3caa040efb298878b99f883a898f76d92554e07a8958e90ff70e7ff3cfabdf5.exe
Resource
win7-20220414-en
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
f3caa040efb298878b99f883a898f76d92554e07a8958e90ff70e7ff3cfabdf5.exe
Resource
win10v2004-20220414-en
windows10-2004_x64
0 signatures
0 seconds
General
-
Target
f3caa040efb298878b99f883a898f76d92554e07a8958e90ff70e7ff3cfabdf5.exe
-
Size
235KB
-
MD5
b7a182db3ba75e737f75bda1bc76331a
-
SHA1
cf0fe28214ad4106c48ec5867327319eaa82b3c3
-
SHA256
f3caa040efb298878b99f883a898f76d92554e07a8958e90ff70e7ff3cfabdf5
-
SHA512
5e8d7f65ae231020056a3940d3ca31546986a6130a7956374edc0bc4f139f66f467bf27b66b5cdff73f52dc48ad00f84a9a618fec6db2727c61c44807fb650e8
Score
10/10
Malware Config
Extracted
Path
C:\Restore_Your_Files.txt
Ransom Note
All your important files have been encrypted and stolen!
Contact us for price and get decryption software.
You have 3 days to contact us for negotiation.
If you don't contact within three days, we'll start leaking data.
1) Contact our tox.
Tox download address: https://tox.chat/
Our poison ID:
59B542C61F574BD8B3255E55651FC7C49EB53546FC6AD0698C7A12D97D193C7D6DBA9758A282
* Note that this server is available via Tor browser only
Follow the instructions to open the link:
1. Type the addres "https://www.torproject.org" in your Internet browser. It opens the Tor site.
2. Press "Download Tor", then press "Download Tor Browser Bundle", install and run it.
3. Now you have Tor browser. In the Tor Browser open :
http://yeuajcizwytgmrntijhxphs6wn5txp2prs6rpndafbsapek3zd4ubcid.onion
URLs
https://tox.chat/
http://yeuajcizwytgmrntijhxphs6wn5txp2prs6rpndafbsapek3zd4ubcid.onion
Signatures
-
Modifies extensions of user files 10 IoCs
Ransomware generally changes the extension on encrypted files.
description ioc Process File renamed C:\Users\Admin\Pictures\ExportSync.crw => C:\Users\Admin\Pictures\ExportSync.crw.lilith f3caa040efb298878b99f883a898f76d92554e07a8958e90ff70e7ff3cfabdf5.exe File renamed C:\Users\Admin\Pictures\MountTest.tiff => C:\Users\Admin\Pictures\MountTest.tiff.lilith f3caa040efb298878b99f883a898f76d92554e07a8958e90ff70e7ff3cfabdf5.exe File renamed C:\Users\Admin\Pictures\ReadInstall.tif => C:\Users\Admin\Pictures\ReadInstall.tif.lilith f3caa040efb298878b99f883a898f76d92554e07a8958e90ff70e7ff3cfabdf5.exe File renamed C:\Users\Admin\Pictures\UninstallAssert.png => C:\Users\Admin\Pictures\UninstallAssert.png.lilith f3caa040efb298878b99f883a898f76d92554e07a8958e90ff70e7ff3cfabdf5.exe File renamed C:\Users\Admin\Pictures\FormatLock.tif => C:\Users\Admin\Pictures\FormatLock.tif.lilith f3caa040efb298878b99f883a898f76d92554e07a8958e90ff70e7ff3cfabdf5.exe File opened for modification C:\Users\Admin\Pictures\MountTest.tiff f3caa040efb298878b99f883a898f76d92554e07a8958e90ff70e7ff3cfabdf5.exe File renamed C:\Users\Admin\Pictures\ResolveRedo.tif => C:\Users\Admin\Pictures\ResolveRedo.tif.lilith f3caa040efb298878b99f883a898f76d92554e07a8958e90ff70e7ff3cfabdf5.exe File renamed C:\Users\Admin\Pictures\RepairSuspend.raw => C:\Users\Admin\Pictures\RepairSuspend.raw.lilith f3caa040efb298878b99f883a898f76d92554e07a8958e90ff70e7ff3cfabdf5.exe File renamed C:\Users\Admin\Pictures\SelectConvertFrom.png => C:\Users\Admin\Pictures\SelectConvertFrom.png.lilith f3caa040efb298878b99f883a898f76d92554e07a8958e90ff70e7ff3cfabdf5.exe File renamed C:\Users\Admin\Pictures\SyncEnable.png => C:\Users\Admin\Pictures\SyncEnable.png.lilith f3caa040efb298878b99f883a898f76d92554e07a8958e90ff70e7ff3cfabdf5.exe -
Enumerates connected drives 3 TTPs 24 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\E: f3caa040efb298878b99f883a898f76d92554e07a8958e90ff70e7ff3cfabdf5.exe File opened (read-only) \??\U: f3caa040efb298878b99f883a898f76d92554e07a8958e90ff70e7ff3cfabdf5.exe File opened (read-only) \??\I: f3caa040efb298878b99f883a898f76d92554e07a8958e90ff70e7ff3cfabdf5.exe File opened (read-only) \??\A: f3caa040efb298878b99f883a898f76d92554e07a8958e90ff70e7ff3cfabdf5.exe File opened (read-only) \??\G: f3caa040efb298878b99f883a898f76d92554e07a8958e90ff70e7ff3cfabdf5.exe File opened (read-only) \??\M: f3caa040efb298878b99f883a898f76d92554e07a8958e90ff70e7ff3cfabdf5.exe File opened (read-only) \??\Q: f3caa040efb298878b99f883a898f76d92554e07a8958e90ff70e7ff3cfabdf5.exe File opened (read-only) \??\W: f3caa040efb298878b99f883a898f76d92554e07a8958e90ff70e7ff3cfabdf5.exe File opened (read-only) \??\F: f3caa040efb298878b99f883a898f76d92554e07a8958e90ff70e7ff3cfabdf5.exe File opened (read-only) \??\K: f3caa040efb298878b99f883a898f76d92554e07a8958e90ff70e7ff3cfabdf5.exe File opened (read-only) \??\V: f3caa040efb298878b99f883a898f76d92554e07a8958e90ff70e7ff3cfabdf5.exe File opened (read-only) \??\N: f3caa040efb298878b99f883a898f76d92554e07a8958e90ff70e7ff3cfabdf5.exe File opened (read-only) \??\R: f3caa040efb298878b99f883a898f76d92554e07a8958e90ff70e7ff3cfabdf5.exe File opened (read-only) \??\Y: f3caa040efb298878b99f883a898f76d92554e07a8958e90ff70e7ff3cfabdf5.exe File opened (read-only) \??\P: f3caa040efb298878b99f883a898f76d92554e07a8958e90ff70e7ff3cfabdf5.exe File opened (read-only) \??\H: f3caa040efb298878b99f883a898f76d92554e07a8958e90ff70e7ff3cfabdf5.exe File opened (read-only) \??\Z: f3caa040efb298878b99f883a898f76d92554e07a8958e90ff70e7ff3cfabdf5.exe File opened (read-only) \??\T: f3caa040efb298878b99f883a898f76d92554e07a8958e90ff70e7ff3cfabdf5.exe File opened (read-only) \??\O: f3caa040efb298878b99f883a898f76d92554e07a8958e90ff70e7ff3cfabdf5.exe File opened (read-only) \??\S: f3caa040efb298878b99f883a898f76d92554e07a8958e90ff70e7ff3cfabdf5.exe File opened (read-only) \??\J: f3caa040efb298878b99f883a898f76d92554e07a8958e90ff70e7ff3cfabdf5.exe File opened (read-only) \??\L: f3caa040efb298878b99f883a898f76d92554e07a8958e90ff70e7ff3cfabdf5.exe File opened (read-only) \??\X: f3caa040efb298878b99f883a898f76d92554e07a8958e90ff70e7ff3cfabdf5.exe File opened (read-only) \??\B: f3caa040efb298878b99f883a898f76d92554e07a8958e90ff70e7ff3cfabdf5.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Modifies registry class 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000_Classes\Local Settings rundll32.exe Key created \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\MuiCache rundll32.exe -
Opens file in notepad (likely ransom note) 2 IoCs
pid Process 592 NOTEPAD.EXE 1552 NOTEPAD.EXE -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1684 f3caa040efb298878b99f883a898f76d92554e07a8958e90ff70e7ff3cfabdf5.exe 1684 f3caa040efb298878b99f883a898f76d92554e07a8958e90ff70e7ff3cfabdf5.exe 1684 f3caa040efb298878b99f883a898f76d92554e07a8958e90ff70e7ff3cfabdf5.exe 1684 f3caa040efb298878b99f883a898f76d92554e07a8958e90ff70e7ff3cfabdf5.exe 1684 f3caa040efb298878b99f883a898f76d92554e07a8958e90ff70e7ff3cfabdf5.exe 1684 f3caa040efb298878b99f883a898f76d92554e07a8958e90ff70e7ff3cfabdf5.exe 1684 f3caa040efb298878b99f883a898f76d92554e07a8958e90ff70e7ff3cfabdf5.exe 1684 f3caa040efb298878b99f883a898f76d92554e07a8958e90ff70e7ff3cfabdf5.exe 1684 f3caa040efb298878b99f883a898f76d92554e07a8958e90ff70e7ff3cfabdf5.exe 1684 f3caa040efb298878b99f883a898f76d92554e07a8958e90ff70e7ff3cfabdf5.exe 1684 f3caa040efb298878b99f883a898f76d92554e07a8958e90ff70e7ff3cfabdf5.exe 1684 f3caa040efb298878b99f883a898f76d92554e07a8958e90ff70e7ff3cfabdf5.exe 1684 f3caa040efb298878b99f883a898f76d92554e07a8958e90ff70e7ff3cfabdf5.exe 1684 f3caa040efb298878b99f883a898f76d92554e07a8958e90ff70e7ff3cfabdf5.exe 1684 f3caa040efb298878b99f883a898f76d92554e07a8958e90ff70e7ff3cfabdf5.exe 1684 f3caa040efb298878b99f883a898f76d92554e07a8958e90ff70e7ff3cfabdf5.exe 1684 f3caa040efb298878b99f883a898f76d92554e07a8958e90ff70e7ff3cfabdf5.exe 1684 f3caa040efb298878b99f883a898f76d92554e07a8958e90ff70e7ff3cfabdf5.exe 1684 f3caa040efb298878b99f883a898f76d92554e07a8958e90ff70e7ff3cfabdf5.exe 1684 f3caa040efb298878b99f883a898f76d92554e07a8958e90ff70e7ff3cfabdf5.exe 1684 f3caa040efb298878b99f883a898f76d92554e07a8958e90ff70e7ff3cfabdf5.exe 1684 f3caa040efb298878b99f883a898f76d92554e07a8958e90ff70e7ff3cfabdf5.exe 1684 f3caa040efb298878b99f883a898f76d92554e07a8958e90ff70e7ff3cfabdf5.exe 1684 f3caa040efb298878b99f883a898f76d92554e07a8958e90ff70e7ff3cfabdf5.exe 1684 f3caa040efb298878b99f883a898f76d92554e07a8958e90ff70e7ff3cfabdf5.exe 1684 f3caa040efb298878b99f883a898f76d92554e07a8958e90ff70e7ff3cfabdf5.exe 1684 f3caa040efb298878b99f883a898f76d92554e07a8958e90ff70e7ff3cfabdf5.exe 1684 f3caa040efb298878b99f883a898f76d92554e07a8958e90ff70e7ff3cfabdf5.exe 1684 f3caa040efb298878b99f883a898f76d92554e07a8958e90ff70e7ff3cfabdf5.exe 1684 f3caa040efb298878b99f883a898f76d92554e07a8958e90ff70e7ff3cfabdf5.exe 1684 f3caa040efb298878b99f883a898f76d92554e07a8958e90ff70e7ff3cfabdf5.exe 1684 f3caa040efb298878b99f883a898f76d92554e07a8958e90ff70e7ff3cfabdf5.exe 1684 f3caa040efb298878b99f883a898f76d92554e07a8958e90ff70e7ff3cfabdf5.exe 1684 f3caa040efb298878b99f883a898f76d92554e07a8958e90ff70e7ff3cfabdf5.exe 1684 f3caa040efb298878b99f883a898f76d92554e07a8958e90ff70e7ff3cfabdf5.exe 1684 f3caa040efb298878b99f883a898f76d92554e07a8958e90ff70e7ff3cfabdf5.exe 1684 f3caa040efb298878b99f883a898f76d92554e07a8958e90ff70e7ff3cfabdf5.exe 1684 f3caa040efb298878b99f883a898f76d92554e07a8958e90ff70e7ff3cfabdf5.exe 1684 f3caa040efb298878b99f883a898f76d92554e07a8958e90ff70e7ff3cfabdf5.exe 1684 f3caa040efb298878b99f883a898f76d92554e07a8958e90ff70e7ff3cfabdf5.exe 1684 f3caa040efb298878b99f883a898f76d92554e07a8958e90ff70e7ff3cfabdf5.exe 1684 f3caa040efb298878b99f883a898f76d92554e07a8958e90ff70e7ff3cfabdf5.exe 1684 f3caa040efb298878b99f883a898f76d92554e07a8958e90ff70e7ff3cfabdf5.exe 1684 f3caa040efb298878b99f883a898f76d92554e07a8958e90ff70e7ff3cfabdf5.exe 1684 f3caa040efb298878b99f883a898f76d92554e07a8958e90ff70e7ff3cfabdf5.exe 1684 f3caa040efb298878b99f883a898f76d92554e07a8958e90ff70e7ff3cfabdf5.exe 1684 f3caa040efb298878b99f883a898f76d92554e07a8958e90ff70e7ff3cfabdf5.exe 1684 f3caa040efb298878b99f883a898f76d92554e07a8958e90ff70e7ff3cfabdf5.exe 1684 f3caa040efb298878b99f883a898f76d92554e07a8958e90ff70e7ff3cfabdf5.exe 1684 f3caa040efb298878b99f883a898f76d92554e07a8958e90ff70e7ff3cfabdf5.exe 1684 f3caa040efb298878b99f883a898f76d92554e07a8958e90ff70e7ff3cfabdf5.exe 1684 f3caa040efb298878b99f883a898f76d92554e07a8958e90ff70e7ff3cfabdf5.exe 1684 f3caa040efb298878b99f883a898f76d92554e07a8958e90ff70e7ff3cfabdf5.exe 1684 f3caa040efb298878b99f883a898f76d92554e07a8958e90ff70e7ff3cfabdf5.exe 1684 f3caa040efb298878b99f883a898f76d92554e07a8958e90ff70e7ff3cfabdf5.exe 1684 f3caa040efb298878b99f883a898f76d92554e07a8958e90ff70e7ff3cfabdf5.exe 1684 f3caa040efb298878b99f883a898f76d92554e07a8958e90ff70e7ff3cfabdf5.exe 1684 f3caa040efb298878b99f883a898f76d92554e07a8958e90ff70e7ff3cfabdf5.exe 1684 f3caa040efb298878b99f883a898f76d92554e07a8958e90ff70e7ff3cfabdf5.exe 1684 f3caa040efb298878b99f883a898f76d92554e07a8958e90ff70e7ff3cfabdf5.exe 1684 f3caa040efb298878b99f883a898f76d92554e07a8958e90ff70e7ff3cfabdf5.exe 1684 f3caa040efb298878b99f883a898f76d92554e07a8958e90ff70e7ff3cfabdf5.exe 1684 f3caa040efb298878b99f883a898f76d92554e07a8958e90ff70e7ff3cfabdf5.exe 1684 f3caa040efb298878b99f883a898f76d92554e07a8958e90ff70e7ff3cfabdf5.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 672 wrote to memory of 1552 672 rundll32.exe 32 PID 672 wrote to memory of 1552 672 rundll32.exe 32 PID 672 wrote to memory of 1552 672 rundll32.exe 32
Processes
-
C:\Users\Admin\AppData\Local\Temp\f3caa040efb298878b99f883a898f76d92554e07a8958e90ff70e7ff3cfabdf5.exe"C:\Users\Admin\AppData\Local\Temp\f3caa040efb298878b99f883a898f76d92554e07a8958e90ff70e7ff3cfabdf5.exe"1⤵
- Modifies extensions of user files
- Enumerates connected drives
- Suspicious behavior: EnumeratesProcesses
PID:1684
-
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Public\Desktop\Restore_Your_Files.txt1⤵
- Opens file in notepad (likely ransom note)
PID:592
-
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\Desktop\SelectSuspend.vb.lilith1⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:672 -
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\SelectSuspend.vb.lilith2⤵
- Opens file in notepad (likely ransom note)
PID:1552
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
273KB
MD5c44c2f8aa5002c3abc94a8242545f7f4
SHA1465be03c6571cf01a8c5049a7154f71916502213
SHA25653942c723360e9857dcd0040c28eed06d03c40c39e1a99bdb0969289bf2f87cb
SHA512412ffcb194af6b3add28fd9c48caf476869ec3d0daa188206a90436c2fa72874474f9b2f250bf7ab97057569fc72228acb6bfcb40b68253a69a76f5901c8936b
-
Filesize
789B
MD5adf02d7498cc7b3379ba694647c1f051
SHA18ace40a1487e1d78058b1f42111c41583d537ddb
SHA256e63ae8bb47c3aa3339a02bb3937c893deb396c3b8bc8646abf5a91e90f2ffbc6
SHA51225f3f289d50951607ba1ebee4a2ceb79a80782e35418773192fdb9300a7b11bf71a38775dc0ae659d82f743bf92e80dac9b5623004a51fde4dd895f480569148