Analysis
- max time kernel
122s - max time network
140s - platform
windows10-2004_x64 - resource
win10v2004-20220414-en - submitted
08/07/2022, 10:15
Static task
static1
Behavioral task
behavioral1
Sample
f3caa040efb298878b99f883a898f76d92554e07a8958e90ff70e7ff3cfabdf5.exe
Resource
win7-20220414-en
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
f3caa040efb298878b99f883a898f76d92554e07a8958e90ff70e7ff3cfabdf5.exe
Resource
win10v2004-20220414-en
windows10-2004_x64
0 signatures
0 seconds
General
- Target f3caa040efb298878b99f883a898f76d92554e07a8958e90ff70e7ff3cfabdf5.exe
- Size 235KB
- Sample220708-l97klsdfh3
- SHA256 f3caa040efb298878b99f883a898f76d92554e07a8958e90ff70e7ff3cfabdf5
- MD5 b7a182db3ba75e737f75bda1bc76331a
- SHA1 cf0fe28214ad4106c48ec5867327319eaa82b3c3
- SHA512 5e8d7f65ae231020056a3940d3ca31546986a6130a7956374edc0bc4f139f66f467bf27b66b5cdff73f52dc48ad00f84a9a618fec6db2727c61c44807fb650e8
- MD5 SHA1 SHA512
Score
10/10
Malware Config
Extracted
Path
-
C:\Restore_Your_Files.txt
Ransom Note
- All your important files have been encrypted and stolen! Contact us for price and get decryption software. You have 3 days to contact us for negotiation. If you don't contact within three days, we'll start leaking data. 1) Contact our tox. Tox download address: https://tox.chat/ Our poison ID: 59B542C61F574BD8B3255E55651FC7C49EB53546FC6AD0698C7A12D97D193C7D6DBA9758A282 * Note that this server is available via Tor browser only Follow the instructions to open the link: 1. Type the addres "https://www.torproject.org" in your Internet browser. It opens the Tor site. 2. Press "Download Tor", then press "Download Tor Browser Bundle", install and run it. 3. Now you have Tor browser. In the Tor Browser open : http://yeuajcizwytgmrntijhxphs6wn5txp2prs6rpndafbsapek3zd4ubcid.onion
URLs
-
https://tox.chat/
-
http://yeuajcizwytgmrntijhxphs6wn5txp2prs6rpndafbsapek3zd4ubcid.onion
Signatures
- Modifies extensions of user files 8 IoCs
Ransomware generally changes the extension on encrypted files.
description ioc Process File renamed C:\Users\Admin\Pictures\InitializeRequest.tif => C:\Users\Admin\Pictures\InitializeRequest.tif.lilith f3caa040efb298878b99f883a898f76d92554e07a8958e90ff70e7ff3cfabdf5.exe File renamed C:\Users\Admin\Pictures\RenameOut.tif => C:\Users\Admin\Pictures\RenameOut.tif.lilith f3caa040efb298878b99f883a898f76d92554e07a8958e90ff70e7ff3cfabdf5.exe File renamed C:\Users\Admin\Pictures\PingOptimize.raw => C:\Users\Admin\Pictures\PingOptimize.raw.lilith f3caa040efb298878b99f883a898f76d92554e07a8958e90ff70e7ff3cfabdf5.exe File renamed C:\Users\Admin\Pictures\RegisterBlock.crw => C:\Users\Admin\Pictures\RegisterBlock.crw.lilith f3caa040efb298878b99f883a898f76d92554e07a8958e90ff70e7ff3cfabdf5.exe File renamed C:\Users\Admin\Pictures\SetFormat.crw => C:\Users\Admin\Pictures\SetFormat.crw.lilith f3caa040efb298878b99f883a898f76d92554e07a8958e90ff70e7ff3cfabdf5.exe File renamed C:\Users\Admin\Pictures\RestartRemove.crw => C:\Users\Admin\Pictures\RestartRemove.crw.lilith f3caa040efb298878b99f883a898f76d92554e07a8958e90ff70e7ff3cfabdf5.exe File renamed C:\Users\Admin\Pictures\ConnectRegister.crw => C:\Users\Admin\Pictures\ConnectRegister.crw.lilith f3caa040efb298878b99f883a898f76d92554e07a8958e90ff70e7ff3cfabdf5.exe File renamed C:\Users\Admin\Pictures\ExportFind.crw => C:\Users\Admin\Pictures\ExportFind.crw.lilith f3caa040efb298878b99f883a898f76d92554e07a8958e90ff70e7ff3cfabdf5.exe - Drops startup file 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\Restore_Your_Files.txt f3caa040efb298878b99f883a898f76d92554e07a8958e90ff70e7ff3cfabdf5.exe - Enumerates connected drives 3 TTPs 24 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\P: f3caa040efb298878b99f883a898f76d92554e07a8958e90ff70e7ff3cfabdf5.exe File opened (read-only) \??\V: f3caa040efb298878b99f883a898f76d92554e07a8958e90ff70e7ff3cfabdf5.exe File opened (read-only) \??\M: f3caa040efb298878b99f883a898f76d92554e07a8958e90ff70e7ff3cfabdf5.exe File opened (read-only) \??\W: f3caa040efb298878b99f883a898f76d92554e07a8958e90ff70e7ff3cfabdf5.exe File opened (read-only) \??\Y: f3caa040efb298878b99f883a898f76d92554e07a8958e90ff70e7ff3cfabdf5.exe File opened (read-only) \??\T: f3caa040efb298878b99f883a898f76d92554e07a8958e90ff70e7ff3cfabdf5.exe File opened (read-only) \??\A: f3caa040efb298878b99f883a898f76d92554e07a8958e90ff70e7ff3cfabdf5.exe File opened (read-only) \??\F: f3caa040efb298878b99f883a898f76d92554e07a8958e90ff70e7ff3cfabdf5.exe File opened (read-only) \??\G: f3caa040efb298878b99f883a898f76d92554e07a8958e90ff70e7ff3cfabdf5.exe File opened (read-only) \??\Q: f3caa040efb298878b99f883a898f76d92554e07a8958e90ff70e7ff3cfabdf5.exe File opened (read-only) \??\E: f3caa040efb298878b99f883a898f76d92554e07a8958e90ff70e7ff3cfabdf5.exe File opened (read-only) \??\J: f3caa040efb298878b99f883a898f76d92554e07a8958e90ff70e7ff3cfabdf5.exe File opened (read-only) \??\K: f3caa040efb298878b99f883a898f76d92554e07a8958e90ff70e7ff3cfabdf5.exe File opened (read-only) \??\L: f3caa040efb298878b99f883a898f76d92554e07a8958e90ff70e7ff3cfabdf5.exe File opened (read-only) \??\X: f3caa040efb298878b99f883a898f76d92554e07a8958e90ff70e7ff3cfabdf5.exe File opened (read-only) \??\I: f3caa040efb298878b99f883a898f76d92554e07a8958e90ff70e7ff3cfabdf5.exe File opened (read-only) \??\H: f3caa040efb298878b99f883a898f76d92554e07a8958e90ff70e7ff3cfabdf5.exe File opened (read-only) \??\O: f3caa040efb298878b99f883a898f76d92554e07a8958e90ff70e7ff3cfabdf5.exe File opened (read-only) \??\S: f3caa040efb298878b99f883a898f76d92554e07a8958e90ff70e7ff3cfabdf5.exe File opened (read-only) \??\Z: f3caa040efb298878b99f883a898f76d92554e07a8958e90ff70e7ff3cfabdf5.exe File opened (read-only) \??\B: f3caa040efb298878b99f883a898f76d92554e07a8958e90ff70e7ff3cfabdf5.exe File opened (read-only) \??\N: f3caa040efb298878b99f883a898f76d92554e07a8958e90ff70e7ff3cfabdf5.exe File opened (read-only) \??\R: f3caa040efb298878b99f883a898f76d92554e07a8958e90ff70e7ff3cfabdf5.exe File opened (read-only) \??\U: f3caa040efb298878b99f883a898f76d92554e07a8958e90ff70e7ff3cfabdf5.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000_Classes\Local Settings\MuiCache StartMenuExperienceHost.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4508 f3caa040efb298878b99f883a898f76d92554e07a8958e90ff70e7ff3cfabdf5.exe 4508 f3caa040efb298878b99f883a898f76d92554e07a8958e90ff70e7ff3cfabdf5.exe 4508 f3caa040efb298878b99f883a898f76d92554e07a8958e90ff70e7ff3cfabdf5.exe 4508 f3caa040efb298878b99f883a898f76d92554e07a8958e90ff70e7ff3cfabdf5.exe 4508 f3caa040efb298878b99f883a898f76d92554e07a8958e90ff70e7ff3cfabdf5.exe 4508 f3caa040efb298878b99f883a898f76d92554e07a8958e90ff70e7ff3cfabdf5.exe 4508 f3caa040efb298878b99f883a898f76d92554e07a8958e90ff70e7ff3cfabdf5.exe 4508 f3caa040efb298878b99f883a898f76d92554e07a8958e90ff70e7ff3cfabdf5.exe 4508 f3caa040efb298878b99f883a898f76d92554e07a8958e90ff70e7ff3cfabdf5.exe 4508 f3caa040efb298878b99f883a898f76d92554e07a8958e90ff70e7ff3cfabdf5.exe 4508 f3caa040efb298878b99f883a898f76d92554e07a8958e90ff70e7ff3cfabdf5.exe 4508 f3caa040efb298878b99f883a898f76d92554e07a8958e90ff70e7ff3cfabdf5.exe 4508 f3caa040efb298878b99f883a898f76d92554e07a8958e90ff70e7ff3cfabdf5.exe 4508 f3caa040efb298878b99f883a898f76d92554e07a8958e90ff70e7ff3cfabdf5.exe 4508 f3caa040efb298878b99f883a898f76d92554e07a8958e90ff70e7ff3cfabdf5.exe 4508 f3caa040efb298878b99f883a898f76d92554e07a8958e90ff70e7ff3cfabdf5.exe 4508 f3caa040efb298878b99f883a898f76d92554e07a8958e90ff70e7ff3cfabdf5.exe 4508 f3caa040efb298878b99f883a898f76d92554e07a8958e90ff70e7ff3cfabdf5.exe 4508 f3caa040efb298878b99f883a898f76d92554e07a8958e90ff70e7ff3cfabdf5.exe 4508 f3caa040efb298878b99f883a898f76d92554e07a8958e90ff70e7ff3cfabdf5.exe 4508 f3caa040efb298878b99f883a898f76d92554e07a8958e90ff70e7ff3cfabdf5.exe 4508 f3caa040efb298878b99f883a898f76d92554e07a8958e90ff70e7ff3cfabdf5.exe 4508 f3caa040efb298878b99f883a898f76d92554e07a8958e90ff70e7ff3cfabdf5.exe 4508 f3caa040efb298878b99f883a898f76d92554e07a8958e90ff70e7ff3cfabdf5.exe 4508 f3caa040efb298878b99f883a898f76d92554e07a8958e90ff70e7ff3cfabdf5.exe 4508 f3caa040efb298878b99f883a898f76d92554e07a8958e90ff70e7ff3cfabdf5.exe 4508 f3caa040efb298878b99f883a898f76d92554e07a8958e90ff70e7ff3cfabdf5.exe 4508 f3caa040efb298878b99f883a898f76d92554e07a8958e90ff70e7ff3cfabdf5.exe 4508 f3caa040efb298878b99f883a898f76d92554e07a8958e90ff70e7ff3cfabdf5.exe 4508 f3caa040efb298878b99f883a898f76d92554e07a8958e90ff70e7ff3cfabdf5.exe 4508 f3caa040efb298878b99f883a898f76d92554e07a8958e90ff70e7ff3cfabdf5.exe 4508 f3caa040efb298878b99f883a898f76d92554e07a8958e90ff70e7ff3cfabdf5.exe 4508 f3caa040efb298878b99f883a898f76d92554e07a8958e90ff70e7ff3cfabdf5.exe 4508 f3caa040efb298878b99f883a898f76d92554e07a8958e90ff70e7ff3cfabdf5.exe 4508 f3caa040efb298878b99f883a898f76d92554e07a8958e90ff70e7ff3cfabdf5.exe 4508 f3caa040efb298878b99f883a898f76d92554e07a8958e90ff70e7ff3cfabdf5.exe 4508 f3caa040efb298878b99f883a898f76d92554e07a8958e90ff70e7ff3cfabdf5.exe 4508 f3caa040efb298878b99f883a898f76d92554e07a8958e90ff70e7ff3cfabdf5.exe 4508 f3caa040efb298878b99f883a898f76d92554e07a8958e90ff70e7ff3cfabdf5.exe 4508 f3caa040efb298878b99f883a898f76d92554e07a8958e90ff70e7ff3cfabdf5.exe 4508 f3caa040efb298878b99f883a898f76d92554e07a8958e90ff70e7ff3cfabdf5.exe 4508 f3caa040efb298878b99f883a898f76d92554e07a8958e90ff70e7ff3cfabdf5.exe 4508 f3caa040efb298878b99f883a898f76d92554e07a8958e90ff70e7ff3cfabdf5.exe 4508 f3caa040efb298878b99f883a898f76d92554e07a8958e90ff70e7ff3cfabdf5.exe 4508 f3caa040efb298878b99f883a898f76d92554e07a8958e90ff70e7ff3cfabdf5.exe 4508 f3caa040efb298878b99f883a898f76d92554e07a8958e90ff70e7ff3cfabdf5.exe 4508 f3caa040efb298878b99f883a898f76d92554e07a8958e90ff70e7ff3cfabdf5.exe 4508 f3caa040efb298878b99f883a898f76d92554e07a8958e90ff70e7ff3cfabdf5.exe 4508 f3caa040efb298878b99f883a898f76d92554e07a8958e90ff70e7ff3cfabdf5.exe 4508 f3caa040efb298878b99f883a898f76d92554e07a8958e90ff70e7ff3cfabdf5.exe 4508 f3caa040efb298878b99f883a898f76d92554e07a8958e90ff70e7ff3cfabdf5.exe 4508 f3caa040efb298878b99f883a898f76d92554e07a8958e90ff70e7ff3cfabdf5.exe 4508 f3caa040efb298878b99f883a898f76d92554e07a8958e90ff70e7ff3cfabdf5.exe 4508 f3caa040efb298878b99f883a898f76d92554e07a8958e90ff70e7ff3cfabdf5.exe 4508 f3caa040efb298878b99f883a898f76d92554e07a8958e90ff70e7ff3cfabdf5.exe 4508 f3caa040efb298878b99f883a898f76d92554e07a8958e90ff70e7ff3cfabdf5.exe 4508 f3caa040efb298878b99f883a898f76d92554e07a8958e90ff70e7ff3cfabdf5.exe 4508 f3caa040efb298878b99f883a898f76d92554e07a8958e90ff70e7ff3cfabdf5.exe 4508 f3caa040efb298878b99f883a898f76d92554e07a8958e90ff70e7ff3cfabdf5.exe 4508 f3caa040efb298878b99f883a898f76d92554e07a8958e90ff70e7ff3cfabdf5.exe 4508 f3caa040efb298878b99f883a898f76d92554e07a8958e90ff70e7ff3cfabdf5.exe 4508 f3caa040efb298878b99f883a898f76d92554e07a8958e90ff70e7ff3cfabdf5.exe 4508 f3caa040efb298878b99f883a898f76d92554e07a8958e90ff70e7ff3cfabdf5.exe 4508 f3caa040efb298878b99f883a898f76d92554e07a8958e90ff70e7ff3cfabdf5.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 4704 StartMenuExperienceHost.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\f3caa040efb298878b99f883a898f76d92554e07a8958e90ff70e7ff3cfabdf5.exe"C:\Users\Admin\AppData\Local\Temp\f3caa040efb298878b99f883a898f76d92554e07a8958e90ff70e7ff3cfabdf5.exe"1⤵
- Modifies extensions of user files
- Drops startup file
- Enumerates connected drives
- Suspicious behavior: EnumeratesProcesses
PID:4508
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4704