Overview

overview

10

Static

static

5230f18b80...87.exe

windows7-x64

10

5230f18b80...87.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    152s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220414-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220414-enlocale:en-usos:windows10-2004-x64system
  • submitted
    17-07-2022 03:48

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    5230f18b804d1117f09f2ec7d7b45977c154bc80bfbfbb3c1f32997a28583087.exe

  • Size

    679KB

  • MD5

    cfe5a7469deb3aff3d6630614833afda

  • SHA1

    8d99a9c94bfced8df8f50395e990465d0721e815

  • SHA256

    5230f18b804d1117f09f2ec7d7b45977c154bc80bfbfbb3c1f32997a28583087

  • SHA512

    89fa84f2f5395d5b5a6d263140c7a118d97c8e7d11283f41148dd786f6d16bc583292cec30dbd6e8d9ef3743633fb9adde63e3624a36c9ec89281dfb7603e8ff

Score
10/10
persistenceransomware

Malware Config

Extracted

Path

C:\@@_READ_ME_@@.txt

Ransom Note
$$$$$$$$$$$$$$$$$$$$$$$$> PEEKABOO <$$$$$$$$$$$$$$$$$$$$$$$$ SORRY! Your files are encrypted. File contents are encrypted with random key. Random key is encrypted with RSA public key (2048 bit). We STRONGLY RECOMMEND you NOT to use any "decryption tools". These tools can damage your data, making recover IMPOSSIBLE. Also we recommend you not to contact data recovery companies. They will just contact us, buy the key and sell it to you at a higher price. If you want to decrypt your files, you have to get RSA private key. -- In order to get private key, write here: [email protected] =========== !ATTENTION! Attach file is 000000000.key from %appdata% to email message, without it we will not be able to decrypt your files =========== And pay $300 on BTC-wallet: 1NkjBNF7fmpRsX4WjokUie21m8bv9xvRKs If someone else offers you files restoring, ask him for test decryption. Only we can successfully decrypt your files; knowing this can protect you from fraud. You will receive instructions of what to do next. $$$$$$$$$$$$$$$$$$$$$$$$> PEEKABOO <$$$$$$$$$$$$$$$$$$$$$$$$
Wallets

1NkjBNF7fmpRsX4WjokUie21m8bv9xvRKs

Signatures

  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Suspicious use of SetThreadContext 1 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Suspicious use of WriteProcessMemory 10 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\5230f18b804d1117f09f2ec7d7b45977c154bc80bfbfbb3c1f32997a28583087.exe
    "C:\Users\Admin\AppData\Local\Temp\5230f18b804d1117f09f2ec7d7b45977c154bc80bfbfbb3c1f32997a28583087.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:1736
    • C:\Users\Admin\AppData\Local\Temp\5230f18b804d1117f09f2ec7d7b45977c154bc80bfbfbb3c1f32997a28583087.exe
      "C:\Users\Admin\AppData\Local\Temp\5230f18b804d1117f09f2ec7d7b45977c154bc80bfbfbb3c1f32997a28583087.exe"
      2⤵
      • Adds Run key to start application
      • Drops file in Program Files directory
      PID:4192

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1736-133-0x00000000007E8000-0x000000000084E000-memory.dmp

    Filesize

    408KB

    Download

  • memory/4192-131-0x0000000000400000-0x0000000000467000-memory.dmp

    Filesize

    412KB

    Download

  • memory/4192-132-0x0000000000400000-0x0000000000467000-memory.dmp

    Filesize

    412KB

    Download

  • memory/4192-134-0x0000000000400000-0x0000000000467000-memory.dmp

    Filesize

    412KB

    Download

  • memory/4192-135-0x0000000000400000-0x0000000000467000-memory.dmp

    Filesize

    412KB

    Download

  • memory/4192-136-0x0000000000400000-0x0000000000467000-memory.dmp

    Filesize

    412KB

    Download