Overview

overview

10

Static

static

9272022_diav1.exe

windows7-x64

10

9272022_diav1.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    266s
  • max time network
    297s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220901-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
  • submitted
    26-09-2022 18:01

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    9272022_diav1.exe

  • Size

    227KB

  • MD5

    2f62c5385dc49b91f5bd5e2a42f75fe6

  • SHA1

    fdfdfacde0b898d13b01b1ab95d09d55196a13f5

  • SHA256

    28b3ecf298a47f0e3db76f087e056f30736dab5a0d0a367cb48651897fa617d7

  • SHA512

    45aa5c281ab9d0e5c01b8da10a96416b2d01f0d57662ccbc1394b8f0dea1baa9d349675bd58a069e6ad005bf7601452bba17edefdb8f309c9bcc909d2364b351

  • SSDEEP

    3072:v+HwIahsiDzTvGvJTkwEluO9GYSFR8HenNGmeu9+hvwG:GHZs/LeJTkz0YGYSz1n1id

Score
10/10
ransomwarespywarestealer

Malware Config

Extracted

Path

C:\$Recycle.Bin\S-1-5-21-929662420-1054238289-2961194603-1000\WARNING.TXT

Ransom Note
You've been hacked. All your corporate network servers and workstations are encrypted. Your company is a victim of double extortion ransomware attack. What is it? Basically it means that not only your data is encrypted, but it's also have been exfiltrated from your network. Double Extortion attack explained in details : https://www.zscaler.com/resources/security-terms-glossary/what-is-double-extortion-ransomware ===== What now? ===== If you want your network to be fully operational again and if you want us not to publish all files we've taken : 1. Download Tor Browser from original site : https://torproject.org 2. Open this url in Tor Browser and visit this website : https://7ypnbv3snejqmgce4kbewwvym4cm5j6lkzf2hra2hyhtsvwjaxwipkyd.onion/ 3. Enter this key : 2A58A-29167-F7907-33C1E-B50BF-5704B If you've done everything correctly - now you are able to contact us and take a chance to leave this all behind for a reasonable fee. NOTE : If TOR network is unavailable by any reason - you can use any VPN service to solve it.
URLs

https://www.zscaler.com/resources/security-terms-glossary/what-is-double-extortion-ransomware

https://7ypnbv3snejqmgce4kbewwvym4cm5j6lkzf2hra2hyhtsvwjaxwipkyd.onion/

Signatures

  • Deletes shadow copies 2 TTPs

    Ransomware often targets backup files to inhibit system recovery.

    ransomware
  • Modifies extensions of user files 5 IoCs

    Ransomware generally changes the extension on encrypted files.

    ransomware
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file 2 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Drops desktop.ini file(s) 2 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Interacts with shadow copies 2 TTPs 1 IoCs

    Shadow copies are often targeted by ransomware to inhibit system recovery.

    ransomware
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\9272022_diav1.exe
    "C:\Users\Admin\AppData\Local\Temp\9272022_diav1.exe"
    1⤵
    • Modifies extensions of user files
    • Checks computer location settings
    • Drops startup file
    • Drops desktop.ini file(s)
    • Drops file in Program Files directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:3284
    • C:\Windows\system32\cmd.exe
      "C:\Windows\system32\cmd.exe" /c vssadmin Delete Shadows /All /Quiet >> NUL
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:1488
      • C:\Windows\system32\vssadmin.exe
        vssadmin Delete Shadows /All /Quiet
        3⤵
        • Interacts with shadow copies
        PID:4832
    • C:\Windows\system32\cmd.exe
      "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\9272022_diav1.exe >> NUL
      2⤵
        PID:4284
    • C:\Windows\system32\vssvc.exe
      C:\Windows\system32\vssvc.exe
      1⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:2244

    Network

    MITRE ATT&CK Matrix ATT&CK v6

    Initial Access

    Execution

    Persistence

    Privilege Escalation

    Defense Evasion

    File Deletion

    2
    T1107

    Credential Access

    Credentials in Files

    1
    T1081

    Discovery

    Query Registry

    1
    T1012

    System Information Discovery

    2
    T1082

    Lateral Movement

    Collection

    Data from Local System

    1
    T1005

    Exfiltration

    Command and Control

    Impact

    Inhibit System Recovery

    2
    T1490

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/1488-135-0x0000000000000000-mapping.dmp
      Download
    • memory/3284-132-0x0000000002BA0000-0x0000000002BA8000-memory.dmp
      Filesize

      32KB

      Download
    • memory/3284-133-0x0000000002BB0000-0x0000000002BB8000-memory.dmp
      Filesize

      32KB

      Download
    • memory/3284-134-0x0000000002BA0000-0x0000000002BA8000-memory.dmp
      Filesize

      32KB

      Download
    • memory/3284-137-0x0000000002BA0000-0x0000000002BA8000-memory.dmp
      Filesize

      32KB

      Download
    • memory/4284-136-0x0000000000000000-mapping.dmp
      Download
    • memory/4832-138-0x0000000000000000-mapping.dmp
      Download