Overview

overview

10

Static

static

6d8e2d8f6a...05.exe

windows7-x64

8

6d8e2d8f6a...05.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    70s
  • max time network
    128s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    27/10/2022, 15:07

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    6d8e2d8f6aeb0f4512a53fe83b2ef7699513ebaff31735675f46d1beea3a8e05.exe

  • Size

    225KB

  • MD5

    0d4247600f91e28bd390c91dd61ccd7f

  • SHA1

    ba145483608a4ea567ed3c3c2b7e396098f5386a

  • SHA256

    6d8e2d8f6aeb0f4512a53fe83b2ef7699513ebaff31735675f46d1beea3a8e05

  • SHA512

    0c1f20f0cf0cc80f861d502ee93ab886028a8cd9f3d83c0ce681c583e1371ec76a6fcaf76171d5ec4e36c15fd3a0cbadd7b25f34b51190636b62e090a9e3be46

  • SSDEEP

    6144:NR+1JmXKQwAPxGXJZcKV50DErN5xgTw7ozFz254W:NR+reKQwAgZ+D6GcoxfW

Score
10/10
evasionpersistenceransomwarespywarestealer

Malware Config

Extracted

Path

C:\README.html

Ransom Note
<html><head><title>Venus</title><style type = "text/css">*{padding:0;margin:0}p{color:white}.f{background-color:#ff7c00;width:100%;margin-left:auto;margin-right:auto;height:100%}.c h1{color:white;line-height:80px}.r{word-break:break-all;float:left;width:100%;text-align:center}</style></head><body><div class="f"><div class="c"><h1 align="center">&lt;&lt;&lt;Venus&gt;&gt;&gt;</h1></div><div class="r"><p></br></br></br></br><strong>We downloaded and encrypted your data.</strong></br>Only we can decrypt your data.<br><strong>IMPORTANT!</strong><br> If you, your programmers or your friends would try to help you to decrypt the files it can cause data loss even after you pay.<br> In this case we will not be able to help you.<br>Do not play with files.</p><p>Do not rename encrypted files.<br>Do not try to decrypt your data using third party software, it may cause permanent data loss.<br>Decryption of your files with the help of third parties may cause increased price or you can become a victim of a scam.</br>-----------------------------------------------------</br>Contact and send this file to us:<br><strong><br>email:[email protected]<br>Download TOX CHAT(https://tox.chat/download.html)and write to TOX:25FB9AB6691BD61F085409F0C18C2BE6D47705A5731F7ECBF566BEC4404D5D7A643DAE16AB3F<br></strong><br><br>pWM/19mmS/2j4/hntZOpze6Buoh39PMhsGdj9R+HXA2WuLb1g/mcLBXbZ6HP5pmq biAtz4qloO8So0FJ+kEmcmcZsViqtCdpbeF432exDMnsX07hmIOnn6CtKXY5dx00 ExnwTSmfje3qmJwbMd58vhPiMe13smSsUyHPmBpmtRcGRVOpeVbV8aeluDqIUoGo N/6syat9dVESdwp4kiBk9G79cxgM5tURTjzwy49HzuhUpEFpTA8yLY6UuGz3VrSw 6gninUA2iF26iFqGAG8rC42J9AAsMeCGg43uRaLtTU8LNulXiWY6e7dVROuU34of wU1HoM82ts8lP7hxmgLb8uHFNCeZ51QFzo6uS88oi4IQfWBy++AWlIxTO3tp/vnO KSLHRkozC8FKuhdsQLXr62962FgohSnF+BJxKSWMUxkLW76YjAmWVao8LPphRhoi OJPEGIAsDs6JGw/O0jnPUcCwY2mr+nWf/uPTv6EHocO2dlV/YECS3YdO/kNoJ+N2 ZHjBnrNWLowq9y9BDtRNYfwZGIsGv2SITqOGNVhE/ppfPo3nH0JhaZPBe+3+H4Tg +YrHSollabBy+GF1muDByc9pIdiD7GFGJdUmEIcNbAKKilvTvddyHXcjg+NmKGTr cRxvbD7bKGDoyw== </p></div></body></html></html></body></html>
Emails

us:<br><strong><br>email:[email protected]<br>Download

Extracted

Path

C:\Users\Admin\AppData\Local\Temp\34960028031972527219.hta

Ransom Note
<<<Venus>>> We downloaded and encrypted your data.Only we can decrypt your data.IMPORTANT! If you, your programmers or your friends would try to help you to decrypt the files it can cause data loss even after you pay. In this case we will not be able to help you. Do not play with files. Do not rename encrypted files. Do not try to decrypt your data using third party software, it may cause permanent data loss. Decryption of your files with the help of third parties may cause increased price or you can become a victim of a scam.-----------------------------------------------------Contact and send this file to us: email:[email protected] Download TOX CHAT(https://tox.chat/download.html)and write to TOX:25FB9AB6691BD61F085409F0C18C2BE6D47705A5731F7ECBF566BEC4404D5D7A643DAE16AB3F
Emails

Signatures

  • Deletes shadow copies 2 TTPs

    Ransomware often targets backup files to inhibit system recovery.

    ransomware
  • Modifies boot configuration data using bcdedit 1 TTPs 1 IoCs
    ransomwareevasion
  • Deletes backup catalog 3 TTPs 1 IoCs

    Uses wbadmin.exe to inhibit system recovery.

    ransomware
  • Executes dropped EXE 1 IoCs
  • Modifies extensions of user files 10 IoCs

    Ransomware generally changes the extension on encrypted files.

    ransomware
  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Drops desktop.ini file(s) 34 IoCs
  • Enumerates connected drives 3 TTPs 2 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Sets desktop wallpaper using registry 2 TTPs 1 IoCs
    ransomware
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Checks SCSI registry key(s) 3 TTPs 4 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Interacts with shadow copies 2 TTPs 1 IoCs

    Shadow copies are often targeted by ransomware to inhibit system recovery.

    ransomware
  • Kills process with taskkill 1 IoCs
    evasion
  • Modifies registry class 5 IoCs
  • Runs ping.exe 1 TTPs 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 53 IoCs
  • Suspicious use of WriteProcessMemory 24 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\6d8e2d8f6aeb0f4512a53fe83b2ef7699513ebaff31735675f46d1beea3a8e05.exe
    "C:\Users\Admin\AppData\Local\Temp\6d8e2d8f6aeb0f4512a53fe83b2ef7699513ebaff31735675f46d1beea3a8e05.exe"
    1⤵
    • Checks computer location settings
    • Adds Run key to start application
    • Drops file in Windows directory
    • Modifies registry class
    • Suspicious use of WriteProcessMemory
    PID:1044
    • C:\Windows\6d8e2d8f6aeb0f4512a53fe83b2ef7699513ebaff31735675f46d1beea3a8e05.exe
      "C:\Windows\6d8e2d8f6aeb0f4512a53fe83b2ef7699513ebaff31735675f46d1beea3a8e05.exe" g g g o n e123
      2⤵
      • Executes dropped EXE
      • Modifies extensions of user files
      • Checks computer location settings
      • Drops desktop.ini file(s)
      • Enumerates connected drives
      • Sets desktop wallpaper using registry
      • Drops file in Program Files directory
      • Drops file in Windows directory
      • Modifies registry class
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:4160
      • C:\Windows\System32\cmd.exe
        /C taskkill /F /IM msftesql.exe /IM sqlagent.exe /IM sqlbrowser.exe /IM sqlservr.exe /IM sqlwriter.exe /IM oracle.exe /IM ocssd.exe /IM dbsnmp.exe /IM synctime.exe /IM mydesktopqos.exe /IM agntsvc.exe /IM isqlplussvc.exe /IM xfssvccon.exe /IM mydesktopservice.exe /IM ocautoupds.exe /IM agntsvc.exe /IM agntsvc.exe /IM agntsvc.exe /IM encsvc.exe /IM firefoxconfig.exe /IM tbirdconfig.exe /IM ocomm.exe /IM mysqld.exe /IM mysqld-nt.exe /IM mysqld-opt.exe /IM dbeng50.exe /IM sqbcoreservice.exe /IM excel.exe /IM infopath.exe /IM msaccess.exe /IM mspub.exe /IM onenote.exe /IM outlook.exe /IM powerpnt.exe /IM sqlservr.exe /IM thebat64.exe /IM thunderbird.exe /IM winword.exe /IM wordpad.exe
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:4688
        • C:\Windows\system32\taskkill.exe
          taskkill /F /IM msftesql.exe /IM sqlagent.exe /IM sqlbrowser.exe /IM sqlservr.exe /IM sqlwriter.exe /IM oracle.exe /IM ocssd.exe /IM dbsnmp.exe /IM synctime.exe /IM mydesktopqos.exe /IM agntsvc.exe /IM isqlplussvc.exe /IM xfssvccon.exe /IM mydesktopservice.exe /IM ocautoupds.exe /IM agntsvc.exe /IM agntsvc.exe /IM agntsvc.exe /IM encsvc.exe /IM firefoxconfig.exe /IM tbirdconfig.exe /IM ocomm.exe /IM mysqld.exe /IM mysqld-nt.exe /IM mysqld-opt.exe /IM dbeng50.exe /IM sqbcoreservice.exe /IM excel.exe /IM infopath.exe /IM msaccess.exe /IM mspub.exe /IM onenote.exe /IM outlook.exe /IM powerpnt.exe /IM sqlservr.exe /IM thebat64.exe /IM thunderbird.exe /IM winword.exe /IM wordpad.exe
          4⤵
          • Kills process with taskkill
          • Suspicious use of AdjustPrivilegeToken
          PID:4308
      • C:\Windows\System32\cmd.exe
        /C wbadmin delete catalog -quiet && vssadmin.exe delete shadows /all /quiet && bcdedit.exe /set {current} nx AlwaysOff && wmic SHADOWCOPY DELETE
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:5988
        • C:\Windows\system32\wbadmin.exe
          wbadmin delete catalog -quiet
          4⤵
          • Deletes backup catalog
          PID:6044
        • C:\Windows\system32\vssadmin.exe
          vssadmin.exe delete shadows /all /quiet
          4⤵
          • Interacts with shadow copies
          PID:5896
        • C:\Windows\system32\bcdedit.exe
          bcdedit.exe /set {current} nx AlwaysOff
          4⤵
          • Modifies boot configuration data using bcdedit
          PID:6324
        • C:\Windows\System32\Wbem\WMIC.exe
          wmic SHADOWCOPY DELETE
          4⤵
          • Suspicious use of AdjustPrivilegeToken
          PID:6344
      • C:\Windows\SysWOW64\mshta.exe
        "C:\Windows\SysWOW64\mshta.exe" "C:\Users\Admin\AppData\Local\Temp\34960028031972527219.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}
        3⤵
          PID:3364
      • C:\Windows\System32\cmd.exe
        /c ping localhost -n 3 > nul & del C:\Users\Admin\AppData\Local\Temp\6d8e2d8f6aeb0f4512a53fe83b2ef7699513ebaff31735675f46d1beea3a8e05.exe
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:4712
        • C:\Windows\system32\PING.EXE
          ping localhost -n 3
          3⤵
          • Runs ping.exe
          PID:1796
    • C:\Windows\system32\wbengine.exe
      "C:\Windows\system32\wbengine.exe"
      1⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:6080
    • C:\Windows\System32\vdsldr.exe
      C:\Windows\System32\vdsldr.exe -Embedding
      1⤵
        PID:6124
      • C:\Windows\System32\vds.exe
        C:\Windows\System32\vds.exe
        1⤵
        • Checks SCSI registry key(s)
        PID:2528
      • C:\Windows\system32\vssvc.exe
        C:\Windows\system32\vssvc.exe
        1⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:4420

      Network

      MITRE ATT&CK Enterprise v6

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Local\Temp\34960028031972527219.hta
        Filesize

        1KB

        MD5

        27f18e238ada4033513e6441e0bb3574

        SHA1

        7683f1096ced4fda776082eeb38591d5e195c263

        SHA256

        15d27d96f1d87da0e93d7eacdb0003068535e2946cee3b05fe5b8dd3a3009b63

        SHA512

        227e758793b8a97de49a7d4758c599a5b47740a16047ced811a00de57305bacaf9420e55963fdc25041e0ffc7bd565cd07c0ed8eac8d602eb5ba3640b7a50e3a

        Download Submit

      • C:\Windows\6d8e2d8f6aeb0f4512a53fe83b2ef7699513ebaff31735675f46d1beea3a8e05.exe
        Filesize

        225KB

        MD5

        0d4247600f91e28bd390c91dd61ccd7f

        SHA1

        ba145483608a4ea567ed3c3c2b7e396098f5386a

        SHA256

        6d8e2d8f6aeb0f4512a53fe83b2ef7699513ebaff31735675f46d1beea3a8e05

        SHA512

        0c1f20f0cf0cc80f861d502ee93ab886028a8cd9f3d83c0ce681c583e1371ec76a6fcaf76171d5ec4e36c15fd3a0cbadd7b25f34b51190636b62e090a9e3be46

        Download Submit

      • C:\Windows\6d8e2d8f6aeb0f4512a53fe83b2ef7699513ebaff31735675f46d1beea3a8e05.exe
        Filesize

        225KB

        MD5

        0d4247600f91e28bd390c91dd61ccd7f

        SHA1

        ba145483608a4ea567ed3c3c2b7e396098f5386a

        SHA256

        6d8e2d8f6aeb0f4512a53fe83b2ef7699513ebaff31735675f46d1beea3a8e05

        SHA512

        0c1f20f0cf0cc80f861d502ee93ab886028a8cd9f3d83c0ce681c583e1371ec76a6fcaf76171d5ec4e36c15fd3a0cbadd7b25f34b51190636b62e090a9e3be46

        Download Submit

      • memory/1044-132-0x0000000000400000-0x000000000043E000-memory.dmp

        Filesize

        248KB

        Download

      • memory/1044-138-0x0000000000400000-0x000000000043E000-memory.dmp

        Filesize

        248KB

        Download

      • memory/4160-141-0x0000000000400000-0x000000000043E000-memory.dmp

        Filesize

        248KB

        Download

      • memory/4160-142-0x0000000000400000-0x000000000043E000-memory.dmp

        Filesize

        248KB

        Download