289c0f0f4ccee755aaf90a6037743d73d3da2cebc34366679ccc841d5eb5ed58

Analysis

max time kernel
152s
max time network
43s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
08-11-2022 11:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f4e2bab6cb056c8e644e4b8d4dac7cbf2b972d763f396a475e9fb539438de839.exe
Size

42KB
MD5

5884482db6adca2b8476c395c66805e7
SHA1

4c5b8b834d7d9e8b1316a1b8d2e7b9024022d4ce
SHA256

f4e2bab6cb056c8e644e4b8d4dac7cbf2b972d763f396a475e9fb539438de839
SHA512

4e1007fb311c474217b8dfb810d04c2b188deadf56dcd81ee532a48abeb5fc29ff0eae7628cda5aa78f690f46c2370dfb3379e270ee03e83025f7a872f99e52d
SSDEEP

768:AO1oR/RVS1RzK4wbs+D/SIJX+ZZ1SQQwZuIOPzDsUky5DuGMKKz0YnW:AXS1FKnDtkuImNNxFKU

Score

10^/10

ransomware

Malware Config

Extracted

Path

C:\Users\Admin\AppData\Local\Temp\1628246561\+README-WARNING+.txt

Ransom Note

::: Greetings ::: Little FAQ: .1. Q: Whats Happen? A: Your files have been encrypted. The file structure was not damaged, we did everything possible so that this could not happen. .2. Q: How to recover files? A: If you wish to decrypt your files you will need to pay us. .3. Q: What about guarantees? A: Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will cooperate with us. Its not in our interests. To check the ability of returning files, you can send to us any 2 files with SIMPLE extensions(jpg,xls,doc, etc... not databases!) and low sizes(max 1 mb), we will decrypt them and send back to you. That is our guarantee. .4. Q: How to contact with you? A: You can write us to our mailbox: [email protected] .5. Q: How will the decryption process proceed after payment? A: After payment we will send to you our scanner-decoder program and detailed instructions for use. With this program you will be able to decrypt all your encrypted files. .6. Q: If I don�t want to pay bad people like you? A: If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause only we have the private key. In practice - time is much more valuable than money. :::BEWARE::: DON'T try to change encrypted files by yourself! If you will try to use any third party software for restoring your data or antivirus solutions - please make a backup for all encrypted files! Any changes in encrypted files may entail damage of the private key and, as result, the loss all data.

Emails

[email protected]

Signatures

Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware

File Deletion
T1107

Inhibit System Recovery
T1490

Deletes backup catalog 3 TTPs 1 IoCs

Uses wbadmin.exe to inhibit system recovery.

ransomware

Command-Line Interface

T1059

File Deletion

T1107

Inhibit System Recovery

T1490

pid	Process
928	wbadmin.exe

Interacts with shadow copies 2 TTPs 1 IoCs

Shadow copies are often targeted by ransomware to inhibit system recovery.

ransomware

File Deletion

T1107

Inhibit System Recovery

T1490

pid	Process
1944	vssadmin.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1612	f4e2bab6cb056c8e644e4b8d4dac7cbf2b972d763f396a475e9fb539438de839.exe

Suspicious use of AdjustPrivilegeToken 46 IoCs

description	pid	Process
Token: SeBackupPrivilege	1376	vssvc.exe
Token: SeRestorePrivilege	1376	vssvc.exe
Token: SeAuditPrivilege	1376	vssvc.exe
Token: SeBackupPrivilege	1968	wbengine.exe
Token: SeRestorePrivilege	1968	wbengine.exe
Token: SeSecurityPrivilege	1968	wbengine.exe
Token: SeIncreaseQuotaPrivilege	268	WMIC.exe
Token: SeSecurityPrivilege	268	WMIC.exe
Token: SeTakeOwnershipPrivilege	268	WMIC.exe
Token: SeLoadDriverPrivilege	268	WMIC.exe
Token: SeSystemProfilePrivilege	268	WMIC.exe
Token: SeSystemtimePrivilege	268	WMIC.exe
Token: SeProfSingleProcessPrivilege	268	WMIC.exe
Token: SeIncBasePriorityPrivilege	268	WMIC.exe
Token: SeCreatePagefilePrivilege	268	WMIC.exe
Token: SeBackupPrivilege	268	WMIC.exe
Token: SeRestorePrivilege	268	WMIC.exe
Token: SeShutdownPrivilege	268	WMIC.exe
Token: SeDebugPrivilege	268	WMIC.exe
Token: SeSystemEnvironmentPrivilege	268	WMIC.exe
Token: SeRemoteShutdownPrivilege	268	WMIC.exe
Token: SeUndockPrivilege	268	WMIC.exe
Token: SeManageVolumePrivilege	268	WMIC.exe
Token: 33	268	WMIC.exe
Token: 34	268	WMIC.exe
Token: 35	268	WMIC.exe
Token: SeIncreaseQuotaPrivilege	268	WMIC.exe
Token: SeSecurityPrivilege	268	WMIC.exe
Token: SeTakeOwnershipPrivilege	268	WMIC.exe
Token: SeLoadDriverPrivilege	268	WMIC.exe
Token: SeSystemProfilePrivilege	268	WMIC.exe
Token: SeSystemtimePrivilege	268	WMIC.exe
Token: SeProfSingleProcessPrivilege	268	WMIC.exe
Token: SeIncBasePriorityPrivilege	268	WMIC.exe
Token: SeCreatePagefilePrivilege	268	WMIC.exe
Token: SeBackupPrivilege	268	WMIC.exe
Token: SeRestorePrivilege	268	WMIC.exe
Token: SeShutdownPrivilege	268	WMIC.exe
Token: SeDebugPrivilege	268	WMIC.exe
Token: SeSystemEnvironmentPrivilege	268	WMIC.exe
Token: SeRemoteShutdownPrivilege	268	WMIC.exe
Token: SeUndockPrivilege	268	WMIC.exe
Token: SeManageVolumePrivilege	268	WMIC.exe
Token: 33	268	WMIC.exe
Token: 34	268	WMIC.exe
Token: 35	268	WMIC.exe

Suspicious use of WriteProcessMemory 13 IoCs

description	pid	Process	procid_target
PID 1612 wrote to memory of 1708	1612	f4e2bab6cb056c8e644e4b8d4dac7cbf2b972d763f396a475e9fb539438de839.exe	27
PID 1612 wrote to memory of 1708	1612	f4e2bab6cb056c8e644e4b8d4dac7cbf2b972d763f396a475e9fb539438de839.exe	27
PID 1612 wrote to memory of 1708	1612	f4e2bab6cb056c8e644e4b8d4dac7cbf2b972d763f396a475e9fb539438de839.exe	27
PID 1612 wrote to memory of 1708	1612	f4e2bab6cb056c8e644e4b8d4dac7cbf2b972d763f396a475e9fb539438de839.exe	27
PID 1708 wrote to memory of 1944	1708	cmd.exe	29
PID 1708 wrote to memory of 1944	1708	cmd.exe	29
PID 1708 wrote to memory of 1944	1708	cmd.exe	29
PID 1708 wrote to memory of 928	1708	cmd.exe	32
PID 1708 wrote to memory of 928	1708	cmd.exe	32
PID 1708 wrote to memory of 928	1708	cmd.exe	32
PID 1708 wrote to memory of 268	1708	cmd.exe	36
PID 1708 wrote to memory of 268	1708	cmd.exe	36
PID 1708 wrote to memory of 268	1708	cmd.exe	36

C:\Users\Admin\AppData\Local\Temp\f4e2bab6cb056c8e644e4b8d4dac7cbf2b972d763f396a475e9fb539438de839.exe
"C:\Users\Admin\AppData\Local\Temp\f4e2bab6cb056c8e644e4b8d4dac7cbf2b972d763f396a475e9fb539438de839.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1612
- C:\Users\Admin\AppData\Local\Temp\f4e2bab6cb056c8e644e4b8d4dac7cbf2b972d763f396a475e9fb539438de839.exe
  "C:\Users\Admin\AppData\Local\Temp\f4e2bab6cb056c8e644e4b8d4dac7cbf2b972d763f396a475e9fb539438de839.exe" n1612
  2⤵
  PID:1952
- C:\Windows\system32\cmd.exe
  "C:\Windows\system32\cmd.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1708
- - C:\Windows\system32\vssadmin.exe
    vssadmin delete shadows /all /quiet
    3⤵
    - Interacts with shadow copies
    PID:1944
- - C:\Windows\system32\wbadmin.exe
    wbadmin delete catalog -quiet
    3⤵
    - Deletes backup catalog
    PID:928
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic shadowcopy delete
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:268

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1376

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1968

C:\Windows\System32\vdsldr.exe
C:\Windows\System32\vdsldr.exe -Embedding
1⤵
PID:2000

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
PID:956

C:\Windows\system32\Dwm.exe
"C:\Windows\system32\Dwm.exe"
1⤵
PID:920

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Command-Line Interface

T1059

Persistence

Privilege Escalation

Defense Evasion

File Deletion

T1107

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

memory/928-59-0x000007FEFBD91000-0x000007FEFBD93000-memory.dmp

Filesize
8KB

Download
memory/1612-54-0x0000000076681000-0x0000000076683000-memory.dmp

Filesize
8KB

Download