ransomexx_win | 926da8f5eafdb6a22a2ffd01fe737a589f001f2da87a244f4fa9fd2626348898

General

Target

4cae449450c07b7aa74314173c7b00d409eabfe22b86859f3b3acedd66010458.exe
Size

156KB
MD5

fcd21c6fca3b9378961aa1865bee7ecb
SHA1

0abaa05da2a05977e0baf68838cff1712f1789e0
SHA256

4cae449450c07b7aa74314173c7b00d409eabfe22b86859f3b3acedd66010458
SHA512

e39c1f965f6faeaa33dfec6eba23fbfff14b287f4777797ea79480bb037d6d806516bda7046315e051961fce12e935ac546819c1e0bef5c33568d68955a9792a
SSDEEP

1536:7ZLTzASUIG0TOOYTufIaSWvRYkekdvizSBXxNe9VPw6s6aUCT7Q7qn:OBI9HYyfNBdviGBBQsrhPk4

Score

10^/10

ransomexx_win evasion ransomware

Malware Config

Signatures

Deletes NTFS Change Journal 2 TTPs 1 IoCs

The USN change journal is a persistent log of all changes made to local files used by Windows Server systems.

ransomware

Inhibit System Recovery

T1490

Data Destruction

T1485

pid	Process
864	fsutil.exe

RansomEXX Ransomware
Targeted ransomware with variants which affect Windows and Linux systems.
ransomware ransomexx_win

Clears Windows event logs 1 TTPs 4 IoCs

evasion ransomware

Indicator Removal on Host

T1070

pid	Process
1088	wevtutil.exe
1904	wevtutil.exe
2040	wevtutil.exe
1060	wevtutil.exe

Modifies boot configuration data using bcdedit 1 TTPs 2 IoCs

ransomware evasion

Inhibit System Recovery

T1490

pid	Process
760	bcdedit.exe
2036	bcdedit.exe

Deletes backup catalog 3 TTPs 1 IoCs

Uses wbadmin.exe to inhibit system recovery.

ransomware

Command-Line Interface

T1059

File Deletion

T1107

Inhibit System Recovery

T1490

pid	Process
1540	wbadmin.exe

Disables use of System Restore points 1 TTPs
evasion

Inhibit System Recovery
T1490

Modifies extensions of user files 2 IoCs

Ransomware generally changes the extension on encrypted files.

ransomware

description	ioc	Process
File renamed	C:\Users\Admin\Pictures\ExitExpand.crw => C:\Users\Admin\Pictures\ExitExpand.crw.txd0t	4cae449450c07b7aa74314173c7b00d409eabfe22b86859f3b3acedd66010458.exe
File renamed	C:\Users\Admin\Pictures\SetSave.png => C:\Users\Admin\Pictures\SetSave.png.txd0t	4cae449450c07b7aa74314173c7b00d409eabfe22b86859f3b3acedd66010458.exe

Overwrites deleted data with Cipher tool 1 TTPs
Cipher is a Windows tool which be used to securely wipe deallocated HDD space, preventing recovery of deleted data.
ransomware

Inhibit System Recovery
T1490
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 7 IoCs

pid	Process
1204	4cae449450c07b7aa74314173c7b00d409eabfe22b86859f3b3acedd66010458.exe
1204	4cae449450c07b7aa74314173c7b00d409eabfe22b86859f3b3acedd66010458.exe
1204	4cae449450c07b7aa74314173c7b00d409eabfe22b86859f3b3acedd66010458.exe
1204	4cae449450c07b7aa74314173c7b00d409eabfe22b86859f3b3acedd66010458.exe
1204	4cae449450c07b7aa74314173c7b00d409eabfe22b86859f3b3acedd66010458.exe
1204	4cae449450c07b7aa74314173c7b00d409eabfe22b86859f3b3acedd66010458.exe
1204	4cae449450c07b7aa74314173c7b00d409eabfe22b86859f3b3acedd66010458.exe

C:\Users\Admin\AppData\Local\Temp\4cae449450c07b7aa74314173c7b00d409eabfe22b86859f3b3acedd66010458.exe
"C:\Users\Admin\AppData\Local\Temp\4cae449450c07b7aa74314173c7b00d409eabfe22b86859f3b3acedd66010458.exe"
1⤵
- Modifies extensions of user files
- Suspicious behavior: EnumeratesProcesses
PID:1204
- C:\Windows\System32\wbadmin.exe
  "C:\Windows\System32\wbadmin.exe" delete catalog -quiet
  2⤵
  - Deletes backup catalog
  PID:1540
- C:\Windows\System32\bcdedit.exe
  "C:\Windows\System32\bcdedit.exe" /set {default} bootstatuspolicy ignoreallfailures
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:760
- C:\Windows\System32\wevtutil.exe
  "C:\Windows\System32\wevtutil.exe" cl System
  2⤵
  - Clears Windows event logs
  PID:1088
- C:\Windows\System32\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Change /TN "\Microsoft\Windows\SystemRestore\SR" /disable
  2⤵
  PID:1876
- C:\Windows\System32\wevtutil.exe
  "C:\Windows\System32\wevtutil.exe" cl Setup
  2⤵
  - Clears Windows event logs
  PID:1904
- C:\Windows\SysWOW64\cipher.exe
  "C:\Windows\System32\cipher.exe" /w:C:
  2⤵
  PID:1472
- C:\Windows\SysWOW64\cipher.exe
  "C:\Windows\System32\cipher.exe" /w:D:
  2⤵
  PID:1672
- C:\Windows\System32\bcdedit.exe
  "C:\Windows\System32\bcdedit.exe" /set {default} recoveryenabled no
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:2036
- C:\Windows\System32\wevtutil.exe
  "C:\Windows\System32\wevtutil.exe" cl Application
  2⤵
  - Clears Windows event logs
  PID:2040
- C:\Windows\System32\fsutil.exe
  "C:\Windows\System32\fsutil.exe" usn deletejournal /D C:
  2⤵
  - Deletes NTFS Change Journal
  PID:864
- C:\Windows\System32\wevtutil.exe
  "C:\Windows\System32\wevtutil.exe" cl Security
  2⤵
  - Clears Windows event logs
  PID:1060
- C:\Windows\System32\wevtutil.exe
  "C:\Windows\System32\wevtutil.exe" sl Security /e:false
  2⤵
  PID:1156

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
PID:920

C:\Windows\System32\vdsldr.exe
C:\Windows\System32\vdsldr.exe -Embedding
1⤵
PID:1688

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
PID:1664

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Command-Line Interface

1

T1059

Persistence

Privilege Escalation

Defense Evasion

File Deletion

1

T1107

Indicator Removal on Host

1

T1070

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Data Destruction

1

T1485

Inhibit System Recovery

5

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1156-69-0x000007FEFB641000-0x000007FEFB643000-memory.dmp

Filesize
8KB

Download
memory/1204-54-0x0000000074E41000-0x0000000074E43000-memory.dmp

Filesize
8KB

Download
memory/1204-56-0x0000000006FA0000-0x00000000073AB000-memory.dmp

Filesize
4.0MB

Download
memory/1204-55-0x000000000AEE0000-0x000000000B99A000-memory.dmp

Filesize
10.7MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads