Overview

overview

10

Static

static

10

9b11711efe...dd.exe

windows10-2004-x64

10

Resubmissions

27-11-2022 07:25

221127-h83y9adc3v 10

27-11-2022 07:18

221127-h4y5hahc96 10

Analysis

  • max time kernel
    114s
  • max time network
    116s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220901-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
  • submitted
    27-11-2022 07:25

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    9b11711efed24b3c6723521a7d7eb4a52e4914db7420e278aa36e727459d59dd.exe

  • Size

    136KB

  • MD5

    94d087166651c0020a9e6cc2fdacdc0c

  • SHA1

    99be22569ba9b1e49d3fd36f65faa6795672fcc0

  • SHA256

    9b11711efed24b3c6723521a7d7eb4a52e4914db7420e278aa36e727459d59dd

  • SHA512

    0f5a413e57e4cedf0a8df3b33cda3c2c0732ded58c367633e8677bf88786eb786b85c97420fda150fecb68db74dc00f77064c3ea77d00f53904413c9ea3a93ba

  • SSDEEP

    1536:xxd+ReKXU/MQaL7k0B/L7s+Zi+GrZxtQpfyHvtICS4A4UdZls8XzUXiWr4X5F4GC:xtchTojrZxtMhiiZHjUyWr4X5FTDU

Score
10/10
evasionransomware

Malware Config

Extracted

Path

C:\wx7a702z-readme.txt

Ransom Note
---=== Welcome. Again. ===--- [-] Whats HapPen? [-] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension wx7a702z. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practice - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/5C1F7BF43A71CAD9 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decoder.re/5C1F7BF43A71CAD9 Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: tg1ogfdwE+GdGzxBKlI7ArLA1enSvRI7nr9p84Yps/cTPudJuxXbyNKTHYgqDMVC vsvC40m0SNFwlLvouzd8vlMvytTjmZ/qAkrLEdZG29xqRidRur9bCx2u8lTP3Gst K7KLwnxo/dZTYrSCI9xsV4vcqofd7gjNPJJrq02yHmPPD5An1jA+lJHHiUzA+3qv hUYVz46xrXFH5iEMEHR/AlnypJZpHTootqGAnIL3hnU2H53MzOn+OEaM/1AnirVi GjAUioqy2fykJiYs2Md5ackGyBSgkLEG8CIL9XCzukeZdJ74KCYeRzsYbW+UUF4p dgf4/R7X6+gp/AlIlx8q5bhQNj2YtmPAOAYExvepaGwHM8yV3HGIgsfKc1e67nUp P68wleExgquNBQ98ulzD/LoekPWh/E4NmaFzoHifxV2VcvYh0MFSR3UZDup2P5gw oB764ohnGUnboVUj2VTnnFkzbGKlJ/EaUpoEDxJkURb1Q2febEAkEk0R8rMOjzW5 DcgbIdxVj1Q+KlwPl0t/fChhWEATarJuNTLwaKBA0WNb8YBiN8eYYAZyes3uo3ED u+E8QqnArGlabwXudnSCJMi8RKky05VXuSN6IVKs2yfFo6NDNacrCob4lYviEy8G RxsFXYGUaal6qTl5hOol13UmX+a0AiSyTZIZsH86vpzffEWYFwB0Dy7fnWJFTG6n Uups108HL0U1E8buQa2gp4WSwxguHZgXkDICBsNZL4N1HNSqGtIZSMasU5o/JBbD ZqxwK2La2q7/4W2fZq66orImh+oBWoix5YGdD00FqGYGffaEWmYlbAPPmFw6cOfK TZkitfKP+eTmOD1aZpwqcpfZPmWkX6smLlHadatbp5n2hYP2vhlEjjDd1FklfdwU bervx1+LyNWYa019ObysvGlTs+Frh7NFRxbEAEYTkMika7ks2rwE7gLaSc60xtH4 FHQcnM9VvzBgRgMJgum97DmdljfixM3wkst1ibCp23987dvBf8Riiq2PH5coQabk TWhBigVBTVPdb3NUB+/skPRhBMbAeABE838RiQDRDOS0FANH+4FCy+rhs7ktQ82a mfatxLRyZoxymB1DqIp33JO7TW0PwnhEENFTRmHbfbaB7kFZEtqI6A+Oh8LL43tC xdUlBPkga87Cb3vIA/muUBfOpQzRCXxGdoShKsUN6GJ6iFlg0/OiDL8NnyCGx5bd cXfmk2u563WmK7zdeO420/kTjMq5e8fOjs8V4cB0Np9T6q5S2gxAAEGuRMlrKBaW kynuaUcgJDRsWjtN5YgkEn5o+Hl7M78F ----------------------------------------------------------------------------------------- !!! DANGER !!! DON'T try to change files by yourself, DON'T use any third party software for restoring your data or antivirus solutions - its may entail damage of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/5C1F7BF43A71CAD9

http://decoder.re/5C1F7BF43A71CAD9

Signatures

  • Modifies Windows Firewall 1 TTPs 1 IoCs
    evasion
  • Modifies extensions of user files 7 IoCs

    Ransomware generally changes the extension on encrypted files.

    ransomware
  • Enumerates connected drives 3 TTPs 25 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Sets desktop wallpaper using registry 2 TTPs 1 IoCs
    ransomware
  • Drops file in Program Files directory 27 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Checks SCSI registry key(s) 3 TTPs 3 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Suspicious behavior: EnumeratesProcesses 51 IoCs
  • Suspicious use of AdjustPrivilegeToken 8 IoCs
  • Suspicious use of FindShellTrayWindow 53 IoCs
  • Suspicious use of SendNotifyMessage 53 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\9b11711efed24b3c6723521a7d7eb4a52e4914db7420e278aa36e727459d59dd.exe
    "C:\Users\Admin\AppData\Local\Temp\9b11711efed24b3c6723521a7d7eb4a52e4914db7420e278aa36e727459d59dd.exe"
    1⤵
    • Modifies extensions of user files
    • Enumerates connected drives
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1336
    • C:\Windows\SysWOW64\netsh.exe
      netsh advfirewall firewall set rule group="Network Discovery" new enable=Yes
      2⤵
      • Modifies Windows Firewall
      PID:3800
  • C:\Windows\system32\wbem\unsecapp.exe
    C:\Windows\system32\wbem\unsecapp.exe -Embedding
    1⤵
      PID:348
    • C:\Windows\system32\vssvc.exe
      C:\Windows\system32\vssvc.exe
      1⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:4172
    • C:\Windows\system32\taskmgr.exe
      "C:\Windows\system32\taskmgr.exe" /4
      1⤵
      • Checks SCSI registry key(s)
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:4832
    • C:\Windows\system32\NOTEPAD.EXE
      "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\wx7a702z-readme.txt
      1⤵
        PID:1448

      Network

      MITRE ATT&CK Enterprise v6

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\Desktop\wx7a702z-readme.txt
        Filesize

        6KB

        MD5

        a4fb7c8e740a027160d69e54d025a02f

        SHA1

        5392d941bd60491e00883d3d740f01bc718657e3

        SHA256

        742cd1470baec8a361474364aa695e534abd803fd94bef7337ee6d2d2ceb5d42

        SHA512

        3bcb850ff3a83cab8301a6cbb1d848f99f82f3b13fff4b73f975e15262f3129869365306eaf7e945432a0395d53ea23c48b80200781d1bc5762fc796f0fc8845

        Download Submit

      • memory/3800-132-0x0000000000000000-mapping.dmp

        Download