Overview

overview

10

Static

static

10

8090cb9a98...5a.exe

windows7-x64

10

8090cb9a98...5a.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    156s
  • max time network
    135s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    08-12-2022 10:56

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    8090cb9a98392d753116e30e0be9f25a.exe

  • Size

    216KB

  • MD5

    8090cb9a98392d753116e30e0be9f25a

  • SHA1

    1f45a5e3dc88e363fd6ff83d52a6a2e4ddd8951f

  • SHA256

    ab440c4391ea3a01bebbb651c80c27847b58ac928b32d73ed3b19a0b17dd7e75

  • SHA512

    dede19a2dd8c314617c448ad785e24b511f76eecd4dcc40b1ce2a034ef57a536fc0c6f74209685f73219974b200008b1d4127783ea5738e07b2306e13db6f7dd

  • SSDEEP

    6144:UyJE1yd7WWlJmcyfwAPWna4DQFu/U3buRKlemZ9DnGAevIGS+:UU/d7WWKvhPWa4DQFu/U3buRKlemZ9DG

Score
10/10
zeppelinpersistenceransomware

Malware Config

Extracted

Path

C:\!!! ALL YOUR FILES ARE ENCRYPTED !!!.TXT

Ransom Note
ALL YOUR FILES HAVE BEEN ENCRYPTED BY "VICE SOCIETY" All your important documents, photos, databases were stolen and encrypted. If you don't contact us in 7 days we will upload your files to darknet. The only method of recovering files is to purchase an unique private key. We are the only who can give you tool to recover your files. To proove that we have the key and it works you can send us 2 files and we decrypt it for free (not more than 2 MB each). This file should be not valuable! Write to email: [email protected] Alternative email: [email protected] Public emai:l [email protected] Our tor website: vsociethok6sbprvevl4dlwbqrzyhxcxaqpvcqt5belwvsuxaxsutyad.onion Attention! * Do not rename encrypted files. * Do not try to decrypt your data using third party software, it may cause permanent data loss. * Decryption of your files with the help of third parties may cause increased price (they add their fee to ours) or you can become a victim of a scam.
URLs

http://vsociethok6sbprvevl4dlwbqrzyhxcxaqpvcqt5belwvsuxaxsutyad.onion

Signatures

  • Detects Zeppelin payload 3 IoCs
  • Zeppelin Ransomware

    Ransomware-as-a-service (RaaS) written in Delphi and first seen in 2019.

    ransomwarezeppelin
  • Deletes shadow copies 2 TTPs

    Ransomware often targets backup files to inhibit system recovery.

    ransomware
  • Executes dropped EXE 2 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 24 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Program Files directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 36 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\8090cb9a98392d753116e30e0be9f25a.exe
    "C:\Users\Admin\AppData\Local\Temp\8090cb9a98392d753116e30e0be9f25a.exe"
    1⤵
    • Checks computer location settings
    • Adds Run key to start application
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4284
    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\services.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\services.exe" -start
      2⤵
      • Executes dropped EXE
      • Enumerates connected drives
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:4928
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\system32\cmd.exe" /C wmic shadowcopy delete
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:4592
        • C:\Windows\SysWOW64\Wbem\WMIC.exe
          wmic shadowcopy delete
          4⤵
          • Suspicious use of AdjustPrivilegeToken
          PID:4220
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\system32\cmd.exe" /C bcdedit /set {default} recoveryenabled no
        3⤵
          PID:648
        • C:\Windows\SysWOW64\cmd.exe
          "C:\Windows\system32\cmd.exe" /C bcdedit /set {default} bootstatuspolicy ignoreallfailures
          3⤵
            PID:3632
          • C:\Windows\SysWOW64\cmd.exe
            "C:\Windows\system32\cmd.exe" /C wbadmin delete catalog -quiet
            3⤵
              PID:4628
            • C:\Windows\SysWOW64\cmd.exe
              "C:\Windows\system32\cmd.exe" /C vssadmin delete shadows /all /quiet
              3⤵
                PID:4432
              • C:\Windows\SysWOW64\cmd.exe
                "C:\Windows\system32\cmd.exe" /C C:\Users\Admin\AppData\Local\Temp\~temp001.bat
                3⤵
                • Suspicious use of WriteProcessMemory
                PID:1944
                • C:\Windows\SysWOW64\Wbem\WMIC.exe
                  wmic shadowcopy delete
                  4⤵
                  • Suspicious use of AdjustPrivilegeToken
                  PID:1680
              • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\services.exe
                "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\services.exe" -agent 0
                3⤵
                • Executes dropped EXE
                • Drops file in Program Files directory
                PID:1780
            • C:\Windows\SysWOW64\notepad.exe
              notepad.exe
              2⤵
                PID:5032
            • C:\Windows\system32\vssvc.exe
              C:\Windows\system32\vssvc.exe
              1⤵
                PID:2400

              Network

              MITRE ATT&CK Enterprise v6

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              • C:\Users\Admin\AppData\Local\Temp\~temp001.bat
                Filesize

                406B

                MD5

                ef572e2c7b1bbd57654b36e8dcfdc37a

                SHA1

                b84c4db6d0dfd415c289d0c8ae099aea4001e3b7

                SHA256

                e6e609db3f387f42bfd16dd9e5695ddc2b73d86ae12baf4f0dfc4edda4a96a64

                SHA512

                b8c014b242e8e8f42da37b75fe96c52cd25ebd366d0b5103bcba5ac041806d13142a62351edecdee583d494d2a120f9b330f6229b1b5fe820e1c7d98981089e9

                Download Submit

              • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\services.exe
                Filesize

                216KB

                MD5

                8090cb9a98392d753116e30e0be9f25a

                SHA1

                1f45a5e3dc88e363fd6ff83d52a6a2e4ddd8951f

                SHA256

                ab440c4391ea3a01bebbb651c80c27847b58ac928b32d73ed3b19a0b17dd7e75

                SHA512

                dede19a2dd8c314617c448ad785e24b511f76eecd4dcc40b1ce2a034ef57a536fc0c6f74209685f73219974b200008b1d4127783ea5738e07b2306e13db6f7dd

                Download Submit

              • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\services.exe
                Filesize

                216KB

                MD5

                8090cb9a98392d753116e30e0be9f25a

                SHA1

                1f45a5e3dc88e363fd6ff83d52a6a2e4ddd8951f

                SHA256

                ab440c4391ea3a01bebbb651c80c27847b58ac928b32d73ed3b19a0b17dd7e75

                SHA512

                dede19a2dd8c314617c448ad785e24b511f76eecd4dcc40b1ce2a034ef57a536fc0c6f74209685f73219974b200008b1d4127783ea5738e07b2306e13db6f7dd

                Download Submit

              • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\services.exe
                Filesize

                216KB

                MD5

                8090cb9a98392d753116e30e0be9f25a

                SHA1

                1f45a5e3dc88e363fd6ff83d52a6a2e4ddd8951f

                SHA256

                ab440c4391ea3a01bebbb651c80c27847b58ac928b32d73ed3b19a0b17dd7e75

                SHA512

                dede19a2dd8c314617c448ad785e24b511f76eecd4dcc40b1ce2a034ef57a536fc0c6f74209685f73219974b200008b1d4127783ea5738e07b2306e13db6f7dd

                Download Submit

              • memory/648-137-0x0000000000000000-mapping.dmp

                Download

              • memory/1680-146-0x0000000000000000-mapping.dmp

                Download

              • memory/1780-142-0x0000000000000000-mapping.dmp

                Download

              • memory/1944-141-0x0000000000000000-mapping.dmp

                Download

              • memory/3632-138-0x0000000000000000-mapping.dmp

                Download

              • memory/4220-145-0x0000000000000000-mapping.dmp

                Download

              • memory/4432-140-0x0000000000000000-mapping.dmp

                Download

              • memory/4592-136-0x0000000000000000-mapping.dmp

                Download

              • memory/4628-139-0x0000000000000000-mapping.dmp

                Download

              • memory/4928-132-0x0000000000000000-mapping.dmp

                Download

              • memory/5032-135-0x0000000000000000-mapping.dmp

                Download