Overview

overview

10

Static

static

10

sample.exe

windows7-x64

10

sample.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    116s
  • max time network
    49s
  • platform
    windows7_x64
  • resource
    win7-20220901-en
  • resource tags

    arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
  • submitted
    09-12-2022 08:10

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    sample.exe

  • Size

    265KB

  • MD5

    edb9ba4dec60f2fbabe50db587ed035b

  • SHA1

    43ba0dc628d76092dd409a6d21f81e5045ddd24f

  • SHA256

    99b8962d32d011802dfa8c8aafaf2c1464fa80d9fb107f7fe1abe7005b5af2cf

  • SHA512

    7931e66b5c7fe59981835623f4fef3228aed943b49f3b44b1ad8831f28e9f8be8b1be82e1564fa33a843352345f95405198ba89c98bc3e62622b3ab081c7ecfc

  • SSDEEP

    3072:hUQoKIo3zkikzwVNYWGN6ozfnQxct3VCyuVMAAbMIcEWSRgdOdLOfTg:Ryojkia2pGNbZ3EvVxIcEmOdM

Score
10/10
xoristpersistenceransomwarespywarestealerupx

Malware Config

Extracted

Path

C:\$Recycle.Bin\S-1-5-21-4063495947-34355257-727531523-1000\HOW TO DECRYPT FILES.txt

Ransom Note
Ooops, your files have been encrypted! -What Happen to my computer? Your important files are encrypted Many of your documents , photos , passwords , databases and other files are no longer accessible because they have been encrypted . Maybe you are busy looking for way to recover your files , but do not waste your time . Nobody can recover your files without our decryption KEY -Can i Recover My Files? Sure.We guarantee that you can recover all your files safely and easlly But You have not so enough time . So If you want to decrypt all your files, you need to pay . You only have 12H to submit the payment.After that price will be doubled Also, If the transaction is not completed within 24 hours your files will be permanently deleted. How To buy bitcoins https://www.bitcoin.com/buy-bitcoin And Send the the correct amount to this address 0.05 BTC 17pXroP4MruitJzpTa88FAPAGD5q5QAPzb
Wallets

17pXroP4MruitJzpTa88FAPAGD5q5QAPzb

URLs

https://www.bitcoin.com/buy-bitcoin

Signatures

  • Detected Xorist Ransomware 2 IoCs
  • Xorist Ransomware

    Xorist is a ransomware first seen in 2020.

    ransomwarexorist
  • Drops file in Drivers directory 8 IoCs
  • Modifies extensions of user files 5 IoCs

    Ransomware generally changes the extension on encrypted files.

    ransomware
  • UPX packed file 2 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Drops startup file 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Drops file in System32 directory 64 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 64 IoCs
  • Modifies registry class 10 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\sample.exe
    "C:\Users\Admin\AppData\Local\Temp\sample.exe"
    1⤵
    • Drops file in Drivers directory
    • Modifies extensions of user files
    • Drops startup file
    • Adds Run key to start application
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Modifies registry class
    • Suspicious use of FindShellTrayWindow
    PID:1696
  • C:\Windows\system32\NOTEPAD.EXE
    "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\HOW TO DECRYPT FILES.txt
    1⤵
      PID:1324

    Network

    MITRE ATT&CK Matrix ATT&CK v6

    Initial Access

    Execution

    Persistence

    Registry Run Keys / Startup Folder

    1
    T1060

    Privilege Escalation

    Defense Evasion

    Modify Registry

    1
    T1112

    Credential Access

    Credentials in Files

    1
    T1081

    Discovery

    Lateral Movement

    Collection

    Data from Local System

    1
    T1005

    Exfiltration

    Command and Control

    Impact

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\Desktop\HOW TO DECRYPT FILES.txt
      Filesize

      949B

      MD5

      f1bad9df68fd2048163760286e7ba0e6

      SHA1

      bda9081d420f6b80728811bfc9b551efbc6dddce

      SHA256

      ba55982fc1d90fdaef69c6b069f39aef64685973f304303f203eaa35b151db05

      SHA512

      6c2d8f2fc91d8e843b93e6996050649dfa564dc3ee0b8c1c34ef98c65d22ed47e95b9a59bbb11d6414d9101512b626a3eff1b8c5136e14d6b4d598222b141573

      Download Submit
    • memory/1324-57-0x000007FEFC2F1000-0x000007FEFC2F3000-memory.dmp
      Filesize

      8KB

      Download
    • memory/1696-54-0x00000000766D1000-0x00000000766D3000-memory.dmp
      Filesize

      8KB

      Download
    • memory/1696-55-0x0000000000400000-0x0000000000551000-memory.dmp
      Filesize

      1.3MB

      Download
    • memory/1696-56-0x0000000000400000-0x0000000000551000-memory.dmp
      Filesize

      1.3MB

      Download