Overview

overview

10

Static

static

8

c3f3659442...9e.exe

windows7-x64

10

c3f3659442...9e.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    66s
  • max time network
    33s
  • platform
    windows7_x64
  • resource
    win7-20221111-en
  • resource tags

    arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
  • submitted
    27/12/2022, 15:58

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target

    c3f3659442a27afa1a9e8cbc18479f9c88e209b0429b30b695085746f1edb39e.exe

  • Size

    563KB

  • MD5

    fb8898216510c6af50a7aa81e23c35cb

  • SHA1

    41d42f120ba66bc69efb3a2e1af47e197242f3a2

  • SHA256

    c3f3659442a27afa1a9e8cbc18479f9c88e209b0429b30b695085746f1edb39e

  • SHA512

    bd91d17213daa08918998e1352893cf94e36e1c2d7e6008b59c71bbdcbd7b7b58c1c8accc7b561c0e9421c0fe133fa3af131bc2f9ccbc411c38a7c4680851402

  • SSDEEP

    12288:jXLRoysOFO0XmyVNpCwSnDTWm2kqvqSfyqMFIoiBrRR0GPJT1QxC:jXLRhFC8m2v5GIoiVRRnuxC

Score
10/10
persistenceransomwarespywarestealerupx

Malware Config

Extracted

Path

C:\Users\Admin\Desktop\!_INFO.txt

Ransom Note
WARNING! YOUR FILES ARE ENCRYPTED! Don’t worry, your files are safe, provided that you are willing to pay the ransom. Any forced shutdown or attempts to restore your files with the thrid-party software will be damage your files permanently! Do not rename your files. It will damage it. The only way to decrypt your files safely is to buy the special decryption software from us. Before paying you can send us up to 2 files for free decryption as guarantee. No database files for test. Send pictures, text, doc files. (files no more than 1mb) You can contact us with the following email [email protected] [email protected] Send us this ID or this file in first email ID: EWKk9rkhWBtV9fDsDvDnIfdhefN1To9cvb4VMxVLgIg=:b169ebacc1fdf8cb1c9ed4d8f083b48dc29218ea8c94090465563c3d36c3600f

Signatures

  • Modifies extensions of user files 2 IoCs

    Ransomware generally changes the extension on encrypted files.

    ransomware
  • UPX packed file 3 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Deletes itself 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 4 IoCs
    persistence
  • Drops file in Program Files directory 64 IoCs
  • Runs ping.exe 1 TTPs 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 7 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\c3f3659442a27afa1a9e8cbc18479f9c88e209b0429b30b695085746f1edb39e.exe
    "C:\Users\Admin\AppData\Local\Temp\c3f3659442a27afa1a9e8cbc18479f9c88e209b0429b30b695085746f1edb39e.exe"
    1⤵
    • Modifies extensions of user files
    • Adds Run key to start application
    • Drops file in Program Files directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:1060
    • C:\Windows\SysWOW64\cmd.exe
      cmd.exe /C ping 1.1.1.1 -n 10 -w 3000 > Nul & Del /f /q "C:\Users\Admin\AppData\Local\Temp\c3f3659442a27afa1a9e8cbc18479f9c88e209b0429b30b695085746f1edb39e.exe"
      2⤵
      • Deletes itself
      • Suspicious use of WriteProcessMemory
      PID:1116
      • C:\Windows\SysWOW64\PING.EXE
        ping 1.1.1.1 -n 10 -w 3000
        3⤵
        • Runs ping.exe
        PID:1944

Network

        MITRE ATT&CK Enterprise v6

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\$Recycle.Bin\S-1-5-21-3406023954-474543476-3319432036-1000\desktop.ini
          Filesize

          257B

          MD5

          e7f0a68f30a3ba4a456788ec2b6f8f6f

          SHA1

          deb9ee85356bdbd685aa7a9131ea0dc47c8fccb6

          SHA256

          97f1d1ccc80a36a946a4dd424eb9928e8ad90eefae08f0ec5372dd6d9514f2ad

          SHA512

          8b6120c1591fbaea899a042f1b15e61fffe9759c4ba9b943ffde65a0f6dd0af1f506d60ee9e88035020e55316b7a620887b42bcc28fbbbbdf31afd0dfff87bd1

          Download Submit

        • memory/1060-54-0x0000000075631000-0x0000000075633000-memory.dmp

          Filesize

          8KB

          Download

        • memory/1060-55-0x00000000000E0000-0x0000000000277000-memory.dmp

          Filesize

          1.6MB

          Download

        • memory/1060-56-0x00000000000E0000-0x0000000000277000-memory.dmp

          Filesize

          1.6MB

          Download

        • memory/1060-59-0x00000000000E0000-0x0000000000277000-memory.dmp

          Filesize

          1.6MB

          Download