Overview

overview

10

Static

static

8

c3f3659442...9e.exe

windows7-x64

10

c3f3659442...9e.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    145s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    27/12/2022, 15:58

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target

    c3f3659442a27afa1a9e8cbc18479f9c88e209b0429b30b695085746f1edb39e.exe

  • Size

    563KB

  • MD5

    fb8898216510c6af50a7aa81e23c35cb

  • SHA1

    41d42f120ba66bc69efb3a2e1af47e197242f3a2

  • SHA256

    c3f3659442a27afa1a9e8cbc18479f9c88e209b0429b30b695085746f1edb39e

  • SHA512

    bd91d17213daa08918998e1352893cf94e36e1c2d7e6008b59c71bbdcbd7b7b58c1c8accc7b561c0e9421c0fe133fa3af131bc2f9ccbc411c38a7c4680851402

  • SSDEEP

    12288:jXLRoysOFO0XmyVNpCwSnDTWm2kqvqSfyqMFIoiBrRR0GPJT1QxC:jXLRhFC8m2v5GIoiVRRnuxC

Score
10/10
persistenceransomwarespywarestealerupx

Malware Config

Extracted

Path

C:\Users\Admin\Desktop\!_INFO.txt

Ransom Note
WARNING! YOUR FILES ARE ENCRYPTED! Don’t worry, your files are safe, provided that you are willing to pay the ransom. Any forced shutdown or attempts to restore your files with the thrid-party software will be damage your files permanently! Do not rename your files. It will damage it. The only way to decrypt your files safely is to buy the special decryption software from us. Before paying you can send us up to 2 files for free decryption as guarantee. No database files for test. Send pictures, text, doc files. (files no more than 1mb) You can contact us with the following email [email protected] [email protected] Send us this ID or this file in first email ID: 6D9MiVj3OUgdbSbS1Y/yKUUB7EeaZB3wVFPbGe+j1OI=:b169ebacc1fdf8cb1c9ed4d8f083b48dc29218ea8c94090465563c3d36c3600f

Signatures

  • Modifies extensions of user files 8 IoCs

    Ransomware generally changes the extension on encrypted files.

    ransomware
  • UPX packed file 2 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 4 IoCs
    persistence
  • Drops file in Program Files directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Modifies registry class 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\c3f3659442a27afa1a9e8cbc18479f9c88e209b0429b30b695085746f1edb39e.exe
    "C:\Users\Admin\AppData\Local\Temp\c3f3659442a27afa1a9e8cbc18479f9c88e209b0429b30b695085746f1edb39e.exe"
    1⤵
    • Modifies extensions of user files
    • Adds Run key to start application
    • Drops file in Program Files directory
    • Suspicious behavior: EnumeratesProcesses
    PID:988
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:3640

Network

        MITRE ATT&CK Enterprise v6

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\$Recycle.Bin\S-1-5-21-2891029575-1462575-1165213807-1000\desktop.ini
          Filesize

          129B

          MD5

          a526b9e7c716b3489d8cc062fbce4005

          SHA1

          2df502a944ff721241be20a9e449d2acd07e0312

          SHA256

          e1b9ce9b57957b1a0607a72a057d6b7a9b34ea60f3f8aa8f38a3af979bd23066

          SHA512

          d83d4c656c96c3d1809ad06ce78fa09a77781461c99109e4b81d1a186fc533a7e72d65a4cb7edf689eeccda8f687a13d3276f1111a1e72f7c3cd92a49bce0f88

          Download Submit

        • memory/988-132-0x0000000000010000-0x00000000001A7000-memory.dmp

          Filesize

          1.6MB

          Download

        • memory/988-133-0x0000000000010000-0x00000000001A7000-memory.dmp

          Filesize

          1.6MB

          Download