Analysis
-
max time kernel
150s -
max time network
124s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
31/03/2023, 17:35
Behavioral task
behavioral1
Sample
Test.exe
Resource
win7-20230220-en
windows7-x64
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
Test.exe
Resource
win10v2004-20230220-en
windows10-2004-x64
9 signatures
150 seconds
General
-
Target
Test.exe
-
Size
563KB
-
MD5
fb8898216510c6af50a7aa81e23c35cb
-
SHA1
41d42f120ba66bc69efb3a2e1af47e197242f3a2
-
SHA256
c3f3659442a27afa1a9e8cbc18479f9c88e209b0429b30b695085746f1edb39e
-
SHA512
bd91d17213daa08918998e1352893cf94e36e1c2d7e6008b59c71bbdcbd7b7b58c1c8accc7b561c0e9421c0fe133fa3af131bc2f9ccbc411c38a7c4680851402
-
SSDEEP
12288:jXLRoysOFO0XmyVNpCwSnDTWm2kqvqSfyqMFIoiBrRR0GPJT1QxC:jXLRhFC8m2v5GIoiVRRnuxC
Score
10/10
Malware Config
Extracted
Path
C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\!_INFO.txt
Ransom Note
WARNING! YOUR FILES ARE ENCRYPTED!
Don’t worry, your files are safe, provided that you are willing to pay the ransom.
Any forced shutdown or attempts to restore your files with the thrid-party software will be damage your files permanently!
Do not rename your files. It will damage it.
The only way to decrypt your files safely is to buy the special decryption software from us.
Before paying you can send us up to 2 files for free decryption as guarantee. No database files for test.
Send pictures, text, doc files. (files no more than 1mb)
You can contact us with the following email
[email protected]
[email protected]
Send us this ID or this file in first email
ID: 6XSJPpDFGStCH1FNpiAaexScPo0ha1vujSF86KxHWHo=:b169ebacc1fdf8cb1c9ed4d8f083b48dc29218ea8c94090465563c3d36c3600f
Signatures
-
Modifies extensions of user files 12 IoCs
Ransomware generally changes the extension on encrypted files.
description ioc Process File opened for modification C:\Users\Admin\Pictures\SaveDeny.tiff.360 Test.exe File opened for modification C:\Users\Admin\Pictures\AssertUnprotect.tiff.360 Test.exe File renamed C:\Users\Admin\Pictures\CheckpointImport.tiff => C:\Users\Admin\Pictures\CheckpointImport.tiff.360 Test.exe File opened for modification C:\Users\Admin\Pictures\RemoveConvertFrom.tif.360 Test.exe File opened for modification C:\Users\Admin\Pictures\ResumeGet.png.360 Test.exe File renamed C:\Users\Admin\Pictures\RemoveConvertFrom.tif => C:\Users\Admin\Pictures\RemoveConvertFrom.tif.360 Test.exe File renamed C:\Users\Admin\Pictures\ResumeGet.png => C:\Users\Admin\Pictures\ResumeGet.png.360 Test.exe File renamed C:\Users\Admin\Pictures\SaveDeny.tiff => C:\Users\Admin\Pictures\SaveDeny.tiff.360 Test.exe File renamed C:\Users\Admin\Pictures\AssertUnprotect.tiff => C:\Users\Admin\Pictures\AssertUnprotect.tiff.360 Test.exe File opened for modification C:\Users\Admin\Pictures\CheckpointImport.tiff.360 Test.exe File renamed C:\Users\Admin\Pictures\GetComplete.raw => C:\Users\Admin\Pictures\GetComplete.raw.360 Test.exe File opened for modification C:\Users\Admin\Pictures\GetComplete.raw.360 Test.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
resource yara_rule behavioral2/memory/1120-133-0x0000000000930000-0x0000000000AC7000-memory.dmp upx behavioral2/memory/1120-1308-0x0000000000930000-0x0000000000AC7000-memory.dmp upx behavioral2/memory/1120-1316-0x0000000000930000-0x0000000000AC7000-memory.dmp upx behavioral2/memory/1120-1655-0x0000000000930000-0x0000000000AC7000-memory.dmp upx behavioral2/memory/1120-2619-0x0000000000930000-0x0000000000AC7000-memory.dmp upx behavioral2/memory/1120-3778-0x0000000000930000-0x0000000000AC7000-memory.dmp upx behavioral2/memory/1120-5856-0x0000000000930000-0x0000000000AC7000-memory.dmp upx behavioral2/memory/1120-8524-0x0000000000930000-0x0000000000AC7000-memory.dmp upx behavioral2/memory/1120-11315-0x0000000000930000-0x0000000000AC7000-memory.dmp upx behavioral2/memory/1120-11576-0x0000000000930000-0x0000000000AC7000-memory.dmp upx behavioral2/memory/1120-13108-0x0000000000930000-0x0000000000AC7000-memory.dmp upx behavioral2/memory/1120-14686-0x0000000000930000-0x0000000000AC7000-memory.dmp upx behavioral2/memory/1120-17649-0x0000000000930000-0x0000000000AC7000-memory.dmp upx behavioral2/memory/1120-20410-0x0000000000930000-0x0000000000AC7000-memory.dmp upx behavioral2/memory/1120-22906-0x0000000000930000-0x0000000000AC7000-memory.dmp upx behavioral2/memory/1120-26653-0x0000000000930000-0x0000000000AC7000-memory.dmp upx -
Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run Test.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\e075e974dbe5337acff06c176e5fd387015fe485a357a6b4f89f9910931c63bc = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\Test.exe\" b169ebacc1fdf8cb1c9ed4d8f083b48dc29218ea8c94090465563c3d36c3600f" Test.exe Key created \REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\Software\Microsoft\Windows\CurrentVersion\Run Test.exe Set value (str) \REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\e075e974dbe5337acff06c176e5fd387015fe485a357a6b4f89f9910931c63bc = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\Test.exe\" b169ebacc1fdf8cb1c9ed4d8f083b48dc29218ea8c94090465563c3d36c3600f" Test.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\ResiliencyLinks\identity_proxy\__lock_XXX__ Test.exe File created C:\Program Files\Microsoft Office\root\Office16\MSIPC\hr\__lock_XXX__ Test.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\sl-sl\__lock_XXX__ Test.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\js\nls\fr-fr\__lock_XXX__ Test.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\en-ae\ui-strings.js.360 Test.exe File opened for modification C:\Program Files\7-Zip\Lang\mng.txt.360 Test.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\lib\ext\sunec.jar.360 Test.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\modules\org-netbeans-core-io-ui.jar.360 Test.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\O365BusinessR_Subscription-ul-oob.xrm-ms.360 Test.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\s_reject_18.svg.360 Test.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\ko-kr\__lock_XXX__ Test.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\css\__lock_XXX__ Test.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSIPC\vi\msipc.dll.mui.360 Test.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\he-il\!_INFO.txt Test.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\en-ae\!_INFO.txt Test.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\client-issuance-root.xrm-ms.360 Test.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\da-dk\__lock_XXX__ Test.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\fi-fi\__lock_XXX__ Test.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\viewer\nls\he-il\__lock_XXX__ Test.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome.VisualElementsManifest.xml.360 Test.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\schema\triggerConstraints.exsd.360 Test.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\ar-ae\__lock_XXX__ Test.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\es-es\__lock_XXX__ Test.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\he-il\__lock_XXX__ Test.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\MondoR_Subscription-pl.xrm-ms.360 Test.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_OEM_Perp3-ppd.xrm-ms.360 Test.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\he-il\!_INFO.txt Test.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\images\s_radio_selected_18.svg.360 Test.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.ssl.feature_1.0.0.v20140827-1444\feature.properties.360 Test.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\generic-rhp-app\js\nls\!_INFO.txt Test.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.core.jobs_3.6.0.v20140424-0053.jar.360 Test.exe File opened for modification C:\Program Files\Microsoft Office\root\Integration\C2RManifest.excelmui.msi.16.en-us.xml.360 Test.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\en-il\!_INFO.txt Test.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Playstore\fil_get.svg.360 Test.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\BORDERS\MSART14.BDR.360 Test.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOCRRES.ORP.360 Test.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Notifications\__lock_XXX__ Test.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_Retail3-ppd.xrm-ms.360 Test.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\Bibliography\!_INFO.txt Test.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\s_empty_state.svg.360 Test.exe File created C:\Program Files\Microsoft Office\root\Office16\Document Parts\1033\__lock_XXX__ Test.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\LogoImages\WinWordLogoSmall.contrast-white_scale-180.png.360 Test.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\fi-fi\ui-strings.js.360 Test.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\he-il\__lock_XXX__ Test.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\en-il\__lock_XXX__ Test.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\js\nls\hu-hu\ui-strings.js.360 Test.exe File created C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\!_INFO.txt Test.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\LivePersonaCard\TPN.txt.360 Test.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\css\main.css.360 Test.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\zh-tw\__lock_XXX__ Test.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\js\nls\fr-ma\!_INFO.txt Test.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\pl-pl\ui-strings.js.360 Test.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\welcome-2x.png.360 Test.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\js\nls\pl-pl\__lock_XXX__ Test.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\hu-hu\!_INFO.txt Test.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\nl-nl\ui-strings.js.360 Test.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\generic-rhp-app\images\rhp_world_icon_hover_2x.png.360 Test.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Locales\gl.pak.360 Test.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\lib\ext\dnsns.jar.360 Test.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentR_OEM_Perp-ul-phn.xrm-ms.360 Test.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\tools.jar.360 Test.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-jmx_ja.jar.360 Test.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MEDIA\EXPLODE.WAV.360 Test.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\task-handler\js\nls\de-de\__lock_XXX__ Test.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000_Classes\Local Settings\MuiCache StartMenuExperienceHost.exe -
Suspicious behavior: EnumeratesProcesses 52 IoCs
pid Process 1120 Test.exe 1120 Test.exe 1120 Test.exe 1120 Test.exe 1120 Test.exe 1120 Test.exe 1120 Test.exe 1120 Test.exe 1120 Test.exe 1120 Test.exe 1120 Test.exe 1120 Test.exe 1120 Test.exe 1120 Test.exe 1120 Test.exe 1120 Test.exe 1120 Test.exe 1120 Test.exe 1120 Test.exe 1120 Test.exe 1120 Test.exe 1120 Test.exe 1120 Test.exe 1120 Test.exe 1120 Test.exe 1120 Test.exe 1120 Test.exe 1120 Test.exe 1120 Test.exe 1120 Test.exe 1120 Test.exe 1120 Test.exe 1120 Test.exe 1120 Test.exe 1120 Test.exe 1120 Test.exe 1120 Test.exe 1120 Test.exe 1120 Test.exe 1120 Test.exe 1120 Test.exe 1120 Test.exe 1120 Test.exe 1120 Test.exe 1120 Test.exe 1120 Test.exe 1120 Test.exe 1120 Test.exe 1120 Test.exe 1120 Test.exe 1120 Test.exe 1120 Test.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 1008 StartMenuExperienceHost.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Test.exe"C:\Users\Admin\AppData\Local\Temp\Test.exe"1⤵
- Modifies extensions of user files
- Adds Run key to start application
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
PID:1120
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:1008
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
129B
MD5a526b9e7c716b3489d8cc062fbce4005
SHA12df502a944ff721241be20a9e449d2acd07e0312
SHA256e1b9ce9b57957b1a0607a72a057d6b7a9b34ea60f3f8aa8f38a3af979bd23066
SHA512d83d4c656c96c3d1809ad06ce78fa09a77781461c99109e4b81d1a186fc533a7e72d65a4cb7edf689eeccda8f687a13d3276f1111a1e72f7c3cd92a49bce0f88
-
C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\Install\{65949401-7B2D-4281-A148-DEA6D44CB2BC}\MicrosoftEdgeUpdateSetup_X86_1.3.173.45.exe.360
Filesize1.5MB
MD5fca0dc08346e759d97f483db65da761d
SHA1ade9e3bcaca722f4133b4a224a56e8ae5154c6ec
SHA256b356de3e3786aca76e511a6468e3976ce608d1278decb1017e87d03d94626121
SHA5127b428d87664461d92285ba883ce9e550becbf6a6f3e96691553bb09b6d6527a740f9cc8b5eaf9bc0312d95e1a08b7a393c3874acbdc1ae76defc5d37a243f5b2
-
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\StartUnifiedTileModelCache.dat
Filesize14KB
MD5460d7e35e626d6b4bdb5d036c62f2afb
SHA11a2f3ae4a09eae574aafc27afe2de171e0e5863b
SHA256c545e9c063692010ff9c02cf9d39151971e213e626701cf5fe0e38f31974e8fc
SHA512a216027ee7420c431eaae565083a9b370f261763c65ac17913860926a07d3d26d1cd1eec7c90dff1d308390d163baa5d15d287c9aa8ec402cf8075d33bf42f59
-
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\StartUnifiedTileModelCache.dat
Filesize14KB
MD5916186d46d7dc1d46961379ac3701eba
SHA1651ca7b0c1599057ef5b1356bcd5ef177f36d8fa
SHA25627f7ba5fcb8d4fa37e1019ebc93ec57c9f6d8baac09568517fccb849c3bcc520
SHA5126d7e57aa19615fdc7e5bb268cc6584530ae3392269c652420620174122944aaa2888fd3279128e4fd989293d111a695e99533d8c3df3ca354d0b2d7bf1494d53
-
Filesize
177B
MD56269828a455f5b2e470ab7bbf18a4a71
SHA11120a7b68cc3b8d4c38512f6f5b46cea1999115b
SHA2567a2f326ca41dd6a595b9153391afca052b23ca5fa6827176d9f838f9abfd97bb
SHA512e7e595e7a583d75df2f0b2db341e1165dce0ae0eef5c86b1395faa9a8209ae84e3dcd2fb312d84fc28dd1228500df8eb8f793a3498980c19c2e4fad6d2167376
-
Filesize
810B
MD5563ae203674920ff2bf1590d6fe6ab49
SHA15253e10862151145c7d65989acde853e86603a79
SHA256fe763ae57fded8f889ff08cb4f42215be9cd081e61e1f52d91b3b9c6b2883d01
SHA5127ef9abb94a9d45d600aecb274ea567d50321c8a9a0cabb560a0ba3636360421f0068fd70818ce7321294601a911cdc5f907e02d37b92a3cf95c71307e7e8354f