Overview

overview

10

Static

static

3

b95a4443bb...1e.exe

windows7-x64

10

b95a4443bb...1e.exe

windows10-2004-x64

10

Resubmissions

07/06/2023, 00:18

230607-alrcyagb74 10

07/06/2023, 00:16

230607-akgr4sgb68 10

Analysis

  • max time kernel
    23s
  • max time network
    28s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230220-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
  • submitted
    07/06/2023, 00:16

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    b95a4443bb8bff80d927ac551a9a5a5cfac3e3e03a5b5737c0e05c75f33ad61e.exe

  • Size

    113KB

  • MD5

    8d9f3e223f8d5e350b87dc0908fee0a5

  • SHA1

    9fe3060e5cbe3a9ab6c3fb3dee40bd6cd385a6f6

  • SHA256

    b95a4443bb8bff80d927ac551a9a5a5cfac3e3e03a5b5737c0e05c75f33ad61e

  • SHA512

    d7ffbcdc3bdb72cb1994aae3178feec0edf0384ca57c9dc32bfa95d55d71ffc0dcce809411da9a410c10a1a12677b218807dcb39ab7bc72e04c6519e32314f30

  • SSDEEP

    1536:1wS0lrtfH16vu2Lwn7iqtjl20VoC6wC+kh9YuikxGHgdyo1dRHPUW:70lRv4LR4j4zCjC+kh9Bikw417vUW

Score
10/10
ransomware

Malware Config

Extracted

Path

C:\HOW_TO_RECOVERY_FILES.txt

Ransom Note
~~~ Hello! Your company has been hacked! ~~~ >>>> Your data are stolen and encrypted >>>> What guarantees that we will not deceive you? We are not a politically motivated group and we do not need anything other than your money. If you pay, we will provide you the programs for decryption and we will delete your data. Life is too short to be sad. Be not sad, money, it is only paper. If we do not give you decrypters, or we do not delete your data after payment, then nobody will pay us in the future. Therefore to us our reputation is very important. We attack the companies worldwide and there is no dissatisfied victim after payment. >>>> You need to contact us by email [email protected] and decrypt some files for free >>>> The data will be published on TOR website if you do not pay the ransom Download and install TOR Browser https://www.torproject.org/ Links for Tor Browser: http://ze677xuzard4lx4iul2yzf5ks4gqqzoulgj5u4n5n4bbbsxjbfr7eayd.onion >>>> Your personal ID: 81E0591A068F76320F0702E9482D4025EED36AE18449D08FD7FED63470D699 24F7EF1BFCF6855C4E93285680F762D41D66E079F6AB9A6E8185A19AC36F95 7CE079BA0A15D8399D4E4BD64AF0FA245A41A02E1CB234441086A8C69FEE5B 2AAC0D6692ABB2DF5078DD45A88B5572B8069F3B7B1C912641317C587D9318 E6FA1841A4CAB89FCCA4026437E04EA9A5141138FE430243187DB4E34B4F09 E9B4A7B6A72F087B6EC21CDC122CD29A471C5441B6E7A07A72A41E294D9B46 0C254CEC846861CC1AFC98EE180CC63B3CCC5FB469DFDAF04884446E3A5D85 7FF8249DB38896961FA9BC6F84E569A080B22582B7BFF5A375EFC65B943ED7 4E66B6402D6AD807D0BC5C74AF6958A35B36D897FC6C11A50622C07C833499 2DD6391D7E04D913C93C68C65A928BBF90F8EAD70A70C2F1C493949C66F9AD 7849A50B53C09A14F7A277851558BBB265E78B26AC808CE5BB21F3806979C4 ECA92EC11957505D38D0F9756424EDE1189E909CB76913CCCE25115BA0ACAC 3EAE37F18B7E3743B45DCC454D3D35EDB1A3F3BA581C39A4553F0A835E540A 4427344F08FB14B2ACE0AA0EDDBB22EA751345AC6EC412C8164A215401AE15 C9C6C66E369E4C853B73FA6E974E1A6528272BE2F22785AF7345F505FD151A 9679FC80D74F0AFD379B7FEAC327577D501F410D3EEFE5A168C8C2F69DC704 7F77B16FFCD4D19A49F67C6B06B13779A56DDB6426E0C0030A1A2EC6854D1E CABE50491FF50D9FA91D2D5E6EFF9CB7D7E5AE2C439841C06EAB8F670B38B8 B910D14EFE8B42BECF6FCD26CB3E9A395497306AF73CF3EEB98094D69B71E4 19EACCE43902AB2FB56E21F7A95B22527F0E1D4958EFBA2F12AB8A133F3D84 6E5C0EF2998D0D4D445F66AA22D42953322E3F623D5363F8657DA5D45B5976 48ED05F913EF882A150FE058A290D4748E7A6E040CB6F8964283B6AFBF79A3 5AD2C9F739A1B354AAE0AC707D5DC33ABD70DE5A25C243E4936FA839D12D20 0BB97BFC41230A9D84A959905FFC815B0948F266E45222DD1C971B48BFC39F AACD0F7EA996936066690368FCFFC8665BCC95A93E5B6C00A2B7D8384E6B1C 35CA21C7FA54A7A029850F939BFB839AAF24AAA37B0262D7D238827BECE367 8701 >>>> Provide your personal ID in the email >>>> Warning! Do not DELETE or MODIFY any files, it can lead to recovery problems! >>>> Warning! If you do not pay the ransom we will attack your company repeatedly again!
URLs

http://ze677xuzard4lx4iul2yzf5ks4gqqzoulgj5u4n5n4bbbsxjbfr7eayd.onion

Signatures

  • Deletes shadow copies 2 TTPs

    Ransomware often targets backup files to inhibit system recovery.

    ransomware
  • Renames multiple (2364) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware
  • Modifies extensions of user files 12 IoCs

    Ransomware generally changes the extension on encrypted files.

    ransomware
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops desktop.ini file(s) 26 IoCs
  • Enumerates connected drives 3 TTPs 1 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Program Files directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Interacts with shadow copies 2 TTPs 1 IoCs

    Shadow copies are often targeted by ransomware to inhibit system recovery.

    ransomware
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\b95a4443bb8bff80d927ac551a9a5a5cfac3e3e03a5b5737c0e05c75f33ad61e.exe
    "C:\Users\Admin\AppData\Local\Temp\b95a4443bb8bff80d927ac551a9a5a5cfac3e3e03a5b5737c0e05c75f33ad61e.exe"
    1⤵
    • Modifies extensions of user files
    • Checks computer location settings
    • Drops desktop.ini file(s)
    • Enumerates connected drives
    • Drops file in Program Files directory
    • Suspicious use of WriteProcessMemory
    PID:4172
    • C:\Windows\system32\cmd.exe
      "C:\Windows\system32\cmd.exe" /c vssadmin.exe Delete Shadows /All /Quiet reg delete "HKEY_CURRENT_USER\Software\Microsoft\Terminal Server Client\Default" /va /f reg delete "HKEY_CURRENT_USER\Software\Microsoft\Terminal Server Client\Servers" /f reg add "HKEY_CURRENT_USER\Software\Microsoft\Terminal Server Client\Servers" cd %userprofile%\documents\ attrib Default.rdp -s -h del Default.rdp for /F "tokens=*" %1 in ('wevtutil.exe el') DO wevtutil.exe cl "%1"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:3712
      • C:\Windows\system32\vssadmin.exe
        vssadmin.exe Delete Shadows /All /Quiet
        3⤵
        • Interacts with shadow copies
        PID:1920
  • C:\Windows\system32\vssvc.exe
    C:\Windows\system32\vssvc.exe
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:4672

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\HOW_TO_RECOVERY_FILES.txt
    Filesize

    2KB

    MD5

    4b37a9a4dc92e314d17ddc259cdff1d0

    SHA1

    ee46c816d554d70b41f898dd234a7792bb1d875e

    SHA256

    89b950e80b574c7301bad54004c73a0ccfca60decc122070d77cb6dabfdc411b

    SHA512

    f4be6813ee168c96ebf72ef6dd3f8b722200a17b7783a60d330c285fc997595c3c4bc5bbe08a328a385ef4a519192012372e5c3809b0818a96905fa84da36cbe

    Download Submit

  • memory/4172-4158-0x0000000000400000-0x0000000000424000-memory.dmp

    Filesize

    144KB

    Download

  • memory/4172-8139-0x0000000000400000-0x0000000000424000-memory.dmp

    Filesize

    144KB

    Download