8ece3ce00a84b7365b96487f215cbbea379a8df57ed7c23a2add8758858fba6e

General

Target

NA_NA_38bb6d3370e91dexeexe_JC.exe
Size

122KB
MD5

38bb6d3370e91deee960c8aeb6b0a50e
SHA1

ba9e23c4f6e7435e90e92ffef836386053c04ca3
SHA256

8ece3ce00a84b7365b96487f215cbbea379a8df57ed7c23a2add8758858fba6e
SHA512

532b5f6d68b2526250d1c307cf265b84985ce4c4bc4b00a3c6c05edb051bcc6fa06b64c987de1279746a2c5d91c951aa6c4820546cf2985a1e6d608c0a011b22
SSDEEP

1536:hxOUyl20w8bVZQ40iMSO1fY+iUyQs2r8t5p1ySotICS4A6UdSJOfTo4QVvA3T2+g:hMhQNDEtb3AirfTz0vAVR/6

Score

10^/10

evasion persistence ransomware

Malware Config

Extracted

Path

C:\Users\54mvm1-readme.txt

Ransom Note

---=== Welcome. Again. ===--- We strongly encourage You to pay your attention to this message and read it to the end. All Your files are encrypted, and currently unavailable, now all files on your system has extension 54mvm1 Before that, all of your most important personal and business files were backed up to our secure offline storage. We took them for temporary storage - but we don't need your files and we are not personally interested in your business. Our encryption algorithm is the most technically difficult and max resistant to burglary. Only OUR specialists can decrypted your files without loss(!) Any attempts to decrypt files on your own lead to damage them beyond repair(!) Best way to you will be consent to negotiations and mutual agreement between us. To connect us you need to download TOR browser and follow the link to begin negotiations.(You can find full instructions below.) We are waiting You and ready to listen all your offers and discuss them. If You will ignore this letter - we will have to sell closed auction all yours private files, photoes, business correspondence, documents and business files + with our analysis of your work activity (weakness of your business, financial violations and the opportunity to profit from this information). It will offset our financial losses. Or we'll just put all your files in the public domain, where everyone can download and use them as they wish. * For TOR Browser http://dnpscnbaix6nkwvystl3yxglz7nteicqrou3t75tpcc5532cztc46qyd.onion/ We are known as "Sodinokibi (REvil) Ransomware". For example, this article: https://www.coveware.com/blog/2019/7/15/ransomware-amounts-rise-3x-in-q2-as-ryuk-amp-sodinokibi-spread You have a guarantee that your files will be returned 100 %. And remember, this is only business, nothing personal.. We have a concept of business honor, and we can promise something if we come to a mutual agreement: 1. We guarantee to decrypt all your files in the shortest possible time 2. We will delete all your files and forget about your company. 3. We will show your weaknesses in your networks. .-= INSTRUCTIONS TO CONNECT =-. How to get access on website? You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/EFB63750FC8B4188 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decoder.re/EFB63750FC8B4188 Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: phVm0knx4Hv6a6vrfY2vFasov3rubSAuv/Cr8SKf0Swb89JYskV3ZKkP+HoHJvze BTAckX4epikGU7qivv5qHdTSNhw19BfwTqr4wLTdhPLTCt1BcX03CE+LR00WXF9D cRMrUJ1A/7Hzut6VYINaSkvFAf8jIwzzuA/17ojGYMWam/KmOY9cCm1EHH2ht4B3 gUDnFjjypsCdyhAAu3WSWvRev+0rVU87jLN75+rK9Bqw6WlZ4ndprvGExHG5IcC/ qGozVIeeqec3AE5/pBK9yqdIfD5+HkpPQX4L8BVoofvSXjb98YwD4JglAO0ZXKeR dSgEHo360q+TdNggI3LCDoLnA0A2ElWhSH1Ldr1sTjNegGQfkgsAjmjfobba2BfW ZEH65+EJghdlQLmVLGUzacn/5WsdVoAah8lX8vndpOaUayCiPIGYXpY9L9foTvuZ utmuBFVFHjPjWRqzfdpwM7fQLcc6kEhGec5bx8LwN1EycKsj7plH3g0dSrERShY8 HLGLZqOSuOScMik6d5Kvc98QVizbS2DNqaYMaWSvyyzxVD5By3e/9oMeS+Yxnvz9 Uejqboaf89up75CLt1lc7xr7JOc70zd791yh7eaDJMwS+EvGBVvHSbpqXzN+PIxx 50N6Qd5N8FhY4yrSKJVsBeVP4hLZgg50jYqj+ExfWE87IGGTLEzT85v1rhldU5U0 Z1opZCjnL+iFSjx+r3JC59uNEHy21Rq368JCaIqaN68hW+eOjkSu36AfAAhKf2oF k+2YCwkhUAZEv627LXiPlIvYG7b4uKAeQhD0DQtxMFp5NoGuVatEjUOx4GI0DkbX wp8DI3vzFxdzaEDfGm8D9Rh0iwAbm00EBoyk/5Fy08SfbUFoJ1PM/pgvO8MGmAmr qjSeYgvHYry/WbWtV9GoLWqB0uwwvlxuetu1TlVE5ayHTV8GWQD4bvseRqmsNXbM nZ2jhJalt8hjr39q5v8FwVjf2OhkFf5V/x/ikW+YdCLmEC9kotDdZ33m8NsrwONE AMeHeYhmrZMTAJT4O7YwytscEbuUzw2/nO6wIH0CGZcegp0eGsu9R4hU5nCoFXYL pYyCPW6lG4pv5JvUwer4nTUr40UG8bMEyk/PoW7y1l34BNALP3z7vCOjTPYFfZpr 6lZMa9ewCwegESIuUKnWLnDavJQG2NvCWsYiEY9XSO//rEDqv0JqdNEhy0K/F8Pf pEYI2MEyHBd10MUTr4fzZ46K0a1LIpJDQ7K4VrjXSieyjSuOO2I2zINFiOQl8Jtd GOuGxnUosClY2eNZT1YJ/tbbuaumenVndUQA3tyYIYgfB9yfgJ78Y4o2dwbvB4Ol oAGzHO1d/iNcaJ8+nu7Mx6v3wDSSMw== ---------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all your data!

URLs

http://dnpscnbaix6nkwvystl3yxglz7nteicqrou3t75tpcc5532cztc46qyd.onion/

https://www.coveware.com/blog/2019/7/15/ransomware-amounts-rise-3x-in-q2-as-ryuk-amp-sodinokibi-spread

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/EFB63750FC8B4188

http://decoder.re/EFB63750FC8B4188

Signatures

Modifies Windows Firewall 1 TTPs 1 IoCs
evasion

Windows Service
T1543.003

Processes:

netsh.exe

pid process

2632 netsh.exe

pid	process
2632	netsh.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

NA_NA_38bb6d3370e91dexeexe_JC.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run	NA_NA_38bb6d3370e91dexeexe_JC.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\t32mMaunsR = "C:\\Users\\Admin\\AppData\\Local\\Temp\\NA_NA_38bb6d3370e91dexeexe_JC.exe"	NA_NA_38bb6d3370e91dexeexe_JC.exe

Enumerates connected drives 3 TTPs 25 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

NA_NA_38bb6d3370e91dexeexe_JC.exe

description	ioc	process
File opened (read-only)	\??\H:	NA_NA_38bb6d3370e91dexeexe_JC.exe
File opened (read-only)	\??\M:	NA_NA_38bb6d3370e91dexeexe_JC.exe
File opened (read-only)	\??\N:	NA_NA_38bb6d3370e91dexeexe_JC.exe
File opened (read-only)	\??\R:	NA_NA_38bb6d3370e91dexeexe_JC.exe
File opened (read-only)	\??\F:	NA_NA_38bb6d3370e91dexeexe_JC.exe
File opened (read-only)	\??\D:	NA_NA_38bb6d3370e91dexeexe_JC.exe
File opened (read-only)	\??\E:	NA_NA_38bb6d3370e91dexeexe_JC.exe
File opened (read-only)	\??\I:	NA_NA_38bb6d3370e91dexeexe_JC.exe
File opened (read-only)	\??\J:	NA_NA_38bb6d3370e91dexeexe_JC.exe
File opened (read-only)	\??\O:	NA_NA_38bb6d3370e91dexeexe_JC.exe
File opened (read-only)	\??\Z:	NA_NA_38bb6d3370e91dexeexe_JC.exe
File opened (read-only)	\??\V:	NA_NA_38bb6d3370e91dexeexe_JC.exe
File opened (read-only)	\??\Y:	NA_NA_38bb6d3370e91dexeexe_JC.exe
File opened (read-only)	\??\B:	NA_NA_38bb6d3370e91dexeexe_JC.exe
File opened (read-only)	\??\K:	NA_NA_38bb6d3370e91dexeexe_JC.exe
File opened (read-only)	\??\P:	NA_NA_38bb6d3370e91dexeexe_JC.exe
File opened (read-only)	\??\Q:	NA_NA_38bb6d3370e91dexeexe_JC.exe
File opened (read-only)	\??\T:	NA_NA_38bb6d3370e91dexeexe_JC.exe
File opened (read-only)	\??\W:	NA_NA_38bb6d3370e91dexeexe_JC.exe
File opened (read-only)	\??\X:	NA_NA_38bb6d3370e91dexeexe_JC.exe
File opened (read-only)	\??\A:	NA_NA_38bb6d3370e91dexeexe_JC.exe
File opened (read-only)	\??\G:	NA_NA_38bb6d3370e91dexeexe_JC.exe
File opened (read-only)	\??\L:	NA_NA_38bb6d3370e91dexeexe_JC.exe
File opened (read-only)	\??\S:	NA_NA_38bb6d3370e91dexeexe_JC.exe
File opened (read-only)	\??\U:	NA_NA_38bb6d3370e91dexeexe_JC.exe

Sets desktop wallpaper using registry 2 TTPs 1 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

Processes:

NA_NA_38bb6d3370e91dexeexe_JC.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-1014134971-2480516131-292343513-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\531692dc5pf.bmp"	NA_NA_38bb6d3370e91dexeexe_JC.exe

Drops file in Program Files directory 39 IoCs

Processes:

NA_NA_38bb6d3370e91dexeexe_JC.exe

description	ioc	process
File created	\??\c:\program files (x86)\microsoft sql server compact edition\v3.5\desktop\54mvm1-readme.txt	NA_NA_38bb6d3370e91dexeexe_JC.exe
File opened for modification	\??\c:\program files\EnableCheckpoint.xhtml	NA_NA_38bb6d3370e91dexeexe_JC.exe
File opened for modification	\??\c:\program files\MeasureConvert.vssx	NA_NA_38bb6d3370e91dexeexe_JC.exe
File opened for modification	\??\c:\program files\ReadSubmit.ppsm	NA_NA_38bb6d3370e91dexeexe_JC.exe
File created	\??\c:\program files (x86)\microsoft sql server compact edition\54mvm1-readme.txt	NA_NA_38bb6d3370e91dexeexe_JC.exe
File created	\??\c:\program files (x86)\microsoft sql server compact edition\tmp	NA_NA_38bb6d3370e91dexeexe_JC.exe
File created	\??\c:\program files (x86)\microsoft sql server compact edition\v3.5\desktop\tmp	NA_NA_38bb6d3370e91dexeexe_JC.exe
File opened for modification	\??\c:\program files\DisableRemove.au	NA_NA_38bb6d3370e91dexeexe_JC.exe
File opened for modification	\??\c:\program files\MountEdit.mp2v	NA_NA_38bb6d3370e91dexeexe_JC.exe
File opened for modification	\??\c:\program files\ResetReceive.docx	NA_NA_38bb6d3370e91dexeexe_JC.exe
File opened for modification	\??\c:\program files\WriteMove.xltx	NA_NA_38bb6d3370e91dexeexe_JC.exe
File created	\??\c:\program files (x86)\microsoft sql server compact edition\v3.5\tmp	NA_NA_38bb6d3370e91dexeexe_JC.exe
File created	\??\c:\program files (x86)\microsoft sql server compact edition\v3.5\54mvm1-readme.txt	NA_NA_38bb6d3370e91dexeexe_JC.exe
File created	\??\c:\program files (x86)\54mvm1-readme.txt	NA_NA_38bb6d3370e91dexeexe_JC.exe
File opened for modification	\??\c:\program files\CloseRegister.tmp	NA_NA_38bb6d3370e91dexeexe_JC.exe
File opened for modification	\??\c:\program files\UnprotectSend.js	NA_NA_38bb6d3370e91dexeexe_JC.exe
File opened for modification	\??\c:\program files\WriteStop.xlsm	NA_NA_38bb6d3370e91dexeexe_JC.exe
File opened for modification	\??\c:\program files\PopDeny.mp2	NA_NA_38bb6d3370e91dexeexe_JC.exe
File opened for modification	\??\c:\program files\PopDisable.mp3	NA_NA_38bb6d3370e91dexeexe_JC.exe
File opened for modification	\??\c:\program files\RenameComplete.jpeg	NA_NA_38bb6d3370e91dexeexe_JC.exe
File opened for modification	\??\c:\program files\TestClear.mpv2	NA_NA_38bb6d3370e91dexeexe_JC.exe
File created	\??\c:\program files\54mvm1-readme.txt	NA_NA_38bb6d3370e91dexeexe_JC.exe
File opened for modification	\??\c:\program files\FindEdit.vdw	NA_NA_38bb6d3370e91dexeexe_JC.exe
File opened for modification	\??\c:\program files\InitializeAssert.mhtml	NA_NA_38bb6d3370e91dexeexe_JC.exe
File opened for modification	\??\c:\program files\JoinFind.midi	NA_NA_38bb6d3370e91dexeexe_JC.exe
File opened for modification	\??\c:\program files\AssertRestart.svgz	NA_NA_38bb6d3370e91dexeexe_JC.exe
File opened for modification	\??\c:\program files\CopyBackup.DVR	NA_NA_38bb6d3370e91dexeexe_JC.exe
File opened for modification	\??\c:\program files\DisconnectProtect.reg	NA_NA_38bb6d3370e91dexeexe_JC.exe
File opened for modification	\??\c:\program files\PublishResolve.mp4v	NA_NA_38bb6d3370e91dexeexe_JC.exe
File opened for modification	\??\c:\program files\DisableSuspend.odp	NA_NA_38bb6d3370e91dexeexe_JC.exe
File opened for modification	\??\c:\program files\PopPush.avi	NA_NA_38bb6d3370e91dexeexe_JC.exe
File opened for modification	\??\c:\program files\ResolveNew.dot	NA_NA_38bb6d3370e91dexeexe_JC.exe
File opened for modification	\??\c:\program files\SuspendUndo.vsdx	NA_NA_38bb6d3370e91dexeexe_JC.exe
File created	\??\c:\program files\tmp	NA_NA_38bb6d3370e91dexeexe_JC.exe
File created	\??\c:\program files (x86)\tmp	NA_NA_38bb6d3370e91dexeexe_JC.exe
File opened for modification	\??\c:\program files\RestartRead.m1v	NA_NA_38bb6d3370e91dexeexe_JC.exe
File opened for modification	\??\c:\program files\SelectApprove.M2V	NA_NA_38bb6d3370e91dexeexe_JC.exe
File opened for modification	\??\c:\program files\DisableConvertTo.scf	NA_NA_38bb6d3370e91dexeexe_JC.exe
File opened for modification	\??\c:\program files\SubmitDeny.vbs	NA_NA_38bb6d3370e91dexeexe_JC.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies system certificate store 2 TTPs 4 IoCs

evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

Processes:

NA_NA_38bb6d3370e91dexeexe_JC.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8	NA_NA_38bb6d3370e91dexeexe_JC.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 0400000001000000100000000cd2f9e0da1773e9ed864da5e370e74e14000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e80f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f631900000001000000100000002fe1f70bb05d7c92335bc5e05b984da620000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827	NA_NA_38bb6d3370e91dexeexe_JC.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13	NA_NA_38bb6d3370e91dexeexe_JC.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13\Blob = 430000000100000000000000040000000100000010000000410352dc0ff7501b16f0028eba6f45c50f00000001000000140000005bcaa1c2780f0bcb5a90770451d96f38963f012d1900000001000000100000006cf252fec3e8f20996de5d4dd9aef424030000000100000014000000dac9024f54d8f6df94935fb1732638ca6ad77c131d00000001000000100000004558d512eecb27464920897de7b66053140000000100000014000000c4a7b1a47b2c71fadbe14b9075ffc41560858910090000000100000016000000301406082b0601050507030406082b060105050703010b000000010000001e000000440053005400200052006f006f007400200043004100200058003300000020000000010000004e0300003082034a30820232a003020102021044afb080d6a327ba893039862ef8406b300d06092a864886f70d0101050500303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f74204341205833301e170d3030303933303231313231395a170d3231303933303134303131355a303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f7420434120583330820122300d06092a864886f70d01010105000382010f003082010a0282010100dfafe99750088357b4cc6265f69082ecc7d32c6b30ca5becd9c37dc740c118148be0e83376492ae33f214993ac4e0eaf3e48cb65eefcd3210f65d22ad9328f8ce5f777b0127bb595c089a3a9baed732e7a0c063283a27e8a1430cd11a0e12a38b9790a31fd50bd8065dfb7516383c8e28861ea4b6181ec526bb9a2e24b1a289f48a39e0cda098e3e172e1edd20df5bc62a8aab2ebd70adc50b1a25907472c57b6aab34d63089ffe568137b540bc8d6aeec5a9c921e3d64b38cc6dfbfc94170ec1672d526ec38553943d0fcfd185c40f197ebd59a9b8d1dbada25b9c6d8dfc115023aabda6ef13e2ef55c089c3cd68369e4109b192ab62957e3e53d9b9ff0025d0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e04160414c4a7b1a47b2c71fadbe14b9075ffc41560858910300d06092a864886f70d01010505000382010100a31a2c9b17005ca91eee2866373abf83c73f4bc309a095205de3d95944d23e0d3ebd8a4ba0741fce10829c741a1d7e981addcb134bb32044e491e9ccfc7da5db6ae5fee6fde04eddb7003ab57049aff2e5eb02f1d1028b19cb943a5e48c4181e58195f1e025af00cf1b1ada9dc59868b6ee991f586cafab96633aa595bcee2a7167347cb2bcc99b03748cfe3564bf5cf0f0c723287c6f044bb53726d43f526489a5267b758abfe67767178db0da256141339243185a2a8025a3047e1dd5007bc02099000eb6463609b16bc88c912e6d27d918bf93d328d65b4e97cb15776eac5b62839bf15651cc8f677966a0a8d770bd8910b048e07db29b60aee9d82353510	NA_NA_38bb6d3370e91dexeexe_JC.exe

Suspicious behavior: EnumeratesProcesses 5 IoCs

Processes:

NA_NA_38bb6d3370e91dexeexe_JC.exe

pid	process
2212	NA_NA_38bb6d3370e91dexeexe_JC.exe
2212	NA_NA_38bb6d3370e91dexeexe_JC.exe
2212	NA_NA_38bb6d3370e91dexeexe_JC.exe
2212	NA_NA_38bb6d3370e91dexeexe_JC.exe
2212	NA_NA_38bb6d3370e91dexeexe_JC.exe

Suspicious use of AdjustPrivilegeToken 14 IoCs

Processes:

NA_NA_38bb6d3370e91dexeexe_JC.exevssvc.exevssvc.exevssvc.exevssvc.exe

description	pid	process
Token: SeDebugPrivilege	2212	NA_NA_38bb6d3370e91dexeexe_JC.exe
Token: SeTakeOwnershipPrivilege	2212	NA_NA_38bb6d3370e91dexeexe_JC.exe
Token: SeBackupPrivilege	512	vssvc.exe
Token: SeRestorePrivilege	512	vssvc.exe
Token: SeAuditPrivilege	512	vssvc.exe
Token: SeBackupPrivilege	3016	vssvc.exe
Token: SeRestorePrivilege	3016	vssvc.exe
Token: SeAuditPrivilege	3016	vssvc.exe
Token: SeBackupPrivilege	2580	vssvc.exe
Token: SeRestorePrivilege	2580	vssvc.exe
Token: SeAuditPrivilege	2580	vssvc.exe
Token: SeBackupPrivilege	2336	vssvc.exe
Token: SeRestorePrivilege	2336	vssvc.exe
Token: SeAuditPrivilege	2336	vssvc.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

NA_NA_38bb6d3370e91dexeexe_JC.exe

description	pid	process	target process
PID 2212 wrote to memory of 2632	2212	NA_NA_38bb6d3370e91dexeexe_JC.exe	netsh.exe
PID 2212 wrote to memory of 2632	2212	NA_NA_38bb6d3370e91dexeexe_JC.exe	netsh.exe
PID 2212 wrote to memory of 2632	2212	NA_NA_38bb6d3370e91dexeexe_JC.exe	netsh.exe
PID 2212 wrote to memory of 2632	2212	NA_NA_38bb6d3370e91dexeexe_JC.exe	netsh.exe

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\NA_NA_38bb6d3370e91dexeexe_JC.exe
"C:\Users\Admin\AppData\Local\Temp\NA_NA_38bb6d3370e91dexeexe_JC.exe"
1⤵
- Adds Run key to start application
- Enumerates connected drives
- Sets desktop wallpaper using registry
- Drops file in Program Files directory
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2212

C:\Windows\SysWOW64\netsh.exe
netsh advfirewall firewall set rule group="Network Discovery" new enable=Yes
2⤵
- Modifies Windows Firewall
PID:2632

C:\Windows\system32\wbem\unsecapp.exe
C:\Windows\system32\wbem\unsecapp.exe -Embedding
1⤵
PID:2184

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:512

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3016

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2580

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2336

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

3

T1112

Subvert Trust Controls

1

T1553

Install Root Certificate

1

T1553.004

Credential Access

Discovery

Query Registry

1

T1012

Peripheral Device Discovery

1

T1120

System Information Discovery

2

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Defacement

1

T1491

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\54mvm1-readme.txt
Filesize
9KB

MD5
41916c891ae0bf515bc334c582494d97

SHA1
88be8a09d32823c99e4f79f3a0fb21f03fc7f6d2

SHA256
517ad23528f39854fd082fbea8a898caab5f3c8af4b20cb5da8d359081319793

SHA512
29a7783151957e1f9521a1f93fc120e23e7282f89903b193882040e447be990a1536098bd3b2c35e6d3fbc997d525d5db1066c8fa6adacf633c591d943cc9874

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
304B

MD5
e4667641dc8c6039a3c1a22751bf37af

SHA1
34caa79a9f74565402934cb67251cb8b26914a70

SHA256
53c1314230be63ce5ab6cbbb4de6ddebcba6ebb3129c644cd5925566315d9b9f

SHA512
8327f4b6cbcfbfa43940fbdbfa0bc37728616d99029e5b4c08c491c1f45467c3b7e63e5ee4569339bedac0f20fefb6cfc4fb84a1e40e32aa696ecdb5310244f9

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab4B4.tmp
Filesize
62KB

MD5
3ac860860707baaf32469fa7cc7c0192

SHA1
c33c2acdaba0e6fa41fd2f00f186804722477639

SHA256
d015145d551ecd14916270efad773bbc9fd57fad2228d2c24559f696c961d904

SHA512
d62ad2408c969a95550fb87efda50f988770ba5e39972041bf85924275baf156b8bec309ecc6409e5acdd37ec175dea40eff921ab58933b5b5b5d35a6147567c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar4E6.tmp
Filesize
164KB

MD5
4ff65ad929cd9a367680e0e5b1c08166

SHA1
c0af0d4396bd1f15c45f39d3b849ba444233b3a2

SHA256
c8733c93cc5aaf5ca206d06af22ee8dbdec764fb5085019a6a9181feb9dfdee6

SHA512
f530dc0d024a5a3b8903ffaaa41b608a5ccdd6da4ba1949f2c2e55a9fca475fec5c8d2119b5763cabe7ef1c3788fb9dcac621869db51d65b1d83cfe404fb4c27

Download Submit
\??\PIPE\samr
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads