Resubmissions

21-01-2024 14:52

240121-r8syqaeac7 10

21-01-2024 14:51

240121-r8k8waeac5 10

01-01-2024 13:55

240101-q776kscacp 10

Analysis

  • max time kernel
    150s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    01-01-2024 13:55

General

  • Target

    59c59ef90d1370297375d4e3195eabe2a031251bc939fae962a835d8336a8a4d.exe

  • Size

    477KB

  • MD5

    ebbb782bafaa3ab64a3e4b006a698fe0

  • SHA1

    2800cd4dd62ba63f38d0452bf80cb35b4359a3dd

  • SHA256

    59c59ef90d1370297375d4e3195eabe2a031251bc939fae962a835d8336a8a4d

  • SHA512

    cd6681d7987901eb27064c4a833052abccef60383f9b0e53360ae9e3e66a19d0d0405bdeb5a609c7d668aa8720eb49f5fc3f060920ec042ec6584eebfd9f09ae

  • SSDEEP

    6144:ko4FuDncVzUJOH5bpX3Q92J6fHgaEFx9BQOJvZTsMJfOg2lOMxPEiarVb0J0:kzuwVzUW5bN3Y6LmO13Gg2IMyxrt0u

Score
10/10

Malware Config

Extracted

Path

C:\PerfLogs\readme.txt

Ransom Note
Dear user! Your computer is encrypted! We demand a ransom! Decryption service is paid !!!! PAYMENT FOR BITCOIN !!! To decrypt your computer, you need to download the TOR browser at https://www.torproject.org/download/ Install it and visit our website for further action http://paymen45oxzpnouz.onion/f9c90a087d Also from your servers files, documents, databases SQL, PDF were uploaded to our cloud storage After we agree, you will receive a decryption program, valuable advice in order not to fall into this situation in the future, as well as all your files on our server will be deleted. Otherwise, they will fall into the open access of the Internet! Use any third party software for restoring your data or antivirus solutions will result in a loose of data. Please be sure that we will find common languge. We will restore all the data and give you recommedations how to configure the protection of your server.
URLs

http://paymen45oxzpnouz.onion/f9c90a087d

Signatures

  • Renames multiple (7191) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops desktop.ini file(s) 30 IoCs
  • Drops file in System32 directory 6 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 31 IoCs
  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Delays execution with timeout.exe 1 IoCs
  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies data under HKEY_USERS 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\59c59ef90d1370297375d4e3195eabe2a031251bc939fae962a835d8336a8a4d.exe
    "C:\Users\Admin\AppData\Local\Temp\59c59ef90d1370297375d4e3195eabe2a031251bc939fae962a835d8336a8a4d.exe"
    1⤵
    • Checks computer location settings
    • Drops desktop.ini file(s)
    • Drops file in Program Files directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:448
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 448 -s 544
      2⤵
      • Program crash
      PID:4920
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 448 -s 632
      2⤵
      • Program crash
      PID:4548
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 448 -s 704
      2⤵
      • Program crash
      PID:208
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 448 -s 620
      2⤵
      • Program crash
      PID:3524
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 448 -s 708
      2⤵
      • Program crash
      PID:3504
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 448 -s 704
      2⤵
      • Program crash
      PID:3684
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 448 -s 644
      2⤵
      • Program crash
      PID:3472
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 448 -s 720
      2⤵
      • Program crash
      PID:4124
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 448 -s 620
      2⤵
      • Program crash
      PID:3660
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 448 -s 756
      2⤵
      • Program crash
      PID:4564
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 448 -s 768
      2⤵
      • Program crash
      PID:2012
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 448 -s 796
      2⤵
      • Program crash
      PID:2656
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 448 -s 828
      2⤵
      • Program crash
      PID:5164
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 448 -s 836
      2⤵
      • Program crash
      PID:5368
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 448 -s 904
      2⤵
      • Program crash
      PID:6136
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 448 -s 776
      2⤵
      • Program crash
      PID:7964
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 448 -s 692
      2⤵
      • Program crash
      PID:4728
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 448 -s 824
      2⤵
      • Program crash
      PID:6720
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 448 -s 836
      2⤵
      • Program crash
      PID:7516
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 448 -s 932
      2⤵
      • Program crash
      PID:5328
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 448 -s 980
      2⤵
      • Program crash
      PID:9692
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 448 -s 692
      2⤵
      • Program crash
      PID:10304
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 448 -s 772
      2⤵
      • Program crash
      PID:10352
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 448 -s 892
      2⤵
      • Program crash
      PID:10404
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 448 -s 984
      2⤵
      • Program crash
      PID:8268
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 448 -s 760
      2⤵
      • Program crash
      PID:9520
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 448 -s 756
      2⤵
      • Program crash
      PID:6528
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 448 -s 756
      2⤵
      • Program crash
      PID:5392
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 448 -s 760
      2⤵
      • Program crash
      PID:6348
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 448 -s 1044
      2⤵
      • Program crash
      PID:6228
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /c timeout 1 && del "C:\Users\Admin\AppData\Local\Temp\59c59ef90d1370297375d4e3195eabe2a031251bc939fae962a835d8336a8a4d.exe" >> NUL
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:6496
      • C:\Windows\SysWOW64\timeout.exe
        timeout 1
        3⤵
        • Delays execution with timeout.exe
        PID:5116
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 448 -s 1076
      2⤵
      • Program crash
      PID:9928
  • C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe
    "C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service
    1⤵
    • Drops file in System32 directory
    • Checks processor information in registry
    • Enumerates system info in registry
    • Modifies data under HKEY_USERS
    • Suspicious use of SetWindowsHookEx
    PID:4980
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 448 -ip 448
    1⤵
      PID:3296
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 448 -ip 448
      1⤵
        PID:4624
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 448 -ip 448
        1⤵
          PID:3604
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 448 -ip 448
          1⤵
            PID:1516
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 448 -ip 448
            1⤵
              PID:4452
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 448 -ip 448
              1⤵
                PID:1648
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 448 -ip 448
                1⤵
                  PID:1972
                • C:\Windows\SysWOW64\WerFault.exe
                  C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 448 -ip 448
                  1⤵
                    PID:2104
                  • C:\Windows\SysWOW64\WerFault.exe
                    C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 448 -ip 448
                    1⤵
                      PID:4836
                    • C:\Windows\SysWOW64\WerFault.exe
                      C:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 448 -ip 448
                      1⤵
                        PID:3376
                      • C:\Windows\SysWOW64\WerFault.exe
                        C:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 448 -ip 448
                        1⤵
                          PID:4432
                        • C:\Windows\SysWOW64\WerFault.exe
                          C:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 448 -ip 448
                          1⤵
                            PID:4644
                          • C:\Windows\SysWOW64\WerFault.exe
                            C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 448 -ip 448
                            1⤵
                              PID:2016
                            • C:\Windows\SysWOW64\WerFault.exe
                              C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 448 -ip 448
                              1⤵
                                PID:6820
                              • C:\Windows\SysWOW64\WerFault.exe
                                C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 448 -ip 448
                                1⤵
                                  PID:6320
                                • C:\Windows\SysWOW64\WerFault.exe
                                  C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 448 -ip 448
                                  1⤵
                                    PID:5212
                                  • C:\Windows\SysWOW64\WerFault.exe
                                    C:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 448 -ip 448
                                    1⤵
                                      PID:5684
                                    • C:\Windows\SysWOW64\WerFault.exe
                                      C:\Windows\SysWOW64\WerFault.exe -pss -s 572 -p 448 -ip 448
                                      1⤵
                                        PID:6820
                                      • C:\Windows\SysWOW64\WerFault.exe
                                        C:\Windows\SysWOW64\WerFault.exe -pss -s 600 -p 448 -ip 448
                                        1⤵
                                          PID:6380
                                        • C:\Windows\SysWOW64\WerFault.exe
                                          C:\Windows\SysWOW64\WerFault.exe -pss -s 608 -p 448 -ip 448
                                          1⤵
                                            PID:7496
                                          • C:\Windows\SysWOW64\WerFault.exe
                                            C:\Windows\SysWOW64\WerFault.exe -pss -s 620 -p 448 -ip 448
                                            1⤵
                                              PID:10036
                                            • C:\Windows\SysWOW64\WerFault.exe
                                              C:\Windows\SysWOW64\WerFault.exe -pss -s 588 -p 448 -ip 448
                                              1⤵
                                                PID:10288
                                              • C:\Windows\SysWOW64\WerFault.exe
                                                C:\Windows\SysWOW64\WerFault.exe -pss -s 620 -p 448 -ip 448
                                                1⤵
                                                  PID:10332
                                                • C:\Windows\SysWOW64\WerFault.exe
                                                  C:\Windows\SysWOW64\WerFault.exe -pss -s 600 -p 448 -ip 448
                                                  1⤵
                                                    PID:10384
                                                  • C:\Windows\SysWOW64\WerFault.exe
                                                    C:\Windows\SysWOW64\WerFault.exe -pss -s 608 -p 448 -ip 448
                                                    1⤵
                                                      PID:9952
                                                    • C:\Windows\SysWOW64\WerFault.exe
                                                      C:\Windows\SysWOW64\WerFault.exe -pss -s 600 -p 448 -ip 448
                                                      1⤵
                                                        PID:10452
                                                      • C:\Windows\SysWOW64\WerFault.exe
                                                        C:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 448 -ip 448
                                                        1⤵
                                                          PID:9136
                                                        • C:\Windows\SysWOW64\WerFault.exe
                                                          C:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 448 -ip 448
                                                          1⤵
                                                            PID:6712
                                                          • C:\Windows\SysWOW64\WerFault.exe
                                                            C:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 448 -ip 448
                                                            1⤵
                                                              PID:7464
                                                            • C:\Windows\SysWOW64\WerFault.exe
                                                              C:\Windows\SysWOW64\WerFault.exe -pss -s 616 -p 448 -ip 448
                                                              1⤵
                                                                PID:7696
                                                              • C:\Windows\SysWOW64\WerFault.exe
                                                                C:\Windows\SysWOW64\WerFault.exe -pss -s 592 -p 448 -ip 448
                                                                1⤵
                                                                  PID:7284

                                                                Network

                                                                MITRE ATT&CK Enterprise v15

                                                                Replay Monitor

                                                                Loading Replay Monitor...

                                                                Downloads

                                                                • C:\$Recycle.Bin\S-1-5-21-1497073144-2389943819-3385106915-1000\desktop.ini

                                                                  Filesize

                                                                  649B

                                                                  MD5

                                                                  a17c03c78b99500037d98e93555bfa34

                                                                  SHA1

                                                                  59aee02e238baa4fd8d9cad10c1e3f9c4167f91c

                                                                  SHA256

                                                                  411b3adb44c19ea9e2e915d39fcf77d22239055215466b6d420c426f7b99e5ba

                                                                  SHA512

                                                                  27e1e9a15893af692a295c52ad40b6be39520e40088dda904a3a08874d5d83e7303460119b2a7499adfce0f92bcda3509a286d1ae62e64da236680cd91ba0dd9

                                                                • C:\PerfLogs\readme.txt

                                                                  Filesize

                                                                  1KB

                                                                  MD5

                                                                  936089eb989b5e6470dfc1f7cef10ca9

                                                                  SHA1

                                                                  d53b07660436b8bfab19dd7030e352d0801cf288

                                                                  SHA256

                                                                  941a7ecc23a679b80be374bdbd960faa6dbe4f2383fedc4d06605d46d57c6027

                                                                  SHA512

                                                                  aae251ce1d4f2b50c3a09558c9dd543120c3b168dbb1f228928d18cf5fce35d640165ce479128c4e5fe0bb688aaab47b29ff1ccdcc017b9aecb03caac5f93012

                                                                • memory/448-8-0x00000000005F0000-0x00000000005F1000-memory.dmp

                                                                  Filesize

                                                                  4KB

                                                                • memory/448-4-0x0000000000400000-0x00000000004E3000-memory.dmp

                                                                  Filesize

                                                                  908KB

                                                                • memory/448-5-0x00000000005C0000-0x00000000005C1000-memory.dmp

                                                                  Filesize

                                                                  4KB

                                                                • memory/448-7-0x00000000005F0000-0x00000000005F1000-memory.dmp

                                                                  Filesize

                                                                  4KB

                                                                • memory/448-1-0x0000000000840000-0x0000000000940000-memory.dmp

                                                                  Filesize

                                                                  1024KB

                                                                • memory/448-3-0x00000000005C0000-0x00000000005C1000-memory.dmp

                                                                  Filesize

                                                                  4KB

                                                                • memory/448-2-0x0000000000660000-0x00000000006E0000-memory.dmp

                                                                  Filesize

                                                                  512KB

                                                                • memory/448-16908-0x0000000000400000-0x00000000004E3000-memory.dmp

                                                                  Filesize

                                                                  908KB

                                                                • memory/448-17561-0x00000000005C0000-0x00000000005C1000-memory.dmp

                                                                  Filesize

                                                                  4KB

                                                                • memory/448-17562-0x0000000000400000-0x00000000004E3000-memory.dmp

                                                                  Filesize

                                                                  908KB

                                                                • memory/448-17564-0x0000000000660000-0x00000000006E0000-memory.dmp

                                                                  Filesize

                                                                  512KB