Resubmissions

21-01-2024 14:52

240121-r8syqaeac7 10

21-01-2024 14:51

240121-r8k8waeac5 10

01-01-2024 13:55

240101-q776kscacp 10

Analysis

  • max time kernel
    144s
  • max time network
    149s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    01-01-2024 13:55

General

  • Target

    365712147d687fb2eb2d5cb612586c7d3d7364277441491a3ab379a4a1128ba7.exe

  • Size

    450KB

  • MD5

    e70b33103c17c000ac11025d2d8e70a1

  • SHA1

    df898d9d0e8e6f2d4eb5d4742d4c206092cdcb34

  • SHA256

    365712147d687fb2eb2d5cb612586c7d3d7364277441491a3ab379a4a1128ba7

  • SHA512

    632461a9c6bff4e013cf3e77a7262d1daaa8775156c61c70dab685ae59114b22d00a47a0214204f6c514c6be77ad5b0c371a889076072fdb1eaf574cb6d4c42c

  • SSDEEP

    12288:krYn2GbqdcOuAKi1kcwyEOywAx1gT+yFCv6oE4E:kcNbqdFtVkcwyEOix1GtFCv6F4E

Score
10/10

Malware Config

Extracted

Path

C:\PerfLogs\readme.txt

Ransom Note
Dear user! Your computer is encrypted! We demand a ransom! Decryption service is paid !!!! PAYMENT FOR BITCOIN !!! To decrypt your computer, you need to download the TOR browser at https://www.torproject.org/download/ Install it and visit our website for further action http://paymen45oxzpnouz.onion/74129a02f1 Also from your servers files, documents, databases SQL, PDF were uploaded to our cloud storage After we agree, you will receive a decryption program, valuable advice in order not to fall into this situation in the future, as well as all your files on our server will be deleted. Otherwise, they will fall into the open access of the Internet! Use any third party software for restoring your data or antivirus solutions will result in a loose of data. Please be sure that we will find common languge. We will restore all the data and give you recommedations how to configure the protection of your server.
URLs

http://paymen45oxzpnouz.onion/74129a02f1

Signatures

  • Renames multiple (7147) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops desktop.ini file(s) 30 IoCs
  • Drops file in System32 directory 6 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 31 IoCs
  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Delays execution with timeout.exe 1 IoCs
  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies data under HKEY_USERS 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\365712147d687fb2eb2d5cb612586c7d3d7364277441491a3ab379a4a1128ba7.exe
    "C:\Users\Admin\AppData\Local\Temp\365712147d687fb2eb2d5cb612586c7d3d7364277441491a3ab379a4a1128ba7.exe"
    1⤵
    • Checks computer location settings
    • Drops desktop.ini file(s)
    • Drops file in Program Files directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:2148
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2148 -s 528
      2⤵
      • Program crash
      PID:404
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2148 -s 600
      2⤵
      • Program crash
      PID:3632
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2148 -s 676
      2⤵
      • Program crash
      PID:4860
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2148 -s 684
      2⤵
      • Program crash
      PID:4896
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2148 -s 712
      2⤵
      • Program crash
      PID:4520
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2148 -s 688
      2⤵
      • Program crash
      PID:4560
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2148 -s 676
      2⤵
      • Program crash
      PID:3908
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2148 -s 756
      2⤵
      • Program crash
      PID:5032
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2148 -s 776
      2⤵
      • Program crash
      PID:4444
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2148 -s 792
      2⤵
      • Program crash
      PID:4592
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2148 -s 784
      2⤵
      • Program crash
      PID:1472
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2148 -s 828
      2⤵
      • Program crash
      PID:6948
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2148 -s 836
      2⤵
      • Program crash
      PID:7892
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2148 -s 1000
      2⤵
      • Program crash
      PID:5604
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2148 -s 876
      2⤵
      • Program crash
      PID:7900
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2148 -s 988
      2⤵
      • Program crash
      PID:3872
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2148 -s 824
      2⤵
      • Program crash
      PID:6464
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2148 -s 932
      2⤵
      • Program crash
      PID:9108
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2148 -s 864
      2⤵
      • Program crash
      PID:2956
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2148 -s 932
      2⤵
      • Program crash
      PID:5964
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2148 -s 872
      2⤵
      • Program crash
      PID:6704
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2148 -s 808
      2⤵
      • Program crash
      PID:7648
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2148 -s 1016
      2⤵
      • Program crash
      PID:9564
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2148 -s 988
      2⤵
      • Program crash
      PID:7884
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2148 -s 668
      2⤵
      • Program crash
      PID:7080
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2148 -s 692
      2⤵
      • Program crash
      PID:5744
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2148 -s 928
      2⤵
      • Program crash
      PID:1172
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2148 -s 864
      2⤵
      • Program crash
      PID:5924
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2148 -s 864
      2⤵
      • Program crash
      PID:4952
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2148 -s 1048
      2⤵
      • Program crash
      PID:6780
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /c timeout 1 && del "C:\Users\Admin\AppData\Local\Temp\365712147d687fb2eb2d5cb612586c7d3d7364277441491a3ab379a4a1128ba7.exe" >> NUL
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:7892
      • C:\Windows\SysWOW64\timeout.exe
        timeout 1
        3⤵
        • Delays execution with timeout.exe
        PID:8556
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2148 -s 1148
      2⤵
      • Program crash
      PID:8564
  • C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe
    "C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service
    1⤵
    • Drops file in System32 directory
    • Checks processor information in registry
    • Enumerates system info in registry
    • Modifies data under HKEY_USERS
    • Suspicious use of SetWindowsHookEx
    PID:3488
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2148 -ip 2148
    1⤵
      PID:1904
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 2148 -ip 2148
      1⤵
        PID:4668
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 2148 -ip 2148
        1⤵
          PID:4908
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 2148 -ip 2148
          1⤵
            PID:4092
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 2148 -ip 2148
            1⤵
              PID:4692
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 2148 -ip 2148
              1⤵
                PID:2840
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 2148 -ip 2148
                1⤵
                  PID:4892
                • C:\Windows\SysWOW64\WerFault.exe
                  C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 2148 -ip 2148
                  1⤵
                    PID:3400
                  • C:\Windows\SysWOW64\WerFault.exe
                    C:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 2148 -ip 2148
                    1⤵
                      PID:4176
                    • C:\Windows\SysWOW64\WerFault.exe
                      C:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 2148 -ip 2148
                      1⤵
                        PID:4848
                      • C:\Windows\SysWOW64\WerFault.exe
                        C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 2148 -ip 2148
                        1⤵
                          PID:2132
                        • C:\Windows\SysWOW64\WerFault.exe
                          C:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 2148 -ip 2148
                          1⤵
                            PID:440
                          • C:\Windows\SysWOW64\WerFault.exe
                            C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 2148 -ip 2148
                            1⤵
                              PID:7804
                            • C:\Windows\SysWOW64\WerFault.exe
                              C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 2148 -ip 2148
                              1⤵
                                PID:4620
                              • C:\Windows\SysWOW64\WerFault.exe
                                C:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 2148 -ip 2148
                                1⤵
                                  PID:6000
                                • C:\Windows\SysWOW64\WerFault.exe
                                  C:\Windows\SysWOW64\WerFault.exe -pss -s 568 -p 2148 -ip 2148
                                  1⤵
                                    PID:8960
                                  • C:\Windows\SysWOW64\WerFault.exe
                                    C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 2148 -ip 2148
                                    1⤵
                                      PID:3504
                                    • C:\Windows\SysWOW64\WerFault.exe
                                      C:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 2148 -ip 2148
                                      1⤵
                                        PID:8204
                                      • C:\Windows\SysWOW64\WerFault.exe
                                        C:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 2148 -ip 2148
                                        1⤵
                                          PID:5832
                                        • C:\Windows\SysWOW64\WerFault.exe
                                          C:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 2148 -ip 2148
                                          1⤵
                                            PID:1112
                                          • C:\Windows\SysWOW64\WerFault.exe
                                            C:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 2148 -ip 2148
                                            1⤵
                                              PID:5168
                                            • C:\Windows\SysWOW64\WerFault.exe
                                              C:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 2148 -ip 2148
                                              1⤵
                                                PID:6016
                                              • C:\Windows\SysWOW64\WerFault.exe
                                                C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 2148 -ip 2148
                                                1⤵
                                                  PID:7356
                                                • C:\Windows\SysWOW64\WerFault.exe
                                                  C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 2148 -ip 2148
                                                  1⤵
                                                    PID:908
                                                  • C:\Windows\SysWOW64\WerFault.exe
                                                    C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 2148 -ip 2148
                                                    1⤵
                                                      PID:7140
                                                    • C:\Windows\SysWOW64\WerFault.exe
                                                      C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 2148 -ip 2148
                                                      1⤵
                                                        PID:3264
                                                      • C:\Windows\SysWOW64\WerFault.exe
                                                        C:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 2148 -ip 2148
                                                        1⤵
                                                          PID:10092
                                                        • C:\Windows\SysWOW64\WerFault.exe
                                                          C:\Windows\SysWOW64\WerFault.exe -pss -s 592 -p 2148 -ip 2148
                                                          1⤵
                                                            PID:7756
                                                          • C:\Windows\SysWOW64\WerFault.exe
                                                            C:\Windows\SysWOW64\WerFault.exe -pss -s 600 -p 2148 -ip 2148
                                                            1⤵
                                                              PID:7016
                                                            • C:\Windows\SysWOW64\WerFault.exe
                                                              C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 2148 -ip 2148
                                                              1⤵
                                                                PID:7284
                                                              • C:\Windows\SysWOW64\WerFault.exe
                                                                C:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 2148 -ip 2148
                                                                1⤵
                                                                  PID:4996

                                                                Network

                                                                MITRE ATT&CK Enterprise v15

                                                                Replay Monitor

                                                                Loading Replay Monitor...

                                                                Downloads

                                                                • C:\$Recycle.Bin\S-1-5-21-1232405761-1209240240-3206092754-1000\desktop.ini

                                                                  Filesize

                                                                  649B

                                                                  MD5

                                                                  606868bcfde3abbc6a1a79276a1d5a12

                                                                  SHA1

                                                                  bff2f1e9b572eeb594ecc8a4cc9557bfc9ea4b89

                                                                  SHA256

                                                                  000996b0ded3108a3645253ebf92d330212c715b0f93221e9f8139441a23c0b7

                                                                  SHA512

                                                                  0a5d6ac9e4fe3677b22f40c85325274253b0c57cbc99a89a1cdf0a0573aeda1a886783d70402a92406be017dec68c85aeae5396c6c35ab6ccaeb906660ee100b

                                                                • C:\PerfLogs\readme.txt

                                                                  Filesize

                                                                  1KB

                                                                  MD5

                                                                  36fa0fb05110af6c6f27315329990277

                                                                  SHA1

                                                                  b59aede34641266ff739f6cf6385acf7d17b58ad

                                                                  SHA256

                                                                  5983dd0a334682308c9e8404ef89a5b5c9ea4a1efe3cca9dcf95710d162922df

                                                                  SHA512

                                                                  cf178cbd03fa91b7a8ceb1dbc35f587d3fa6e95fef612187282204883932bb23f1da734489e8b53b34f59ffc4cd84a170462e3753a59226732d29f8c0b5fc675

                                                                • memory/2148-5-0x0000000000A10000-0x0000000000A11000-memory.dmp

                                                                  Filesize

                                                                  4KB

                                                                • memory/2148-1-0x0000000000640000-0x0000000000740000-memory.dmp

                                                                  Filesize

                                                                  1024KB

                                                                • memory/2148-4-0x00000000009C0000-0x0000000000A00000-memory.dmp

                                                                  Filesize

                                                                  256KB

                                                                • memory/2148-6-0x0000000000A00000-0x0000000000A01000-memory.dmp

                                                                  Filesize

                                                                  4KB

                                                                • memory/2148-8-0x00000000009C0000-0x0000000000A00000-memory.dmp

                                                                  Filesize

                                                                  256KB

                                                                • memory/2148-10-0x00000000022A0000-0x00000000022A1000-memory.dmp

                                                                  Filesize

                                                                  4KB

                                                                • memory/2148-9-0x00000000009C0000-0x0000000000A00000-memory.dmp

                                                                  Filesize

                                                                  256KB

                                                                • memory/2148-3-0x0000000000400000-0x00000000004DD000-memory.dmp

                                                                  Filesize

                                                                  884KB

                                                                • memory/2148-2-0x00000000005B0000-0x0000000000630000-memory.dmp

                                                                  Filesize

                                                                  512KB

                                                                • memory/2148-6161-0x0000000000400000-0x00000000004DD000-memory.dmp

                                                                  Filesize

                                                                  884KB

                                                                • memory/2148-17477-0x00000000009C0000-0x00000000009C1000-memory.dmp

                                                                  Filesize

                                                                  4KB

                                                                • memory/2148-17478-0x0000000000400000-0x00000000004DD000-memory.dmp

                                                                  Filesize

                                                                  884KB

                                                                • memory/2148-17480-0x00000000005B0000-0x0000000000630000-memory.dmp

                                                                  Filesize

                                                                  512KB