Overview

overview

10

Static

static

10

samples (2).zip

windows7-x64

1

samples (2).zip

windows10-2004-x64

1

04035f6fdd...f9.exe

windows7-x64

9

04035f6fdd...f9.exe

windows10-2004-x64

7

0ed3c87ce3...07.exe

windows7-x64

4

0ed3c87ce3...07.exe

windows10-2004-x64

1

1ce291b079...c9.exe

windows7-x64

7

1ce291b079...c9.exe

windows10-2004-x64

1

30e66f95b4...49.exe

windows7-x64

8

30e66f95b4...49.exe

windows10-2004-x64

8

335160bee7...cf.exe

windows7-x64

10

335160bee7...cf.exe

windows10-2004-x64

10

3d7dd597a4...67.exe

windows7-x64

1

3d7dd597a4...67.exe

windows10-2004-x64

7

42dcc46f9d...46.exe

windows7-x64

9

42dcc46f9d...46.exe

windows10-2004-x64

8

4fcaca23e9...f2.exe

windows7-x64

10

4fcaca23e9...f2.exe

windows10-2004-x64

10

5994300c1c...a7.exe

windows7-x64

10

5994300c1c...a7.exe

windows10-2004-x64

9

627a5569d4...e3.exe

windows7-x64

7

627a5569d4...e3.exe

windows10-2004-x64

10

kf12.pyc

windows7-x64

3

kf12.pyc

windows10-2004-x64

1

63fa775052...2f.exe

windows7-x64

1

63fa775052...2f.exe

windows10-2004-x64

1

645b8dfe73...79.exe

windows7-x64

1

645b8dfe73...79.exe

windows10-2004-x64

1

64862ec699...1b.exe

windows7-x64

9

64862ec699...1b.exe

windows10-2004-x64

10

741d75a02d...5e.exe

windows7-x64

10

741d75a02d...5e.exe

windows10-2004-x64

10

Resubmissions

18-04-2024 18:50

240418-xha8wabh29 10

01-01-2024 15:12

240101-slnwxsfeh4 10

Analysis

  • max time kernel
    125s
  • max time network
    176s
  • platform
    windows7_x64
  • resource
    win7-20231215-en
  • resource tags

    arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
  • submitted
    01-01-2024 15:12

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    5994300c1c7d099bec13d2a6aec942a6a866966e9545773d3fbe26cc5e308da7.exe

  • Size

    4.8MB

  • MD5

    5a3c5576c359ce4f40b3274209db2e76

  • SHA1

    8d38f1c0953013d623bea6d6f6f47d5a0c7027f9

  • SHA256

    5994300c1c7d099bec13d2a6aec942a6a866966e9545773d3fbe26cc5e308da7

  • SHA512

    a9780e15702531d22a7088bb1de49c083499244819732f07c7a1c22bea00aa3592231766adae42ea8f980896a659a46a51a58e4e366a35e327f9d788ff88e5eb

  • SSDEEP

    49152:Dc2Ee3ScTnrb/T5vO90dL3BmAFd4A64nsfJG0CJZGSUeU/o/ZsPfNW7Ew5EzUgr0:73l8ZSUOyaEUVHB72INLu6SZJZ

Score
10/10
ransomware

Malware Config

Extracted

Path

C:\MSOCache\All Users\{90140000-0019-0409-0000-0000000FF1CE}-C\HOW TO RESTORE YOUR HGJZITLXE FILES.TXT

Ransom Note
THE ENTIRE NETWORK IS ENCRYPTED YOUR BUSINESS IS LOSING MONEY! Dear Management! We inform you that your network has undergone a penetration test, during which we encrypted your files and downloaded more than 100GB of your data Personal data Marketing data Confidentional documents Accounting SQL Databases Copy of some mailboxes Important! Do not try to decrypt the files yourself or using third-party utilities. The only program that can decrypt them is our decryptor, which you can request from the contacts below. Any other program will only damage files in such a way that it will be impossible to restore them. Write to us directly, without resorting to intermediaries, they will deceive you. You can get all the necessary evidence, discuss with us possible solutions to this problem and request a decryptor by using the contacts below. Please be advised that if we don't receive a response from you within 3 days, we reserve the right to publish files to the public. Contact us: [email protected] or [email protected] Additional ways to communicate in tox chat tox id: 83E6E3CFEC0E4C8E7F7B6E01F6E86CF70AE8D4E75A59126A2C52FE9F568B4072CA78EF2B3C97

Signatures

  • Deletes shadow copies 2 TTPs

    Ransomware often targets backup files to inhibit system recovery.

    ransomware
  • Drops file in Program Files directory 64 IoCs
  • Launches sc.exe 1 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Delays execution with timeout.exe 1 IoCs
    evasion
  • Interacts with shadow copies 2 TTPs 3 IoCs

    Shadow copies are often targeted by ransomware to inhibit system recovery.

    ransomware
  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\5994300c1c7d099bec13d2a6aec942a6a866966e9545773d3fbe26cc5e308da7.exe
    "C:\Users\Admin\AppData\Local\Temp\5994300c1c7d099bec13d2a6aec942a6a866966e9545773d3fbe26cc5e308da7.exe"
    1⤵
    • Drops file in Program Files directory
    • Suspicious behavior: EnumeratesProcesses
    PID:2096
  • C:\Windows\system32\taskeng.exe
    taskeng.exe {052E2DE7-0F00-4255-AD55-63BD67F52C0B} S-1-5-18:NT AUTHORITY\System:Service:
    1⤵
      PID:1608
    • C:\Windows\system32\taskeng.exe
      taskeng.exe {8FC8DACE-4802-49F7-A121-2971C3E0C523} S-1-5-21-928733405-3780110381-2966456290-1000:VTILVGXH\Admin:Interactive:[1]
      1⤵
      • Suspicious use of WriteProcessMemory
      PID:1864
      • C:\Windows\SYSTEM32\cmd.exe
        C:\Windows\SYSTEM32\cmd.exe /c "c:\windows\temp\b.bat"
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:1832
        • C:\Windows\system32\sc.exe
          sc start vss
          3⤵
          • Launches sc.exe
          PID:2848
        • C:\Windows\system32\timeout.exe
          timeout /T 5
          3⤵
          • Delays execution with timeout.exe
          PID:1304
        • C:\Windows\system32\vssadmin.exe
          vssadmin Delete Shadows /all /quiet
          3⤵
          • Interacts with shadow copies
          PID:580
        • C:\Windows\System32\vssadmin.exe
          C:\Windows\System32\vssadmin.exe Delete Shadows /all /quiet
          3⤵
          • Interacts with shadow copies
          PID:1364
        • C:\Windows\SysWOW64\vssadmin.exe
          C:\Windows\SysWOW64\vssadmin.exe Delete Shadows /all /quiet
          3⤵
          • Interacts with shadow copies
          PID:1500
    • C:\Windows\system32\vssvc.exe
      C:\Windows\system32\vssvc.exe
      1⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:2428

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\MSOCache\All Users\{90140000-0019-0409-0000-0000000FF1CE}-C\HOW TO RESTORE YOUR HGJZITLXE FILES.TXT
      Filesize

      1KB

      MD5

      b0cfb42691ffe6a59d3b8143f9bfb7d5

      SHA1

      c5e4b7d8a892cdadbe8ffd4e1ba73b2f13e340f8

      SHA256

      f01f4211f4e14aa3cac54f331b4a56463651490d6c1c353b9d90f3250d193d82

      SHA512

      7a0574d7859cdfc022e00a829a8eb7ded4d8b0908f370924bb6bb2a0f8b1fd6416ad02920687f62c82692d303891e8d07cb74e645aecbcb9f91fd06ab661031c

      Download Submit

    • \??\c:\windows\temp\b.bat
      Filesize

      11KB

      MD5

      9ef680eda0e357dfcdfe9a7ddcd33514

      SHA1

      33a5a77eb9bb3be27b37fb8645fbe946b3f5f4ed

      SHA256

      dc98394f1189fd8ae45eec6e7302993b0cc2da4ab8855503ca6d76ed59b17692

      SHA512

      e3b3e595d760c13d5509ca8e621dc8bec36d705199effcc60b1c854d0f6ce17bc1eab26ea5704dba1d34a4e35c401cf22917deb088fce1e32403878ebc690293

      Download Submit