ee65e9d7a7bc9d17e894e0b775fc0bbfb35e72c65c3d768e34bfe059d521cc16

Resubmissions

21-01-2024 14:52

240121-r8syqaeac7 10

21-01-2024 14:51

240121-r8k8waeac5 10

01-01-2024 13:55

240101-q776kscacp 10

Analysis

max time kernel
118s
max time network
122s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
21-01-2024 14:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

365712147d687fb2eb2d5cb612586c7d3d7364277441491a3ab379a4a1128ba7.exe
Size

450KB
MD5

e70b33103c17c000ac11025d2d8e70a1
SHA1

df898d9d0e8e6f2d4eb5d4742d4c206092cdcb34
SHA256

365712147d687fb2eb2d5cb612586c7d3d7364277441491a3ab379a4a1128ba7
SHA512

632461a9c6bff4e013cf3e77a7262d1daaa8775156c61c70dab685ae59114b22d00a47a0214204f6c514c6be77ad5b0c371a889076072fdb1eaf574cb6d4c42c
SSDEEP

12288:krYn2GbqdcOuAKi1kcwyEOywAx1gT+yFCv6oE4E:kcNbqdFtVkcwyEOix1GtFCv6F4E

Score

10^/10

ransomware

Malware Config

Extracted

Path

C:\$Recycle.Bin\S-1-5-21-3470981204-343661084-3367201002-1000\readme.txt

Ransom Note

Dear user! Your computer is encrypted! We demand a ransom! Decryption service is paid !!!! PAYMENT FOR BITCOIN !!! To decrypt your computer, you need to download the TOR browser at https://www.torproject.org/download/ Install it and visit our website for further action http://paymen45oxzpnouz.onion/5e1a7c2620 Also from your servers files, documents, databases SQL, PDF were uploaded to our cloud storage After we agree, you will receive a decryption program, valuable advice in order not to fall into this situation in the future, as well as all your files on our server will be deleted. Otherwise, they will fall into the open access of the Internet! Use any third party software for restoring your data or antivirus solutions will result in a loose of data. Please be sure that we will find common languge. We will restore all the data and give you recommedations how to configure the protection of your server.

URLs

http://paymen45oxzpnouz.onion/5e1a7c2620

Signatures

Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware

File Deletion
T1070.004

Inhibit System Recovery
T1490
Renames multiple (8391) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Deletes itself 1 IoCs

pid	Process
2748	cmd.exe

Drops desktop.ini file(s) 40 IoCs

description	ioc	Process
File opened for modification	C:\Users\Public\Pictures\desktop.ini	365712147d687fb2eb2d5cb612586c7d3d7364277441491a3ab379a4a1128ba7.exe
File opened for modification	C:\Program Files\desktop.ini	365712147d687fb2eb2d5cb612586c7d3d7364277441491a3ab379a4a1128ba7.exe
File opened for modification	C:\Program Files\Microsoft Games\Hearts\desktop.ini	365712147d687fb2eb2d5cb612586c7d3d7364277441491a3ab379a4a1128ba7.exe
File opened for modification	C:\Program Files (x86)\desktop.ini	365712147d687fb2eb2d5cb612586c7d3d7364277441491a3ab379a4a1128ba7.exe
File opened for modification	C:\Users\Admin\Desktop\desktop.ini	365712147d687fb2eb2d5cb612586c7d3d7364277441491a3ab379a4a1128ba7.exe
File opened for modification	C:\Users\Admin\Documents\desktop.ini	365712147d687fb2eb2d5cb612586c7d3d7364277441491a3ab379a4a1128ba7.exe
File opened for modification	C:\Users\Public\desktop.ini	365712147d687fb2eb2d5cb612586c7d3d7364277441491a3ab379a4a1128ba7.exe
File opened for modification	C:\Users\Public\Documents\desktop.ini	365712147d687fb2eb2d5cb612586c7d3d7364277441491a3ab379a4a1128ba7.exe
File opened for modification	C:\Users\Public\Videos\desktop.ini	365712147d687fb2eb2d5cb612586c7d3d7364277441491a3ab379a4a1128ba7.exe
File opened for modification	F:\$RECYCLE.BIN\S-1-5-21-3470981204-343661084-3367201002-1000\desktop.ini	365712147d687fb2eb2d5cb612586c7d3d7364277441491a3ab379a4a1128ba7.exe
File opened for modification	C:\Program Files\Microsoft Games\SpiderSolitaire\desktop.ini	365712147d687fb2eb2d5cb612586c7d3d7364277441491a3ab379a4a1128ba7.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\DataServices\DESKTOP.INI	365712147d687fb2eb2d5cb612586c7d3d7364277441491a3ab379a4a1128ba7.exe
File opened for modification	C:\Users\Admin\Links\desktop.ini	365712147d687fb2eb2d5cb612586c7d3d7364277441491a3ab379a4a1128ba7.exe
File opened for modification	C:\Users\Admin\Music\desktop.ini	365712147d687fb2eb2d5cb612586c7d3d7364277441491a3ab379a4a1128ba7.exe
File opened for modification	C:\Users\Admin\Saved Games\desktop.ini	365712147d687fb2eb2d5cb612586c7d3d7364277441491a3ab379a4a1128ba7.exe
File opened for modification	C:\Users\Public\Desktop\desktop.ini	365712147d687fb2eb2d5cb612586c7d3d7364277441491a3ab379a4a1128ba7.exe
File opened for modification	C:\$Recycle.Bin\S-1-5-21-3470981204-343661084-3367201002-1000\desktop.ini	365712147d687fb2eb2d5cb612586c7d3d7364277441491a3ab379a4a1128ba7.exe
File opened for modification	C:\Users\Admin\Contacts\desktop.ini	365712147d687fb2eb2d5cb612586c7d3d7364277441491a3ab379a4a1128ba7.exe
File opened for modification	C:\Users\Admin\Pictures\desktop.ini	365712147d687fb2eb2d5cb612586c7d3d7364277441491a3ab379a4a1128ba7.exe
File opened for modification	C:\Users\Public\Music\desktop.ini	365712147d687fb2eb2d5cb612586c7d3d7364277441491a3ab379a4a1128ba7.exe
File opened for modification	C:\Program Files\Microsoft Games\Chess\desktop.ini	365712147d687fb2eb2d5cb612586c7d3d7364277441491a3ab379a4a1128ba7.exe
File opened for modification	C:\Users\Admin\Favorites\desktop.ini	365712147d687fb2eb2d5cb612586c7d3d7364277441491a3ab379a4a1128ba7.exe
File opened for modification	C:\Users\Admin\Favorites\Links\desktop.ini	365712147d687fb2eb2d5cb612586c7d3d7364277441491a3ab379a4a1128ba7.exe
File opened for modification	C:\Users\Admin\Favorites\Links for United States\desktop.ini	365712147d687fb2eb2d5cb612586c7d3d7364277441491a3ab379a4a1128ba7.exe
File opened for modification	C:\Users\Admin\Searches\desktop.ini	365712147d687fb2eb2d5cb612586c7d3d7364277441491a3ab379a4a1128ba7.exe
File opened for modification	C:\Users\Public\Music\Sample Music\desktop.ini	365712147d687fb2eb2d5cb612586c7d3d7364277441491a3ab379a4a1128ba7.exe
File opened for modification	C:\Users\Public\Pictures\Sample Pictures\desktop.ini	365712147d687fb2eb2d5cb612586c7d3d7364277441491a3ab379a4a1128ba7.exe
File opened for modification	C:\Users\Public\Recorded TV\Sample Media\desktop.ini	365712147d687fb2eb2d5cb612586c7d3d7364277441491a3ab379a4a1128ba7.exe
File opened for modification	C:\Users\Public\Videos\Sample Videos\desktop.ini	365712147d687fb2eb2d5cb612586c7d3d7364277441491a3ab379a4a1128ba7.exe
File opened for modification	C:\Program Files\Microsoft Games\Solitaire\desktop.ini	365712147d687fb2eb2d5cb612586c7d3d7364277441491a3ab379a4a1128ba7.exe
File opened for modification	C:\Users\Public\Downloads\desktop.ini	365712147d687fb2eb2d5cb612586c7d3d7364277441491a3ab379a4a1128ba7.exe
File opened for modification	C:\Program Files\Microsoft Games\Mahjong\desktop.ini	365712147d687fb2eb2d5cb612586c7d3d7364277441491a3ab379a4a1128ba7.exe
File opened for modification	C:\Users\Admin\Downloads\desktop.ini	365712147d687fb2eb2d5cb612586c7d3d7364277441491a3ab379a4a1128ba7.exe
File opened for modification	C:\Users\Admin\Videos\desktop.ini	365712147d687fb2eb2d5cb612586c7d3d7364277441491a3ab379a4a1128ba7.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\Stationery\Desktop.ini	365712147d687fb2eb2d5cb612586c7d3d7364277441491a3ab379a4a1128ba7.exe
File opened for modification	C:\Program Files\Microsoft Games\FreeCell\desktop.ini	365712147d687fb2eb2d5cb612586c7d3d7364277441491a3ab379a4a1128ba7.exe
File opened for modification	C:\Program Files\Microsoft Games\Purble Place\desktop.ini	365712147d687fb2eb2d5cb612586c7d3d7364277441491a3ab379a4a1128ba7.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\Stationery\Desktop.ini	365712147d687fb2eb2d5cb612586c7d3d7364277441491a3ab379a4a1128ba7.exe
File opened for modification	C:\Users\Public\Libraries\desktop.ini	365712147d687fb2eb2d5cb612586c7d3d7364277441491a3ab379a4a1128ba7.exe
File opened for modification	C:\Users\Public\Recorded TV\desktop.ini	365712147d687fb2eb2d5cb612586c7d3d7364277441491a3ab379a4a1128ba7.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\FORMS\1033\TASKDECS.ICO	365712147d687fb2eb2d5cb612586c7d3d7364277441491a3ab379a4a1128ba7.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\en-US\js\localizedStrings.js	365712147d687fb2eb2d5cb612586c7d3d7364277441491a3ab379a4a1128ba7.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\FALL_01.MID	365712147d687fb2eb2d5cb612586c7d3d7364277441491a3ab379a4a1128ba7.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0103402.WMF	365712147d687fb2eb2d5cb612586c7d3d7364277441491a3ab379a4a1128ba7.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\VSTO\vstoee90.tlb	365712147d687fb2eb2d5cb612586c7d3d7364277441491a3ab379a4a1128ba7.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\AN01251_.WMF	365712147d687fb2eb2d5cb612586c7d3d7364277441491a3ab379a4a1128ba7.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\it-IT\settings.html	365712147d687fb2eb2d5cb612586c7d3d7364277441491a3ab379a4a1128ba7.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\olh001.htm	365712147d687fb2eb2d5cb612586c7d3d7364277441491a3ab379a4a1128ba7.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Argentina\Cordoba	365712147d687fb2eb2d5cb612586c7d3d7364277441491a3ab379a4a1128ba7.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\America\Pangnirtung	365712147d687fb2eb2d5cb612586c7d3d7364277441491a3ab379a4a1128ba7.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\images\system_h.png	365712147d687fb2eb2d5cb612586c7d3d7364277441491a3ab379a4a1128ba7.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\SO01063_.WMF	365712147d687fb2eb2d5cb612586c7d3d7364277441491a3ab379a4a1128ba7.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\OutlookAutoDiscover\YAHOO.HK.XML	365712147d687fb2eb2d5cb612586c7d3d7364277441491a3ab379a4a1128ba7.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\Smart Tag\readme.txt	365712147d687fb2eb2d5cb612586c7d3d7364277441491a3ab379a4a1128ba7.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\CAPSULES\CAPSULES.INF	365712147d687fb2eb2d5cb612586c7d3d7364277441491a3ab379a4a1128ba7.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\OUTLMIME.DLL	365712147d687fb2eb2d5cb612586c7d3d7364277441491a3ab379a4a1128ba7.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\es-ES\gadget.xml	365712147d687fb2eb2d5cb612586c7d3d7364277441491a3ab379a4a1128ba7.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\Help\3082\readme.txt	365712147d687fb2eb2d5cb612586c7d3d7364277441491a3ab379a4a1128ba7.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\fr-FR\js\library.js	365712147d687fb2eb2d5cb612586c7d3d7364277441491a3ab379a4a1128ba7.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\ja-JP\js\picturePuzzle.js	365712147d687fb2eb2d5cb612586c7d3d7364277441491a3ab379a4a1128ba7.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolBMPs\PicturesToolIconImagesMask.bmp	365712147d687fb2eb2d5cb612586c7d3d7364277441491a3ab379a4a1128ba7.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\xjc.exe	365712147d687fb2eb2d5cb612586c7d3d7364277441491a3ab379a4a1128ba7.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveProjectToolset\ProjectToolsetIconImages.jpg	365712147d687fb2eb2d5cb612586c7d3d7364277441491a3ab379a4a1128ba7.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\en-US\js\weather.js	365712147d687fb2eb2d5cb612586c7d3d7364277441491a3ab379a4a1128ba7.exe
File opened for modification	C:\Program Files (x86)\Common Files\System\ado\en-US\msader15.dll.mui	365712147d687fb2eb2d5cb612586c7d3d7364277441491a3ab379a4a1128ba7.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0315612.JPG	365712147d687fb2eb2d5cb612586c7d3d7364277441491a3ab379a4a1128ba7.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\OUTLVBS.DLL	365712147d687fb2eb2d5cb612586c7d3d7364277441491a3ab379a4a1128ba7.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Argentina\readme.txt	365712147d687fb2eb2d5cb612586c7d3d7364277441491a3ab379a4a1128ba7.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\NA00512_.WMF	365712147d687fb2eb2d5cb612586c7d3d7364277441491a3ab379a4a1128ba7.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\images\144DPI\(144DPI)alertIcon.png	365712147d687fb2eb2d5cb612586c7d3d7364277441491a3ab379a4a1128ba7.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\fonts\LucidaSansDemiBold.ttf	365712147d687fb2eb2d5cb612586c7d3d7364277441491a3ab379a4a1128ba7.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Jerusalem	365712147d687fb2eb2d5cb612586c7d3d7364277441491a3ab379a4a1128ba7.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0151047.WMF	365712147d687fb2eb2d5cb612586c7d3d7364277441491a3ab379a4a1128ba7.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\LINES\BD21305_.GIF	365712147d687fb2eb2d5cb612586c7d3d7364277441491a3ab379a4a1128ba7.exe
File opened for modification	C:\Program Files (x86)\Windows Mail\en-US\msoeres.dll.mui	365712147d687fb2eb2d5cb612586c7d3d7364277441491a3ab379a4a1128ba7.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\BOLDSTRI\PREVIEW.GIF	365712147d687fb2eb2d5cb612586c7d3d7364277441491a3ab379a4a1128ba7.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\HH02312_.WMF	365712147d687fb2eb2d5cb612586c7d3d7364277441491a3ab379a4a1128ba7.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\PE00050_.WMF	365712147d687fb2eb2d5cb612586c7d3d7364277441491a3ab379a4a1128ba7.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\AUTOSHAP\BD18238_.WMF	365712147d687fb2eb2d5cb612586c7d3d7364277441491a3ab379a4a1128ba7.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Americana\TAB_OFF.GIF	365712147d687fb2eb2d5cb612586c7d3d7364277441491a3ab379a4a1128ba7.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\Vignette\NavigationLeft_SelectionSubpicture.png	365712147d687fb2eb2d5cb612586c7d3d7364277441491a3ab379a4a1128ba7.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Indiana\Tell_City	365712147d687fb2eb2d5cb612586c7d3d7364277441491a3ab379a4a1128ba7.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.reconciler.dropins.nl_ja_4.4.0.v20140623020002.jar	365712147d687fb2eb2d5cb612586c7d3d7364277441491a3ab379a4a1128ba7.exe
File opened for modification	C:\Program Files\Microsoft Games\SpiderSolitaire\..	365712147d687fb2eb2d5cb612586c7d3d7364277441491a3ab379a4a1128ba7.exe
File created	C:\Program Files\VideoLAN\VLC\locale\sl\LC_MESSAGES\readme.txt	365712147d687fb2eb2d5cb612586c7d3d7364277441491a3ab379a4a1128ba7.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBSPAPR\ZPDIR27F.GIF	365712147d687fb2eb2d5cb612586c7d3d7364277441491a3ab379a4a1128ba7.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\es-ES\js\picturePuzzle.js	365712147d687fb2eb2d5cb612586c7d3d7364277441491a3ab379a4a1128ba7.exe
File opened for modification	C:\Program Files (x86)\Windows Defender\de-DE\MpAsDesc.dll.mui	365712147d687fb2eb2d5cb612586c7d3d7364277441491a3ab379a4a1128ba7.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\J0115834.GIF	365712147d687fb2eb2d5cb612586c7d3d7364277441491a3ab379a4a1128ba7.exe
File opened for modification	C:\Program Files\Mozilla Firefox\browser\features\[email protected]	365712147d687fb2eb2d5cb612586c7d3d7364277441491a3ab379a4a1128ba7.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\ne\LC_MESSAGES\vlc.mo	365712147d687fb2eb2d5cb612586c7d3d7364277441491a3ab379a4a1128ba7.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\RSWOP.ICM	365712147d687fb2eb2d5cb612586c7d3d7364277441491a3ab379a4a1128ba7.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\rectangle_babypink_Thumbnail.bmp	365712147d687fb2eb2d5cb612586c7d3d7364277441491a3ab379a4a1128ba7.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.equinox.p2.core.feature_1.3.0.v20140523-0116\epl-v10.html	365712147d687fb2eb2d5cb612586c7d3d7364277441491a3ab379a4a1128ba7.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0105380.WMF	365712147d687fb2eb2d5cb612586c7d3d7364277441491a3ab379a4a1128ba7.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_bullets.gif	365712147d687fb2eb2d5cb612586c7d3d7364277441491a3ab379a4a1128ba7.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\Smart Tag\1033\STINTL.DLL.IDX_DLL	365712147d687fb2eb2d5cb612586c7d3d7364277441491a3ab379a4a1128ba7.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\IN00177_.WMF	365712147d687fb2eb2d5cb612586c7d3d7364277441491a3ab379a4a1128ba7.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\bg_Groove.gif	365712147d687fb2eb2d5cb612586c7d3d7364277441491a3ab379a4a1128ba7.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Templates\1033\UrbanPhotoAlbum.potx	365712147d687fb2eb2d5cb612586c7d3d7364277441491a3ab379a4a1128ba7.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\images\undocked_gray_hail.png	365712147d687fb2eb2d5cb612586c7d3d7364277441491a3ab379a4a1128ba7.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Lime\TAB_ON.GIF	365712147d687fb2eb2d5cb612586c7d3d7364277441491a3ab379a4a1128ba7.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\Asia\Qyzylorda	365712147d687fb2eb2d5cb612586c7d3d7364277441491a3ab379a4a1128ba7.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	365712147d687fb2eb2d5cb612586c7d3d7364277441491a3ab379a4a1128ba7.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Delays execution with timeout.exe 1 IoCs

evasion

pid	Process
972	timeout.exe

Interacts with shadow copies 2 TTPs 1 IoCs

Shadow copies are often targeted by ransomware to inhibit system recovery.

ransomware

File Deletion

T1070.004

Inhibit System Recovery

T1490

pid	Process
2748	vssadmin.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2972	365712147d687fb2eb2d5cb612586c7d3d7364277441491a3ab379a4a1128ba7.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeBackupPrivilege	1132	vssvc.exe
Token: SeRestorePrivilege	1132	vssvc.exe
Token: SeAuditPrivilege	1132	vssvc.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 2972 wrote to memory of 2748	2972	365712147d687fb2eb2d5cb612586c7d3d7364277441491a3ab379a4a1128ba7.exe	28
PID 2972 wrote to memory of 2748	2972	365712147d687fb2eb2d5cb612586c7d3d7364277441491a3ab379a4a1128ba7.exe	28
PID 2972 wrote to memory of 2748	2972	365712147d687fb2eb2d5cb612586c7d3d7364277441491a3ab379a4a1128ba7.exe	28
PID 2972 wrote to memory of 2748	2972	365712147d687fb2eb2d5cb612586c7d3d7364277441491a3ab379a4a1128ba7.exe	28
PID 2972 wrote to memory of 2748	2972	365712147d687fb2eb2d5cb612586c7d3d7364277441491a3ab379a4a1128ba7.exe	31
PID 2972 wrote to memory of 2748	2972	365712147d687fb2eb2d5cb612586c7d3d7364277441491a3ab379a4a1128ba7.exe	31
PID 2972 wrote to memory of 2748	2972	365712147d687fb2eb2d5cb612586c7d3d7364277441491a3ab379a4a1128ba7.exe	31
PID 2972 wrote to memory of 2748	2972	365712147d687fb2eb2d5cb612586c7d3d7364277441491a3ab379a4a1128ba7.exe	31
PID 2748 wrote to memory of 972	2748	cmd.exe	33
PID 2748 wrote to memory of 972	2748	cmd.exe	33
PID 2748 wrote to memory of 972	2748	cmd.exe	33
PID 2748 wrote to memory of 972	2748	cmd.exe	33

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\365712147d687fb2eb2d5cb612586c7d3d7364277441491a3ab379a4a1128ba7.exe
"C:\Users\Admin\AppData\Local\Temp\365712147d687fb2eb2d5cb612586c7d3d7364277441491a3ab379a4a1128ba7.exe"
1⤵
- Drops desktop.ini file(s)
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2972
- C:\Windows\SysWOW64\vssadmin.exe
  vssadmin delete shadows /all /quiet
  2⤵
  - Interacts with shadow copies
  PID:2748
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /c timeout 1 && del "C:\Users\Admin\AppData\Local\Temp\365712147d687fb2eb2d5cb612586c7d3d7364277441491a3ab379a4a1128ba7.exe" >> NUL
  2⤵
  - Deletes itself
  - Suspicious use of WriteProcessMemory
  PID:2748
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    - Delays execution with timeout.exe
    PID:972

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1132

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Indicator Removal

T1070

File Deletion

T1070.004

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-3470981204-343661084-3367201002-1000\desktop.ini

Filesize
649B

MD5
a2bee75b24ec7a5775167b4eab1aead7

SHA1
1ebe8dc222db12326ca4f275323c0f2aa7f458ee

SHA256
c64072e2ebcec2adef983cedae01cd0e93ed83f53333d81764fd2da046425e05

SHA512
88f803c14ba145c6f4b2aa9be69dfcd648f92651fac4d3fde0d79e0bac2a16d7e075a5028116faa22ac994727ae67a98e9c8c8919664d685a6963f4ad8a57c00

Download Submit
C:\$Recycle.Bin\S-1-5-21-3470981204-343661084-3367201002-1000\readme.txt

Filesize
1KB

MD5
690a32206c421c58a74635ba8623f06c

SHA1
e7ea197518fbcdb181184c5d6c60a49d0d776502

SHA256
2a41e7d3478a8c5023ceecbc9258e072a9db9bf154d10245035e227ab3180941

SHA512
26b03f299c71ba946b6333f77fb54063842d39ceb069728d8587da285c6947e010572bc7f67092651f150814f4dcbee4a7538d2111cfd3860a27e70a8eef2d1f

Download Submit
memory/2972-9-0x0000000000220000-0x0000000000260000-memory.dmp

Filesize
256KB

Download
memory/2972-28-0x00000000002E0000-0x0000000000320000-memory.dmp

Filesize
256KB

Download
memory/2972-15-0x00000000002E0000-0x0000000000320000-memory.dmp

Filesize
256KB

Download
memory/2972-2-0x0000000000330000-0x00000000003B0000-memory.dmp

Filesize
512KB

Download
memory/2972-1-0x0000000000590000-0x0000000000690000-memory.dmp

Filesize
1024KB

Download
memory/2972-135-0x00000000002E0000-0x0000000000320000-memory.dmp

Filesize
256KB

Download
memory/2972-167-0x00000000002E0000-0x0000000000320000-memory.dmp

Filesize
256KB

Download
memory/2972-215-0x0000000000400000-0x00000000004DD000-memory.dmp

Filesize
884KB

Download
memory/2972-253-0x0000000000400000-0x00000000004DD000-memory.dmp

Filesize
884KB

Download
memory/2972-16897-0x0000000000400000-0x00000000004DD000-memory.dmp

Filesize
884KB

Download
memory/2972-18870-0x0000000000220000-0x0000000000221000-memory.dmp

Filesize
4KB

Download
memory/2972-18871-0x0000000000400000-0x00000000004DD000-memory.dmp

Filesize
884KB

Download