Resubmissions

21-01-2024 14:52

240121-r8syqaeac7 10

21-01-2024 14:51

240121-r8k8waeac5 10

01-01-2024 13:55

240101-q776kscacp 10

Analysis

  • max time kernel
    121s
  • max time network
    153s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    21-01-2024 14:51

General

  • Target

    365712147d687fb2eb2d5cb612586c7d3d7364277441491a3ab379a4a1128ba7.exe

  • Size

    450KB

  • MD5

    e70b33103c17c000ac11025d2d8e70a1

  • SHA1

    df898d9d0e8e6f2d4eb5d4742d4c206092cdcb34

  • SHA256

    365712147d687fb2eb2d5cb612586c7d3d7364277441491a3ab379a4a1128ba7

  • SHA512

    632461a9c6bff4e013cf3e77a7262d1daaa8775156c61c70dab685ae59114b22d00a47a0214204f6c514c6be77ad5b0c371a889076072fdb1eaf574cb6d4c42c

  • SSDEEP

    12288:krYn2GbqdcOuAKi1kcwyEOywAx1gT+yFCv6oE4E:kcNbqdFtVkcwyEOix1GtFCv6F4E

Score
10/10

Malware Config

Extracted

Path

C:\$Recycle.Bin\S-1-5-21-768304381-2824894965-3840216961-1000\readme.txt

Ransom Note
Dear user! Your computer is encrypted! We demand a ransom! Decryption service is paid !!!! PAYMENT FOR BITCOIN !!! To decrypt your computer, you need to download the TOR browser at https://www.torproject.org/download/ Install it and visit our website for further action http://paymen45oxzpnouz.onion/e862abe0e5 Also from your servers files, documents, databases SQL, PDF were uploaded to our cloud storage After we agree, you will receive a decryption program, valuable advice in order not to fall into this situation in the future, as well as all your files on our server will be deleted. Otherwise, they will fall into the open access of the Internet! Use any third party software for restoring your data or antivirus solutions will result in a loose of data. Please be sure that we will find common languge. We will restore all the data and give you recommedations how to configure the protection of your server.
URLs

http://paymen45oxzpnouz.onion/e862abe0e5

Signatures

  • Renames multiple (7183) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops desktop.ini file(s) 30 IoCs
  • Drops file in System32 directory 6 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 31 IoCs
  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Delays execution with timeout.exe 1 IoCs
  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies data under HKEY_USERS 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\365712147d687fb2eb2d5cb612586c7d3d7364277441491a3ab379a4a1128ba7.exe
    "C:\Users\Admin\AppData\Local\Temp\365712147d687fb2eb2d5cb612586c7d3d7364277441491a3ab379a4a1128ba7.exe"
    1⤵
    • Checks computer location settings
    • Drops desktop.ini file(s)
    • Drops file in Program Files directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:4756
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4756 -s 544
      2⤵
      • Program crash
      PID:3980
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4756 -s 640
      2⤵
      • Program crash
      PID:896
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4756 -s 716
      2⤵
      • Program crash
      PID:3060
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4756 -s 736
      2⤵
      • Program crash
      PID:2204
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4756 -s 720
      2⤵
      • Program crash
      PID:3940
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4756 -s 716
      2⤵
      • Program crash
      PID:1360
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4756 -s 588
      2⤵
      • Program crash
      PID:4448
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4756 -s 756
      2⤵
      • Program crash
      PID:4912
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4756 -s 788
      2⤵
      • Program crash
      PID:2272
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4756 -s 588
      2⤵
      • Program crash
      PID:1856
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4756 -s 796
      2⤵
      • Program crash
      PID:3724
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4756 -s 824
      2⤵
      • Program crash
      PID:1188
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4756 -s 764
      2⤵
      • Program crash
      PID:1396
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4756 -s 828
      2⤵
      • Program crash
      PID:5036
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4756 -s 760
      2⤵
      • Program crash
      PID:4400
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4756 -s 816
      2⤵
      • Program crash
      PID:6176
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4756 -s 936
      2⤵
      • Program crash
      PID:6196
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4756 -s 732
      2⤵
      • Program crash
      PID:3488
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4756 -s 908
      2⤵
      • Program crash
      PID:3328
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4756 -s 776
      2⤵
      • Program crash
      PID:2632
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4756 -s 920
      2⤵
      • Program crash
      PID:6552
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4756 -s 884
      2⤵
      • Program crash
      PID:2228
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4756 -s 1016
      2⤵
      • Program crash
      PID:8756
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4756 -s 952
      2⤵
      • Program crash
      PID:7820
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4756 -s 656
      2⤵
      • Program crash
      PID:3056
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4756 -s 988
      2⤵
      • Program crash
      PID:1296
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4756 -s 720
      2⤵
      • Program crash
      PID:5728
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4756 -s 896
      2⤵
      • Program crash
      PID:6544
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4756 -s 1040
      2⤵
      • Program crash
      PID:8044
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4756 -s 808
      2⤵
      • Program crash
      PID:5816
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /c timeout 1 && del "C:\Users\Admin\AppData\Local\Temp\365712147d687fb2eb2d5cb612586c7d3d7364277441491a3ab379a4a1128ba7.exe" >> NUL
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:7544
      • C:\Windows\SysWOW64\timeout.exe
        timeout 1
        3⤵
        • Delays execution with timeout.exe
        PID:7368
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4756 -s 868
      2⤵
      • Program crash
      PID:7512
  • C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe
    "C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service
    1⤵
    • Drops file in System32 directory
    • Checks processor information in registry
    • Enumerates system info in registry
    • Modifies data under HKEY_USERS
    • Suspicious use of SetWindowsHookEx
    PID:944
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 4756 -ip 4756
    1⤵
      PID:560
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 4756 -ip 4756
      1⤵
        PID:4684
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -pss -s 488 -p 4756 -ip 4756
        1⤵
          PID:3380
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 4756 -ip 4756
          1⤵
            PID:1712
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 4756 -ip 4756
            1⤵
              PID:2256
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 4756 -ip 4756
              1⤵
                PID:1900
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 4756 -ip 4756
                1⤵
                  PID:2512
                • C:\Windows\SysWOW64\WerFault.exe
                  C:\Windows\SysWOW64\WerFault.exe -pss -s 488 -p 4756 -ip 4756
                  1⤵
                    PID:2520
                  • C:\Windows\SysWOW64\WerFault.exe
                    C:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 4756 -ip 4756
                    1⤵
                      PID:4676
                    • C:\Windows\SysWOW64\WerFault.exe
                      C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 4756 -ip 4756
                      1⤵
                        PID:4820
                      • C:\Windows\SysWOW64\WerFault.exe
                        C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 4756 -ip 4756
                        1⤵
                          PID:2120
                        • C:\Windows\SysWOW64\WerFault.exe
                          C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 4756 -ip 4756
                          1⤵
                            PID:2684
                          • C:\Windows\SysWOW64\WerFault.exe
                            C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 4756 -ip 4756
                            1⤵
                              PID:4056
                            • C:\Windows\SysWOW64\WerFault.exe
                              C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 4756 -ip 4756
                              1⤵
                                PID:4024
                              • C:\Windows\SysWOW64\WerFault.exe
                                C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 4756 -ip 4756
                                1⤵
                                  PID:1376
                                • C:\Windows\SysWOW64\WerFault.exe
                                  C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 4756 -ip 4756
                                  1⤵
                                    PID:4460
                                  • C:\Windows\SysWOW64\WerFault.exe
                                    C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 4756 -ip 4756
                                    1⤵
                                      PID:7420
                                    • C:\Windows\SysWOW64\WerFault.exe
                                      C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 4756 -ip 4756
                                      1⤵
                                        PID:6392
                                      • C:\Windows\SysWOW64\WerFault.exe
                                        C:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 4756 -ip 4756
                                        1⤵
                                          PID:3484
                                        • C:\Windows\SysWOW64\WerFault.exe
                                          C:\Windows\SysWOW64\WerFault.exe -pss -s 384 -p 4756 -ip 4756
                                          1⤵
                                            PID:2352
                                          • C:\Windows\SysWOW64\WerFault.exe
                                            C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 4756 -ip 4756
                                            1⤵
                                              PID:4936
                                            • C:\Windows\SysWOW64\WerFault.exe
                                              C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 4756 -ip 4756
                                              1⤵
                                                PID:5996
                                              • C:\Windows\SysWOW64\WerFault.exe
                                                C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 4756 -ip 4756
                                                1⤵
                                                  PID:6424
                                                • C:\Windows\SysWOW64\WerFault.exe
                                                  C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 4756 -ip 4756
                                                  1⤵
                                                    PID:6896
                                                  • C:\Windows\SysWOW64\WerFault.exe
                                                    C:\Windows\SysWOW64\WerFault.exe -pss -s 484 -p 4756 -ip 4756
                                                    1⤵
                                                      PID:4948
                                                    • C:\Windows\SysWOW64\WerFault.exe
                                                      C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 4756 -ip 4756
                                                      1⤵
                                                        PID:1712
                                                      • C:\Windows\SysWOW64\WerFault.exe
                                                        C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 4756 -ip 4756
                                                        1⤵
                                                          PID:7892
                                                        • C:\Windows\SysWOW64\WerFault.exe
                                                          C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 4756 -ip 4756
                                                          1⤵
                                                            PID:7208
                                                          • C:\Windows\SysWOW64\WerFault.exe
                                                            C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 4756 -ip 4756
                                                            1⤵
                                                              PID:8300
                                                            • C:\Windows\SysWOW64\WerFault.exe
                                                              C:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 4756 -ip 4756
                                                              1⤵
                                                                PID:3100
                                                              • C:\Windows\SysWOW64\WerFault.exe
                                                                C:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 4756 -ip 4756
                                                                1⤵
                                                                  PID:6960

                                                                Network

                                                                MITRE ATT&CK Enterprise v15

                                                                Replay Monitor

                                                                Loading Replay Monitor...

                                                                Downloads

                                                                • C:\$Recycle.Bin\S-1-5-21-768304381-2824894965-3840216961-1000\desktop.ini

                                                                  Filesize

                                                                  649B

                                                                  MD5

                                                                  972b94bbddcda151951a54a6a9674b24

                                                                  SHA1

                                                                  319ad5d6e592a9947127f0489d4ad19ac4db9e42

                                                                  SHA256

                                                                  d3a43ce0d4cc1652c1a917b90d242c1aa4f2227a410b086005863afb820f97a8

                                                                  SHA512

                                                                  152de2ddb209dd88cc1bf5881a9ec4a2d4790676b13474d4e22f0608c58d08ad2c0cb4bea9d696eb2317c821ed3ae68645c7f4fe15e10ccb117733d63ae60feb

                                                                • C:\$Recycle.Bin\S-1-5-21-768304381-2824894965-3840216961-1000\readme.txt

                                                                  Filesize

                                                                  1KB

                                                                  MD5

                                                                  f5d11d5823977ce96b3950c63f756cf0

                                                                  SHA1

                                                                  a2988263ad7cc5939a17a15132e0cfd7441f92cc

                                                                  SHA256

                                                                  5c0d71460d8f8f6ac02031c362e085f91df8e9e93f57df96077c79e6858e7a38

                                                                  SHA512

                                                                  34039cf4eaba282f84418a7e3614e3f961bccf0d18c986dbf6348db2ba14d393bf73408183919f3283c8d4d0223994d1d32ffb1b0b6364f366ca825c6927dcbd

                                                                • memory/4756-4-0x00000000006B0000-0x00000000006F0000-memory.dmp

                                                                  Filesize

                                                                  256KB

                                                                • memory/4756-6176-0x0000000000400000-0x00000000004DD000-memory.dmp

                                                                  Filesize

                                                                  884KB

                                                                • memory/4756-1-0x0000000000740000-0x0000000000840000-memory.dmp

                                                                  Filesize

                                                                  1024KB

                                                                • memory/4756-6-0x0000000000400000-0x00000000004DD000-memory.dmp

                                                                  Filesize

                                                                  884KB

                                                                • memory/4756-8-0x00000000006F0000-0x00000000006F1000-memory.dmp

                                                                  Filesize

                                                                  4KB

                                                                • memory/4756-3-0x0000000000400000-0x00000000004DD000-memory.dmp

                                                                  Filesize

                                                                  884KB

                                                                • memory/4756-2-0x00000000005F0000-0x0000000000670000-memory.dmp

                                                                  Filesize

                                                                  512KB

                                                                • memory/4756-5-0x00000000006B0000-0x00000000006F0000-memory.dmp

                                                                  Filesize

                                                                  256KB

                                                                • memory/4756-15504-0x0000000000400000-0x00000000004DD000-memory.dmp

                                                                  Filesize

                                                                  884KB

                                                                • memory/4756-15505-0x0000000000740000-0x0000000000840000-memory.dmp

                                                                  Filesize

                                                                  1024KB

                                                                • memory/4756-15507-0x0000000000400000-0x00000000004DD000-memory.dmp

                                                                  Filesize

                                                                  884KB

                                                                • memory/4756-15506-0x00000000005F0000-0x0000000000670000-memory.dmp

                                                                  Filesize

                                                                  512KB

                                                                • memory/4756-16271-0x00000000006B0000-0x00000000006F0000-memory.dmp

                                                                  Filesize

                                                                  256KB

                                                                • memory/4756-17553-0x00000000006B0000-0x00000000006F0000-memory.dmp

                                                                  Filesize

                                                                  256KB

                                                                • memory/4756-17554-0x0000000000400000-0x00000000004DD000-memory.dmp

                                                                  Filesize

                                                                  884KB

                                                                • memory/4756-17555-0x00000000006B0000-0x00000000006B1000-memory.dmp

                                                                  Filesize

                                                                  4KB