Resubmissions

21-01-2024 14:52

240121-r8syqaeac7 10

21-01-2024 14:51

240121-r8k8waeac5 10

01-01-2024 13:55

240101-q776kscacp 10

Analysis

  • max time kernel
    62s
  • max time network
    149s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231222-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
  • submitted
    21-01-2024 14:51

General

  • Target

    59c59ef90d1370297375d4e3195eabe2a031251bc939fae962a835d8336a8a4d.exe

  • Size

    477KB

  • MD5

    ebbb782bafaa3ab64a3e4b006a698fe0

  • SHA1

    2800cd4dd62ba63f38d0452bf80cb35b4359a3dd

  • SHA256

    59c59ef90d1370297375d4e3195eabe2a031251bc939fae962a835d8336a8a4d

  • SHA512

    cd6681d7987901eb27064c4a833052abccef60383f9b0e53360ae9e3e66a19d0d0405bdeb5a609c7d668aa8720eb49f5fc3f060920ec042ec6584eebfd9f09ae

  • SSDEEP

    6144:ko4FuDncVzUJOH5bpX3Q92J6fHgaEFx9BQOJvZTsMJfOg2lOMxPEiarVb0J0:kzuwVzUW5bN3Y6LmO13Gg2IMyxrt0u

Score
10/10

Malware Config

Extracted

Path

C:\$Recycle.Bin\S-1-5-21-1168293393-3419776239-306423207-1000\readme.txt

Ransom Note
Dear user! Your computer is encrypted! We demand a ransom! Decryption service is paid !!!! PAYMENT FOR BITCOIN !!! To decrypt your computer, you need to download the TOR browser at https://www.torproject.org/download/ Install it and visit our website for further action http://paymen45oxzpnouz.onion/2fe680d14f Also from your servers files, documents, databases SQL, PDF were uploaded to our cloud storage After we agree, you will receive a decryption program, valuable advice in order not to fall into this situation in the future, as well as all your files on our server will be deleted. Otherwise, they will fall into the open access of the Internet! Use any third party software for restoring your data or antivirus solutions will result in a loose of data. Please be sure that we will find common languge. We will restore all the data and give you recommedations how to configure the protection of your server.
URLs

http://paymen45oxzpnouz.onion/2fe680d14f

Signatures

  • Renames multiple (2398) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

  • Drops desktop.ini file(s) 3 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Program crash 31 IoCs
  • Delays execution with timeout.exe 1 IoCs
  • Modifies data under HKEY_USERS 59 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\59c59ef90d1370297375d4e3195eabe2a031251bc939fae962a835d8336a8a4d.exe
    "C:\Users\Admin\AppData\Local\Temp\59c59ef90d1370297375d4e3195eabe2a031251bc939fae962a835d8336a8a4d.exe"
    1⤵
    • Drops desktop.ini file(s)
    • Drops file in Program Files directory
    • Suspicious behavior: EnumeratesProcesses
    PID:4364
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4364 -s 532
      2⤵
      • Program crash
      PID:1644
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4364 -s 600
      2⤵
      • Program crash
      PID:1448
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4364 -s 716
      2⤵
      • Program crash
      PID:2444
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4364 -s 760
      2⤵
      • Program crash
      PID:3536
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4364 -s 768
      2⤵
      • Program crash
      PID:1412
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4364 -s 776
      2⤵
      • Program crash
      PID:4904
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4364 -s 724
      2⤵
      • Program crash
      PID:3284
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4364 -s 796
      2⤵
      • Program crash
      PID:828
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4364 -s 780
      2⤵
      • Program crash
      PID:4896
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4364 -s 800
      2⤵
      • Program crash
      PID:4852
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4364 -s 836
      2⤵
      • Program crash
      PID:1556
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4364 -s 808
      2⤵
      • Program crash
      PID:5948
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4364 -s 716
      2⤵
      • Program crash
      PID:6692
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4364 -s 832
      2⤵
      • Program crash
      PID:1264
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4364 -s 932
      2⤵
      • Program crash
      PID:1336
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4364 -s 848
      2⤵
      • Program crash
      PID:9916
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4364 -s 1004
      2⤵
      • Program crash
      PID:5840
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4364 -s 876
      2⤵
      • Program crash
      PID:3992
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4364 -s 956
      2⤵
      • Program crash
      PID:6420
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4364 -s 876
      2⤵
      • Program crash
      PID:9600
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4364 -s 792
      2⤵
      • Program crash
      PID:3604
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4364 -s 688
      2⤵
      • Program crash
      PID:1336
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4364 -s 876
      2⤵
      • Program crash
      PID:9396
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4364 -s 664
      2⤵
      • Program crash
      PID:8596
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4364 -s 828
      2⤵
      • Program crash
      PID:9672
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4364 -s 768
      2⤵
      • Program crash
      PID:6560
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4364 -s 796
      2⤵
      • Program crash
      PID:7524
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4364 -s 784
      2⤵
      • Program crash
      PID:9368
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4364 -s 980
      2⤵
      • Program crash
      PID:5800
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4364 -s 1064
      2⤵
      • Program crash
      PID:10072
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /c timeout 1 && del "C:\Users\Admin\AppData\Local\Temp\59c59ef90d1370297375d4e3195eabe2a031251bc939fae962a835d8336a8a4d.exe" >> NUL
      2⤵
        PID:9808
        • C:\Windows\SysWOW64\timeout.exe
          timeout 1
          3⤵
          • Delays execution with timeout.exe
          PID:8152
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 4364 -s 1168
        2⤵
        • Program crash
        PID:5696
    • C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe
      "C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service
      1⤵
      • Modifies data under HKEY_USERS
      • Suspicious use of SetWindowsHookEx
      PID:3184
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 196 -p 4364 -ip 4364
      1⤵
        PID:1716
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 4364 -ip 4364
        1⤵
          PID:3784
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -pss -s 496 -p 4364 -ip 4364
          1⤵
            PID:1548
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 4364 -ip 4364
            1⤵
              PID:208
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 4364 -ip 4364
              1⤵
                PID:1408
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 4364 -ip 4364
                1⤵
                  PID:1508
                • C:\Windows\SysWOW64\WerFault.exe
                  C:\Windows\SysWOW64\WerFault.exe -pss -s 372 -p 4364 -ip 4364
                  1⤵
                    PID:2600
                  • C:\Windows\SysWOW64\WerFault.exe
                    C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 4364 -ip 4364
                    1⤵
                      PID:3876
                    • C:\Windows\SysWOW64\WerFault.exe
                      C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 4364 -ip 4364
                      1⤵
                        PID:592
                      • C:\Windows\SysWOW64\WerFault.exe
                        C:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 4364 -ip 4364
                        1⤵
                          PID:4584
                        • C:\Windows\SysWOW64\WerFault.exe
                          C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 4364 -ip 4364
                          1⤵
                            PID:3440
                          • C:\Windows\SysWOW64\WerFault.exe
                            C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 4364 -ip 4364
                            1⤵
                              PID:2784
                            • C:\Windows\SysWOW64\WerFault.exe
                              C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 4364 -ip 4364
                              1⤵
                                PID:1796
                              • C:\Windows\SysWOW64\WerFault.exe
                                C:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 4364 -ip 4364
                                1⤵
                                  PID:7824
                                • C:\Windows\SysWOW64\WerFault.exe
                                  C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 4364 -ip 4364
                                  1⤵
                                    PID:7340
                                  • C:\Windows\SysWOW64\WerFault.exe
                                    C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 4364 -ip 4364
                                    1⤵
                                      PID:4032
                                    • C:\Windows\SysWOW64\WerFault.exe
                                      C:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 4364 -ip 4364
                                      1⤵
                                        PID:7820
                                      • C:\Windows\SysWOW64\WerFault.exe
                                        C:\Windows\SysWOW64\WerFault.exe -pss -s 488 -p 4364 -ip 4364
                                        1⤵
                                          PID:3424
                                        • C:\Windows\SysWOW64\WerFault.exe
                                          C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 4364 -ip 4364
                                          1⤵
                                            PID:2288
                                          • C:\Windows\SysWOW64\WerFault.exe
                                            C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 4364 -ip 4364
                                            1⤵
                                              PID:4720
                                            • C:\Windows\SysWOW64\WerFault.exe
                                              C:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 4364 -ip 4364
                                              1⤵
                                                PID:5928
                                              • C:\Windows\SysWOW64\WerFault.exe
                                                C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 4364 -ip 4364
                                                1⤵
                                                  PID:7940
                                                • C:\Windows\SysWOW64\WerFault.exe
                                                  C:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 4364 -ip 4364
                                                  1⤵
                                                    PID:3580
                                                  • C:\Windows\SysWOW64\WerFault.exe
                                                    C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 4364 -ip 4364
                                                    1⤵
                                                      PID:9388
                                                    • C:\Windows\SysWOW64\WerFault.exe
                                                      C:\Windows\SysWOW64\WerFault.exe -pss -s 372 -p 4364 -ip 4364
                                                      1⤵
                                                        PID:8000
                                                      • C:\Windows\SysWOW64\WerFault.exe
                                                        C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 4364 -ip 4364
                                                        1⤵
                                                          PID:9248
                                                        • C:\Windows\SysWOW64\WerFault.exe
                                                          C:\Windows\SysWOW64\WerFault.exe -pss -s 488 -p 4364 -ip 4364
                                                          1⤵
                                                            PID:9080
                                                          • C:\Windows\SysWOW64\WerFault.exe
                                                            C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 4364 -ip 4364
                                                            1⤵
                                                              PID:4760
                                                            • C:\Windows\SysWOW64\WerFault.exe
                                                              C:\Windows\SysWOW64\WerFault.exe -pss -s 372 -p 4364 -ip 4364
                                                              1⤵
                                                                PID:6096
                                                              • C:\Windows\SysWOW64\WerFault.exe
                                                                C:\Windows\SysWOW64\WerFault.exe -pss -s 372 -p 4364 -ip 4364
                                                                1⤵
                                                                  PID:5472
                                                                • C:\Windows\SysWOW64\WerFault.exe
                                                                  C:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 4364 -ip 4364
                                                                  1⤵
                                                                    PID:6148

                                                                  Network

                                                                  MITRE ATT&CK Matrix

                                                                  Replay Monitor

                                                                  Loading Replay Monitor...

                                                                  Downloads

                                                                  • C:\$Recycle.Bin\S-1-5-21-1168293393-3419776239-306423207-1000\desktop.ini

                                                                    Filesize

                                                                    649B

                                                                    MD5

                                                                    e69501a4c5c34146c04e669eb881bf2b

                                                                    SHA1

                                                                    4790ba111539c56d0eba2d64b5760813c255c441

                                                                    SHA256

                                                                    7c65cbaea2cb08d6c3de16cb8a1f17611bf69417ac68905d05e1270038cad1db

                                                                    SHA512

                                                                    789954766147053acabeadc70aaf3c9d1ada0f7d0219ddaaf911815ecd34c1259f917f01008051c132f7205812794b685ccf843333e8bdd094b00be0310fd4e2

                                                                  • C:\$Recycle.Bin\S-1-5-21-1168293393-3419776239-306423207-1000\readme.txt

                                                                    Filesize

                                                                    1KB

                                                                    MD5

                                                                    92cf6d740235b98f795b745896afb6ee

                                                                    SHA1

                                                                    466d3eff58c26e76adcd3721f5d292423ed9a939

                                                                    SHA256

                                                                    bd257c62fe587dc2284b7a7d086a755d642dad7c61c78ac99e85f2f519d1bf34

                                                                    SHA512

                                                                    3e2ea973d4be4019fda8d97fa116ef0fcc9e946b243b998e1db15daa0fd3eba74e4bd07cbdf728d72f9064ef423d8f9aba0948af6394601fa83c4e8b2bb9f205

                                                                  • memory/4364-7-0x0000000000580000-0x0000000000581000-memory.dmp

                                                                    Filesize

                                                                    4KB

                                                                  • memory/4364-4-0x0000000000580000-0x0000000000581000-memory.dmp

                                                                    Filesize

                                                                    4KB

                                                                  • memory/4364-3-0x0000000000400000-0x00000000004E3000-memory.dmp

                                                                    Filesize

                                                                    908KB

                                                                  • memory/4364-8-0x0000000000A30000-0x0000000000A31000-memory.dmp

                                                                    Filesize

                                                                    4KB

                                                                  • memory/4364-1-0x00000000005A0000-0x00000000006A0000-memory.dmp

                                                                    Filesize

                                                                    1024KB

                                                                  • memory/4364-5-0x0000000000590000-0x0000000000591000-memory.dmp

                                                                    Filesize

                                                                    4KB

                                                                  • memory/4364-2-0x00000000004F0000-0x0000000000570000-memory.dmp

                                                                    Filesize

                                                                    512KB

                                                                  • memory/4364-3227-0x0000000000400000-0x00000000004E3000-memory.dmp

                                                                    Filesize

                                                                    908KB

                                                                  • memory/4364-17514-0x0000000000400000-0x00000000004E3000-memory.dmp

                                                                    Filesize

                                                                    908KB

                                                                  • memory/4364-17515-0x0000000000580000-0x0000000000581000-memory.dmp

                                                                    Filesize

                                                                    4KB

                                                                  • memory/4364-17517-0x00000000004F0000-0x0000000000570000-memory.dmp

                                                                    Filesize

                                                                    512KB