ee65e9d7a7bc9d17e894e0b775fc0bbfb35e72c65c3d768e34bfe059d521cc16

Resubmissions

21-01-2024 14:52

240121-r8syqaeac7 10

21-01-2024 14:51

240121-r8k8waeac5 10

01-01-2024 13:55

240101-q776kscacp 10

Analysis

max time kernel
119s
max time network
123s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
21-01-2024 14:52

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

365712147d687fb2eb2d5cb612586c7d3d7364277441491a3ab379a4a1128ba7.exe
Size

450KB
MD5

e70b33103c17c000ac11025d2d8e70a1
SHA1

df898d9d0e8e6f2d4eb5d4742d4c206092cdcb34
SHA256

365712147d687fb2eb2d5cb612586c7d3d7364277441491a3ab379a4a1128ba7
SHA512

632461a9c6bff4e013cf3e77a7262d1daaa8775156c61c70dab685ae59114b22d00a47a0214204f6c514c6be77ad5b0c371a889076072fdb1eaf574cb6d4c42c
SSDEEP

12288:krYn2GbqdcOuAKi1kcwyEOywAx1gT+yFCv6oE4E:kcNbqdFtVkcwyEOix1GtFCv6F4E

Score

10^/10

ransomware

Malware Config

Extracted

Path

C:\$Recycle.Bin\readme.txt

Ransom Note

Dear user! Your computer is encrypted! We demand a ransom! Decryption service is paid !!!! PAYMENT FOR BITCOIN !!! To decrypt your computer, you need to download the TOR browser at https://www.torproject.org/download/ Install it and visit our website for further action http://paymen45oxzpnouz.onion/a08e87d5a7 Also from your servers files, documents, databases SQL, PDF were uploaded to our cloud storage After we agree, you will receive a decryption program, valuable advice in order not to fall into this situation in the future, as well as all your files on our server will be deleted. Otherwise, they will fall into the open access of the Internet! Use any third party software for restoring your data or antivirus solutions will result in a loose of data. Please be sure that we will find common languge. We will restore all the data and give you recommedations how to configure the protection of your server.

URLs

http://paymen45oxzpnouz.onion/a08e87d5a7

Signatures

Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware

File Deletion
T1070.004

Inhibit System Recovery
T1490
Renames multiple (8412) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Deletes itself 1 IoCs

pid	Process
3224	cmd.exe

Drops desktop.ini file(s) 40 IoCs

description	ioc	Process
File opened for modification	C:\$Recycle.Bin\S-1-5-21-1268429524-3929314613-1992311491-1000\desktop.ini	365712147d687fb2eb2d5cb612586c7d3d7364277441491a3ab379a4a1128ba7.exe
File opened for modification	C:\Users\Public\Desktop\desktop.ini	365712147d687fb2eb2d5cb612586c7d3d7364277441491a3ab379a4a1128ba7.exe
File opened for modification	C:\Users\Public\Documents\desktop.ini	365712147d687fb2eb2d5cb612586c7d3d7364277441491a3ab379a4a1128ba7.exe
File opened for modification	C:\Users\Public\Music\desktop.ini	365712147d687fb2eb2d5cb612586c7d3d7364277441491a3ab379a4a1128ba7.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\Stationery\Desktop.ini	365712147d687fb2eb2d5cb612586c7d3d7364277441491a3ab379a4a1128ba7.exe
File opened for modification	C:\Program Files\Microsoft Games\FreeCell\desktop.ini	365712147d687fb2eb2d5cb612586c7d3d7364277441491a3ab379a4a1128ba7.exe
File opened for modification	C:\Users\Admin\Contacts\desktop.ini	365712147d687fb2eb2d5cb612586c7d3d7364277441491a3ab379a4a1128ba7.exe
File opened for modification	C:\Users\Admin\Desktop\desktop.ini	365712147d687fb2eb2d5cb612586c7d3d7364277441491a3ab379a4a1128ba7.exe
File opened for modification	C:\Users\Public\Pictures\Sample Pictures\desktop.ini	365712147d687fb2eb2d5cb612586c7d3d7364277441491a3ab379a4a1128ba7.exe
File opened for modification	C:\Users\Public\Videos\desktop.ini	365712147d687fb2eb2d5cb612586c7d3d7364277441491a3ab379a4a1128ba7.exe
File opened for modification	C:\Users\Admin\Favorites\Links for United States\desktop.ini	365712147d687fb2eb2d5cb612586c7d3d7364277441491a3ab379a4a1128ba7.exe
File opened for modification	C:\Users\Admin\Links\desktop.ini	365712147d687fb2eb2d5cb612586c7d3d7364277441491a3ab379a4a1128ba7.exe
File opened for modification	C:\Users\Admin\Searches\desktop.ini	365712147d687fb2eb2d5cb612586c7d3d7364277441491a3ab379a4a1128ba7.exe
File opened for modification	C:\Users\Admin\Videos\desktop.ini	365712147d687fb2eb2d5cb612586c7d3d7364277441491a3ab379a4a1128ba7.exe
File opened for modification	C:\Users\Admin\Saved Games\desktop.ini	365712147d687fb2eb2d5cb612586c7d3d7364277441491a3ab379a4a1128ba7.exe
File opened for modification	C:\Users\Public\Libraries\desktop.ini	365712147d687fb2eb2d5cb612586c7d3d7364277441491a3ab379a4a1128ba7.exe
File opened for modification	C:\Users\Public\Music\Sample Music\desktop.ini	365712147d687fb2eb2d5cb612586c7d3d7364277441491a3ab379a4a1128ba7.exe
File opened for modification	C:\Users\Public\Recorded TV\Sample Media\desktop.ini	365712147d687fb2eb2d5cb612586c7d3d7364277441491a3ab379a4a1128ba7.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\Stationery\Desktop.ini	365712147d687fb2eb2d5cb612586c7d3d7364277441491a3ab379a4a1128ba7.exe
File opened for modification	C:\Program Files (x86)\desktop.ini	365712147d687fb2eb2d5cb612586c7d3d7364277441491a3ab379a4a1128ba7.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\DataServices\DESKTOP.INI	365712147d687fb2eb2d5cb612586c7d3d7364277441491a3ab379a4a1128ba7.exe
File opened for modification	C:\Users\Admin\Favorites\desktop.ini	365712147d687fb2eb2d5cb612586c7d3d7364277441491a3ab379a4a1128ba7.exe
File opened for modification	C:\Users\Admin\Downloads\desktop.ini	365712147d687fb2eb2d5cb612586c7d3d7364277441491a3ab379a4a1128ba7.exe
File opened for modification	C:\Users\Admin\Favorites\Links\desktop.ini	365712147d687fb2eb2d5cb612586c7d3d7364277441491a3ab379a4a1128ba7.exe
File opened for modification	C:\Users\Admin\Pictures\desktop.ini	365712147d687fb2eb2d5cb612586c7d3d7364277441491a3ab379a4a1128ba7.exe
File opened for modification	C:\Users\Public\Downloads\desktop.ini	365712147d687fb2eb2d5cb612586c7d3d7364277441491a3ab379a4a1128ba7.exe
File opened for modification	F:\$RECYCLE.BIN\S-1-5-21-1268429524-3929314613-1992311491-1000\desktop.ini	365712147d687fb2eb2d5cb612586c7d3d7364277441491a3ab379a4a1128ba7.exe
File opened for modification	C:\Program Files\desktop.ini	365712147d687fb2eb2d5cb612586c7d3d7364277441491a3ab379a4a1128ba7.exe
File opened for modification	C:\Program Files\Microsoft Games\Mahjong\desktop.ini	365712147d687fb2eb2d5cb612586c7d3d7364277441491a3ab379a4a1128ba7.exe
File opened for modification	C:\Users\Admin\Documents\desktop.ini	365712147d687fb2eb2d5cb612586c7d3d7364277441491a3ab379a4a1128ba7.exe
File opened for modification	C:\Users\Public\Recorded TV\desktop.ini	365712147d687fb2eb2d5cb612586c7d3d7364277441491a3ab379a4a1128ba7.exe
File opened for modification	C:\Program Files\Microsoft Games\Solitaire\desktop.ini	365712147d687fb2eb2d5cb612586c7d3d7364277441491a3ab379a4a1128ba7.exe
File opened for modification	C:\Users\Public\Videos\Sample Videos\desktop.ini	365712147d687fb2eb2d5cb612586c7d3d7364277441491a3ab379a4a1128ba7.exe
File opened for modification	C:\Program Files\Microsoft Games\Hearts\desktop.ini	365712147d687fb2eb2d5cb612586c7d3d7364277441491a3ab379a4a1128ba7.exe
File opened for modification	C:\Users\Admin\Music\desktop.ini	365712147d687fb2eb2d5cb612586c7d3d7364277441491a3ab379a4a1128ba7.exe
File opened for modification	C:\Users\Public\Pictures\desktop.ini	365712147d687fb2eb2d5cb612586c7d3d7364277441491a3ab379a4a1128ba7.exe
File opened for modification	C:\Program Files\Microsoft Games\Chess\desktop.ini	365712147d687fb2eb2d5cb612586c7d3d7364277441491a3ab379a4a1128ba7.exe
File opened for modification	C:\Program Files\Microsoft Games\Purble Place\desktop.ini	365712147d687fb2eb2d5cb612586c7d3d7364277441491a3ab379a4a1128ba7.exe
File opened for modification	C:\Program Files\Microsoft Games\SpiderSolitaire\desktop.ini	365712147d687fb2eb2d5cb612586c7d3d7364277441491a3ab379a4a1128ba7.exe
File opened for modification	C:\Users\Public\desktop.ini	365712147d687fb2eb2d5cb612586c7d3d7364277441491a3ab379a4a1128ba7.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	365712147d687fb2eb2d5cb612586c7d3d7364277441491a3ab379a4a1128ba7.exe
File opened for modification	C:\Program Files\Windows Defender\fr-FR\MsMpRes.dll.mui	365712147d687fb2eb2d5cb612586c7d3d7364277441491a3ab379a4a1128ba7.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0234001.WMF	365712147d687fb2eb2d5cb612586c7d3d7364277441491a3ab379a4a1128ba7.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\CONVERT\DELIMDOS.FAE	365712147d687fb2eb2d5cb612586c7d3d7364277441491a3ab379a4a1128ba7.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\Slate\TAB_OFF.GIF	365712147d687fb2eb2d5cb612586c7d3d7364277441491a3ab379a4a1128ba7.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Indian\Reunion	365712147d687fb2eb2d5cb612586c7d3d7364277441491a3ab379a4a1128ba7.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\INDUST\INDUST.INF	365712147d687fb2eb2d5cb612586c7d3d7364277441491a3ab379a4a1128ba7.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main.xml	365712147d687fb2eb2d5cb612586c7d3d7364277441491a3ab379a4a1128ba7.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\Shatter\NavigationRight_ButtonGraphic.png	365712147d687fb2eb2d5cb612586c7d3d7364277441491a3ab379a4a1128ba7.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\EST	365712147d687fb2eb2d5cb612586c7d3d7364277441491a3ab379a4a1128ba7.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\es-ES\css\settings.css	365712147d687fb2eb2d5cb612586c7d3d7364277441491a3ab379a4a1128ba7.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBSPAPR\ZPDIR45F.GIF	365712147d687fb2eb2d5cb612586c7d3d7364277441491a3ab379a4a1128ba7.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolBMPs\OutlineToolIconImagesMask.bmp	365712147d687fb2eb2d5cb612586c7d3d7364277441491a3ab379a4a1128ba7.exe
File created	C:\Program Files (x86)\Windows Defender\de-DE\readme.txt	365712147d687fb2eb2d5cb612586c7d3d7364277441491a3ab379a4a1128ba7.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0090390.WMF	365712147d687fb2eb2d5cb612586c7d3d7364277441491a3ab379a4a1128ba7.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\IA32.api	365712147d687fb2eb2d5cb612586c7d3d7364277441491a3ab379a4a1128ba7.exe
File created	C:\Program Files (x86)\Microsoft Office\Office14\FORMS\1033\readme.txt	365712147d687fb2eb2d5cb612586c7d3d7364277441491a3ab379a4a1128ba7.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\16_9-frame-image-mask.png	365712147d687fb2eb2d5cb612586c7d3d7364277441491a3ab379a4a1128ba7.exe
File opened for modification	C:\Program Files\SuspendUpdate.M2TS	365712147d687fb2eb2d5cb612586c7d3d7364277441491a3ab379a4a1128ba7.exe
File created	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\FieldTypePreview\readme.txt	365712147d687fb2eb2d5cb612586c7d3d7364277441491a3ab379a4a1128ba7.exe
File created	C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Cultures\readme.txt	365712147d687fb2eb2d5cb612586c7d3d7364277441491a3ab379a4a1128ba7.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\EXPLR_01.MID	365712147d687fb2eb2d5cb612586c7d3d7364277441491a3ab379a4a1128ba7.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0233665.WMF	365712147d687fb2eb2d5cb612586c7d3d7364277441491a3ab379a4a1128ba7.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\mobile_browse.html	365712147d687fb2eb2d5cb612586c7d3d7364277441491a3ab379a4a1128ba7.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Templates\1033\Access\Part\Tabs.accdt	365712147d687fb2eb2d5cb612586c7d3d7364277441491a3ab379a4a1128ba7.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\css\e4_default_winxp_olv.css	365712147d687fb2eb2d5cb612586c7d3d7364277441491a3ab379a4a1128ba7.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\VideoWall\videowall.png	365712147d687fb2eb2d5cb612586c7d3d7364277441491a3ab379a4a1128ba7.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\PH02417U.BMP	365712147d687fb2eb2d5cb612586c7d3d7364277441491a3ab379a4a1128ba7.exe
File created	C:\Program Files\VideoLAN\VLC\lua\http\css\ui-lightness\images\readme.txt	365712147d687fb2eb2d5cb612586c7d3d7364277441491a3ab379a4a1128ba7.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\images\cronometer.png	365712147d687fb2eb2d5cb612586c7d3d7364277441491a3ab379a4a1128ba7.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\images\settings_corner_top_left.png	365712147d687fb2eb2d5cb612586c7d3d7364277441491a3ab379a4a1128ba7.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\org.eclipse.equinox.p2.core\cache\binary\com.oracle.jmc.executable.win32.win32.x86_64_5.5.0	365712147d687fb2eb2d5cb612586c7d3d7364277441491a3ab379a4a1128ba7.exe
File opened for modification	C:\Program Files\Mozilla Firefox\dependentlibs.list	365712147d687fb2eb2d5cb612586c7d3d7364277441491a3ab379a4a1128ba7.exe
File created	C:\Program Files (x86)\Windows Defender\ja-JP\readme.txt	365712147d687fb2eb2d5cb612586c7d3d7364277441491a3ab379a4a1128ba7.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\WATER\PREVIEW.GIF	365712147d687fb2eb2d5cb612586c7d3d7364277441491a3ab379a4a1128ba7.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Dhaka	365712147d687fb2eb2d5cb612586c7d3d7364277441491a3ab379a4a1128ba7.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\XML Files\Messenger.xml	365712147d687fb2eb2d5cb612586c7d3d7364277441491a3ab379a4a1128ba7.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\content-background.png	365712147d687fb2eb2d5cb612586c7d3d7364277441491a3ab379a4a1128ba7.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\es-ES\js\init.js	365712147d687fb2eb2d5cb612586c7d3d7364277441491a3ab379a4a1128ba7.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\btn_close_over.png	365712147d687fb2eb2d5cb612586c7d3d7364277441491a3ab379a4a1128ba7.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\IPSEventLogMsg.dll.mui	365712147d687fb2eb2d5cb612586c7d3d7364277441491a3ab379a4a1128ba7.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\Smart Tag\SmartTagInstall.exe	365712147d687fb2eb2d5cb612586c7d3d7364277441491a3ab379a4a1128ba7.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Africa\Khartoum	365712147d687fb2eb2d5cb612586c7d3d7364277441491a3ab379a4a1128ba7.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Srednekolymsk	365712147d687fb2eb2d5cb612586c7d3d7364277441491a3ab379a4a1128ba7.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.osgi.nl_ja_4.4.0.v20140623020002.jar	365712147d687fb2eb2d5cb612586c7d3d7364277441491a3ab379a4a1128ba7.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\readme.txt	365712147d687fb2eb2d5cb612586c7d3d7364277441491a3ab379a4a1128ba7.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\NA02262_.WMF	365712147d687fb2eb2d5cb612586c7d3d7364277441491a3ab379a4a1128ba7.exe
File opened for modification	C:\Program Files (x86)\Windows Media Player\Media Renderer\DMR_48.jpg	365712147d687fb2eb2d5cb612586c7d3d7364277441491a3ab379a4a1128ba7.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\fr-FR\gadget.xml	365712147d687fb2eb2d5cb612586c7d3d7364277441491a3ab379a4a1128ba7.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0107526.WMF	365712147d687fb2eb2d5cb612586c7d3d7364277441491a3ab379a4a1128ba7.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\SY01252_.WMF	365712147d687fb2eb2d5cb612586c7d3d7364277441491a3ab379a4a1128ba7.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\ru-RU\tipresx.dll.mui	365712147d687fb2eb2d5cb612586c7d3d7364277441491a3ab379a4a1128ba7.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\SOCIALCONNECTORRES.DLL	365712147d687fb2eb2d5cb612586c7d3d7364277441491a3ab379a4a1128ba7.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\Stacking\720x480icongraphic.png	365712147d687fb2eb2d5cb612586c7d3d7364277441491a3ab379a4a1128ba7.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.apache.lucene.analysis_3.5.0.v20120725-1805.jar	365712147d687fb2eb2d5cb612586c7d3d7364277441491a3ab379a4a1128ba7.exe
File opened for modification	C:\Program Files (x86)\Common Files\System\Ole DB\ja-JP\sqlxmlx.rll.mui	365712147d687fb2eb2d5cb612586c7d3d7364277441491a3ab379a4a1128ba7.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0157177.WMF	365712147d687fb2eb2d5cb612586c7d3d7364277441491a3ab379a4a1128ba7.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0282126.WMF	365712147d687fb2eb2d5cb612586c7d3d7364277441491a3ab379a4a1128ba7.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\db\bin\ij	365712147d687fb2eb2d5cb612586c7d3d7364277441491a3ab379a4a1128ba7.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\meta\art\01_googleimage.luac	365712147d687fb2eb2d5cb612586c7d3d7364277441491a3ab379a4a1128ba7.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0105396.WMF	365712147d687fb2eb2d5cb612586c7d3d7364277441491a3ab379a4a1128ba7.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBSPAPR\ZPDIR10F.GIF	365712147d687fb2eb2d5cb612586c7d3d7364277441491a3ab379a4a1128ba7.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\button_right_over.gif	365712147d687fb2eb2d5cb612586c7d3d7364277441491a3ab379a4a1128ba7.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\MSTORE.EXE	365712147d687fb2eb2d5cb612586c7d3d7364277441491a3ab379a4a1128ba7.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Delays execution with timeout.exe 1 IoCs

evasion

pid	Process
3260	timeout.exe

Interacts with shadow copies 2 TTPs 1 IoCs

Shadow copies are often targeted by ransomware to inhibit system recovery.

ransomware

File Deletion

T1070.004

Inhibit System Recovery

T1490

pid	Process
2788	vssadmin.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2052	365712147d687fb2eb2d5cb612586c7d3d7364277441491a3ab379a4a1128ba7.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeBackupPrivilege	2572	vssvc.exe
Token: SeRestorePrivilege	2572	vssvc.exe
Token: SeAuditPrivilege	2572	vssvc.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 2052 wrote to memory of 2788	2052	365712147d687fb2eb2d5cb612586c7d3d7364277441491a3ab379a4a1128ba7.exe	28
PID 2052 wrote to memory of 2788	2052	365712147d687fb2eb2d5cb612586c7d3d7364277441491a3ab379a4a1128ba7.exe	28
PID 2052 wrote to memory of 2788	2052	365712147d687fb2eb2d5cb612586c7d3d7364277441491a3ab379a4a1128ba7.exe	28
PID 2052 wrote to memory of 2788	2052	365712147d687fb2eb2d5cb612586c7d3d7364277441491a3ab379a4a1128ba7.exe	28
PID 2052 wrote to memory of 3224	2052	365712147d687fb2eb2d5cb612586c7d3d7364277441491a3ab379a4a1128ba7.exe	33
PID 2052 wrote to memory of 3224	2052	365712147d687fb2eb2d5cb612586c7d3d7364277441491a3ab379a4a1128ba7.exe	33
PID 2052 wrote to memory of 3224	2052	365712147d687fb2eb2d5cb612586c7d3d7364277441491a3ab379a4a1128ba7.exe	33
PID 2052 wrote to memory of 3224	2052	365712147d687fb2eb2d5cb612586c7d3d7364277441491a3ab379a4a1128ba7.exe	33
PID 3224 wrote to memory of 3260	3224	cmd.exe	35
PID 3224 wrote to memory of 3260	3224	cmd.exe	35
PID 3224 wrote to memory of 3260	3224	cmd.exe	35
PID 3224 wrote to memory of 3260	3224	cmd.exe	35

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\365712147d687fb2eb2d5cb612586c7d3d7364277441491a3ab379a4a1128ba7.exe
"C:\Users\Admin\AppData\Local\Temp\365712147d687fb2eb2d5cb612586c7d3d7364277441491a3ab379a4a1128ba7.exe"
1⤵
- Drops desktop.ini file(s)
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2052
- C:\Windows\SysWOW64\vssadmin.exe
  vssadmin delete shadows /all /quiet
  2⤵
  - Interacts with shadow copies
  PID:2788
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /c timeout 1 && del "C:\Users\Admin\AppData\Local\Temp\365712147d687fb2eb2d5cb612586c7d3d7364277441491a3ab379a4a1128ba7.exe" >> NUL
  2⤵
  - Deletes itself
  - Suspicious use of WriteProcessMemory
  PID:3224
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    - Delays execution with timeout.exe
    PID:3260

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2572

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Indicator Removal

T1070

File Deletion

T1070.004

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-1268429524-3929314613-1992311491-1000\desktop.ini

Filesize
649B

MD5
86a323f45692066cc71e028e5c00fa63

SHA1
ff1b82801bd42e6fdb9b31f4fc69dbd3da44156d

SHA256
79970377990345ee1ea73f1273405b7d4fb48a2d96230ab1fce3b4e3746ee749

SHA512
689e1f37add93a014feadd2bbab7a7e1428e75e212aca788a2ff92bbb314218563aa36218e8388d00524e3a4c15e8331e0dabd051c5f1f69d837bee07db0211a

Download Submit
C:\$Recycle.Bin\readme.txt

Filesize
1KB

MD5
8d3d4dfef5dc32f2278f520d3e952244

SHA1
1a3e7e1fdea51b6ce3924ba71851f7125b2debf2

SHA256
d9b9434e33e7454a843043152e216d412b5c5753f61d1c9ce50bd7f0d7c46016

SHA512
296b7f7505f0af96dd33ecf7f8dcf14d69104072bb4463f0060343e71b29f104bc2a1557a500055f26a574fc44678e515dc0c3199286a90599599ac413fd1d2b

Download Submit
memory/2052-3-0x00000000002A0000-0x00000000002E0000-memory.dmp

Filesize
256KB

Download
memory/2052-13-0x0000000000400000-0x00000000004DD000-memory.dmp

Filesize
884KB

Download
memory/2052-2-0x0000000000320000-0x00000000003A0000-memory.dmp

Filesize
512KB

Download
memory/2052-9-0x00000000002A0000-0x00000000002E0000-memory.dmp

Filesize
256KB

Download
memory/2052-1-0x0000000000550000-0x0000000000650000-memory.dmp

Filesize
1024KB

Download
memory/2052-6705-0x0000000000400000-0x00000000004DD000-memory.dmp

Filesize
884KB

Download
memory/2052-6706-0x0000000000550000-0x0000000000650000-memory.dmp

Filesize
1024KB

Download
memory/2052-6708-0x0000000000320000-0x00000000003A0000-memory.dmp

Filesize
512KB

Download
memory/2052-9327-0x0000000000400000-0x00000000004DD000-memory.dmp

Filesize
884KB

Download
memory/2052-16376-0x0000000000400000-0x00000000004DD000-memory.dmp

Filesize
884KB

Download
memory/2052-18916-0x00000000002E0000-0x00000000002E1000-memory.dmp

Filesize
4KB

Download
memory/2052-18917-0x0000000000400000-0x00000000004DD000-memory.dmp

Filesize
884KB

Download