Resubmissions

21-01-2024 14:52

240121-r8syqaeac7 10

21-01-2024 14:51

240121-r8k8waeac5 10

01-01-2024 13:55

240101-q776kscacp 10

Analysis

  • max time kernel
    145s
  • max time network
    153s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    21-01-2024 14:52

General

  • Target

    365712147d687fb2eb2d5cb612586c7d3d7364277441491a3ab379a4a1128ba7.exe

  • Size

    450KB

  • MD5

    e70b33103c17c000ac11025d2d8e70a1

  • SHA1

    df898d9d0e8e6f2d4eb5d4742d4c206092cdcb34

  • SHA256

    365712147d687fb2eb2d5cb612586c7d3d7364277441491a3ab379a4a1128ba7

  • SHA512

    632461a9c6bff4e013cf3e77a7262d1daaa8775156c61c70dab685ae59114b22d00a47a0214204f6c514c6be77ad5b0c371a889076072fdb1eaf574cb6d4c42c

  • SSDEEP

    12288:krYn2GbqdcOuAKi1kcwyEOywAx1gT+yFCv6oE4E:kcNbqdFtVkcwyEOix1GtFCv6F4E

Score
10/10

Malware Config

Extracted

Path

C:\PerfLogs\readme.txt

Ransom Note
Dear user! Your computer is encrypted! We demand a ransom! Decryption service is paid !!!! PAYMENT FOR BITCOIN !!! To decrypt your computer, you need to download the TOR browser at https://www.torproject.org/download/ Install it and visit our website for further action http://paymen45oxzpnouz.onion/f1d3a75b0b Also from your servers files, documents, databases SQL, PDF were uploaded to our cloud storage After we agree, you will receive a decryption program, valuable advice in order not to fall into this situation in the future, as well as all your files on our server will be deleted. Otherwise, they will fall into the open access of the Internet! Use any third party software for restoring your data or antivirus solutions will result in a loose of data. Please be sure that we will find common languge. We will restore all the data and give you recommedations how to configure the protection of your server.
URLs

http://paymen45oxzpnouz.onion/f1d3a75b0b

Signatures

  • Renames multiple (7179) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops desktop.ini file(s) 30 IoCs
  • Drops file in System32 directory 6 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 31 IoCs
  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Delays execution with timeout.exe 1 IoCs
  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies data under HKEY_USERS 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\365712147d687fb2eb2d5cb612586c7d3d7364277441491a3ab379a4a1128ba7.exe
    "C:\Users\Admin\AppData\Local\Temp\365712147d687fb2eb2d5cb612586c7d3d7364277441491a3ab379a4a1128ba7.exe"
    1⤵
    • Checks computer location settings
    • Drops desktop.ini file(s)
    • Drops file in Program Files directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:1480
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1480 -s 524
      2⤵
      • Program crash
      PID:452
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1480 -s 600
      2⤵
      • Program crash
      PID:2104
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1480 -s 676
      2⤵
      • Program crash
      PID:4936
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1480 -s 716
      2⤵
      • Program crash
      PID:3444
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1480 -s 724
      2⤵
      • Program crash
      PID:4764
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1480 -s 692
      2⤵
      • Program crash
      PID:5068
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1480 -s 712
      2⤵
      • Program crash
      PID:3412
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1480 -s 684
      2⤵
      • Program crash
      PID:4992
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1480 -s 728
      2⤵
      • Program crash
      PID:656
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1480 -s 740
      2⤵
      • Program crash
      PID:2680
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1480 -s 676
      2⤵
      • Program crash
      PID:1256
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1480 -s 732
      2⤵
      • Program crash
      PID:3972
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1480 -s 828
      2⤵
      • Program crash
      PID:1144
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1480 -s 852
      2⤵
      • Program crash
      PID:344
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1480 -s 872
      2⤵
      • Program crash
      PID:5504
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1480 -s 676
      2⤵
      • Program crash
      PID:7216
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1480 -s 676
      2⤵
      • Program crash
      PID:6040
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1480 -s 704
      2⤵
      • Program crash
      PID:6964
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1480 -s 976
      2⤵
      • Program crash
      PID:6348
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1480 -s 944
      2⤵
      • Program crash
      PID:5496
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1480 -s 976
      2⤵
      • Program crash
      PID:7808
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1480 -s 904
      2⤵
      • Program crash
      PID:6772
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1480 -s 988
      2⤵
      • Program crash
      PID:2200
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1480 -s 824
      2⤵
      • Program crash
      PID:3080
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1480 -s 972
      2⤵
      • Program crash
      PID:7260
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1480 -s 528
      2⤵
      • Program crash
      PID:1916
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1480 -s 740
      2⤵
      • Program crash
      PID:876
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1480 -s 740
      2⤵
      • Program crash
      PID:3612
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1480 -s 1044
      2⤵
      • Program crash
      PID:7460
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1480 -s 968
      2⤵
      • Program crash
      PID:7616
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /c timeout 1 && del "C:\Users\Admin\AppData\Local\Temp\365712147d687fb2eb2d5cb612586c7d3d7364277441491a3ab379a4a1128ba7.exe" >> NUL
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:7220
      • C:\Windows\SysWOW64\timeout.exe
        timeout 1
        3⤵
        • Delays execution with timeout.exe
        PID:5596
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1480 -s 668
      2⤵
      • Program crash
      PID:7860
  • C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe
    "C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service
    1⤵
    • Drops file in System32 directory
    • Checks processor information in registry
    • Enumerates system info in registry
    • Modifies data under HKEY_USERS
    • Suspicious use of SetWindowsHookEx
    PID:3348
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1480 -ip 1480
    1⤵
      PID:3932
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 1480 -ip 1480
      1⤵
        PID:2264
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 1480 -ip 1480
        1⤵
          PID:4904
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 1480 -ip 1480
          1⤵
            PID:1348
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -pss -s 572 -p 1480 -ip 1480
            1⤵
              PID:3676
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -pss -s 568 -p 1480 -ip 1480
              1⤵
                PID:4108
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 1480 -ip 1480
                1⤵
                  PID:1344
                • C:\Windows\SysWOW64\WerFault.exe
                  C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 1480 -ip 1480
                  1⤵
                    PID:5004
                  • C:\Windows\SysWOW64\WerFault.exe
                    C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 1480 -ip 1480
                    1⤵
                      PID:2272
                    • C:\Windows\SysWOW64\WerFault.exe
                      C:\Windows\SysWOW64\WerFault.exe -pss -s 592 -p 1480 -ip 1480
                      1⤵
                        PID:3700
                      • C:\Windows\SysWOW64\WerFault.exe
                        C:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 1480 -ip 1480
                        1⤵
                          PID:2024
                        • C:\Windows\SysWOW64\WerFault.exe
                          C:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 1480 -ip 1480
                          1⤵
                            PID:4544
                          • C:\Windows\SysWOW64\WerFault.exe
                            C:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 1480 -ip 1480
                            1⤵
                              PID:1184
                            • C:\Windows\SysWOW64\WerFault.exe
                              C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 1480 -ip 1480
                              1⤵
                                PID:3624
                              • C:\Windows\SysWOW64\WerFault.exe
                                C:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 1480 -ip 1480
                                1⤵
                                  PID:5052
                                • C:\Windows\SysWOW64\WerFault.exe
                                  C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 1480 -ip 1480
                                  1⤵
                                    PID:7388
                                  • C:\Windows\SysWOW64\WerFault.exe
                                    C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 1480 -ip 1480
                                    1⤵
                                      PID:6528
                                    • C:\Windows\SysWOW64\WerFault.exe
                                      C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 1480 -ip 1480
                                      1⤵
                                        PID:6640
                                      • C:\Windows\SysWOW64\WerFault.exe
                                        C:\Windows\SysWOW64\WerFault.exe -pss -s 484 -p 1480 -ip 1480
                                        1⤵
                                          PID:1744
                                        • C:\Windows\SysWOW64\WerFault.exe
                                          C:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 1480 -ip 1480
                                          1⤵
                                            PID:7164
                                          • C:\Windows\SysWOW64\WerFault.exe
                                            C:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 1480 -ip 1480
                                            1⤵
                                              PID:2188
                                            • C:\Windows\SysWOW64\WerFault.exe
                                              C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 1480 -ip 1480
                                              1⤵
                                                PID:6764
                                              • C:\Windows\SysWOW64\WerFault.exe
                                                C:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 1480 -ip 1480
                                                1⤵
                                                  PID:7256
                                                • C:\Windows\SysWOW64\WerFault.exe
                                                  C:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 1480 -ip 1480
                                                  1⤵
                                                    PID:3596
                                                  • C:\Windows\SysWOW64\WerFault.exe
                                                    C:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 1480 -ip 1480
                                                    1⤵
                                                      PID:7868
                                                    • C:\Windows\SysWOW64\WerFault.exe
                                                      C:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 1480 -ip 1480
                                                      1⤵
                                                        PID:7428
                                                      • C:\Windows\SysWOW64\WerFault.exe
                                                        C:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 1480 -ip 1480
                                                        1⤵
                                                          PID:572
                                                        • C:\Windows\SysWOW64\WerFault.exe
                                                          C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 1480 -ip 1480
                                                          1⤵
                                                            PID:7300
                                                          • C:\Windows\SysWOW64\WerFault.exe
                                                            C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 1480 -ip 1480
                                                            1⤵
                                                              PID:7900
                                                            • C:\Windows\SysWOW64\WerFault.exe
                                                              C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 1480 -ip 1480
                                                              1⤵
                                                                PID:5436
                                                              • C:\Windows\SysWOW64\WerFault.exe
                                                                C:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 1480 -ip 1480
                                                                1⤵
                                                                  PID:7816

                                                                Network

                                                                MITRE ATT&CK Enterprise v15

                                                                Replay Monitor

                                                                Loading Replay Monitor...

                                                                Downloads

                                                                • C:\$Recycle.Bin\S-1-5-21-3336304223-2978740688-3645194410-1000\desktop.ini

                                                                  Filesize

                                                                  649B

                                                                  MD5

                                                                  f55a5324803ba068b7d8a811a7055c9c

                                                                  SHA1

                                                                  34a528c0dcfbcb313003559204733ea693af0473

                                                                  SHA256

                                                                  037a49d828b7e92af3b28863c6501775618e694d6a94cb64e9428337cb48238c

                                                                  SHA512

                                                                  d3087e87c76cb8c003e7e6957e3c40079c7c297df496e0e4314c3dcc8a0cc9ca8123141bab342e7cce60f3f5d197aea10c373c55f365867c4fcb012589aafce5

                                                                • C:\PerfLogs\readme.txt

                                                                  Filesize

                                                                  1KB

                                                                  MD5

                                                                  6d84f6b756232e7bcdf06619d2f0e450

                                                                  SHA1

                                                                  f24b044bf355d5051a59fa6d0189cc80d93fa9da

                                                                  SHA256

                                                                  9a59bc9a3a4b3ab0a623e8459c6a1f5810bdbf1aef268324dd7f5c387c4a14eb

                                                                  SHA512

                                                                  88b9364481753e6f96e61e2dee2facf5f34ba04a000254814d4fb579a04f259eb0d017786d91ac015fc548997e0f37da29a7388bfac511f2a0615d29e0309d78

                                                                • memory/1480-4540-0x00000000007E0000-0x00000000008E0000-memory.dmp

                                                                  Filesize

                                                                  1024KB

                                                                • memory/1480-5-0x00000000007D0000-0x00000000007D1000-memory.dmp

                                                                  Filesize

                                                                  4KB

                                                                • memory/1480-6118-0x0000000000400000-0x00000000004DD000-memory.dmp

                                                                  Filesize

                                                                  884KB

                                                                • memory/1480-6-0x00000000007C0000-0x00000000007C1000-memory.dmp

                                                                  Filesize

                                                                  4KB

                                                                • memory/1480-8-0x0000000000780000-0x00000000007C0000-memory.dmp

                                                                  Filesize

                                                                  256KB

                                                                • memory/1480-9-0x0000000000780000-0x00000000007C0000-memory.dmp

                                                                  Filesize

                                                                  256KB

                                                                • memory/1480-10-0x00000000007C0000-0x00000000007C1000-memory.dmp

                                                                  Filesize

                                                                  4KB

                                                                • memory/1480-11-0x0000000000400000-0x00000000004DD000-memory.dmp

                                                                  Filesize

                                                                  884KB

                                                                • memory/1480-7735-0x0000000002280000-0x0000000002300000-memory.dmp

                                                                  Filesize

                                                                  512KB

                                                                • memory/1480-2-0x0000000002280000-0x0000000002300000-memory.dmp

                                                                  Filesize

                                                                  512KB

                                                                • memory/1480-17555-0x0000000000780000-0x000000000079B000-memory.dmp

                                                                  Filesize

                                                                  108KB

                                                                • memory/1480-3-0x0000000000400000-0x00000000004DD000-memory.dmp

                                                                  Filesize

                                                                  884KB

                                                                • memory/1480-4-0x0000000000780000-0x00000000007C0000-memory.dmp

                                                                  Filesize

                                                                  256KB

                                                                • memory/1480-8507-0x0000000000780000-0x00000000007C0000-memory.dmp

                                                                  Filesize

                                                                  256KB

                                                                • memory/1480-9897-0x0000000000400000-0x00000000004DD000-memory.dmp

                                                                  Filesize

                                                                  884KB

                                                                • memory/1480-9898-0x00000000007D0000-0x00000000007D1000-memory.dmp

                                                                  Filesize

                                                                  4KB

                                                                • memory/1480-15325-0x00000000007C0000-0x00000000007C1000-memory.dmp

                                                                  Filesize

                                                                  4KB

                                                                • memory/1480-17551-0x0000000000780000-0x00000000007C0000-memory.dmp

                                                                  Filesize

                                                                  256KB

                                                                • memory/1480-17552-0x0000000000780000-0x00000000007C0000-memory.dmp

                                                                  Filesize

                                                                  256KB

                                                                • memory/1480-17554-0x00000000007C0000-0x00000000007C1000-memory.dmp

                                                                  Filesize

                                                                  4KB

                                                                • memory/1480-17553-0x0000000000400000-0x00000000004DD000-memory.dmp

                                                                  Filesize

                                                                  884KB

                                                                • memory/1480-1-0x00000000007E0000-0x00000000008E0000-memory.dmp

                                                                  Filesize

                                                                  1024KB