Overview

overview

10

Static

static

7

79468940d4...af.exe

windows7-x64

10

79468940d4...af.exe

windows10-2004-x64

10

out.exe

windows7-x64

out.exe

windows10-2004-x64

Analysis

  • max time kernel
    141s
  • max time network
    149s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    24/01/2024, 12:51

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    79468940d42d217a815eca555b9d2efe72b4f2a53e47d29076c3adde5eb9c5af.exe

  • Size

    1.8MB

  • MD5

    d156711735a2fb0992440a2cd0a19138

  • SHA1

    c8c9645ae15012eb25e83841d87a3ac6c16344aa

  • SHA256

    79468940d42d217a815eca555b9d2efe72b4f2a53e47d29076c3adde5eb9c5af

  • SHA512

    4d10a6a0c77e9bb5feba5a110da54e21ec201cbed7002b9a58a61087b0986e960fa7ba233bc111151ce8c145d2851720678923ee6306b35c169a8dd4bacf273c

  • SSDEEP

    49152:2NA8O1U5YwSTTEVOCT316+f0RbnRM13qE83q7rjjY/qg4wG:21dYNOOSE+f0RzRMdc3Afjtv

Score
10/10
evasionpersistenceransomwaretrojanupx

Malware Config

Extracted

Path

C:\PerfLogs\lockxx.recovery_data.hta

Ransom Note
<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/strict.dtd"> <html> <head> <meta http-equiv="Content-Type" content="text/html; charset=UTF-8" /> <title>How_To_Decrypt_My_File_</title> <style type="text/css"> body{font:15px Tahoma,sans-serif;margin:10px;line-height:25px;background:#EDEDED;}.bold{font-weight:bold;font-size:15px;color:#E53333;}.mark{background:#D0D0E8;padding:2px 5px;}.info{background:#D0D0E8;border-left:10px solid #00008B;}.note{height:auto;padding-bottom:1px;margin:15px 0;}.note .title{font-weight:bold;text-indent:10px;height:30px;line-height:30px;padding-top:10px;}.note .mark{background:#A2A2B5;}.note ul{margin-top:0;}.note pre{margin-left:15px;line-height:13px;font-size:13px;}}.lsb{display:none;margin:15px;text-align:center;}.ls{border:1px solid #888;border-radius:3px;padding:0 0.5em;margin:1em 0.1em;line-height:2em;display:inline-block;} </style> <script language="javascript"> function aIndexOf(arr,v){for(var i=0;i<arr.length;i++)if(arr[i]==v)return i;return-1} function tweakClass(cl,f){var els;if(document.getElementByClassName!=null){els=document.getElementsByClassName(cl)}else{els=[];var tmp=document.getElementsByTagName('*');for(var i=0;i<tmp.length;i++){var c=tmp[i].className;if((c==cl)||((c.indexOf(cl)!=1)&&((' '+c+' ').indexOf(' '+cl+' ')!=-1)))els.push(tmp[i])}}for(var i=0;i<els.length;i++)f(els[i])} function show(el){ el.style.display = 'block'; } function hide(el){ el.style.display = 'none'; } var langs=["en","zh"];var m1="[email protected]";var m2="[email protected]";var langName; var Terminal={language:(navigator.browserLanguage||navigator.language).toLowerCase()} switch(Terminal.language){case'zh-cn':langName="zh";break;default:langName="en";} function setLang(lang){if(aIndexOf(langs,lang)==-1)lang=langs[0];for(var i=0;i<langs.length;i++){var clang=langs[i];tweakClass('l-'+clang,function(el){el.style.display=(clang==lang)?'block':'none'});tweakClass('ls-'+clang,function(el){el.style.backgroundColor=(clang==lang)?'#BBB':''})}} function onPageLoaded(){try{tweakClass('lsb',show)}catch(e){}try{setLang(langName)}catch(e){}} </script> </head> <body onload="javascript:onPageLoaded()"> <div class="lsb"> <span class="ls ls-en" onclick="javascript:return setLang('en')">English</span> <span class="ls ls-zh" onclick="javascript:return setLang('zh')">Chinese</span> </div> <div class="container"> <div class="text l l-en" style="display:block"> The price depends on the speed at which you write to us . After payment , we will send you a decryption tool and assist you in decrypting all files <br /> <br /> <div class="bold"> Mail address ! </div> <ul> <span style="font-size:20px;color:#333333;"><script type="text/javascript">document.write(m1);</script></span> <br> <span style="font-size:20px;color:#333333;"><script type="text/javascript">document.write(m2);</script></span> </ul> <div class="bold"> Free decryption test as guarantee ! </div> <ul> <li>Integrity is our principle </li> <li>Before making the payment , you can send us a test file to prove that we are capable of recovering your data </li> </ul> <div class="bold"> Attention ! </div> <ul> <li>Decryption of your files with the help of third parties may cause increased price </li> <li>Do not try to decrypt your data using third party software , it may cause permanent data loss </li> <li>Please do not (edit, delete, rename) any files , otherwise it cannot be restored </li> </ul> </div> <div class="text l l-zh" style="display:block"> 价格取决于你给我们写信的速度 . 付款后 , 我们将向你发送解密工具 , 并协助你解密所有文件 <br /> <br /> <div class="bold"> 邮件地址 ! </div> <ul> <span style="font-size:20px;color:#333333;"><script type="text/javascript">document.write(m1);</script></span> <br> <span style="font-size:20px;color:#333333;"><script type="text/javascript">document.write(m2);</script></span> </ul> <div class="bold"> 免费解密测试作为保证 ! </div> <ul> <li>诚信是我们的原则</li> <li>在付款之前 , 你可以向我们发送测试文件以证明我们有能力恢复你的数据</li> </ul> <div class="bold"> 注意 ! </div> <ul> <li>在第三方的帮助下解密你的文件可能会导致价格上涨 </li> <li>请勿尝试使用第三方软件解密你的数据 , 这可能会导致数据永久丢失 </li> <li>请不要 (编辑, 删除, 重命名) 任何文件 , 否则无法恢复文件 </li> </ul> </div> <div class="note info"> <div class="title"> ID </div> <pre> dizI/y2N5Q4ynd9Y </pre> </div> </div> </body> </html>
Emails

m1="[email protected]";var

m2="[email protected]";var
URLs

http-equiv="Content-Type"

Signatures

  • UAC bypass 3 TTPs 3 IoCs
    evasiontrojan
  • Deletes shadow copies 2 TTPs

    Ransomware often targets backup files to inhibit system recovery.

    ransomware
  • Modifies boot configuration data using bcdedit 1 TTPs 2 IoCs
    ransomwareevasion
  • Renames multiple (373) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware
  • Deletes itself 1 IoCs
  • UPX packed file 4 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Checks whether UAC is enabled 1 TTPs 1 IoCs
    evasiontrojan
  • Drops desktop.ini file(s) 1 IoCs
  • Enumerates connected drives 3 TTPs 1 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Sets desktop wallpaper using registry 2 TTPs 1 IoCs
    ransomware
  • Drops file in Program Files directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Creates scheduled task(s) 1 TTPs 3 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistence
  • Interacts with shadow copies 2 TTPs 1 IoCs

    Shadow copies are often targeted by ransomware to inhibit system recovery.

    ransomware
  • Modifies Control Panel 2 IoCs
    evasion
  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 36 IoCs
  • System policy modification 1 TTPs 4 IoCs
    evasion
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\79468940d42d217a815eca555b9d2efe72b4f2a53e47d29076c3adde5eb9c5af.exe
    "C:\Users\Admin\AppData\Local\Temp\79468940d42d217a815eca555b9d2efe72b4f2a53e47d29076c3adde5eb9c5af.exe"
    1⤵
    • UAC bypass
    • Adds Run key to start application
    • Checks whether UAC is enabled
    • Drops desktop.ini file(s)
    • Enumerates connected drives
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    • System policy modification
    PID:2936
    • C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "wmic shadowcopy delete /nointeractive"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:4764
      • C:\Windows\System32\Wbem\WMIC.exe
        wmic shadowcopy delete /nointeractive
        3⤵
          PID:4620
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "bcdedit /set {default} recoveryenabled No"
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:3336
        • C:\Windows\system32\bcdedit.exe
          bcdedit /set {default} recoveryenabled No
          3⤵
          • Modifies boot configuration data using bcdedit
          PID:2852
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "bcdedit /set {default} bootstatuspolicy ignoreallfailures"
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:4584
        • C:\Windows\system32\bcdedit.exe
          bcdedit /set {default} bootstatuspolicy ignoreallfailures
          3⤵
          • Modifies boot configuration data using bcdedit
          PID:1060
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "vssadmin delete shadows /All /Quiet"
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:556
        • C:\Windows\system32\vssadmin.exe
          vssadmin delete shadows /All /Quiet
          3⤵
          • Interacts with shadow copies
          PID:4432
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c schtasks /create /sc minute /mo 5 /tn "Windows update00" /tr \"C:\Users\Admin\AppData\Local\Temp\" /ru "" /RL HIGHEST
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:2548
        • C:\Windows\system32\schtasks.exe
          schtasks /create /sc minute /mo 5 /tn "Windows update00" /tr \"C:\Users\Admin\AppData\Local\Temp\" /ru "" /RL HIGHEST
          3⤵
          • Creates scheduled task(s)
          PID:2360
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c schtasks /create /sc minute /mo 5 /tn "Windows update01" /tr "Powershell wevtutil el | Foreach-Object {Write-Host \"Clearing $_\"; wevtutil cl \"$_\"}" /ru "" /RL HIGHEST
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:4692
        • C:\Windows\system32\schtasks.exe
          schtasks /create /sc minute /mo 5 /tn "Windows update01" /tr "Powershell wevtutil el | Foreach-Object {Write-Host \"Clearing $_\"; wevtutil cl \"$_\"}" /ru "" /RL HIGHEST
          3⤵
          • Creates scheduled task(s)
          PID:3972
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c schtasks /delete /tn "Windows update00" /f
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:2348
        • C:\Windows\system32\schtasks.exe
          schtasks /delete /tn "Windows update00" /f
          3⤵
            PID:3516
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c schtasks /create /tn shutdown00 /tr "shutdown -r -t 0" /sc once /st 13:02:02 /ru ""
          2⤵
          • Suspicious use of WriteProcessMemory
          PID:3624
          • C:\Windows\system32\schtasks.exe
            schtasks /create /tn shutdown00 /tr "shutdown -r -t 0" /sc once /st 13:02:02 /ru ""
            3⤵
            • Creates scheduled task(s)
            PID:3540
        • C:\Windows\explorer.exe
          explorer.exe
          2⤵
          • Deletes itself
          PID:3592
      • C:\Windows\system32\vssvc.exe
        C:\Windows\system32\vssvc.exe
        1⤵
          PID:3204

        Network

        MITRE ATT&CK Enterprise v15

        Reconnaissance

        Resource Development

        Initial Access

        Execution

        Scheduled Task/Job

        1
        T1053

        Persistence

        Boot or Logon Autostart Execution

        1
        T1547

        Registry Run Keys / Startup Folder

        1
        T1547.001

        Scheduled Task/Job

        1
        T1053

        Privilege Escalation

        Abuse Elevation Control Mechanism

        1
        T1548

        Bypass User Account Control

        1
        T1548.002

        Boot or Logon Autostart Execution

        1
        T1547

        Registry Run Keys / Startup Folder

        1
        T1547.001

        Scheduled Task/Job

        1
        T1053

        Defense Evasion

        Abuse Elevation Control Mechanism

        1
        T1548

        Bypass User Account Control

        1
        T1548.002

        Impair Defenses

        1
        T1562

        Disable or Modify Tools

        1
        T1562.001

        Indicator Removal

        2
        T1070

        File Deletion

        2
        T1070.004

        Modify Registry

        4
        T1112

        Credential Access

        Discovery

        Peripheral Device Discovery

        1
        T1120

        Query Registry

        2
        T1012

        System Information Discovery

        3
        T1082

        Lateral Movement

        Collection

        Command and Control

        Exfiltration

        Impact

        Defacement

        1
        T1491

        Inhibit System Recovery

        3
        T1490

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\PerfLogs\lockxx.recovery_data.hta
          Filesize

          4KB

          MD5

          6987d642cede42512c01684f37a9ec94

          SHA1

          98c38c96ded94b5762b54e49806f457a09c8687b

          SHA256

          2056469d884c1fa208054daa5a4d465bc4d5135ae1e0df445fd15af8a11a8168

          SHA512

          d39daeabec18338ef11980b32699d31535f2342f9c1cf09b378e4a2b3746ef0480f036f6c50699eccf1a0f496e3ac09b1c5f55c4f1b16d0380073b3ca5174a7f

          Download Submit

        • memory/2936-0-0x00007FF7E7FC0000-0x00007FF7E8546000-memory.dmp

          Filesize

          5.5MB

          Download

        • memory/2936-1308-0x00007FF7E7FC0000-0x00007FF7E8546000-memory.dmp

          Filesize

          5.5MB

          Download

        • memory/2936-2906-0x00007FF7E7FC0000-0x00007FF7E8546000-memory.dmp

          Filesize

          5.5MB

          Download

        • memory/2936-2908-0x00007FF7E7FC0000-0x00007FF7E8546000-memory.dmp

          Filesize

          5.5MB

          Download

        • memory/3592-2907-0x0000000000BE0000-0x0000000000BE1000-memory.dmp

          Filesize

          4KB

          Download