Overview

overview

10

Static

static

10

3da65a0e61...0e.exe

windows7-x64

10

3da65a0e61...0e.exe

windows10-2004-x64

10

Ransomware...et.exe

windows7-x64

8

Ransomware...et.exe

windows10-2004-x64

8

Ransomware...er.exe

windows7-x64

1

Ransomware...er.exe

windows10-2004-x64

1

Ransomware/Cerber.exe

windows7-x64

10

Ransomware/Cerber.exe

windows10-2004-x64

10

Ransomware...ks.exe

windows7-x64

1

Ransomware...ks.exe

windows10-2004-x64

1

Ransomware...ER.exe

windows7-x64

10

Ransomware...ER.exe

windows10-2004-x64

10

Ransomware...er.exe

windows7-x64

9

Ransomware...er.exe

windows10-2004-x64

8

Ransomware...ey.exe

windows7-x64

10

Ransomware...ey.exe

windows10-2004-x64

10

Ransomware/Locky.exe

windows7-x64

10

Ransomware/Locky.exe

windows10-2004-x64

10

Ransomware/Matsnu.exe

windows7-x64

7

Ransomware/Matsnu.exe

windows10-2004-x64

3

Ransomware/Rex

ubuntu-18.04-amd64

9

Ransomware...er.exe

windows7-x64

1

Ransomware...er.exe

windows10-2004-x64

1

Ransomware...92.exe

windows7-x64

9

Ransomware...92.exe

windows10-2004-x64

9

Ransomware...ll.exe

windows7-x64

9

Ransomware...ll.exe

windows10-2004-x64

3

Ransomware/eda2.exe

windows7-x64

1

Ransomware/eda2.exe

windows10-2004-x64

1

Ransomware/jigsaw.exe

windows7-x64

10

Ransomware/jigsaw.exe

windows10-2004-x64

10

Ransomware/mamba.exe

windows7-x64

1

Analysis

  • max time kernel
    118s
  • max time network
    120s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    02-03-2024 20:19

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    Ransomware/Unlock92.exe

  • Size

    24KB

  • MD5

    afe4fa37dbbe91319f0684bc9524e557

  • SHA1

    db412ecb113e8f40781105af0d3dbc67760a9461

  • SHA256

    639f0ebcb2349caf7ab5f34e0d7c156db660f54f621fa9c2151c9f5795528670

  • SHA512

    83d7730a0213c98c4c9d5e8d195eab9c73362824d541df6e68e0106b409be756db4db2317f9ed2796de2e5bb86bdbf9195c0b8c6d91b8986df9ebe58c3603da7

  • SSDEEP

    384:TPDGsgnqFmaPJB4hWMhX5fLhMYQJtz0F92nudaTfrnnnwKPjDKcsujYcV6SUwJF9:DDGbQ/8WMN5frVF9qnnfPfZYcV6lw9b

Score
9/10
ransomwarespywarestealer

Malware Config

Signatures

  • Deletes shadow copies 2 TTPs

    Ransomware often targets backup files to inhibit system recovery.

    ransomware
  • Renames multiple (661) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware
  • Drops file in Drivers directory 58 IoCs
  • Drops startup file 2 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Drops file in System32 directory 64 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Discovers systems in the same network 1 TTPs 2 IoCs
    discovery
  • Interacts with shadow copies 2 TTPs 1 IoCs

    Shadow copies are often targeted by ransomware to inhibit system recovery.

    ransomware
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of WriteProcessMemory 15 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\Ransomware\Unlock92.exe
    "C:\Users\Admin\AppData\Local\Temp\Ransomware\Unlock92.exe"
    1⤵
    • Drops file in Drivers directory
    • Drops startup file
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1912
    • C:\Windows\System32\vssadmin.exe
      "C:\Windows\System32\vssadmin.exe" Delete Shadows /All /Quiet
      2⤵
      • Interacts with shadow copies
      PID:2052
    • C:\Windows\system32\cmd.exe
      "cmd" /C net view
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:2236
      • C:\Windows\system32\net.exe
        net view
        3⤵
        • Discovers systems in the same network
        PID:2636
    • C:\Windows\system32\cmd.exe
      "cmd" /C net view \\QGTQZTRE
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:2436
      • C:\Windows\system32\net.exe
        net view \\QGTQZTRE
        3⤵
        • Discovers systems in the same network
        PID:1656
  • C:\Windows\system32\vssvc.exe
    C:\Windows\system32\vssvc.exe
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:2652

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\MSOCache\All Users\!!!!!!!!Êàê âîññòàíîâèòü ôàéëû!!!!!!!.txt
    Filesize

    788B

    MD5

    1147e74db47fca6169e4aa7a0d373b1e

    SHA1

    57b505607bfb037645a70e91614ee675b2b10698

    SHA256

    a8c359db13c2c23d6a0b18bfab5a0b49888c15dfd76f5ac5bb4e78f3e0860555

    SHA512

    c4353c2c69d45531a1c75163d77f838ba75f055c4c4c96ba35d709151a7981a367bfcec1735ea31b81aee10e3c0d8d44b0fafa2c6056580b6c73d5b7ee806d41

    Download Submit

  • C:\MSOCache\All Users\keyvalue.bin
    Filesize

    2KB

    MD5

    2aac819d450af56aa6ba8e95b65794df

    SHA1

    a40bd3ebfe54ec9070c983f00580bb4f8c363667

    SHA256

    935ad7c6ad24ca58cd9fac5cc4d5281f06a71deee7b2efd82c660b16ae6d3bae

    SHA512

    22b66a5f9e251805ab8227e9e3ce792a8d964f76645f80465e7e65098957fd6f0f6129b6a844607a235f5f0dd61a22fa28bf8d2ba7382d496e949980fa689d29

    Download Submit

  • memory/1912-0-0x0000000000E50000-0x0000000000E5C000-memory.dmp

    Filesize

    48KB

    Download

  • memory/1912-1-0x000007FEF5C70000-0x000007FEF665C000-memory.dmp

    Filesize

    9.9MB

    Download

  • memory/1912-2-0x000000001B310000-0x000000001B390000-memory.dmp

    Filesize

    512KB

    Download

  • memory/1912-15322-0x000007FEF5C70000-0x000007FEF665C000-memory.dmp

    Filesize

    9.9MB

    Download

  • memory/1912-16359-0x000000001B310000-0x000000001B390000-memory.dmp

    Filesize

    512KB

    Download

  • memory/1912-16834-0x000007FEF5C70000-0x000007FEF665C000-memory.dmp

    Filesize

    9.9MB

    Download