Overview

overview

10

Static

static

10

3da65a0e61...0e.exe

windows7-x64

10

3da65a0e61...0e.exe

windows10-2004-x64

10

Ransomware...et.exe

windows7-x64

8

Ransomware...et.exe

windows10-2004-x64

8

Ransomware...er.exe

windows7-x64

1

Ransomware...er.exe

windows10-2004-x64

1

Ransomware/Cerber.exe

windows7-x64

10

Ransomware/Cerber.exe

windows10-2004-x64

10

Ransomware...ks.exe

windows7-x64

1

Ransomware...ks.exe

windows10-2004-x64

1

Ransomware...ER.exe

windows7-x64

10

Ransomware...ER.exe

windows10-2004-x64

10

Ransomware...er.exe

windows7-x64

9

Ransomware...er.exe

windows10-2004-x64

8

Ransomware...ey.exe

windows7-x64

10

Ransomware...ey.exe

windows10-2004-x64

10

Ransomware/Locky.exe

windows7-x64

10

Ransomware/Locky.exe

windows10-2004-x64

10

Ransomware/Matsnu.exe

windows7-x64

7

Ransomware/Matsnu.exe

windows10-2004-x64

3

Ransomware/Rex

ubuntu-18.04-amd64

9

Ransomware...er.exe

windows7-x64

1

Ransomware...er.exe

windows10-2004-x64

1

Ransomware...92.exe

windows7-x64

9

Ransomware...92.exe

windows10-2004-x64

9

Ransomware...ll.exe

windows7-x64

9

Ransomware...ll.exe

windows10-2004-x64

3

Ransomware/eda2.exe

windows7-x64

1

Ransomware/eda2.exe

windows10-2004-x64

1

Ransomware/jigsaw.exe

windows7-x64

10

Ransomware/jigsaw.exe

windows10-2004-x64

10

Ransomware/mamba.exe

windows7-x64

1

Analysis

  • max time kernel
    94s
  • max time network
    119s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    02-03-2024 20:19

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    Ransomware/Unlock92.exe

  • Size

    24KB

  • MD5

    afe4fa37dbbe91319f0684bc9524e557

  • SHA1

    db412ecb113e8f40781105af0d3dbc67760a9461

  • SHA256

    639f0ebcb2349caf7ab5f34e0d7c156db660f54f621fa9c2151c9f5795528670

  • SHA512

    83d7730a0213c98c4c9d5e8d195eab9c73362824d541df6e68e0106b409be756db4db2317f9ed2796de2e5bb86bdbf9195c0b8c6d91b8986df9ebe58c3603da7

  • SSDEEP

    384:TPDGsgnqFmaPJB4hWMhX5fLhMYQJtz0F92nudaTfrnnnwKPjDKcsujYcV6SUwJF9:DDGbQ/8WMN5frVF9qnnfPfZYcV6lw9b

Score
9/10
ransomwarespywarestealer

Malware Config

Signatures

  • Deletes shadow copies 2 TTPs

    Ransomware often targets backup files to inhibit system recovery.

    ransomware
  • Renames multiple (746) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware
  • Drops file in Drivers directory 56 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file 4 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Drops file in System32 directory 64 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Discovers systems in the same network 1 TTPs 1 IoCs
    discovery
  • Interacts with shadow copies 2 TTPs 1 IoCs

    Shadow copies are often targeted by ransomware to inhibit system recovery.

    ransomware
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\Ransomware\Unlock92.exe
    "C:\Users\Admin\AppData\Local\Temp\Ransomware\Unlock92.exe"
    1⤵
    • Drops file in Drivers directory
    • Checks computer location settings
    • Drops startup file
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:3612
    • C:\Windows\System32\vssadmin.exe
      "C:\Windows\System32\vssadmin.exe" Delete Shadows /All /Quiet
      2⤵
      • Interacts with shadow copies
      PID:2100
    • C:\Windows\SYSTEM32\cmd.exe
      "cmd" /C net view
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:4604
      • C:\Windows\system32\net.exe
        net view
        3⤵
        • Discovers systems in the same network
        PID:4060
  • C:\Windows\system32\vssvc.exe
    C:\Windows\system32\vssvc.exe
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:1332

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\PerfLogs\!!!!!!!!Êàê âîññòàíîâèòü ôàéëû!!!!!!!.txt
    Filesize

    788B

    MD5

    1147e74db47fca6169e4aa7a0d373b1e

    SHA1

    57b505607bfb037645a70e91614ee675b2b10698

    SHA256

    a8c359db13c2c23d6a0b18bfab5a0b49888c15dfd76f5ac5bb4e78f3e0860555

    SHA512

    c4353c2c69d45531a1c75163d77f838ba75f055c4c4c96ba35d709151a7981a367bfcec1735ea31b81aee10e3c0d8d44b0fafa2c6056580b6c73d5b7ee806d41

    Download Submit

  • C:\PerfLogs\keyvalue.bin
    Filesize

    2KB

    MD5

    2a080c4a7e9cf44d9c3b26b364592420

    SHA1

    d359ddfb2f739b5b1126d1dffca62e3a2ff036d6

    SHA256

    d0eede012178be378b9cd53dc6b2f2acfba27da149927c316ec0e2364e61aa40

    SHA512

    9c626f95babeb5a1c186794e2f4867ee7a6ce12c2b63db2cefc18047ad4a2c7de08ca8653c97d35c285dd3a652ead75547c3cb0b2f1b85ed11319109bbebc577

    Download Submit

  • memory/3612-0-0x00000000005D0000-0x00000000005DC000-memory.dmp

    Filesize

    48KB

    Download

  • memory/3612-1-0x00007FF98D160000-0x00007FF98DC21000-memory.dmp

    Filesize

    10.8MB

    Download

  • memory/3612-2-0x0000000000E00000-0x0000000000E10000-memory.dmp

    Filesize

    64KB

    Download

  • memory/3612-2285-0x00007FF98D160000-0x00007FF98DC21000-memory.dmp

    Filesize

    10.8MB

    Download

  • memory/3612-6044-0x0000000000E00000-0x0000000000E10000-memory.dmp

    Filesize

    64KB

    Download

  • memory/3612-24711-0x00007FF98D160000-0x00007FF98DC21000-memory.dmp

    Filesize

    10.8MB

    Download