441116d55e97124a067207bf57483dd3462bccfb034e56c4152675b0dcb118e7

Analysis

max time kernel
150s
max time network
119s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
16-03-2024 15:13

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

41c53e90f0861b068eaa512edff28a586128f808b437122399347bcb3774914a.exe
Size

27KB
MD5

b0492e56e1246873173e8f7d32f8a278
SHA1

b31e8e98a4b570f739dd1e1098f4e593f930f450
SHA256

41c53e90f0861b068eaa512edff28a586128f808b437122399347bcb3774914a
SHA512

fa078565f4eab7b1a618dff2182ac0f630f32a151fdbb5c3d73d1544cc4371d283cc76f597dde990eaa9e389355aca9c73cd1e8b3087b769340f3b9642642979
SSDEEP

384:U0Ne12bO+rTx8S0VL+5ka0OXE8vDIXam7JV4DXi4EECyBsnK/8kHaHKczlyDqq:612hTa7JULXEfXamDIy4HBs7HKwQx

Score

10^/10

evasion persistence ransomware

Malware Config

Extracted

Path

C:\MSOCache\All Users\_HELP_INSTRUCTION.TXT

Ransom Note

!!INFORMATIONS!! All of your files are encrypted with RSA2048 and AES128 ciphers. More information about the RSA and AES can be found here: https://en.wikipedia.org/wiki/RSA_(cryptosystem) https://en.wikipedia.org/wiki/Advanced_Encryption_Standard Decrypting of your files is only possible with the private key and decrypt program, which is on our secret server. Follow these steps: 1. Download and install Tor Browser: https://www.torproject.org/download/download-easy.html 2. After a successful installation, run the browser and wait for initialization. 3. Type in the address bar: http://supportxxgbefd7c.onion/ 4. Follow the instructions on the site. !! Your DECRYPT-ID: df54997b-3754-4ca8-b3bd-47bf930a1567 !!

URLs

http://supportxxgbefd7c.onion/

Signatures

Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware

File Deletion
T1070.004

Inhibit System Recovery
T1490
Stops running service(s) 3 TTPs
evasion

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489
Executes dropped EXE 1 IoCs

Processes:

BC1C9B74EA.exe

pid process

2592 BC1C9B74EA.exe

pid	process
2592	BC1C9B74EA.exe

Loads dropped DLL 2 IoCs

Processes:

41c53e90f0861b068eaa512edff28a586128f808b437122399347bcb3774914a.exe

pid	process
3024	41c53e90f0861b068eaa512edff28a586128f808b437122399347bcb3774914a.exe
3024	41c53e90f0861b068eaa512edff28a586128f808b437122399347bcb3774914a.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

BC1C9B74EA.exe41c53e90f0861b068eaa512edff28a586128f808b437122399347bcb3774914a.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Windows\CurrentVersion\Run\00FF1C9B74EA = "\"C:\\Users\\Admin\\AppData\\Roaming\\BC1C9B74EA.exe\""	BC1C9B74EA.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Windows\CurrentVersion\Run\00FF1C9B74EA = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\41c53e90f0861b068eaa512edff28a586128f808b437122399347bcb3774914a.exe\""	41c53e90f0861b068eaa512edff28a586128f808b437122399347bcb3774914a.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Windows\CurrentVersion\Run\BC1C9B74EA = "\"C:\\Users\\Admin\\AppData\\Roaming\\BC1C9B74EA.exe\""	41c53e90f0861b068eaa512edff28a586128f808b437122399347bcb3774914a.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\*BC1C9B74EA = "\"C:\\Users\\Admin\\AppData\\Roaming\\BC1C9B74EA.exe\""	41c53e90f0861b068eaa512edff28a586128f808b437122399347bcb3774914a.exe

Drops desktop.ini file(s) 26 IoCs

Processes:

BC1C9B74EA.exe

description	ioc	process
File opened for modification	C:\Users\Admin\Searches\desktop.ini	BC1C9B74EA.exe
File opened for modification	C:\Users\Admin\Favorites\Links\desktop.ini	BC1C9B74EA.exe
File opened for modification	C:\Users\Admin\Music\desktop.ini	BC1C9B74EA.exe
File opened for modification	C:\Users\Public\Documents\desktop.ini	BC1C9B74EA.exe
File opened for modification	C:\Users\Public\Downloads\desktop.ini	BC1C9B74EA.exe
File opened for modification	C:\Users\Public\Videos\Sample Videos\desktop.ini	BC1C9B74EA.exe
File opened for modification	C:\Users\Admin\Links\desktop.ini	BC1C9B74EA.exe
File opened for modification	C:\Users\Admin\Pictures\desktop.ini	BC1C9B74EA.exe
File opened for modification	C:\Users\Public\Libraries\desktop.ini	BC1C9B74EA.exe
File opened for modification	C:\Users\Public\Recorded TV\desktop.ini	BC1C9B74EA.exe
File opened for modification	C:\Users\Admin\Documents\desktop.ini	BC1C9B74EA.exe
File opened for modification	C:\Users\Public\desktop.ini	BC1C9B74EA.exe
File opened for modification	C:\Users\Admin\Desktop\desktop.ini	BC1C9B74EA.exe
File opened for modification	C:\Users\Admin\Videos\desktop.ini	BC1C9B74EA.exe
File opened for modification	C:\Users\Public\Pictures\Sample Pictures\desktop.ini	BC1C9B74EA.exe
File opened for modification	C:\Users\Public\Music\Sample Music\desktop.ini	BC1C9B74EA.exe
File opened for modification	C:\Users\Public\Videos\desktop.ini	BC1C9B74EA.exe
File opened for modification	C:\Users\Public\Desktop\desktop.ini	BC1C9B74EA.exe
File opened for modification	C:\Users\Public\Pictures\desktop.ini	BC1C9B74EA.exe
File opened for modification	C:\Users\Admin\Favorites\desktop.ini	BC1C9B74EA.exe
File opened for modification	C:\Users\Admin\Favorites\Links for United States\desktop.ini	BC1C9B74EA.exe
File opened for modification	C:\Users\Admin\Saved Games\desktop.ini	BC1C9B74EA.exe
File opened for modification	C:\Users\Public\Music\desktop.ini	BC1C9B74EA.exe
File opened for modification	C:\Users\Public\Recorded TV\Sample Media\desktop.ini	BC1C9B74EA.exe
File opened for modification	C:\Users\Admin\Contacts\desktop.ini	BC1C9B74EA.exe
File opened for modification	C:\Users\Admin\Downloads\desktop.ini	BC1C9B74EA.exe

Drops file in Program Files directory 2 IoCs

Processes:

BC1C9B74EA.exe

description	ioc	process
File opened for modification	C:\Program Files\_HELP_INSTRUCTION.TXT	BC1C9B74EA.exe
File opened for modification	C:\Program Files (x86)\_HELP_INSTRUCTION.TXT	BC1C9B74EA.exe

Drops file in Windows directory 1 IoCs

Processes:

BC1C9B74EA.exe

description ioc process

File opened for modification C:\Windows\_HELP_INSTRUCTION.TXT BC1C9B74EA.exe
Launches sc.exe 6 IoCs
Sc.exe is a Windows utlilty to control services on the system.

Processes:

sc.exesc.exesc.exesc.exesc.exesc.exe

pid process

2516 sc.exe
1628 sc.exe
2324 sc.exe
1924 sc.exe
2332 sc.exe
1948 sc.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Interacts with shadow copies 2 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
ransomware

File Deletion
T1070.004

Inhibit System Recovery
T1490

Processes:

vssadmin.exe

pid process

2148 vssadmin.exe

description	ioc	process
File opened for modification	C:\Windows\_HELP_INSTRUCTION.TXT	BC1C9B74EA.exe

pid	process
2516	sc.exe
1628	sc.exe
2324	sc.exe
1924	sc.exe
2332	sc.exe
1948	sc.exe

pid	process
2148	vssadmin.exe

NTFS ADS 1 IoCs

Processes:

41c53e90f0861b068eaa512edff28a586128f808b437122399347bcb3774914a.exe

description	ioc	process
File opened for modification	C:\Users\Admin\AppData\Roaming\BC1C9B74EA.exe:Zone.Identifier	41c53e90f0861b068eaa512edff28a586128f808b437122399347bcb3774914a.exe

Opens file in notepad (likely ransom note) 2 IoCs
ransomware

Processes:

NOTEPAD.EXENOTEPAD.EXE

pid process

1692 NOTEPAD.EXE
3976 NOTEPAD.EXE
Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

vssvc.exe

description pid process

Token: SeBackupPrivilege 2700 vssvc.exe
Token: SeRestorePrivilege 2700 vssvc.exe
Token: SeAuditPrivilege 2700 vssvc.exe

pid	process
1692	NOTEPAD.EXE
3976	NOTEPAD.EXE

description	pid	process
Token: SeBackupPrivilege	2700	vssvc.exe
Token: SeRestorePrivilege	2700	vssvc.exe
Token: SeAuditPrivilege	2700	vssvc.exe

Suspicious use of WriteProcessMemory 40 IoCs

Processes:

41c53e90f0861b068eaa512edff28a586128f808b437122399347bcb3774914a.exeBC1C9B74EA.exe

description	pid	process	target process
PID 3024 wrote to memory of 1948	3024	41c53e90f0861b068eaa512edff28a586128f808b437122399347bcb3774914a.exe	sc.exe
PID 3024 wrote to memory of 1948	3024	41c53e90f0861b068eaa512edff28a586128f808b437122399347bcb3774914a.exe	sc.exe
PID 3024 wrote to memory of 1948	3024	41c53e90f0861b068eaa512edff28a586128f808b437122399347bcb3774914a.exe	sc.exe
PID 3024 wrote to memory of 1948	3024	41c53e90f0861b068eaa512edff28a586128f808b437122399347bcb3774914a.exe	sc.exe
PID 3024 wrote to memory of 2332	3024	41c53e90f0861b068eaa512edff28a586128f808b437122399347bcb3774914a.exe	sc.exe
PID 3024 wrote to memory of 2332	3024	41c53e90f0861b068eaa512edff28a586128f808b437122399347bcb3774914a.exe	sc.exe
PID 3024 wrote to memory of 2332	3024	41c53e90f0861b068eaa512edff28a586128f808b437122399347bcb3774914a.exe	sc.exe
PID 3024 wrote to memory of 2332	3024	41c53e90f0861b068eaa512edff28a586128f808b437122399347bcb3774914a.exe	sc.exe
PID 3024 wrote to memory of 1924	3024	41c53e90f0861b068eaa512edff28a586128f808b437122399347bcb3774914a.exe	sc.exe
PID 3024 wrote to memory of 1924	3024	41c53e90f0861b068eaa512edff28a586128f808b437122399347bcb3774914a.exe	sc.exe
PID 3024 wrote to memory of 1924	3024	41c53e90f0861b068eaa512edff28a586128f808b437122399347bcb3774914a.exe	sc.exe
PID 3024 wrote to memory of 1924	3024	41c53e90f0861b068eaa512edff28a586128f808b437122399347bcb3774914a.exe	sc.exe
PID 3024 wrote to memory of 2324	3024	41c53e90f0861b068eaa512edff28a586128f808b437122399347bcb3774914a.exe	sc.exe
PID 3024 wrote to memory of 2324	3024	41c53e90f0861b068eaa512edff28a586128f808b437122399347bcb3774914a.exe	sc.exe
PID 3024 wrote to memory of 2324	3024	41c53e90f0861b068eaa512edff28a586128f808b437122399347bcb3774914a.exe	sc.exe
PID 3024 wrote to memory of 2324	3024	41c53e90f0861b068eaa512edff28a586128f808b437122399347bcb3774914a.exe	sc.exe
PID 3024 wrote to memory of 1628	3024	41c53e90f0861b068eaa512edff28a586128f808b437122399347bcb3774914a.exe	sc.exe
PID 3024 wrote to memory of 1628	3024	41c53e90f0861b068eaa512edff28a586128f808b437122399347bcb3774914a.exe	sc.exe
PID 3024 wrote to memory of 1628	3024	41c53e90f0861b068eaa512edff28a586128f808b437122399347bcb3774914a.exe	sc.exe
PID 3024 wrote to memory of 1628	3024	41c53e90f0861b068eaa512edff28a586128f808b437122399347bcb3774914a.exe	sc.exe
PID 3024 wrote to memory of 2516	3024	41c53e90f0861b068eaa512edff28a586128f808b437122399347bcb3774914a.exe	sc.exe
PID 3024 wrote to memory of 2516	3024	41c53e90f0861b068eaa512edff28a586128f808b437122399347bcb3774914a.exe	sc.exe
PID 3024 wrote to memory of 2516	3024	41c53e90f0861b068eaa512edff28a586128f808b437122399347bcb3774914a.exe	sc.exe
PID 3024 wrote to memory of 2516	3024	41c53e90f0861b068eaa512edff28a586128f808b437122399347bcb3774914a.exe	sc.exe
PID 3024 wrote to memory of 2148	3024	41c53e90f0861b068eaa512edff28a586128f808b437122399347bcb3774914a.exe	vssadmin.exe
PID 3024 wrote to memory of 2148	3024	41c53e90f0861b068eaa512edff28a586128f808b437122399347bcb3774914a.exe	vssadmin.exe
PID 3024 wrote to memory of 2148	3024	41c53e90f0861b068eaa512edff28a586128f808b437122399347bcb3774914a.exe	vssadmin.exe
PID 3024 wrote to memory of 2148	3024	41c53e90f0861b068eaa512edff28a586128f808b437122399347bcb3774914a.exe	vssadmin.exe
PID 3024 wrote to memory of 2592	3024	41c53e90f0861b068eaa512edff28a586128f808b437122399347bcb3774914a.exe	BC1C9B74EA.exe
PID 3024 wrote to memory of 2592	3024	41c53e90f0861b068eaa512edff28a586128f808b437122399347bcb3774914a.exe	BC1C9B74EA.exe
PID 3024 wrote to memory of 2592	3024	41c53e90f0861b068eaa512edff28a586128f808b437122399347bcb3774914a.exe	BC1C9B74EA.exe
PID 3024 wrote to memory of 2592	3024	41c53e90f0861b068eaa512edff28a586128f808b437122399347bcb3774914a.exe	BC1C9B74EA.exe
PID 2592 wrote to memory of 1692	2592	BC1C9B74EA.exe	NOTEPAD.EXE
PID 2592 wrote to memory of 1692	2592	BC1C9B74EA.exe	NOTEPAD.EXE
PID 2592 wrote to memory of 1692	2592	BC1C9B74EA.exe	NOTEPAD.EXE
PID 2592 wrote to memory of 1692	2592	BC1C9B74EA.exe	NOTEPAD.EXE
PID 2592 wrote to memory of 3976	2592	BC1C9B74EA.exe	NOTEPAD.EXE
PID 2592 wrote to memory of 3976	2592	BC1C9B74EA.exe	NOTEPAD.EXE
PID 2592 wrote to memory of 3976	2592	BC1C9B74EA.exe	NOTEPAD.EXE
PID 2592 wrote to memory of 3976	2592	BC1C9B74EA.exe	NOTEPAD.EXE

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\41c53e90f0861b068eaa512edff28a586128f808b437122399347bcb3774914a.exe
"C:\Users\Admin\AppData\Local\Temp\41c53e90f0861b068eaa512edff28a586128f808b437122399347bcb3774914a.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- NTFS ADS
- Suspicious use of WriteProcessMemory
PID:3024

C:\Windows\SysWOW64\sc.exe
sc stop wscsvc
2⤵
- Launches sc.exe
PID:1948

C:\Windows\SysWOW64\sc.exe
sc stop WinDefend
2⤵
- Launches sc.exe
PID:2332

C:\Windows\SysWOW64\sc.exe
sc stop wuauserv
2⤵
- Launches sc.exe
PID:1924

C:\Windows\SysWOW64\sc.exe
sc stop BITS
2⤵
- Launches sc.exe
PID:2324

C:\Windows\SysWOW64\sc.exe
sc stop ERSvc
2⤵
- Launches sc.exe
PID:1628

C:\Windows\SysWOW64\sc.exe
sc stop WerSvc
2⤵
- Launches sc.exe
PID:2516

C:\Windows\SysWOW64\vssadmin.exe
vssadmin.exe Delete Shadows /All /Quiet
2⤵
- Interacts with shadow copies
PID:2148

C:\Users\Admin\AppData\Roaming\BC1C9B74EA.exe
C:\Users\Admin\AppData\Roaming\BC1C9B74EA.exe
2⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops desktop.ini file(s)
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2592

C:\Windows\SysWOW64\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\_HELP_INSTRUCTION.TXT
3⤵
- Opens file in notepad (likely ransom note)
PID:1692

C:\Windows\SysWOW64\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\_HELP_INSTRUCTION.TXT
3⤵
- Opens file in notepad (likely ransom note)
PID:3976

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2700

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Indicator Removal

T1070

File Deletion

T1070.004

Impair Defenses

T1562

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Inhibit System Recovery

T1490

Service Stop

T1489

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\MSOCache\All Users\_HELP_INSTRUCTION.TXT
Filesize
1KB

MD5
e82376fbdf5b049ee71be64b5cd2dc3d

SHA1
e1614c8e5c414f6a5e514b266519253dc96401ac

SHA256
014fa3d2d8cf84aa1499a1699f738b0b513c877bbc30799f8a2872e57a05a345

SHA512
6adaa1c01cf0cf17c50474581ef70fba129322f59db165bd7c526f82f853b48200ef1bb3c2d16d3169ef370e59b10d0372355adffb4f876e16090c0742bfd989

Download Submit
C:\Users\Admin\AppData\Roaming\BC1C9B74EA.exe
Filesize
27KB

MD5
b0492e56e1246873173e8f7d32f8a278

SHA1
b31e8e98a4b570f739dd1e1098f4e593f930f450

SHA256
41c53e90f0861b068eaa512edff28a586128f808b437122399347bcb3774914a

SHA512
fa078565f4eab7b1a618dff2182ac0f630f32a151fdbb5c3d73d1544cc4371d283cc76f597dde990eaa9e389355aca9c73cd1e8b3087b769340f3b9642642979

Download Submit
memory/2592-900-0x0000000000030000-0x000000000003E000-memory.dmp

Filesize
56KB

Download
memory/2592-335-0x0000000000030000-0x000000000003E000-memory.dmp

Filesize
56KB

Download
memory/2592-1261-0x0000000000030000-0x000000000003E000-memory.dmp

Filesize
56KB

Download
memory/2592-1191-0x0000000000030000-0x000000000003E000-memory.dmp

Filesize
56KB

Download
memory/2592-1100-0x0000000000030000-0x000000000003E000-memory.dmp

Filesize
56KB

Download
memory/2592-17-0x0000000000030000-0x000000000003E000-memory.dmp

Filesize
56KB

Download
memory/2592-145-0x0000000000030000-0x000000000003E000-memory.dmp

Filesize
56KB

Download
memory/2592-1084-0x0000000000030000-0x000000000003E000-memory.dmp

Filesize
56KB

Download
memory/2592-332-0x0000000000030000-0x000000000003E000-memory.dmp

Filesize
56KB

Download
memory/2592-520-0x0000000000030000-0x000000000003E000-memory.dmp

Filesize
56KB

Download
memory/2592-747-0x0000000000030000-0x000000000003E000-memory.dmp

Filesize
56KB

Download
memory/2592-770-0x0000000000030000-0x000000000003E000-memory.dmp

Filesize
56KB

Download
memory/2592-835-0x0000000000030000-0x000000000003E000-memory.dmp

Filesize
56KB

Download
memory/2592-1087-0x0000000000030000-0x000000000003E000-memory.dmp

Filesize
56KB

Download
memory/2592-992-0x0000000000030000-0x000000000003E000-memory.dmp

Filesize
56KB

Download
memory/3024-2-0x00000000008E0000-0x00000000008EE000-memory.dmp

Filesize
56KB

Download
memory/3024-1-0x0000000000070000-0x0000000000075000-memory.dmp

Filesize
20KB

Download
memory/3024-0-0x00000000008E0000-0x00000000008EE000-memory.dmp

Filesize
56KB

Download
memory/3024-15-0x0000000000210000-0x000000000021E000-memory.dmp

Filesize
56KB

Download
memory/3024-16-0x0000000000210000-0x000000000021E000-memory.dmp

Filesize
56KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads