Overview

overview

10

Static

static

7

00FAEE82AB...AD.exe

windows7-x64

10

0B8E9BC319...20.exe

windows7-x64

10

0c9fa52ace...7a.exe

windows7-x64

7

15f7ea290d...8c.exe

windows7-x64

10

1DD70E8036...25.exe

windows7-x64

10

1E229029B2...DA.exe

windows7-x64

10

21977fc851...61.exe

windows7-x64

10

21e1bc4340...01.exe

windows7-x64

7

2272954a2c...5a.exe

windows7-x64

10

2C3542B5D9...85.exe

windows7-x64

7

3ac7f91e37...38.exe

windows7-x64

10

3c0fe521f6...16.exe

windows7-x64

10

41c53e90f0...4a.exe

windows7-x64

10

467c2b23b7...be.exe

windows7-x64

10

5b79b6a814...b0.exe

windows7-x64

10

712affaa8b...1).exe

windows7-x64

1

72716d15ea...21.exe

windows7-x64

7

8b04af13b7...21.exe

windows7-x64

10

Bit Paymer.exe

windows7-x64

10

KeepCalm.exe

windows7-x64

1

LockedIn.exe

windows7-x64

1

Purge.exe

windows7-x64

1

Scarab.exe

windows7-x64

10

a631ad1b1a...4b.exe

windows7-x64

6

a9053a3a52...bc.exe

windows7-x64

7

b764629e1f...1c.exe

windows7-x64

10

cf89f70633...5c.exe

windows7-x64

1

e951e82867...50.exe

windows7-x64

1

fa0c321e1a...d2.exe

windows7-x64

9

fc184274ad...27.exe

windows7-x64

10

Analysis

  • max time kernel
    151s
  • max time network
    131s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    16-03-2024 15:13

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    Scarab.exe

  • Size

    342KB

  • MD5

    6899003aaa63ab4397f9e32e0a1daf43

  • SHA1

    c22272ff0944d127992b393562871473b23ef8ea

  • SHA256

    53f73dc2e8af9c059136029b3b535e885d4452d3375586eb9a0336d7a389aad5

  • SHA512

    d8895f96e12d1b0b5907f7b1e7b976a37ff0cbe6db929cfbea5c931d905fb8269dc91bf44db83743920b63affc64ba88a0933d3111bc68f71ee266971b91b6bc

  • SSDEEP

    6144:zmTLRf45/wAfqj6pjohSws+wZQtmk6LnAlnZ:eq5/tyjMLd+Rtmkc0

Score
10/10
persistenceransomware

Malware Config

Extracted

Path

C:\IF YOU WANT TO GET ALL YOUR FILES BACK, PLEASE READ THIS.TXT

Ransom Note
__________________________________________________________________________________________________ | | | *** IF YOU WANT TO GET ALL YOUR FILES BACK, PLEASE READ THIS *** | |__________________________________________________________________________________________________| Your files are now encrypted! -----BEGIN PERSONAL IDENTIFIER----- pAQAAAAAAABql7S+JZSHD0NADANXUd2szqKt1lDA0=tQY9Ew9SPjvJ9SvrXhlcWbmn+rfONeyZTZhcVtfdpvWexN=EdRtaVlm8vZ RVR9qp=EgLSW3SF36vlnINQRj7gr1lgpspv0wQAqhNjewqavDitURj8tL2Tte+6bSVZcay3=hgs0quEm4HiSOJca1bSnfoC9KKIY VoqoeJteuvFdmg+iih23FJhUXYCbdnn5WFNxUInJc13a=Cfi0izubUm=f2vrQA2ZWJ6YwEG46pXsXQHf4v5xPS3bFD6Dae5PR0fB jhe76xNQGZrVYvmGJOnVHPjTOqNdSPewEM0R5Pd=8nSUKLaUG8Rp=6cMPsQAwISGBdnw7dsiqXq9d8PPtWus9hGQAu0lFBOY7nCO fBaOkbadByHKREs5skZRwYj+0FIFvHqFVa=yiLzOoGw6hSHgvPYGzCJtEqDqdSydTmlYQAdlA=OQHdjrSMX6Nar1jUDOW4raYTXC og4pIBqn8VmrxSMsHUWkU=m111N4EUAIsXUcCQvq4F03nVmUTwPAvxLQKGijrAiXDUP56vc9DvuFHXobet03kh5PtG0w5Le4=BC9 uURVBcOBMgDzIsBFaq+oIQJMR1Lf4mDLMVI2tAGnPh6b+cEDe2f9G+I3xB+7Cn8IsvUPYD5NSWYWFO6QM2+Z6BnJ3sF=ki=fTb+K lJgk52EFE+EQGhPvDRO53aFaecbIQqLQNJwt0GL6GK99Z7FGuEATxIsO8RRzC9L+yYb1NARNz7bARTvc0JD5K8RaEfYQa5p+82M6 gWHIuJKfC9lvp7pdX9lcwDE4=jq8=y1hEAIjwk0 -----END PERSONAL IDENTIFIER----- All your files have been encrypted due to a security problem with your PC. Now you should send us email with your personal identifier. This email will be as confirmation you are ready to pay for decryption key. You have to pay for decryption in Bitcoins. The price depends on how fast you write to us. After payment we will send you the decryption tool that will decrypt all your files. Contact us using this email address: [email protected] Free decryption as guarantee! Before paying you can send us up to 3 files for free decryption. The total size of files must be less than 10Mb (non archived), and files should not contain valuable information (databases, backups, large excel sheets, etc.). __________________________________________________________________________________________________ | | | How to obtain Bitcoins? | | | | * The easiest way to buy bitcoins is LocalBitcoins site. You have to register, click | | 'Buy bitcoins', and select the seller by payment method and price: | | https://localbitcoins.com/buy_bitcoins | | * Also you can find other places to buy Bitcoins and beginners guide here: | | http://www.coindesk.com/information/how-can-i-buy-bitcoins | | | |__________________________________________________________________________________________________| __________________________________________________________________________________________________ | | | Attention! | | | | * Do not rename encrypted files. | | * Do not try to decrypt your data using third party software, it may cause permanent data loss. | | * Decryption of your files with the help of third parties may cause increased price | | (they add their fee to our) or you can become a victim of a scam. | | | |__________________________________________________________________________________________________|

Signatures

  • Deletes shadow copies 2 TTPs

    Ransomware often targets backup files to inhibit system recovery.

    ransomware
  • Renames multiple (162) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware
  • Deletes itself 1 IoCs
  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 2 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Suspicious use of SetThreadContext 3 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Interacts with shadow copies 2 TTPs 1 IoCs

    Shadow copies are often targeted by ransomware to inhibit system recovery.

    ransomware
  • Modifies Internet Explorer settings 1 TTPs 2 IoCs
    adwarespyware
  • Modifies system certificate store 2 TTPs 6 IoCs
    evasionspywaretrojan
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 43 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\Scarab.exe
    "C:\Users\Admin\AppData\Local\Temp\Scarab.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:2924
    • C:\Users\Admin\AppData\Local\Temp\Scarab.exe
      "C:\Users\Admin\AppData\Local\Temp\Scarab.exe"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:2932
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\system32\cmd.exe" /c copy /y "C:\Users\Admin\AppData\Local\Temp\Scarab.exe" "C:\Users\Admin\AppData\Roaming\sevnz.exe"
        3⤵
          PID:2696
        • C:\Users\Admin\AppData\Local\Temp\Scarab.exe
          "C:\Users\Admin\AppData\Local\Temp\Scarab.exe" runas
          3⤵
          • Suspicious use of SetThreadContext
          • Suspicious use of WriteProcessMemory
          PID:2824
          • C:\Users\Admin\AppData\Local\Temp\Scarab.exe
            "C:\Users\Admin\AppData\Local\Temp\Scarab.exe" runas
            4⤵
            • Loads dropped DLL
            • Suspicious use of WriteProcessMemory
            PID:2716
            • C:\Windows\SysWOW64\cmd.exe
              "C:\Windows\system32\cmd.exe" /c copy /y "C:\Users\Admin\AppData\Local\Temp\Scarab.exe" "C:\Users\Admin\AppData\Roaming\sevnz.exe"
              5⤵
                PID:2740
              • C:\Users\Admin\AppData\Roaming\sevnz.exe
                "C:\Users\Admin\AppData\Roaming\sevnz.exe"
                5⤵
                • Executes dropped EXE
                • Suspicious use of SetThreadContext
                • Suspicious use of WriteProcessMemory
                PID:2456
                • C:\Users\Admin\AppData\Roaming\sevnz.exe
                  "C:\Users\Admin\AppData\Roaming\sevnz.exe"
                  6⤵
                  • Executes dropped EXE
                  • Drops file in Program Files directory
                  • Modifies system certificate store
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious use of WriteProcessMemory
                  PID:304
                  • C:\Windows\SysWOW64\mshta.exe
                    mshta.exe "javascript:o=new ActiveXObject('WScript.Shell');x=new ActiveXObject('Scripting.FileSystemObject');setInterval(function(){try{i=x.GetFile('sevnz.exe').Path;o.RegWrite('HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce\\{45E73A27-D16C-4EDB-ADE8-0C069E54AF30}',i);}catch(e){}},10);"
                    7⤵
                    • Adds Run key to start application
                    • Modifies Internet Explorer settings
                    PID:2604
                  • C:\Windows\SysWOW64\cmd.exe
                    C:\Windows\system32\cmd.exe /c wbadmin DELETE SYSTEMSTATEBACKUP -keepVersions:0
                    7⤵
                      PID:1824
                    • C:\Windows\SysWOW64\cmd.exe
                      C:\Windows\system32\cmd.exe /c wmic SHADOWCOPY DELETE
                      7⤵
                        PID:2284
                        • C:\Windows\SysWOW64\Wbem\WMIC.exe
                          wmic SHADOWCOPY DELETE
                          8⤵
                          • Suspicious use of AdjustPrivilegeToken
                          PID:1800
                      • C:\Windows\SysWOW64\cmd.exe
                        C:\Windows\system32\cmd.exe /c vssadmin Delete Shadows /All /Quiet
                        7⤵
                          PID:2980
                          • C:\Windows\SysWOW64\vssadmin.exe
                            vssadmin Delete Shadows /All /Quiet
                            8⤵
                            • Interacts with shadow copies
                            PID:1556
                        • C:\Windows\SysWOW64\cmd.exe
                          C:\Windows\system32\cmd.exe /c bcdedit /set {default} recoveryenabled No
                          7⤵
                            PID:3032
                          • C:\Windows\SysWOW64\cmd.exe
                            C:\Windows\system32\cmd.exe /c bcdedit /set {default} bootstatuspolicy ignoreallfailures
                            7⤵
                              PID:440
                        • C:\Windows\SysWOW64\mshta.exe
                          mshta.exe "javascript:o=new ActiveXObject('Scripting.FileSystemObject');setInterval(function(){try{o.DeleteFile('Scarab.exe');close()}catch(e){}},10);"
                          5⤵
                          • Deletes itself
                          • Modifies Internet Explorer settings
                          PID:2488
                • C:\Windows\system32\vssvc.exe
                  C:\Windows\system32\vssvc.exe
                  1⤵
                  • Suspicious use of AdjustPrivilegeToken
                  PID:964

                Network

                MITRE ATT&CK Matrix ATT&CK v13

                Initial Access

                Execution

                Persistence

                Boot or Logon Autostart Execution

                1
                T1547

                Registry Run Keys / Startup Folder

                1
                T1547.001

                Privilege Escalation

                Boot or Logon Autostart Execution

                1
                T1547

                Registry Run Keys / Startup Folder

                1
                T1547.001

                Defense Evasion

                Indicator Removal

                2
                T1070

                File Deletion

                2
                T1070.004

                Modify Registry

                3
                T1112

                Subvert Trust Controls

                1
                T1553

                Install Root Certificate

                1
                T1553.004

                Credential Access

                Discovery

                System Information Discovery

                1
                T1082

                Lateral Movement

                Collection

                Exfiltration

                Command and Control

                Impact

                Inhibit System Recovery

                2
                T1490

                Resource Development

                Reconnaissance

                Replay Monitor

                Loading Replay Monitor...

                Downloads

                • C:\IF YOU WANT TO GET ALL YOUR FILES BACK, PLEASE READ THIS.TXT
                  Filesize

                  4KB

                  MD5

                  75d58f6991cd8c14f8fae8d315fac9b7

                  SHA1

                  28f1b8c1af3217ef6ef313c60f003c40afa28c75

                  SHA256

                  4681f1a0eb50e67ce0c73b6e1a3687676a534a5974b9c12cc81decb786f0988a

                  SHA512

                  e70a3658660d6870a66863251b07aa986219aaeb71280c733084444aa8ba2cd11b8432e38422b91400ddd499ed0590f35c1c71efa1dc82d448eaa107e61286bb

                  Download Submit
                • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015
                  Filesize

                  67KB

                  MD5

                  753df6889fd7410a2e9fe333da83a429

                  SHA1

                  3c425f16e8267186061dd48ac1c77c122962456e

                  SHA256

                  b42dc237e44cbc9a43400e7d3f9cbd406dbdefd62bfe87328f8663897d69df78

                  SHA512

                  9d56f79410ad0cf852c74c3ef9454e7ae86e80bdd6ff67773994b48ccac71142bcf5c90635da6a056e1406e81e64674db9584928e867c55b77b59e2851cf6444

                  Download Submit
                • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
                  Filesize

                  344B

                  MD5

                  7d9b95a446bfea47dadc70e8d1c0e5b0

                  SHA1

                  face50e28bc8f5292357d7886eb0dca1a40a197a

                  SHA256

                  d27d11ae0ba92ba2a105c3bf0d8b8896289413cd4dddce7b4b6784cb0ed3de7f

                  SHA512

                  71c4dafcfc419c9a2bf64dc7cb203e6fd79fbb3960d081356136bacbb0e6d348c25f6e1046ca36a78e3e2666992eac55ad1a965700e7642c55acc68dc9dc5c82

                  Download Submit
                • C:\Users\Admin\AppData\Local\Temp\CabA24A.tmp
                  Filesize

                  65KB

                  MD5

                  ac05d27423a85adc1622c714f2cb6184

                  SHA1

                  b0fe2b1abddb97837ea0195be70ab2ff14d43198

                  SHA256

                  c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

                  SHA512

                  6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

                  Download Submit
                • C:\Users\Admin\AppData\Local\Temp\TarA859.tmp
                  Filesize

                  175KB

                  MD5

                  dd73cead4b93366cf3465c8cd32e2796

                  SHA1

                  74546226dfe9ceb8184651e920d1dbfb432b314e

                  SHA256

                  a6752b7851b591550e4625b832a393aabcc428de18d83e8593cd540f7d7cae22

                  SHA512

                  ce1bdd595065c94fa528badf4a6a8777893807d6789267612755df818ba6ffe55e4df429710aea29526ee4aa8ef20e25f2f05341da53992157d21ae032c0fb63

                  Download Submit
                • C:\Users\Admin\AppData\Roaming\sevnz.exe
                  Filesize

                  342KB

                  MD5

                  6899003aaa63ab4397f9e32e0a1daf43

                  SHA1

                  c22272ff0944d127992b393562871473b23ef8ea

                  SHA256

                  53f73dc2e8af9c059136029b3b535e885d4452d3375586eb9a0336d7a389aad5

                  SHA512

                  d8895f96e12d1b0b5907f7b1e7b976a37ff0cbe6db929cfbea5c931d905fb8269dc91bf44db83743920b63affc64ba88a0933d3111bc68f71ee266971b91b6bc

                  Download Submit
                • memory/304-166-0x0000000000400000-0x0000000000441000-memory.dmp
                  Filesize

                  260KB

                  Download
                • memory/304-167-0x0000000000400000-0x0000000000441000-memory.dmp
                  Filesize

                  260KB

                  Download
                • memory/304-196-0x0000000000400000-0x0000000000441000-memory.dmp
                  Filesize

                  260KB

                  Download
                • memory/304-195-0x0000000000400000-0x0000000000441000-memory.dmp
                  Filesize

                  260KB

                  Download
                • memory/304-189-0x0000000000400000-0x0000000000441000-memory.dmp
                  Filesize

                  260KB

                  Download
                • memory/304-188-0x0000000000400000-0x0000000000441000-memory.dmp
                  Filesize

                  260KB

                  Download
                • memory/304-181-0x0000000000400000-0x0000000000441000-memory.dmp
                  Filesize

                  260KB

                  Download
                • memory/304-175-0x0000000000400000-0x0000000000441000-memory.dmp
                  Filesize

                  260KB

                  Download
                • memory/304-174-0x0000000000400000-0x0000000000441000-memory.dmp
                  Filesize

                  260KB

                  Download
                • memory/304-168-0x0000000000400000-0x0000000000441000-memory.dmp
                  Filesize

                  260KB

                  Download
                • memory/304-159-0x0000000000400000-0x0000000000441000-memory.dmp
                  Filesize

                  260KB

                  Download
                • memory/304-158-0x0000000000400000-0x0000000000441000-memory.dmp
                  Filesize

                  260KB

                  Download
                • memory/304-71-0x0000000000400000-0x0000000000441000-memory.dmp
                  Filesize

                  260KB

                  Download
                • memory/304-72-0x0000000000400000-0x0000000000441000-memory.dmp
                  Filesize

                  260KB

                  Download
                • memory/304-69-0x0000000000400000-0x0000000000441000-memory.dmp
                  Filesize

                  260KB

                  Download
                • memory/304-70-0x0000000000400000-0x0000000000441000-memory.dmp
                  Filesize

                  260KB

                  Download
                • memory/2456-50-0x00000000004D0000-0x00000000005D0000-memory.dmp
                  Filesize

                  1024KB

                  Download
                • memory/2716-39-0x0000000000400000-0x0000000000441000-memory.dmp
                  Filesize

                  260KB

                  Download
                • memory/2716-47-0x0000000000400000-0x0000000000441000-memory.dmp
                  Filesize

                  260KB

                  Download
                • memory/2716-38-0x0000000000400000-0x0000000000441000-memory.dmp
                  Filesize

                  260KB

                  Download
                • memory/2824-26-0x0000000000510000-0x0000000000610000-memory.dmp
                  Filesize

                  1024KB

                  Download
                • memory/2924-2-0x0000000000530000-0x0000000000630000-memory.dmp
                  Filesize

                  1024KB

                  Download
                • memory/2932-6-0x0000000000400000-0x0000000000441000-memory.dmp
                  Filesize

                  260KB

                  Download
                • memory/2932-12-0x0000000000400000-0x0000000000441000-memory.dmp
                  Filesize

                  260KB

                  Download
                • memory/2932-4-0x0000000000400000-0x0000000000441000-memory.dmp
                  Filesize

                  260KB

                  Download
                • memory/2932-14-0x0000000000400000-0x0000000000441000-memory.dmp
                  Filesize

                  260KB

                  Download
                • memory/2932-8-0x0000000000400000-0x0000000000441000-memory.dmp
                  Filesize

                  260KB

                  Download
                • memory/2932-10-0x0000000000400000-0x0000000000441000-memory.dmp
                  Filesize

                  260KB

                  Download
                • memory/2932-24-0x0000000000400000-0x0000000000441000-memory.dmp
                  Filesize

                  260KB

                  Download
                • memory/2932-21-0x0000000000400000-0x0000000000441000-memory.dmp
                  Filesize

                  260KB

                  Download
                • memory/2932-20-0x0000000000400000-0x0000000000441000-memory.dmp
                  Filesize

                  260KB

                  Download
                • memory/2932-19-0x0000000000400000-0x0000000000441000-memory.dmp
                  Filesize

                  260KB

                  Download
                • memory/2932-18-0x0000000000400000-0x0000000000441000-memory.dmp
                  Filesize

                  260KB

                  Download
                • memory/2932-1-0x0000000000400000-0x0000000000441000-memory.dmp
                  Filesize

                  260KB

                  Download
                • memory/2932-16-0x000000007EFDE000-0x000000007EFDF000-memory.dmp
                  Filesize

                  4KB

                  Download