Overview

overview

10

Static

static

3

cede0a34e9...ba.exe

windows7-x64

7

cede0a34e9...ba.exe

windows10-2004-x64

10

Resubmissions

20/03/2024, 09:05

240320-k2b83aea3y10

19/03/2024, 09:41

240319-lnrl9sge2910

16/03/2024, 19:26

240316-x5j5asac3110

Analysis

  • max time kernel
    65s
  • max time network
    73s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    20/03/2024, 09:05

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    cede0a34e9d113730c70ff5bf98a26ba.exe
  • Size 23.5MB
  • Sample240320-k2b83aea3y
  • SHA256 01846406554cd4b29e1d9bd0f35396fcb437b8f264edf4f86431bda7a530edbb
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
demonwareransomware

Malware Config

Extracted

Path

  • C:\Users\Admin\Pictures\README.txt

  • demonware

Ransom Note
  • Tango Down! Seems like you got hit by DemonWare ransomware! Don't Panic, you get have your files back! DemonWare uses a basic encryption script to lock your files. This type of ransomware is known as CRYPTO. You'll need a decryption key in order to unlock your files. Your files will be deleted when the timer runs out, so you better hurry. You have 10 hours to find your key C'mon, be glad I don't ask for payment like other ransomware. Please visit: https://keys.zeznzo.nl and search for your IP/hostname to get your key. Kind regards, Zeznzo
URLs

  • https://keys.zeznzo.nl

Signatures

  • DemonWare

    Ransomware first seen in mid-2020.

    ransomwaredemonware
  • Loads dropped DLL 35 IoCs
  • Opens file in notepad (likely ransom note) 1 IoCs
    ransomware
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\cede0a34e9d113730c70ff5bf98a26ba.exe
    "C:\Users\Admin\AppData\Local\Temp\cede0a34e9d113730c70ff5bf98a26ba.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2076
    • C:\Users\Admin\AppData\Local\Temp\cede0a34e9d113730c70ff5bf98a26ba.exe
      "C:\Users\Admin\AppData\Local\Temp\cede0a34e9d113730c70ff5bf98a26ba.exe"
      2⤵
      • Loads dropped DLL
      • Suspicious use of FindShellTrayWindow
      PID:4828
  • C:\Windows\System32\Notepad.exe
    "C:\Windows\System32\Notepad.exe" C:\Users\Admin\Desktop\OutPush.js
    1⤵
    • Opens file in notepad (likely ransom note)
    PID:384

Network

        MITRE ATT&CK Matrix

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        _Salsa20.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI20762\Crypto\Cipher\_Salsa20.pyd
        • Size 13KB
        • SHA256 28efd36be6bbbc56a7219bed7cc132ce67baf629100cc03a08a804360f483db9
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        _raw_cbc.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI20762\Crypto\Cipher\_raw_cbc.pyd
        • Size 12KB
        • SHA256 2a5ab7f23554f497693ca81a5e5f21647b10fd8b9e00b8377d8385dc15a9c4df
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        _raw_cfb.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI20762\Crypto\Cipher\_raw_cfb.pyd
        • Size 13KB
        • SHA256 b5438682a4c6bf57dcaad2835a9a293f712284fbe1af4ba6059011396cdbd180
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        _raw_ctr.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI20762\Crypto\Cipher\_raw_ctr.pyd
        • Size 14KB
        • SHA256 2f9dfa9de351bfe553dde60ae891e9b54a2e08546d723c7165234fd41c3ceed4
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        _raw_ecb.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI20762\Crypto\Cipher\_raw_ecb.pyd
        • Size 10KB
        • SHA256 821a86630238beaf4e303196ce26a250ef873f7a98b92644566b3c7d683d400e
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        _raw_ocb.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI20762\Crypto\Cipher\_raw_ocb.pyd
        • Size 17KB
        • SHA256 59cf35c376f312b1c6a5844f0740fcae4caaa5a3d3cd0e953959b5f4190a475d
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        _raw_ofb.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI20762\Crypto\Cipher\_raw_ofb.pyd
        • Size 12KB
        • SHA256 236650fc42b347b9caa5e3a84a13da9e40586d97762f87730c9016dcb81abf06
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        _BLAKE2s.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI20762\Crypto\Hash\_BLAKE2s.pyd
        • Size 13KB
        • SHA256 825039711c334e169432a482f8b71ae735d7a1bd56552e501f6f3eca87cf272e
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        _MD5.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI20762\Crypto\Hash\_MD5.pyd
        • Size 15KB
        • SHA256 efb961372f6ce102a9836b63038ae1385b408ef8dcf2de7238b2403a6e987b27
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        _SHA1.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI20762\Crypto\Hash\_SHA1.pyd
        • Size 17KB
        • SHA256 6cc9cfa3c9739b545808e814a661b5b54e9127b057ce503024e515648b7a4a33
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        _SHA256.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI20762\Crypto\Hash\_SHA256.pyd
        • Size 21KB
        • SHA256 1b36afc5b2f6f46d1a2457d56f276f5b5ffed066955acec911b9b7973d1e92b3
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        _ghash_clmul.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI20762\Crypto\Hash\_ghash_clmul.pyd
        • Size 12KB
        • SHA256 2ea2b17aaac9e572eef1239b01e8ad378829b765958fd1bf306f39983a76f944
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        _ghash_portable.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI20762\Crypto\Hash\_ghash_portable.pyd
        • Size 13KB
        • SHA256 800cc846930302519335afdd276f9cbbe5f940fe1e5035cb6baf4fb736d37434
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        _scrypt.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI20762\Crypto\Protocol\_scrypt.pyd
        • Size 12KB
        • SHA256 0ec713f4f3e963f618873ff538c7dcc532e0faba5025c5a8e20ac089fdfcf1d4
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        _cpuid_c.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI20762\Crypto\Util\_cpuid_c.pyd
        • Size 10KB
        • SHA256 a6feba74067fb03ee4ba53d1608ab8012eb6bd1f995ebc42c21d653d57b8320b
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        _strxor.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI20762\Crypto\Util\_strxor.pyd
        • Size 10KB
        • SHA256 6429928799a5eea9e090224a2d7083b469892d725a28ea9dcc2a95f94286b0da
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        MSVCP140.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI20762\MSVCP140.dll
        • Size 613KB
        • SHA256 99e3e25cda404283fbd96b25b7683a8d213e7954674adefa2279123a8d0701fd
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        _imaging.cp39-win_amd64.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI20762\PIL\_imaging.cp39-win_amd64.pyd
        • Size 1.6MB
        • SHA256 0f219e33c1a7df7e344ba49da12675df21091d6c16ce88d57432846dd22b1e38
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        _imaging.cp39-win_amd64.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI20762\PIL\_imaging.cp39-win_amd64.pyd
        • Size 2.0MB
        • SHA256 e3109a890eba4bfb928e98ac29ab6d201aa6580f230085a1bcbfd13663820ab2
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        VCRUNTIME140.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI20762\VCRUNTIME140.dll
        • Size 94KB
        • SHA256 c865c3366a98431ec3a5959cb5ac3966081a43b82dfcd8bfefafe0146b1508db
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        _bz2.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI20762\_bz2.pyd
        • Size 84KB
        • SHA256 7301fc2447e7e6d599472d2c52116fbe318a9ff9259b8a85981c419bfd20e3ef
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        _ctypes.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI20762\_ctypes.pyd
        • Size 124KB
        • SHA256 4fcf4c9c98b75a07a7779c52e1f7dff715ae8a2f8a34574e9dac66243fb86763
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        _hashlib.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI20762\_hashlib.pyd
        • Size 64KB
        • SHA256 e7aecb61a54dcc77b6d9cafe9a51fd1f8d78b2194cc3baf6304bbd1edfd0aee6
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        _lzma.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI20762\_lzma.pyd
        • Size 159KB
        • SHA256 638cd8c336f90629a6260e67827833143939497d542838846f4fc94b2475bb3e
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        _socket.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI20762\_socket.pyd
        • Size 78KB
        • SHA256 fdb14859efee35e105f21a64f7afdf50c399ffa0fa8b7fcc76dae4b345d946cb
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        _tkinter.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI20762\_tkinter.pyd
        • Size 64KB
        • SHA256 1b4d93153d06bcdbff02ce3a68f6a620ccbe4ba163baf78698d5fba3f54d4357
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        base_library.zip
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI20762\base_library.zip
        • Size 664KB
        • SHA256 cd0f43feaf1903ce16c0e96aba9337ad374834dd1ff5c55ad57ee84ee7af6b8c
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        libcrypto-1_1.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI20762\libcrypto-1_1.dll
        • Size 129KB
        • SHA256 dc86210c56d3a103f8fd198e807f3e0a597aaccf7ced4851c640f478a7ad9992
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        libcrypto-1_1.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI20762\libcrypto-1_1.dll
        • Size 39KB
        • SHA256 7ab6bc463a26a3a48108971443502f95390024b1a81fafaf4547d33f5b1dd38b
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        libffi-7.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI20762\libffi-7.dll
        • Size 32KB
        • SHA256 f60dd9f2fcbd495674dfc1555effb710eb081fc7d4cae5fa58c438ab50405081
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        python39.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI20762\python39.dll
        • Size 1.3MB
        • SHA256 9b7e79a1e577397ae6bcf275383a55a518288d707663016f20a99d1325219168
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        python39.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI20762\python39.dll
        • Size 991KB
        • SHA256 0dff0607a13f4cfbb8654bacaa9dbf6e97ca35e785e2dda9e88ae4bf1240286e
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        select.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI20762\select.pyd
        • Size 28KB
        • SHA256 d56542143775d02c70ad713ac36f295d473329ef3ad7a2999811d12151512931
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        tcl86t.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI20762\tcl86t.dll
        • Size 1.5MB
        • SHA256 f16d0f6ada6cbc24b780fe2734360764a7f8514cf4598971bf1d51811d2a79c9
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        tcl86t.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI20762\tcl86t.dll
        • Size 1.6MB
        • SHA256 f650d6bc321bcda3fc3ac3dec3ac4e473fb0b7b68b6c948581bcfc54653e6768
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        cp1252.enc
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI20762\tcl\encoding\cp1252.enc
        • Size 1KB
        • SHA256 14df3ae30e81e7620be6bbb7a9e42083af1ae04d94cf1203565f8a3c0542ace0
        • MD5 SHA1 SHA512
        Submit Download

        tk86t.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI20762\tk86t.dll
        • Size 1.4MB
        • SHA256 1a6d0871be2fa7153de22be008a20a5257b721657e6d4b24da8b1f940345d0d5
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        tk86t.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI20762\tk86t.dll
        • Size 1.4MB
        • SHA256 2d522d291c2fc8e7bf897367f9aa201f610b4a397361102bd56dfdfa82c760e2
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        README.txt
        • Path C:\Users\Admin\Pictures\README.txt
        • Size 575B
        • SHA256 e3cf65e96fcf774320e0ae4a42d6544f1aef476cd67184432465b2c595180a99
        • MD5 SHA1 SHA512
        Submit Download