Overview

overview

10

Static

static

3

VirusShare...30.exe

windows7-x64

10

VirusShare...30.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    149s
  • max time network
    152s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    07/06/2024, 18:19

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    VirusShare_a1628f841ac770973760211ca8010230.exe
  • Size 342KB
  • Sample240607-wx953sch23
  • SHA256 381f9c38f54ce9669a5fb3e8a6ee73d7954db19da191c97cb6d0b62d6ff6885a
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
defense_evasionexecutionimpactpersistenceransomware

Malware Config

Extracted

Path

  • C:\Program Files\7-Zip\Lang\HELP_RESTORE_FILES_utsew.TXT

Ransom Note
  • All your documents, photos, databases and other important files have been encrypted with strongest encryption RSA-2048 key, generated for this computer. Private decryption key is stored on a secret Internet server and nobody can decrypt your files until you pay and obtain the private key. If you see the main encryptor red window, examine it and follow the instructions. Otherwise, it seems that you or your antivirus deleted the encryptor program. Now you have the last chance to decrypt your files. Open in your browser one of the links: http://iq3ahijcfeont3xx.htye943kjc38.com http://iq3ahijcfeont3xx.p0oekds4we39.com https://iq3ahijcfeont3xx.tor2web.blutmagie.de They are public gates to the secret server. Copy and paste the following Bitcoin address in the input form on server. Avoid missprints. 12HyYSLBE4HpXUkqvqdHZoLQh6H3Wh2Tsy Follow the instructions on the server. If you have problems with gates, use direct connection: 1. Download Tor Browser from http://torproject.org 2. In the Tor Browser open the http://iq3ahijcfeont3xx.onion/ Note that this server is available via Tor Browser only. Retry in 1 hour if site is not reachable. Copy and paste the following Bitcoin address in the input form on server. Avoid missprints. 12HyYSLBE4HpXUkqvqdHZoLQh6H3Wh2Tsy Follow the instructions on the server.
Wallets

  • 12HyYSLBE4HpXUkqvqdHZoLQh6H3Wh2Tsy

URLs

  • http://iq3ahijcfeont3xx.htye943kjc38.com

  • http://iq3ahijcfeont3xx.p0oekds4we39.com

  • https://iq3ahijcfeont3xx.tor2web.blutmagie.de

  • http://iq3ahijcfeont3xx.onion/

Signatures

  • Deletes shadow copies 3 TTPs

    Ransomware often targets backup files to inhibit system recovery.

    ransomwaredefense_evasionimpactexecution
  • Renames multiple (711) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware
  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Sets desktop wallpaper using registry 2 TTPs 1 IoCs
    ransomware
  • Suspicious use of SetThreadContext 2 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Interacts with shadow copies 2 TTPs 1 IoCs

    Shadow copies are often targeted by ransomware to inhibit system recovery.

    ransomware
  • Modifies Control Panel 2 IoCs
    evasion
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 5 IoCs
  • Suspicious use of WriteProcessMemory 26 IoCs
  • System policy modification 1 TTPs 2 IoCs
    evasion
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\VirusShare_a1628f841ac770973760211ca8010230.exe
    "C:\Users\Admin\AppData\Local\Temp\VirusShare_a1628f841ac770973760211ca8010230.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:896
    • C:\Users\Admin\AppData\Local\Temp\VirusShare_a1628f841ac770973760211ca8010230.exe
      C:\Users\Admin\AppData\Local\Temp\VirusShare_a1628f841ac770973760211ca8010230.exe
      2⤵
      • Checks computer location settings
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:3452
      • C:\Users\Admin\AppData\Local\cvtuapr.exe
        C:\Users\Admin\AppData\Local\cvtuapr.exe
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        • Suspicious use of WriteProcessMemory
        PID:1316
        • C:\Users\Admin\AppData\Local\cvtuapr.exe
          C:\Users\Admin\AppData\Local\cvtuapr.exe
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • Adds Run key to start application
          • Sets desktop wallpaper using registry
          • Drops file in Program Files directory
          • Modifies Control Panel
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          • System policy modification
          PID:2332
          • C:\Windows\System32\vssadmin.exe
            "C:\Windows\System32\vssadmin.exe" delete shadows /all /Quiet
            5⤵
            • Interacts with shadow copies
            PID:2412
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\VIRUSS~1.EXE >> NUL
        3⤵
          PID:4048
    • C:\Windows\system32\vssvc.exe
      C:\Windows\system32\vssvc.exe
      1⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:4536

    Network

          MITRE ATT&CK Enterprise v15

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          HELP_RESTORE_FILES_utsew.TXT
          • Path C:\Program Files\7-Zip\Lang\HELP_RESTORE_FILES_utsew.TXT
          • Size 1KB
          • SHA256 d16d73b1c2cb520cbc31411f1f8bd691e5c15645ced26241f29aa2bffe98b461
          • MD5 SHA1 SHA512
          Submit Download

          cvtuapr.exe
          • Path C:\Users\Admin\AppData\Local\cvtuapr.exe
          • Size 342KB
          • SHA256 381f9c38f54ce9669a5fb3e8a6ee73d7954db19da191c97cb6d0b62d6ff6885a
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          memory/2332-2957-0x0000000000400000-0x00000000004F3000-memory.dmp
          Download

          memory/2332-2955-0x0000000000400000-0x00000000004F3000-memory.dmp
          Download

          memory/2332-2968-0x0000000000400000-0x00000000004F3000-memory.dmp
          Download

          memory/2332-12-0x0000000000400000-0x00000000004F3000-memory.dmp
          Download

          memory/2332-10-0x0000000000400000-0x00000000004F3000-memory.dmp
          Download

          memory/2332-15-0x0000000000400000-0x00000000004F3000-memory.dmp
          Download

          memory/2332-2964-0x0000000000400000-0x00000000004F3000-memory.dmp
          Download

          memory/2332-17-0x0000000000400000-0x00000000004F3000-memory.dmp
          Download

          memory/2332-19-0x0000000000400000-0x00000000004F3000-memory.dmp
          Download

          memory/2332-2959-0x0000000000400000-0x00000000004F3000-memory.dmp
          Download

          memory/2332-23-0x0000000000400000-0x00000000004F3000-memory.dmp
          Download

          memory/3452-14-0x0000000000400000-0x00000000004F3000-memory.dmp
          Download

          memory/3452-3-0x0000000000400000-0x00000000004F3000-memory.dmp
          Download

          memory/3452-1-0x0000000000400000-0x00000000004F3000-memory.dmp
          Download

          memory/3452-2-0x0000000000400000-0x00000000004F3000-memory.dmp
          Download

          memory/3452-0-0x0000000000400000-0x00000000004F3000-memory.dmp
          Download