Overview

overview

10

Static

static

3

VirusShare...d4.exe

windows7-x64

10

VirusShare...d4.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    118s
  • max time network
    147s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    10/06/2024, 21:30

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    VirusShare_2868401dabd038143ca5442e05624bd4.exe
  • Size 344KB
  • Sample240610-1cs4aa1dkd
  • SHA256 38129f85a69aebacbd4a0667272b249e56b15eb9593fbeed2a4faa99851fdbd2
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
defense_evasionevasionexecutionimpactpersistenceransomwarespywarestealer

Malware Config

Extracted

Path

  • C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\how_recover+cnu.txt

Ransom Note
  • 111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111 NOT YOUR LANGUAGE? USE https://translate.google.com What happened to your files ? All of your files were protected by a strong encryption with RSA-4096. More information about the encryption keys using RSA-4096 can be found here: http://en.wikipedia.org/wiki/RSA_(cryptosystem) What does this mean ? This means that the structure and data within your files have been irrevocably changed, you will not be able to work with them, read them or see them, it is the same thing as losing them forever, but with our help, you can restore them. 111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111 How did this happen ? ---Specially for your PC was generated personal RSA-4096 KEY, both public and private. ---ALL YOUR FILES were encrypted with the public key, which has been transferred to your computer via the Internet. 111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111 Decrypting of your files is only possible with the help of the private key and decrypt program, which is on our secret server. What do I do ? So, there are two ways you can choose: wait for a miracle and get your price doubled, or start obtaining BTC NOW, and restore your data easy way. If You have really valuable data, you better not waste your time, because there is no other way to get your files, except make a payment. For more specific instructions, please visit your personal home page, there are a few different addresses pointing to your page below: 1. http://vr6g2curb2kcidou.encpayment23.com/E42535DAD18224A9 2. http://vr6g2curb2kcidou.expay34.com/E42535DAD18224A9 3. http://psbc532jm8c.hsh73cu37n1.net/E42535DAD18224A9 4. https://vr6g2curb2kcidou.onion.to/E42535DAD18224A9 If for some reasons the addresses are not available, follow these steps: 1. Download and install tor-browser: http://www.torproject.org/projects/torbrowser.html.en 2. After a successful installation, run the browser and wait for initialization. 3. Type in the address bar: vr6g2curb2kcidou.onion/E42535DAD18224A9 4. Follow the instructions on the site. IMPORTANT INFORMATION: Your personal pages: http://vr6g2curb2kcidou.encpayment23.com/E42535DAD18224A9 http://vr6g2curb2kcidou.expay34.com/E42535DAD18224A9 http://psbc532jm8c.hsh73cu37n1.net/E42535DAD18224A9 https://vr6g2curb2kcidou.onion.to/E42535DAD18224A9 Your personal page (using TOR-Browser): vr6g2curb2kcidou.onion/E42535DAD18224A9 Your personal identification number (if you open the site (or TOR-Browser's) directly): E42535DAD18224A9 111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111
URLs

  • http://vr6g2curb2kcidou.encpayment23.com/E42535DAD18224A9

  • http://vr6g2curb2kcidou.expay34.com/E42535DAD18224A9

  • http://psbc532jm8c.hsh73cu37n1.net/E42535DAD18224A9

  • https://vr6g2curb2kcidou.onion.to/E42535DAD18224A9

  • http://vr6g2curb2kcidou.onion/E42535DAD18224A9

Signatures

  • Deletes shadow copies 3 TTPs

    Ransomware often targets backup files to inhibit system recovery.

    ransomwaredefense_evasionimpactexecution
  • Modifies boot configuration data using bcdedit 1 TTPs 5 IoCs
    ransomwareevasion
  • Renames multiple (411) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware
  • Deletes itself 1 IoCs
  • Drops startup file 2 IoCs
  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 3 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext 2 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Interacts with shadow copies 2 TTPs 2 IoCs

    Shadow copies are often targeted by ransomware to inhibit system recovery.

    ransomware
  • Modifies Internet Explorer settings 1 TTPs 36 IoCs
    adwarespyware
  • Opens file in notepad (likely ransom note) 1 IoCs
    ransomware
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 5 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • System policy modification 1 TTPs 2 IoCs
    evasion
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\VirusShare_2868401dabd038143ca5442e05624bd4.exe
    "C:\Users\Admin\AppData\Local\Temp\VirusShare_2868401dabd038143ca5442e05624bd4.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:2992
    • C:\Users\Admin\AppData\Local\Temp\VirusShare_2868401dabd038143ca5442e05624bd4.exe
      "C:\Users\Admin\AppData\Local\Temp\VirusShare_2868401dabd038143ca5442e05624bd4.exe"
      2⤵
      • Loads dropped DLL
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:2744
      • C:\Users\Admin\AppData\Roaming\lxbsxacroic.exe
        C:\Users\Admin\AppData\Roaming\lxbsxacroic.exe
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious use of SetThreadContext
        • Suspicious use of WriteProcessMemory
        PID:2596
        • C:\Users\Admin\AppData\Roaming\lxbsxacroic.exe
          C:\Users\Admin\AppData\Roaming\lxbsxacroic.exe
          4⤵
          • Drops startup file
          • Executes dropped EXE
          • Adds Run key to start application
          • Drops file in Program Files directory
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          • System policy modification
          PID:2524
          • C:\Windows\system32\bcdedit.exe
            bcdedit.exe /set {current} bootems off
            5⤵
            • Modifies boot configuration data using bcdedit
            PID:2240
          • C:\Windows\System32\vssadmin.exe
            "C:\Windows\System32\vssadmin.exe" delete shadows /all /Quiet
            5⤵
            • Interacts with shadow copies
            PID:2752
          • C:\Windows\system32\bcdedit.exe
            bcdedit.exe /set {current} advancedoptions off
            5⤵
            • Modifies boot configuration data using bcdedit
            PID:1456
          • C:\Windows\system32\bcdedit.exe
            bcdedit.exe /set {current} optionsedit off
            5⤵
            • Modifies boot configuration data using bcdedit
            PID:2636
          • C:\Windows\system32\bcdedit.exe
            bcdedit.exe /set {current} bootstatuspolicy IgnoreAllFailures
            5⤵
            • Modifies boot configuration data using bcdedit
            PID:2460
          • C:\Windows\system32\bcdedit.exe
            bcdedit.exe /set {current} recoveryenabled off
            5⤵
            • Modifies boot configuration data using bcdedit
            PID:1272
          • C:\Windows\SysWOW64\NOTEPAD.EXE
            "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Howto_RESTORE_FILES.txt
            5⤵
            • Opens file in notepad (likely ransom note)
            PID:712
          • C:\Program Files\Internet Explorer\iexplore.exe
            "C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\Desktop\Howto_RESTORE_FILES.html
            5⤵
            • Modifies Internet Explorer settings
            • Suspicious use of FindShellTrayWindow
            • Suspicious use of SetWindowsHookEx
            • Suspicious use of WriteProcessMemory
            PID:308
            • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
              "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:308 CREDAT:275457 /prefetch:2
              6⤵
              • Modifies Internet Explorer settings
              • Suspicious use of SetWindowsHookEx
              PID:1732
          • C:\Windows\System32\vssadmin.exe
            "C:\Windows\System32\vssadmin.exe" delete shadows /all /Quiet
            5⤵
            • Interacts with shadow copies
            PID:3016
          • C:\Windows\SysWOW64\cmd.exe
            "C:\Windows\system32\cmd.exe" /c DEL C:\Users\Admin\AppData\Roaming\LXBSXA~1.EXE
            5⤵
              PID:2612
        • C:\Windows\SysWOW64\cmd.exe
          "C:\Windows\system32\cmd.exe" /c DEL C:\Users\Admin\AppData\Local\Temp\VIRUSS~1.EXE
          3⤵
          • Deletes itself
          PID:1964
    • C:\Windows\system32\vssvc.exe
      C:\Windows\system32\vssvc.exe
      1⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:2908
    • C:\Windows\SysWOW64\DllHost.exe
      C:\Windows\SysWOW64\DllHost.exe /Processid:{76D0CB12-7604-4048-B83C-1005C7DDC503}
      1⤵
      • Suspicious use of FindShellTrayWindow
      PID:2356

    Network

          MITRE ATT&CK Enterprise v15

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          how_recover+cnu.html
          • Path C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\how_recover+cnu.html
          • Size 9KB
          • SHA256 c25f6e2bb0ec2542cbf53ee2e4853090d1d7bb45db3d0ff99f2111f986a239fc
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          how_recover+cnu.txt
          • Path C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\how_recover+cnu.txt
          • Size 2KB
          • SHA256 931e6e169fd911a572dcdcc779c57133819b4945358904c6b619a0ae6d970900
          • MD5 SHA1 SHA512
          Submit Download

          asl-v20.txt
          • Path C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.ssl.feature_1.0.0.v20140827-1444\asl-v20.txt
          • Size 11KB
          • SHA256 6aeeec60d5a2971fb4ff5c8dd1393ff91b3eb87a559c4d7c20f46cbd4febba75
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          THIRDPARTYLICENSEREADME-JAVAFX.txt
          • Path C:\Program Files\Java\jre7\THIRDPARTYLICENSEREADME-JAVAFX.txt
          • Size 109KB
          • SHA256 23c7f11b8efa85c0fda8df75a779f2f1a9be957a043a1b7d43fafaf38f0ed0bc
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          THIRDPARTYLICENSEREADME.txt
          • Path C:\Program Files\Java\jre7\THIRDPARTYLICENSEREADME.txt
          • Size 173KB
          • SHA256 a6141fd08af79f971b4b50a278d035974296efe2584a675a6397b5d02a5e9b9b
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          94308059B57B3142E455B38A6EB92015
          • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015
          • Size 70KB
          • SHA256 b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          94308059B57B3142E455B38A6EB92015
          • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
          • Size 342B
          • SHA256 db110ed2f456f4ea9a779ead0e4b06f2a971f02d794f828bda043a24d7f87ef5
          • MD5 SHA1 SHA512
          Submit Download

          94308059B57B3142E455B38A6EB92015
          • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
          • Size 342B
          • SHA256 6a24cdbfcde5e5456f7a8e7ce2a5721506d91b60260aed6151b578ffb850a046
          • MD5 SHA1 SHA512
          Submit Download

          94308059B57B3142E455B38A6EB92015
          • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
          • Size 342B
          • SHA256 4c362e7864a03f54d6cdd86103e2c268cafdc9b4a5c0b6d04fb6b48fc381609b
          • MD5 SHA1 SHA512
          Submit Download

          94308059B57B3142E455B38A6EB92015
          • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
          • Size 342B
          • SHA256 ce5a648885df8067c96f3b87842941908f4cc6c7469ee85b27a7a656c2235840
          • MD5 SHA1 SHA512
          Submit Download

          94308059B57B3142E455B38A6EB92015
          • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
          • Size 342B
          • SHA256 ac57270feece3cc8e2b9635611731ee12fd2047320bce24be93beb8a85004b8b
          • MD5 SHA1 SHA512
          Submit Download

          94308059B57B3142E455B38A6EB92015
          • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
          • Size 342B
          • SHA256 5b056b19c8d88f3f54490eed8f0e7ed947bebbf2b398fb0cfddb47091a8accc2
          • MD5 SHA1 SHA512
          Submit Download

          94308059B57B3142E455B38A6EB92015
          • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
          • Size 342B
          • SHA256 92d01201a1ab5f6b1a2a8ea4546c2f5e127a7efc0091a52fd356983476441b26
          • MD5 SHA1 SHA512
          Submit Download

          94308059B57B3142E455B38A6EB92015
          • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
          • Size 342B
          • SHA256 b6f0c7c8c1e515b92c2f7007e82f688d4a43dc0607667b72fc7a2a20919463d9
          • MD5 SHA1 SHA512
          Submit Download

          94308059B57B3142E455B38A6EB92015
          • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
          • Size 342B
          • SHA256 b89011c7b6a06c3816bffb4791e34ef11c30221e59e4fd28bc54c58f2650a4cd
          • MD5 SHA1 SHA512
          Submit Download

          94308059B57B3142E455B38A6EB92015
          • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
          • Size 342B
          • SHA256 9096f4bc4adf556c69f52d74c0af086c8450d5ad33d23dd7f8cab58fe5a66ef4
          • MD5 SHA1 SHA512
          Submit Download

          94308059B57B3142E455B38A6EB92015
          • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
          • Size 342B
          • SHA256 98ef3202137ffa22a4b723048befd584eaa4434d0bc621c1e3029303df358c17
          • MD5 SHA1 SHA512
          Submit Download

          94308059B57B3142E455B38A6EB92015
          • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
          • Size 342B
          • SHA256 7c61df41a3f1f777885644b4034d0f33a777d6f809ba3ecbca2e0e0739ecc426
          • MD5 SHA1 SHA512
          Submit Download

          94308059B57B3142E455B38A6EB92015
          • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
          • Size 342B
          • SHA256 8f1b638b44fde991228e065a7832b3326a9418e9a264c46c86f1150b355b5d78
          • MD5 SHA1 SHA512
          Submit Download

          94308059B57B3142E455B38A6EB92015
          • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
          • Size 342B
          • SHA256 19960349388519f8ea04382b4336876731884893ccf2319b60734a4ec67e8421
          • MD5 SHA1 SHA512
          Submit Download

          94308059B57B3142E455B38A6EB92015
          • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
          • Size 342B
          • SHA256 01bdf1f744794be8e2d6f1e56be61a645c3a3769d11ce97fc1cf2e1ae387fb64
          • MD5 SHA1 SHA512
          Submit Download

          94308059B57B3142E455B38A6EB92015
          • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
          • Size 342B
          • SHA256 1498bd998ce1264b38e2a05f5494d40247d302addc055b907f0001d5931854dc
          • MD5 SHA1 SHA512
          Submit Download

          94308059B57B3142E455B38A6EB92015
          • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
          • Size 342B
          • SHA256 c1d885e0dd4033a549f43cd4813f8760c2a4ae9fc8eaae0116abce08d2ea5967
          • MD5 SHA1 SHA512
          Submit Download

          94308059B57B3142E455B38A6EB92015
          • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
          • Size 342B
          • SHA256 ef45005a35360562c1123c9c54e7158f69c6e11e54b1d35c50018db0bf34bc00
          • MD5 SHA1 SHA512
          Submit Download

          Tar45DD.tmp
          • Path C:\Users\Admin\AppData\Local\Temp\Tar45DD.tmp
          • Size 181KB
          • SHA256 8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          Howto_RESTORE_FILES.bmp
          • Path C:\Users\Admin\Desktop\Howto_RESTORE_FILES.bmp
          • Size 3.3MB
          • SHA256 350f38ce90d60580b6f3118c899db8f42ff9f1ce9c0fb094e09d8fd16949cf08
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          lxbsxacroic.exe
          • Path \Users\Admin\AppData\Roaming\lxbsxacroic.exe
          • Size 344KB
          • SHA256 38129f85a69aebacbd4a0667272b249e56b15eb9593fbeed2a4faa99851fdbd2
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          memory/2356-4346-0x00000000001E0000-0x00000000001E2000-memory.dmp
          Download

          memory/2524-4348-0x0000000000400000-0x0000000000485000-memory.dmp
          Download

          memory/2524-57-0x0000000000400000-0x0000000000485000-memory.dmp
          Download

          memory/2524-4345-0x0000000003500000-0x0000000003502000-memory.dmp
          Download

          memory/2524-2627-0x0000000000400000-0x0000000000485000-memory.dmp
          Download

          memory/2524-51-0x0000000000400000-0x0000000000485000-memory.dmp
          Download

          memory/2524-4349-0x0000000000400000-0x0000000000485000-memory.dmp
          Download

          memory/2524-52-0x0000000000400000-0x0000000000485000-memory.dmp
          Download

          memory/2524-4401-0x0000000000400000-0x0000000000485000-memory.dmp
          Download

          memory/2524-53-0x0000000000400000-0x0000000000485000-memory.dmp
          Download

          memory/2524-4339-0x0000000000400000-0x0000000000485000-memory.dmp
          Download

          memory/2524-56-0x0000000000400000-0x0000000000485000-memory.dmp
          Download

          memory/2524-946-0x0000000000400000-0x0000000000485000-memory.dmp
          Download

          memory/2596-31-0x0000000000400000-0x00000000005CB000-memory.dmp
          Download

          memory/2744-1-0x0000000000400000-0x0000000000485000-memory.dmp
          Download

          memory/2744-15-0x0000000000400000-0x0000000000485000-memory.dmp
          Download

          memory/2744-19-0x0000000000400000-0x0000000000485000-memory.dmp
          Download

          memory/2744-13-0x000000007EFDE000-0x000000007EFDF000-memory.dmp
          Download

          memory/2744-18-0x0000000000400000-0x0000000000485000-memory.dmp
          Download

          memory/2744-3-0x0000000000400000-0x0000000000485000-memory.dmp
          Download

          memory/2744-5-0x0000000000400000-0x0000000000485000-memory.dmp
          Download

          memory/2744-9-0x0000000000400000-0x0000000000485000-memory.dmp
          Download

          memory/2744-11-0x0000000000400000-0x0000000000485000-memory.dmp
          Download

          memory/2744-30-0x0000000000400000-0x0000000000485000-memory.dmp
          Download

          memory/2744-7-0x0000000000400000-0x0000000000485000-memory.dmp
          Download

          memory/2992-0-0x0000000000200000-0x0000000000203000-memory.dmp
          Download

          memory/2992-16-0x0000000000200000-0x0000000000203000-memory.dmp
          Download