Overview

overview

10

Static

static

3

VirusShare...19.exe

windows7-x64

10

VirusShare...19.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    127s
  • max time network
    152s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240426-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
  • submitted
    10/06/2024, 11:21

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    VirusShare_495156ba604fe45c08317b6a021ac519.exe
  • Size 368KB
  • Sample240610-ngaraagg7y
  • SHA256 6f90dd4223c979615f55b7a6a6c88370052b96cc4309cde2048a00d8fab60b17
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
defense_evasionexecutionimpactpersistenceransomwarespywarestealer

Malware Config

Extracted

Path

  • C:\Program Files\7-Zip\Lang\+-xxx-HELP-xxx-+qhule-+.txt

Ransom Note
  • ---------------------------------------------------- NOT YOUR LANGUAGE? USE https://translate.google.com What's the matter with your files? Your data was secured using a strong encryption with RSA4096. Use the link down below to find additional information on the encryption keys using RSA-4096 https://en.wikipedia.org/wiki/RSA_(cryptosystem) What exactly that means? It means that on a structural level your files have been transformed . You won't be able to use , read , see or work with them anymore . In other words they are useless , however , there is a possibility to restore them with our help . What exactly happened to your files ??? *** Two personal RSA-4096 keys were generated for your PC/Laptop; one key is public, another key is private. *** All your data and files were encrypted by the means of the public key , which you received over the web . *** In order to decrypt your data and gain access to your computer you need a private key and a decryption software, which can be found on one of our secret servers. What should you do next ? There are several options for you to consider : *** You can wait for a while until the price of a private key will raise, so you will have to pay twice as much to access your files or *** You can start getting BitCoins right now and get access to your data quite fast . In case you have valuable files , we advise you to act fast as there is no other option rather than paying in order to get back your data. In order to obtain specific instructions , please access your personal homepage by choosing one of the few addresses down below : http://9hrds.wolfcrap.at/3341D01EAC4D3430 http://6g4ds.froekuge.com/3341D01EAC4D3430 http://vewrb.italisumo.at/3341D01EAC4D3430 If you can't access your personal homepage or the addresses are not working, complete the following steps: *** Download TOR Browser - http://www.torproject.org/projects/torbrowser.html.en *** Install TOR Browser and open TOR Browser *** Insert the following link in the address bar: k7tlx3ghr3m4n2tu.onion/3341D01EAC4D3430 *** Follow instructions on your screen !!! *** *** *** *** *** *** *** IMPORTANT INFORMATION *** *** *** *** *** *** Your personal homepages http://9hrds.wolfcrap.at/3341D01EAC4D3430 http://6g4ds.froekuge.com/3341D01EAC4D3430 http://vewrb.italisumo.at/3341D01EAC4D3430 Your personal homepage Tor-Browser k7tlx3ghr3m4n2tu.onion/3341D01EAC4D3430 Your personal ID 3341D01EAC4D3430
URLs

  • http://9hrds.wolfcrap.at/3341D01EAC4D3430

  • http://6g4ds.froekuge.com/3341D01EAC4D3430

  • http://vewrb.italisumo.at/3341D01EAC4D3430

  • http://k7tlx3ghr3m4n2tu.onion/3341D01EAC4D3430

Signatures

  • Deletes shadow copies 3 TTPs

    Ransomware often targets backup files to inhibit system recovery.

    ransomwaredefense_evasionimpactexecution
  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file 6 IoCs
  • Executes dropped EXE 2 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Suspicious use of SetThreadContext 2 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Interacts with shadow copies 2 TTPs 2 IoCs

    Shadow copies are often targeted by ransomware to inhibit system recovery.

    ransomware
  • Modifies data under HKEY_USERS 1 IoCs
  • Modifies registry class 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of FindShellTrayWindow 25 IoCs
  • Suspicious use of SendNotifyMessage 24 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\VirusShare_495156ba604fe45c08317b6a021ac519.exe
    "C:\Users\Admin\AppData\Local\Temp\VirusShare_495156ba604fe45c08317b6a021ac519.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:4688
    • C:\Users\Admin\AppData\Local\Temp\VirusShare_495156ba604fe45c08317b6a021ac519.exe
      "C:\Users\Admin\AppData\Local\Temp\VirusShare_495156ba604fe45c08317b6a021ac519.exe"
      2⤵
      • Checks computer location settings
      • Suspicious use of WriteProcessMemory
      PID:4724
      • C:\Users\Admin\Documents\obiyuev.exe
        C:\Users\Admin\Documents\obiyuev.exe
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        • Suspicious use of WriteProcessMemory
        PID:1524
        • C:\Users\Admin\Documents\obiyuev.exe
          C:\Users\Admin\Documents\obiyuev.exe
          4⤵
          • Checks computer location settings
          • Drops startup file
          • Executes dropped EXE
          • Adds Run key to start application
          • Drops file in Program Files directory
          • Modifies data under HKEY_USERS
          • Modifies registry class
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:5112
          • C:\Windows\System32\vssadmin.exe
            "C:\Windows\System32\vssadmin.exe" Delete Shadows /All /Quiet
            5⤵
            • Interacts with shadow copies
            PID:640
          • C:\Windows\SysWOW64\NOTEPAD.EXE
            "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\+-xxx-HELP-xxx-+qhule-+.txt
            5⤵
              PID:2500
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\Desktop\+-xxx-HELP-xxx-+qhule-+.html
              5⤵
              • Enumerates system info in registry
              • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
              • Suspicious use of FindShellTrayWindow
              • Suspicious use of SendNotifyMessage
              • Suspicious use of WriteProcessMemory
              PID:984
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9ec4e46f8,0x7ff9ec4e4708,0x7ff9ec4e4718
                6⤵
                  PID:1736
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2200,8342653486230593605,16625198911616556723,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2212 /prefetch:2
                  6⤵
                    PID:2804
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2200,8342653486230593605,16625198911616556723,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2264 /prefetch:3
                    6⤵
                      PID:1612
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2200,8342653486230593605,16625198911616556723,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2872 /prefetch:8
                      6⤵
                        PID:1644
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2200,8342653486230593605,16625198911616556723,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3264 /prefetch:1
                        6⤵
                          PID:3720
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2200,8342653486230593605,16625198911616556723,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3284 /prefetch:1
                          6⤵
                            PID:1200
                          • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2200,8342653486230593605,16625198911616556723,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5132 /prefetch:8
                            6⤵
                              PID:1816
                            • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2200,8342653486230593605,16625198911616556723,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5132 /prefetch:8
                              6⤵
                                PID:1172
                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2200,8342653486230593605,16625198911616556723,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5220 /prefetch:1
                                6⤵
                                  PID:1952
                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2200,8342653486230593605,16625198911616556723,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5324 /prefetch:1
                                  6⤵
                                    PID:308
                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2200,8342653486230593605,16625198911616556723,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3356 /prefetch:1
                                    6⤵
                                      PID:5004
                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2200,8342653486230593605,16625198911616556723,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4012 /prefetch:1
                                      6⤵
                                        PID:3856
                                    • C:\Windows\System32\vssadmin.exe
                                      "C:\Windows\System32\vssadmin.exe" Delete Shadows /All /Quiet
                                      5⤵
                                      • Interacts with shadow copies
                                      PID:2060
                                    • C:\Windows\SysWOW64\cmd.exe
                                      "C:\Windows\system32\cmd.exe" /c DEL C:\Users\Admin\DOCUME~1\obiyuev.exe >> NUL
                                      5⤵
                                        PID:4072
                                  • C:\Windows\SysWOW64\cmd.exe
                                    "C:\Windows\system32\cmd.exe" /c DEL C:\Users\Admin\AppData\Local\Temp\VIRUSS~1.EXE >> NUL
                                    3⤵
                                      PID:4720
                                • C:\Windows\system32\vssvc.exe
                                  C:\Windows\system32\vssvc.exe
                                  1⤵
                                  • Suspicious use of AdjustPrivilegeToken
                                  PID:5036
                                • C:\Windows\System32\CompPkgSrv.exe
                                  C:\Windows\System32\CompPkgSrv.exe -Embedding
                                  1⤵
                                    PID:3384
                                  • C:\Windows\System32\CompPkgSrv.exe
                                    C:\Windows\System32\CompPkgSrv.exe -Embedding
                                    1⤵
                                      PID:2092

                                    Network

                                          MITRE ATT&CK Enterprise v15

                                          Replay Monitor

                                          Loading Replay Monitor...

                                          Downloads

                                          +-xxx-HELP-xxx-+qhule-+.html
                                          • Path C:\Program Files\7-Zip\Lang\+-xxx-HELP-xxx-+qhule-+.html
                                          • Size 6KB
                                          • SHA256 062b83f42225e183dbc0f3e651797fcda5402ea07b6bac519c83b04dd72b9e44
                                          • MD5 SHA1 SHA512 SSDEEP
                                          Submit Download

                                          +-xxx-HELP-xxx-+qhule-+.png
                                          • Path C:\Program Files\7-Zip\Lang\+-xxx-HELP-xxx-+qhule-+.png
                                          • Size 74KB
                                          • SHA256 3fe51602c6ccc189518ae13cec3740c23edd972e57164f164f3c111fbc1fa73e
                                          • MD5 SHA1 SHA512 SSDEEP
                                          Submit Download

                                          +-xxx-HELP-xxx-+qhule-+.txt
                                          • Path C:\Program Files\7-Zip\Lang\+-xxx-HELP-xxx-+qhule-+.txt
                                          • Size 2KB
                                          • SHA256 5df3ff2d29c0e5fc1327ad065b058f75d746bd069af3c8b82ba01955529c229b
                                          • MD5 SHA1 SHA512
                                          Submit Download

                                          settings.dat
                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                          • Size 152B
                                          • SHA256 a1c5f48659d4b3af960971b3a0f433a95fee5bfafe5680a34110c68b342377d8
                                          • MD5 SHA1 SHA512
                                          Submit Download

                                          settings.dat
                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                          • Size 152B
                                          • SHA256 a0ca609205813c307df9122c0c5b0967c5472755700f615b0033129cf7d6b35b
                                          • MD5 SHA1 SHA512
                                          Submit Download

                                          Preferences
                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                          • Size 5KB
                                          • SHA256 21494996b4615dceec90af629a81b7a25e828dc6eb7b83512bcd0de376df30c8
                                          • MD5 SHA1 SHA512 SSDEEP
                                          Submit Download

                                          Preferences
                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                          • Size 6KB
                                          • SHA256 167780aaac92f188106205afaf93917300ef8301e35f8b8492ce82034440fb97
                                          • MD5 SHA1 SHA512 SSDEEP
                                          Submit Download

                                          CURRENT
                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
                                          • Size 16B
                                          • SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
                                          • MD5 SHA1 SHA512
                                          Submit Download

                                          CURRENT
                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
                                          • Size 16B
                                          • SHA256 1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167
                                          • MD5 SHA1 SHA512
                                          Submit Download

                                          Local State
                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                          • Size 10KB
                                          • SHA256 30176702d11d71f00ec5977257e51dbbf48be6baa1aa0b976d6243246322b6ca
                                          • MD5 SHA1 SHA512 SSDEEP
                                          Submit Download

                                          AppCache133586139643214768.txt
                                          • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133586139643214768.txt
                                          • Size 75KB
                                          • SHA256 873b70fa713cdb3caea9ab19c635a3eb9d2b07699cfb92eba3edb5b01cca97da
                                          • MD5 SHA1 SHA512 SSDEEP
                                          Submit Download

                                          obiyuev.exe
                                          • Path C:\Users\Admin\Documents\obiyuev.exe
                                          • Size 368KB
                                          • SHA256 6f90dd4223c979615f55b7a6a6c88370052b96cc4309cde2048a00d8fab60b17
                                          • MD5 SHA1 SHA512 SSDEEP
                                          Submit Download

                                          memory/1524-13-0x0000000000400000-0x00000000004CA000-memory.dmp
                                          Download

                                          memory/4688-0-0x0000000002210000-0x0000000002216000-memory.dmp
                                          Download

                                          memory/4688-3-0x0000000002210000-0x0000000002216000-memory.dmp
                                          Download

                                          memory/4688-1-0x0000000002210000-0x0000000002216000-memory.dmp
                                          Download

                                          memory/4724-17-0x0000000074B40000-0x0000000074B79000-memory.dmp
                                          Download

                                          memory/4724-16-0x0000000000400000-0x0000000000473000-memory.dmp
                                          Download

                                          memory/4724-2-0x0000000000400000-0x0000000000473000-memory.dmp
                                          Download

                                          memory/4724-4-0x0000000000400000-0x0000000000473000-memory.dmp
                                          Download

                                          memory/4724-6-0x0000000000400000-0x0000000000473000-memory.dmp
                                          Download

                                          memory/4724-5-0x0000000000400000-0x0000000000473000-memory.dmp
                                          Download

                                          memory/4724-7-0x0000000074B40000-0x0000000074B79000-memory.dmp
                                          Download

                                          memory/5112-3257-0x0000000000400000-0x0000000000473000-memory.dmp
                                          Download

                                          memory/5112-9528-0x0000000000400000-0x0000000000473000-memory.dmp
                                          Download

                                          memory/5112-4993-0x0000000000400000-0x0000000000473000-memory.dmp
                                          Download

                                          memory/5112-7196-0x0000000000400000-0x0000000000473000-memory.dmp
                                          Download

                                          memory/5112-21-0x0000000000400000-0x0000000000473000-memory.dmp
                                          Download

                                          memory/5112-9517-0x0000000000400000-0x0000000000473000-memory.dmp
                                          Download

                                          memory/5112-9520-0x0000000000400000-0x0000000000473000-memory.dmp
                                          Download

                                          memory/5112-9529-0x0000000000400000-0x0000000000473000-memory.dmp
                                          Download

                                          memory/5112-20-0x0000000000400000-0x0000000000473000-memory.dmp
                                          Download

                                          memory/5112-3258-0x0000000000400000-0x0000000000473000-memory.dmp
                                          Download

                                          memory/5112-22-0x0000000000400000-0x0000000000473000-memory.dmp
                                          Download

                                          memory/5112-28-0x0000000000400000-0x0000000000473000-memory.dmp
                                          Download

                                          memory/5112-1382-0x0000000000400000-0x0000000000473000-memory.dmp
                                          Download

                                          memory/5112-9573-0x0000000074B40000-0x0000000074B79000-memory.dmp
                                          Download

                                          memory/5112-9570-0x0000000000400000-0x0000000000473000-memory.dmp
                                          Download

                                          memory/5112-428-0x0000000000400000-0x0000000000473000-memory.dmp
                                          Download

                                          memory/5112-23-0x0000000074B40000-0x0000000074B79000-memory.dmp
                                          Download

                                          memory/5112-24-0x0000000000400000-0x0000000000473000-memory.dmp
                                          Download

                                          memory/5112-26-0x0000000000400000-0x0000000000473000-memory.dmp
                                          Download