4f1e783f68071d95e0b07e1f8b80ed49d0d94a089ae96016b197f846350cfe66

General

Target

VirusShare_4affa384ff6ab351df42fc3a02716670.exe
Size

364KB
MD5

4affa384ff6ab351df42fc3a02716670
SHA1

7bebae1ad50fd27c3df625dc3995256f7d8bb8c2
SHA256

4f1e783f68071d95e0b07e1f8b80ed49d0d94a089ae96016b197f846350cfe66
SHA512

802616cac860ed2facd74387475e45ecd5a9e00fb106db801cd0168659fcecb9bb0ca6afb4cfeeca592d24d20c07add685e9a65c3178c839d37850a324906070
SSDEEP

6144:rHDYm7R++Qhm/FxsB+lIB+0ODLawCi308Ki7B4iTK24D1sr:rHr2mwB+g03S5idVK24Zsr

Score

10^/10

defense_evasion execution impact persistence ransomware spyware stealer

Malware Config

Extracted

Path

C:\Program Files\7-Zip\Lang\+REcovER+iivys+.txt

Ransom Note

{}_~_~+ -$.-_+$|~~_|| =|_$.**+-~| $+|=*.-=| !!! IMPORTANT INFORMATION !!!! All of your files are encrypted with RSA-4096. More information about the RSA algorythm can be found here: http://en.wikipedia.org/wiki/RSA_(cryptosystem) Decrypting of your files is only possible with the private key and decrypt program, which is on our secret server. To receive your private key follow one of the links: 1. http://88fga.ketteaero.com/F126583B6F187C94 2. http://2bdfb.spinakrosa.at/F126583B6F187C94 3. http://uj5nj.onanwhit.com/F126583B6F187C94 If all of the addresses are not available, follow these steps: 1. Download and install Tor Browser: https://www.torproject.org/download/download-easy.html 2. After a successful installation, run the browser and wait for initialization. 3. Type in the address bar: k7tlx3ghr3m4n2tu.onion/F126583B6F187C94 4. Follow the instructions on the site. !!! Your personal identification ID: F126583B6F187C94 !!! )(*=~_$~+$==-$*~=$$ __$-=-+*

URLs

http://88fga.ketteaero.com/F126583B6F187C94

http://2bdfb.spinakrosa.at/F126583B6F187C94

http://uj5nj.onanwhit.com/F126583B6F187C94

http://k7tlx3ghr3m4n2tu.onion/F126583B6F187C94

Signatures

Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware defense_evasion impact execution

File Deletion
T1070.004

Inhibit System Recovery
T1490

Windows Management Instrumentation
T1047

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

VirusShare_4affa384ff6ab351df42fc3a02716670.exeusqurq.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\International\Geo\Nation	VirusShare_4affa384ff6ab351df42fc3a02716670.exe
Key value queried	\REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\International\Geo\Nation	usqurq.exe

Drops startup file 4 IoCs

Processes:

usqurq.exe

description	ioc	process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\+REcovER+iivys+.png	usqurq.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\+REcovER+iivys+.txt	usqurq.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\+REcovER+iivys+.png	usqurq.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\+REcovER+iivys+.txt	usqurq.exe

Executes dropped EXE 2 IoCs

Processes:

usqurq.exeusqurq.exe

pid process

440 usqurq.exe
2492 usqurq.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

pid	process
440	usqurq.exe
2492	usqurq.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

usqurq.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\vssrrfkbu = "C:\\Windows\\SYSTEM32\\CMD.EXE /C START \"\" \"C:\\Users\\Admin\\Documents\\usqurq.exe\""	usqurq.exe

Suspicious use of SetThreadContext 2 IoCs

Processes:

VirusShare_4affa384ff6ab351df42fc3a02716670.exeusqurq.exe

description	pid	process	target process
PID 3772 set thread context of 3956	3772	VirusShare_4affa384ff6ab351df42fc3a02716670.exe	VirusShare_4affa384ff6ab351df42fc3a02716670.exe
PID 440 set thread context of 2492	440	usqurq.exe	usqurq.exe

Drops file in Program Files directory 64 IoCs

Processes:

usqurq.exe

description	ioc	process
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.1907.3152.0_x64__8wekyb3d8bbwe\Assets\MediumGray.png	usqurq.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\zh-TW\+REcovER+iivys+.png	usqurq.exe
File opened for modification	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\ja\+REcovER+iivys+.txt	usqurq.exe
File opened for modification	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.XboxApp_48.49.31001.0_neutral_split.scale-200_8wekyb3d8bbwe\Assets\GamesXboxHubSplashScreen.scale-200_contrast-high.png	usqurq.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Getstarted_8.2.22942.0_x64__8wekyb3d8bbwe\Assets\GetStartedAppList.targetsize-16_altform-unplated.png	usqurq.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2019.19071.12548.0_x64__8wekyb3d8bbwe\AppCS\Assets\FaceReco_Illustration_LRG.png	usqurq.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1906.55.0_x64__8wekyb3d8bbwe\Assets\Date.targetsize-20_contrast-black.png	usqurq.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Xbox.TCUI_1.23.28002.0_neutral_~_8wekyb3d8bbwe\+REcovER+iivys+.png	usqurq.exe
File opened for modification	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Car\+REcovER+iivys+.png	usqurq.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Assets\AppTiles\WeatherIcons\30x30\152.png	usqurq.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Common.View.UWP\Strings\fi-FI\+REcovER+iivys+.png	usqurq.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\ReactAssets\assets\node_modules\reactxp-experimental-navigation\NavigationExperimental\+REcovER+iivys+.txt	usqurq.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\HxCalendarAppList.targetsize-80_altform-unplated.png	usqurq.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.1907.3152.0_x64__8wekyb3d8bbwe\Assets\InsiderHubAppList.targetsize-48_altform-unplated_contrast-black.png	usqurq.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\SecondaryTiles\Car\LTR\contrast-white\+REcovER+iivys+.txt	usqurq.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.XboxIdentityProvider_12.50.6001.0_x64__8wekyb3d8bbwe\Assets\xbox_live_logo_black.png	usqurq.exe
File opened for modification	C:\Program Files\Common Files\System\msadc\it-IT\+REcovER+iivys+.png	usqurq.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\LivePersonaCard\images\default\linkedin_ghost_profile.png	usqurq.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\AppxMetadata\+REcovER+iivys+.png	usqurq.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.ScreenSketch_10.1907.2471.0_x64__8wekyb3d8bbwe\Assets\ClippingTool.targetsize-24.png	usqurq.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2019.19071.12548.0_neutral_~_8wekyb3d8bbwe\+REcovER+iivys+.txt	usqurq.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_10.1906.2182.0_x64__8wekyb3d8bbwe\Assets\AlarmsAppList.contrast-black_targetsize-72_altform-unplated.png	usqurq.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.549981C3F5F10_1.1911.21713.0_x64__8wekyb3d8bbwe\Assets\Images\contrast-standard\+REcovER+iivys+.png	usqurq.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppPackageAppList.targetsize-80_contrast-black.png	usqurq.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MSPaint_6.1907.29027.0_x64__8wekyb3d8bbwe\Assets\Dial\Thickness.png	usqurq.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.VP9VideoExtensions_1.0.22681.0_x64__8wekyb3d8bbwe\Assets\AppList.targetsize-60_altform-unplated.png	usqurq.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\SecondaryTiles\Home\contrast-black\+REcovER+iivys+.png	usqurq.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.YourPhone_0.19051.7.0_x64__8wekyb3d8bbwe\Assets\AppTiles\AppIcon.targetsize-36_altform-unplated.png	usqurq.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\MSIPC\nl\+REcovER+iivys+.png	usqurq.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Assets\AppTiles\+REcovER+iivys+.txt	usqurq.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\ReactAssets\assets\RNApp\app\uwp\+REcovER+iivys+.txt	usqurq.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.VP9VideoExtensions_1.0.22681.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppList.targetsize-36_contrast-white.png	usqurq.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1906.55.0_x64__8wekyb3d8bbwe\Assets\Standard.targetsize-20_contrast-black.png	usqurq.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\HxCalendarSmallTile.scale-200.png	usqurq.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskpred\+REcovER+iivys+.txt	usqurq.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\WATER\THMBNAIL.PNG	usqurq.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Home\LTR\+REcovER+iivys+.txt	usqurq.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\HxMailAppList.targetsize-24_altform-lightunplated.png	usqurq.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe\Resources\Fonts\+REcovER+iivys+.png	usqurq.exe
File opened for modification	C:\Program Files\Windows Photo Viewer\fr-FR\+REcovER+iivys+.txt	usqurq.exe
File opened for modification	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\SecondaryTiles\Work\contrast-white\SmallTile.scale-125.png	usqurq.exe
File opened for modification	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsStore_11910.1002.5.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\AppTiles\contrast-black\+REcovER+iivys+.png	usqurq.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.ScreenSketch_10.1907.2471.0_x64__8wekyb3d8bbwe\+REcovER+iivys+.txt	usqurq.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WebpImageExtension_1.0.22753.0_x64__8wekyb3d8bbwe\Assets\WideTile.scale-100.png	usqurq.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1906.55.0_x64__8wekyb3d8bbwe\Assets\Scientific.targetsize-32_contrast-white.png	usqurq.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2019.19071.12548.0_x64__8wekyb3d8bbwe\Assets\+REcovER+iivys+.txt	usqurq.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_10.1906.2182.0_neutral_split.scale-100_8wekyb3d8bbwe\microsoft.system.package.metadata\+REcovER+iivys+.txt	usqurq.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.0.22742.0_x64__8wekyb3d8bbwe\x86\+REcovER+iivys+.txt	usqurq.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Common.View.UWP\Strings\it-IT\View3d\+REcovER+iivys+.png	usqurq.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MSPaint_6.1907.29027.0_x64__8wekyb3d8bbwe\Assets\Dial\RotateX.PNG	usqurq.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MSPaint_6.1907.29027.0_x64__8wekyb3d8bbwe\Assets\StartScreen\+REcovER+iivys+.png	usqurq.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\OneNoteNotebookWideTile.scale-400.png	usqurq.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.ScreenSketch_10.1907.2471.0_neutral_split.scale-125_8wekyb3d8bbwe\microsoft.system.package.metadata\+REcovER+iivys+.png	usqurq.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\SecondaryTiles\Car\LTR\contrast-white\SmallTile.scale-200.png	usqurq.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe\Assets\Scrubbing_icons.png	usqurq.exe
File opened for modification	C:\Program Files\Windows Defender\en-US\+REcovER+iivys+.png	usqurq.exe
File opened for modification	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\SecondaryTiles\Home\contrast-white\LargeTile.scale-125.png	usqurq.exe
File opened for modification	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsStore_11910.1002.5.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\AppTiles\contrast-black\StoreWideTile.scale-100.png	usqurq.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Getstarted_8.2.22942.0_x64__8wekyb3d8bbwe\Assets\GetStartedAppList.scale-100_contrast-black.png	usqurq.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1906.55.0_x64__8wekyb3d8bbwe\Assets\CalculatorAppList.contrast-white_targetsize-40.png	usqurq.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\Spotlight_NFL.png	usqurq.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\contrast-black\OneNoteSectionGroupLargeTile.scale-200.png	usqurq.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WebMediaExtensions_1.0.20875.0_neutral_~_8wekyb3d8bbwe\AppxMetadata\+REcovER+iivys+.txt	usqurq.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2019.19071.12548.0_x64__8wekyb3d8bbwe\Assets\PhotosAppList.targetsize-20_altform-unplated_contrast-white.png	usqurq.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Interacts with shadow copies 2 TTPs 2 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
ransomware

File Deletion
T1070.004

Inhibit System Recovery
T1490

Processes:

vssadmin.exevssadmin.exe

pid process

3164 vssadmin.exe
3608 vssadmin.exe
Modifies data under HKEY_USERS 1 IoCs

Processes:

usqurq.exe

description ioc process

Key created \REGISTRY\USER\.DEFAULT\Software\Axronics usqurq.exe
Modifies registry class 1 IoCs

Processes:

usqurq.exe

description ioc process

Key created \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000_Classes\Local Settings usqurq.exe

pid	process
3164	vssadmin.exe
3608	vssadmin.exe

description	ioc	process
Key created	\REGISTRY\USER\.DEFAULT\Software\Axronics	usqurq.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000_Classes\Local Settings	usqurq.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

usqurq.exe

pid	process
2492	usqurq.exe
2492	usqurq.exe
2492	usqurq.exe
2492	usqurq.exe
2492	usqurq.exe
2492	usqurq.exe
2492	usqurq.exe
2492	usqurq.exe
2492	usqurq.exe
2492	usqurq.exe
2492	usqurq.exe
2492	usqurq.exe
2492	usqurq.exe
2492	usqurq.exe
2492	usqurq.exe
2492	usqurq.exe
2492	usqurq.exe
2492	usqurq.exe
2492	usqurq.exe
2492	usqurq.exe
2492	usqurq.exe
2492	usqurq.exe
2492	usqurq.exe
2492	usqurq.exe
2492	usqurq.exe
2492	usqurq.exe
2492	usqurq.exe
2492	usqurq.exe
2492	usqurq.exe
2492	usqurq.exe
2492	usqurq.exe
2492	usqurq.exe
2492	usqurq.exe
2492	usqurq.exe
2492	usqurq.exe
2492	usqurq.exe
2492	usqurq.exe
2492	usqurq.exe
2492	usqurq.exe
2492	usqurq.exe
2492	usqurq.exe
2492	usqurq.exe
2492	usqurq.exe
2492	usqurq.exe
2492	usqurq.exe
2492	usqurq.exe
2492	usqurq.exe
2492	usqurq.exe
2492	usqurq.exe
2492	usqurq.exe
2492	usqurq.exe
2492	usqurq.exe
2492	usqurq.exe
2492	usqurq.exe
2492	usqurq.exe
2492	usqurq.exe
2492	usqurq.exe
2492	usqurq.exe
2492	usqurq.exe
2492	usqurq.exe
2492	usqurq.exe
2492	usqurq.exe
2492	usqurq.exe
2492	usqurq.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes:

usqurq.exevssvc.exe

description	pid	process
Token: SeDebugPrivilege	2492	usqurq.exe
Token: SeBackupPrivilege	4728	vssvc.exe
Token: SeRestorePrivilege	4728	vssvc.exe
Token: SeAuditPrivilege	4728	vssvc.exe

Suspicious use of WriteProcessMemory 36 IoCs

Processes:

VirusShare_4affa384ff6ab351df42fc3a02716670.exeVirusShare_4affa384ff6ab351df42fc3a02716670.exeusqurq.exeusqurq.exe

description	pid	process	target process
PID 3772 wrote to memory of 3956	3772	VirusShare_4affa384ff6ab351df42fc3a02716670.exe	VirusShare_4affa384ff6ab351df42fc3a02716670.exe
PID 3772 wrote to memory of 3956	3772	VirusShare_4affa384ff6ab351df42fc3a02716670.exe	VirusShare_4affa384ff6ab351df42fc3a02716670.exe
PID 3772 wrote to memory of 3956	3772	VirusShare_4affa384ff6ab351df42fc3a02716670.exe	VirusShare_4affa384ff6ab351df42fc3a02716670.exe
PID 3772 wrote to memory of 3956	3772	VirusShare_4affa384ff6ab351df42fc3a02716670.exe	VirusShare_4affa384ff6ab351df42fc3a02716670.exe
PID 3772 wrote to memory of 3956	3772	VirusShare_4affa384ff6ab351df42fc3a02716670.exe	VirusShare_4affa384ff6ab351df42fc3a02716670.exe
PID 3772 wrote to memory of 3956	3772	VirusShare_4affa384ff6ab351df42fc3a02716670.exe	VirusShare_4affa384ff6ab351df42fc3a02716670.exe
PID 3772 wrote to memory of 3956	3772	VirusShare_4affa384ff6ab351df42fc3a02716670.exe	VirusShare_4affa384ff6ab351df42fc3a02716670.exe
PID 3772 wrote to memory of 3956	3772	VirusShare_4affa384ff6ab351df42fc3a02716670.exe	VirusShare_4affa384ff6ab351df42fc3a02716670.exe
PID 3772 wrote to memory of 3956	3772	VirusShare_4affa384ff6ab351df42fc3a02716670.exe	VirusShare_4affa384ff6ab351df42fc3a02716670.exe
PID 3772 wrote to memory of 3956	3772	VirusShare_4affa384ff6ab351df42fc3a02716670.exe	VirusShare_4affa384ff6ab351df42fc3a02716670.exe
PID 3956 wrote to memory of 440	3956	VirusShare_4affa384ff6ab351df42fc3a02716670.exe	usqurq.exe
PID 3956 wrote to memory of 440	3956	VirusShare_4affa384ff6ab351df42fc3a02716670.exe	usqurq.exe
PID 3956 wrote to memory of 440	3956	VirusShare_4affa384ff6ab351df42fc3a02716670.exe	usqurq.exe
PID 3956 wrote to memory of 456	3956	VirusShare_4affa384ff6ab351df42fc3a02716670.exe	cmd.exe
PID 3956 wrote to memory of 456	3956	VirusShare_4affa384ff6ab351df42fc3a02716670.exe	cmd.exe
PID 3956 wrote to memory of 456	3956	VirusShare_4affa384ff6ab351df42fc3a02716670.exe	cmd.exe
PID 440 wrote to memory of 2492	440	usqurq.exe	usqurq.exe
PID 440 wrote to memory of 2492	440	usqurq.exe	usqurq.exe
PID 440 wrote to memory of 2492	440	usqurq.exe	usqurq.exe
PID 440 wrote to memory of 2492	440	usqurq.exe	usqurq.exe
PID 440 wrote to memory of 2492	440	usqurq.exe	usqurq.exe
PID 440 wrote to memory of 2492	440	usqurq.exe	usqurq.exe
PID 440 wrote to memory of 2492	440	usqurq.exe	usqurq.exe
PID 440 wrote to memory of 2492	440	usqurq.exe	usqurq.exe
PID 440 wrote to memory of 2492	440	usqurq.exe	usqurq.exe
PID 440 wrote to memory of 2492	440	usqurq.exe	usqurq.exe
PID 2492 wrote to memory of 3608	2492	usqurq.exe	vssadmin.exe
PID 2492 wrote to memory of 3608	2492	usqurq.exe	vssadmin.exe
PID 2492 wrote to memory of 4116	2492	usqurq.exe	NOTEPAD.EXE
PID 2492 wrote to memory of 4116	2492	usqurq.exe	NOTEPAD.EXE
PID 2492 wrote to memory of 4116	2492	usqurq.exe	NOTEPAD.EXE
PID 2492 wrote to memory of 3164	2492	usqurq.exe	vssadmin.exe
PID 2492 wrote to memory of 3164	2492	usqurq.exe	vssadmin.exe
PID 2492 wrote to memory of 1508	2492	usqurq.exe	cmd.exe
PID 2492 wrote to memory of 1508	2492	usqurq.exe	cmd.exe
PID 2492 wrote to memory of 1508	2492	usqurq.exe	cmd.exe

System policy modification 1 TTPs 2 IoCs

evasion

Modify Registry

T1112

Processes:

usqurq.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLinkedConnections = "1"	usqurq.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	usqurq.exe

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\VirusShare_4affa384ff6ab351df42fc3a02716670.exe
"C:\Users\Admin\AppData\Local\Temp\VirusShare_4affa384ff6ab351df42fc3a02716670.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3772
- C:\Users\Admin\AppData\Local\Temp\VirusShare_4affa384ff6ab351df42fc3a02716670.exe
  "C:\Users\Admin\AppData\Local\Temp\VirusShare_4affa384ff6ab351df42fc3a02716670.exe"
  2⤵
  - Checks computer location settings
  - Suspicious use of WriteProcessMemory
  PID:3956
- - C:\Users\Admin\Documents\usqurq.exe
    C:\Users\Admin\Documents\usqurq.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious use of WriteProcessMemory
    PID:440
  - - C:\Users\Admin\Documents\usqurq.exe
      C:\Users\Admin\Documents\usqurq.exe
      4⤵
      Checks computer location settings
      Drops startup file
      Executes dropped EXE
      Adds Run key to start application
      Drops file in Program Files directory
      Modifies data under HKEY_USERS
      Modifies registry class
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      System policy modification
      PID:2492
    - - C:\Windows\System32\vssadmin.exe
        
        "C:\Windows\System32\vssadmin.exe" Delete Shadows /All /Quiet
        5⤵
        Interacts with shadow copies
        
        PID:3608
    - - C:\Windows\SysWOW64\NOTEPAD.EXE
        
        "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\+REcovER+iivys+.txt
        5⤵
        
        PID:4116
    - - C:\Windows\System32\vssadmin.exe
        
        "C:\Windows\System32\vssadmin.exe" Delete Shadows /All /Quiet
        5⤵
        Interacts with shadow copies
        
        PID:3164
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c DEL C:\Users\Admin\DOCUME~1\usqurq.exe >> NUL
        5⤵
        
        PID:1508
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /c DEL C:\Users\Admin\AppData\Local\Temp\VIRUSS~1.EXE >> NUL
    3⤵
    PID:456

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4728

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Windows Management Instrumentation

1

T1047

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Indicator Removal

2

T1070

File Deletion

Modify Registry

Credential Access

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Inhibit System Recovery

2

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\7-Zip\Lang\+REcovER+iivys+.png

Filesize
37KB

MD5
9857d0da203e4efc59c5882ac243a6be

SHA1
174445b060b1f2118c0394f039d6e755235397a9

SHA256
07d13c68a619ac70ff416ea532bbadcf50a92ed5df465c9d79566bbb370922ea

SHA512
36fa87e49c3be02c563a4a39179bffccc395de1e75d29797e4d8374abd4d712c7637172dfab1c5b2bec365cde901112deaa9613eb9513ad23eca5430e3a15ef2

Download Submit
C:\Program Files\7-Zip\Lang\+REcovER+iivys+.txt

Filesize
1KB

MD5
2e4535e7708073e4552658dd8aac9e14

SHA1
ac1d45963a83d7d510e37b08032b9c189cab2ebd

SHA256
3cc6bf2c49873dec140bfb241749d3ab9b9f2c9968279b6119a2489cdfbb2931

SHA512
5e10a512d6bfbf2bb6c4bf3512992c70d32f2ef065a939767d8afa58ec7d5a94824b79824662604b1ca5545f072e8c38bf9f092b6ffad80fc844867d731f7cda

Download Submit
C:\Users\Admin\Documents\usqurq.exe

Filesize
364KB

MD5
4affa384ff6ab351df42fc3a02716670

SHA1
7bebae1ad50fd27c3df625dc3995256f7d8bb8c2

SHA256
4f1e783f68071d95e0b07e1f8b80ed49d0d94a089ae96016b197f846350cfe66

SHA512
802616cac860ed2facd74387475e45ecd5a9e00fb106db801cd0168659fcecb9bb0ca6afb4cfeeca592d24d20c07add685e9a65c3178c839d37850a324906070

Download Submit
memory/440-13-0x0000000000400000-0x00000000004CB000-memory.dmp

Filesize
812KB

Download
memory/2492-24-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2492-3376-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2492-6662-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2492-6665-0x0000000073F20000-0x0000000073F59000-memory.dmp

Filesize
228KB

Download
memory/2492-6658-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2492-6659-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2492-6653-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2492-6652-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2492-20-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2492-22-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2492-21-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2492-23-0x0000000073F20000-0x0000000073F59000-memory.dmp

Filesize
228KB

Download
memory/2492-5654-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2492-26-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2492-29-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2492-3385-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2492-1478-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2492-158-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3772-1-0x0000000000730000-0x0000000000736000-memory.dmp

Filesize
24KB

Download
memory/3772-0-0x0000000000730000-0x0000000000736000-memory.dmp

Filesize
24KB

Download
memory/3772-4-0x0000000000730000-0x0000000000736000-memory.dmp

Filesize
24KB

Download
memory/3956-6-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3956-2-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3956-16-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3956-17-0x0000000074D40000-0x0000000074D79000-memory.dmp

Filesize
228KB

Download
memory/3956-3-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3956-7-0x0000000074D40000-0x0000000074D79000-memory.dmp

Filesize
228KB

Download
memory/3956-5-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads