3730e9cba4a93bc985ef7cd2368ccbf5eccd4724f514b38b20e320e5553dd08d

Analysis

max time kernel
1565s
max time network
1566s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
16-07-2024 08:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

084c57449c765416706301c723116da5073aa60da415c0eb3013239611135b0e.exe
Size

49KB
MD5

50248697e19117027d4823c6a3be6db5
SHA1

fb81c35ffe11180c1d6269006db2fc775eec4741
SHA256

084c57449c765416706301c723116da5073aa60da415c0eb3013239611135b0e
SHA512

abc04de0ee5dfc9ca1afccc6b46f9bb4b56d3d9e9ec11165dfc9d3630a597e865941c2c33f4284807f155f69d8255ac3279c418f3bdb2a7f6b4e8678ba7fd6ed
SSDEEP

768:acaQRffDB31aCytHLykiKPT3JATD2qBwV2ckjbnsb0Ah99De0YAD8hMWsddOC86t:acai318HxZATvnsblYO8hMWsdoC86+r

Score

10^/10

defense_evasion execution impact ransomware

Malware Config

Extracted

Path

C:\Users\Admin\Desktop\+README-WARNING+.txt

Ransom Note

::: Hey ::: Small FAQ: .1. Q: What's going on? A: Your files have been encrypted. The file structure was not affected, we did our best to prevent this from happening. .2. Q: How to recover files? A: If you want to decrypt your files, you will need to pay us. .3. Q: What about guarantees? A: It's just business. We are absolutely not interested in you and your transactions, except for profit. If we do not fulfill our work and obligations, no one will cooperate with us. It's not in our interest. To check the possibility of returning files, you can send us any 2 files with SIMPLE extensions (jpg, xls, doc, etc... not databases!) and small sizes (max 1 mb), we will decrypt them and send them back to you. This is our guarantee. .4. Q: How to contact you? A: You can write to us at our mailboxes: [email protected] .5. Q: How will the decryption process take place after payment? A: After payment, we will send you our scanner-decoder program and detailed instructions for use. With this program you will be able to decrypt all your encrypted files. .6. Q: If I don't want to pay bad people like you? A: If you do not cooperate with our service - it does not matter to us. But you will lose your time and data because only we have the private key. In practice, time is much more valuable than money. :::BEWARE::: DO NOT try to modify encrypted files yourself! If you try to use third party software to recover your data or antivirus solutions - back up all encrypted files! Any changes to the encrypted files may result in damage to the private key and, as a result, the loss of all data. Note: ::::::IF WE HAVE NOT RESPONSE YOU BY MAIL WITHIN 24 HOURS:::::: Spare contact for communication: If we have not answered your email within 24 hours, you can contact us via the free messenger qTox Download from the link https://tox.chat/download.html Next go qTox 64-bit after downloading the program, install it and go through a short registration. Our Tox ID 37CDA60B5B593473E120366CCF68A8C08F503880D2AE7F0F4161C2C9C0502C6304DDA2B19D8E

Emails

[email protected]

URLs

https://tox.chat/download.html

Signatures

Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware defense_evasion impact execution

File Deletion
T1070.004

Inhibit System Recovery
T1490

Windows Management Instrumentation
T1047
Deletes backup catalog 3 TTPs 1 IoCs
Uses wbadmin.exe to inhibit system recovery.
ransomware

Command and Scripting Interpreter
T1059

File Deletion
T1070.004

Inhibit System Recovery
T1490

Processes:

wbadmin.exe

pid process

2772 wbadmin.exe
Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service
T1102

Processes:

flow ioc

4 iplogger.com
5 iplogger.com

pid	process
2772	wbadmin.exe

flow	ioc
4	iplogger.com
5	iplogger.com

Sets desktop wallpaper using registry 2 TTPs 1 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

Processes:

084c57449c765416706301c723116da5073aa60da415c0eb3013239611135b0e.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\E1E8.tmp.bmp"	084c57449c765416706301c723116da5073aa60da415c0eb3013239611135b0e.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Interacts with shadow copies 3 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
ransomware

File Deletion
T1070.004

Inhibit System Recovery
T1490

Direct Volume Access
T1006

Processes:

vssadmin.exe

pid process

2920 vssadmin.exe
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

084c57449c765416706301c723116da5073aa60da415c0eb3013239611135b0e.exe

pid process

1652 084c57449c765416706301c723116da5073aa60da415c0eb3013239611135b0e.exe

pid	process
2920	vssadmin.exe

pid	process
1652	084c57449c765416706301c723116da5073aa60da415c0eb3013239611135b0e.exe

Suspicious use of AdjustPrivilegeToken 46 IoCs

Processes:

vssvc.exewbengine.exeWMIC.exe

description	pid	process
Token: SeBackupPrivilege	2700	vssvc.exe
Token: SeRestorePrivilege	2700	vssvc.exe
Token: SeAuditPrivilege	2700	vssvc.exe
Token: SeBackupPrivilege	2640	wbengine.exe
Token: SeRestorePrivilege	2640	wbengine.exe
Token: SeSecurityPrivilege	2640	wbengine.exe
Token: SeIncreaseQuotaPrivilege	3000	WMIC.exe
Token: SeSecurityPrivilege	3000	WMIC.exe
Token: SeTakeOwnershipPrivilege	3000	WMIC.exe
Token: SeLoadDriverPrivilege	3000	WMIC.exe
Token: SeSystemProfilePrivilege	3000	WMIC.exe
Token: SeSystemtimePrivilege	3000	WMIC.exe
Token: SeProfSingleProcessPrivilege	3000	WMIC.exe
Token: SeIncBasePriorityPrivilege	3000	WMIC.exe
Token: SeCreatePagefilePrivilege	3000	WMIC.exe
Token: SeBackupPrivilege	3000	WMIC.exe
Token: SeRestorePrivilege	3000	WMIC.exe
Token: SeShutdownPrivilege	3000	WMIC.exe
Token: SeDebugPrivilege	3000	WMIC.exe
Token: SeSystemEnvironmentPrivilege	3000	WMIC.exe
Token: SeRemoteShutdownPrivilege	3000	WMIC.exe
Token: SeUndockPrivilege	3000	WMIC.exe
Token: SeManageVolumePrivilege	3000	WMIC.exe
Token: 33	3000	WMIC.exe
Token: 34	3000	WMIC.exe
Token: 35	3000	WMIC.exe
Token: SeIncreaseQuotaPrivilege	3000	WMIC.exe
Token: SeSecurityPrivilege	3000	WMIC.exe
Token: SeTakeOwnershipPrivilege	3000	WMIC.exe
Token: SeLoadDriverPrivilege	3000	WMIC.exe
Token: SeSystemProfilePrivilege	3000	WMIC.exe
Token: SeSystemtimePrivilege	3000	WMIC.exe
Token: SeProfSingleProcessPrivilege	3000	WMIC.exe
Token: SeIncBasePriorityPrivilege	3000	WMIC.exe
Token: SeCreatePagefilePrivilege	3000	WMIC.exe
Token: SeBackupPrivilege	3000	WMIC.exe
Token: SeRestorePrivilege	3000	WMIC.exe
Token: SeShutdownPrivilege	3000	WMIC.exe
Token: SeDebugPrivilege	3000	WMIC.exe
Token: SeSystemEnvironmentPrivilege	3000	WMIC.exe
Token: SeRemoteShutdownPrivilege	3000	WMIC.exe
Token: SeUndockPrivilege	3000	WMIC.exe
Token: SeManageVolumePrivilege	3000	WMIC.exe
Token: 33	3000	WMIC.exe
Token: 34	3000	WMIC.exe
Token: 35	3000	WMIC.exe

Suspicious use of FindShellTrayWindow 2 IoCs

Processes:

084c57449c765416706301c723116da5073aa60da415c0eb3013239611135b0e.exeNOTEPAD.EXE

pid process

1652 084c57449c765416706301c723116da5073aa60da415c0eb3013239611135b0e.exe
1536 NOTEPAD.EXE

pid	process
1652	084c57449c765416706301c723116da5073aa60da415c0eb3013239611135b0e.exe
1536	NOTEPAD.EXE

Suspicious use of WriteProcessMemory 13 IoCs

Processes:

084c57449c765416706301c723116da5073aa60da415c0eb3013239611135b0e.execmd.exe

description	pid	process	target process
PID 1652 wrote to memory of 2372	1652	084c57449c765416706301c723116da5073aa60da415c0eb3013239611135b0e.exe	cmd.exe
PID 1652 wrote to memory of 2372	1652	084c57449c765416706301c723116da5073aa60da415c0eb3013239611135b0e.exe	cmd.exe
PID 1652 wrote to memory of 2372	1652	084c57449c765416706301c723116da5073aa60da415c0eb3013239611135b0e.exe	cmd.exe
PID 1652 wrote to memory of 2372	1652	084c57449c765416706301c723116da5073aa60da415c0eb3013239611135b0e.exe	cmd.exe
PID 2372 wrote to memory of 2920	2372	cmd.exe	vssadmin.exe
PID 2372 wrote to memory of 2920	2372	cmd.exe	vssadmin.exe
PID 2372 wrote to memory of 2920	2372	cmd.exe	vssadmin.exe
PID 2372 wrote to memory of 2772	2372	cmd.exe	wbadmin.exe
PID 2372 wrote to memory of 2772	2372	cmd.exe	wbadmin.exe
PID 2372 wrote to memory of 2772	2372	cmd.exe	wbadmin.exe
PID 2372 wrote to memory of 3000	2372	cmd.exe	WMIC.exe
PID 2372 wrote to memory of 3000	2372	cmd.exe	WMIC.exe
PID 2372 wrote to memory of 3000	2372	cmd.exe	WMIC.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\084c57449c765416706301c723116da5073aa60da415c0eb3013239611135b0e.exe
"C:\Users\Admin\AppData\Local\Temp\084c57449c765416706301c723116da5073aa60da415c0eb3013239611135b0e.exe"
1⤵
- Sets desktop wallpaper using registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:1652
- C:\Windows\system32\cmd.exe
  "C:\Windows\system32\cmd.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2372
- - C:\Windows\system32\vssadmin.exe
    vssadmin delete shadows /all /quiet
    3⤵
    - Interacts with shadow copies
    PID:2920
- - C:\Windows\system32\wbadmin.exe
    wbadmin delete catalog -quiet
    3⤵
    - Deletes backup catalog
    PID:2772
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic shadowcopy delete
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:3000

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2700

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2640

C:\Windows\System32\vdsldr.exe
C:\Windows\System32\vdsldr.exe -Embedding
1⤵
PID:1740

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
PID:1016

C:\Windows\system32\Dwm.exe
"C:\Windows\system32\Dwm.exe"
1⤵
PID:2976

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\+README-WARNING+.txt
1⤵
- Suspicious use of FindShellTrayWindow
PID:1536

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Management Instrumentation

T1047

Persistence

Privilege Escalation

Defense Evasion

Direct Volume Access

T1006

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Defacement

T1491

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\Desktop\+README-WARNING+.txt

Filesize
2KB

MD5
5d230c41f5f5f64ec6858756404c7a7e

SHA1
6e6ccd293641504eee97cb55d48566976f1bcf92

SHA256
2225eb49c5a55704c141e965cee16592f303ab5112a5df49b6a102a8bd34bb02

SHA512
1a058e1c77214546b5c978d77671f44a3d636c9ec69818da17064746a983aeeddd3068e2eef63bd54c2ad0a014ca943f50df588510107e8a02ef25f7d309c883

Download Submit