Overview

overview

10

Static

static

3

2c7aeac07c...77.exe

windows7-x64

10

2c7aeac07c...77.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    122s
  • max time network
    124s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    04-09-2024 12:29

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    2c7aeac07ce7f03b74952e0e243bd52f2bfa60fadc92dd71a6a1fee2d14cdd77.exe

  • Size

    879KB

  • MD5

    2a7a76cde7e970c06316e3ae4feadbe3

  • SHA1

    89d195f59bba9c3b43635607f9f1c3051645332c

  • SHA256

    2c7aeac07ce7f03b74952e0e243bd52f2bfa60fadc92dd71a6a1fee2d14cdd77

  • SHA512

    834f76c0de678d26507fa1a3446cf6336952d36bd2857113f1bbaddf0d33132d4c579bfd232194868c8dc4ddefa66a9c589610e74f4a808787b8edf36f3d5b4f

  • SSDEEP

    24576:dpN2CMwVhLcqnB+c9z2Va31qIU2p1GA3zaIJYj9+M+C6vU1KKoPAFGG+TR3aZX:UC5Uqn4c9z2Vu1qIU2pAA3rM+C6vZJAp

Score
10/10
akiracredential_accessdiscoveryexecutionransomwareransowmwarespywarestealer

Malware Config

Extracted

Path

C:\PerfLogs\akira_readme.txt

Family

akira

Ransom Note
Hi friends, Whatever who you are and what your title is if you're reading this it means the internal infrastructure of your company is fully or partially dead, all your backups - virtual, physical - everything that we managed to reach - are completely removed. Moreover, we have taken a great amount of your corporate data prior to encryption. Well, for now let's keep all the tears and resentment to ourselves and try to build a constructive dialogue. We're fully aware of what damage we caused by locking your internal sources. At the moment, you have to know: 1. Dealing with us you will save A LOT due to we are not interested in ruining your financially. We will study in depth your finance, bank & income statements, your savings, investments etc. and present our reasonable demand to you. If you have an active cyber insurance, let us know and we will guide you how to properly use it. Also, dragging out the negotiation process will lead to failing of a deal. 2. Paying us you save your TIME, MONEY, EFFORTS and be back on track within 24 hours approximately. Our decryptor works properly on any files or systems, so you will be able to check it by requesting a test decryption service from the beginning of our conversation. If you decide to recover on your own, keep in mind that you can permanently lose access to some files or accidently corrupt them - in this case we won't be able to help. 3. The security report or the exclusive first-hand information that you will receive upon reaching an agreement is of a great value, since NO full audit of your network will show you the vulnerabilities that we've managed to detect and used in order to get into, identify backup solutions and upload your data. 4. As for your data, if we fail to agree, we will try to sell personal information/trade secrets/databases/source codes - generally speaking, everything that has a value on the darkmarket - to multiple threat actors at ones. Then all of this will be published in our blog - https://akiral2iz6a7qgd3ayp3l6yub7xx2uep76idk3u2kollpj5z3z636bad.onion. 5. We're more than negotiable and will definitely find the way to settle this quickly and reach an agreement which will satisfy both of us. If you're indeed interested in our assistance and the services we provide you can reach out to us following simple instructions: 1. Install TOR Browser to get access to our chat room - https://www.torproject.org/download/. 2. Paste this link - https://akiralkzxzq2dsrzsrvbr2xgbbu2wgsmxryd4csgfameg52n7efvr2id.onion. 3. Use this code - 6729-HK-NIZN-WOPQ - to log into our chat. Keep in mind that the faster you will get in touch, the less damage we cause.
URLs

https://akiral2iz6a7qgd3ayp3l6yub7xx2uep76idk3u2kollpj5z3z636bad.onion

https://akiralkzxzq2dsrzsrvbr2xgbbu2wgsmxryd4csgfameg52n7efvr2id.onion

Signatures

  • Akira

    Akira is a ransomware first seen in March 2023 and targets several industries, including education, finance, real estate, manufacturing, and consulting.

    ransomwareakira
  • Process spawned unexpected child process 1 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • Credentials from Password Stores: Credentials from Web Browsers 1 TTPs

    Malicious Access or copy of Web Browser Credential store.

    credential_accessstealer
  • Renames multiple (9063) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware
  • Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

    Run Powershell command to delete shadowcopy.

    executionransowmware
  • Credentials from Password Stores: Windows Credential Manager 1 TTPs

    Suspicious access to Credentials History.

    credential_accessstealer
  • Drops startup file 3 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Drops file in System32 directory 1 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\2c7aeac07ce7f03b74952e0e243bd52f2bfa60fadc92dd71a6a1fee2d14cdd77.exe
    "C:\Users\Admin\AppData\Local\Temp\2c7aeac07ce7f03b74952e0e243bd52f2bfa60fadc92dd71a6a1fee2d14cdd77.exe"
    1⤵
    • Drops startup file
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    PID:1644
  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -Command "Get-WmiObject Win32_Shadowcopy | Remove-WmiObject"
    1⤵
    • Process spawned unexpected child process
    • Command and Scripting Interpreter: PowerShell
    • Drops file in System32 directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:2488
  • C:\Windows\system32\vssvc.exe
    C:\Windows\system32\vssvc.exe
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:2848

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\PerfLogs\akira_readme.txt
    Filesize

    2KB

    MD5

    e158265e513c5b865b19240370d4cb81

    SHA1

    4a37838237b622bc8f6049cf62573d7ed69b1a25

    SHA256

    f13ffbbdf446bb88a48de8162406b9b2f97cde15a27ce007a156f4dbd028fb2a

    SHA512

    dd8e241126d131f4d3d4c3936ccb06eef955258573c7337a241cb93fea66e41324caae2ced4548b9e69c7427f3649d134f670607e0e65a13bdaa61b3381cbb34

    Download Submit

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
    Filesize

    8KB

    MD5

    ea4f826df84cb24a1bf2a6bbc56b2a24

    SHA1

    105a720f21edd8e895edb5635bd81d4819f06560

    SHA256

    47e922f7586195d093c91dab8ed700f28bd76351060832e26a6e479926774bc6

    SHA512

    980fdbad1cb8bbd476dfdeb85c7d50bc8a3d2b656256f739750fe0f22f3e7db81141571185b68bb2d388c535dc0886d1b4849b46c8350288c4a2d176fe2cdd73

    Download Submit

  • memory/2488-4-0x000007FEF593E000-0x000007FEF593F000-memory.dmp

    Filesize

    4KB

    Download

  • memory/2488-6-0x000007FEF5680000-0x000007FEF601D000-memory.dmp

    Filesize

    9.6MB

    Download

  • memory/2488-7-0x0000000001EC0000-0x0000000001EC8000-memory.dmp

    Filesize

    32KB

    Download

  • memory/2488-5-0x000000001B6F0000-0x000000001B9D2000-memory.dmp

    Filesize

    2.9MB

    Download

  • memory/2488-10-0x000007FEF5680000-0x000007FEF601D000-memory.dmp

    Filesize

    9.6MB

    Download

  • memory/2488-9-0x000007FEF5680000-0x000007FEF601D000-memory.dmp

    Filesize

    9.6MB

    Download

  • memory/2488-8-0x000007FEF5680000-0x000007FEF601D000-memory.dmp

    Filesize

    9.6MB

    Download

  • memory/2488-11-0x000007FEF5680000-0x000007FEF601D000-memory.dmp

    Filesize

    9.6MB

    Download

  • memory/2488-12-0x000007FEF5680000-0x000007FEF601D000-memory.dmp

    Filesize

    9.6MB

    Download