Overview

overview

10

Static

static

3

20240925c8...ch.exe

windows7-x64

10

20240925c8...ch.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    149s
  • max time network
    150s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    25/09/2024, 07:18

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    20240925c8ececb7cd83b938712e63f9e96e6f6cespilonredsnatch.exe

  • Size

    2.6MB

  • MD5

    c8ececb7cd83b938712e63f9e96e6f6c

  • SHA1

    942597cd5e7b61721dc516793e7510580757c587

  • SHA256

    96b3bcce3280a16131ef6de01f65bdc69314a7d86477321e8bb944d2fb6ff603

  • SHA512

    ca9f3d13ae0c043d87ca3ab505c12dec2656ef71c05737f24a3483f9d3619cb9837a36faf71b614b77169e3486057228ba2a4e3920385cabe830033a2395a9f9

  • SSDEEP

    24576:LbA9MGiVwmIPOaq6EUWOk/vNKj1xzb6gPvsFjG4/owGkE1Pj:yriVNI2aq6EUdkHNKjTGckowGkE1

Score
10/10
discoverypersistenceransomwarespywarestealer

Malware Config

Extracted

Path

C:\temp\important.txt

Ransom Note
=============================================== | 重要通知 - 重要通知 | =============================================== 你好，尊敬的用户， 我们已经成功侵入你的系统，并对你的文件进行了强力加密。你数据库和其他重要文件都已被锁定，无法访问。 为了解锁你的文件，你需要支付赎金。我们采用匿名的支付方式，即比特币。以下是支付细节： 支付金额：5 BTC（比特币） 充币网络：BTC-Bitconin 比特币地址：3PztoCUcREzAhVhTwKT1hf2ManFP3eQQJC 请在下面的比特币地址中支付赎金。一旦支付完成，你将收到解密密钥，并能够恢复你的所有文件。 倒计时：你有 72 小时来支付赎金。一旦倒计时结束，解密密钥将永久失效，文件将无法恢复。 ==================== 警告 ===================== 如果你尝试解密文件或与当地执法机关联系，你的文件将被永久销毁，并且你将失去所有数据。 为避免不必要的损失，请遵循我们的指示支付赎金。 联系我们：[email protected] =============================================== =============================================== | Important Notice | =============================================== Hello, dear user, We have successfully infiltrated your system and encrypted your files with strong encryption. Your photos, documents, databases, and other important files are now locked and inaccessible. To unlock your files, you need to pay a ransom. We prefer an anonymous payment method, namely Bitcoin. Below are the payment details: Payment Amount: 5 BTC (Bitcoin) Bitcoin network：BTC-Bitconin Bitcoin Address: 3PztoCUcREzAhVhTwKT1hf2ManFP3eQQJC Please pay the ransom to the Bitcoin address provided. Once the payment is complete, you will receive the decryption key and be able to recover all your files. Countdown: You have 72 hours to pay the ransom. Once the countdown expires, the decryption key will permanently expire, and your files will be unrecoverable. ==================== Warning ===================== If you attempt to decrypt the files or contact local law enforcement, your files will be permanently destroyed, and you will lose all data. To avoid unnecessary losses, follow our instructions to pay the ransom. Contact us: [email protected] ===============================================
Emails

联系我们：[email protected]

[email protected]
Wallets

3PztoCUcREzAhVhTwKT1hf2ManFP3eQQJC

Signatures

  • Modifies WinLogon for persistence 2 TTPs 1 IoCs
    persistence
  • Creates a large amount of network flows 1 TTPs

    This may indicate a network scan to discover remotely running services.

    discovery
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Drops file in System32 directory 4 IoCs
  • Enumerates processes with tasklist 1 TTPs 1 IoCs
    discovery
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Collects information from the system 1 TTPs 1 IoCs

    Uses WMIC.exe to find detailed system information.

  • Gathers network information 2 TTPs 1 IoCs

    Uses commandline utility to view network configuration.

  • Modifies registry key 1 TTPs 1 IoCs
  • Opens file in notepad (likely ransom note) 1 IoCs
    ransomware
  • Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious use of AdjustPrivilegeToken 41 IoCs
  • Suspicious use of WriteProcessMemory 39 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\20240925c8ececb7cd83b938712e63f9e96e6f6cespilonredsnatch.exe
    "C:\Users\Admin\AppData\Local\Temp\20240925c8ececb7cd83b938712e63f9e96e6f6cespilonredsnatch.exe"
    1⤵
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Suspicious use of WriteProcessMemory
    PID:2128
    • C:\Windows\system32\tasklist.exe
      tasklist
      2⤵
      • Enumerates processes with tasklist
      • Suspicious use of AdjustPrivilegeToken
      PID:2496
    • C:\Windows\system32\cmd.exe
      cmd /c start C:\temp\important.txt
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:2140
      • C:\Windows\system32\NOTEPAD.EXE
        "C:\Windows\system32\NOTEPAD.EXE" C:\temp\important.txt
        3⤵
        • Opens file in notepad (likely ransom note)
        PID:2668
    • C:\Windows\system32\cmd.exe
      cmd /c copy C:\Users\Admin\AppData\Local\Temp\20240925c8ececb7cd83b938712e63f9e96e6f6cespilonredsnatch.exe C:\temp\20240925c8ececb7cd83b938712e63f9e96e6f6cespilonredsnatch.exe
      2⤵
        PID:1864
      • C:\Windows\system32\cmd.exe
        cmd /c copy C:\Users\Admin\AppData\Local\Temp\20240925c8ececb7cd83b938712e63f9e96e6f6cespilonredsnatch.exe C:\Windows\System32\WinHelp.exe
        2⤵
        • Drops file in System32 directory
        PID:2660
      • C:\Windows\system32\schtasks.exe
        schtasks /create /tn DeepMountains /tr C:\temp\20240925c8ececb7cd83b938712e63f9e96e6f6cespilonredsnatch.exe /sc minute /mo 5
        2⤵
        • Scheduled Task/Job: Scheduled Task
        PID:2152
      • C:\Windows\system32\reg.exe
        reg add hkcu\Software\Microsoft\Windows\CurrentVersion\Run /v DeepMountains /d C:\temp\20240925c8ececb7cd83b938712e63f9e96e6f6cespilonredsnatch.exe /f
        2⤵
        • Adds Run key to start application
        • Modifies registry key
        PID:2680
      • C:\Windows\system32\reg.exe
        reg add "hklm\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /v Userinit /d C:\Windows\system32\userinit.exe,WinHelp.exe /f
        2⤵
        • Modifies WinLogon for persistence
        PID:2708
      • C:\Windows\system32\cmd.exe
        cmd /c "wmic logicaldisk get caption /value"
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:2752
        • C:\Windows\System32\Wbem\WMIC.exe
          wmic logicaldisk get caption /value
          3⤵
          • Collects information from the system
          • Suspicious use of AdjustPrivilegeToken
          PID:3016
      • C:\Windows\system32\cmd.exe
        cmd /c "ipconfig | findstr IPv4"
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:2388
        • C:\Windows\system32\ipconfig.exe
          ipconfig
          3⤵
          • Gathers network information
          PID:2520
        • C:\Windows\system32\findstr.exe
          findstr IPv4
          3⤵
            PID:1648

      Network

      MITRE ATT&CK Enterprise v15

      Reconnaissance

      Resource Development

      Initial Access

      Execution

      Command and Scripting Interpreter

      1
      T1059

      Scheduled Task/Job

      1
      T1053

      Scheduled Task

      1
      T1053.005

      Persistence

      Boot or Logon Autostart Execution

      2
      T1547

      Registry Run Keys / Startup Folder

      1
      T1547.001

      Winlogon Helper DLL

      1
      T1547.004

      Scheduled Task/Job

      1
      T1053

      Scheduled Task

      1
      T1053.005

      Privilege Escalation

      Boot or Logon Autostart Execution

      2
      T1547

      Registry Run Keys / Startup Folder

      1
      T1547.001

      Winlogon Helper DLL

      1
      T1547.004

      Scheduled Task/Job

      1
      T1053

      Scheduled Task

      1
      T1053.005

      Defense Evasion

      Modify Registry

      3
      T1112

      Credential Access

      Credentials from Password Stores

      1
      T1555

      Credentials from Web Browsers

      1
      T1555.003

      Unsecured Credentials

      1
      T1552

      Credentials In Files

      1
      T1552.001

      Discovery

      Network Service Discovery

      1
      T1046

      Process Discovery

      1
      T1057

      Query Registry

      1
      T1012

      System Information Discovery

      2
      T1082

      Lateral Movement

      Collection

      Data from Local System

      2
      T1005

      Command and Control

      Exfiltration

      Impact

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\images\19.png.Mirage
        Filesize

        5KB

        MD5

        8265284c16f6f1b30621063c1d1f6a9b

        SHA1

        bbbef6e6f2bcc9f380e72e9c61b329c0ee053194

        SHA256

        becc693b2c4e7c1a6da8a4a1d4e24d0a0b322544a3d65768d21164a5063c7894

        SHA512

        6a614769d70090f14907a40c1eab569556ca07627bb370c11e56de7cf097680279cc2d21fe92bff1db6fba40fffc1f1603ed7306fbd834fc1181cd6548bf0f02

        Download Submit

      • C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\images\23.png.Mirage
        Filesize

        5KB

        MD5

        75437db3603c44ca5d5ea74e5c72da06

        SHA1

        8435e6985ad85a361bd8712e54c304121e87a3bb

        SHA256

        07f2753b9e2ca3815614d48643cc13792d96d36b27a275b0f5eac68a0357ef64

        SHA512

        db5c5952479632d3930bf5feb65a65a7f60c9fe5e811fd7cc661d95347632bcdf7e13352d842ba2727a76ddd79dbd392537febe7ca76820976ddea1b3dc65a75

        Download Submit

      • C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\images\26.png.Mirage
        Filesize

        4KB

        MD5

        a7235adc7bff1f216d076f8b20a646d6

        SHA1

        5ab1806b55c3f26a0a20800c161d51fd4ced52ff

        SHA256

        00742dcbb5469b612b16047883940550542a060eb30dec763f350da8df41843e

        SHA512

        14f92e0fd016ba75932b9d21caf69e86ba6894377cedf7ecf8cc77fcbc05c448fa0b7f824438db4fde411c65bcfd496bbd6ed4c6871281fb053c6340aa517d44

        Download Submit

      • C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\images\29.png.Mirage
        Filesize

        4KB

        MD5

        075dc652619877ddb9964c20ee9049b8

        SHA1

        089ddbbc4903a0e4f0fb8cad2cb184db95c1a25e

        SHA256

        efb1db0e41bd00f1693e35b17d4e62fc191c44a6655903f4379ab7192a28459a

        SHA512

        18b0ab0332f82a95bec64a1ddbbd022137b35d64e46f4124a0ddc6b5e1873169daa534216a1f11c3ae25355642e5acc1776897d1aef2e1e3d8322d0c22c8c5b9

        Download Submit

      • C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\images\32.png.Mirage
        Filesize

        5KB

        MD5

        cbbd98afb4cbc50ee76e79131eae4cb4

        SHA1

        3f2fa92a31a32a72e542cb40fbcbeb76e6ae4287

        SHA256

        c45ebe4969e3eb8ce360018436b60e4705d19edd91ec6af16761d749a422f867

        SHA512

        214fba7673eb5456c8119c01a7a638c98c1f731778b796d2e2d6c5dc0c16cc323d5f9e0e8df37b3ea597a47d7ef3304b9d5bec5bfc8dcc32ca981edfcfc5eecf

        Download Submit

      • C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\images\6.png.Mirage
        Filesize

        5KB

        MD5

        b79c6d17defb0fd0d8777e7ad271777e

        SHA1

        30916dc2d721d434861871a27731e0816470031d

        SHA256

        db2d8a84be3b15d3e8312d8eba87e1b073ff097dacaa128b46b1ff1bfccc8455

        SHA512

        60eeb7373b65165c93bd8aa8b89dc8e20bcda237b213ebdc9ac1d4bb21679a47c36557a865b1adbaa7148947e25715575352f8b62a5d75a7305f041b0ec2c740

        Download Submit

      • C:\Program Files\DVD Maker\Shared\DvdStyles\NavigationLeft_ButtonGraphic.png.Mirage
        Filesize

        4KB

        MD5

        b90366db937daa3792ecfa070dca6f36

        SHA1

        8f9b55fe372d40893a6f2d0a7885842fbb2b9192

        SHA256

        219b3a690bab9a540a3784417ed452b4ac2d9a20d244dba21e8f64c546cd1d61

        SHA512

        013e41e6ae96cc01ecf2e9c3e68bd37477eefea6ed5b448357c29cb72e0f998fef30f9ec0126e6cc2226cb152ade83fd85302baca80443e6ba9c1e8016314559

        Download Submit

      • C:\Program Files\DVD Maker\Shared\DvdStyles\NavigationLeft_SelectionSubpicture.png.Mirage
        Filesize

        3KB

        MD5

        9fbf657a875fd725a0780281268b6e1e

        SHA1

        d586af81a93fbb5cf0a5ed2224571d21dc24f4be

        SHA256

        98e16bcc75bb9246a06498923d0b9bc649b47fed72264b6c20c3e400fde82ddf

        SHA512

        d7f4c337fc875c5715f2b26eb82186aeeb5b905017a65efde901957d530ef7fe18679a4fb1f2fd0e1558ff97d847b04735efb10491f214b22b871e93154b302d

        Download Submit

      • C:\Program Files\DVD Maker\Shared\DvdStyles\NavigationRight_ButtonGraphic.png.Mirage
        Filesize

        4KB

        MD5

        c079578a705530957065410a13ab99f9

        SHA1

        ad93494e517e034f76a78a21fd6db4f5c47e9cc1

        SHA256

        c735ce3bf0b1df8788c93167de86df190ed2156446857eac0596435d19d461c0

        SHA512

        39710243aae3a160f92fd29dc83877caa79150d874008376f1457052d5341c5c3aa4897290eaac4f429c1234b1fb29c2eb209e2fc610954894a8fbb92225ff17

        Download Submit

      • C:\Program Files\DVD Maker\Shared\DvdStyles\NavigationRight_SelectionSubpicture.png.Mirage
        Filesize

        3KB

        MD5

        4398d678faa4ba9817e697f23f794533

        SHA1

        16d4049de4835de958ede416b06b7f0e9d7f49ed

        SHA256

        702bde6cb9192572b5db2f151a19e14e0069037dfdd975c7036787bce31016f5

        SHA512

        584ded6ee04173204f7dfcb362ec1ddbd31204bdf24a20c3648c04bc8f599b4c405b5cecc4ee3994791822841b386c906fc50a1dc8d511682c7c1282215c6b2f

        Download Submit

      • C:\Program Files\DVD Maker\Shared\DvdStyles\NavigationUp_ButtonGraphic.png.Mirage
        Filesize

        4KB

        MD5

        a6c9236a30ff442d46bc5438d8be36b3

        SHA1

        ffcbf0db663d4ed2552dd9f5cb527e160444d5af

        SHA256

        a3d1f4c50ae21464226c3192ebea750ca106bb424791f73919c73cd0e664d6a5

        SHA512

        588a1eb91cd2ee4de1660f2de99129df4cc85eb66f89350c88938b41806a2a3b325789523e8588e9ecd57a1da88c4c043608302b9a6dc354d2962ec565b35443

        Download Submit

      • C:\Program Files\DVD Maker\Shared\DvdStyles\NavigationUp_SelectionSubpicture.png.Mirage
        Filesize

        3KB

        MD5

        391dfd16de323eaee2addaa1ca63e22a

        SHA1

        f022fab0700bbfdaf1397d60158b977d4740725d

        SHA256

        4e4bff5627c80ed65964f3c99ad94d128859e0132c06b08a12d3a209114542d2

        SHA512

        04f04f6b5358fa5088fffdb87203a665ce5d2ee6f5e95f02011076b39e0c27870b2013638ef5740a753c82a367a682c2430a7de16a4c73f6c4ec1794fd82f168

        Download Submit

      • C:\Program Files\DVD Maker\Shared\DvdStyles\OldAge\1047x576black.png.Mirage
        Filesize

        4KB

        MD5

        0ee9835435a9d8076d03df196a1a96ca

        SHA1

        5edab1ab0ccebae7e9b52df00be91ff8abf650c4

        SHA256

        e19987dda064a58f9117728af238ceb813ee574ca5932d14e01b162b7ede6f66

        SHA512

        45d8487c1667597ffc7a0345c312209d78092dd34e7293fec8646ecc8f574b47b693b8a89a80dcb7a4e9ca2f0cf771b3f200da904db0d807b6722d2fe670c3bc

        Download Submit

      • C:\Program Files\DVD Maker\Shared\DvdStyles\Stacking\15x15dot.png.Mirage
        Filesize

        2KB

        MD5

        6c6d21b22d8089f450773a23f13666bd

        SHA1

        8e4187f454d4c113f68b5308fab61ce516e3c4ce

        SHA256

        726e123e03822073dd807221468ed8cd392c4c181b533301903ef680d721dc3f

        SHA512

        08ed7c4a8fc6b2be61f8879346198a425877286f18d95d5f74752c88d824fa9a55612cb1b219eaa2590c804112e2881d7b72b72ac97a71e73e84fbeb8a17eb59

        Download Submit

      • C:\Program Files\DVD Maker\Shared\DvdStyles\VideoWall\203x8subpicture.png.Mirage
        Filesize

        2KB

        MD5

        8351c00f8ce8f80505db74aadae8b719

        SHA1

        7abae403e6ae74ba842a772b276306e09f7ebc99

        SHA256

        3ed6e6623ee267cb19c537dbf130c5a80a80fa6cb2d041b737364cb24c5a2748

        SHA512

        09377809c8fe0afe842ff18c8779c0548cb43d6018bd1268f87b8f8f5c7650bb3862e87f5acbf1c91a5af59525e833972971278fc4dda97feec8114feced52d8

        Download Submit

      • C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\logo.png.Mirage
        Filesize

        6KB

        MD5

        e658ffafdbe436219b741f726e7bd765

        SHA1

        997f11686a1047e9d103487708a06e6388d531ec

        SHA256

        8d8d78a53a3c6e06e42b4a05033bb69be035cb144ae736f55e2856f1b8ba4466

        SHA512

        346ef74c8992fdc683d9157b639136d3a86cab1185e25d25efff5d96bad4c0c28abd6ae51e2070249d0c58f14e2cf94e701b84c273a4bccb86567790aa00b1cf

        Download Submit

      • C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\35.png.Mirage
        Filesize

        5KB

        MD5

        f4ef7c0175be21013a757cd1ed853422

        SHA1

        f3ab055acb6f24276f60edc83346efef045c8cd0

        SHA256

        e46e3da8d5090ac28426c5ff793cb8586cd264d8fcb3cee14c52809867cf6d52

        SHA512

        b54f8124dc3d69c06b15306c8b8b839fe029ae317387b29c1e18e8aefa68827c54e49fe2677500f1d5892ea2c01048e33ecac9e4bc0094475fbd3d86e2506a6a

        Download Submit

      • C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\38.png.Mirage
        Filesize

        5KB

        MD5

        0955da9b56e957bb69d8218e633817c4

        SHA1

        f7fb0c07df6e80ca3848a67419c305c89c6d59d8

        SHA256

        346d0a7ce5c7e6680e4cfd2364902c565eeb0c8a1999effb0808d9bcad7b4c72

        SHA512

        a8d98b88b24520c4750b5d8352c73bee90e532ded045ee5d658698abde73077eebab8b585d95e85e9f946ef0f404abd7d1e1860795f48cba9e64b785af98f3fa

        Download Submit

      • C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\41.png.Mirage
        Filesize

        3KB

        MD5

        a396dffaeb074b502d21d38f4acf30a0

        SHA1

        8d978314fd845a16e1ca2f8539a05e7bb685a625

        SHA256

        2c3fb933756290d41459b80849955837fac7291f6e7d826720914eb93f21a8b0

        SHA512

        377addabce65989e71211a6f0b1fa6c755f4e1a362912e8b448ba351b0a560666dd9a80460a1614d6ff8b9a8510071c9141fe1288bc4f25faef065bf46cab238

        Download Submit

      • C:\temp\important.txt
        Filesize

        2KB

        MD5

        0c8dcde8a2b2aac8f3bec1ba841b647c

        SHA1

        4e967f080f936840cd0a0e730b736b667b8effa6

        SHA256

        50769bf5c040a4a4c884249bf9cc8a47d19bcbaa7605869a31bb353afbf31994

        SHA512

        bfd743d23b17c30ca5f8b331f672604c60e0252b976a68b11ebbca685cc9bf63157bb62712ec286c2ab681c4ad276b61e6f567759f782a83103a523da2435370

        Download Submit