Overview

overview

10

Static

static

3

369034bf1d...0b.exe

windows7-x64

10

369034bf1d...0b.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    140s
  • max time network
    137s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    19/10/2024, 14:19

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    369034bf1d793fe56ea4d683a156722d825ad9829fc128117f82a26bc1d0480b.exe
  • Size 81KB
  • Sample241019-rmtywssdkl
  • SHA256 369034bf1d793fe56ea4d683a156722d825ad9829fc128117f82a26bc1d0480b
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
discoveryransomware

Malware Config

Extracted

Path

  • C:\Recovery\README.TXT

Ransom Note
  • I'll try to be brief: 1. It is beneficial for us that your files are decrypted no less than you, we don't want to harm you, we just want to get a ransom for our work. 2. Its only takes for us at list 20 minutes after payment to completely decrypt you, to its original state, it's very simple for us! 3.If you contact decryption companies, you are automatically exposed to publicity,also, these companies do not care about your files at all, they only think about their own benefit! 4.They also contact the police. Again, only you suffer from this treatment! 5. We have developed a scheme for your secure decryption without any problems, unlike the above companies, who just as definitely come to us to decipher you and simply make a profit from you as intermediaries, preventing a quick resolution of this issue! 6. In case of refusal to pay, we transfer all your personal data such as (emails, link to panel, payment documents , certificates , personal information of you staff, SQL,ERP,financial information for other hacker groups) and they will come to you again for sure! We will also publicize this attack using social networks and other media, which will significantly affect your reputation! 7. If you contact us no more than 12 hours after the attack, the price is only 50% of the price afterwards! 8. Do not under any circumstances try to decrypt the files yourself; you will simply break them! Contacts Download the (Session) messenger (https://getsession.org) in messenger :ID"0585ae8a3c3a688c78cf2e2b2b7df760630377f29c0b36d999862861bdbf93380d" MAIL:[email protected]
Emails
URLs

  • https://getsession.org

Signatures

  • Renames multiple (5827) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware
  • Enumerates connected drives 3 TTPs 2 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Program Files directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 62 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\369034bf1d793fe56ea4d683a156722d825ad9829fc128117f82a26bc1d0480b.exe
    "C:\Users\Admin\AppData\Local\Temp\369034bf1d793fe56ea4d683a156722d825ad9829fc128117f82a26bc1d0480b.exe"
    1⤵
    • Enumerates connected drives
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:4880
  • C:\Windows\system32\vssvc.exe
    C:\Windows\system32\vssvc.exe
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:1756

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        README.TXT
        • Path C:\Recovery\README.TXT
        • Size 1KB
        • SHA256 e742364f70b84d708bfca18621594a9c4238fef00f4088d686313ca3ae86a8ff
        • MD5 SHA1 SHA512
        Submit Download