Overview

overview

10

Static

static

3

2016-08-26...e2.exe

windows7-x64

10

2016-08-30...e2.exe

windows7-x64

10

2016-09-14...re.exe

windows7-x64

10

2016-09-16...e2.exe

windows7-x64

10

2016-09-19...e2.exe

windows7-x64

10

2016-09-21...om.exe

windows7-x64

10

2016-09-27...er.exe

windows7-x64

7

2016-09-28...om.exe

windows7-x64

10

2016-09-28...om.exe

windows7-x64

10

2016-09-29...e2.exe

windows7-x64

10

2016-09-29...e2.exe

windows7-x64

10

2016-10-04...er.exe

windows7-x64

7

2016-10-05...e2.exe

windows7-x64

10

2016-10-06...e2.exe

windows7-x64

10

2016-10-12...er.exe

windows7-x64

7

2016-10-14...er.exe

windows7-x64

7

2016-10-18...e2.exe

windows7-x64

10

2016-10-23...er.exe

windows7-x64

7

2016-10-28...e2.exe

windows7-x64

10

2016-11-07...e2.exe

windows7-x64

10

2016-11-08...e2.exe

windows7-x64

10

2016-11-09...e2.exe

windows7-x64

10

2016-11-15...e2.exe

windows7-x64

10

2016-11-16...e2.exe

windows7-x64

10

2016-11-21...e2.exe

windows7-x64

10

2017-03-15...si.exe

windows7-x64

10

2017-04-07...re.exe

windows7-x64

10

2017-04-07...re.exe

windows7-x64

10

2017-04-07...re.exe

windows7-x64

10

2018-01-28...re.exe

windows7-x64

10

Analysis

  • max time kernel
    1561s
  • max time network
    1563s
  • platform
    windows7_x64
  • resource
    win7-20241010-en
  • resource tags

    arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
  • submitted
    11-11-2024 07:17

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    2016-11-08-3rd-run-EITest-Rig-EK-payload-CryptFile2.exe

  • Size

    87KB

  • MD5

    ab68413f9685bfac416520b220b4e49b

  • SHA1

    adf4e3925c2965be9487659ca606a86b61951093

  • SHA256

    64a7cf0a5c8c4eebd1e2d96c2877623183520afd0e467fc6932664f550597554

  • SHA512

    002367ee8785d25736240173f034ce240a601c2b53ed7a0af9be311c739ad887233e159cf1e8ffa5f9f6aed9e4e2e6139489b28e3468f9c556a04c1b1a64e84c

  • SSDEEP

    1536:VjnRGW/IqP2IHef6RkkkkCu2i6CrKbbWaDsPuHVPICaSaB:5nk5ceCcuuTHMEVP7aB

Score
10/10
defense_evasiondiscoveryexecutionimpactpersistenceransomware

Malware Config

Extracted

Path

C:\MSOCache\HELP_DECRYPT_YOUR_FILES.TXT

Ransom Note
NOT YOUR LANGUAGE? USE https://translate.google.com What happened to your files ? All of your files protected by a strong encryption with RSA-2048. More information about the encryption keys using RSA-2048 can be found here: https://en.wikipedia.org/wiki/RSA_(cryptosystem) How did this happen ? !!! Specially for your PC was generated personal RSA-2048 KEY, both public and private. !!! ALL YOUR FILES were encrypted with the public key, which has been transferred to your computer via the Internet. !!! Decrypting of your files is only possible with the help of the private key and decrypt program , which is on our Secret Server What do I do ? So, there are two ways you can choose: wait for a miracle and get your price doubled, or start send email now for more specific instructions! , and restore your data easy way. If You have really valuable data, you better not waste your time, because there is no other way to get your files, except make a payment. For more specific instructions: Contact us by email only, send us an email along with your ID number and wait for further instructions. Our specialist will contact you within 24 hours. For you to be sure, that we can decrypt your files - you can send us a single encrypted file and we will send you back it in a decrypted form. This will be your guarantee. Please do not waste your time! You have 72 hours only! After that The Main Server will double your price! So right now You have a chance to buy your individual private softWare with a low price! E-MAIL1: [email protected] E-MAIL2: [email protected] YOUR_ID: 1c9b74ea833ba189

Signatures

  • Deletes shadow copies 3 TTPs

    Ransomware often targets backup files to inhibit system recovery.

    ransomwaredefense_evasionimpactexecution
  • Adds Run key to start application 2 TTPs 4 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 23 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Program Files directory 4 IoCs
  • Drops file in Windows directory 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Interacts with shadow copies 3 TTPs 27 IoCs

    Shadow copies are often targeted by ransomware to inhibit system recovery.

    ransomware
  • Opens file in notepad (likely ransom note) 1 IoCs
    ransomware
  • Runs net.exe
  • Suspicious use of AdjustPrivilegeToken 43 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\2016-11-08-3rd-run-EITest-Rig-EK-payload-CryptFile2.exe
    "C:\Users\Admin\AppData\Local\Temp\2016-11-08-3rd-run-EITest-Rig-EK-payload-CryptFile2.exe"
    1⤵
    • Adds Run key to start application
    • Enumerates connected drives
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:2676
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /C vssadmin.exe Delete Shadows /All /Quiet
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:1616
      • C:\Windows\SysWOW64\vssadmin.exe
        vssadmin.exe Delete Shadows /All /Quiet
        3⤵
        • System Location Discovery: System Language Discovery
        • Interacts with shadow copies
        PID:980
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /C wmic shadowcopy delete
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:976
      • C:\Windows\SysWOW64\Wbem\WMIC.exe
        wmic shadowcopy delete
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of AdjustPrivilegeToken
        PID:2176
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /C vssadmin Delete Shadows /For=Z: /All /Quiet
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:768
      • C:\Windows\SysWOW64\vssadmin.exe
        vssadmin Delete Shadows /For=Z: /All /Quiet
        3⤵
        • System Location Discovery: System Language Discovery
        • Interacts with shadow copies
        PID:1716
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /C vssadmin Delete Shadows /For=Y: /All /Quiet
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:1220
      • C:\Windows\SysWOW64\vssadmin.exe
        vssadmin Delete Shadows /For=Y: /All /Quiet
        3⤵
        • System Location Discovery: System Language Discovery
        • Interacts with shadow copies
        PID:1964
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /C vssadmin Delete Shadows /For=X: /All /Quiet
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:948
      • C:\Windows\SysWOW64\vssadmin.exe
        vssadmin Delete Shadows /For=X: /All /Quiet
        3⤵
        • System Location Discovery: System Language Discovery
        • Interacts with shadow copies
        PID:3024
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /C vssadmin Delete Shadows /For=W: /All /Quiet
      2⤵
      • System Location Discovery: System Language Discovery
      PID:2152
      • C:\Windows\SysWOW64\vssadmin.exe
        vssadmin Delete Shadows /For=W: /All /Quiet
        3⤵
        • System Location Discovery: System Language Discovery
        • Interacts with shadow copies
        PID:1580
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /C vssadmin Delete Shadows /For=V: /All /Quiet
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:1676
      • C:\Windows\SysWOW64\vssadmin.exe
        vssadmin Delete Shadows /For=V: /All /Quiet
        3⤵
        • System Location Discovery: System Language Discovery
        • Interacts with shadow copies
        PID:1872
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /C vssadmin Delete Shadows /For=U: /All /Quiet
      2⤵
      • System Location Discovery: System Language Discovery
      PID:1672
      • C:\Windows\SysWOW64\vssadmin.exe
        vssadmin Delete Shadows /For=U: /All /Quiet
        3⤵
        • System Location Discovery: System Language Discovery
        • Interacts with shadow copies
        PID:2560
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /C vssadmin Delete Shadows /For=T: /All /Quiet
      2⤵
      • System Location Discovery: System Language Discovery
      PID:764
      • C:\Windows\SysWOW64\vssadmin.exe
        vssadmin Delete Shadows /For=T: /All /Quiet
        3⤵
        • System Location Discovery: System Language Discovery
        • Interacts with shadow copies
        PID:2672
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /C vssadmin Delete Shadows /For=S: /All /Quiet
      2⤵
      • System Location Discovery: System Language Discovery
      PID:236
      • C:\Windows\SysWOW64\vssadmin.exe
        vssadmin Delete Shadows /For=S: /All /Quiet
        3⤵
        • System Location Discovery: System Language Discovery
        • Interacts with shadow copies
        PID:1732
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /C vssadmin Delete Shadows /For=R: /All /Quiet
      2⤵
      • System Location Discovery: System Language Discovery
      PID:1924
      • C:\Windows\SysWOW64\vssadmin.exe
        vssadmin Delete Shadows /For=R: /All /Quiet
        3⤵
        • System Location Discovery: System Language Discovery
        • Interacts with shadow copies
        PID:1972
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /C vssadmin Delete Shadows /For=Q: /All /Quiet
      2⤵
      • System Location Discovery: System Language Discovery
      PID:1744
      • C:\Windows\SysWOW64\vssadmin.exe
        vssadmin Delete Shadows /For=Q: /All /Quiet
        3⤵
        • Interacts with shadow copies
        PID:2488
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /C vssadmin Delete Shadows /For=P: /All /Quiet
      2⤵
      • System Location Discovery: System Language Discovery
      PID:2120
      • C:\Windows\SysWOW64\vssadmin.exe
        vssadmin Delete Shadows /For=P: /All /Quiet
        3⤵
        • System Location Discovery: System Language Discovery
        • Interacts with shadow copies
        PID:2444
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /C vssadmin Delete Shadows /For=O: /All /Quiet
      2⤵
      • System Location Discovery: System Language Discovery
      PID:1608
      • C:\Windows\SysWOW64\vssadmin.exe
        vssadmin Delete Shadows /For=O: /All /Quiet
        3⤵
        • System Location Discovery: System Language Discovery
        • Interacts with shadow copies
        PID:2800
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /C vssadmin Delete Shadows /For=N: /All /Quiet
      2⤵
      • System Location Discovery: System Language Discovery
      PID:1640
      • C:\Windows\SysWOW64\vssadmin.exe
        vssadmin Delete Shadows /For=N: /All /Quiet
        3⤵
        • System Location Discovery: System Language Discovery
        • Interacts with shadow copies
        PID:2600
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /C vssadmin Delete Shadows /For=M: /All /Quiet
      2⤵
      • System Location Discovery: System Language Discovery
      PID:2788
      • C:\Windows\SysWOW64\vssadmin.exe
        vssadmin Delete Shadows /For=M: /All /Quiet
        3⤵
        • System Location Discovery: System Language Discovery
        • Interacts with shadow copies
        PID:2724
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /C vssadmin Delete Shadows /For=L: /All /Quiet
      2⤵
      • System Location Discovery: System Language Discovery
      PID:2888
      • C:\Windows\SysWOW64\vssadmin.exe
        vssadmin Delete Shadows /For=L: /All /Quiet
        3⤵
        • System Location Discovery: System Language Discovery
        • Interacts with shadow copies
        PID:2032
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /C vssadmin Delete Shadows /For=K: /All /Quiet
      2⤵
      • System Location Discovery: System Language Discovery
      PID:2708
      • C:\Windows\SysWOW64\vssadmin.exe
        vssadmin Delete Shadows /For=K: /All /Quiet
        3⤵
        • System Location Discovery: System Language Discovery
        • Interacts with shadow copies
        PID:3064
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /C vssadmin Delete Shadows /For=J: /All /Quiet
      2⤵
      • System Location Discovery: System Language Discovery
      PID:2356
      • C:\Windows\SysWOW64\vssadmin.exe
        vssadmin Delete Shadows /For=J: /All /Quiet
        3⤵
        • System Location Discovery: System Language Discovery
        • Interacts with shadow copies
        PID:2768
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /C vssadmin Delete Shadows /For=I: /All /Quiet
      2⤵
      • System Location Discovery: System Language Discovery
      PID:2352
      • C:\Windows\SysWOW64\vssadmin.exe
        vssadmin Delete Shadows /For=I: /All /Quiet
        3⤵
        • System Location Discovery: System Language Discovery
        • Interacts with shadow copies
        PID:2660
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /C vssadmin Delete Shadows /For=H: /All /Quiet
      2⤵
        PID:2704
        • C:\Windows\SysWOW64\vssadmin.exe
          vssadmin Delete Shadows /For=H: /All /Quiet
          3⤵
          • System Location Discovery: System Language Discovery
          • Interacts with shadow copies
          PID:2852
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /C vssadmin Delete Shadows /For=G: /All /Quiet
        2⤵
        • System Location Discovery: System Language Discovery
        PID:2624
        • C:\Windows\SysWOW64\vssadmin.exe
          vssadmin Delete Shadows /For=G: /All /Quiet
          3⤵
          • Interacts with shadow copies
          PID:1412
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /C vssadmin Delete Shadows /For=F: /All /Quiet
        2⤵
        • System Location Discovery: System Language Discovery
        PID:2636
        • C:\Windows\SysWOW64\vssadmin.exe
          vssadmin Delete Shadows /For=F: /All /Quiet
          3⤵
          • System Location Discovery: System Language Discovery
          • Interacts with shadow copies
          PID:448
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /C vssadmin Delete Shadows /For=E: /All /Quiet
        2⤵
        • System Location Discovery: System Language Discovery
        PID:2864
        • C:\Windows\SysWOW64\vssadmin.exe
          vssadmin Delete Shadows /For=E: /All /Quiet
          3⤵
          • System Location Discovery: System Language Discovery
          • Interacts with shadow copies
          PID:1824
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /C vssadmin Delete Shadows /For=D: /All /Quiet
        2⤵
        • System Location Discovery: System Language Discovery
        PID:1956
        • C:\Windows\SysWOW64\vssadmin.exe
          vssadmin Delete Shadows /For=D: /All /Quiet
          3⤵
          • System Location Discovery: System Language Discovery
          • Interacts with shadow copies
          PID:2576
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /C vssadmin Delete Shadows /For=C: /All /Quiet
        2⤵
        • System Location Discovery: System Language Discovery
        PID:1408
        • C:\Windows\SysWOW64\vssadmin.exe
          vssadmin Delete Shadows /For=C: /All /Quiet
          3⤵
          • System Location Discovery: System Language Discovery
          • Interacts with shadow copies
          PID:332
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /C vssadmin Delete Shadows /For=B: /All /Quiet
        2⤵
        • System Location Discovery: System Language Discovery
        PID:2536
        • C:\Windows\SysWOW64\vssadmin.exe
          vssadmin Delete Shadows /For=B: /All /Quiet
          3⤵
          • System Location Discovery: System Language Discovery
          • Interacts with shadow copies
          PID:2020
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /C vssadmin Delete Shadows /For=A: /All /Quiet
        2⤵
        • System Location Discovery: System Language Discovery
        PID:852
        • C:\Windows\SysWOW64\vssadmin.exe
          vssadmin Delete Shadows /For=A: /All /Quiet
          3⤵
          • System Location Discovery: System Language Discovery
          • Interacts with shadow copies
          PID:2424
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /C net stop vss
        2⤵
          PID:1164
          • C:\Windows\SysWOW64\net.exe
            net stop vss
            3⤵
            • System Location Discovery: System Language Discovery
            PID:3116
            • C:\Windows\SysWOW64\net1.exe
              C:\Windows\system32\net1 stop vss
              4⤵
              • System Location Discovery: System Language Discovery
              PID:3172
        • C:\Windows\SysWOW64\cmd.exe
          "C:\Windows\System32\cmd.exe" /C bcdedit /set {default} recoveryenabled No
          2⤵
          • System Location Discovery: System Language Discovery
          PID:3008
        • C:\Windows\SysWOW64\cmd.exe
          "C:\Windows\System32\cmd.exe" /C bcdedit /set {default} bootstatuspolicy ignoreallfailures
          2⤵
          • System Location Discovery: System Language Discovery
          PID:1688
        • C:\Windows\SysWOW64\cmd.exe
          "C:\Windows\System32\cmd.exe" bcdedit /set {default} recoveryenabled No
          2⤵
          • System Location Discovery: System Language Discovery
          PID:3096
        • C:\Windows\SysWOW64\cmd.exe
          "C:\Windows\System32\cmd.exe" bcdedit /set {default} bootstatuspolicy ignoreallfailures
          2⤵
          • System Location Discovery: System Language Discovery
          PID:3164
        • C:\Windows\SysWOW64\cmd.exe
          "C:\Windows\System32\cmd.exe" bcdedit /set bootstatuspolicy ignoreallfailures
          2⤵
          • System Location Discovery: System Language Discovery
          PID:3236
        • C:\Windows\SysWOW64\cmd.exe
          "C:\Windows\System32\cmd.exe" /C bcdedit /set bootstatuspolicy ignoreallfailures
          2⤵
          • System Location Discovery: System Language Discovery
          PID:3268
        • C:\Windows\SysWOW64\cmd.exe
          "C:\Windows\System32\cmd.exe" bcdedit /set recoveryenabled NO
          2⤵
          • System Location Discovery: System Language Discovery
          PID:3296
        • C:\Windows\SysWOW64\cmd.exe
          "C:\Windows\System32\cmd.exe" /C bcdedit /set recoveryenabled NO
          2⤵
          • System Location Discovery: System Language Discovery
          PID:3320
        • C:\Windows\SysWOW64\cmd.exe
          "C:\Windows\System32\cmd.exe" /C wbadmin delete catalog -quiet
          2⤵
          • System Location Discovery: System Language Discovery
          PID:3404
        • C:\Windows\SysWOW64\cmd.exe
          "C:\Windows\System32\cmd.exe" wbadmin delete catalog -quiet
          2⤵
            PID:3488
          • C:\Windows\SysWOW64\NOTEPAD.EXE
            "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Documents\HELP_DECRYPT_YOUR_FILES.TXT
            2⤵
            • Opens file in notepad (likely ransom note)
            PID:3604
        • C:\Windows\system32\vssvc.exe
          C:\Windows\system32\vssvc.exe
          1⤵
          • Suspicious use of AdjustPrivilegeToken
          PID:1376

        Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\MSOCache\HELP_DECRYPT_YOUR_FILES.TXT
          Filesize

          3KB

          MD5

          d636a423df1cad3d65e732962033b83c

          SHA1

          17e80b8fddd3825d14ebab83e9c89fc53bd6bf68

          SHA256

          37678604892fd13580cfc8c81b0038dfeee03fc13c9bcf5c7d80bab67e9718f2

          SHA512

          5be036b6f46df9a90ff5946bd5531c9b9d6153c7c311dd118ed6946016e033174ebe447f425bc57c17d3c0b4ab4c3018a62ec6fe5817b59e6d375f51e331b89d

          Download Submit

        • C:\Users\Admin\Documents\[email protected]_.rscl
          Filesize

          10KB

          MD5

          354edc0200bba69bf39d845e4982002d

          SHA1

          7ccff8d5f0b4cee53f3731eeb94911831a5843f7

          SHA256

          59e02f5acb977ca999ab8e0ef90222f1da58936ae7a458a2f19495380ffd1f73

          SHA512

          b7a5d3ab8a7418bced55445813aae360be7bb1340468edb7b613651f8e06fdb2f276344a39433ffdb759ed75589445f30eeac0d82fc3647eb3fced9e3d9d1f4d

          Download Submit

        • memory/2676-0-0x0000000000100000-0x000000000010C000-memory.dmp

          Filesize

          48KB

          Download