Overview

overview

10

Static

static

1

Gosjeufon.cpl.exe

windows7-x64

10

Gosjeufon.cpl.exe

windows10-2004-x64

10

Resubmissions

15-12-2024 15:40

241215-s4m3caylfs 10

14-12-2024 13:26

241214-qphg7stkay 10

Analysis

  • max time kernel
    30s
  • max time network
    31s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    15-12-2024 15:40

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    Gosjeufon.cpl.exe

  • Size

    881KB

  • MD5

    9049faba5517305c44bd5f28398fb6b9

  • SHA1

    036c6b32f3e7d7d689c9b4d482091eebcc669bfa

  • SHA256

    d2100ffe58eb50c05d97a3da738ccd1f0be9672c057c26a10140af80595b78c3

  • SHA512

    65a33506f970675775468f80b94a3f8bb2d3672e6fb08fc9f2e5107020095ca6d4bca927c59b72488e2ef4208a64a56ced7511ea14c0445cd50ea3ff9b827f6a

  • SSDEEP

    12288:I2wMm7l55+OeO+OeNhBBhhBBaELPA081o9baXpL3K+HDFgZUid4X9dCU5+Kazw4t:I2wMm7lfCIL3K+gY9dfcw4h3DX9X1

Score
10/10
credential_accessdefense_evasiondiscoveryexecutionimpactpersistenceransomwarespywarestealer

Malware Config

Extracted

Path

C:\Users\Admin\AppData\Local\Temp\Decryptfiles.txt

Ransom Note
ATTENTION! Don't worry, you can return your files! All your files like photos, videos and other important documents are encrypted with a strong encryption algorithm and unique key. The only method of recovering files is to purchase a decrypt tool and your key. Do not try to recover your files without a decrypt tool, you may damage them making them impossible to recover we advise you contact us in less than 72 hours, otherwise there is a possibility that your files will never be returned. We will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision. Check your email 'Spam' or 'Junk' foeder if you don't get answer within 6 hours. Contact us email :[email protected] -> [email protected] Attach this file in the email. ID :56A23C7793EEFDB4627B2F20DD748BA3FA88D2E3A467170DBDC7B7688FC9F430A19BD2005BE5B5E964A3589EC5941CC2B1F6B62291EB997026D39947484D6223248410B08EDC3E05DB18E16B6BDB56AE433470547D91D0AAB1F2853F54C6D0637465E0D567EFBCE05DC00BC17083515767239A792E6E92B80C5D1D56F0335FBA336F7671E37A9BE4A9CE76CCBE7ACADACD54B2D1300BD960B75958142C2CEC558D622D9EE8EEA74986BCF47C9D925D7F349649A0D12A3E41FE5D357B15DD7F3F1204ECA678D28183BFF0110C2FE18B50F01CA4F58788501D170D9BE36AC569CFCC25759213791C108BE08BB1E07CECDE5331F3A56784BEAFFDAE49CD5DF2A93CDC9D216F4CF58D5408C3A218142566038BD30A8C2463519F2052E596A276AFB600B90FFB2815823AEF88AD6FCCAB4F5F81CE292D70437063903D34211490E2022CD4474888017212A49CF226862F3E2DD5D2A74AB1A3803F715C191FAFEAB9FD12B11F4F5249AB2C2FF9DD834443239544341ED24F4DC2B8CC9210BD0C7A5F34B9621CD0FDEAFC0FAAD6D4007E2A0638B22534C6B165BC4C1AA0F2B7943BBDC857C47692912E69DD99AB00EFAF9F55ED9E3187F85CA2AC3C360F5CCDFE8B66C16F05225E06B52174727FA5F5EA78241A40992E18B588019A9F9EECEECF98E69E118456E873A1C2B566937CAF209AE9859ACBD79CB988D923BF8BEB91F12C69D1F27024891E1DBC2CB08128B829882B69B63085D4DBFD2BEAA432B34D8DED6ABCB3FDB49C5755883DFEE646D6B4F59C0FF934B4371088041D36CE74CD9846CB5269D478989D23C5EDC4FCF115B0758E0CD81DCDCDBBC508A4E582B8E873AE625A59E09A7D5C2459DC16E69184983678C25346ED28DE32D5BF9D23FD56038E74088F8791ABABE3885B4107FEECFEF9BF1C7260AAD1557BC1FC52C1B66F459556831854219C24F9E0C9B82499B8F819173520016F41D9D2CC90346C3DE687C3FFF3C9C3DA3C665BB99CAF797B5BC39610773A543FBEE810976AB119C3589BA4C7D229E77CB0F56BC5C39EE0AB2B514ADA03A9C39B10768097A87625035CA431BE05BBB2AF09B87B873ADD0695F43BF703292D8FAD9F811E9DCBBD22D8EE3F5746D494ABA88BB3F581BBECDACEA4183C69F3DF3A4B1C0AF8B8BEA5FF466A7B19F4CBC7F3B0B02D69F35E9F195C017D9EE7E79CC7B1D2ED74EB018BB387C6B4066EA15DA99EAFEE84470CD1B68A7BC3E6EBE9746F0B255D277350EAE39E10B2AD1F4AE8E73CC60525EDEB7612B9AD63C99D2F043FDC475E24FFDC0F4395A69D829788B6096AFB89BE872D7ADBF32C0728091A05707AC763A903ACE4DB3EEC059559D7E9533B51E1C32526471319C1AC638507A00BA5E4AAA3C425761670DF78DD42FF8AB612018142FF37E366C4DEC11C7C825CB5C323B70E3E50B8E750553DEE58C6506DF84A14C69DFD0976D1CE6F7A969F6986CFB305C02C86460ABAAC8716F8286750C736B5512EDD33432673CCA302B818F8225E2B6507207805E1A74C6E82CDC0767950B2F26157A000224951B9D2C8AB7F38CE6C28CB0A5963264DFEDB521F2890324285A445369F76770FAA159CB502B7FA379CBCEE480FCD601AAFDCB723CA26EC48FD54781FCDAB1D52EB973C01427CFF55A63DA9683C33846E0D73EA08DA6E952AC61FAA0FE55C0FF9C9D311368C385BA14BAE7E153941AAB5040B5B00CA5BE203DC974DA4BA400FA11657AF25A9C6D5DAEB13F0351DAFEF2A68D8EBF9907DEB7C08B68B21BB51C97D8684F081BB0CFEE732537BC6E4BAA36F5D0517FCAB45F9AC9F9E37B5A6FAF7F896F7CEABAABB3E62A07C35830EB16B0487466E78284909C59116DC23CAA4E483E0B3D3333325005DEAD6DA54F7984C3053231E9A0A94332C5FC992C8DCC00CC6FD26CB38F3AE6D6C051EAC1A68280E707F3D31F30845BF671CF78B7CFF6585BE70944BD9FAC1388B481D36BCD61794ABD4643ED247E72120DC51237395D05A617B8C0C4FB4068DFD55BD70FDC3D88949E615B0955A76E18442A2064CDBC6235F7DA30118475A2806F9D0E52B7088D9266792934FCBF9BD1130F22CA16DDE5E3CBE7537B3A5CAF606690ED8C56EF9F26DFFB9FC13315AC1715CF640790A5FF220DA4F0C617A0EEB757DF17F3A92BDE626FDA44030C4A48D22AFD6E31E14A446DD701A13A386C5B0ECC2508CD492E31D4FAF07046E9F916AD5560C005F7CE8E1CF2E1B891B8074932ED9A3CA93070A5136DAF7508CFC4F7580F901FB413508C48350188322AD70D5F562F6B2C71276EF57270D064F05DCE54CAFF45C77B7DADAD4A5947FC8EA4F175E54DC3C079C7C53F11DB4BBDFAD26AB271EFD69��i�L�~�

Signatures

  • Deletes shadow copies 3 TTPs

    Ransomware often targets backup files to inhibit system recovery.

    ransomwaredefense_evasionimpactexecution
  • Credentials from Password Stores: Windows Credential Manager 1 TTPs

    Suspicious access to Credentials History.

    credential_accessstealer
  • Drops startup file 2 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Drops desktop.ini file(s) 4 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs

    Adversaries may check for Internet connectivity on compromised systems.

    discovery
  • Runs ping.exe 1 TTPs 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 14 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 10 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\Gosjeufon.cpl.exe
    "C:\Users\Admin\AppData\Local\Temp\Gosjeufon.cpl.exe"
    1⤵
    • Drops startup file
    • Adds Run key to start application
    • Drops desktop.ini file(s)
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:3568
    • \??\c:\Windows\system32\wbem\wmic.exe
      c:\yZTSJz\yZTS\..\..\Windows\yZTS\yZTS\..\..\system32\yZTS\yZTS\..\..\wbem\yZTS\yZTSJ\..\..\wmic.exe shadowcopy delete
      2⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:3136
    • \??\c:\Windows\system32\wbem\wmic.exe
      c:\oFuKyQ\oFuK\..\..\Windows\oFuK\oFuK\..\..\system32\oFuK\oFuK\..\..\wbem\oFuK\oFuKy\..\..\wmic.exe shadowcopy delete
      2⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:1352
    • C:\Windows\SysWOW64\cmd.exe
      cmd.exe /C ping 1.1.1.1 -n 1 -w 3000 > Nul & Del /f /q "C:\Users\Admin\AppData\Local\Temp\Gosjeufon.cpl.exe"
      2⤵
      • System Location Discovery: System Language Discovery
      • System Network Configuration Discovery: Internet Connection Discovery
      • Suspicious use of WriteProcessMemory
      PID:2820
      • C:\Windows\SysWOW64\PING.EXE
        ping 1.1.1.1 -n 1 -w 3000
        3⤵
        • System Location Discovery: System Language Discovery
        • System Network Configuration Discovery: Internet Connection Discovery
        • Runs ping.exe
        PID:3156
  • C:\Windows\system32\vssvc.exe
    C:\Windows\system32\vssvc.exe
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:2368

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Windows Management Instrumentation

1
T1047

Persistence

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Defense Evasion

Indicator Removal

1
T1070

File Deletion

1
T1070.004

Modify Registry

1
T1112

Credential Access

Credentials from Password Stores

2
T1555

Credentials from Web Browsers

1
T1555.003

Windows Credential Manager

1
T1555.004

Unsecured Credentials

1
T1552

Credentials In Files

1
T1552.001

Discovery

Remote System Discovery

1
T1018

System Location Discovery

1
T1614

System Language Discovery

1
T1614.001

System Network Configuration Discovery

1
T1016

Internet Connection Discovery

1
T1016.001

Lateral Movement

Collection

Data from Local System

1
T1005

Command and Control

Exfiltration

Impact

Inhibit System Recovery

1
T1490

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\Decryptfiles.txt
    Filesize

    4KB

    MD5

    4539ad23b0b4d5136158a005a8ff7812

    SHA1

    56fa19f50f08df4872f2f266a7ed30aba52e4c15

    SHA256

    b18fe29d0691dfe8417cee6115523322cdaf9187b803372ebee686304e459c69

    SHA512

    5f27eabe778c32705cdaea25ce40ceede7473a05d58d4229b104fda2a8dc8a443dc48faa63d94632213539989342f9f1321fb420ab85bccb3a4dd16f0c919f38

    Download Submit