Overview

overview

10

Static

static

10

sample-604...ad.zip

windows7-x64

sample-604...ad.zip

windows10-2004-x64

sample-604...ad.zip

android-13-x64

sample-604...ad.zip

android-13-x64

sample-604...ad.zip

macos-10.15-amd64

sample-604...ad.zip

ubuntu-18.04-amd64

sample-604...ad.zip

debian-9-armhf

sample-604...ad.zip

debian-9-mips

sample-604...ad.zip

debian-9-mipsel

W71my1HtQm.exe

windows7-x64

10

W71my1HtQm.exe

windows10-2004-x64

10

W71my1HtQm.exe

android-9-x86

W71my1HtQm.exe

android-13-x64

W71my1HtQm.exe

macos-10.15-amd64

W71my1HtQm.exe

ubuntu-18.04-amd64

W71my1HtQm.exe

debian-9-armhf

W71my1HtQm.exe

debian-9-mips

W71my1HtQm.exe

debian-9-mipsel

Resubmissions

05-02-2025 10:30

250205-mj94gstpgl 10

05-02-2025 10:30

250205-mjtfqssmgt 10

25-05-2022 22:49

220525-2rm19aefd9 10

Analysis

  • max time kernel
    140s
  • max time network
    205s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20250129-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20250129-enlocale:en-usos:windows10-2004-x64system
  • submitted
    05-02-2025 10:30

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    W71my1HtQm.exe

  • Size

    499KB

  • MD5

    339165f63aec8d7fd7798129d0fc68ad

  • SHA1

    07f594333ca9db110bbee37a9643988f4cc22933

  • SHA256

    0f0014669bc10a7d87472cafc05301c66516857607b920ddeb3039f4cb8f0a50

  • SHA512

    5ef9dbe0f29397adf00f0c4ace8f90fd0aba9a0c2016cecff02f68bcef5781bc5dcd32c18d9b54cc8025581ec6494990dd472cdd36c394637799907e5cc55e3b

  • SSDEEP

    12288:WLIv9fm79P+OeO+OeNhBBhhBBmBRW3aHhIBidMbDI8s9eJ:EIv9OxBRW3+hIIdE01e

Score
10/10
mespinozadiscoveryransomwarespywarestealer

Malware Config

Extracted

Path

C:\Users\Readme.README

Ransom Note
Hi Company, Every byte on any types of your devices was encrypted. Don't try to use backups because it were encrypted too. To get all your data back contact us: [email protected] [email protected] -------------- FAQ: 1. Q: How can I make sure you don't fooling me? A: You can send us 2 files(max 2mb). 2. Q: What to do to get all data back? A: Don't restart the computer, don't move files and write us. 3. Q: What to tell my boss? A: Protect Your System Amigo.

Signatures

  • Mespinoza Ransomware 2 TTPs

    Also known as Pysa. Ransomware-as-a-servoce which first appeared in 2020.

    ransomwaremespinoza
  • Mespinoza family
    mespinoza
  • Renames multiple (3395) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 1 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious use of WriteProcessMemory 3 IoCs
  • System policy modification 1 TTPs 2 IoCs
    defense_evasion

Processes

  • C:\Users\Admin\AppData\Local\Temp\W71my1HtQm.exe
    C:\Users\Admin\AppData\Local\Temp\W71my1HtQm.exe dsrm -subtree -noprompt -c user"http://+:443"
    1⤵
    • Checks computer location settings
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    • System policy modification
    PID:872
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\update.bat" "
      2⤵
      • System Location Discovery: System Language Discovery
      PID:832

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\update.bat
    Filesize

    231B

    MD5

    715e4d1f8655fb52a0126e5a7dae0655

    SHA1

    6ef4a6f09ee41b4e252ffb2e6d0468ee2baa7fa8

    SHA256

    41b5704d96abe077590fbd89587d411447555435112688a2a21183e91e98f211

    SHA512

    a3fd655d5eb3fe22bcdb6c47b6d2fc892e152c4e103468864220639e6a740d1906596a639019c5cbe70a4eab00d47a3fcf4d60a4213a4da912bc4cd207b091a7

    Download Submit

  • C:\Users\Readme.README
    Filesize

    528B

    MD5

    b26277809ebf80bc297f7a3ce3cf0e03

    SHA1

    e676b984e54a5a271645c0fc00070a85693d8199

    SHA256

    9118268321ccd7872acda7d40b86d2856f329fa95b1cc6374f9deb7849b35ee1

    SHA512

    3b23ba7677aff6540eb6e7a64f672036a647f7a7159dada81d135b5ae52489469456f813f310e617f7abb5d44bcf483220100a528ca9da8f93efae3d7d48860d

    Download Submit