Overview

overview

10

Static

static

10

533.7z

windows7-x64

533.7z

windows10-2004-x64

533.7z

android-10-x64

533.7z

android-13-x64

533.7z

macos-10.15-amd64

533.7z

ubuntu-18.04-amd64

533.7z

debian-9-armhf

533.7z

debian-9-mips

533.7z

debian-9-mipsel

084c57449c...0e.exe

windows7-x64

10

084c57449c...0e.exe

windows10-2004-x64

10

084c57449c...0e.exe

android-13-x64

084c57449c...0e.exe

android-13-x64

084c57449c...0e.exe

macos-10.15-amd64

084c57449c...0e.exe

ubuntu-18.04-amd64

084c57449c...0e.exe

debian-9-armhf

084c57449c...0e.exe

debian-9-mips

084c57449c...0e.exe

debian-9-mipsel

14b94844b9...c3.exe

windows7-x64

10

14b94844b9...c3.exe

windows10-2004-x64

10

14b94844b9...c3.exe

android-11-x64

14b94844b9...c3.exe

android-13-x64

14b94844b9...c3.exe

macos-10.15-amd64

14b94844b9...c3.exe

ubuntu-18.04-amd64

14b94844b9...c3.exe

debian-9-armhf

14b94844b9...c3.exe

debian-9-mips

14b94844b9...c3.exe

debian-9-mipsel

2daa514408...2e.exe

windows7-x64

10

2daa514408...2e.exe

windows10-2004-x64

10

2daa514408...2e.exe

android-11-x64

2daa514408...2e.exe

android-13-x64

2daa514408...2e.exe

macos-10.15-amd64

Resubmissions

25/03/2025, 13:12

250325-qfl42aznw910

25/03/2025, 13:09

250325-qdtq4aznv610

25/03/2025, 13:05

250325-qbtcjszns310

25/03/2025, 13:01

250325-p9k86awxat10

25/03/2025, 12:55

250325-p58tnawwe110

25/03/2025, 12:51

250325-p3txqazmt610

05/02/2025, 11:16

250205-ndjvsavrdm10

16/07/2024, 08:54

240716-kt64gavakp10

Analysis

  • max time kernel
    300s
  • max time network
    180s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20250129-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20250129-enlocale:en-usos:windows10-2004-x64system
  • submitted
    05/02/2025, 11:16

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    084c57449c765416706301c723116da5073aa60da415c0eb3013239611135b0e.exe
  • Size 49KB
  • Sample250205-ndjvsavrdm
  • SHA256 084c57449c765416706301c723116da5073aa60da415c0eb3013239611135b0e
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
credential_accessdefense_evasiondiscoveryexecutionimpactransomwarestealer

Malware Config

Extracted

Path

  • C:\Program Files\Common Files\DESIGNER\+README-WARNING+.txt

Ransom Note
  • ::: Hey ::: Small FAQ: .1. Q: What's going on? A: Your files have been encrypted. The file structure was not affected, we did our best to prevent this from happening. .2. Q: How to recover files? A: If you want to decrypt your files, you will need to pay us. .3. Q: What about guarantees? A: It's just business. We are absolutely not interested in you and your transactions, except for profit. If we do not fulfill our work and obligations, no one will cooperate with us. It's not in our interest. To check the possibility of returning files, you can send us any 2 files with SIMPLE extensions (jpg, xls, doc, etc... not databases!) and small sizes (max 1 mb), we will decrypt them and send them back to you. This is our guarantee. .4. Q: How to contact you? A: You can write to us at our mailboxes: [email protected] .5. Q: How will the decryption process take place after payment? A: After payment, we will send you our scanner-decoder program and detailed instructions for use. With this program you will be able to decrypt all your encrypted files. .6. Q: If I don't want to pay bad people like you? A: If you do not cooperate with our service - it does not matter to us. But you will lose your time and data because only we have the private key. In practice, time is much more valuable than money. :::BEWARE::: DO NOT try to modify encrypted files yourself! If you try to use third party software to recover your data or antivirus solutions - back up all encrypted files! Any changes to the encrypted files may result in damage to the private key and, as a result, the loss of all data. Note: ::::::IF WE HAVE NOT RESPONSE YOU BY MAIL WITHIN 24 HOURS:::::: Spare contact for communication: If we have not answered your email within 24 hours, you can contact us via the free messenger qTox Download from the link https://tox.chat/download.html Next go qTox 64-bit after downloading the program, install it and go through a short registration. Our Tox ID 37CDA60B5B593473E120366CCF68A8C08F503880D2AE7F0F4161C2C9C0502C6304DDA2B19D8E
URLs

  • https://tox.chat/download.html

Signatures

  • Deletes shadow copies 3 TTPs

    Ransomware often targets backup files to inhibit system recovery.

    ransomwaredefense_evasionimpactexecution
  • Renames multiple (6415) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware
  • Deletes backup catalog 3 TTPs 1 IoCs

    Uses wbadmin.exe to inhibit system recovery.

    ransomware
  • Credentials from Password Stores: Windows Credential Manager 1 TTPs

    Suspicious access to Credentials History.

    credential_accessstealer
  • Drops file in System32 directory 6 IoCs
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 4 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Interacts with shadow copies 3 TTPs 1 IoCs

    Shadow copies are often targeted by ransomware to inhibit system recovery.

    ransomware
  • Modifies data under HKEY_USERS 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 48 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\084c57449c765416706301c723116da5073aa60da415c0eb3013239611135b0e.exe
    C:\Users\Admin\AppData\Local\Temp\084c57449c765416706301c723116da5073aa60da415c0eb3013239611135b0e.exe dsrm -subtree -noprompt -c user"http://+:443"
    1⤵
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:2720
    • C:\Windows\system32\cmd.exe
      "C:\Windows\system32\cmd.exe"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:4800
      • C:\Windows\system32\vssadmin.exe
        vssadmin delete shadows /all /quiet
        3⤵
        • Interacts with shadow copies
        PID:2548
      • C:\Windows\system32\wbadmin.exe
        wbadmin delete catalog -quiet
        3⤵
        • Deletes backup catalog
        PID:4756
      • C:\Windows\System32\Wbem\WMIC.exe
        wmic shadowcopy delete
        3⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:4192
  • C:\Windows\system32\vssvc.exe
    C:\Windows\system32\vssvc.exe
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:4944
  • C:\Windows\system32\wbengine.exe
    "C:\Windows\system32\wbengine.exe"
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:4220
  • C:\Windows\System32\vdsldr.exe
    C:\Windows\System32\vdsldr.exe -Embedding
    1⤵
      PID:720
    • C:\Windows\System32\vds.exe
      C:\Windows\System32\vds.exe
      1⤵
      • Checks SCSI registry key(s)
      PID:4504
    • C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe
      "C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service
      1⤵
      • Drops file in System32 directory
      • Checks processor information in registry
      • Enumerates system info in registry
      • Modifies data under HKEY_USERS
      • Suspicious use of SetWindowsHookEx
      PID:3500

    Network

          MITRE ATT&CK Enterprise v15

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          +README-WARNING+.txt
          • Path C:\Program Files\Common Files\DESIGNER\+README-WARNING+.txt
          • Size 2KB
          • SHA256 2225eb49c5a55704c141e965cee16592f303ab5112a5df49b6a102a8bd34bb02
          • MD5 SHA1 SHA512
          Submit Download