f1c69846f701883a14f9f9b0aa8ecc0b4ec9dad1fbdd01bad362cc124e00f010

General

Target
d7a4c01a54a2368351bfa4099b9d41c36d52997328c6292f0881eb102b810f37.exe
Size 1.1MB
Sample250429-cds8nsvm19
SHA256 d7a4c01a54a2368351bfa4099b9d41c36d52997328c6292f0881eb102b810f37
MD5 64fd00d04ae1cbfa4dfff576018f209b
SHA1 40dfe63bf78dd3dcb5d674297b65bb5030f7264b
SHA512 dfcde8e105d30d24989fa9523ddd5b20623f917f81a028496b21e042f7c2d7deda6ee5fbafc1ffd16a1a867daf8320319635f9c7ee445f5fba7c67d4aaf90858
SSDEEP 24576:PLhQsUxCEZIkvaWGOwcCW0OYu+QpbTybCF46vh2a:9tU/fiWpiOvECF4u
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

defense_evasion discovery execution impact ransomware

Malware Config

Extracted

Path

C:\PerfLogs\How To Restore Your Files.txt

Ransom Note

--------------- Hello --------------- !!!IMPORTANT !!! ################################### # you Decryptor ID is : Ths62cw69 # ################################### Your computers and servers are encrypted, and backups are deleted. We use strong encryption algorithms, so no one has yet been able to decrypt their files without our participation. The only way to decrypt your files is to purchase a universal decoder from us, which will restore all the encrypted data and your network. Follow our instructions below, and you will recover all your data: 1) Pay 0,006 bitcoin to 1E6cvG6iEbufvYspsDa3XQ3WJgEMvRTm9i 2) Send us a message with your Decryptor ID and transaction ID at [email protected] 3) Launch decryptor.exe, which our support will send you through email What guarantees? ------------------ We value our reputation. If we will not do our work and liabilities, nobody will pay us. This is not in our interests. All our decryption software is tested by time and will decrypt all your data. ------------------ !!! DO NOT TRY TO RECOVER ANY FILES YOURSELF. WE WILL NOT BE ABLE TO RESTORE THEM!!! --------------- Привет --------------- !!!ВАЖНО!!! ################################### # товй Decryptor ID : Ths62cw69 # ################################### Ваши компьютеры и серверы шифруются, а резервные копии удаляются. Мы используем надежные алгоритмы шифрования, поэтому никто еще не смог расшифровать свои файлы без нашего участия. Единственный способ расшифровать ваши файлы - это приобрести у нас универсальный декодер, который восстановит все зашифрованные данные и вашу сеть. Следуйте нашим инструкциям ниже, и вы восстановите все свои данные: 1) Переведите 0,006 биткоина на 1E6cvG6iEbufvYspsDa3XQ3WJgEMvRTm9i 2) Отправьте нам сообщение с вашим Decryptor ID и с идентификатором транзакции по адресу [email protected] 3) Запустите decryptor.exe, который наша служба поддержки отправит вам по электронной почте Какие гарантии? ------------------ Мы дорожим своей репутацией. Если мы не выполним свою работу и обязательства, нам никто не заплатит. Это не в наших интересах. Все наши программы для расшифровки проверены временем и расшифруют все ваши данные. ------------------ !!! НЕ ПЫТАЙТЕСЬ ВОССТАНОВИТЬ КАКИЕ-ЛИБО ФАЙЛЫ САМОСТОЯТЕЛЬНО. ИНАЧЕ МЫ НЕ СМОЖЕМ ИХ ВОССТАНОВИТЬ!!!

Emails

[email protected]

Wallets

1E6cvG6iEbufvYspsDa3XQ3WJgEMvRTm9i

Signatures

Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware defense_evasion impact execution

File Deletion
T1070.004

Inhibit System Recovery
T1490

Windows Management Instrumentation
T1047
Renames multiple (153) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\V:	d7a4c01a54a2368351bfa4099b9d41c36d52997328c6292f0881eb102b810f37.exe
File opened (read-only)	\??\M:	d7a4c01a54a2368351bfa4099b9d41c36d52997328c6292f0881eb102b810f37.exe
File opened (read-only)	\??\Q:	d7a4c01a54a2368351bfa4099b9d41c36d52997328c6292f0881eb102b810f37.exe
File opened (read-only)	\??\E:	d7a4c01a54a2368351bfa4099b9d41c36d52997328c6292f0881eb102b810f37.exe
File opened (read-only)	\??\J:	d7a4c01a54a2368351bfa4099b9d41c36d52997328c6292f0881eb102b810f37.exe
File opened (read-only)	\??\K:	d7a4c01a54a2368351bfa4099b9d41c36d52997328c6292f0881eb102b810f37.exe
File opened (read-only)	\??\X:	d7a4c01a54a2368351bfa4099b9d41c36d52997328c6292f0881eb102b810f37.exe
File opened (read-only)	\??\W:	d7a4c01a54a2368351bfa4099b9d41c36d52997328c6292f0881eb102b810f37.exe
File opened (read-only)	\??\T:	d7a4c01a54a2368351bfa4099b9d41c36d52997328c6292f0881eb102b810f37.exe
File opened (read-only)	\??\Y:	d7a4c01a54a2368351bfa4099b9d41c36d52997328c6292f0881eb102b810f37.exe
File opened (read-only)	\??\U:	d7a4c01a54a2368351bfa4099b9d41c36d52997328c6292f0881eb102b810f37.exe
File opened (read-only)	\??\A:	d7a4c01a54a2368351bfa4099b9d41c36d52997328c6292f0881eb102b810f37.exe
File opened (read-only)	\??\H:	d7a4c01a54a2368351bfa4099b9d41c36d52997328c6292f0881eb102b810f37.exe
File opened (read-only)	\??\Z:	d7a4c01a54a2368351bfa4099b9d41c36d52997328c6292f0881eb102b810f37.exe
File opened (read-only)	\??\B:	d7a4c01a54a2368351bfa4099b9d41c36d52997328c6292f0881eb102b810f37.exe
File opened (read-only)	\??\R:	d7a4c01a54a2368351bfa4099b9d41c36d52997328c6292f0881eb102b810f37.exe
File opened (read-only)	\??\I:	d7a4c01a54a2368351bfa4099b9d41c36d52997328c6292f0881eb102b810f37.exe
File opened (read-only)	\??\O:	d7a4c01a54a2368351bfa4099b9d41c36d52997328c6292f0881eb102b810f37.exe
File opened (read-only)	\??\P:	d7a4c01a54a2368351bfa4099b9d41c36d52997328c6292f0881eb102b810f37.exe
File opened (read-only)	\??\N:	d7a4c01a54a2368351bfa4099b9d41c36d52997328c6292f0881eb102b810f37.exe
File opened (read-only)	\??\S:	d7a4c01a54a2368351bfa4099b9d41c36d52997328c6292f0881eb102b810f37.exe
File opened (read-only)	\??\G:	d7a4c01a54a2368351bfa4099b9d41c36d52997328c6292f0881eb102b810f37.exe
File opened (read-only)	\??\L:	d7a4c01a54a2368351bfa4099b9d41c36d52997328c6292f0881eb102b810f37.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
924	d7a4c01a54a2368351bfa4099b9d41c36d52997328c6292f0881eb102b810f37.exe
924	d7a4c01a54a2368351bfa4099b9d41c36d52997328c6292f0881eb102b810f37.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	d7a4c01a54a2368351bfa4099b9d41c36d52997328c6292f0881eb102b810f37.exe

Interacts with shadow copies 3 TTPs 2 IoCs

Shadow copies are often targeted by ransomware to inhibit system recovery.

ransomware

File Deletion

T1070.004

Inhibit System Recovery

T1490

Direct Volume Access

T1006

pid	Process
1680	vssadmin.exe
3644	vssadmin.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
924	d7a4c01a54a2368351bfa4099b9d41c36d52997328c6292f0881eb102b810f37.exe
924	d7a4c01a54a2368351bfa4099b9d41c36d52997328c6292f0881eb102b810f37.exe
924	d7a4c01a54a2368351bfa4099b9d41c36d52997328c6292f0881eb102b810f37.exe
924	d7a4c01a54a2368351bfa4099b9d41c36d52997328c6292f0881eb102b810f37.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeBackupPrivilege	3536	vssvc.exe
Token: SeRestorePrivilege	3536	vssvc.exe
Token: SeAuditPrivilege	3536	vssvc.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
924	d7a4c01a54a2368351bfa4099b9d41c36d52997328c6292f0881eb102b810f37.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 924 wrote to memory of 2228	924	d7a4c01a54a2368351bfa4099b9d41c36d52997328c6292f0881eb102b810f37.exe	79
PID 924 wrote to memory of 2228	924	d7a4c01a54a2368351bfa4099b9d41c36d52997328c6292f0881eb102b810f37.exe	79
PID 2228 wrote to memory of 1680	2228	cmd.exe	82
PID 2228 wrote to memory of 1680	2228	cmd.exe	82
PID 924 wrote to memory of 5700	924	d7a4c01a54a2368351bfa4099b9d41c36d52997328c6292f0881eb102b810f37.exe	86
PID 924 wrote to memory of 5700	924	d7a4c01a54a2368351bfa4099b9d41c36d52997328c6292f0881eb102b810f37.exe	86
PID 5700 wrote to memory of 3644	5700	cmd.exe	88
PID 5700 wrote to memory of 3644	5700	cmd.exe	88

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\d7a4c01a54a2368351bfa4099b9d41c36d52997328c6292f0881eb102b810f37.exe
"C:\Users\Admin\AppData\Local\Temp\d7a4c01a54a2368351bfa4099b9d41c36d52997328c6292f0881eb102b810f37.exe"
1⤵
- Enumerates connected drives
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:924
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c vssadmin.exe delete shadows /all /quiet
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2228
- - C:\Windows\system32\vssadmin.exe
    vssadmin.exe delete shadows /all /quiet
    3⤵
    - Interacts with shadow copies
    PID:1680
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c vssadmin.exe delete shadows /all /quiet
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5700
- - C:\Windows\system32\vssadmin.exe
    vssadmin.exe delete shadows /all /quiet
    3⤵
    - Interacts with shadow copies
    PID:3644

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3536

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Windows Management Instrumentation

1

T1047

Persistence

Privilege Escalation

Defense Evasion

Direct Volume Access

1

T1006

Indicator Removal

2

T1070

File Deletion

2

T1070.004

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

2

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Inhibit System Recovery

2

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

How To Restore Your Files.txt

Path C:\PerfLogs\How To Restore Your Files.txt
Size 3KB
SHA256 105ae4c673496a65110e937d4a1cca6216625adedd59cdc23c7145ace84b9d57
MD5 5b20d63874d8eea6525cf20e26acf287
SHA1 8b41b7d04fb30f8a0583d2c97e74eee7c1a31026
SHA512 dec7a023ccca97ba2d368e67d041bb6db035f8c25c02acd5b6ee10c9feabd3919af6fee84213208cf2a381a488f264ff757557d738300798adbaf728d0cdcd6f
MD5 SHA1 SHA512

Submit Download

memory/924-0-0x0000000000270000-0x00000000005EC000-memory.dmp

Download

memory/924-219-0x0000000000270000-0x00000000005EC000-memory.dmp

Download

memory/924-220-0x0000000000270000-0x00000000005EC000-memory.dmp

Download

memory/924-221-0x0000000000270000-0x00000000005EC000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads