Analysis

  • max time kernel
    149s
  • max time network
    136s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20250502-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20250502-enlocale:en-usos:windows10-2004-x64system
  • submitted
    04/05/2025, 05:35

General

  • Target

    5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe

  • Size

    669KB

  • MD5

    ead18f3a909685922d7213714ea9a183

  • SHA1

    1270bd7fd62acc00447b30f066bb23f4745869bf

  • SHA256

    5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18

  • SHA512

    6e532d9c3d186e4dac38823ae9152056346e283613f0caf088b21a1b3e5f4f6cf3bad8c407168b1072895a386e3be0b8c11ad1cb326d3d3ff0eb8562052def91

  • SSDEEP

    6144:bLUHLyHlwFjxDi2nEZkQ4NXxp0XMgkBWPqdN/jGdfYY7SRA7j4YlvfYAAjJ:4uFi02nEZh4jp0XLuxGdgTm73vL

Malware Config

Extracted

Path

C:\ProgramData\_readme.txt

Ransom Note
ATTENTION! Don't worry my friend, you can return all your files! All your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key. The only method of recovering files is to purchase decrypt tool and unique key for you. This software will decrypt all your encrypted files. What guarantees you have? You can send one of your encrypted file from your PC and we decrypt it for free. But we can decrypt only 1 file for free. File must not contain valuable information. You can get and look video overview decrypt tool: https://we.tl/t-T9WE5uiVT6 Price of private key and decrypt software is $980. Discount 50% available if you contact us first 72 hours, that's price for you is $490. Please note that you'll never restore your data without payment. Check your e-mail "Spam" folder if you don't get answer more than 6 hours. To get this software you need write on our e-mail: [email protected] Reserve e-mail address to contact us: [email protected] Your personal ID: 046Sdsd3273yifhsisySD60h7mFQcjRC3pDgsRcrWZ7K7bdAgvgDos224DmXt1
URLs

https://we.tl/t-T9WE5uiVT6

Signatures

  • Renames multiple (155) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Modifies file permissions 1 TTPs 1 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Drops desktop.ini file(s) 25 IoCs
  • Looks up external IP address via web service 6 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • UPX packed file 5 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 5 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 10 IoCs
  • Suspicious use of WriteProcessMemory 15 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe
    "C:\Users\Admin\AppData\Local\Temp\5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe"
    1⤵
    • Checks computer location settings
    • Adds Run key to start application
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:4436
    • C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Users\Admin\AppData\Local\25a14486-eda8-4c34-b4e9-eb31d5e8d9cd" /deny *S-1-1-0:(OI)(CI)(DE,DC)
      2⤵
      • Modifies file permissions
      • System Location Discovery: System Language Discovery
      PID:1308
    • C:\Users\Admin\AppData\Local\Temp\5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe
      "C:\Users\Admin\AppData\Local\Temp\5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe" --Admin IsNotAutoStart IsNotTask
      2⤵
      • Drops desktop.ini file(s)
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:1568
      • C:\Users\Admin\AppData\Local\Temp\5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe
        "C:\Users\Admin\AppData\Local\Temp\5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe" --ForNetRes "FsnDCf1u1wJvLcqbFxxtOchBf2V2lgtk24oM5mt2" 0h7mFQcjRC3pDgsRcrWZ7K7bdAgvgDos224DmXt1 IsNotAutoStart IsNotTask
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:3780
        • C:\Users\Admin\AppData\Local\Temp\5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe
          "C:\Users\Admin\AppData\Local\Temp\5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe" --Service 3780 "FsnDCf1u1wJvLcqbFxxtOchBf2V2lgtk24oM5mt2" 0h7mFQcjRC3pDgsRcrWZ7K7bdAgvgDos224DmXt1
          4⤵
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          PID:2884
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -u -p 2884 -s 1064
            5⤵
            • Program crash
            PID:1264
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 3780 -s 1608
          4⤵
          • Program crash
          PID:4780
      • C:\Users\Admin\AppData\Local\Temp\5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe
        "C:\Users\Admin\AppData\Local\Temp\5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe" --Service 1568 "FsnDCf1u1wJvLcqbFxxtOchBf2V2lgtk24oM5mt2" 0h7mFQcjRC3pDgsRcrWZ7K7bdAgvgDos224DmXt1
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        PID:2672
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 2672 -s 1724
          4⤵
          • Program crash
          PID:1672
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 1568 -s 1676
        3⤵
        • Program crash
        PID:1508
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4436 -s 1860
      2⤵
      • Program crash
      PID:4528
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 4436 -ip 4436
    1⤵
      PID:3332
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 2884 -ip 2884
      1⤵
        PID:3188
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 3780 -ip 3780
        1⤵
          PID:3060
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 2672 -ip 2672
          1⤵
            PID:3284
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 1568 -ip 1568
            1⤵
              PID:1684

            Network

                  MITRE ATT&CK Enterprise v16

                  Replay Monitor

                  Loading Replay Monitor...

                  Downloads

                  • C:\ProgramData\Microsoft\Network\Downloader\edbtmp.log

                    Filesize

                    1.3MB

                    MD5

                    f782b09fd215d3d9bb898d61ea2e7a37

                    SHA1

                    a382348e9592bdf93dd10c49773b815a992fa7c7

                    SHA256

                    7bd4646090dff9875e08ea00e5727b11be19fcb850344856e66360c152835694

                    SHA512

                    9342bd7a0cbabd7e699ea545897a6403371a0034e4bea067a9662dad9e492c5fa9b27efa4c850e1c001c79d6a76ffe0dacb6831010e41c8d5e2a92bd5b898606

                  • C:\ProgramData\Package Cache\{3A96B93E-763F-41E7-85C7-1F3CCC37EF27}v48.108.8828\dotnet-host-6.0.27-win-x64.msi

                    Filesize

                    736KB

                    MD5

                    c3c0fe1bf5f38a6c89cead208307b99c

                    SHA1

                    df5d4f184c3124d4749c778084f35a2c00066b0b

                    SHA256

                    f4f6d008e54b5a6bac3998fc3fe8e632c347d6b598813e3524d5489b84bd2eaf

                    SHA512

                    0f3e96d16c512e37025b04ff7989d60126c3d65fe868dbcfbeae4dac910ce04fc52d1089f0e41ce85c2def0182a927fdcc349094e74cdd21b45a42fde7f01806

                  • C:\ProgramData\Package Cache\{662A0088-6FCD-45DD-9EA7-68674058AED5}v14.30.30704\packages\vcRuntimeMinimum_amd64\vc_runtimeMinimum_x64.msi

                    Filesize

                    180KB

                    MD5

                    b2e47100abd58190e40c8b6f9f672a36

                    SHA1

                    a754a78021b16e63d9e606cacc6de4fcf6872628

                    SHA256

                    889217bcb971387bc3cb6d76554646d2b0822eceb102320d40adf2422c829128

                    SHA512

                    d30da8c901e063df5901d011b22a01f884234ddddd44b9e81b3c43d93a51e10342074523339d155d69ff03a03a1df66c7d19e0137a16f47735b5b600616ca2a9

                  • C:\ProgramData\Package Cache\{CE4D7AE0-FCBA-486F-A58F-DBA3626FBE4B}v56.64.8781\dotnet-runtime-7.0.16-win-x64.msi

                    Filesize

                    6.5MB

                    MD5

                    603546474e1924371efcd5c67e489cf7

                    SHA1

                    10a06814e89c9484edde91686d791d62bc7d6341

                    SHA256

                    b6e05f9bafdd59f3c849bc10496acc327ae57739682a1d3b84c6012ca2690705

                    SHA512

                    1aa7d30a0b869b8ad0d79ab58c045df2de026eec49eeb290edaba68f1ff6b11525b17106f8720b90549d54e1e01ce9f7e3ccb29a7c0424db3ea54a0e877873e3

                  • C:\ProgramData\Package Cache\{E634F316-BEB6-4FB3-A612-F7102F576165}v48.108.8836\windowsdesktop-runtime-6.0.27-win-x64.msi.kropun

                    Filesize

                    6.0MB

                    MD5

                    424d9a9bd7e77c6c9af915be4086aa8c

                    SHA1

                    46c1eb9800f316398325feed54f56bd6189dfb29

                    SHA256

                    c3d4ddcc1bcf9bbc91561becb646d178f8971ee9ed06360fad3171c122a47932

                    SHA512

                    df26eb05162e00ee07d0ce755953be7a1e6e6d545c7835be5021c05114b80935d20d66f056f1f24f153e31ddba68be1fa9cdf321ca2744ad3d05c5170b3947b9

                  • C:\ProgramData\_readme.txt

                    Filesize

                    1KB

                    MD5

                    d75064cfaac9c92f52aadf373dc7e463

                    SHA1

                    36ea05181d9b037694929ec81f276f13c7d2655c

                    SHA256

                    163ec5b903b6baadd32d560c44c1ea4dce241579a7493eb32c632eae9085d508

                    SHA512

                    43387299749f31c623c5dd4a53ff4d2eff5edfeb80fd4e2edd45860b5c9367d2767ae2ee9b60824b57301999dd2bd995b7d3bd5e7187e447aed76106272559d1

                  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8B2B9A00839EED1DFDCCC3BFC2F5DF12

                    Filesize

                    1KB

                    MD5

                    4a90329071ae30b759d279cca342b0a6

                    SHA1

                    0ac7c4f3357ce87f37a3a112d6878051c875eda5

                    SHA256

                    fb6a7c3edcd7b97fabc18855102a39fc4d6d3f82c0fdd39b1667807b71b9c49b

                    SHA512

                    f0e206053d4369437c2c0f1f90f0fd03d631e4b9859d807049b41efde823d64cf4d75c28316d932360f7c03bd409e923c8bc2d4f5959361feacecfcf101ae823

                  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B46811C17859FFB409CF0E904A4AA8F8

                    Filesize

                    530B

                    MD5

                    1fbb37f79b317a9a248e7c4ce4f5bac5

                    SHA1

                    0ff4d709ebf17be0c28e66dc8bf74672ca28362a

                    SHA256

                    6fb1b8e593cb0388f67ead35313a230f524657317ea86271b3a97362e5ec6ad9

                    SHA512

                    287e1d62c9ceb660965c266f677c467fbb997c2f5dcd1d63e185e266488aafc3489ac1d3feec81d10f01ce4a72e61a8bc4e124f137ce8675a220aa7797002e74

                  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8B2B9A00839EED1DFDCCC3BFC2F5DF12

                    Filesize

                    174B

                    MD5

                    fc99ee21409ccd03f25e4be3383f13bd

                    SHA1

                    2c4eb4b7fbbbffaa1e9a58bc0c16ca96be7d3bec

                    SHA256

                    7cdd1f2c9ddbed697540a2b1966684790eccd1c4043afbb2327a5acce3575294

                    SHA512

                    0fd5c623a3d54bc61ec1b5cc4489e02db83af1957313a75cf2e75f722eda1d4029c5f82a340f58a6997a6025e52774c1e3e3fd8f06a493b9d3fccb860bf0aad0

                  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B46811C17859FFB409CF0E904A4AA8F8

                    Filesize

                    170B

                    MD5

                    67da9ca9f2effe0218fa768cb1f9a55d

                    SHA1

                    7ebce6aede4ff88cc1c5b6df89f6207e123dfe66

                    SHA256

                    d82cddbb6bdae8012b6b23fe6ec73f3837d208204d0c60e802ed2aac9c054724

                    SHA512

                    9e042548958c34df23dde9f89928ee57ec0f36f0f8a45d92b040a7b03a3732c968590d7256d8db59cb4f39531fe2ad49ac06557e226043c2444513a123c593c1

                  • C:\Users\Admin\AppData\Local\25a14486-eda8-4c34-b4e9-eb31d5e8d9cd\5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe

                    Filesize

                    669KB

                    MD5

                    ead18f3a909685922d7213714ea9a183

                    SHA1

                    1270bd7fd62acc00447b30f066bb23f4745869bf

                    SHA256

                    5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18

                    SHA512

                    6e532d9c3d186e4dac38823ae9152056346e283613f0caf088b21a1b3e5f4f6cf3bad8c407168b1072895a386e3be0b8c11ad1cb326d3d3ff0eb8562052def91

                  • memory/1568-12-0x0000000000400000-0x00000000004A9000-memory.dmp

                    Filesize

                    676KB

                  • memory/1568-18-0x0000000000400000-0x00000000004A9000-memory.dmp

                    Filesize

                    676KB

                  • memory/1568-23-0x0000000000400000-0x00000000004A9000-memory.dmp

                    Filesize

                    676KB

                  • memory/1568-24-0x0000000000400000-0x00000000004A9000-memory.dmp

                    Filesize

                    676KB

                  • memory/1568-25-0x0000000000400000-0x00000000004A9000-memory.dmp

                    Filesize

                    676KB

                  • memory/1568-17-0x0000000000400000-0x00000000004A9000-memory.dmp

                    Filesize

                    676KB

                  • memory/1568-31-0x0000000000400000-0x00000000004A9000-memory.dmp

                    Filesize

                    676KB

                  • memory/2672-27-0x0000000000400000-0x00000000004A9000-memory.dmp

                    Filesize

                    676KB

                  • memory/2672-32-0x0000000000400000-0x00000000004A9000-memory.dmp

                    Filesize

                    676KB

                  • memory/2672-1166-0x0000000000400000-0x00000000004A9000-memory.dmp

                    Filesize

                    676KB

                  • memory/2672-28-0x0000000000400000-0x00000000004A9000-memory.dmp

                    Filesize

                    676KB

                  • memory/2884-36-0x0000000000400000-0x00000000004A9000-memory.dmp

                    Filesize

                    676KB

                  • memory/2884-38-0x0000000000400000-0x00000000004A9000-memory.dmp

                    Filesize

                    676KB

                  • memory/3780-39-0x0000000000400000-0x00000000004A9000-memory.dmp

                    Filesize

                    676KB

                  • memory/3780-34-0x0000000000400000-0x00000000004A9000-memory.dmp

                    Filesize

                    676KB

                  • memory/3780-30-0x0000000000400000-0x00000000004A9000-memory.dmp

                    Filesize

                    676KB

                  • memory/4436-0-0x0000000000400000-0x00000000004A9000-memory.dmp

                    Filesize

                    676KB

                  • memory/4436-14-0x0000000000400000-0x00000000004A9000-memory.dmp

                    Filesize

                    676KB

                  • memory/4436-15-0x0000000000400000-0x0000000000476000-memory.dmp

                    Filesize

                    472KB

                  • memory/4436-3-0x0000000000400000-0x0000000000476000-memory.dmp

                    Filesize

                    472KB

                  • memory/4436-2-0x0000000000730000-0x0000000000830000-memory.dmp

                    Filesize

                    1024KB