Overview

overview

10

Static

static

56b483bc7b...9c.exe

windows7_x64

10

56b483bc7b...9c.exe

windows10_x64

10

Analysis

  • max time kernel
    142s
  • max time network
    68s
  • platform
    windows7_x64
  • resource
    win7
  • submitted
    21/06/2020, 03:53

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    56b483bc7bf3708d49c6d326dc36e3b350aa431028ea05e7f1e7fd63177fb19c.exe

  • Size

    206KB

  • MD5

    7df850b43f3f28a67b8160c4265bc726

  • SHA1

    522377eced5e1694d36e45da75037d87e84b3729

  • SHA256

    56b483bc7bf3708d49c6d326dc36e3b350aa431028ea05e7f1e7fd63177fb19c

  • SHA512

    c6bb2271a794da8a7b5ac6f7e634f1d4173dbaa54fbc778dd29651fc99a5096b974f3bdd0c28775392760f8253bdb55ff7303a33915525ccd0d6a4f52d526225

Score
10/10
ransomware

Malware Config

Extracted

Path

\??\c:\GOMER-README.txt

Ransom Note
! ATTENTION ! -------------------------------------------------------------------------------------------- ! STRICTLY FORBIDDEN TO USE THIRD-PARTY DECRYPTION SOFTWARE - FILES WILL BE LOST ! -------------------------------------------------------------------------------------------- Due vulnerability in your system all files have been protected with strong private key to safe them from unathorized access. To RESTORE your files, follow this instructions: 1. Gomer service charges a payment for file decryption tool 2. Contact us with attached Gomer-readme.txt 3. Receive Gomer file decryption tool 4. Run the tool and successfully RESTORE all your files! We guarantee: 100% Successful restoring all of your files 100% Satisfaction guarantee 100% Fast and secure service As a proof of our trusted service, you can send us 1 file and get it decrypted for free! -------------------------------------------------------------------------------------------- ! ONLY ORIGINAL GOMER DECRYPTION TOOL CAN RESTORE YOUR FILES ! -------------------------------------------------------------------------------------------- Contacts: [email protected] Payments accepted: Bitcoin (BTC) ID KEY: gMWCXd52gagzYTakkupc2dqCy0xNvLiodz+1yw8fJ714F8MXpsFOM/mp6oqJJjLs 3bdTk/VPXtQ0vRVZtvF9w9a+zdn0UdgS3Axw18epdH0qaNxNmTh9BxOLts02C08b 1qWCyoq09LluA2HJi4Y8UPWDM2Rj4iCRVHWqHoM8HEQ= ~ GOMER ~ fZMyUwYEw1gbCXY2/a/Mzg==

Signatures

  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Modifies registry class 3 IoCs
  • Opens file in notepad (likely ransom note) 1 IoCs
    ransomware
  • Suspicious use of WriteProcessMemory 15 IoCs
  • Suspicious behavior: EnumeratesProcesses 5 IoCs
  • Deletes itself 1 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Runs ping.exe 1 TTPs 1 IoCs
  • Drops file in Program Files directory 7697 IoCs
  • Drops desktop.ini file(s) 21 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\56b483bc7bf3708d49c6d326dc36e3b350aa431028ea05e7f1e7fd63177fb19c.exe
    "C:\Users\Admin\AppData\Local\Temp\56b483bc7bf3708d49c6d326dc36e3b350aa431028ea05e7f1e7fd63177fb19c.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    • Suspicious behavior: EnumeratesProcesses
    • Drops file in Program Files directory
    • Drops desktop.ini file(s)
    PID:1496
    • C:\Windows\SysWOW64\cmd.exe
      cmd.exe /C rd /q /s "%systemdrive%\$Recycle.bin"
      2⤵
        PID:1820
      • C:\Windows\SysWOW64\cmd.exe
        cmd.exe /C ping 1.1.1.1 -n 1 -w 3000 > Nul & Del /f /q "C:\Users\Admin\AppData\Local\Temp\56b483bc7bf3708d49c6d326dc36e3b350aa431028ea05e7f1e7fd63177fb19c.exe"
        2⤵
        • Suspicious use of WriteProcessMemory
        • Deletes itself
        PID:1964
        • C:\Windows\SysWOW64\PING.EXE
          ping 1.1.1.1 -n 1 -w 3000
          3⤵
          • Runs ping.exe
          PID:1988
    • C:\Windows\system32\NOTEPAD.EXE
      "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\GOMER-README.txt
      1⤵
      • Suspicious use of FindShellTrayWindow
      PID:2028
    • C:\Windows\explorer.exe
      "C:\Windows\explorer.exe"
      1⤵
        PID:1608
      • C:\Windows\system32\rundll32.exe
        "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\Documents\Files.docx.gomer
        1⤵
        • Modifies registry class
        PID:1860
      • C:\Windows\system32\rundll32.exe
        "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\Documents\RestoreUnprotect.txt.gomer
        1⤵
        • Modifies registry class
        • Suspicious use of WriteProcessMemory
        • Suspicious behavior: GetForegroundWindowSpam
        PID:1976
        • C:\Windows\system32\NOTEPAD.EXE
          "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Documents\RestoreUnprotect.txt.gomer
          2⤵
          • Opens file in notepad (likely ransom note)
          PID:1604

      Network

      MITRE ATT&CK Enterprise v6

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • memory/1496-6-0x0000000003720000-0x0000000003731000-memory.dmp

        Filesize

        68KB

        Download

      • memory/1496-4-0x0000000003720000-0x0000000003731000-memory.dmp

        Filesize

        68KB

        Download

      • memory/1496-3-0x0000000003310000-0x0000000003321000-memory.dmp

        Filesize

        68KB

        Download

      • memory/1496-5-0x0000000003310000-0x0000000003321000-memory.dmp

        Filesize

        68KB

        Download

      • memory/1496-7-0x0000000003310000-0x0000000003321000-memory.dmp

        Filesize

        68KB

        Download

      • memory/1496-8-0x0000000003720000-0x0000000003731000-memory.dmp

        Filesize

        68KB

        Download

      • memory/1496-10-0x0000000003720000-0x0000000003731000-memory.dmp

        Filesize

        68KB

        Download

      • memory/1496-1-0x0000000003010000-0x0000000003021000-memory.dmp

        Filesize

        68KB

        Download

      • memory/1496-2-0x0000000003420000-0x0000000003431000-memory.dmp

        Filesize

        68KB

        Download