darkcrypt | 2cc7e6ee6c500f4968b6f989ac295d2de0b3974b5905ec1fc3ab9e8662788379

General

Target

2F8D2E2177EE32CA380C4EDF4F7160D4.bin.exe
Size

27KB
MD5

2f8d2e2177ee32ca380c4edf4f7160d4
SHA1

54682e6579620b6f8406b5122fcca2ff6c7cd80b
SHA256

2cc7e6ee6c500f4968b6f989ac295d2de0b3974b5905ec1fc3ab9e8662788379
SHA512

49dd1f1d1e862166f5ba142ea93f339a46684ff43c7890a24b2700bdde996750c0ee98030469091d78ec4b38552b7ca92e162088c32e912f96b4fac8ca22c139

Score

10^/10

darkcrypt evasion ransomware spyware stealer

Malware Config

Extracted

Path

C:\Users\Admin\AppData\Local\Temp\README.txt

Family

darkcrypt

Ransom Note

[+] All Your Files Have Been Encrypted [+] [-] Do You Really Want To Restore Your Files? [+] Write Us To The E-Mail : [email protected] [+] If you did not get any response until 24 hours later,Write to this E-Mail : [email protected] [-] Write Your Unique-ID In The Title Of Your Message. [+] Unique-ID : F86B013E [-] You Have To Pay For Decryption In Bitcoins. [-] The Price Depends On How Fast You Write To Us. [-] After Payment We Will Send You The Decryption Tool That Will Decrypt All Your Files. _______________________________________________ [+] Free Decryption As Guarantee [+] [-] Before Paying You Can Send Us Up To 5 Files For Free Decryption, The Total Size Of Files Must Bee Less Than 10MB, (Non Archived) And Files Should Not Contain Valuable Information (Databases, Backups, Large Excel -Sheets, Etc). _______________________________________________ [+] How To Obtain Bitcoins [+] [-] The Easiest Way To Buy Bitcoins Is LocalBitcoins Site : https://localbitcoins.com/buy_bitcoins You Have To Register, Click 'Buy Bitcoins', And Select The Seller By Payment Method And Price. [-] Also You Can Find Other Places To Buy Bitcoins And Beginners Guide Here: http://coindesk.com/information/how-can-i-buy-bitcoins _______________________________________________ [+] Attention! [+] [-] Do Not Rename Encrypted Files. [-] Do Not Try To Decrypt Your Data Using Third Party -Software, It May Cause Permanent Data Loss. [-] Decryption Of Your Files With The Help Of Third Parties May Cause Increased Price (They Add Their Fee To Our) Or You Can Become A Victim Of A Scam. _________________DARKCRYPT_Ransomware___________________

Emails

[email protected]

URLs

http://coindesk.com/information/how-can-i-buy-bitcoins

Extracted

Path

C:\Users\Admin\AppData\Local\Temp\WannaScream.hta

Ransom Note

All your files have been encrypted by Wanna Scream! due to a security problem with your PC. If you want to restore them, write us to the e-mail [email protected] Write this ID in the title of your message: F86B013E In case of no answer in 24 hours write us to this e-mail: [email protected] You have to pay for decryption in Bitcoins. The price depends on how fast you write to us. After payment we will send you the tool that will decrypt all your files. Free decryption as guarantee Before paying you can send us up to 5 files for free decryption. The total size of files must be less than 4Mb (non archived), and files should not contain valuable information. (databases,backups, large excel sheets, etc.) How to obtain Bitcoins The easiest way to buy bitcoins is LocalBitcoins site. You have to register, click 'Buy bitcoins', and select the seller by payment method and price. https://localbitcoins.com/buy_bitcoins Also you can find other places to buy Bitcoins and beginners guide here: http://www.coindesk.com/information/how-can-i-buy-bitcoins/ Attention! Do not rename encrypted files. Do not try to decrypt your data using third party software, it may cause permanent data loss. Decryption of your files with the help of third parties may cause increased price (they add their fee to our) or you can become a victim of a scam.

Emails

[email protected]

Signatures

DarkCrypt
Another variant of WannaCry ransomware (Imitation).
ransomware darkcrypt
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware

File Deletion
T1107

Inhibit System Recovery
T1490
Disables Task Manager via registry modification
evasion

Modifies extensions of user files 2 IoCs

Ransomware generally changes the extension on encrypted files.

ransomware

Processes:

2F8D2E2177EE32CA380C4EDF4F7160D4.bin.exe

description	ioc	process
File opened for modification	C:\Users\Admin\Pictures\SendSwitch.tiff	2F8D2E2177EE32CA380C4EDF4F7160D4.bin.exe
File opened for modification	C:\Users\Admin\Pictures\WriteConvert.tiff	2F8D2E2177EE32CA380C4EDF4F7160D4.bin.exe

Drops startup file 3 IoCs

Processes:

2F8D2E2177EE32CA380C4EDF4F7160D4.bin.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WannaScream.hta	2F8D2E2177EE32CA380C4EDF4F7160D4.bin.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Runtime Broker.exe	2F8D2E2177EE32CA380C4EDF4F7160D4.bin.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Runtime Broker.exe	2F8D2E2177EE32CA380C4EDF4F7160D4.bin.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

3 icanhazip.com
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Interacts with shadow copies 2 TTPs 4 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
ransomware

File Deletion
T1107

Inhibit System Recovery
T1490

Processes:

vssadmin.exevssadmin.exevssadmin.exevssadmin.exe

pid process

1664 vssadmin.exe
1072 vssadmin.exe
580 vssadmin.exe
1812 vssadmin.exe

flow	ioc
3	icanhazip.com

pid	process
1664	vssadmin.exe
1072	vssadmin.exe
580	vssadmin.exe
1812	vssadmin.exe

Modifies Internet Explorer settings 1 TTPs 4 IoCs

adware spyware

Modify Registry

T1112

Processes:

mshta.exemshta.exemshta.exemshta.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Internet Explorer\Main	mshta.exe
Key created	\REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Internet Explorer\Main	mshta.exe
Key created	\REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Internet Explorer\Main	mshta.exe
Key created	\REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Internet Explorer\Main	mshta.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes:

2F8D2E2177EE32CA380C4EDF4F7160D4.bin.exevssvc.exe

description	pid	process
Token: SeDebugPrivilege	1088	2F8D2E2177EE32CA380C4EDF4F7160D4.bin.exe
Token: SeBackupPrivilege	1816	vssvc.exe
Token: SeRestorePrivilege	1816	vssvc.exe
Token: SeAuditPrivilege	1816	vssvc.exe

Suspicious use of WriteProcessMemory 40 IoCs

Processes:

2F8D2E2177EE32CA380C4EDF4F7160D4.bin.execmd.execmd.execmd.execmd.exe

description	pid	process	target process
PID 1088 wrote to memory of 1036	1088	2F8D2E2177EE32CA380C4EDF4F7160D4.bin.exe	cmd.exe
PID 1088 wrote to memory of 1036	1088	2F8D2E2177EE32CA380C4EDF4F7160D4.bin.exe	cmd.exe
PID 1088 wrote to memory of 1036	1088	2F8D2E2177EE32CA380C4EDF4F7160D4.bin.exe	cmd.exe
PID 1036 wrote to memory of 1664	1036	cmd.exe	vssadmin.exe
PID 1036 wrote to memory of 1664	1036	cmd.exe	vssadmin.exe
PID 1036 wrote to memory of 1664	1036	cmd.exe	vssadmin.exe
PID 1088 wrote to memory of 1388	1088	2F8D2E2177EE32CA380C4EDF4F7160D4.bin.exe	mshta.exe
PID 1088 wrote to memory of 1388	1088	2F8D2E2177EE32CA380C4EDF4F7160D4.bin.exe	mshta.exe
PID 1088 wrote to memory of 1388	1088	2F8D2E2177EE32CA380C4EDF4F7160D4.bin.exe	mshta.exe
PID 1088 wrote to memory of 1388	1088	2F8D2E2177EE32CA380C4EDF4F7160D4.bin.exe	mshta.exe
PID 1088 wrote to memory of 1956	1088	2F8D2E2177EE32CA380C4EDF4F7160D4.bin.exe	cmd.exe
PID 1088 wrote to memory of 1956	1088	2F8D2E2177EE32CA380C4EDF4F7160D4.bin.exe	cmd.exe
PID 1088 wrote to memory of 1956	1088	2F8D2E2177EE32CA380C4EDF4F7160D4.bin.exe	cmd.exe
PID 1088 wrote to memory of 2004	1088	2F8D2E2177EE32CA380C4EDF4F7160D4.bin.exe	mshta.exe
PID 1088 wrote to memory of 2004	1088	2F8D2E2177EE32CA380C4EDF4F7160D4.bin.exe	mshta.exe
PID 1088 wrote to memory of 2004	1088	2F8D2E2177EE32CA380C4EDF4F7160D4.bin.exe	mshta.exe
PID 1088 wrote to memory of 2004	1088	2F8D2E2177EE32CA380C4EDF4F7160D4.bin.exe	mshta.exe
PID 1956 wrote to memory of 1072	1956	cmd.exe	vssadmin.exe
PID 1956 wrote to memory of 1072	1956	cmd.exe	vssadmin.exe
PID 1956 wrote to memory of 1072	1956	cmd.exe	vssadmin.exe
PID 1088 wrote to memory of 1076	1088	2F8D2E2177EE32CA380C4EDF4F7160D4.bin.exe	cmd.exe
PID 1088 wrote to memory of 1076	1088	2F8D2E2177EE32CA380C4EDF4F7160D4.bin.exe	cmd.exe
PID 1088 wrote to memory of 1076	1088	2F8D2E2177EE32CA380C4EDF4F7160D4.bin.exe	cmd.exe
PID 1088 wrote to memory of 1104	1088	2F8D2E2177EE32CA380C4EDF4F7160D4.bin.exe	mshta.exe
PID 1088 wrote to memory of 1104	1088	2F8D2E2177EE32CA380C4EDF4F7160D4.bin.exe	mshta.exe
PID 1088 wrote to memory of 1104	1088	2F8D2E2177EE32CA380C4EDF4F7160D4.bin.exe	mshta.exe
PID 1088 wrote to memory of 1104	1088	2F8D2E2177EE32CA380C4EDF4F7160D4.bin.exe	mshta.exe
PID 1076 wrote to memory of 580	1076	cmd.exe	vssadmin.exe
PID 1076 wrote to memory of 580	1076	cmd.exe	vssadmin.exe
PID 1076 wrote to memory of 580	1076	cmd.exe	vssadmin.exe
PID 1088 wrote to memory of 204	1088	2F8D2E2177EE32CA380C4EDF4F7160D4.bin.exe	cmd.exe
PID 1088 wrote to memory of 204	1088	2F8D2E2177EE32CA380C4EDF4F7160D4.bin.exe	cmd.exe
PID 1088 wrote to memory of 204	1088	2F8D2E2177EE32CA380C4EDF4F7160D4.bin.exe	cmd.exe
PID 1088 wrote to memory of 236	1088	2F8D2E2177EE32CA380C4EDF4F7160D4.bin.exe	mshta.exe
PID 1088 wrote to memory of 236	1088	2F8D2E2177EE32CA380C4EDF4F7160D4.bin.exe	mshta.exe
PID 1088 wrote to memory of 236	1088	2F8D2E2177EE32CA380C4EDF4F7160D4.bin.exe	mshta.exe
PID 1088 wrote to memory of 236	1088	2F8D2E2177EE32CA380C4EDF4F7160D4.bin.exe	mshta.exe
PID 204 wrote to memory of 1812	204	cmd.exe	vssadmin.exe
PID 204 wrote to memory of 1812	204	cmd.exe	vssadmin.exe
PID 204 wrote to memory of 1812	204	cmd.exe	vssadmin.exe

C:\Users\Admin\AppData\Local\Temp\2F8D2E2177EE32CA380C4EDF4F7160D4.bin.exe
"C:\Users\Admin\AppData\Local\Temp\2F8D2E2177EE32CA380C4EDF4F7160D4.bin.exe"
1⤵
- Modifies extensions of user files
- Drops startup file
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1088
- C:\Windows\system32\cmd.exe
  "cmd.exe" /c vssadmin.exe delete shadows /all /quiet
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1036
- - C:\Windows\system32\vssadmin.exe
    vssadmin.exe delete shadows /all /quiet
    3⤵
    - Interacts with shadow copies
    PID:1664
- C:\Windows\SysWOW64\mshta.exe
  "C:\Windows\SysWOW64\mshta.exe" "C:\Users\Admin\AppData\Local\Temp\WannaScream.hta"
  2⤵
  - Modifies Internet Explorer settings
  PID:1388
- C:\Windows\system32\cmd.exe
  "cmd.exe" /c vssadmin.exe delete shadows /all /quiet
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1956
- - C:\Windows\system32\vssadmin.exe
    vssadmin.exe delete shadows /all /quiet
    3⤵
    - Interacts with shadow copies
    PID:1072
- C:\Windows\SysWOW64\mshta.exe
  "C:\Windows\SysWOW64\mshta.exe" "C:\Users\Admin\AppData\Local\Temp\WannaScream.hta"
  2⤵
  - Modifies Internet Explorer settings
  PID:2004
- C:\Windows\system32\cmd.exe
  "cmd.exe" /c vssadmin.exe delete shadows /all /quiet
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1076
- - C:\Windows\system32\vssadmin.exe
    vssadmin.exe delete shadows /all /quiet
    3⤵
    - Interacts with shadow copies
    PID:580
- C:\Windows\SysWOW64\mshta.exe
  "C:\Windows\SysWOW64\mshta.exe" "C:\Users\Admin\AppData\Local\Temp\WannaScream.hta"
  2⤵
  - Modifies Internet Explorer settings
  PID:1104
- C:\Windows\system32\cmd.exe
  "cmd.exe" /c vssadmin.exe delete shadows /all /quiet
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:204
- - C:\Windows\system32\vssadmin.exe
    vssadmin.exe delete shadows /all /quiet
    3⤵
    - Interacts with shadow copies
    PID:1812
- C:\Windows\SysWOW64\mshta.exe
  "C:\Windows\SysWOW64\mshta.exe" "C:\Users\Admin\AppData\Local\Temp\WannaScream.hta"
  2⤵
  - Modifies Internet Explorer settings
  PID:236

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1816

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File Deletion

Modify Registry

Credential Access

Credentials in Files

1

T1081

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Inhibit System Recovery

2

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\WannaScream.hta

MD5
0d06f34f7eaaddfeaff1096b11fda36e

SHA1
99114e88254f21a171903b4d295dcfea36dcd11d

SHA256
a147f852cbeb5cca576705025955733d8ed52766c02b0ce91ca84e58f70fd80e

SHA512
c98a0e72169ca282a37480f28f485480c7422a37506c91c81b8e94abd4f2120c39b5a2c2cf944d7246c860da4be05b529c8874ba3b053d5c62c14c99862e83ec

Download Submit
C:\Users\Admin\AppData\Local\Temp\WannaScream.hta

MD5
0d06f34f7eaaddfeaff1096b11fda36e

SHA1
99114e88254f21a171903b4d295dcfea36dcd11d

SHA256
a147f852cbeb5cca576705025955733d8ed52766c02b0ce91ca84e58f70fd80e

SHA512
c98a0e72169ca282a37480f28f485480c7422a37506c91c81b8e94abd4f2120c39b5a2c2cf944d7246c860da4be05b529c8874ba3b053d5c62c14c99862e83ec

Download Submit
C:\Users\Admin\AppData\Local\Temp\WannaScream.hta

MD5
0d06f34f7eaaddfeaff1096b11fda36e

SHA1
99114e88254f21a171903b4d295dcfea36dcd11d

SHA256
a147f852cbeb5cca576705025955733d8ed52766c02b0ce91ca84e58f70fd80e

SHA512
c98a0e72169ca282a37480f28f485480c7422a37506c91c81b8e94abd4f2120c39b5a2c2cf944d7246c860da4be05b529c8874ba3b053d5c62c14c99862e83ec

Download Submit
C:\Users\Admin\AppData\Local\Temp\WannaScream.hta

MD5
0d06f34f7eaaddfeaff1096b11fda36e

SHA1
99114e88254f21a171903b4d295dcfea36dcd11d

SHA256
a147f852cbeb5cca576705025955733d8ed52766c02b0ce91ca84e58f70fd80e

SHA512
c98a0e72169ca282a37480f28f485480c7422a37506c91c81b8e94abd4f2120c39b5a2c2cf944d7246c860da4be05b529c8874ba3b053d5c62c14c99862e83ec

Download Submit
memory/204-37-0x0000000000000000-mapping.dmp

Download
memory/236-38-0x0000000000000000-mapping.dmp

Download
memory/580-27-0x0000000000000000-mapping.dmp

Download
memory/1036-0-0x0000000000000000-mapping.dmp

Download
memory/1072-15-0x0000000000000000-mapping.dmp

Download
memory/1076-25-0x0000000000000000-mapping.dmp

Download
memory/1104-26-0x0000000000000000-mapping.dmp

Download
memory/1388-2-0x0000000000000000-mapping.dmp

Download
memory/1664-1-0x0000000000000000-mapping.dmp

Download
memory/1812-39-0x0000000000000000-mapping.dmp

Download
memory/1956-13-0x0000000000000000-mapping.dmp

Download
memory/2004-14-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads