darkcrypt | 2cc7e6ee6c500f4968b6f989ac295d2de0b3974b5905ec1fc3ab9e8662788379

General

Target
2F8D2E2177EE32CA380C4EDF4F7160D4.bin.exe
Size 27KB
Sample200701-p8b29476wn
SHA256 2cc7e6ee6c500f4968b6f989ac295d2de0b3974b5905ec1fc3ab9e8662788379
MD5 2f8d2e2177ee32ca380c4edf4f7160d4
SHA1 54682e6579620b6f8406b5122fcca2ff6c7cd80b
SHA512 49dd1f1d1e862166f5ba142ea93f339a46684ff43c7890a24b2700bdde996750c0ee98030469091d78ec4b38552b7ca92e162088c32e912f96b4fac8ca22c139
MD5 SHA1 SHA512

Score

10^/10

darkcrypt evasion ransomware spyware stealer

Malware Config

Extracted

Path

C:\Users\Admin\AppData\Local\Temp\README.txt

darkcrypt

Ransom Note

[+] All Your Files Have Been Encrypted [+] [-] Do You Really Want To Restore Your Files? [+] Write Us To The E-Mail : [email protected] [+] If you did not get any response until 24 hours later,Write to this E-Mail : [email protected] [-] Write Your Unique-ID In The Title Of Your Message. [+] Unique-ID : 949CEBC7 [-] You Have To Pay For Decryption In Bitcoins. [-] The Price Depends On How Fast You Write To Us. [-] After Payment We Will Send You The Decryption Tool That Will Decrypt All Your Files. _______________________________________________ [+] Free Decryption As Guarantee [+] [-] Before Paying You Can Send Us Up To 5 Files For Free Decryption, The Total Size Of Files Must Bee Less Than 10MB, (Non Archived) And Files Should Not Contain Valuable Information (Databases, Backups, Large Excel -Sheets, Etc). _______________________________________________ [+] How To Obtain Bitcoins [+] [-] The Easiest Way To Buy Bitcoins Is LocalBitcoins Site : https://localbitcoins.com/buy_bitcoins You Have To Register, Click 'Buy Bitcoins', And Select The Seller By Payment Method And Price. [-] Also You Can Find Other Places To Buy Bitcoins And Beginners Guide Here: http://coindesk.com/information/how-can-i-buy-bitcoins _______________________________________________ [+] Attention! [+] [-] Do Not Rename Encrypted Files. [-] Do Not Try To Decrypt Your Data Using Third Party -Software, It May Cause Permanent Data Loss. [-] Decryption Of Your Files With The Help Of Third Parties May Cause Increased Price (They Add Their Fee To Our) Or You Can Become A Victim Of A Scam. _________________DARKCRYPT_Ransomware___________________

Emails

URLs

http://coindesk.com/information/how-can-i-buy-bitcoins

Extracted

Path

C:\Users\Admin\AppData\Local\Temp\WannaScream.hta

Ransom Note

All your files have been encrypted by Wanna Scream! due to a security problem with your PC. If you want to restore them, write us to the e-mail [email protected] Write this ID in the title of your message: 949CEBC7 In case of no answer in 24 hours write us to this e-mail: [email protected] You have to pay for decryption in Bitcoins. The price depends on how fast you write to us. After payment we will send you the tool that will decrypt all your files. Free decryption as guarantee Before paying you can send us up to 5 files for free decryption. The total size of files must be less than 4Mb (non archived), and files should not contain valuable information. (databases,backups, large excel sheets, etc.) How to obtain Bitcoins The easiest way to buy bitcoins is LocalBitcoins site. You have to register, click 'Buy bitcoins', and select the seller by payment method and price. https://localbitcoins.com/buy_bitcoins Also you can find other places to buy Bitcoins and beginners guide here: http://www.coindesk.com/information/how-can-i-buy-bitcoins/ Attention! Do not rename encrypted files. Do not try to decrypt your data using third party software, it may cause permanent data loss. Decryption of your files with the help of third parties may cause increased price (they add their fee to our) or you can become a victim of a scam.

Emails

Signatures

DarkCrypt
Another variant of WannaCry ransomware (Imitation).
ransomware darkcrypt
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware

File Deletion
T1107

Inhibit System Recovery
T1490
Disables Task Manager via registry modification
evasion

Modifies extensions of user files 2 IoCs

Ransomware generally changes the extension on encrypted files.

ransomware

description	ioc	Process
File opened for modification	C:\Users\Admin\Pictures\DismountUnlock.tiff	2F8D2E2177EE32CA380C4EDF4F7160D4.bin.exe
File opened for modification	C:\Users\Admin\Pictures\SubmitResume.tiff	2F8D2E2177EE32CA380C4EDF4F7160D4.bin.exe

Drops startup file 3 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Runtime Broker.exe	2F8D2E2177EE32CA380C4EDF4F7160D4.bin.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Runtime Broker.exe	2F8D2E2177EE32CA380C4EDF4F7160D4.bin.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WannaScream.hta	2F8D2E2177EE32CA380C4EDF4F7160D4.bin.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
1	icanhazip.com

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Interacts with shadow copies 2 TTPs 1 IoCs

Shadow copies are often targeted by ransomware to inhibit system recovery.

ransomware

File Deletion

T1107

Inhibit System Recovery

T1490

pid	Process
3396	vssadmin.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1231583446-2617009595-2137880041-1000_Classes\Local Settings	2F8D2E2177EE32CA380C4EDF4F7160D4.bin.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	4004	2F8D2E2177EE32CA380C4EDF4F7160D4.bin.exe
Token: SeBackupPrivilege	3116	vssvc.exe
Token: SeRestorePrivilege	3116	vssvc.exe
Token: SeAuditPrivilege	3116	vssvc.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 4004 wrote to memory of 3412	4004	2F8D2E2177EE32CA380C4EDF4F7160D4.bin.exe	75
PID 4004 wrote to memory of 3412	4004	2F8D2E2177EE32CA380C4EDF4F7160D4.bin.exe	75
PID 3412 wrote to memory of 3396	3412	cmd.exe	77
PID 3412 wrote to memory of 3396	3412	cmd.exe	77
PID 4004 wrote to memory of 3064	4004	2F8D2E2177EE32CA380C4EDF4F7160D4.bin.exe	79
PID 4004 wrote to memory of 3064	4004	2F8D2E2177EE32CA380C4EDF4F7160D4.bin.exe	79
PID 4004 wrote to memory of 3064	4004	2F8D2E2177EE32CA380C4EDF4F7160D4.bin.exe	79

C:\Users\Admin\AppData\Local\Temp\2F8D2E2177EE32CA380C4EDF4F7160D4.bin.exe
"C:\Users\Admin\AppData\Local\Temp\2F8D2E2177EE32CA380C4EDF4F7160D4.bin.exe"
1⤵
- Modifies extensions of user files
- Drops startup file
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4004
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /c vssadmin.exe delete shadows /all /quiet
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3412
- - C:\Windows\system32\vssadmin.exe
    vssadmin.exe delete shadows /all /quiet
    3⤵
    - Interacts with shadow copies
    PID:3396
- C:\Windows\SysWOW64\mshta.exe
  "C:\Windows\SysWOW64\mshta.exe" "C:\Users\Admin\AppData\Local\Temp\WannaScream.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}
  2⤵
  PID:3064