darkcrypt | 2cc7e6ee6c500f4968b6f989ac295d2de0b3974b5905ec1fc3ab9e8662788379

General

Target

2F8D2E2177EE32CA380C4EDF4F7160D4.bin.exe
Size

27KB
MD5

2f8d2e2177ee32ca380c4edf4f7160d4
SHA1

54682e6579620b6f8406b5122fcca2ff6c7cd80b
SHA256

2cc7e6ee6c500f4968b6f989ac295d2de0b3974b5905ec1fc3ab9e8662788379
SHA512

49dd1f1d1e862166f5ba142ea93f339a46684ff43c7890a24b2700bdde996750c0ee98030469091d78ec4b38552b7ca92e162088c32e912f96b4fac8ca22c139

Score

10^/10

darkcrypt evasion ransomware spyware stealer

Malware Config

Extracted

Path

C:\Users\Admin\AppData\Local\Temp\README.txt

Family

darkcrypt

Ransom Note

[+] All Your Files Have Been Encrypted [+] [-] Do You Really Want To Restore Your Files? [+] Write Us To The E-Mail : [email protected] [+] If you did not get any response until 24 hours later,Write to this E-Mail : [email protected] [-] Write Your Unique-ID In The Title Of Your Message. [+] Unique-ID : 949CEBC7 [-] You Have To Pay For Decryption In Bitcoins. [-] The Price Depends On How Fast You Write To Us. [-] After Payment We Will Send You The Decryption Tool That Will Decrypt All Your Files. _______________________________________________ [+] Free Decryption As Guarantee [+] [-] Before Paying You Can Send Us Up To 5 Files For Free Decryption, The Total Size Of Files Must Bee Less Than 10MB, (Non Archived) And Files Should Not Contain Valuable Information (Databases, Backups, Large Excel -Sheets, Etc). _______________________________________________ [+] How To Obtain Bitcoins [+] [-] The Easiest Way To Buy Bitcoins Is LocalBitcoins Site : https://localbitcoins.com/buy_bitcoins You Have To Register, Click 'Buy Bitcoins', And Select The Seller By Payment Method And Price. [-] Also You Can Find Other Places To Buy Bitcoins And Beginners Guide Here: http://coindesk.com/information/how-can-i-buy-bitcoins _______________________________________________ [+] Attention! [+] [-] Do Not Rename Encrypted Files. [-] Do Not Try To Decrypt Your Data Using Third Party -Software, It May Cause Permanent Data Loss. [-] Decryption Of Your Files With The Help Of Third Parties May Cause Increased Price (They Add Their Fee To Our) Or You Can Become A Victim Of A Scam. _________________DARKCRYPT_Ransomware___________________

Emails

[email protected]

URLs

http://coindesk.com/information/how-can-i-buy-bitcoins

Extracted

Path

C:\Users\Admin\AppData\Local\Temp\WannaScream.hta

Ransom Note

All your files have been encrypted by Wanna Scream! due to a security problem with your PC. If you want to restore them, write us to the e-mail [email protected] Write this ID in the title of your message: 949CEBC7 In case of no answer in 24 hours write us to this e-mail: [email protected] You have to pay for decryption in Bitcoins. The price depends on how fast you write to us. After payment we will send you the tool that will decrypt all your files. Free decryption as guarantee Before paying you can send us up to 5 files for free decryption. The total size of files must be less than 4Mb (non archived), and files should not contain valuable information. (databases,backups, large excel sheets, etc.) How to obtain Bitcoins The easiest way to buy bitcoins is LocalBitcoins site. You have to register, click 'Buy bitcoins', and select the seller by payment method and price. https://localbitcoins.com/buy_bitcoins Also you can find other places to buy Bitcoins and beginners guide here: http://www.coindesk.com/information/how-can-i-buy-bitcoins/ Attention! Do not rename encrypted files. Do not try to decrypt your data using third party software, it may cause permanent data loss. Decryption of your files with the help of third parties may cause increased price (they add their fee to our) or you can become a victim of a scam.

Emails

[email protected]

Signatures

DarkCrypt
Another variant of WannaCry ransomware (Imitation).
ransomware darkcrypt
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware

File Deletion
T1107

Inhibit System Recovery
T1490
Disables Task Manager via registry modification
evasion

Modifies extensions of user files 2 IoCs

Ransomware generally changes the extension on encrypted files.

ransomware

Processes:

2F8D2E2177EE32CA380C4EDF4F7160D4.bin.exe

description	ioc	process
File opened for modification	C:\Users\Admin\Pictures\DismountUnlock.tiff	2F8D2E2177EE32CA380C4EDF4F7160D4.bin.exe
File opened for modification	C:\Users\Admin\Pictures\SubmitResume.tiff	2F8D2E2177EE32CA380C4EDF4F7160D4.bin.exe

Drops startup file 3 IoCs

Processes:

2F8D2E2177EE32CA380C4EDF4F7160D4.bin.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Runtime Broker.exe	2F8D2E2177EE32CA380C4EDF4F7160D4.bin.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Runtime Broker.exe	2F8D2E2177EE32CA380C4EDF4F7160D4.bin.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WannaScream.hta	2F8D2E2177EE32CA380C4EDF4F7160D4.bin.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

1 icanhazip.com
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Interacts with shadow copies 2 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
ransomware

File Deletion
T1107

Inhibit System Recovery
T1490

Processes:

vssadmin.exe

pid process

3396 vssadmin.exe

flow	ioc
1	icanhazip.com

pid	process
3396	vssadmin.exe

Modifies registry class 1 IoCs

Processes:

2F8D2E2177EE32CA380C4EDF4F7160D4.bin.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-1231583446-2617009595-2137880041-1000_Classes\Local Settings	2F8D2E2177EE32CA380C4EDF4F7160D4.bin.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes:

2F8D2E2177EE32CA380C4EDF4F7160D4.bin.exevssvc.exe

description	pid	process
Token: SeDebugPrivilege	4004	2F8D2E2177EE32CA380C4EDF4F7160D4.bin.exe
Token: SeBackupPrivilege	3116	vssvc.exe
Token: SeRestorePrivilege	3116	vssvc.exe
Token: SeAuditPrivilege	3116	vssvc.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

2F8D2E2177EE32CA380C4EDF4F7160D4.bin.execmd.exe

description	pid	process	target process
PID 4004 wrote to memory of 3412	4004	2F8D2E2177EE32CA380C4EDF4F7160D4.bin.exe	cmd.exe
PID 4004 wrote to memory of 3412	4004	2F8D2E2177EE32CA380C4EDF4F7160D4.bin.exe	cmd.exe
PID 3412 wrote to memory of 3396	3412	cmd.exe	vssadmin.exe
PID 3412 wrote to memory of 3396	3412	cmd.exe	vssadmin.exe
PID 4004 wrote to memory of 3064	4004	2F8D2E2177EE32CA380C4EDF4F7160D4.bin.exe	mshta.exe
PID 4004 wrote to memory of 3064	4004	2F8D2E2177EE32CA380C4EDF4F7160D4.bin.exe	mshta.exe
PID 4004 wrote to memory of 3064	4004	2F8D2E2177EE32CA380C4EDF4F7160D4.bin.exe	mshta.exe

C:\Users\Admin\AppData\Local\Temp\2F8D2E2177EE32CA380C4EDF4F7160D4.bin.exe
"C:\Users\Admin\AppData\Local\Temp\2F8D2E2177EE32CA380C4EDF4F7160D4.bin.exe"
1⤵
- Modifies extensions of user files
- Drops startup file
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4004

C:\Windows\SYSTEM32\cmd.exe
"cmd.exe" /c vssadmin.exe delete shadows /all /quiet
2⤵
- Suspicious use of WriteProcessMemory
PID:3412

C:\Windows\system32\vssadmin.exe
vssadmin.exe delete shadows /all /quiet
3⤵
- Interacts with shadow copies
PID:3396

C:\Windows\SysWOW64\mshta.exe
"C:\Windows\SysWOW64\mshta.exe" "C:\Users\Admin\AppData\Local\Temp\WannaScream.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}
2⤵
PID:3064

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3116

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File Deletion

2

T1107

Credential Access

Credentials in Files

1

T1081

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Inhibit System Recovery

2

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\WannaScream.hta

MD5
fb2bf10a3484c6a231aa54cb72371c24

SHA1
610e98bbd86a91e983795c5443f319ccc1dbe361

SHA256
d0479aa5c8179c1ec85fd2f3e438e6535536c87856aac16aa6e1f86de8deb6ce

SHA512
df8974f14c90fffb03750a202c1e64dfaed166bfaaa6041e9c124e794bd2965d22a78da98554d15b4db1296ab6bd81c410ffa3391dd8544aadcb1ec14a902be5

Download Submit
memory/3064-2-0x0000000000000000-mapping.dmp

Download
memory/3396-1-0x0000000000000000-mapping.dmp

Download
memory/3412-0-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads