4cb3cc8e7d2d712c43268d8a56e20dee3a1f40d580237115992307a5037b991e

General

Target

1ee39f6cd500940ad97c444778dc717361e01ce5579a28d761aedae86e85af64.exe
Size

5.7MB
MD5

e3204b2e61223989b1562f5dee40eee0
SHA1

7bd50a3b0e3f9b4a543f750869ca3ee29b4798e1
SHA256

1ee39f6cd500940ad97c444778dc717361e01ce5579a28d761aedae86e85af64
SHA512

19df0eb4c803e6eeb41abb1fb425f4d9cd6e4262aaeb8bbf7eb959a30f3db2533fd6aed13e055a9781371e9de37de4212d80a32862798368e5dd798763012bc4

Score

10^/10

ransomware

Malware Config

Extracted

Path

C:\Documents and Settings\read_me.txt

Ransom Note

--= DEATHRANSOM =--- ***********************UNDER NO CIRCUMSTANCES DO NOT DELETE THIS FILE, UNTIL ALL YOUR DATA IS RECOVERED*********************** *****FAILING TO DO SO, WILL RESULT IN YOUR SYSTEM CORRUPTION, IF THERE ARE DECRYPTION ERRORS***** All your files, documents, photos, databases and other important files are encrypted. You are not able to decrypt it by yourself! The only method of recovering files is to purchase an unique private key. Only we can give you this key and only we can recover your files. To be sure we have the decryptor and it works you can send an email [email protected] and decrypt one file for free. But this file should be of not valuable! Do you really want to restore your files? Write to email [email protected] [email protected] Your LOCK-ID: iB1hSZQnvagnWmsaX7Grx3a16wu/xQDfkBnqBKah6R8I6ufSG93soTQjqYWgNE2MvM++630fIMA0tpxdKS1sXPQzjNR6OWAGu8cb8ian4vAPo8XP+wtJhsq6HtFfAy/svDQv4vP7t26nC6chsl+LwDR+YWVSX4RlaEq3YYM8HWhyXPRwcf32R9u4mdgFOLZu2PFo3iLqd9m2/4ZFCQfbmDpidHEABld8Pm7hYpn6xf4R4AEeCnvEvigHZl/YAERgWRB5pXSlUFPsAdjR+r6PUDH/jiI1JHJ3SZXydgiPcg4hN/p1Muz25/T3hpDv3bPop9aKfsEzse5tUf3lRDZoB9nzUnTwLfRcfsua+/ICQ2a8g3sHRkKeSpyS9AW1OL8lETt5VsXo5jw8Dg8p4Y3VlPQ8o7KtmnIdnFfa8LNdmqwZgnBM/k3psm0n3zrao52/7AYgMbih9OlGlCgRa31CN7TdyZkHUOlB6zhle214/K3+Z/OHmATrQub5Smy0vWJi23nntwc38OnjWb4xKRUB/3Xx29BLQueRR6mT/yVIJKcN47ZPbVpaSo3caMI9r9vj2nEShPEahppR7wQPrAAlHrggMbUXc69xgovAy9wl+aYaiSfWC1YxP9sz00YAj+gZE4Mk17+x8viyVeg+yYYBXdzRmkfDc+EKVYjja4v39kaT3s/UEZ070GU/PonJgqRx8WhSTJvar5of76RUVPNu3Q== >>>How to obtain bitcoin: The easiest way to buy bitcoins is LocalBitcoins site. You have to register, click 'Buy bitcoins', and select the seller by payment method and price. https://localbitcoins.com/buy_bitcoins Also you can find other places to buy Bitcoins and beginners guide here: http://www.coindesk.com/information/how-can-i-buy-bitcoins/ >>> Free decryption as guarantee! Before paying you send us up to 1 file for free decryption. We recommeded to send pictures, text files, sheets, etc. (files no more than 1mb) IN ORDER TO PREVENT DATA DAMAGE: 1. Do not rename encrypted files. 2. Do not try to decrypt your data using third party software, it may cause permanent data loss. 3. Decryption of your files with the help of third parties may cause increased price (they add their fee to our) or you can become a victim of a scam.

Emails

[email protected]

Signatures

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
1152	1ee39f6cd500940ad97c444778dc717361e01ce5579a28d761aedae86e85af64.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1152	1ee39f6cd500940ad97c444778dc717361e01ce5579a28d761aedae86e85af64.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1784	1152	WerFault.exe	23

Modifies extensions of user files 6 IoCs

Ransomware generally changes the extension on encrypted files.

ransomware

description	ioc	Process
File renamed	C:\Users\Admin\Pictures\InstallDisable.raw => C:\Users\Admin\Pictures\InstallDisable.raw.wctc	1ee39f6cd500940ad97c444778dc717361e01ce5579a28d761aedae86e85af64.exe
File renamed	C:\Users\Admin\Pictures\RevokeSubmit.crw => C:\Users\Admin\Pictures\RevokeSubmit.crw.wctc	1ee39f6cd500940ad97c444778dc717361e01ce5579a28d761aedae86e85af64.exe
File renamed	C:\Users\Admin\Pictures\SkipRemove.png => C:\Users\Admin\Pictures\SkipRemove.png.wctc	1ee39f6cd500940ad97c444778dc717361e01ce5579a28d761aedae86e85af64.exe
File opened for modification	C:\Users\Admin\Pictures\UnprotectSwitch.tiff	1ee39f6cd500940ad97c444778dc717361e01ce5579a28d761aedae86e85af64.exe
File renamed	C:\Users\Admin\Pictures\UnprotectSwitch.tiff => C:\Users\Admin\Pictures\UnprotectSwitch.tiff.wctc	1ee39f6cd500940ad97c444778dc717361e01ce5579a28d761aedae86e85af64.exe
File renamed	C:\Users\Admin\Pictures\ConvertFromStop.raw => C:\Users\Admin\Pictures\ConvertFromStop.raw.wctc	1ee39f6cd500940ad97c444778dc717361e01ce5579a28d761aedae86e85af64.exe

Drops desktop.ini file(s) 12 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Contacts\desktop.ini	1ee39f6cd500940ad97c444778dc717361e01ce5579a28d761aedae86e85af64.exe
File opened for modification	C:\Users\Admin\Desktop\desktop.ini	1ee39f6cd500940ad97c444778dc717361e01ce5579a28d761aedae86e85af64.exe
File opened for modification	C:\Users\Admin\Favorites\desktop.ini	1ee39f6cd500940ad97c444778dc717361e01ce5579a28d761aedae86e85af64.exe
File opened for modification	C:\Users\Admin\Favorites\Links for United States\desktop.ini	1ee39f6cd500940ad97c444778dc717361e01ce5579a28d761aedae86e85af64.exe
File opened for modification	C:\Users\Admin\Links\desktop.ini	1ee39f6cd500940ad97c444778dc717361e01ce5579a28d761aedae86e85af64.exe
File opened for modification	C:\Users\Admin\Pictures\desktop.ini	1ee39f6cd500940ad97c444778dc717361e01ce5579a28d761aedae86e85af64.exe
File opened for modification	C:\Users\Admin\Documents\desktop.ini	1ee39f6cd500940ad97c444778dc717361e01ce5579a28d761aedae86e85af64.exe
File opened for modification	C:\Users\Admin\Downloads\desktop.ini	1ee39f6cd500940ad97c444778dc717361e01ce5579a28d761aedae86e85af64.exe
File opened for modification	C:\Users\Admin\Favorites\Links\desktop.ini	1ee39f6cd500940ad97c444778dc717361e01ce5579a28d761aedae86e85af64.exe
File opened for modification	C:\Users\Admin\Music\desktop.ini	1ee39f6cd500940ad97c444778dc717361e01ce5579a28d761aedae86e85af64.exe
File opened for modification	C:\Users\Admin\Saved Games\desktop.ini	1ee39f6cd500940ad97c444778dc717361e01ce5579a28d761aedae86e85af64.exe
File opened for modification	C:\Users\Admin\Searches\desktop.ini	1ee39f6cd500940ad97c444778dc717361e01ce5579a28d761aedae86e85af64.exe

C:\Users\Admin\AppData\Local\Temp\1ee39f6cd500940ad97c444778dc717361e01ce5579a28d761aedae86e85af64.exe
"C:\Users\Admin\AppData\Local\Temp\1ee39f6cd500940ad97c444778dc717361e01ce5579a28d761aedae86e85af64.exe"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Modifies extensions of user files
- Drops desktop.ini file(s)
PID:1152
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1152 -s 764
  2⤵
  - Program crash
  PID:1784

Windows 7 deprecation

Loading Replay Monitor...

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads