crypt32 | bf536ce5dda81ac7309daddf5116d8fe374656f04e65ca9d02751d0fc88c1228

Analysis

max time kernel
27s
max time network
17s
platform
windows7_x64
resource
win7
submitted
13-09-2020 07:17

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

32Bit.bin.exe

Score

10^/10

ransomware crypt32

Malware Config

Extracted

Path

C:\Users\Admin\Desktop\!! YOUR FILES HAS BEEN ENCRYPTED !!.txt

Family

crypt32

Ransom Note

Your files has been encrypted by ransomware! and You can't decrypt with money. Please install heroes of the storm to decrypt your files. Attention: DO NOT TURN OFF YOUR PC! IF YOU TURNED OFF YOUR PC, YOU WON'T ABLE TO DECRYPT YOUR FILES! Emergency contact: [email protected] Warning - Any attmpt of decryption file will delete your private key. 당신의 파일들은 랜섬웨어에 의해 암호화되었습니다. 그리고 돈을 줘도 풀 수 없습니다. 히어로즈 오브 더 스톰을 설치해서 파일들을 복호화하세요. 경고: PC를 끄지 마세요! PC를 끄면 파일을 복원할 수 없습니다! 긴급 연락 이메일: [email protected] 경고: 복호화를 시도하면 파일들은 절대 다시 풀 수 없습니다.

Emails

[email protected]

Signatures

Crypt32 Ransomware
Javascript Fan-extortionist malware which demands victims install Heroes of the Storm instead of a monetary ransom. Uses Crypto-JS library for encryption.
ransomware crypt32

Executes dropped EXE 1 IoCs

pid	Process
1960	node.exe

Loads dropped DLL 4 IoCs

pid	Process
1124	32Bit.bin.exe
1124	32Bit.bin.exe
1124	32Bit.bin.exe
1124	32Bit.bin.exe

Drops desktop.ini file(s) 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\Desktop\desktop.ini	node.exe

JavaScript code in executable 6 IoCs

resource	yara_rule
behavioral1/files/0x00050000000131a7-2.dat	js
behavioral1/files/0x00050000000131a7-4.dat	js
behavioral1/files/0x00050000000131a7-3.dat	js
behavioral1/files/0x00050000000131a7-5.dat	js
behavioral1/files/0x00050000000131a7-7.dat	js
behavioral1/files/0x00030000000133c4-237.dat	js

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1960	node.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1124 wrote to memory of 1960	1124	32Bit.bin.exe	28
PID 1124 wrote to memory of 1960	1124	32Bit.bin.exe	28
PID 1124 wrote to memory of 1960	1124	32Bit.bin.exe	28
PID 1124 wrote to memory of 1960	1124	32Bit.bin.exe	28

C:\Users\Admin\AppData\Local\Temp\32Bit.bin.exe
"C:\Users\Admin\AppData\Local\Temp\32Bit.bin.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1124
- C:\Users\Admin\AppData\Local\Temp\RarSFX0\node.exe
  "C:\Users\Admin\AppData\Local\Temp\RarSFX0\node.exe" encrypt_ransom
  2⤵
  - Executes dropped EXE
  - Drops desktop.ini file(s)
  - Suspicious behavior: EnumeratesProcesses
  PID:1960

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1960-10-0x0000000003FE0000-0x0000000003FF1000-memory.dmp

Filesize
68KB

Download
memory/1960-8-0x0000000003FE0000-0x0000000003FF1000-memory.dmp

Filesize
68KB

Download
memory/1960-9-0x00000000043F0000-0x0000000004401000-memory.dmp

Filesize
68KB

Download