General
-
Target
3a7e74f0ecf5c9b44add16fceb394def8a7789334906a710e476e7f361cd38c2
-
Size
173KB
-
Sample
201112-sk45j4nwy2
-
MD5
8cf406f0f89d84050ddc3f5acc013e4e
-
SHA1
060e505e4283811d629b406cf137432237239bc3
-
SHA256
3a7e74f0ecf5c9b44add16fceb394def8a7789334906a710e476e7f361cd38c2
-
SHA512
7318ab05ec213695e08b9edeb7948f5430ea3509146781edbf41c857d098194185be655dcb2e93a4fc8c9979b41192236200286f8e016a6828bfe5839a8489f0
Static task
static1
Behavioral task
behavioral1
Sample
3a7e74f0ecf5c9b44add16fceb394def8a7789334906a710e476e7f361cd38c2.exe
Resource
win7v20201028
Behavioral task
behavioral2
Sample
3a7e74f0ecf5c9b44add16fceb394def8a7789334906a710e476e7f361cd38c2.exe
Resource
win10v20201028
Malware Config
Extracted
C:\MSOCache\All Users\{90140000-001B-0409-0000-0000000FF1CE}-C\# DECRYPT MY FILES #.txt
http://cerberhhyed5frqa.onion.to/27FF-F720-3B6E-0000-0BEF
http://cerberhhyed5frqa.onion.cab/27FF-F720-3B6E-0000-0BEF
http://cerberhhyed5frqa.onion.nu/27FF-F720-3B6E-0000-0BEF
http://cerberhhyed5frqa.onion.link/27FF-F720-3B6E-0000-0BEF
http://cerberhhyed5frqa.tor2web.org/27FF-F720-3B6E-0000-0BEF
http://cerberhhyed5frqa.onion.to/27FF-F720-3B6E-0000-0BEF);
http://cerberhhyed5frqa.onion/27FF-F720-3B6E-0000-0BEF
Extracted
C:\Users\Admin\Desktop\# DECRYPT MY FILES #.html
http://cerberhhyed5frqa.onion.to/27FF-F720-3B6E-0000-0BEF
http://cerberhhyed5frqa.onion.cab/27FF-F720-3B6E-0000-0BEF
http://cerberhhyed5frqa.onion.nu/27FF-F720-3B6E-0000-0BEF
http://cerberhhyed5frqa.onion.link/27FF-F720-3B6E-0000-0BEF
http://cerberhhyed5frqa.tor2web.org/27FF-F720-3B6E-0000-0BEF
http://cerberhhyed5frqa.onion.to/27FF-F720-3B6E-0000-0BEF);
http://cerberhhyed5frqa.onion/27FF-F720-3B6E-0000-0BEF
Extracted
C:\Users\Admin\AppData\Roaming\Microsoft\Office\Recent\# DECRYPT MY FILES #.txt
http://cerberhhyed5frqa.onion.to/7801-3D47-6A9D-0000-0919
http://cerberhhyed5frqa.onion.cab/7801-3D47-6A9D-0000-0919
http://cerberhhyed5frqa.onion.nu/7801-3D47-6A9D-0000-0919
http://cerberhhyed5frqa.onion.link/7801-3D47-6A9D-0000-0919
http://cerberhhyed5frqa.tor2web.org/7801-3D47-6A9D-0000-0919
http://cerberhhyed5frqa.onion.to/7801-3D47-6A9D-0000-0919);
http://cerberhhyed5frqa.onion/7801-3D47-6A9D-0000-0919
Extracted
C:\Users\Admin\Desktop\# DECRYPT MY FILES #.html
http://cerberhhyed5frqa.onion.to/7801-3D47-6A9D-0000-0919
http://cerberhhyed5frqa.onion.cab/7801-3D47-6A9D-0000-0919
http://cerberhhyed5frqa.onion.nu/7801-3D47-6A9D-0000-0919
http://cerberhhyed5frqa.onion.link/7801-3D47-6A9D-0000-0919
http://cerberhhyed5frqa.tor2web.org/7801-3D47-6A9D-0000-0919
http://cerberhhyed5frqa.onion.to/7801-3D47-6A9D-0000-0919);
http://cerberhhyed5frqa.onion/7801-3D47-6A9D-0000-0919
Targets
-
-
Target
3a7e74f0ecf5c9b44add16fceb394def8a7789334906a710e476e7f361cd38c2
-
Size
173KB
-
MD5
8cf406f0f89d84050ddc3f5acc013e4e
-
SHA1
060e505e4283811d629b406cf137432237239bc3
-
SHA256
3a7e74f0ecf5c9b44add16fceb394def8a7789334906a710e476e7f361cd38c2
-
SHA512
7318ab05ec213695e08b9edeb7948f5430ea3509146781edbf41c857d098194185be655dcb2e93a4fc8c9979b41192236200286f8e016a6828bfe5839a8489f0
-
Adds policy Run key to start application
-
Executes dropped EXE
-
Modifies extensions of user files
Ransomware generally changes the extension on encrypted files.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Deletes itself
-
Drops startup file
-
Loads dropped DLL
-
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Modifies service
-