General
-
Target
735e27f460be6edce9f0cd5c0d0972b0
-
Size
173KB
-
Sample
201117-lkvkvvf5tj
-
MD5
2df254dce86ca636e77f4ad422d21da4
-
SHA1
4efa723962bc64e753742f5fdeec4dc1c2985a51
-
SHA256
a1a1e34dbc30a46811f5b717f808908412aa6f3d6840aa526d5c0154e008558e
-
SHA512
9cc70f4525162dfeedba5c3ec421fbf219596077824489cd74d3bc9038c00d96210396312a7426416db1df62d3cad7b71167145aaa1ff8c3623645ffcfa53acd
Static task
static1
Behavioral task
behavioral1
Sample
735e27f460be6edce9f0cd5c0d0972b0.exe
Resource
win7v20201028
Behavioral task
behavioral2
Sample
735e27f460be6edce9f0cd5c0d0972b0.exe
Resource
win10v20201028
Malware Config
Extracted
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\# DECRYPT MY FILES #.txt
http://cerberhhyed5frqa.onion.to/83B4-FED4-14BB-0000-0415
http://cerberhhyed5frqa.onion.cab/83B4-FED4-14BB-0000-0415
http://cerberhhyed5frqa.onion.nu/83B4-FED4-14BB-0000-0415
http://cerberhhyed5frqa.onion.link/83B4-FED4-14BB-0000-0415
http://cerberhhyed5frqa.tor2web.org/83B4-FED4-14BB-0000-0415
http://cerberhhyed5frqa.onion.to/83B4-FED4-14BB-0000-0415);
http://cerberhhyed5frqa.onion/83B4-FED4-14BB-0000-0415
Extracted
C:\Users\Admin\Desktop\# DECRYPT MY FILES #.html
http://cerberhhyed5frqa.onion.to/83B4-FED4-14BB-0000-0415
http://cerberhhyed5frqa.onion.cab/83B4-FED4-14BB-0000-0415
http://cerberhhyed5frqa.onion.nu/83B4-FED4-14BB-0000-0415
http://cerberhhyed5frqa.onion.link/83B4-FED4-14BB-0000-0415
http://cerberhhyed5frqa.tor2web.org/83B4-FED4-14BB-0000-0415
http://cerberhhyed5frqa.onion.to/83B4-FED4-14BB-0000-0415);
http://cerberhhyed5frqa.onion/83B4-FED4-14BB-0000-0415
Extracted
C:\Users\Admin\AppData\Roaming\Microsoft\Office\Recent\# DECRYPT MY FILES #.txt
http://cerberhhyed5frqa.onion.to/EE07-24B3-7A9E-0000-0182
http://cerberhhyed5frqa.onion.cab/EE07-24B3-7A9E-0000-0182
http://cerberhhyed5frqa.onion.nu/EE07-24B3-7A9E-0000-0182
http://cerberhhyed5frqa.onion.link/EE07-24B3-7A9E-0000-0182
http://cerberhhyed5frqa.tor2web.org/EE07-24B3-7A9E-0000-0182
http://cerberhhyed5frqa.onion.to/EE07-24B3-7A9E-0000-0182);
http://cerberhhyed5frqa.onion/EE07-24B3-7A9E-0000-0182
Extracted
C:\Users\Admin\Desktop\# DECRYPT MY FILES #.html
http://cerberhhyed5frqa.onion.to/EE07-24B3-7A9E-0000-0182
http://cerberhhyed5frqa.onion.cab/EE07-24B3-7A9E-0000-0182
http://cerberhhyed5frqa.onion.nu/EE07-24B3-7A9E-0000-0182
http://cerberhhyed5frqa.onion.link/EE07-24B3-7A9E-0000-0182
http://cerberhhyed5frqa.tor2web.org/EE07-24B3-7A9E-0000-0182
http://cerberhhyed5frqa.onion.to/EE07-24B3-7A9E-0000-0182);
http://cerberhhyed5frqa.onion/EE07-24B3-7A9E-0000-0182
Targets
-
-
Target
735e27f460be6edce9f0cd5c0d0972b0
-
Size
173KB
-
MD5
2df254dce86ca636e77f4ad422d21da4
-
SHA1
4efa723962bc64e753742f5fdeec4dc1c2985a51
-
SHA256
a1a1e34dbc30a46811f5b717f808908412aa6f3d6840aa526d5c0154e008558e
-
SHA512
9cc70f4525162dfeedba5c3ec421fbf219596077824489cd74d3bc9038c00d96210396312a7426416db1df62d3cad7b71167145aaa1ff8c3623645ffcfa53acd
-
Adds policy Run key to start application
-
Executes dropped EXE
-
Modifies extensions of user files
Ransomware generally changes the extension on encrypted files.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Deletes itself
-
Drops startup file
-
Loads dropped DLL
-
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Modifies service
-