Analysis

  • max time kernel
    72s
  • max time network
    28s
  • platform
    windows7_x64
  • resource
    win7v20201028
  • submitted
    03-12-2020 14:08

General

  • Target

    319fbb2dd26045a90a452eb26799c6529f8a77ad8d7b967aec58111e25b12cd5.exe

  • Size

    12KB

  • MD5

    0a5e38ff165e9e78e58fd5b47b19b86a

  • SHA1

    d0cccb38776b7390bf8b0fc5ebe14a75b1dfa3ef

  • SHA256

    319fbb2dd26045a90a452eb26799c6529f8a77ad8d7b967aec58111e25b12cd5

  • SHA512

    330c946e02bab30f4f33a6b246c0ad3d83438dddd1572d499aca2af5a1789714b81ba08729c2917ad8b6090ccb2b476d3a88f6bfd537ebd5a2f0e8ff9048ab67

Malware Config

Extracted

Path

C:\$Recycle.Bin\S-1-5-21-293278959-2699126792-324916226-1000\HOW TO DECRYPT FILES.txt

Ransom Note
Attention! All your files are encrypted! To restore your files and access them, please send an SMS with the text [email protected] You have 70 attempts to enter the code. When that number has been exceeded, all the data irreversibly is destroyed. Be careful when you enter the code! Price of private key and decrypt software is $50. Discount 50% available if you contact us first 72 hours, that�s price for you is $25. BTC Wallet: 37t6hwuzJbq6PtEgaxyS3AWyLS99qMGrt8 Bitcoin ee Transfer korte na parle Bkash ee Trasnfer korte parbn tk2500[3days] Contact me here: [email protected]
Wallets

37t6hwuzJbq6PtEgaxyS3AWyLS99qMGrt8

Signatures

  • Drops file in Drivers directory 3 IoCs
  • Modifies extensions of user files 3 IoCs

    Ransomware generally changes the extension on encrypted files.

  • Drops startup file 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Adds Run key to start application 2 TTPs 2 IoCs
  • Drops file in System32 directory 927 IoCs
  • Drops file in Program Files directory 4064 IoCs
  • Drops file in Windows directory 15524 IoCs
  • Modifies registry class 10 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\319fbb2dd26045a90a452eb26799c6529f8a77ad8d7b967aec58111e25b12cd5.exe
    "C:\Users\Admin\AppData\Local\Temp\319fbb2dd26045a90a452eb26799c6529f8a77ad8d7b967aec58111e25b12cd5.exe"
    1⤵
    • Drops file in Drivers directory
    • Modifies extensions of user files
    • Drops startup file
    • Adds Run key to start application
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Modifies registry class
    PID:740

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads