Overview

overview

10

Static

static

8

6dd4af7019...56.exe

windows7_x64

10

6dd4af7019...56.exe

windows10_x64

10

Analysis

  • max time kernel
    148s
  • max time network
    149s
  • platform
    windows10_x64
  • resource
    win10v20210408
  • submitted
    19-04-2021 11:48

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    6dd4af7019dba1ff08c306fa73d3069c267c4f3d709ef7e8a5d718dbee7b7e56.exe

  • Size

    65KB

  • MD5

    bff66efddf31e2835e50c778f0c338cd

  • SHA1

    0b0e24bd3b6889b10ea6f77f8ffd19b489da4e2f

  • SHA256

    6dd4af7019dba1ff08c306fa73d3069c267c4f3d709ef7e8a5d718dbee7b7e56

  • SHA512

    0c781af46d4a366a3768faa3fa76e69a1532459a1a521d1048e485ef079c03716214c0c13abab1b2b67504ade3fd2316cdaf681f18129f98b82e92d66c32cdec

Score
10/10
persistenceransomwarespywarestealer

Malware Config

Extracted

Path

C:\$Recycle.Bin\S-1-5-21-1594587808-2047097707-2163810515-1000\HOW TO DECRYPT FILES.txt

Ransom Note
your network has been infected due to improper browsing with infected html :( * all data has been locked with a unique key and has become .btCry_zip :( * without the unique key, it is impossible to bring your data to the state of origin :( * with the exclusive key in hand, it takes 20 minutes to unlock your data :) * you can get this key for just a fee. contact us email: [email protected] send id along with email id-67588824752785452767452345237499285 PS: * do not rename or change the extension of the files, as this will corrupt the renamed file : ( * no need to format or reinstall Windows :) * do not post this message on a third party website, as they will block the only contact email :( as proof of trust send me a file of up to 1 mb which i will return to you in its original state :)))) contact us until 04/13/2021

Signatures

  • Drops file in Drivers directory 3 IoCs
  • Modifies Installed Components in the registry 2 TTPs
    persistence
  • Drops startup file 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Drops file in System32 directory 64 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 64 IoCs
  • Program crash 2 IoCs
  • Modifies registry class 10 IoCs
  • Suspicious behavior: EnumeratesProcesses 28 IoCs
  • Suspicious use of AdjustPrivilegeToken 6 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\6dd4af7019dba1ff08c306fa73d3069c267c4f3d709ef7e8a5d718dbee7b7e56.exe
    "C:\Users\Admin\AppData\Local\Temp\6dd4af7019dba1ff08c306fa73d3069c267c4f3d709ef7e8a5d718dbee7b7e56.exe"
    1⤵
    • Drops file in Drivers directory
    • Drops startup file
    • Adds Run key to start application
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Modifies registry class
    PID:1032
  • C:\Windows\system32\WerFault.exe
    C:\Windows\system32\WerFault.exe -u -p 2740 -s 6800
    1⤵
    • Program crash
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:2844
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:3748
    • C:\Windows\system32\WerFault.exe
      C:\Windows\system32\WerFault.exe -u -p 3748 -s 1892
      2⤵
      • Program crash
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:1796

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\ProgramData\Microsoft\Windows\Caches\{6AF0698E-D558-4F6E-9B3C-3716689AF493}.2.ver0x0000000000000001.db.btCry_zip
    MD5

    b49339d686de442f8a300e8c5e1833a8

    SHA1

    24f53b3073b266fdd8adb91e4f79f3025fab98e8

    SHA256

    f3e3db5624988feb2bf625a633c18632abf4dcfd914b7b96bc444a4a40ef0ddf

    SHA512

    b33b6226be96bafe6504f90be9e244b787c6d07d62a2b9465f60bca415929c13891df984dae3f2d6d33cdf138891afe7570917d75feed03173b112696d160021

    Download Submit
  • C:\ProgramData\Microsoft\Windows\Caches\{DDF571F2-BE98-426D-8288-1A9A39C3FDA2}.2.ver0x0000000000000001.db.btCry_zip
    MD5

    a0d1086b50b66907c76ecabd78b4624d

    SHA1

    41d648ca84595e078baf0ae6be813d97a797036b

    SHA256

    8d3e1c3600847d84691c0f00ccda506924feedebb02bac9a2e06d5e422b4b26d

    SHA512

    8ebe71d1742693f477dea70bc2afec6938f836596f7277f40e85a6ebb24d42ce2705958784ea7e95513c81570595cc5a081d22ef8345d5356582a8de0edb5b31

    Download Submit