Overview

overview

10

Static

static

10

5acebee8f4...1c.exe

windows7_x64

10

5acebee8f4...1c.exe

windows10_x64

10

Analysis

  • max time kernel
    132s
  • max time network
    32s
  • platform
    windows7_x64
  • resource
    win7v20210408
  • submitted
    19-04-2021 11:39

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    5acebee8f450c294dcaad9165a1e3dd27ff027e99cca65564546e6ea2818b91c.exe

  • Size

    70KB

  • MD5

    0a6cc2a5fd2701a3d80cca1438c4950d

  • SHA1

    260f28d8fde4bccee35b4c5a80568ca431e13435

  • SHA256

    5acebee8f450c294dcaad9165a1e3dd27ff027e99cca65564546e6ea2818b91c

  • SHA512

    e70ce320f088aec289b9ae8c5ed539d6f10581544b53a23053746514744f51556c8fcdb193f6c88421b1bc22e5bdfd1270c5048e9fb8da391e5dcc0d2a157152

Score
10/10
persistenceransomwarespywarestealer

Malware Config

Extracted

Path

C:\$Recycle.Bin\S-1-5-21-2455352368-1077083310-2879168483-1000\HOW TO DECRYPT FILES.txt

Ransom Note
your network has been infected due to improper browsing with infected html :( * all data has been locked with a unique key and has become .btCry_zip :( * without the unique key, it is impossible to bring your data to the state of origin :( * with the exclusive key in hand, it takes 20 minutes to unlock your data :) * you can get this key for just a fee. contact us email: btcontact@protonmail.com send id along with email id-67588824752785452767452345237499285 PS: * do not rename or change the extension of the files, as this will corrupt the renamed file : ( * no need to format or reinstall Windows :) * do not post this message on a third party website, as they will block the only contact email :( as proof of trust send me a file of up to 1 mb which i will return to you in its original state :)))) contact us until 04/13/2021
Emails

btcontact@protonmail.com

Signatures

  • Drops file in Drivers directory 3 IoCs
  • Drops startup file 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Drops file in System32 directory 64 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 64 IoCs
  • Program crash 1 IoCs
  • Modifies registry class 10 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\5acebee8f450c294dcaad9165a1e3dd27ff027e99cca65564546e6ea2818b91c.exe
    "C:\Users\Admin\AppData\Local\Temp\5acebee8f450c294dcaad9165a1e3dd27ff027e99cca65564546e6ea2818b91c.exe"
    1⤵
    • Drops file in Drivers directory
    • Drops startup file
    • Adds Run key to start application
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Modifies registry class
    PID:1628
  • C:\Windows\system32\WerFault.exe
    C:\Windows\system32\WerFault.exe -u -p 1244 -s 3140
    1⤵
    • Program crash
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of AdjustPrivilegeToken
    PID:1184

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Credentials in Files

1
T1081

Discovery

Lateral Movement

Collection

Data from Local System

1
T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1184-61-0x000007FEFC031000-0x000007FEFC033000-memory.dmp
    Filesize

    8KB

    Download
  • memory/1184-62-0x0000000000460000-0x0000000000461000-memory.dmp
    Filesize

    4KB

    Download
  • memory/1628-60-0x0000000075551000-0x0000000075553000-memory.dmp
    Filesize

    8KB

    Download