Overview

overview

10

Static

static

a4d9cf67d1...27.exe

windows7_x64

10

a4d9cf67d1...27.exe

windows10_x64

10

Analysis

  • max time kernel
    136s
  • max time network
    138s
  • platform
    windows7_x64
  • resource
    win7v20210410
  • submitted
    21-04-2021 10:55

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    a4d9cf67d111b79da9cb4b366400fc3ba1d5f41f71d48ca9c8bb101cb4596327.exe

  • Size

    3.0MB

  • MD5

    c0d30c047b185328d266078965a68b37

  • SHA1

    989ee095844cd41520e395e7e85aea475e572c1d

  • SHA256

    a4d9cf67d111b79da9cb4b366400fc3ba1d5f41f71d48ca9c8bb101cb4596327

  • SHA512

    7aa4b947fbdc5e04f3a25b1401420cebb776ab51a05bfdc45996bfcd0e979368f1b7143d23fc45e128f102d2e53fcc40ae2971229f67fc0df18a74146655e105

Score
10/10
ransomware

Malware Config

Extracted

Path

C:\$Recycle.Bin\BENTLEY-HELP.txt

Ransom Note
Two things have happened to your company. ========================================================================================================================== Gigabytes of archived files that we deemed valuable or sensitive were downloaded from your network to a secure location. When you contact us we will tell you how much data was downloaded and can provide extensive proof of the data extraction. You can analyze the type of the data we download on our websites. If you do not contact us we will start leaking the data periodically in parts. ========================================================================================================================== We have also encrypted files on your computers with military grade algorithms. If you don't have extensive backups the only way to retrieve your data is with our software. Restoration of your data with our software requires a private key which only we possess. ========================================================================================================================== To confirm that our decryption software works send 2 encrypted files from random computers to us via email. You will receive further instructions after you send us the test files. We will make sure you retrieve your data swiftly and securely and your data that we downloaded will be securely deleted when our demands are met. If we do not come to an agreement your data will be leaked on this website. Website: http://corpleaks.net TOR link: http://hxt254aygrsziejn.onion Contact us via email: BENTLEY@icloud.com BENTLEY@icloud.com BENTLEY@icloud.com
Emails

BENTLEY@icloud.com

URLs

http://corpleaks.net

http://hxt254aygrsziejn.onion

Signatures

  • Modifies extensions of user files 10 IoCs

    Ransomware generally changes the extension on encrypted files.

    ransomware
  • Drops desktop.ini file(s) 27 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\a4d9cf67d111b79da9cb4b366400fc3ba1d5f41f71d48ca9c8bb101cb4596327.exe
    "C:\Users\Admin\AppData\Local\Temp\a4d9cf67d111b79da9cb4b366400fc3ba1d5f41f71d48ca9c8bb101cb4596327.exe"
    1⤵
    • Modifies extensions of user files
    • Drops desktop.ini file(s)
    PID:1096

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\$Recycle.Bin\S-1-5-21-2513283230-931923277-594887482-1000\desktop.ini
    MD5

    3f39fc9e005301895911ea5033f4d8de

    SHA1

    0c414ded55bc30ed5f0b21f81bbcf7127e99fe2c

    SHA256

    8b75daf5ccafac19d37149164d151b715236c1c0ef5594d1526c40da757da8c3

    SHA512

    3f9f6a9fd00f7b632f0cf661e3146dee489f56981d78b471d60f8784fd2b1088217cecec2bd2b3730465e94d56661188a3b5c3b1c2de492ce753e8ab0cc1d36a

    Download Submit