a4d9cf67d111b79da9cb4b366400fc3ba1d5f41f71d48ca9c8bb101cb4596327

General

Target

a4d9cf67d111b79da9cb4b366400fc3ba1d5f41f71d48ca9c8bb101cb4596327.exe
Size

3.0MB
MD5

c0d30c047b185328d266078965a68b37
SHA1

989ee095844cd41520e395e7e85aea475e572c1d
SHA256

a4d9cf67d111b79da9cb4b366400fc3ba1d5f41f71d48ca9c8bb101cb4596327
SHA512

7aa4b947fbdc5e04f3a25b1401420cebb776ab51a05bfdc45996bfcd0e979368f1b7143d23fc45e128f102d2e53fcc40ae2971229f67fc0df18a74146655e105

Score

10^/10

ransomware

Malware Config

Extracted

Path

C:\$Recycle.Bin\BENTLEY-HELP.txt

Ransom Note

Two things have happened to your company. ========================================================================================================================== Gigabytes of archived files that we deemed valuable or sensitive were downloaded from your network to a secure location. When you contact us we will tell you how much data was downloaded and can provide extensive proof of the data extraction. You can analyze the type of the data we download on our websites. If you do not contact us we will start leaking the data periodically in parts. ========================================================================================================================== We have also encrypted files on your computers with military grade algorithms. If you don't have extensive backups the only way to retrieve your data is with our software. Restoration of your data with our software requires a private key which only we possess. ========================================================================================================================== To confirm that our decryption software works send 2 encrypted files from random computers to us via email. You will receive further instructions after you send us the test files. We will make sure you retrieve your data swiftly and securely and your data that we downloaded will be securely deleted when our demands are met. If we do not come to an agreement your data will be leaked on this website. Website: http://corpleaks.net TOR link: http://hxt254aygrsziejn.onion Contact us via email: BENTLEY@icloud.com BENTLEY@icloud.com BENTLEY@icloud.com

Emails

BENTLEY@icloud.com

URLs

http://corpleaks.net

http://hxt254aygrsziejn.onion

Signatures

Modifies extensions of user files 8 IoCs

Ransomware generally changes the extension on encrypted files.

ransomware

Processes:

a4d9cf67d111b79da9cb4b366400fc3ba1d5f41f71d48ca9c8bb101cb4596327.exe

description	ioc	process
File renamed	C:\Users\Admin\Pictures\RemoveConvertFrom.raw => C:\Users\Admin\Pictures\RemoveConvertFrom.raw.BENTLEY	a4d9cf67d111b79da9cb4b366400fc3ba1d5f41f71d48ca9c8bb101cb4596327.exe
File renamed	C:\Users\Admin\Pictures\RevokeDeny.crw => C:\Users\Admin\Pictures\RevokeDeny.crw.BENTLEY	a4d9cf67d111b79da9cb4b366400fc3ba1d5f41f71d48ca9c8bb101cb4596327.exe
File renamed	C:\Users\Admin\Pictures\UnblockRestore.tif => C:\Users\Admin\Pictures\UnblockRestore.tif.BENTLEY	a4d9cf67d111b79da9cb4b366400fc3ba1d5f41f71d48ca9c8bb101cb4596327.exe
File renamed	C:\Users\Admin\Pictures\ExpandGroup.tif => C:\Users\Admin\Pictures\ExpandGroup.tif.BENTLEY	a4d9cf67d111b79da9cb4b366400fc3ba1d5f41f71d48ca9c8bb101cb4596327.exe
File opened for modification	C:\Users\Admin\Pictures\MountExport.tiff	a4d9cf67d111b79da9cb4b366400fc3ba1d5f41f71d48ca9c8bb101cb4596327.exe
File renamed	C:\Users\Admin\Pictures\MountExport.tiff => C:\Users\Admin\Pictures\MountExport.tiff.BENTLEY	a4d9cf67d111b79da9cb4b366400fc3ba1d5f41f71d48ca9c8bb101cb4596327.exe
File opened for modification	C:\Users\Admin\Pictures\OutCheckpoint.tiff	a4d9cf67d111b79da9cb4b366400fc3ba1d5f41f71d48ca9c8bb101cb4596327.exe
File renamed	C:\Users\Admin\Pictures\OutCheckpoint.tiff => C:\Users\Admin\Pictures\OutCheckpoint.tiff.BENTLEY	a4d9cf67d111b79da9cb4b366400fc3ba1d5f41f71d48ca9c8bb101cb4596327.exe

Drops desktop.ini file(s) 25 IoCs

Processes:

a4d9cf67d111b79da9cb4b366400fc3ba1d5f41f71d48ca9c8bb101cb4596327.exe

description	ioc	process
File opened for modification	C:\Users\Public\Music\desktop.ini	a4d9cf67d111b79da9cb4b366400fc3ba1d5f41f71d48ca9c8bb101cb4596327.exe
File opened for modification	C:\$Recycle.Bin\S-1-5-21-3686645723-710336880-414668232-1000\desktop.ini	a4d9cf67d111b79da9cb4b366400fc3ba1d5f41f71d48ca9c8bb101cb4596327.exe
File opened for modification	C:\Users\Admin\Documents\desktop.ini	a4d9cf67d111b79da9cb4b366400fc3ba1d5f41f71d48ca9c8bb101cb4596327.exe
File opened for modification	C:\Users\Admin\Searches\desktop.ini	a4d9cf67d111b79da9cb4b366400fc3ba1d5f41f71d48ca9c8bb101cb4596327.exe
File opened for modification	C:\Users\Public\Desktop\desktop.ini	a4d9cf67d111b79da9cb4b366400fc3ba1d5f41f71d48ca9c8bb101cb4596327.exe
File opened for modification	C:\Users\Public\Downloads\desktop.ini	a4d9cf67d111b79da9cb4b366400fc3ba1d5f41f71d48ca9c8bb101cb4596327.exe
File opened for modification	C:\Users\Public\Documents\desktop.ini	a4d9cf67d111b79da9cb4b366400fc3ba1d5f41f71d48ca9c8bb101cb4596327.exe
File opened for modification	C:\Users\Public\Libraries\desktop.ini	a4d9cf67d111b79da9cb4b366400fc3ba1d5f41f71d48ca9c8bb101cb4596327.exe
File opened for modification	C:\Users\Public\desktop.ini	a4d9cf67d111b79da9cb4b366400fc3ba1d5f41f71d48ca9c8bb101cb4596327.exe
File opened for modification	C:\Users\Admin\Contacts\desktop.ini	a4d9cf67d111b79da9cb4b366400fc3ba1d5f41f71d48ca9c8bb101cb4596327.exe
File opened for modification	C:\Users\Admin\Favorites\Links\desktop.ini	a4d9cf67d111b79da9cb4b366400fc3ba1d5f41f71d48ca9c8bb101cb4596327.exe
File opened for modification	C:\Users\Admin\Links\desktop.ini	a4d9cf67d111b79da9cb4b366400fc3ba1d5f41f71d48ca9c8bb101cb4596327.exe
File opened for modification	C:\Users\Admin\Pictures\Camera Roll\desktop.ini	a4d9cf67d111b79da9cb4b366400fc3ba1d5f41f71d48ca9c8bb101cb4596327.exe
File opened for modification	C:\Users\Admin\Pictures\Saved Pictures\desktop.ini	a4d9cf67d111b79da9cb4b366400fc3ba1d5f41f71d48ca9c8bb101cb4596327.exe
File opened for modification	C:\Users\Public\Videos\desktop.ini	a4d9cf67d111b79da9cb4b366400fc3ba1d5f41f71d48ca9c8bb101cb4596327.exe
File opened for modification	C:\Users\Admin\Favorites\desktop.ini	a4d9cf67d111b79da9cb4b366400fc3ba1d5f41f71d48ca9c8bb101cb4596327.exe
File opened for modification	C:\Users\Admin\Music\desktop.ini	a4d9cf67d111b79da9cb4b366400fc3ba1d5f41f71d48ca9c8bb101cb4596327.exe
File opened for modification	C:\Users\Admin\OneDrive\desktop.ini	a4d9cf67d111b79da9cb4b366400fc3ba1d5f41f71d48ca9c8bb101cb4596327.exe
File opened for modification	C:\Users\Admin\Pictures\desktop.ini	a4d9cf67d111b79da9cb4b366400fc3ba1d5f41f71d48ca9c8bb101cb4596327.exe
File opened for modification	C:\Users\Admin\Videos\desktop.ini	a4d9cf67d111b79da9cb4b366400fc3ba1d5f41f71d48ca9c8bb101cb4596327.exe
File opened for modification	C:\Users\Admin\Desktop\desktop.ini	a4d9cf67d111b79da9cb4b366400fc3ba1d5f41f71d48ca9c8bb101cb4596327.exe
File opened for modification	C:\Users\Admin\Downloads\desktop.ini	a4d9cf67d111b79da9cb4b366400fc3ba1d5f41f71d48ca9c8bb101cb4596327.exe
File opened for modification	C:\Users\Admin\Saved Games\desktop.ini	a4d9cf67d111b79da9cb4b366400fc3ba1d5f41f71d48ca9c8bb101cb4596327.exe
File opened for modification	C:\Users\Public\AccountPictures\desktop.ini	a4d9cf67d111b79da9cb4b366400fc3ba1d5f41f71d48ca9c8bb101cb4596327.exe
File opened for modification	C:\Users\Public\Pictures\desktop.ini	a4d9cf67d111b79da9cb4b366400fc3ba1d5f41f71d48ca9c8bb101cb4596327.exe

C:\Users\Admin\AppData\Local\Temp\a4d9cf67d111b79da9cb4b366400fc3ba1d5f41f71d48ca9c8bb101cb4596327.exe
"C:\Users\Admin\AppData\Local\Temp\a4d9cf67d111b79da9cb4b366400fc3ba1d5f41f71d48ca9c8bb101cb4596327.exe"
1⤵
- Modifies extensions of user files
- Drops desktop.ini file(s)
PID:3952

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:1772

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Downloads\BENTLEY-HELP.txt
1⤵
PID:2788

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-3686645723-710336880-414668232-1000\desktop.ini
MD5
58aec795aae1b30bf407f75562e4e15d

SHA1
2946b776fa3b31ca851ee3522330fa45ce919691

SHA256
0a8584d8f135fb8312925a5d81cf8c13d0bb7ee97757ad8f850f6b25e639b855

SHA512
7e5908089714c549c6ec519ff4a476bf3ddc086c72331503ae7715e839fa2fecd7771708b8fc53ab1280e03333c9a7fb62766fb3fd1224424e84edbf8852537e

Download Submit
C:\Users\Admin\Downloads\BENTLEY-HELP.txt
MD5
975197b5358066351c7190ac20d7705f

SHA1
c63433ea71f23e0330754cedf4a1782728d814b2

SHA256
ac0ece8a21551d718b20ee8c9706c1580cd89074002fe38b0b35e037bd9c36fc

SHA512
26f21ba26a22f73d3d59829198dd20c1afb84dd7d1105f6ce57815d42a81a95325da66de6d89fc1ff969aa362badd568cb4fafc7028b7e0ea5db2ee922013926

Download Submit

Analysis

Sharing