General
-
Target
35195406382becaa3866e042e17dc62dcf956b43ca05e8022565c4591f0da98b.exe
-
Size
436KB
-
Sample
210705-tnwfmnjnbe
-
MD5
8723362009a3762ce6e882fb99b107db
-
SHA1
33669b86b841b69570246eafcf8b823f893d6763
-
SHA256
35195406382becaa3866e042e17dc62dcf956b43ca05e8022565c4591f0da98b
-
SHA512
55ae8195467ab77b27989c6fc677526cc5e2807565765a278e1311e9c805f35e7a316c20915ce8908f3933ae51df66892c10cf80ea11d1518e79488aaea6a2d6
Static task
static1
Behavioral task
behavioral1
Sample
35195406382becaa3866e042e17dc62dcf956b43ca05e8022565c4591f0da98b.exe
Resource
win7v20210410
Behavioral task
behavioral2
Sample
35195406382becaa3866e042e17dc62dcf956b43ca05e8022565c4591f0da98b.exe
Resource
win10v20210410
Malware Config
Extracted
\??\c:\_R_E_A_D___T_H_I_S___GU86_.txt
cerber
http://xpcx6erilkjced3j.onion/1A12-7D32-549E-0098-BAEC
http://xpcx6erilkjced3j.1n5mod.top/1A12-7D32-549E-0098-BAEC
http://xpcx6erilkjced3j.19kdeh.top/1A12-7D32-549E-0098-BAEC
http://xpcx6erilkjced3j.1mpsnr.top/1A12-7D32-549E-0098-BAEC
http://xpcx6erilkjced3j.18ey8e.top/1A12-7D32-549E-0098-BAEC
http://xpcx6erilkjced3j.17gcun.top/1A12-7D32-549E-0098-BAEC
Extracted
C:\Users\Admin\Desktop\_R_E_A_D___T_H_I_S___7ZXIDJ_.hta
http://xpcx6erilkjced3j.1n5mod.top/1A12-7D32-549E-0098-BAEChttp://xpcx6erilkjced3j.19kdeh.top/1A12-7D32-549E-0098-BAEChttp://xpcx6erilkjced3j.1mpsnr.top/1A12-7D32-549E-0098-BAEChttp://xpcx6erilkjced3j.18ey8e.top/1A12-7D32-549E-0098-BAEChttp://xpcx6erilkjced3j.17gcun.top/1A12-7D32-549E-0098-BAEC
http://xpcx6erilkjced3j.onion/1A12-7D32-549E-0098-BAEC
https://www.baidu.com
Extracted
\??\c:\_R_E_A_D___T_H_I_S___Z565O_.txt
cerber
http://xpcx6erilkjced3j.onion/3F04-FE10-CC9E-0098-BBBA
http://xpcx6erilkjced3j.1n5mod.top/3F04-FE10-CC9E-0098-BBBA
http://xpcx6erilkjced3j.19kdeh.top/3F04-FE10-CC9E-0098-BBBA
http://xpcx6erilkjced3j.1mpsnr.top/3F04-FE10-CC9E-0098-BBBA
http://xpcx6erilkjced3j.18ey8e.top/3F04-FE10-CC9E-0098-BBBA
http://xpcx6erilkjced3j.17gcun.top/3F04-FE10-CC9E-0098-BBBA
Extracted
C:\Users\Admin\Desktop\_R_E_A_D___T_H_I_S___QIONXVLO_.hta
http://xpcx6erilkjced3j.1n5mod.top/3F04-FE10-CC9E-0098-BBBAhttp://xpcx6erilkjced3j.19kdeh.top/3F04-FE10-CC9E-0098-BBBAhttp://xpcx6erilkjced3j.1mpsnr.top/3F04-FE10-CC9E-0098-BBBAhttp://xpcx6erilkjced3j.18ey8e.top/3F04-FE10-CC9E-0098-BBBAhttp://xpcx6erilkjced3j.17gcun.top/3F04-FE10-CC9E-0098-BBBA
http://xpcx6erilkjced3j.onion/3F04-FE10-CC9E-0098-BBBA
https://www.baidu.com
Targets
-
-
Target
35195406382becaa3866e042e17dc62dcf956b43ca05e8022565c4591f0da98b.exe
-
Size
436KB
-
MD5
8723362009a3762ce6e882fb99b107db
-
SHA1
33669b86b841b69570246eafcf8b823f893d6763
-
SHA256
35195406382becaa3866e042e17dc62dcf956b43ca05e8022565c4591f0da98b
-
SHA512
55ae8195467ab77b27989c6fc677526cc5e2807565765a278e1311e9c805f35e7a316c20915ce8908f3933ae51df66892c10cf80ea11d1518e79488aaea6a2d6
-
InfinityLock Ransomware
Also known as InfinityCrypt. Based on the open-source HiddenTear ransomware.
-
Suspicious use of NtCreateProcessExOtherParentProcess
-
Blocklisted process makes network request
-
Disables Task Manager via registry modification
-
Downloads MZ/PE file
-
Executes dropped EXE
-
Modifies Windows Firewall
-
Modifies extensions of user files
Ransomware generally changes the extension on encrypted files.
-
Drops startup file
-
Loads dropped DLL
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
Drops file in System32 directory
-
Sets desktop wallpaper using registry
-