9b46d03b690bda0df57c0ebb8dae0aebdd1d131beb500242fa8fe59cb260eed1

General

Target

martinhal.exe
Size

122KB
MD5

c3afcdffa4aeeee56b80cf2fd3c9758c
SHA1

e405c212107696a579494a67531ca5877956fac0
SHA256

9b46d03b690bda0df57c0ebb8dae0aebdd1d131beb500242fa8fe59cb260eed1
SHA512

3a984d836176b14d16ac0106c11ebd37f8d7343668e8156d33d74fc721e4224efadd1cc2ae22b3630bcf181eb077a55c571d9f670dd1552905e1fc4605b51346

Score

10^/10

evasion ransomware

Malware Config

Extracted

Path

C:\6iu4l9w-readme.txt

Ransom Note

---=== Welcome. Again. ===--- [-] Whats Happen? [-] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension 6iu4l9w. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [-] What guarantees? [-] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practice - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/B5D63CC5BB219DA3 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decoder.re/B5D63CC5BB219DA3 Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: ye6h3JmS1/n9dC4KDtwRkya8kbz+57gHekrTo2uyGID+rLrcgJdHEFdCsZVnXryj UD16bIHN30+LqhG0hwklpagEoSBbQqTJF7KEXUSCVJJ0cmffr+AWJ0LeSZXvR4Q2 2xqrfxrYvAofcadovFGcl2e6ekPc6o02y2p46jOZcyYJmPR3EvYnDvbJhzwp1ERQ vJOyhcaWwTIDzsxFpAbQ71obZt8XZWLoYkvXxlnHsk9vdyn7L+avfFh0Hrf7oWwM J33K4CZfE9yIbr3DkLOj+SQ8VcZw98TUjz6FUjm8TMJ56i/QMcggZVGY2QgtBwjK P1LNRZ0+Hzo+7A1U62Pida0z1sF28MRfMEVNEAfVLpg19j9rJ3CC2c3sA0azQ0QN Zh/1RMwcTXGlPtjikmMKsBE0+WAKI3WvuNLG35GiNnibQJJXp6wDn0eMaPgypEGp J6p2X/OPyWymm5oyLgeJNq13hwQcOXiBlmECG0CIXEslAUreNaZbxvs4W3B4D/Cu prrcnEXiQdzeAw2wkydidPqDmO2hp5IHqyAIJuaWWtKsWQknPTmlQrLpEj3j5S8Z dVrLiZJ6Fh1Y/f749C+qByXQowGXb0lKG7rhDUeBPMRaYAyKXdHGOkXKXgEcvVQu kovd4vHTFFEn3B9o92mad7/nPFVOu/FKdARWHoeF0Ap9/y5yH4HJOOBG9sW/PzId BknbUSHMpWfGndw55j4SsS5HQgDy5QzxpE4uLWTmaoYOgAQ5ehGx2HyjKO1cyJIy QiKt2llggnN20n5HuFXE3mr7Wua1YSd7pz9hnFAB1tcY5L2hdGh5pYdW868eu/fN NE97WMG4NtwJNmUZzwQ0QbuAxAfv9cNaq4UAzuLBkVymdHBP+My5YV0CLqpw9JtH F3RsjPUdBYIhFaZ9aiIm5x7HmvnsJWGkZ0v3IK3BbZzagK02PE69uJDdQwEsBi+B irK4kKu6ZmegOyW4lD+1DFxWhomc7eqkyi3RWFOqw8Ln+I/lMmj7UPb5tjJqC2ff w7104A32gYW2tsiDmRscb4uHjHFy9wU019XQvfFLpfJ+4y8XU3ERU7zz7s1bzQvA ipbEjPnGvCzf7fOwf8IyC8xYewvCX8EjXJBhSSgiZBw54j4zrmFC6sk+wlm/9uld T620qqGFo569c6Hy6OJ2WQjJPTk5e+zg6R0Y0HHRsVJpvQ0hlGOlIEx57Dtj7Ev4 sh21m8wwaF7qye2bEdF/lew5XkOlNrGNIJ6WpW9cslJFb6cWcKRBR/0N8w2jAA+o 9w6LjZlL3YQ= ----------------------------------------------------------------------------------------- !!! DANGER !!! DON'T try to change files by yourself, DON'T use any third party software for restoring your data or antivirus solutions - its may entail damage of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!

URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/B5D63CC5BB219DA3

http://decoder.re/B5D63CC5BB219DA3

Signatures

Modifies Windows Firewall 1 TTPs
evasion

Modify Existing Service
T1031

Modifies extensions of user files 3 IoCs

Ransomware generally changes the extension on encrypted files.

ransomware

Processes:

martinhal.exe

description	ioc	process
File opened for modification	\??\c:\users\admin\pictures\ConvertConnect.tiff	martinhal.exe
File renamed	C:\Users\Admin\Pictures\ConvertConnect.tiff => \??\c:\users\admin\pictures\ConvertConnect.tiff.6iu4l9w	martinhal.exe
File renamed	C:\Users\Admin\Pictures\FormatRemove.png => \??\c:\users\admin\pictures\FormatRemove.png.6iu4l9w	martinhal.exe

Enumerates connected drives 3 TTPs 25 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

martinhal.exe

description	ioc	process
File opened (read-only)	\??\E:	martinhal.exe
File opened (read-only)	\??\G:	martinhal.exe
File opened (read-only)	\??\V:	martinhal.exe
File opened (read-only)	\??\B:	martinhal.exe
File opened (read-only)	\??\H:	martinhal.exe
File opened (read-only)	\??\S:	martinhal.exe
File opened (read-only)	\??\T:	martinhal.exe
File opened (read-only)	\??\Y:	martinhal.exe
File opened (read-only)	\??\A:	martinhal.exe
File opened (read-only)	\??\F:	martinhal.exe
File opened (read-only)	\??\M:	martinhal.exe
File opened (read-only)	\??\N:	martinhal.exe
File opened (read-only)	\??\O:	martinhal.exe
File opened (read-only)	\??\Q:	martinhal.exe
File opened (read-only)	\??\Z:	martinhal.exe
File opened (read-only)	\??\U:	martinhal.exe
File opened (read-only)	\??\W:	martinhal.exe
File opened (read-only)	\??\I:	martinhal.exe
File opened (read-only)	\??\J:	martinhal.exe
File opened (read-only)	\??\K:	martinhal.exe
File opened (read-only)	\??\L:	martinhal.exe
File opened (read-only)	\??\P:	martinhal.exe
File opened (read-only)	\??\R:	martinhal.exe
File opened (read-only)	\??\X:	martinhal.exe
File opened (read-only)	\??\D:	martinhal.exe

Sets desktop wallpaper using registry 2 TTPs 1 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

Processes:

martinhal.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\4l69.bmp"	martinhal.exe

Drops file in Program Files directory 21 IoCs

Processes:

martinhal.exe

description	ioc	process
File created	\??\c:\program files\tmp	martinhal.exe
File opened for modification	\??\c:\program files\JoinTest.m1v	martinhal.exe
File opened for modification	\??\c:\program files\MoveConvertTo.crw	martinhal.exe
File opened for modification	\??\c:\program files\ResetUnpublish.M2TS	martinhal.exe
File opened for modification	\??\c:\program files\UnpublishRestart.xlsx	martinhal.exe
File opened for modification	\??\c:\program files\SubmitStop.M2V	martinhal.exe
File opened for modification	\??\c:\program files\SuspendInstall.search-ms	martinhal.exe
File created	\??\c:\program files (x86)\tmp	martinhal.exe
File created	\??\c:\program files (x86)\6iu4l9w-readme.txt	martinhal.exe
File opened for modification	\??\c:\program files\FindUninstall.fon	martinhal.exe
File opened for modification	\??\c:\program files\OutAssert.ppsx	martinhal.exe
File opened for modification	\??\c:\program files\RepairPop.htm	martinhal.exe
File opened for modification	\??\c:\program files\ResumeSet.TS	martinhal.exe
File opened for modification	\??\c:\program files\UseGet.mp2	martinhal.exe
File opened for modification	\??\c:\program files\WaitInvoke.scf	martinhal.exe
File opened for modification	\??\c:\program files\WatchBlock.mov	martinhal.exe
File created	\??\c:\program files\6iu4l9w-readme.txt	martinhal.exe
File opened for modification	\??\c:\program files\MountUndo.php	martinhal.exe
File opened for modification	\??\c:\program files\OutLock.html	martinhal.exe
File opened for modification	\??\c:\program files\SetApprove.inf	martinhal.exe
File opened for modification	\??\c:\program files\StepCheckpoint.mpg	martinhal.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 10 IoCs

Processes:

martinhal.exe

pid	process
3920	martinhal.exe
3920	martinhal.exe
3920	martinhal.exe
3920	martinhal.exe
3920	martinhal.exe
3920	martinhal.exe
3920	martinhal.exe
3920	martinhal.exe
3920	martinhal.exe
3920	martinhal.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

Processes:

martinhal.exevssvc.exe

description	pid	process
Token: SeDebugPrivilege	3920	martinhal.exe
Token: SeTakeOwnershipPrivilege	3920	martinhal.exe
Token: SeBackupPrivilege	3388	vssvc.exe
Token: SeRestorePrivilege	3388	vssvc.exe
Token: SeAuditPrivilege	3388	vssvc.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

martinhal.exe

description	pid	process	target process
PID 3920 wrote to memory of 2784	3920	martinhal.exe	netsh.exe
PID 3920 wrote to memory of 2784	3920	martinhal.exe	netsh.exe
PID 3920 wrote to memory of 2784	3920	martinhal.exe	netsh.exe

C:\Users\Admin\AppData\Local\Temp\martinhal.exe
"C:\Users\Admin\AppData\Local\Temp\martinhal.exe"
1⤵
- Modifies extensions of user files
- Enumerates connected drives
- Sets desktop wallpaper using registry
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3920