Overview

overview

10

Static

static

c5dccb1aec...le.exe

windows7_x64

10

c5dccb1aec...le.exe

windows10_x64

10

Analysis

  • max time kernel
    119s
  • max time network
    156s
  • platform
    windows7_x64
  • resource
    win7v20210410
  • submitted
    26-07-2021 13:00

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    c5dccb1aec2c6493cdd02d9571df26c995de9934394ffbad030667e34b099e71.sample.exe

  • Size

    252KB

  • MD5

    056fa68a3a2b65e4677f685746283209

  • SHA1

    991f7fa89b13f94a5de106950c14a2f0321069f6

  • SHA256

    c5dccb1aec2c6493cdd02d9571df26c995de9934394ffbad030667e34b099e71

  • SHA512

    cca455cacc8bedb3766762327b3b7e640386d16470a538335f119dda3369a7e1963561ea7a9fd112327a0a5ccbeb464ac2f7ab274fbc968dec159a6270ac2061

Score
10/10
evasionpersistenceransomwarespywarestealersuricata

Malware Config

Extracted

Path

C:\$Recycle.Bin\S-1-5-21-2513283230-931923277-594887482-1000\how_recover+gap.txt

Ransom Note
111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111 NOT YOUR LANGUAGE? USE https://translate.google.com What happened to your files ? All of your files were protected by a strong encryption with RSA-4096. More information about the encryption keys using RSA-4096 can be found here: http://en.wikipedia.org/wiki/RSA_(cryptosystem) What does this mean ? This means that the structure and data within your files have been irrevocably changed, you will not be able to work with them, read them or see them, it is the same thing as losing them forever, but with our help, you can restore them. 111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111 How did this happen ? ---Specially for your PC was generated personal RSA-4096 KEY, both public and private. ---ALL YOUR FILES were encrypted with the public key, which has been transferred to your computer via the Internet. 111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111 Decrypting of your files is only possible with the help of the private key and decrypt program, which is on our secret server. What do I do ? So, there are two ways you can choose: wait for a miracle and get your price doubled, or start obtaining BTC NOW, and restore your data easy way. If You have really valuable data, you better not waste your time, because there is no other way to get your files, except make a payment. For more specific instructions, please visit your personal home page, there are a few different addresses pointing to your page below: 1. http://vr6g2curb2kcidou.encpayment23.com/AD7D2BC4DB652761 2. http://vr6g2curb2kcidou.expay34.com/AD7D2BC4DB652761 3. http://psbc532jm8c.hsh73cu37n1.net/AD7D2BC4DB652761 4. https://vr6g2curb2kcidou.onion.to/AD7D2BC4DB652761 If for some reasons the addresses are not available, follow these steps: 1. Download and install tor-browser: http://www.torproject.org/projects/torbrowser.html.en 2. After a successful installation, run the browser and wait for initialization. 3. Type in the address bar: vr6g2curb2kcidou.onion/AD7D2BC4DB652761 4. Follow the instructions on the site. IMPORTANT INFORMATION: Your personal pages: http://vr6g2curb2kcidou.encpayment23.com/AD7D2BC4DB652761 http://vr6g2curb2kcidou.expay34.com/AD7D2BC4DB652761 http://psbc532jm8c.hsh73cu37n1.net/AD7D2BC4DB652761 https://vr6g2curb2kcidou.onion.to/AD7D2BC4DB652761 Your personal page (using TOR-Browser): vr6g2curb2kcidou.onion/AD7D2BC4DB652761 Your personal identification number (if you open the site (or TOR-Browser's) directly): AD7D2BC4DB652761 111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111
URLs

http://vr6g2curb2kcidou.encpayment23.com/AD7D2BC4DB652761

http://vr6g2curb2kcidou.expay34.com/AD7D2BC4DB652761

http://psbc532jm8c.hsh73cu37n1.net/AD7D2BC4DB652761

https://vr6g2curb2kcidou.onion.to/AD7D2BC4DB652761

http://vr6g2curb2kcidou.onion/AD7D2BC4DB652761

Extracted

Path

C:\Users\Admin\Desktop\Howto_RESTORE_FILES.html

Ransom Note
NOT YOUR LANGUAGE? USE Google Translate What happened to your files? protected by a strong encryption with RSA-4096 More information about the encryption RSA-4096 can be found here: http://en.wikipedia.org/wiki/RSA_(cryptosystem) does this mean? means that the structure and data within your files have been irrevocably changed, you will not be able to work with them, read them or see them, it is the same thing as losing them forever, but with our help, you can restore them. All your files were encrypted with the public key, which has been transferred to your computer via the Internet. Decrypting of YOUR FILES is only possible with the help of the private key and decrypt program, which is on our Secret Server!!! * do not take the necessary measures for the specified time then the conditions for obtaining the private key will be changed. If you really need your data, then we suggest you do not waste valuable time searching for other solutions becausen they do not exist. For more specific instructions, please visit your personal home page, there are a few different addresses pointing to your page below: 1.http://vr6g2curb2kcidou.encpayment23.com/AD7D2BC4DB652761 2.http://vr6g2curb2kcidou.expay34.com/AD7D2BC4DB652761 3.http://psbc532jm8c.hsh73cu37n1.net/AD7D2BC4DB652761 4.https://vr6g2curb2kcidou.onion.to/AD7D2BC4DB652761 If for some reasons the addresses are not available, follow these steps: 1. Download and install tor-browser: http://www.torproject.org/projects/torbrowser.html.en 2. After a successful installation, run the browser and wait for initialization. 3. Type in the tor-browser address bar: vr6g2curb2kcidou.onion/AD7D2BC4DB652761 4. Follow the instructions on the site. IMPORTANT INFORMATION: Your Personal PAGES: http://vr6g2curb2kcidou.encpayment23.com/AD7D2BC4DB652761 http://vr6g2curb2kcidou.expay34.com/AD7D2BC4DB652761 http://psbc532jm8c.hsh73cu37n1.net/AD7D2BC4DB652761 https://vr6g2curb2kcidou.onion.to/AD7D2BC4DB652761 Your Personal PAGES (using TOR-Browser): vr6g2curb2kcidou.onion/AD7D2BC4DB652761 Your personal code (if you open the site (or TOR-Browser's) directly):
URLs

http://vr6g2curb2kcidou.onion/AD7D2BC4DB652761

http://vr6g2curb2kcidou.encpayment23.com/AD7D2BC4DB652761

http://vr6g2curb2kcidou.expay34.com/AD7D2BC4DB652761

http://psbc532jm8c.hsh73cu37n1.net/AD7D2BC4DB652761

https://vr6g2curb2kcidou.onion.to/AD7D2BC4DB652761

Signatures

  • suricata: ET MALWARE AlphaCrypt CnC Beacon 5
    suricata
  • suricata: ET MALWARE AlphaCrypt CnC Beacon 6
    suricata
  • Deletes shadow copies 2 TTPs

    Ransomware often targets backup files to inhibit system recovery.

    ransomware
  • Modifies boot configuration data using bcdedit 1 TTPs 5 IoCs
    ransomwareevasion
  • Executes dropped EXE 1 IoCs
  • Modifies extensions of user files 2 IoCs

    Ransomware generally changes the extension on encrypted files.

    ransomware
  • Deletes itself 1 IoCs
  • Drops startup file 2 IoCs
  • Loads dropped DLL 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Looks up external IP address via web service 2 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Drops file in Program Files directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Interacts with shadow copies 2 TTPs 2 IoCs

    Shadow copies are often targeted by ransomware to inhibit system recovery.

    ransomware
  • Modifies Internet Explorer settings 1 TTPs 36 IoCs
    adwarespyware
  • Modifies system certificate store 2 TTPs 5 IoCs
    evasionspywaretrojan
  • Opens file in notepad (likely ransom note) 1 IoCs
    ransomware
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 5 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Suspicious use of WriteProcessMemory 52 IoCs
  • System policy modification 1 TTPs 2 IoCs
    evasion

Processes

  • C:\Users\Admin\AppData\Local\Temp\c5dccb1aec2c6493cdd02d9571df26c995de9934394ffbad030667e34b099e71.sample.exe
    "C:\Users\Admin\AppData\Local\Temp\c5dccb1aec2c6493cdd02d9571df26c995de9934394ffbad030667e34b099e71.sample.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1732
    • C:\Users\Admin\AppData\Roaming\gabnnacroic.exe
      C:\Users\Admin\AppData\Roaming\gabnnacroic.exe
      2⤵
      • Executes dropped EXE
      • Modifies extensions of user files
      • Drops startup file
      • Adds Run key to start application
      • Drops file in Program Files directory
      • Modifies system certificate store
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      • System policy modification
      PID:1704
      • C:\Windows\system32\bcdedit.exe
        bcdedit.exe /set {current} bootems off
        3⤵
        • Modifies boot configuration data using bcdedit
        PID:516
      • C:\Windows\System32\vssadmin.exe
        "C:\Windows\System32\vssadmin.exe" delete shadows /all /Quiet
        3⤵
        • Interacts with shadow copies
        PID:624
      • C:\Windows\system32\bcdedit.exe
        bcdedit.exe /set {current} advancedoptions off
        3⤵
        • Modifies boot configuration data using bcdedit
        PID:1140
      • C:\Windows\system32\bcdedit.exe
        bcdedit.exe /set {current} optionsedit off
        3⤵
        • Modifies boot configuration data using bcdedit
        PID:928
      • C:\Windows\system32\bcdedit.exe
        bcdedit.exe /set {current} bootstatuspolicy IgnoreAllFailures
        3⤵
        • Modifies boot configuration data using bcdedit
        PID:1784
      • C:\Windows\system32\bcdedit.exe
        bcdedit.exe /set {current} recoveryenabled off
        3⤵
        • Modifies boot configuration data using bcdedit
        PID:736
      • C:\Windows\SysWOW64\NOTEPAD.EXE
        "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Howto_RESTORE_FILES.txt
        3⤵
        • Opens file in notepad (likely ransom note)
        PID:1476
      • C:\Program Files\Internet Explorer\iexplore.exe
        "C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\Desktop\Howto_RESTORE_FILES.html
        3⤵
        • Modifies Internet Explorer settings
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:1792
        • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
          "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1792 CREDAT:275457 /prefetch:2
          4⤵
          • Modifies Internet Explorer settings
          • Suspicious use of SetWindowsHookEx
          PID:556
      • C:\Windows\System32\vssadmin.exe
        "C:\Windows\System32\vssadmin.exe" delete shadows /all /Quiet
        3⤵
        • Interacts with shadow copies
        PID:1320
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\system32\cmd.exe" /c DEL C:\Users\Admin\AppData\Roaming\GABNNA~1.EXE
        3⤵
          PID:1584
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\system32\cmd.exe" /c DEL C:\Users\Admin\AppData\Local\Temp\C5DCCB~1.EXE
        2⤵
        • Deletes itself
        PID:2020
    • C:\Windows\system32\vssvc.exe
      C:\Windows\system32\vssvc.exe
      1⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:1556
    • C:\Windows\SysWOW64\DllHost.exe
      C:\Windows\SysWOW64\DllHost.exe /Processid:{76D0CB12-7604-4048-B83C-1005C7DDC503}
      1⤵
      • Suspicious use of FindShellTrayWindow
      PID:1832

    Network

    MITRE ATT&CK Matrix ATT&CK v6

    Initial Access

    Execution

    Persistence

    Registry Run Keys / Startup Folder

    1
    T1060

    Privilege Escalation

    Defense Evasion

    File Deletion

    2
    T1107

    Modify Registry

    4
    T1112

    Install Root Certificate

    1
    T1130

    Credential Access

    Credentials in Files

    1
    T1081

    Discovery

    System Information Discovery

    1
    T1082

    Lateral Movement

    Collection

    Data from Local System

    1
    T1005

    Exfiltration

    Command and Control

    Impact

    Inhibit System Recovery

    3
    T1490

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015
      MD5

      2902de11e30dcc620b184e3bb0f0c1cb

      SHA1

      5d11d14a2558801a2688dc2d6dfad39ac294f222

      SHA256

      e6a7f1f8810e46a736e80ee5ac6187690f28f4d5d35d130d410e20084b2c1544

      SHA512

      efd415cde25b827ac2a7ca4d6486ce3a43cdcc1c31d3a94fd7944681aa3e83a4966625bf2e6770581c4b59d05e35ff9318d9adaddade9070f131076892af2fa0

      Download Submit
    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
      MD5

      21d79a5f0e741333cb77d78a368bd0df

      SHA1

      26d39adefea9e2f5f18654df3c65e851fa5eae82

      SHA256

      4100071004e1590bb098323a0e1a357259715224d1ee343913aacaca4dc37d15

      SHA512

      96b20c1da916590c658575a11886594834c7e7757ee03d20b23d715711b795069419ab560c7a7b0a936baa5ceedac165a920abd77cf8bf65627452a98e3d4201

      Download Submit
    • C:\Users\Admin\AppData\Roaming\Microsoft\SystemCertificates\My\CRLs\how_recover+gap.html
      MD5

      19bc53b2e2c4270b34d865aba9bf85cd

      SHA1

      415658613f394b782d6d7300b8b70237ba3d7def

      SHA256

      0be92300c1ff95613e5dedad221ed94166e028699f9951f592ca681e1a38f57f

      SHA512

      0260331d58c4ef18b15a10500cc5bc1678def3298201f8a95f2e658af94111315d7bb3d7422783d7d58a3697d98b4a83b57057e4ed72441b0a880771f51fde9a

      Download Submit
    • C:\Users\Admin\AppData\Roaming\Microsoft\SystemCertificates\My\CRLs\how_recover+gap.txt
      MD5

      d313ea55677ccc777157e300e32642bd

      SHA1

      e6d37e8c7f2c93083588a42bbbe15b998d4b5727

      SHA256

      aade73b75788f14901ba75c255ab7bef51ba184ee45504548f9af63f2aea1ed5

      SHA512

      18f09f8d48b2135004c66994d8015c2f56b52ff4e1890c703d09270c40df8f0338df01fe850491489c92f0461fb2f5bf7688ea285cb92b6268dffafe0c485472

      Download Submit
    • C:\Users\Admin\AppData\Roaming\Microsoft\SystemCertificates\My\CTLs\how_recover+gap.html
      MD5

      19bc53b2e2c4270b34d865aba9bf85cd

      SHA1

      415658613f394b782d6d7300b8b70237ba3d7def

      SHA256

      0be92300c1ff95613e5dedad221ed94166e028699f9951f592ca681e1a38f57f

      SHA512

      0260331d58c4ef18b15a10500cc5bc1678def3298201f8a95f2e658af94111315d7bb3d7422783d7d58a3697d98b4a83b57057e4ed72441b0a880771f51fde9a

      Download Submit
    • C:\Users\Admin\AppData\Roaming\Microsoft\SystemCertificates\My\CTLs\how_recover+gap.txt
      MD5

      d313ea55677ccc777157e300e32642bd

      SHA1

      e6d37e8c7f2c93083588a42bbbe15b998d4b5727

      SHA256

      aade73b75788f14901ba75c255ab7bef51ba184ee45504548f9af63f2aea1ed5

      SHA512

      18f09f8d48b2135004c66994d8015c2f56b52ff4e1890c703d09270c40df8f0338df01fe850491489c92f0461fb2f5bf7688ea285cb92b6268dffafe0c485472

      Download Submit
    • C:\Users\Admin\AppData\Roaming\Microsoft\SystemCertificates\My\Certificates\how_recover+gap.html
      MD5

      19bc53b2e2c4270b34d865aba9bf85cd

      SHA1

      415658613f394b782d6d7300b8b70237ba3d7def

      SHA256

      0be92300c1ff95613e5dedad221ed94166e028699f9951f592ca681e1a38f57f

      SHA512

      0260331d58c4ef18b15a10500cc5bc1678def3298201f8a95f2e658af94111315d7bb3d7422783d7d58a3697d98b4a83b57057e4ed72441b0a880771f51fde9a

      Download Submit
    • C:\Users\Admin\AppData\Roaming\Microsoft\SystemCertificates\My\Certificates\how_recover+gap.txt
      MD5

      d313ea55677ccc777157e300e32642bd

      SHA1

      e6d37e8c7f2c93083588a42bbbe15b998d4b5727

      SHA256

      aade73b75788f14901ba75c255ab7bef51ba184ee45504548f9af63f2aea1ed5

      SHA512

      18f09f8d48b2135004c66994d8015c2f56b52ff4e1890c703d09270c40df8f0338df01fe850491489c92f0461fb2f5bf7688ea285cb92b6268dffafe0c485472

      Download Submit
    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\2HJ5PQ1O.txt
      MD5

      00129db4dd04e040a48ea45c149f9330

      SHA1

      8ab4b27548f0754e99262416e00d69acf82a339c

      SHA256

      6c07155a1fd5a5adde6dbd8e685a9d50ae34a0b097a7e732f81940e377169597

      SHA512

      6de407c566ab8b21d40b565d80411c886e51b5e319e7c64affc8804e25f907f8c6cb7d321efe1d5079342ce791d7b175df1fb03e838a2443d6064efc12563827

      Download Submit
    • C:\Users\Admin\AppData\Roaming\gabnnacroic.exe
      MD5

      056fa68a3a2b65e4677f685746283209

      SHA1

      991f7fa89b13f94a5de106950c14a2f0321069f6

      SHA256

      c5dccb1aec2c6493cdd02d9571df26c995de9934394ffbad030667e34b099e71

      SHA512

      cca455cacc8bedb3766762327b3b7e640386d16470a538335f119dda3369a7e1963561ea7a9fd112327a0a5ccbeb464ac2f7ab274fbc968dec159a6270ac2061

      Download Submit
    • C:\Users\Admin\AppData\Roaming\gabnnacroic.exe
      MD5

      056fa68a3a2b65e4677f685746283209

      SHA1

      991f7fa89b13f94a5de106950c14a2f0321069f6

      SHA256

      c5dccb1aec2c6493cdd02d9571df26c995de9934394ffbad030667e34b099e71

      SHA512

      cca455cacc8bedb3766762327b3b7e640386d16470a538335f119dda3369a7e1963561ea7a9fd112327a0a5ccbeb464ac2f7ab274fbc968dec159a6270ac2061

      Download Submit
    • C:\Users\Admin\Desktop\Howto_RESTORE_FILES.bmp
      MD5

      96e8f7307ced22a54bac8124a96dc232

      SHA1

      e0ebab78f98690c623810e024717c59bec35c542

      SHA256

      e851dd21dc7c05689f47bf69a0864b015ac9ff25d8c21d52c1f694dfede74f02

      SHA512

      2a312f724eef9d40c59c156dd9fd3d6f7cccfc9e913884cf4dde72a85739b89b5e618d44a95949bb415acb71785aa9509ebb82e89af6a8d19f5526b3a9542986

      Download Submit
    • C:\Users\Admin\Desktop\Howto_RESTORE_FILES.html
      MD5

      19bc53b2e2c4270b34d865aba9bf85cd

      SHA1

      415658613f394b782d6d7300b8b70237ba3d7def

      SHA256

      0be92300c1ff95613e5dedad221ed94166e028699f9951f592ca681e1a38f57f

      SHA512

      0260331d58c4ef18b15a10500cc5bc1678def3298201f8a95f2e658af94111315d7bb3d7422783d7d58a3697d98b4a83b57057e4ed72441b0a880771f51fde9a

      Download Submit
    • C:\Users\Admin\Desktop\Howto_RESTORE_FILES.txt
      MD5

      d313ea55677ccc777157e300e32642bd

      SHA1

      e6d37e8c7f2c93083588a42bbbe15b998d4b5727

      SHA256

      aade73b75788f14901ba75c255ab7bef51ba184ee45504548f9af63f2aea1ed5

      SHA512

      18f09f8d48b2135004c66994d8015c2f56b52ff4e1890c703d09270c40df8f0338df01fe850491489c92f0461fb2f5bf7688ea285cb92b6268dffafe0c485472

      Download Submit
    • \Users\Admin\AppData\Roaming\gabnnacroic.exe
      MD5

      056fa68a3a2b65e4677f685746283209

      SHA1

      991f7fa89b13f94a5de106950c14a2f0321069f6

      SHA256

      c5dccb1aec2c6493cdd02d9571df26c995de9934394ffbad030667e34b099e71

      SHA512

      cca455cacc8bedb3766762327b3b7e640386d16470a538335f119dda3369a7e1963561ea7a9fd112327a0a5ccbeb464ac2f7ab274fbc968dec159a6270ac2061

      Download Submit
    • memory/516-67-0x0000000000000000-mapping.dmp
      Download
    • memory/556-77-0x0000000000000000-mapping.dmp
      Download
    • memory/624-68-0x0000000000000000-mapping.dmp
      Download
    • memory/736-72-0x0000000000000000-mapping.dmp
      Download
    • memory/928-70-0x0000000000000000-mapping.dmp
      Download
    • memory/1140-69-0x0000000000000000-mapping.dmp
      Download
    • memory/1320-80-0x0000000000000000-mapping.dmp
      Download
    • memory/1476-73-0x0000000000000000-mapping.dmp
      Download
    • memory/1584-84-0x0000000000000000-mapping.dmp
      Download
    • memory/1704-62-0x0000000000000000-mapping.dmp
      Download
    • memory/1732-60-0x0000000075971000-0x0000000075973000-memory.dmp
      Filesize

      8KB

      Download
    • memory/1784-71-0x0000000000000000-mapping.dmp
      Download
    • memory/1792-75-0x0000000000000000-mapping.dmp
      Download
    • memory/1832-79-0x0000000000260000-0x0000000000262000-memory.dmp
      Filesize

      8KB

      Download
    • memory/1832-82-0x0000000000320000-0x0000000000321000-memory.dmp
      Filesize

      4KB

      Download
    • memory/2020-65-0x0000000000000000-mapping.dmp
      Download