Overview

overview

10

Static

static

c5dccb1aec...le.exe

windows7_x64

10

c5dccb1aec...le.exe

windows10_x64

10

Analysis

  • max time kernel
    115s
  • max time network
    149s
  • platform
    windows10_x64
  • resource
    win10v20210410
  • submitted
    26-07-2021 13:00

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    c5dccb1aec2c6493cdd02d9571df26c995de9934394ffbad030667e34b099e71.sample.exe

  • Size

    252KB

  • MD5

    056fa68a3a2b65e4677f685746283209

  • SHA1

    991f7fa89b13f94a5de106950c14a2f0321069f6

  • SHA256

    c5dccb1aec2c6493cdd02d9571df26c995de9934394ffbad030667e34b099e71

  • SHA512

    cca455cacc8bedb3766762327b3b7e640386d16470a538335f119dda3369a7e1963561ea7a9fd112327a0a5ccbeb464ac2f7ab274fbc968dec159a6270ac2061

Score
10/10
evasionpersistenceransomwarespywarestealersuricata

Malware Config

Extracted

Path

C:\$Recycle.Bin\S-1-5-21-3686645723-710336880-414668232-1000\how_recover+fch.txt

Ransom Note
111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111 NOT YOUR LANGUAGE? USE https://translate.google.com What happened to your files ? All of your files were protected by a strong encryption with RSA-4096. More information about the encryption keys using RSA-4096 can be found here: http://en.wikipedia.org/wiki/RSA_(cryptosystem) What does this mean ? This means that the structure and data within your files have been irrevocably changed, you will not be able to work with them, read them or see them, it is the same thing as losing them forever, but with our help, you can restore them. 111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111 How did this happen ? ---Specially for your PC was generated personal RSA-4096 KEY, both public and private. ---ALL YOUR FILES were encrypted with the public key, which has been transferred to your computer via the Internet. 111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111 Decrypting of your files is only possible with the help of the private key and decrypt program, which is on our secret server. What do I do ? So, there are two ways you can choose: wait for a miracle and get your price doubled, or start obtaining BTC NOW, and restore your data easy way. If You have really valuable data, you better not waste your time, because there is no other way to get your files, except make a payment. For more specific instructions, please visit your personal home page, there are a few different addresses pointing to your page below: 1. http://vr6g2curb2kcidou.encpayment23.com/AC80C2916097D79 2. http://vr6g2curb2kcidou.expay34.com/AC80C2916097D79 3. http://psbc532jm8c.hsh73cu37n1.net/AC80C2916097D79 4. https://vr6g2curb2kcidou.onion.to/AC80C2916097D79 If for some reasons the addresses are not available, follow these steps: 1. Download and install tor-browser: http://www.torproject.org/projects/torbrowser.html.en 2. After a successful installation, run the browser and wait for initialization. 3. Type in the address bar: vr6g2curb2kcidou.onion/AC80C2916097D79 4. Follow the instructions on the site. IMPORTANT INFORMATION: Your personal pages: http://vr6g2curb2kcidou.encpayment23.com/AC80C2916097D79 http://vr6g2curb2kcidou.expay34.com/AC80C2916097D79 http://psbc532jm8c.hsh73cu37n1.net/AC80C2916097D79 https://vr6g2curb2kcidou.onion.to/AC80C2916097D79 Your personal page (using TOR-Browser): vr6g2curb2kcidou.onion/AC80C2916097D79 Your personal identification number (if you open the site (or TOR-Browser's) directly): AC80C2916097D79 111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111
URLs

http://vr6g2curb2kcidou.encpayment23.com/AC80C2916097D79

http://vr6g2curb2kcidou.expay34.com/AC80C2916097D79

http://psbc532jm8c.hsh73cu37n1.net/AC80C2916097D79

https://vr6g2curb2kcidou.onion.to/AC80C2916097D79

http://vr6g2curb2kcidou.onion/AC80C2916097D79

Extracted

Path

C:\Users\Admin\Desktop\Howto_RESTORE_FILES.html

Ransom Note
NOT YOUR LANGUAGE? USE Google Translate What happened to your files? protected by a strong encryption with RSA-4096 More information about the encryption RSA-4096 can be found here: http://en.wikipedia.org/wiki/RSA_(cryptosystem) does this mean? means that the structure and data within your files have been irrevocably changed, you will not be able to work with them, read them or see them, it is the same thing as losing them forever, but with our help, you can restore them. All your files were encrypted with the public key, which has been transferred to your computer via the Internet. Decrypting of YOUR FILES is only possible with the help of the private key and decrypt program, which is on our Secret Server!!! * do not take the necessary measures for the specified time then the conditions for obtaining the private key will be changed. If you really need your data, then we suggest you do not waste valuable time searching for other solutions becausen they do not exist. For more specific instructions, please visit your personal home page, there are a few different addresses pointing to your page below: 1.http://vr6g2curb2kcidou.encpayment23.com/AC80C2916097D79 2.http://vr6g2curb2kcidou.expay34.com/AC80C2916097D79 3.http://psbc532jm8c.hsh73cu37n1.net/AC80C2916097D79 4.https://vr6g2curb2kcidou.onion.to/AC80C2916097D79 If for some reasons the addresses are not available, follow these steps: 1. Download and install tor-browser: http://www.torproject.org/projects/torbrowser.html.en 2. After a successful installation, run the browser and wait for initialization. 3. Type in the tor-browser address bar: vr6g2curb2kcidou.onion/AC80C2916097D79 4. Follow the instructions on the site. IMPORTANT INFORMATION: Your Personal PAGES: http://vr6g2curb2kcidou.encpayment23.com/AC80C2916097D79 http://vr6g2curb2kcidou.expay34.com/AC80C2916097D79 http://psbc532jm8c.hsh73cu37n1.net/AC80C2916097D79 https://vr6g2curb2kcidou.onion.to/AC80C2916097D79 Your Personal PAGES (using TOR-Browser): vr6g2curb2kcidou.onion/AC80C2916097D79 Your personal code (if you open the site (or TOR-Browser's) directly):
URLs

http://vr6g2curb2kcidou.onion/AC80C2916097D79

http://vr6g2curb2kcidou.encpayment23.com/AC80C2916097D79

http://vr6g2curb2kcidou.expay34.com/AC80C2916097D79

http://psbc532jm8c.hsh73cu37n1.net/AC80C2916097D79

https://vr6g2curb2kcidou.onion.to/AC80C2916097D79

Signatures

  • suricata: ET MALWARE AlphaCrypt CnC Beacon 5
    suricata
  • suricata: ET MALWARE AlphaCrypt CnC Beacon 6
    suricata
  • Deletes shadow copies 2 TTPs

    Ransomware often targets backup files to inhibit system recovery.

    ransomware
  • Modifies boot configuration data using bcdedit 1 TTPs 5 IoCs
    ransomwareevasion
  • Executes dropped EXE 1 IoCs
  • Modifies extensions of user files 1 IoCs

    Ransomware generally changes the extension on encrypted files.

    ransomware
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file 4 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Looks up external IP address via web service 2 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Interacts with shadow copies 2 TTPs 2 IoCs

    Shadow copies are often targeted by ransomware to inhibit system recovery.

    ransomware
  • Modifies Internet Explorer settings 1 TTPs 3 IoCs
    adwarespyware
  • Modifies registry class 64 IoCs
  • Opens file in notepad (likely ransom note) 1 IoCs
    ransomware
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: MapViewOfSection 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 14 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 32 IoCs
  • System policy modification 1 TTPs 2 IoCs
    evasion

Processes

  • C:\Users\Admin\AppData\Local\Temp\c5dccb1aec2c6493cdd02d9571df26c995de9934394ffbad030667e34b099e71.sample.exe
    "C:\Users\Admin\AppData\Local\Temp\c5dccb1aec2c6493cdd02d9571df26c995de9934394ffbad030667e34b099e71.sample.exe"
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:3892
    • C:\Users\Admin\AppData\Roaming\qruajacroic.exe
      C:\Users\Admin\AppData\Roaming\qruajacroic.exe
      2⤵
      • Executes dropped EXE
      • Modifies extensions of user files
      • Checks computer location settings
      • Drops startup file
      • Adds Run key to start application
      • Drops file in Program Files directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      • System policy modification
      PID:2776
      • C:\Windows\SYSTEM32\bcdedit.exe
        bcdedit.exe /set {current} bootems off
        3⤵
        • Modifies boot configuration data using bcdedit
        PID:188
      • C:\Windows\System32\vssadmin.exe
        "C:\Windows\System32\vssadmin.exe" delete shadows /all /Quiet
        3⤵
        • Interacts with shadow copies
        PID:2896
      • C:\Windows\SYSTEM32\bcdedit.exe
        bcdedit.exe /set {current} advancedoptions off
        3⤵
        • Modifies boot configuration data using bcdedit
        PID:2108
      • C:\Windows\SYSTEM32\bcdedit.exe
        bcdedit.exe /set {current} optionsedit off
        3⤵
        • Modifies boot configuration data using bcdedit
        PID:3900
      • C:\Windows\SYSTEM32\bcdedit.exe
        bcdedit.exe /set {current} bootstatuspolicy IgnoreAllFailures
        3⤵
        • Modifies boot configuration data using bcdedit
        PID:3052
      • C:\Windows\SYSTEM32\bcdedit.exe
        bcdedit.exe /set {current} recoveryenabled off
        3⤵
        • Modifies boot configuration data using bcdedit
        PID:4040
      • C:\Windows\SysWOW64\NOTEPAD.EXE
        "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Howto_RESTORE_FILES.txt
        3⤵
        • Opens file in notepad (likely ransom note)
        PID:3580
      • C:\Windows\System32\vssadmin.exe
        "C:\Windows\System32\vssadmin.exe" delete shadows /all /Quiet
        3⤵
        • Interacts with shadow copies
        PID:2936
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\system32\cmd.exe" /c DEL C:\Users\Admin\AppData\Roaming\QRUAJA~1.EXE
        3⤵
          PID:4492
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\system32\cmd.exe" /c DEL C:\Users\Admin\AppData\Local\Temp\C5DCCB~1.EXE
        2⤵
          PID:4040
      • C:\Windows\system32\vssvc.exe
        C:\Windows\system32\vssvc.exe
        1⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:3760
      • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe
        "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca
        1⤵
        • Drops file in Windows directory
        • Modifies Internet Explorer settings
        • Modifies registry class
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of SetWindowsHookEx
        PID:252
      • C:\Windows\system32\browser_broker.exe
        C:\Windows\system32\browser_broker.exe -Embedding
        1⤵
        • Modifies Internet Explorer settings
        PID:2280
      • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
        "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
        1⤵
        • Modifies registry class
        • Suspicious behavior: MapViewOfSection
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:4188
      • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
        "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
        1⤵
        • Modifies Internet Explorer settings
        • Modifies registry class
        • Suspicious use of AdjustPrivilegeToken
        PID:4260

      Network

      MITRE ATT&CK Matrix ATT&CK v6

      Initial Access

      Execution

      Persistence

      Registry Run Keys / Startup Folder

      1
      T1060

      Privilege Escalation

      Defense Evasion

      File Deletion

      2
      T1107

      Modify Registry

      3
      T1112

      Credential Access

      Credentials in Files

      1
      T1081

      Discovery

      Query Registry

      1
      T1012

      System Information Discovery

      2
      T1082

      Lateral Movement

      Collection

      Data from Local System

      1
      T1005

      Exfiltration

      Command and Control

      Impact

      Inhibit System Recovery

      3
      T1490

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Roaming\qruajacroic.exe
        MD5

        056fa68a3a2b65e4677f685746283209

        SHA1

        991f7fa89b13f94a5de106950c14a2f0321069f6

        SHA256

        c5dccb1aec2c6493cdd02d9571df26c995de9934394ffbad030667e34b099e71

        SHA512

        cca455cacc8bedb3766762327b3b7e640386d16470a538335f119dda3369a7e1963561ea7a9fd112327a0a5ccbeb464ac2f7ab274fbc968dec159a6270ac2061

        Download Submit
      • C:\Users\Admin\AppData\Roaming\qruajacroic.exe
        MD5

        056fa68a3a2b65e4677f685746283209

        SHA1

        991f7fa89b13f94a5de106950c14a2f0321069f6

        SHA256

        c5dccb1aec2c6493cdd02d9571df26c995de9934394ffbad030667e34b099e71

        SHA512

        cca455cacc8bedb3766762327b3b7e640386d16470a538335f119dda3369a7e1963561ea7a9fd112327a0a5ccbeb464ac2f7ab274fbc968dec159a6270ac2061

        Download Submit
      • C:\Users\Admin\Desktop\Howto_RESTORE_FILES.html
        MD5

        5bc1c2bd0995d7d899e1e0b54bcb65cd

        SHA1

        abf4fd44146f1315f86cceb3b3d7183852d4c203

        SHA256

        b50e7303c6318202f7fc216b868d357abbe460d6c23d9a33ea4b423c48d1f76c

        SHA512

        3ea038e706a0b98baa35e80f0cd4ba3741a52dffed38d83ddcc04c3b3d45437e5d1a15a3e8cf99af9f63772e58f0efc8bdaa4adb76935b99c0215fdbca5e7830

        Download Submit
      • C:\Users\Admin\Desktop\Howto_RESTORE_FILES.txt
        MD5

        d698b9f70791a803090a61820e101f50

        SHA1

        3c7f66b99924fc7d777417d965e72cff73a0e8c7

        SHA256

        f9495222ee318a10c404044bf73dcae8a8c91503daafd8fe1b4fa85daa51a724

        SHA512

        005242eb67a8188a762c1cd6a4a2eaae15aafad9aca0176c90a774b2dcb036874a3760cb6214f347bb152365a5b3bb9f8d52cc0fd3b5e7b4e28cbe1fa5a56396

        Download Submit
      • memory/188-118-0x0000000000000000-mapping.dmp
        Download
      • memory/2108-120-0x0000000000000000-mapping.dmp
        Download
      • memory/2776-114-0x0000000000000000-mapping.dmp
        Download
      • memory/2896-119-0x0000000000000000-mapping.dmp
        Download
      • memory/2936-127-0x0000000000000000-mapping.dmp
        Download
      • memory/3052-122-0x0000000000000000-mapping.dmp
        Download
      • memory/3580-124-0x0000000000000000-mapping.dmp
        Download
      • memory/3900-121-0x0000000000000000-mapping.dmp
        Download
      • memory/4040-117-0x0000000000000000-mapping.dmp
        Download
      • memory/4040-123-0x0000000000000000-mapping.dmp
        Download
      • memory/4492-129-0x0000000000000000-mapping.dmp
        Download