Overview

overview

10

Static

static

ac6f4894fd...le.exe

windows7_x64

10

ac6f4894fd...le.exe

windows10_x64

10

Analysis

  • max time kernel
    152s
  • max time network
    143s
  • platform
    windows10_x64
  • resource
    win10v20210408
  • submitted
    26-07-2021 13:00

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    ac6f4894fd8fa229c83018fb7959ed9f10f17bc758e2807656524d0fa5060a40.sample.exe

  • Size

    300KB

  • MD5

    beb272ed6ca4bb3559758c8c6426eade

  • SHA1

    836654dee6d0d60b6e0e1483d05e0bf29c0f97a7

  • SHA256

    ac6f4894fd8fa229c83018fb7959ed9f10f17bc758e2807656524d0fa5060a40

  • SHA512

    960bb6d3352bd7ce68f0963829a0df136ba6f94f1b9881e76ed7f21a9dd79f4b508ced38980ecaeddf5b9fae08b0b5ac2318ddda82f9abf3c9c96b77a06a4a0f

Score
10/10
persistenceransomwarespywarestealersuricata

Malware Config

Extracted

Path

C:\$Recycle.Bin\S-1-5-21-1594587808-2047097707-2163810515-1000\how_recover+ksk.txt

Ransom Note
__!@#!@#!__!@#!@#!__!@#!@#!__!@#!@#!__!@#!@#!__!@#!@#!__!@#!@#!__!@#!@#!__!@#!@#!__!@#!@#! NOT YOUR LANGUAGE? USE https://translate.google.com What happened to your files ? All of your files were protected by a strong encryption with RSA-4096. More information about the encryption keys using RSA-4096 can be found here: http://en.wikipedia.org/wiki/RSA_(cryptosystem) How did this happen ? !!! Specially for your PC was generated personal RSA-4096 KEY, both public and private. !!! ALL YOUR FILES were encrypted with the public key, which has been transferred to your computer via the Internet. Decrypting of your files is only possible with the help of the private key and decrypt program, which is on our secret server. What do I do ? So, there are two ways you can choose: wait for a miracle and get your price doubled, or start obtaining BTC NOW, and restore your data easy way. If You have really valuable data, you better not waste your time, because there is no other way to get your files, except make a payment. For more specific instructions, please visit your personal home page, there are a few different addresses pointing to your page below: 1. http://idjsnfnkwjefnsdf.likinrealm.com/2654F9FABF5E1A61 2. http://krfdnhfnsai3d.abeleros.com/2654F9FABF5E1A61 3. http://idjsnfnkwjefnsdf.likinrealm.com/2654F9FABF5E1A61 4. https://4nauizsaaopuj3qj.onion.to/2654F9FABF5E1A61 5. https://4nauizsaaopuj3qj.tor2web.org/2654F9FABF5E1A61 6. https://4nauizsaaopuj3qj.onion.cab/2654F9FABF5E1A61 If for some reasons the addresses are not available, follow these steps: 1. Download and install tor-browser: http://www.torproject.org/projects/torbrowser.html.en 2. After a successful installation, run the browser and wait for initialization. 3. Type in the address bar: 4nauizsaaopuj3qj.onion/2654F9FABF5E1A61 4. Follow the instructions on the site. !!! IMPORTANT INFORMATION: !!! Your personal pages: http://idjsnfnkwjefnsdf.likinrealm.com/2654F9FABF5E1A61 http://krfdnhfnsai3d.abeleros.com/2654F9FABF5E1A61 http://idjsnfnkwjefnsdf.likinrealm.com/2654F9FABF5E1A61 https://4nauizsaaopuj3qj.onion.to/2654F9FABF5E1A61 !!! Your personal page in TOR Browser: 4nauizsaaopuj3qj.onion/2654F9FABF5E1A61 !!! Your personal identification ID: 2654F9FABF5E1A61 00000000000000000000000000000
URLs

http://idjsnfnkwjefnsdf.likinrealm.com/2654F9FABF5E1A61

http://krfdnhfnsai3d.abeleros.com/2654F9FABF5E1A61

https://4nauizsaaopuj3qj.onion.to/2654F9FABF5E1A61

https://4nauizsaaopuj3qj.tor2web.org/2654F9FABF5E1A61

https://4nauizsaaopuj3qj.onion.cab/2654F9FABF5E1A61

http://4nauizsaaopuj3qj.onion/2654F9FABF5E1A61

Signatures

  • suricata: ET MALWARE Alphacrypt/TeslaCrypt Ransomware CnC Beacon
    suricata
  • suricata: ET MALWARE HTTP POST to WP Theme Directory Without Referer
    suricata
  • Deletes shadow copies 2 TTPs

    Ransomware often targets backup files to inhibit system recovery.

    ransomware
  • Executes dropped EXE 1 IoCs
  • Modifies extensions of user files 4 IoCs

    Ransomware generally changes the extension on encrypted files.

    ransomware
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file 4 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Interacts with shadow copies 2 TTPs 2 IoCs

    Shadow copies are often targeted by ransomware to inhibit system recovery.

    ransomware
  • Modifies Internet Explorer settings 1 TTPs 3 IoCs
    adwarespyware
  • Modifies registry class 64 IoCs
  • Opens file in notepad (likely ransom note) 1 IoCs
    ransomware
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: MapViewOfSection 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 15 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 22 IoCs
  • System policy modification 1 TTPs 2 IoCs
    evasion

Processes

  • C:\Users\Admin\AppData\Local\Temp\ac6f4894fd8fa229c83018fb7959ed9f10f17bc758e2807656524d0fa5060a40.sample.exe
    "C:\Users\Admin\AppData\Local\Temp\ac6f4894fd8fa229c83018fb7959ed9f10f17bc758e2807656524d0fa5060a40.sample.exe"
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:628
    • C:\Users\Admin\AppData\Roaming\rxtgrhe45.exe
      C:\Users\Admin\AppData\Roaming\rxtgrhe45.exe
      2⤵
      • Executes dropped EXE
      • Modifies extensions of user files
      • Checks computer location settings
      • Drops startup file
      • Adds Run key to start application
      • Drops file in Program Files directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      • System policy modification
      PID:768
      • C:\Windows\System32\vssadmin.exe
        "C:\Windows\System32\vssadmin.exe" delete shadows /all /Quiet
        3⤵
        • Interacts with shadow copies
        PID:2864
      • C:\Windows\SysWOW64\NOTEPAD.EXE
        "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Howto_Restore_FILES.TXT
        3⤵
        • Opens file in notepad (likely ransom note)
        PID:232
      • C:\Windows\System32\vssadmin.exe
        "C:\Windows\System32\vssadmin.exe" delete shadows /all /Quiet
        3⤵
        • Interacts with shadow copies
        PID:1840
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\system32\cmd.exe" /c DEL C:\Users\Admin\AppData\Roaming\RXTGRH~1.EXE
        3⤵
          PID:4104
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\system32\cmd.exe" /c DEL C:\Users\Admin\AppData\Local\Temp\AC6F48~1.EXE
        2⤵
          PID:3668
      • C:\Windows\system32\vssvc.exe
        C:\Windows\system32\vssvc.exe
        1⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:2364
      • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe
        "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca
        1⤵
        • Drops file in Windows directory
        • Modifies Internet Explorer settings
        • Modifies registry class
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of SetWindowsHookEx
        PID:3052
      • C:\Windows\system32\browser_broker.exe
        C:\Windows\system32\browser_broker.exe -Embedding
        1⤵
        • Modifies Internet Explorer settings
        PID:3844
      • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
        "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
        1⤵
        • Modifies registry class
        • Suspicious behavior: MapViewOfSection
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:3896
      • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
        "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
        1⤵
        • Modifies Internet Explorer settings
        • Modifies registry class
        • Suspicious use of AdjustPrivilegeToken
        PID:2672
      • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
        "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
        1⤵
        • Modifies registry class
        • Suspicious use of AdjustPrivilegeToken
        PID:4260
      • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
        "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
        1⤵
        • Modifies registry class
        PID:4392

      Network

      MITRE ATT&CK Matrix ATT&CK v6

      Initial Access

      Execution

      Persistence

      Registry Run Keys / Startup Folder

      1
      T1060

      Privilege Escalation

      Defense Evasion

      File Deletion

      2
      T1107

      Modify Registry

      3
      T1112

      Credential Access

      Credentials in Files

      1
      T1081

      Discovery

      Query Registry

      1
      T1012

      System Information Discovery

      2
      T1082

      Lateral Movement

      Collection

      Data from Local System

      1
      T1005

      Exfiltration

      Command and Control

      Impact

      Inhibit System Recovery

      2
      T1490

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Roaming\rxtgrhe45.exe
        MD5

        beb272ed6ca4bb3559758c8c6426eade

        SHA1

        836654dee6d0d60b6e0e1483d05e0bf29c0f97a7

        SHA256

        ac6f4894fd8fa229c83018fb7959ed9f10f17bc758e2807656524d0fa5060a40

        SHA512

        960bb6d3352bd7ce68f0963829a0df136ba6f94f1b9881e76ed7f21a9dd79f4b508ced38980ecaeddf5b9fae08b0b5ac2318ddda82f9abf3c9c96b77a06a4a0f

        Download Submit
      • C:\Users\Admin\AppData\Roaming\rxtgrhe45.exe
        MD5

        beb272ed6ca4bb3559758c8c6426eade

        SHA1

        836654dee6d0d60b6e0e1483d05e0bf29c0f97a7

        SHA256

        ac6f4894fd8fa229c83018fb7959ed9f10f17bc758e2807656524d0fa5060a40

        SHA512

        960bb6d3352bd7ce68f0963829a0df136ba6f94f1b9881e76ed7f21a9dd79f4b508ced38980ecaeddf5b9fae08b0b5ac2318ddda82f9abf3c9c96b77a06a4a0f

        Download Submit
      • C:\Users\Admin\Desktop\Howto_Restore_FILES.HTM
        MD5

        7f87edb54abb031b17584aaa3ac51097

        SHA1

        ad07befab730344b57060739069ea36fd76831b5

        SHA256

        d31b1c87865794c498888d1d39dd7dd8ad39adf937913b58ff24a76b95038ce2

        SHA512

        5435c3ef54bf576961e77d7bfa9c975e588c85d4bee6d601fca06df1bfc77496b756d08d1ae12e075eb5749df0a0b0e23d63820ab0289fcaf25c540edc4b8dbd

        Download Submit
      • C:\Users\Admin\Desktop\Howto_Restore_FILES.TXT
        MD5

        42422ab76d75b8b4d90c86e65ca9b413

        SHA1

        f7f04c0f1fc49fe589764d10584fd914620e9a4c

        SHA256

        282573a2dfb1d8d4c2877af48701e755b5d57d63608c8aacde4cff3fff3ead2c

        SHA512

        bc0038265ef9748ed54e7bd86742fcacb7efac2dccb63520054de92fdbd94286ed0ed9e1493d789c86dd34eb520c92d265cfd08d6e6bacf1eef2a1087a44e403

        Download Submit
      • memory/232-119-0x0000000000000000-mapping.dmp
        Download
      • memory/768-114-0x0000000000000000-mapping.dmp
        Download
      • memory/1840-122-0x0000000000000000-mapping.dmp
        Download
      • memory/2864-118-0x0000000000000000-mapping.dmp
        Download
      • memory/3668-117-0x0000000000000000-mapping.dmp
        Download
      • memory/4104-123-0x0000000000000000-mapping.dmp
        Download