ctblocker | d96950d14352749542917183d25c38234c7ab5249062d913ff88516077eadbab

General

Target

d96950d14352749542917183d25c38234c7ab5249062d913ff88516077eadbab.sample.exe
Size

682KB
MD5

45ec8fc71ee99d25db903a68ca7f5ec3
SHA1

d460fc45d2355d352e60c1e95b0156f69487372e
SHA256

d96950d14352749542917183d25c38234c7ab5249062d913ff88516077eadbab
SHA512

85cf082b781aad9a6feed6969b2de3bee578fb1e5a3f96ba5d44b37c976e11be7097ed9eb206c4534f1b9e0ceff57ffd6cf00fb7c56144323b50d65c3dde8b5e

Score

10^/10

ctblocker ransomware

Malware Config

Extracted

Path

C:\Users\Admin\Documents\!Decrypt-All-Files-oidgvle.txt

Ransom Note

Your documents, photos, databases and other important files have been encrypted with strongest encryption and unique key, generated for this computer. Private decryption key is stored on a secret Internet server and nobody can decrypt your files until you pay and obtain the private key. If you see the main locker window, follow the instructions on the locker. Overwise, it's seems that you or your antivirus deleted the locker program. Now you have the last chance to decrypt your files. Open http://jssestaew3e7ao3q.onion.cab or http://jssestaew3e7ao3q.tor2web.org in your browser. They are public gates to the secret server. If you have problems with gates, use direct connection: 1. Download Tor Browser from http://torproject.org 2. In the Tor Browser open the http://jssestaew3e7ao3q.onion/ Note that this server is available via Tor Browser only. Retry in 1 hour if site is not reachable. Copy and paste the following public key in the input form on server. Avoid missprints. YCYJBGE-VTMZTG7-KTNYTQ7-IQUSEGT-BG33S25-TBJJRG3-4QECMPE-A22SPWF Z4ZU2GK-4OCWOXF-PT77OWD-VHFJFHP-USIGXLI-ZCSI563-6RBMJRZ-ZSIFI7Q 7F2HF7R-J3UTVJL-S6ZQACM-VE5K72P-5IEQWF6-R2OTC6V-XSRBEJS-JXDN37U Follow the instructions on the server.

URLs

http://jssestaew3e7ao3q.onion.cab

http://jssestaew3e7ao3q.tor2web.org

http://jssestaew3e7ao3q.onion/

Extracted

Path

C:\ProgramData\siyrcpf.html

Ransom Note

Your documents, photos, databases and other important files have been encrypted with strongest encryption and unique key, generated for this computer. Private decryption key is stored on a secret Internet server and nobody can decrypt your files until you pay and obtain the private key. If you see the main locker window, follow the instructions on the locker. Overwise, it's seems that you or your antivirus deleted the locker program. Now you have the last chance to decrypt your files. Open http://jssestaew3e7ao3q.onion.cab or http://jssestaew3e7ao3q.tor2web.org in your browser. They are public gates to the secret server. If you have problems with gates, use direct connection: 1. Download Tor Browser from http://torproject.org. 2. In the Tor Browser open the http://jssestaew3e7ao3q.onion Note that this server is available via Tor Browser only. Retry in 1 hour if site is not reachable. Copy and paste the following public key in the input form on server. Avoid missprints. Follow the instructions on the server. The list of your encrypted files: Path File

URLs

http://jssestaew3e7ao3q.onion.cab

http://jssestaew3e7ao3q.tor2web.org

http://jssestaew3e7ao3q.onion

Signatures

CTB-Locker
Ransomware family which uses Tor to hide its C2 communications.
ransomware ctblocker
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware

File Deletion
T1107

Inhibit System Recovery
T1490

Executes dropped EXE 4 IoCs

pid	Process
776	gvpesyf.exe
4032	gvpesyf.exe
2240	gvpesyf.exe
2136	gvpesyf.exe

Modifies extensions of user files 4 IoCs

Ransomware generally changes the extension on encrypted files.

ransomware

description	ioc	Process
File renamed	C:\Windows\Temp\laaaaaaa.tmp => C:\Users\Admin\Pictures\ApproveWait.CRW.oidgvle	svchost.exe
File renamed	C:\Windows\Temp\laaaaaaa.tmp => C:\Users\Admin\Pictures\LockHide.CRW.oidgvle	svchost.exe
File renamed	C:\Windows\Temp\laaaaaaa.tmp => C:\Users\Admin\Pictures\SplitRead.RAW.oidgvle	svchost.exe
File renamed	C:\Windows\Temp\laaaaaaa.tmp => C:\Users\Admin\Pictures\ImportSubmit.CRW.oidgvle	svchost.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Control Panel\International\Geo\Nation	gvpesyf.exe

Drops desktop.ini file(s) 1 IoCs

description	ioc	Process
File opened for modification	C:\$RECYCLE.BIN\S-1-5-18\desktop.ini	svchost.exe

Drops file in System32 directory 6 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5	gvpesyf.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE	gvpesyf.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies	gvpesyf.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5	gvpesyf.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\counters2.dat	gvpesyf.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\desktop.ini	gvpesyf.exe

Sets desktop wallpaper using registry 2 TTPs 1 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\Documents\\!Decrypt-All-Files-oidgvle.bmp"	Explorer.EXE

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 568 set thread context of 348	568	d96950d14352749542917183d25c38234c7ab5249062d913ff88516077eadbab.sample.exe	75
PID 776 set thread context of 4032	776	gvpesyf.exe	79
PID 2240 set thread context of 2136	2240	gvpesyf.exe	85

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Interacts with shadow copies 2 TTPs 1 IoCs

Shadow copies are often targeted by ransomware to inhibit system recovery.

ransomware

File Deletion

T1107

Inhibit System Recovery

T1490

pid	Process
1148	vssadmin.exe

Modifies Internet Explorer settings 1 TTPs 4 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\GPU	gvpesyf.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\GPU\AdapterInfo = "vendorId=\"0x1414\",deviceID=\"0x8c\",subSysID=\"0x0\",revision=\"0x0\",version=\"6.2.15063.0\"hypervisor=\"No Hypervisor (No SLAT)\""	gvpesyf.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	gvpesyf.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	gvpesyf.exe

Modifies data under HKEY_USERS 21 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}\DefaultIcon\Empty = "%SystemRoot%\\System32\\imageres.dll,-55"	svchost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Control Panel\Desktop\TileWallpaper = "0"	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\BitBucket\Volume	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\CLSID	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}\DefaultIcon	svchost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}\DefaultIcon\Full = "%SystemRoot%\\System32\\imageres.dll,-54"	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}	svchost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Control Panel\Desktop\WallpaperStyle = "0"	svchost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\@%SystemRoot%\system32\shell32.dll,-50176 = "File Operation"	svchost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\BitBucket\Volume\{d05cfc4a-0000-0000-0000-500600000000}\NukeOnDelete = "0"	svchost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\BitBucket\LastEnum = 30002c007b00640030003500630066006300340061002d0030003000300030002d0030003000300030002d0030003000300030002d003500300030003600300030003000300030003000300030007d0000000000	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	svchost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\BitBucket\Volume\{d05cfc4a-0000-0000-0000-500600000000}	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\BitBucket	svchost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\BitBucket\Volume\{d05cfc4a-0000-0000-0000-500600000000}\MaxCapacity = "15150"	svchost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}\DefaultIcon\ = "%SystemRoot%\\System32\\imageres.dll,-55"	svchost.exe

Suspicious behavior: EnumeratesProcesses 16 IoCs

pid	Process
348	d96950d14352749542917183d25c38234c7ab5249062d913ff88516077eadbab.sample.exe
348	d96950d14352749542917183d25c38234c7ab5249062d913ff88516077eadbab.sample.exe
4032	gvpesyf.exe
4032	gvpesyf.exe
4032	gvpesyf.exe
4032	gvpesyf.exe
4032	gvpesyf.exe
4032	gvpesyf.exe
4032	gvpesyf.exe
4032	gvpesyf.exe
4032	gvpesyf.exe
4032	gvpesyf.exe
4032	gvpesyf.exe
4032	gvpesyf.exe
4032	gvpesyf.exe
4032	gvpesyf.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2708	Explorer.EXE

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeDebugPrivilege	4032	gvpesyf.exe
Token: SeDebugPrivilege	4032	gvpesyf.exe
Token: SeShutdownPrivilege	2708	Explorer.EXE
Token: SeCreatePagefilePrivilege	2708	Explorer.EXE
Token: SeShutdownPrivilege	2708	Explorer.EXE
Token: SeCreatePagefilePrivilege	2708	Explorer.EXE
Token: SeShutdownPrivilege	2708	Explorer.EXE
Token: SeCreatePagefilePrivilege	2708	Explorer.EXE
Token: SeShutdownPrivilege	2708	Explorer.EXE
Token: SeCreatePagefilePrivilege	2708	Explorer.EXE
Token: SeShutdownPrivilege	2708	Explorer.EXE
Token: SeCreatePagefilePrivilege	2708	Explorer.EXE
Token: SeShutdownPrivilege	2708	Explorer.EXE
Token: SeCreatePagefilePrivilege	2708	Explorer.EXE
Token: SeShutdownPrivilege	2708	Explorer.EXE
Token: SeCreatePagefilePrivilege	2708	Explorer.EXE
Token: SeShutdownPrivilege	2708	Explorer.EXE
Token: SeCreatePagefilePrivilege	2708	Explorer.EXE
Token: SeShutdownPrivilege	2708	Explorer.EXE
Token: SeCreatePagefilePrivilege	2708	Explorer.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2136	gvpesyf.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
2136	gvpesyf.exe

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
568	d96950d14352749542917183d25c38234c7ab5249062d913ff88516077eadbab.sample.exe
776	gvpesyf.exe
2240	gvpesyf.exe
2136	gvpesyf.exe
2136	gvpesyf.exe

Suspicious use of WriteProcessMemory 26 IoCs

description	pid	Process	procid_target
PID 568 wrote to memory of 348	568	d96950d14352749542917183d25c38234c7ab5249062d913ff88516077eadbab.sample.exe	75
PID 568 wrote to memory of 348	568	d96950d14352749542917183d25c38234c7ab5249062d913ff88516077eadbab.sample.exe	75
PID 568 wrote to memory of 348	568	d96950d14352749542917183d25c38234c7ab5249062d913ff88516077eadbab.sample.exe	75
PID 568 wrote to memory of 348	568	d96950d14352749542917183d25c38234c7ab5249062d913ff88516077eadbab.sample.exe	75
PID 568 wrote to memory of 348	568	d96950d14352749542917183d25c38234c7ab5249062d913ff88516077eadbab.sample.exe	75
PID 568 wrote to memory of 348	568	d96950d14352749542917183d25c38234c7ab5249062d913ff88516077eadbab.sample.exe	75
PID 776 wrote to memory of 4032	776	gvpesyf.exe	79
PID 776 wrote to memory of 4032	776	gvpesyf.exe	79
PID 776 wrote to memory of 4032	776	gvpesyf.exe	79
PID 776 wrote to memory of 4032	776	gvpesyf.exe	79
PID 776 wrote to memory of 4032	776	gvpesyf.exe	79
PID 776 wrote to memory of 4032	776	gvpesyf.exe	79
PID 4032 wrote to memory of 696	4032	gvpesyf.exe	8
PID 4032 wrote to memory of 2708	4032	gvpesyf.exe	50
PID 4032 wrote to memory of 1148	4032	gvpesyf.exe	82
PID 4032 wrote to memory of 1148	4032	gvpesyf.exe	82
PID 4032 wrote to memory of 1148	4032	gvpesyf.exe	82
PID 4032 wrote to memory of 2240	4032	gvpesyf.exe	84
PID 4032 wrote to memory of 2240	4032	gvpesyf.exe	84
PID 4032 wrote to memory of 2240	4032	gvpesyf.exe	84
PID 2240 wrote to memory of 2136	2240	gvpesyf.exe	85
PID 2240 wrote to memory of 2136	2240	gvpesyf.exe	85
PID 2240 wrote to memory of 2136	2240	gvpesyf.exe	85
PID 2240 wrote to memory of 2136	2240	gvpesyf.exe	85
PID 2240 wrote to memory of 2136	2240	gvpesyf.exe	85
PID 2240 wrote to memory of 2136	2240	gvpesyf.exe	85

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k dcomlaunch -s PlugPlay
1⤵
- Modifies extensions of user files
- Drops desktop.ini file(s)
- Modifies data under HKEY_USERS
PID:696

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Sets desktop wallpaper using registry
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:2708
- C:\Users\Admin\AppData\Local\Temp\d96950d14352749542917183d25c38234c7ab5249062d913ff88516077eadbab.sample.exe
  "C:\Users\Admin\AppData\Local\Temp\d96950d14352749542917183d25c38234c7ab5249062d913ff88516077eadbab.sample.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:568
- - C:\Users\Admin\AppData\Local\Temp\d96950d14352749542917183d25c38234c7ab5249062d913ff88516077eadbab.sample.exe
    "C:\Users\Admin\AppData\Local\Temp\d96950d14352749542917183d25c38234c7ab5249062d913ff88516077eadbab.sample.exe"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:348

C:\Users\Admin\AppData\Local\Temp\gvpesyf.exe
C:\Users\Admin\AppData\Local\Temp\gvpesyf.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:776
- C:\Users\Admin\AppData\Local\Temp\gvpesyf.exe
  "C:\Users\Admin\AppData\Local\Temp\gvpesyf.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4032
- - C:\Windows\SysWOW64\vssadmin.exe
    vssadmin delete shadows all
    3⤵
    - Interacts with shadow copies
    PID:1148
- - C:\Users\Admin\AppData\Local\Temp\gvpesyf.exe
    "C:\Users\Admin\AppData\Local\Temp\gvpesyf.exe" -u
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2240
  - - C:\Users\Admin\AppData\Local\Temp\gvpesyf.exe
      "C:\Users\Admin\AppData\Local\Temp\gvpesyf.exe"
      4⤵
      Executes dropped EXE
      Checks computer location settings
      Drops file in System32 directory
      Modifies Internet Explorer settings
      Suspicious use of FindShellTrayWindow
      Suspicious use of SendNotifyMessage
      Suspicious use of SetWindowsHookEx
      PID:2136

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File Deletion

Modify Registry

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Defacement

1

T1491

Inhibit System Recovery

2

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

memory/348-117-0x0000000000400000-0x00000000004A5000-memory.dmp

Filesize
660KB

Download
memory/348-121-0x0000000000970000-0x0000000000BBB000-memory.dmp

Filesize
2.3MB

Download
memory/348-120-0x0000000000400000-0x00000000004A4400-memory.dmp

Filesize
657KB

Download
memory/348-119-0x0000000000750000-0x000000000096A000-memory.dmp

Filesize
2.1MB

Download
memory/568-114-0x0000000000830000-0x0000000001133000-memory.dmp

Filesize
9.0MB

Download
memory/696-131-0x0000000009990000-0x0000000009A07000-memory.dmp

Filesize
476KB

Download
memory/4032-130-0x0000000000A80000-0x0000000000CCB000-memory.dmp

Filesize
2.3MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads