e92bd8498d8a868a7a9fdf5bf0776096a42b7dc8a9d0af9a294bfad5983076f5

General

Target

e25eaaac03aa958688cbe950275156169eb4955e145bc9627fcbfb36cd832a84.exe
Size

116KB
MD5

d1c9c12e08c8e2111da989e2318b1c42
SHA1

d0c7f3c8de28d0fccec9d4925afeb5fa9dd62b5d
SHA256

e25eaaac03aa958688cbe950275156169eb4955e145bc9627fcbfb36cd832a84
SHA512

152f93308e6d15910e01d77c74bb86284e5929ece91627c1aa82fe5050f7a233e3b27a6c5834110478789d5d845c49775c3473b3ee838488f1cd19c6af17312c

Score

10^/10

ransomware

Malware Config

Extracted

Path

C:\46e45-README.txt

Ransom Note

---=== Welcome. Again. ===--- [+] What's Happened? [+] Your files have been encrypted and currently unavailable. You can check it. All files in your system have 46e45 extension. By the way, everything is possible to recover (restore) but you should follow our instructions. Otherwise you can NEVER return your data. [+] What are our guarantees? [+] It's just a business and we care only about getting benefits. If we don't meet our obligations, nobody will deal with us. It doesn't hold our interest. So you can check the ability to restore your files. For this purpose you should visit our website where you can decrypt one file for free. That is our guarantee. It doesn't metter for us whether you cooperate with us or not. But if you don't, you'll lose your time and data cause only we have the private key to decrypt your files. In practice - time is much more valuable than money. [+] How to get access to our website? [+] Use TOR browser: 1. Download and install TOR browser from this site: https://torproject.org/ 2. Visit our website: http://4to43yp4mng2gdc3jgnep5bt7lkhqvjqiritbv4x2ebj3qun7wz4y2id.onion When you visit our website, put the following data into the input form: Key: u5T0PA7MWURnoTppEj3BUuuQ9Q6T66UQKnIBgmqWGSPa2pRql3lw/LVqDYPcZ/eQ UkVqz0tM+yITMSxfw6mFM3h3O5CNkLBVdXwFX5SwqcdfCmHuNITD4QajfWVtF7YB mmcz9U2Rvsy0JtAgpbyArYgCxDAINqS6joMUvZNtPzQYVSYoBTfj/ALqOLbZY3Av kDJNHnTd3OEsbQYnioGBceMA7PCoVjOcGPcbc+GaIy2bzepSL+zBqKb+bpOHBV4/ /TrCYQ7pThhK5Z7R9e6ySghOAQ8jwAQ0BW2cs+59eNp2N9LFPWvdnSD94krw4zDC v5qrnIGkVpmTSdB1O+VFS0W3ME9hDIm7qtfRozkBSkUJ3IA3DTNh807o6XHkyq3V YVfqW0OWYNBz3eFVPrahMwTLsU9L4TvaEP02W9Y+bZ0wRoHGiA7LpdI5/7ILAhbR QHmbYBJtpbIiPmqF7zpMLer+7+ZP75GStlZwP6SVGeRIgZUAB/7Aw15H/fypz/Iz aQX4WeGKuVmYTSxHR2sxIUsnyOL3a2pvitQijX5seebB1IftxaPUuc/K0gETmWgZ Ne7cwPFKR5vVR6lDcFcMgOv6L6wlFxbZzghRYO5gP76IV3nk6OJ9skhyM7BwX3J8 3e9H104Warvb22WVTvDDmNOHHwnxL9YMh7j1nO27WQYc8RQIjIRs8rJMoRBHiBV3 mzBT0gbgZZ3NtqvNRDIf8Ma5ciXQuLxHb405qG4FTtZIdOOU2WZVhVXuErBnAZW1 CFQ5Pv5RruygETGyzLGA2jhkeZQrTB6V9oFzDeKGTF99d5KGzXPPYVKNBISW1BGy dOFFoIyPNUsZ5nhlwxKgA03EaZSFxRTyanBzqIbiMEG/FXz3/Wj11tNF4RO0AINK NBfsftx7hBP6ULFsZps9h1wXu2KyfQXHVBqqy27Q9MAIBFKwC1A5RMxQjntFVDdF tiQFSEr47acNgv94SWsf+rl79lHTuVWQ9hpqkqvuevoa4zTFdpf7opxLolCiNf2p iusIyrppvOYAzA9ipwgjmHZ2h1eWYUO9IWGfM7zDaSoCJOHS7J8Y0dSTHa+ePdQX 4Qopl2x0sLy8Aiwk36eOGO34GpSoWYqrDLbPUc5fmZB8xOFwpWv20bW+GCptTli4 MtgJupipap2aOpW7ZVJOf/Kz3OPdYDkEm3A2zNi7y038zglSnRabB1b+WRh5rmM9 FlAD7T1CWHbzMTPNTI6GnUI3NraGLhRv/YrxHoH1tJl4Xm6GEIW152s8cep5LFZQ YWtzqJJq/TWLe0/dAlThPUxn2QG/Ut6e2iM= !!! DANGER !!! DON'T try to change files by yourself, DON'T use any third party software or antivirus solutions to restore your data - it may entail the private key damage and as a result all your data loss! !!! !!! !!! ONE MORE TIME: It's in your best interests to get your files back. From our side we (the best specialists in this sphere) ready to make everything for restoring but please do not interfere. !!! !!! !!

URLs

http://4to43yp4mng2gdc3jgnep5bt7lkhqvjqiritbv4x2ebj3qun7wz4y2id.onion

Signatures

Modifies extensions of user files 8 IoCs

Ransomware generally changes the extension on encrypted files.

ransomware

Processes:

e25eaaac03aa958688cbe950275156169eb4955e145bc9627fcbfb36cd832a84.exe

description	ioc	process
File renamed	C:\Users\Admin\Pictures\ResizeRemove.crw => \??\c:\users\admin\pictures\ResizeRemove.crw.46e45	e25eaaac03aa958688cbe950275156169eb4955e145bc9627fcbfb36cd832a84.exe
File renamed	C:\Users\Admin\Pictures\StopReset.crw => \??\c:\users\admin\pictures\StopReset.crw.46e45	e25eaaac03aa958688cbe950275156169eb4955e145bc9627fcbfb36cd832a84.exe
File renamed	C:\Users\Admin\Pictures\PingRevoke.crw => \??\c:\users\admin\pictures\PingRevoke.crw.46e45	e25eaaac03aa958688cbe950275156169eb4955e145bc9627fcbfb36cd832a84.exe
File renamed	C:\Users\Admin\Pictures\UndoUse.tiff => \??\c:\users\admin\pictures\UndoUse.tiff.46e45	e25eaaac03aa958688cbe950275156169eb4955e145bc9627fcbfb36cd832a84.exe
File opened for modification	\??\c:\users\admin\pictures\ConvertStop.tiff	e25eaaac03aa958688cbe950275156169eb4955e145bc9627fcbfb36cd832a84.exe
File opened for modification	\??\c:\users\admin\pictures\UndoUse.tiff	e25eaaac03aa958688cbe950275156169eb4955e145bc9627fcbfb36cd832a84.exe
File renamed	C:\Users\Admin\Pictures\ClearInstall.tif => \??\c:\users\admin\pictures\ClearInstall.tif.46e45	e25eaaac03aa958688cbe950275156169eb4955e145bc9627fcbfb36cd832a84.exe
File renamed	C:\Users\Admin\Pictures\ConvertStop.tiff => \??\c:\users\admin\pictures\ConvertStop.tiff.46e45	e25eaaac03aa958688cbe950275156169eb4955e145bc9627fcbfb36cd832a84.exe

Enumerates connected drives 3 TTPs 25 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

e25eaaac03aa958688cbe950275156169eb4955e145bc9627fcbfb36cd832a84.exe

description	ioc	process
File opened (read-only)	\??\V:	e25eaaac03aa958688cbe950275156169eb4955e145bc9627fcbfb36cd832a84.exe
File opened (read-only)	\??\W:	e25eaaac03aa958688cbe950275156169eb4955e145bc9627fcbfb36cd832a84.exe
File opened (read-only)	\??\A:	e25eaaac03aa958688cbe950275156169eb4955e145bc9627fcbfb36cd832a84.exe
File opened (read-only)	\??\S:	e25eaaac03aa958688cbe950275156169eb4955e145bc9627fcbfb36cd832a84.exe
File opened (read-only)	\??\U:	e25eaaac03aa958688cbe950275156169eb4955e145bc9627fcbfb36cd832a84.exe
File opened (read-only)	\??\T:	e25eaaac03aa958688cbe950275156169eb4955e145bc9627fcbfb36cd832a84.exe
File opened (read-only)	\??\Y:	e25eaaac03aa958688cbe950275156169eb4955e145bc9627fcbfb36cd832a84.exe
File opened (read-only)	\??\Z:	e25eaaac03aa958688cbe950275156169eb4955e145bc9627fcbfb36cd832a84.exe
File opened (read-only)	\??\K:	e25eaaac03aa958688cbe950275156169eb4955e145bc9627fcbfb36cd832a84.exe
File opened (read-only)	\??\Q:	e25eaaac03aa958688cbe950275156169eb4955e145bc9627fcbfb36cd832a84.exe
File opened (read-only)	\??\R:	e25eaaac03aa958688cbe950275156169eb4955e145bc9627fcbfb36cd832a84.exe
File opened (read-only)	\??\N:	e25eaaac03aa958688cbe950275156169eb4955e145bc9627fcbfb36cd832a84.exe
File opened (read-only)	\??\O:	e25eaaac03aa958688cbe950275156169eb4955e145bc9627fcbfb36cd832a84.exe
File opened (read-only)	\??\X:	e25eaaac03aa958688cbe950275156169eb4955e145bc9627fcbfb36cd832a84.exe
File opened (read-only)	\??\E:	e25eaaac03aa958688cbe950275156169eb4955e145bc9627fcbfb36cd832a84.exe
File opened (read-only)	\??\F:	e25eaaac03aa958688cbe950275156169eb4955e145bc9627fcbfb36cd832a84.exe
File opened (read-only)	\??\G:	e25eaaac03aa958688cbe950275156169eb4955e145bc9627fcbfb36cd832a84.exe
File opened (read-only)	\??\J:	e25eaaac03aa958688cbe950275156169eb4955e145bc9627fcbfb36cd832a84.exe
File opened (read-only)	\??\L:	e25eaaac03aa958688cbe950275156169eb4955e145bc9627fcbfb36cd832a84.exe
File opened (read-only)	\??\M:	e25eaaac03aa958688cbe950275156169eb4955e145bc9627fcbfb36cd832a84.exe
File opened (read-only)	\??\P:	e25eaaac03aa958688cbe950275156169eb4955e145bc9627fcbfb36cd832a84.exe
File opened (read-only)	\??\D:	e25eaaac03aa958688cbe950275156169eb4955e145bc9627fcbfb36cd832a84.exe
File opened (read-only)	\??\B:	e25eaaac03aa958688cbe950275156169eb4955e145bc9627fcbfb36cd832a84.exe
File opened (read-only)	\??\H:	e25eaaac03aa958688cbe950275156169eb4955e145bc9627fcbfb36cd832a84.exe
File opened (read-only)	\??\I:	e25eaaac03aa958688cbe950275156169eb4955e145bc9627fcbfb36cd832a84.exe

Sets desktop wallpaper using registry 2 TTPs 1 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

Processes:

e25eaaac03aa958688cbe950275156169eb4955e145bc9627fcbfb36cd832a84.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\6nd5rs5.bmp"	e25eaaac03aa958688cbe950275156169eb4955e145bc9627fcbfb36cd832a84.exe

Drops file in Program Files directory 16 IoCs

Processes:

e25eaaac03aa958688cbe950275156169eb4955e145bc9627fcbfb36cd832a84.exe

description	ioc	process
File opened for modification	\??\c:\program files\EditExport.i64	e25eaaac03aa958688cbe950275156169eb4955e145bc9627fcbfb36cd832a84.exe
File created	\??\c:\program files (x86)\microsoft sql server compact edition\v3.5\46e45-README.txt	e25eaaac03aa958688cbe950275156169eb4955e145bc9627fcbfb36cd832a84.exe
File created	\??\c:\program files (x86)\46e45-README.txt	e25eaaac03aa958688cbe950275156169eb4955e145bc9627fcbfb36cd832a84.exe
File opened for modification	\??\c:\program files\MoveGroup.js	e25eaaac03aa958688cbe950275156169eb4955e145bc9627fcbfb36cd832a84.exe
File opened for modification	\??\c:\program files\SendReceive.avi	e25eaaac03aa958688cbe950275156169eb4955e145bc9627fcbfb36cd832a84.exe
File opened for modification	\??\c:\program files\SetComplete.midi	e25eaaac03aa958688cbe950275156169eb4955e145bc9627fcbfb36cd832a84.exe
File opened for modification	\??\c:\program files\SubmitConvertTo.contact	e25eaaac03aa958688cbe950275156169eb4955e145bc9627fcbfb36cd832a84.exe
File created	\??\c:\program files (x86)\microsoft sql server compact edition\v3.5\desktop\46e45-README.txt	e25eaaac03aa958688cbe950275156169eb4955e145bc9627fcbfb36cd832a84.exe
File opened for modification	\??\c:\program files\ClearTest.mp3	e25eaaac03aa958688cbe950275156169eb4955e145bc9627fcbfb36cd832a84.exe
File opened for modification	\??\c:\program files\ApproveDebug.ADT	e25eaaac03aa958688cbe950275156169eb4955e145bc9627fcbfb36cd832a84.exe
File opened for modification	\??\c:\program files\InitializeHide.ini	e25eaaac03aa958688cbe950275156169eb4955e145bc9627fcbfb36cd832a84.exe
File opened for modification	\??\c:\program files\UseSwitch.docm	e25eaaac03aa958688cbe950275156169eb4955e145bc9627fcbfb36cd832a84.exe
File created	\??\c:\program files (x86)\microsoft sql server compact edition\46e45-README.txt	e25eaaac03aa958688cbe950275156169eb4955e145bc9627fcbfb36cd832a84.exe
File created	\??\c:\program files\46e45-README.txt	e25eaaac03aa958688cbe950275156169eb4955e145bc9627fcbfb36cd832a84.exe
File opened for modification	\??\c:\program files\UninstallRead.php	e25eaaac03aa958688cbe950275156169eb4955e145bc9627fcbfb36cd832a84.exe
File opened for modification	\??\c:\program files\DismountRepair.pub	e25eaaac03aa958688cbe950275156169eb4955e145bc9627fcbfb36cd832a84.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

Processes:

e25eaaac03aa958688cbe950275156169eb4955e145bc9627fcbfb36cd832a84.exepowershell.exe

pid process

1608 e25eaaac03aa958688cbe950275156169eb4955e145bc9627fcbfb36cd832a84.exe
672 powershell.exe
672 powershell.exe

pid	process
1608	e25eaaac03aa958688cbe950275156169eb4955e145bc9627fcbfb36cd832a84.exe
672	powershell.exe
672	powershell.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

Processes:

e25eaaac03aa958688cbe950275156169eb4955e145bc9627fcbfb36cd832a84.exepowershell.exevssvc.exe

description	pid	process
Token: SeDebugPrivilege	1608	e25eaaac03aa958688cbe950275156169eb4955e145bc9627fcbfb36cd832a84.exe
Token: SeDebugPrivilege	672	powershell.exe
Token: SeBackupPrivilege	1644	vssvc.exe
Token: SeRestorePrivilege	1644	vssvc.exe
Token: SeAuditPrivilege	1644	vssvc.exe
Token: SeTakeOwnershipPrivilege	1608	e25eaaac03aa958688cbe950275156169eb4955e145bc9627fcbfb36cd832a84.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

e25eaaac03aa958688cbe950275156169eb4955e145bc9627fcbfb36cd832a84.exe

description	pid	process	target process
PID 1608 wrote to memory of 672	1608	e25eaaac03aa958688cbe950275156169eb4955e145bc9627fcbfb36cd832a84.exe	powershell.exe
PID 1608 wrote to memory of 672	1608	e25eaaac03aa958688cbe950275156169eb4955e145bc9627fcbfb36cd832a84.exe	powershell.exe
PID 1608 wrote to memory of 672	1608	e25eaaac03aa958688cbe950275156169eb4955e145bc9627fcbfb36cd832a84.exe	powershell.exe
PID 1608 wrote to memory of 672	1608	e25eaaac03aa958688cbe950275156169eb4955e145bc9627fcbfb36cd832a84.exe	powershell.exe

C:\Users\Admin\AppData\Local\Temp\e25eaaac03aa958688cbe950275156169eb4955e145bc9627fcbfb36cd832a84.exe
"C:\Users\Admin\AppData\Local\Temp\e25eaaac03aa958688cbe950275156169eb4955e145bc9627fcbfb36cd832a84.exe"
1⤵
- Modifies extensions of user files
- Enumerates connected drives
- Sets desktop wallpaper using registry
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1608

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell -e RwBlAHQALQBXAG0AaQBPAGIAagBlAGMAdAAgAFcAaQBuADMAMgBfAFMAaABhAGQAbwB3AGMAbwBwAHkAIAB8ACAARgBvAHIARQBhAGMAaAAtAE8AYgBqAGUAYwB0ACAAewAkAF8ALgBEAGUAbABlAHQAZQAoACkAOwB9AA==
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:672

C:\Windows\system32\wbem\unsecapp.exe
C:\Windows\system32\wbem\unsecapp.exe -Embedding
1⤵
PID:1312

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1644

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Defacement

1

T1491

Replay Monitor

Loading Replay Monitor...

Downloads

memory/672-62-0x000007FEFBAB1000-0x000007FEFBAB3000-memory.dmp

Filesize
8KB

Download
memory/672-61-0x0000000000000000-mapping.dmp

Download
memory/672-63-0x0000000002360000-0x0000000002361000-memory.dmp

Filesize
4KB

Download
memory/672-64-0x000000001AC50000-0x000000001AC51000-memory.dmp

Filesize
4KB

Download
memory/672-65-0x00000000024E0000-0x00000000024E1000-memory.dmp

Filesize
4KB

Download
memory/672-66-0x000000001ABD0000-0x000000001ABD2000-memory.dmp

Filesize
8KB

Download
memory/672-67-0x000000001ABD4000-0x000000001ABD6000-memory.dmp

Filesize
8KB

Download
memory/672-68-0x00000000023A0000-0x00000000023A1000-memory.dmp

Filesize
4KB

Download
memory/672-69-0x000000001AB30000-0x000000001AB31000-memory.dmp

Filesize
4KB

Download
memory/1608-60-0x0000000075411000-0x0000000075413000-memory.dmp

Filesize
8KB

Download

Resubmissions

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads