e92bd8498d8a868a7a9fdf5bf0776096a42b7dc8a9d0af9a294bfad5983076f5

General

Target

e25eaaac03aa958688cbe950275156169eb4955e145bc9627fcbfb36cd832a84.exe
Size

116KB
MD5

d1c9c12e08c8e2111da989e2318b1c42
SHA1

d0c7f3c8de28d0fccec9d4925afeb5fa9dd62b5d
SHA256

e25eaaac03aa958688cbe950275156169eb4955e145bc9627fcbfb36cd832a84
SHA512

152f93308e6d15910e01d77c74bb86284e5929ece91627c1aa82fe5050f7a233e3b27a6c5834110478789d5d845c49775c3473b3ee838488f1cd19c6af17312c

Score

10^/10

ransomware

Malware Config

Extracted

Path

C:\gmhb9n-README.txt

Ransom Note

---=== Welcome. Again. ===--- [+] What's Happened? [+] Your files have been encrypted and currently unavailable. You can check it. All files in your system have gmhb9n extension. By the way, everything is possible to recover (restore) but you should follow our instructions. Otherwise you can NEVER return your data. [+] What are our guarantees? [+] It's just a business and we care only about getting benefits. If we don't meet our obligations, nobody will deal with us. It doesn't hold our interest. So you can check the ability to restore your files. For this purpose you should visit our website where you can decrypt one file for free. That is our guarantee. It doesn't metter for us whether you cooperate with us or not. But if you don't, you'll lose your time and data cause only we have the private key to decrypt your files. In practice - time is much more valuable than money. [+] How to get access to our website? [+] Use TOR browser: 1. Download and install TOR browser from this site: https://torproject.org/ 2. Visit our website: http://4to43yp4mng2gdc3jgnep5bt7lkhqvjqiritbv4x2ebj3qun7wz4y2id.onion When you visit our website, put the following data into the input form: Key: UduaCxHGR7tNfGHLErw1k8gA69ZxET9PGBP9tGIyJc5JTTz9sWZ+Ky80GN4Ndcvc VWTF0+nFHBjVPh+zz9GPlTPhVe9j4H5ZelI4O+OGQ/WOa38/OnxpJUj0XkokfcD8 CF14TKkFNN6xy8YV2HqP6vJ9eANevnYujI4D4ccHZHzDmpsx2J6DVEn61kQwNKe+ wwYWUG3HSi2Pg5eHFK27ZlmkYLN43JnANPRpdEbe/99biSGGrVfPtGbz2mZmNlaP CgL1qZGzDudIQ28jNRUr2jDa0GN3OU6/KLY0S/ymtBMcCeltt0rxPWMXZDeBGBPt E0JJgTjsNwZd9KgoZadQmYT/79pX8hQB4znmKKXS/kdY0GKrYezxGBOD0MftCJL0 Y9f02t69BuVp9XVd0ihsZnC6tSVXXuoxUvvMXmVGNJ/WOD0p7igP4yguA6ktBfm7 j/PdUxVru3sX8mLRWDUv41+ZpH1YZ3unDPzNwCVBxYY/yZHjuQge4r4hIrE9Rend uFcTMrjN9Ah5CG72NEj/sG4amj/sn0IYuhd3m/FMdCcrb/fzhT25x1f+X55/PGNm C7LJlAY1VhP8tAdAe1vMbptzEpLBPzoTrGrSR70DsI/PmArJw7C3OZwGZ07RQhpt Wm1wEO8NcDOYskgm+eO0rZ8jCOMbXXLgQqLOHg3jmG4Yzz4biGdo/UGfENjh07Nl 6kM2ZduejSLK24uzTkZN/jkvtfQOlMOyc8o3vyzTUKOfNBRHp6vqNafAEoDvm4CM 07NDeQI4x5JA07bPa+0XvSaKhJcQX062OyhfrLKBEV1fj4oRR1di1454rVVw9kl9 ZV8GDaF6aq41LwWjdb9zzW0Fvg461KesieUeHZWdZ456Cg3jPRb8+LMiePzzh1ZH z5HMSbMivW13FudCkGQ1e7I8eYFkKvHnIL/d6oZZRNLk1La4yg1F4y2M/579Q7cl mcdiA7KHDBbJv/8F2FqBXhA8o5o3hPjxc/j2oRK7rYNTpvU+Xi/J96JRtzweQJ0A J8NnP/RVrflBdi6oeS+i+7RdMxFpc6ras11nqko8IZmUYYrtSaSZ9h40v866D+jt gXVmgg6gFLKmAT3wKG1sICln5V/YRQkcXGWSli7HaIlKWHOgc2TM3rS7HtJ7sF/o JMMf+QdLVUSi6nK54a5kCpfk6kJZOgDkrEeW7YsACqQ2mPreg1Gy4wVehWHb9jS2 TRdnAHPkTWgKdi0BAqVY5U/mB4Gf7tFnxY9ddqDER+BVYdk6gSY8A98ZAmQGdxBe SaGn/TW5EHYFy2l4 !!! DANGER !!! DON'T try to change files by yourself, DON'T use any third party software or antivirus solutions to restore your data - it may entail the private key damage and as a result all your data loss! !!! !!! !!! ONE MORE TIME: It's in your best interests to get your files back. From our side we (the best specialists in this sphere) ready to make everything for restoring but please do not interfere. !!! !!! !!

URLs

http://4to43yp4mng2gdc3jgnep5bt7lkhqvjqiritbv4x2ebj3qun7wz4y2id.onion

Signatures

Modifies extensions of user files 16 IoCs

Ransomware generally changes the extension on encrypted files.

ransomware

Processes:

e25eaaac03aa958688cbe950275156169eb4955e145bc9627fcbfb36cd832a84.exe

description	ioc	process
File renamed	C:\Users\Admin\Pictures\RevokeInitialize.png => \??\c:\users\admin\pictures\RevokeInitialize.png.gmhb9n	e25eaaac03aa958688cbe950275156169eb4955e145bc9627fcbfb36cd832a84.exe
File renamed	C:\Users\Admin\Pictures\CompleteSelect.png => \??\c:\users\admin\pictures\CompleteSelect.png.gmhb9n	e25eaaac03aa958688cbe950275156169eb4955e145bc9627fcbfb36cd832a84.exe
File renamed	C:\Users\Admin\Pictures\FormatShow.tif => \??\c:\users\admin\pictures\FormatShow.tif.gmhb9n	e25eaaac03aa958688cbe950275156169eb4955e145bc9627fcbfb36cd832a84.exe
File renamed	C:\Users\Admin\Pictures\ImportUninstall.tiff => \??\c:\users\admin\pictures\ImportUninstall.tiff.gmhb9n	e25eaaac03aa958688cbe950275156169eb4955e145bc9627fcbfb36cd832a84.exe
File renamed	C:\Users\Admin\Pictures\UnlockEdit.crw => \??\c:\users\admin\pictures\UnlockEdit.crw.gmhb9n	e25eaaac03aa958688cbe950275156169eb4955e145bc9627fcbfb36cd832a84.exe
File renamed	C:\Users\Admin\Pictures\UseLimit.tiff => \??\c:\users\admin\pictures\UseLimit.tiff.gmhb9n	e25eaaac03aa958688cbe950275156169eb4955e145bc9627fcbfb36cd832a84.exe
File renamed	C:\Users\Admin\Pictures\ConfirmRestore.tif => \??\c:\users\admin\pictures\ConfirmRestore.tif.gmhb9n	e25eaaac03aa958688cbe950275156169eb4955e145bc9627fcbfb36cd832a84.exe
File opened for modification	\??\c:\users\admin\pictures\UseLimit.tiff	e25eaaac03aa958688cbe950275156169eb4955e145bc9627fcbfb36cd832a84.exe
File renamed	C:\Users\Admin\Pictures\PopUnregister.tif => \??\c:\users\admin\pictures\PopUnregister.tif.gmhb9n	e25eaaac03aa958688cbe950275156169eb4955e145bc9627fcbfb36cd832a84.exe
File renamed	C:\Users\Admin\Pictures\RevokeMerge.tif => \??\c:\users\admin\pictures\RevokeMerge.tif.gmhb9n	e25eaaac03aa958688cbe950275156169eb4955e145bc9627fcbfb36cd832a84.exe
File renamed	C:\Users\Admin\Pictures\UseUndo.png => \??\c:\users\admin\pictures\UseUndo.png.gmhb9n	e25eaaac03aa958688cbe950275156169eb4955e145bc9627fcbfb36cd832a84.exe
File opened for modification	\??\c:\users\admin\pictures\ImportUninstall.tiff	e25eaaac03aa958688cbe950275156169eb4955e145bc9627fcbfb36cd832a84.exe
File renamed	C:\Users\Admin\Pictures\RevokeTest.tif => \??\c:\users\admin\pictures\RevokeTest.tif.gmhb9n	e25eaaac03aa958688cbe950275156169eb4955e145bc9627fcbfb36cd832a84.exe
File renamed	C:\Users\Admin\Pictures\StopBackup.png => \??\c:\users\admin\pictures\StopBackup.png.gmhb9n	e25eaaac03aa958688cbe950275156169eb4955e145bc9627fcbfb36cd832a84.exe
File renamed	C:\Users\Admin\Pictures\SubmitUndo.tif => \??\c:\users\admin\pictures\SubmitUndo.tif.gmhb9n	e25eaaac03aa958688cbe950275156169eb4955e145bc9627fcbfb36cd832a84.exe
File renamed	C:\Users\Admin\Pictures\MoveResolve.raw => \??\c:\users\admin\pictures\MoveResolve.raw.gmhb9n	e25eaaac03aa958688cbe950275156169eb4955e145bc9627fcbfb36cd832a84.exe

Enumerates connected drives 3 TTPs 25 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

e25eaaac03aa958688cbe950275156169eb4955e145bc9627fcbfb36cd832a84.exe

description	ioc	process
File opened (read-only)	\??\F:	e25eaaac03aa958688cbe950275156169eb4955e145bc9627fcbfb36cd832a84.exe
File opened (read-only)	\??\H:	e25eaaac03aa958688cbe950275156169eb4955e145bc9627fcbfb36cd832a84.exe
File opened (read-only)	\??\K:	e25eaaac03aa958688cbe950275156169eb4955e145bc9627fcbfb36cd832a84.exe
File opened (read-only)	\??\Y:	e25eaaac03aa958688cbe950275156169eb4955e145bc9627fcbfb36cd832a84.exe
File opened (read-only)	\??\S:	e25eaaac03aa958688cbe950275156169eb4955e145bc9627fcbfb36cd832a84.exe
File opened (read-only)	\??\T:	e25eaaac03aa958688cbe950275156169eb4955e145bc9627fcbfb36cd832a84.exe
File opened (read-only)	\??\V:	e25eaaac03aa958688cbe950275156169eb4955e145bc9627fcbfb36cd832a84.exe
File opened (read-only)	\??\W:	e25eaaac03aa958688cbe950275156169eb4955e145bc9627fcbfb36cd832a84.exe
File opened (read-only)	\??\E:	e25eaaac03aa958688cbe950275156169eb4955e145bc9627fcbfb36cd832a84.exe
File opened (read-only)	\??\P:	e25eaaac03aa958688cbe950275156169eb4955e145bc9627fcbfb36cd832a84.exe
File opened (read-only)	\??\Q:	e25eaaac03aa958688cbe950275156169eb4955e145bc9627fcbfb36cd832a84.exe
File opened (read-only)	\??\R:	e25eaaac03aa958688cbe950275156169eb4955e145bc9627fcbfb36cd832a84.exe
File opened (read-only)	\??\X:	e25eaaac03aa958688cbe950275156169eb4955e145bc9627fcbfb36cd832a84.exe
File opened (read-only)	\??\Z:	e25eaaac03aa958688cbe950275156169eb4955e145bc9627fcbfb36cd832a84.exe
File opened (read-only)	\??\O:	e25eaaac03aa958688cbe950275156169eb4955e145bc9627fcbfb36cd832a84.exe
File opened (read-only)	\??\B:	e25eaaac03aa958688cbe950275156169eb4955e145bc9627fcbfb36cd832a84.exe
File opened (read-only)	\??\J:	e25eaaac03aa958688cbe950275156169eb4955e145bc9627fcbfb36cd832a84.exe
File opened (read-only)	\??\L:	e25eaaac03aa958688cbe950275156169eb4955e145bc9627fcbfb36cd832a84.exe
File opened (read-only)	\??\M:	e25eaaac03aa958688cbe950275156169eb4955e145bc9627fcbfb36cd832a84.exe
File opened (read-only)	\??\U:	e25eaaac03aa958688cbe950275156169eb4955e145bc9627fcbfb36cd832a84.exe
File opened (read-only)	\??\D:	e25eaaac03aa958688cbe950275156169eb4955e145bc9627fcbfb36cd832a84.exe
File opened (read-only)	\??\A:	e25eaaac03aa958688cbe950275156169eb4955e145bc9627fcbfb36cd832a84.exe
File opened (read-only)	\??\G:	e25eaaac03aa958688cbe950275156169eb4955e145bc9627fcbfb36cd832a84.exe
File opened (read-only)	\??\I:	e25eaaac03aa958688cbe950275156169eb4955e145bc9627fcbfb36cd832a84.exe
File opened (read-only)	\??\N:	e25eaaac03aa958688cbe950275156169eb4955e145bc9627fcbfb36cd832a84.exe

Sets desktop wallpaper using registry 2 TTPs 1 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

Processes:

e25eaaac03aa958688cbe950275156169eb4955e145bc9627fcbfb36cd832a84.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\baq859.bmp"	e25eaaac03aa958688cbe950275156169eb4955e145bc9627fcbfb36cd832a84.exe

Drops file in Program Files directory 12 IoCs

Processes:

e25eaaac03aa958688cbe950275156169eb4955e145bc9627fcbfb36cd832a84.exe

description	ioc	process
File opened for modification	\??\c:\program files\InstallLimit.csv	e25eaaac03aa958688cbe950275156169eb4955e145bc9627fcbfb36cd832a84.exe
File opened for modification	\??\c:\program files\OptimizeSplit.mov	e25eaaac03aa958688cbe950275156169eb4955e145bc9627fcbfb36cd832a84.exe
File opened for modification	\??\c:\program files\ProtectInstall.pub	e25eaaac03aa958688cbe950275156169eb4955e145bc9627fcbfb36cd832a84.exe
File opened for modification	\??\c:\program files\SaveProtect.m4a	e25eaaac03aa958688cbe950275156169eb4955e145bc9627fcbfb36cd832a84.exe
File opened for modification	\??\c:\program files\StepPublish.shtml	e25eaaac03aa958688cbe950275156169eb4955e145bc9627fcbfb36cd832a84.exe
File opened for modification	\??\c:\program files\SubmitDebug.mpeg2	e25eaaac03aa958688cbe950275156169eb4955e145bc9627fcbfb36cd832a84.exe
File opened for modification	\??\c:\program files\ExitGet.tiff	e25eaaac03aa958688cbe950275156169eb4955e145bc9627fcbfb36cd832a84.exe
File created	\??\c:\program files (x86)\gmhb9n-README.txt	e25eaaac03aa958688cbe950275156169eb4955e145bc9627fcbfb36cd832a84.exe
File opened for modification	\??\c:\program files\MeasureTrace.sql	e25eaaac03aa958688cbe950275156169eb4955e145bc9627fcbfb36cd832a84.exe
File opened for modification	\??\c:\program files\RenameSubmit.avi	e25eaaac03aa958688cbe950275156169eb4955e145bc9627fcbfb36cd832a84.exe
File opened for modification	\??\c:\program files\ResetDisconnect.m1v	e25eaaac03aa958688cbe950275156169eb4955e145bc9627fcbfb36cd832a84.exe
File created	\??\c:\program files\gmhb9n-README.txt	e25eaaac03aa958688cbe950275156169eb4955e145bc9627fcbfb36cd832a84.exe

Suspicious behavior: EnumeratesProcesses 5 IoCs

Processes:

e25eaaac03aa958688cbe950275156169eb4955e145bc9627fcbfb36cd832a84.exepowershell.exe

pid	process
580	e25eaaac03aa958688cbe950275156169eb4955e145bc9627fcbfb36cd832a84.exe
580	e25eaaac03aa958688cbe950275156169eb4955e145bc9627fcbfb36cd832a84.exe
2764	powershell.exe
2764	powershell.exe
2764	powershell.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

Processes:

e25eaaac03aa958688cbe950275156169eb4955e145bc9627fcbfb36cd832a84.exepowershell.exevssvc.exe

description	pid	process
Token: SeDebugPrivilege	580	e25eaaac03aa958688cbe950275156169eb4955e145bc9627fcbfb36cd832a84.exe
Token: SeDebugPrivilege	2764	powershell.exe
Token: SeBackupPrivilege	3656	vssvc.exe
Token: SeRestorePrivilege	3656	vssvc.exe
Token: SeAuditPrivilege	3656	vssvc.exe
Token: SeTakeOwnershipPrivilege	580	e25eaaac03aa958688cbe950275156169eb4955e145bc9627fcbfb36cd832a84.exe

Suspicious use of WriteProcessMemory 2 IoCs

Processes:

e25eaaac03aa958688cbe950275156169eb4955e145bc9627fcbfb36cd832a84.exe

description	pid	process	target process
PID 580 wrote to memory of 2764	580	e25eaaac03aa958688cbe950275156169eb4955e145bc9627fcbfb36cd832a84.exe	powershell.exe
PID 580 wrote to memory of 2764	580	e25eaaac03aa958688cbe950275156169eb4955e145bc9627fcbfb36cd832a84.exe	powershell.exe

C:\Users\Admin\AppData\Local\Temp\e25eaaac03aa958688cbe950275156169eb4955e145bc9627fcbfb36cd832a84.exe
"C:\Users\Admin\AppData\Local\Temp\e25eaaac03aa958688cbe950275156169eb4955e145bc9627fcbfb36cd832a84.exe"
1⤵
- Modifies extensions of user files
- Enumerates connected drives
- Sets desktop wallpaper using registry
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:580

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell -e RwBlAHQALQBXAG0AaQBPAGIAagBlAGMAdAAgAFcAaQBuADMAMgBfAFMAaABhAGQAbwB3AGMAbwBwAHkAIAB8ACAARgBvAHIARQBhAGMAaAAtAE8AYgBqAGUAYwB0ACAAewAkAF8ALgBEAGUAbABlAHQAZQAoACkAOwB9AA==
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2764

C:\Windows\system32\wbem\unsecapp.exe
C:\Windows\system32\wbem\unsecapp.exe -Embedding
1⤵
PID:1088

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3656

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Defacement

1

T1491

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2764-114-0x0000000000000000-mapping.dmp

Download
memory/2764-120-0x00000120AEE30000-0x00000120AEE31000-memory.dmp

Filesize
4KB

Download
memory/2764-124-0x00000120AEFE0000-0x00000120AEFE1000-memory.dmp

Filesize
4KB

Download
memory/2764-129-0x0000012092E80000-0x0000012092E82000-memory.dmp

Filesize
8KB

Download
memory/2764-130-0x0000012092E83000-0x0000012092E85000-memory.dmp

Filesize
8KB

Download
memory/2764-136-0x0000012092E86000-0x0000012092E88000-memory.dmp

Filesize
8KB

Download

Resubmissions

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads