Resubmissions
23-10-2021 13:49
211023-q4pj3acda6 927-09-2021 16:25
210927-tw86aahecn 1027-09-2021 16:15
210927-tp7c4shebk 1025-09-2021 21:37
210925-1glj1adhh7 924-09-2021 00:57
210924-bbd6asfdgj 1024-09-2021 00:56
210924-bad4xafdfr 9Analysis
-
max time kernel
877s -
max time network
752s -
platform
windows10_x64 -
resource
win10v20210408 -
submitted
24-09-2021 00:57
Static task
static1
Behavioral task
behavioral1
Sample
APP.exe
Resource
win10v20210408
windows10_x64
0 signatures
0 seconds
General
-
Target
APP.exe
Score
10/10
Malware Config
Extracted
Path
C:\HOW_TO_RECOVER_FILES.Colossus.txt
Family
colossus
Ransom Note
[+] What's Happened? [+]
Your files have been encrypted and currently unavailable. You can check it. All files in your system have "Colossus" extension. By the way, everything is possible to recover (restore) but you should follow our instructions. Otherwise you can NEVER return your data.
[+] What are our guarantees? [+]
It's just a business and we care only about getting benefits. If we don't meet our obligations, nobody will deal with us. It doesn't hold our interest. So you can check the ability to restore your files. For this purpose you should come to talk to us we can decrypt one of your files for free. That is our guarantee.
It doesn't metter for us whether you cooperate with us or not. But if you don't, you'll lose your time and data cause only we have the private key to decrypt your files. time is much more valuable than money.
[+] Data Leak [+]
We uploaded your data and if you dont contact with us then we will publish your data.
Example of data:
- Accounting data
- Executive data
- Sales data
- Customer support data
- Marketing data
- And more other ...
[+] How to Contact? [+]
You have two options :
1. Chat with me :
-Visit our website: http://colossus.support/LPc6EwBqmyC8Tv9Glawleycars/
-When you visit our website, put the following KEY into the input form.
-Then start talk to me.
2. Email me at : [email protected]
KEY:
MjdhZDUzM2Y3MTVhZmUxZjI2NTk2ZGM4YjVhN2EwMDEzODk2M2ZhNWEzMGU2Mjc5MTU4ODFjYjhiNWE3YTAwMTM4OTYzZmE1YTMwZTYyNzkxNTg4MWNiZmRkNDkwNDhiNzA0MjVhNGU0YTc0N2FhYzY0MWU5MTFjODY3M2RhZGQ=
!!! DANGER !!!
DON'T try to change files by yourself, DON'T use any third party software or antivirus solutions to restore your data - it may entail the private key damage and as a result all your data loss!
!!! !!! !!!
ONE MORE TIME: It's in your best interests to get your files back. From our side we ready to make everything for restoring but please do not interfere.
!!! !!! !!
Emails
URLs
http://colossus.support/LPc6EwBqmyC8Tv9Glawleycars/
Signatures
-
Colossus
Ransomware discovered by ZeroFox.
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs
-
Checks BIOS information in registry 2 TTPs 14 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion APP.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion APP.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion APP.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion APP.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion APP.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion APP.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion APP.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion APP.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion APP.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion APP.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion APP.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion APP.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion APP.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion APP.exe -
resource yara_rule behavioral1/memory/2544-114-0x0000000000210000-0x0000000000EEB000-memory.dmp themida behavioral1/memory/2324-183-0x0000000000210000-0x0000000000EEB000-memory.dmp themida behavioral1/memory/3680-226-0x0000000000210000-0x0000000000EEB000-memory.dmp themida behavioral1/memory/2204-229-0x0000000000210000-0x0000000000EEB000-memory.dmp themida behavioral1/memory/3788-232-0x0000000000210000-0x0000000000EEB000-memory.dmp themida behavioral1/memory/1844-235-0x0000000000210000-0x0000000000EEB000-memory.dmp themida behavioral1/memory/2260-238-0x0000000000210000-0x0000000000EEB000-memory.dmp themida -
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA APP.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA APP.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA APP.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA APP.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA APP.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA APP.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA APP.exe -
Drops desktop.ini file(s) 6 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\desktop.ini APP.exe File opened for modification C:\$Recycle.Bin\S-1-5-21-1594587808-2047097707-2163810515-1000\desktop.ini APP.exe File opened for modification C:\Users\Public\desktop.ini APP.exe File opened for modification C:\Windows\Downloaded Program Files\desktop.ini APP.exe File opened for modification C:\Windows\Fonts\desktop.ini APP.exe File opened for modification C:\Program Files\desktop.ini APP.exe -
Drops autorun.inf file 1 TTPs
Malware can abuse Windows Autorun to spread further via attached volumes.
-
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Internet Explorer\IEShims.dll APP.exe File opened for modification C:\Program Files\InvokeGet.pub APP.exe File opened for modification C:\Program Files\Windows Defender\MpCmdRun.exe APP.exe File opened for modification C:\Program Files\Windows Defender\AmStatusInstall.mof APP.exe File opened for modification C:\Program Files\Windows Defender Advanced Threat Protection\SenseCncProxy.exe APP.exe File opened for modification C:\Program Files\Windows Mail\oeimport.dll APP.exe File opened for modification C:\Program Files\Windows Multimedia Platform\sqmapi.dll APP.exe File opened for modification C:\Program Files (x86)\Internet Explorer\iexplore.exe APP.exe File opened for modification C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe APP.exe File opened for modification C:\Program Files\7-Zip\descript.ion APP.exe File opened for modification C:\Program Files\Mozilla Firefox\firefox.exe.sig APP.exe File opened for modification C:\Program Files\Mozilla Firefox\updater.ini APP.exe File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice.exe APP.exe File opened for modification C:\Program Files\Windows Defender\MpUXSrv.exe APP.exe File opened for modification C:\Program Files\ResizeMerge.mid APP.exe File opened for modification C:\Program Files\ResetMeasure.ogg APP.exe File opened for modification C:\Program Files\ShowExit.mid APP.exe File opened for modification C:\Program Files\MoveConvert.mpeg APP.exe File opened for modification C:\Program Files\Mozilla Firefox\api-ms-win-crt-private-l1-1-0.dll APP.exe File opened for modification C:\Program Files\Mozilla Firefox\api-ms-win-crt-conio-l1-1-0.dll APP.exe File opened for modification C:\Program Files\Windows Media Player\mpvis.DLL APP.exe File opened for modification C:\Program Files\Windows Mail\wabimp.dll APP.exe File opened for modification C:\Program Files\Windows Media Player\WMPMediaSharing.dll APP.exe File opened for modification C:\Program Files\Windows Photo Viewer\PhotoViewer.dll APP.exe File opened for modification C:\Program Files (x86)\Windows Mail\MSOERES.dll APP.exe File opened for modification C:\Program Files\BackupFormat.odt APP.exe File created C:\Program Files\Uninstall Information\HOW_TO_RECOVER_FILES.Colossus.txt APP.exe File opened for modification C:\Program Files\Mozilla Firefox\mozglue.dll APP.exe File opened for modification C:\Program Files\Windows Defender\ClientWMIInstall.mof APP.exe File created C:\Program Files (x86)\Reference Assemblies\HOW_TO_RECOVER_FILES.Colossus.txt APP.exe File opened for modification C:\Program Files (x86)\Windows Media Player\setup_wm.exe APP.exe File opened for modification C:\Program Files\PingUnblock.mpeg3 APP.exe File opened for modification C:\Program Files\Internet Explorer\iexplore.exe APP.exe File opened for modification C:\Program Files\Mozilla Firefox\crashreporter.exe APP.exe File opened for modification C:\Program Files\Windows Defender\FepUnregister.mof APP.exe File created C:\Program Files\WindowsPowerShell\HOW_TO_RECOVER_FILES.Colossus.txt APP.exe File opened for modification C:\Program Files\Internet Explorer\ielowutil.exe APP.exe File opened for modification C:\Program Files\Windows Defender\MpOAV.dll APP.exe File opened for modification C:\Program Files (x86)\Windows Defender\MpClient.dll APP.exe File opened for modification C:\Program Files\OptimizePop.3g2 APP.exe File opened for modification C:\Program Files\Windows Defender\AMMonitoringProvider.dll APP.exe File opened for modification C:\Program Files (x86)\Windows Media Player\wmpshare.exe APP.exe File opened for modification C:\Program Files (x86)\Windows Mail\oeimport.dll APP.exe File opened for modification C:\Program Files\StartUnpublish.tmp APP.exe File opened for modification C:\Program Files\7-Zip\License.txt APP.exe File created C:\Program Files\Internet Explorer\HOW_TO_RECOVER_FILES.Colossus.txt APP.exe File opened for modification C:\Program Files\Mozilla Firefox\plugin-hang-ui.exe APP.exe File created C:\Program Files\Windows NT\HOW_TO_RECOVER_FILES.Colossus.txt APP.exe File opened for modification C:\Program Files\Windows Defender Advanced Threat Protection\SenseSampleUploader.exe APP.exe File opened for modification C:\Program Files\Mozilla Firefox\firefox.exe APP.exe File opened for modification C:\Program Files\Mozilla Firefox\firefox.VisualElementsManifest.xml APP.exe File opened for modification C:\Program Files\Windows Defender\NisWfp.dll APP.exe File opened for modification C:\Program Files (x86)\Windows Mail\WinMail.exe APP.exe File created C:\Program Files (x86)\Windows NT\HOW_TO_RECOVER_FILES.Colossus.txt APP.exe File opened for modification C:\Program Files (x86)\Windows Photo Viewer\PhotoAcq.dll APP.exe File opened for modification C:\Program Files\Windows Media Player\wmpnssci.dll APP.exe File created C:\Program Files (x86)\Windows Mail\HOW_TO_RECOVER_FILES.Colossus.txt APP.exe File opened for modification C:\Program Files (x86)\Windows Media Player\wmprph.exe APP.exe File opened for modification C:\Program Files\Mozilla Firefox\api-ms-win-crt-time-l1-1-0.dll APP.exe File opened for modification C:\Program Files\Windows Defender\shellext.dll APP.exe File opened for modification C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe APP.exe File opened for modification C:\Program Files\Windows Media Player\wmpnscfg.exe APP.exe File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\updater.ini APP.exe File opened for modification C:\Program Files (x86)\Windows Defender\MpOAV.dll APP.exe -
Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\Cursors\HOW_TO_RECOVER_FILES.Colossus.txt APP.exe File opened for modification C:\Windows\Fonts\palai.ttf APP.exe File opened for modification C:\Windows\Fonts\corbelz.ttf APP.exe File opened for modification C:\Windows\INF\tdibth.inf APP.exe File opened for modification C:\Windows\INF\netrtl64.inf APP.exe File opened for modification C:\Windows\INF\swenum.inf APP.exe File opened for modification C:\Windows\INF\wsdprint.inf APP.exe File opened for modification C:\Windows\Fonts\ega40866.fon APP.exe File opened for modification C:\Windows\Fonts\vgafix.fon APP.exe File opened for modification C:\Windows\INF\mdmgl008.inf APP.exe File opened for modification C:\Windows\INF\mdmmhrtz.inf APP.exe File opened for modification C:\Windows\INF\mgtdyn.inf APP.exe File opened for modification C:\Windows\INF\prnms005.inf APP.exe File opened for modification C:\Windows\INF\wfpcapture.inf APP.exe File opened for modification C:\Windows\Cursors\busy_m.cur APP.exe File opened for modification C:\Windows\Fonts\holomdl2.ttf APP.exe File opened for modification C:\Windows\INF\WpdFs.inf APP.exe File opened for modification C:\Windows\INF\bthhfenum.PNF APP.exe File opened for modification C:\Windows\INF\oposdrv.inf APP.exe File opened for modification C:\Windows\Fonts\vgas1255.fon APP.exe File opened for modification C:\Windows\INF\mchgr.inf APP.exe File opened for modification C:\Windows\INF\mdmcpq.inf APP.exe File opened for modification C:\Windows\BitLockerDiscoveryVolumeContents\bg-BG_BitLockerToGo.exe.mui APP.exe File opened for modification C:\Windows\BitLockerDiscoveryVolumeContents\en-US_BitLockerToGo.exe.mui APP.exe File created C:\Windows\Branding\HOW_TO_RECOVER_FILES.Colossus.txt APP.exe File opened for modification C:\Windows\Cursors\aero_busy_xl.ani APP.exe File opened for modification C:\Windows\Fonts\smaf1255.fon APP.exe File opened for modification C:\Windows\INF\tsusbhubfilter.inf APP.exe File opened for modification C:\Windows\BitLockerDiscoveryVolumeContents\uk-UA_BitLockerToGo.exe.mui APP.exe File opened for modification C:\Windows\Cursors\aero_nesw_l.cur APP.exe File opened for modification C:\Windows\Fonts\ega80866.fon APP.exe File opened for modification C:\Windows\INF\netwsw00.inf APP.exe File opened for modification C:\Windows\Fonts\85f1257.fon APP.exe File opened for modification C:\Windows\INF\mdmcpv.inf APP.exe File opened for modification C:\Windows\INF\iagpio.inf APP.exe File opened for modification C:\Windows\INF\ksfilter.PNF APP.exe File opened for modification C:\Windows\INF\mdmmega.inf APP.exe File opened for modification C:\Windows\HOW_TO_RECOVER_FILES.Colossus.txt APP.exe File opened for modification C:\Windows\Fonts\StaticCache.dat APP.exe File opened for modification C:\Windows\Fonts\seriff.fon APP.exe File opened for modification C:\Windows\Fonts\ssef1255.fon APP.exe File opened for modification C:\Windows\INF\c_printer.inf APP.exe File opened for modification C:\Windows\INF\ndiscap.inf APP.exe File opened for modification C:\Windows\Fonts\cga80852.fon APP.exe File opened for modification C:\Windows\Fonts\georgiai.ttf APP.exe File opened for modification C:\Windows\Fonts\himalaya.ttf APP.exe File opened for modification C:\Windows\Fonts\vgafixr.fon APP.exe File opened for modification C:\Windows\INF\c_extension.inf APP.exe File opened for modification C:\Windows\Cursors\lmove.cur APP.exe File opened for modification C:\Windows\Fonts\arial.ttf APP.exe File opened for modification C:\Windows\INF\c_holographic.inf APP.exe File opened for modification C:\Windows\INF\flpydisk.PNF APP.exe File opened for modification C:\Windows\INF\netl1c63x64.inf APP.exe File opened for modification C:\Windows\INF\usbhub3.inf APP.exe File opened for modification C:\Windows\HelpPane.exe APP.exe File opened for modification C:\Windows\Cursors\size2_rm.cur APP.exe File opened for modification C:\Windows\Fonts\serifee.fon APP.exe File opened for modification C:\Windows\INF\kscaptur.inf APP.exe File opened for modification C:\Windows\INF\oem1.inf APP.exe File opened for modification C:\Windows\INF\ufxsynopsys.PNF APP.exe File opened for modification C:\Windows\INF\urschipidea.inf APP.exe File opened for modification C:\Windows\lsasetup.log APP.exe File opened for modification C:\Windows\Cursors\arrow_rl.cur APP.exe File opened for modification C:\Windows\Fonts\vgasysr.fon APP.exe -
Suspicious behavior: EnumeratesProcesses 3 IoCs
pid Process 772 powershell.exe 772 powershell.exe 772 powershell.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 772 powershell.exe -
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 772 wrote to memory of 2324 772 powershell.exe 82 PID 772 wrote to memory of 2324 772 powershell.exe 82 PID 772 wrote to memory of 3680 772 powershell.exe 84 PID 772 wrote to memory of 3680 772 powershell.exe 84 PID 772 wrote to memory of 2204 772 powershell.exe 85 PID 772 wrote to memory of 2204 772 powershell.exe 85 PID 772 wrote to memory of 3788 772 powershell.exe 86 PID 772 wrote to memory of 3788 772 powershell.exe 86 PID 772 wrote to memory of 1844 772 powershell.exe 87 PID 772 wrote to memory of 1844 772 powershell.exe 87 PID 772 wrote to memory of 2260 772 powershell.exe 88 PID 772 wrote to memory of 2260 772 powershell.exe 88
Processes
-
C:\Users\Admin\AppData\Local\Temp\APP.exe"C:\Users\Admin\AppData\Local\Temp\APP.exe"1⤵
- Checks BIOS information in registry
- Checks whether UAC is enabled
PID:2544
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:3568
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noexit -command Set-Location -literalPath 'C:\Users\Admin\AppData\Local\Temp'1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:772 -
C:\Users\Admin\AppData\Local\Temp\APP.exe"C:\Users\Admin\AppData\Local\Temp\APP.exe" 6e42f05c8e4d24c3fa0ce2f2a8d203c82⤵
- Checks BIOS information in registry
- Checks whether UAC is enabled
PID:2324
-
-
C:\Users\Admin\AppData\Local\Temp\APP.exe"C:\Users\Admin\AppData\Local\Temp\APP.exe" -ArgumentList 6e42f05c8e4d24c3fa0ce2f2a8d203c8 c:\2⤵
- Checks BIOS information in registry
- Checks whether UAC is enabled
PID:3680
-
-
C:\Users\Admin\AppData\Local\Temp\APP.exe"C:\Users\Admin\AppData\Local\Temp\APP.exe" -ArgumentList 6e42f05c8e4d24c3fa0ce2f2a8d203c8 c:\2⤵
- Checks BIOS information in registry
- Checks whether UAC is enabled
PID:2204
-
-
C:\Users\Admin\AppData\Local\Temp\APP.exe"C:\Users\Admin\AppData\Local\Temp\APP.exe" -ArgumentList 6e42f05c8e4d24c3fa0ce2f2a8d203c8 *2⤵
- Checks BIOS information in registry
- Checks whether UAC is enabled
PID:3788
-
-
C:\Users\Admin\AppData\Local\Temp\APP.exe"C:\Users\Admin\AppData\Local\Temp\APP.exe" 6e42f05c8e4d24c3fa0ce2f2a8d203c8 *2⤵
- Checks BIOS information in registry
- Checks whether UAC is enabled
PID:1844
-
-
C:\Users\Admin\AppData\Local\Temp\APP.exe"C:\Users\Admin\AppData\Local\Temp\APP.exe" 6e42f05c8e4d24c3fa0ce2f2a8d203c8 C:\2⤵
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Drops desktop.ini file(s)
- Drops file in Program Files directory
- Drops file in Windows directory
PID:2260
-