Behavioral Report

Target

APP.exe
Size

5MB
MD5

a0b4d2c96937104bcffd21ce69885a59
SHA1

6cda6e2bee6d67a5f407e4d7e96af9d76bfa7c79
SHA256

72cb50e5791e1fcb11d24bc4cff3b44379a529c5549fbf6f500adcd67bfe9139
SHA512

17b1b4de1bddb7f357744ace07509481e80eb8a63fa9c39ee00ecd7eba3b03611eb0e2329e88e20b05e8a2655fa67a7b699c8455c1fa9aebeba4384151ae2ee0

Score

10^/10

evasion ransomware themida trojan

Malware Config

Extracted

Path

C:\Users\Admin\HOW_TO_RECOVER_FILES.Colossus.txt

Ransom Note

[+] What's Happened? [+] Your files have been encrypted and currently unavailable. You can check it. All files in your system have "Colossus" extension. By the way, everything is possible to recover (restore) but you should follow our instructions. Otherwise you can NEVER return your data. [+] What are our guarantees? [+] It's just a business and we care only about getting benefits. If we don't meet our obligations, nobody will deal with us. It doesn't hold our interest. So you can check the ability to restore your files. For this purpose you should come to talk to us we can decrypt one of your files for free. That is our guarantee. It doesn't metter for us whether you cooperate with us or not. But if you don't, you'll lose your time and data cause only we have the private key to decrypt your files. time is much more valuable than money. [+] Data Leak [+] We uploaded your data and if you dont contact with us then we will publish your data. Example of data: - Accounting data - Executive data - Sales data - Customer support data - Marketing data - And more other ... [+] How to Contact? [+] You have two options : 1. Chat with me : -Visit our website: http://colossus.support/LPc6EwBqmyC8Tv9Glawleycars/ -When you visit our website, put the following KEY into the input form. -Then start talk to me. 2. Email me at : colossussupport@protonmail.com KEY: MjdhZDUzM2Y3MTVhZmUxZjI2NTk2ZGM4YjVhN2EwMDEzODk2M2ZhNWEzMGU2Mjc5MTU4ODFjYjhiNWE3YTAwMTM4OTYzZmE1YTMwZTYyNzkxNTg4MWNiZmRkNDkwNDhiNzA0MjVhNGU0YTc0N2FhYzY0MWU5MTFjODY3M2RhZGQ= !!! DANGER !!! DON'T try to change files by yourself, DON'T use any third party software or antivirus solutions to restore your data - it may entail the private key damage and as a result all your data loss! !!! !!! !!! ONE MORE TIME: It's in your best interests to get your files back. From our side we ready to make everything for restoring but please do not interfere. !!! !!! !!

Emails

colossussupport@protonmail.com

URLs

http://colossus.support/LPc6EwBqmyC8Tv9Glawleycars/

Signatures

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs
evasion

Query Registry
T1012

Virtualization/Sandbox Evasion
T1497

Checks BIOS information in registry 2 TTPs 4 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

APP.exeAPP.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	APP.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	APP.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	APP.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	APP.exe

Themida packer 2 IoCs

Detects Themida, an advanced Windows software protection system.

themida

Processes:

resource	yara_rule
behavioral1/memory/3800-115-0x0000000000CF0000-0x00000000019CB000-memory.dmp	themida
behavioral1/memory/4428-118-0x0000000000CF0000-0x00000000019CB000-memory.dmp	themida

Checks whether UAC is enabled 1 TTPs 2 IoCs

evasion trojan

System Information Discovery

T1082

Processes:

APP.exeAPP.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	APP.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	APP.exe

Colossus Note 2 IoCs
Detect Colossus ransomware note.
colossus ransomware ransom note

Processes:

yara_rule

Colossus_Note
behavioral1/files/0x000600000000ff38-120.dat Colossus_Note
Opens file in notepad (likely ransom note) 1 IoCs
ransomware

Processes:

NOTEPAD.EXE

pid process

4512 NOTEPAD.EXE
Suspicious use of WriteProcessMemory 2 IoCs

Processes:

cmd.exe

description pid process target process

PID 1540 wrote to memory of 4428 1540 cmd.exe APP.exe
PID 1540 wrote to memory of 4428 1540 cmd.exe APP.exe

yara_rule
Colossus_Note
behavioral1/files/0x000600000000ff38-120.dat	Colossus_Note

pid	process
4512	NOTEPAD.EXE

description	pid	process	target process
PID 1540 wrote to memory of 4428	1540	cmd.exe	APP.exe
PID 1540 wrote to memory of 4428	1540	cmd.exe	APP.exe

C:\Users\Admin\AppData\Local\Temp\APP.exe
"C:\Users\Admin\AppData\Local\Temp\APP.exe"
- Checks BIOS information in registry
- Checks whether UAC is enabled
PID:3800

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
PID:3364

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe"
- Suspicious use of WriteProcessMemory
PID:1540

C:\Users\Admin\AppData\Local\Temp\APP.exe
.\APP.exe 6e42f05c8e4d24c3fa0ce2f2a8d203c8 C:\Users\Admin
- Checks BIOS information in registry
- Checks whether UAC is enabled
PID:4428

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\HOW_TO_RECOVER_FILES.Colossus.txt
- Opens file in notepad (likely ransom note)
PID:4512

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

00:00 00:00

Downloads

C:\Users\Admin\HOW_TO_RECOVER_FILES.Colossus.txt
MD5
898d5f963f127e7f0daeebd42801e511

SHA1
b516caca91cfdd6c13b385c2a65db5244bf9ebbb

SHA256
f07ae15d589c80022346018f554c599142169edf0b401aee471de9224b676e03

SHA512
e323d278c71db2c2e5d66de37afcb730caf621db51937456543cdb6028c09b7e827ef6e9c9b35607f9abde3af3f49896f182aebba87c70538f774bfd67dc82df

Download Submit
memory/3800-115-0x0000000000CF0000-0x00000000019CB000-memory.dmp

Filesize
12MB

Download
memory/3800-116-0x0000000000CF1000-0x0000000000DD7000-memory.dmp

Filesize
920KB

Download
memory/4428-117-0x0000000000000000-mapping.dmp

Download
memory/4428-118-0x0000000000CF0000-0x00000000019CB000-memory.dmp

Filesize
12MB

Download

Resubmissions

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Downloads