Overview

overview

10

Static

static

9d4458f6de...f4.exe

windows7_x64

10

9d4458f6de...f4.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    9d4458f6de6fb97b9b2a6ee9a69b62f4

  • Size

    58KB

  • Sample

    211021-rg9r6aadf2

  • MD5

    9d4458f6de6fb97b9b2a6ee9a69b62f4

  • SHA1

    b7e91d625d95e6b6c8452c0beb4d9900da1931a2

  • SHA256

    dfdf48403506835206467e72952fc59fa3fb3c9dabc36090e82979e0b3a624c7

  • SHA512

    a7b91a7df43fa0902192d34b556d6957954c2878f3329a347226bb2edcfa5a5c44de3e0e245bfd1bcf2efd3c4bcbbb6e7dc17528d5917798cb9795a53dd53e06

Score
10/10
evasionpersistenceransomwaretrojan

Malware Config

Extracted

Path

\??\M:\Boot\cs-CZ\Read_Me.txt

Ransom Note
Attention! All your files, documents, photos, databases and other important files are encrypted The only method of recovering files is to purchase an unique decryptor. Only we can give you this decryptor and only we can recover your files. The server with your decryptor is in a closed network TOR. You can get there by the following ways: ---------------------------------------------------------------------------------------- 1. Download Tor browser - https://www.torproject.org/ 2. Install Tor browser 3. Open Tor Browser 4. Open link in TOR browser: http://mmeeiix2ejdwkmseycljetmpiwebdvgjts75c63camjofn2cjdoulzqd.onion/?101IYODTIYO 5. and open ticket ---------------------------------------------------------------------------------------- Alternate communication channel here: https://yip.su/2QstD5
URLs

http://mmeeiix2ejdwkmseycljetmpiwebdvgjts75c63camjofn2cjdoulzqd.onion/?101IYODTIYO

https://yip.su/2QstD5

Targets

    • Target

      9d4458f6de6fb97b9b2a6ee9a69b62f4

    • Size

      58KB

    • MD5

      9d4458f6de6fb97b9b2a6ee9a69b62f4

    • SHA1

      b7e91d625d95e6b6c8452c0beb4d9900da1931a2

    • SHA256

      dfdf48403506835206467e72952fc59fa3fb3c9dabc36090e82979e0b3a624c7

    • SHA512

      a7b91a7df43fa0902192d34b556d6957954c2878f3329a347226bb2edcfa5a5c44de3e0e245bfd1bcf2efd3c4bcbbb6e7dc17528d5917798cb9795a53dd53e06

    Score
    10/10
    evasionpersistenceransomwaretrojan

    • Modifies Windows Defender Real-time Protection settings

      evasiontrojan

    • Windows security bypass

      evasiontrojan

    • Nirsoft

    • Executes dropped EXE

    • Modifies Installed Components in the registry

      persistence

    • Loads dropped DLL

    • Windows security modification

      evasiontrojan

    • Adds Run key to start application

      persistence

    • Drops desktop.ini file(s)

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Drops file in System32 directory

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Modify Existing Service

1
T1031

Registry Run Keys / Startup Folder

2
T1060

Privilege Escalation

Defense Evasion

Modify Registry

5
T1112

Disabling Security Tools

3
T1089

Credential Access

Discovery

Query Registry

1
T1012

Peripheral Device Discovery

1
T1120

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks