dff5690cd1a3474c6cac9dcf8efacdaf51a6be992e70029e21dcacd89cc71f05

General

Target
dff5690cd1a3474c6cac9dcf8efacdaf51a6be992e70029e21dcacd89cc71f05.dll
Size 78KB
Sample220124-a7r7cshaan
SHA256 dff5690cd1a3474c6cac9dcf8efacdaf51a6be992e70029e21dcacd89cc71f05
MD5 9c3784b44183e575037fdb131355b2f6
SHA1 8b85ce577902376ebab9a4e3839da030077fd65c
SHA512 db20b54bd34ebb3abf6640c773ada4e14a187552aaaac2fddcde3ad64598d7221054db56ea145fba6e123d21e281d33573e1f9b2035ebe60014e7ae5164c2e9d
MD5 SHA1 SHA512

Score

10^/10

ransomware

Malware Config

Extracted

Path

C:\7c14u939-readme.txt

Ransom Note

---=== Welcome. Again. ===--- [-] Whats Happen? [-] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension 7c14u939. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [-] What guarantees? [-] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practice - time is much more valuable than money. [+] How to get access on website? [+] Using a TOR browser! 1) Download and install TOR browser from this site: https://torproject.org/ 2) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/D84152300BC3497B Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: OjcA72EzSK3R4YuwnHmrJ/B/rIj2O9JszO56wLkfdsA5jVE0uhbCM8ZHRrB7z1im Rp3q/7TdKda68hhYxMF17nYcTDCYcywBKQQlv0OY1pkxwQ5xklXTboEpsY+NdzB5 ytudyd5oMAc4/S+5UjtKBnT7nFjR5NCKT/iHXwCVqnM75z8I3IvFRYJmgFKAfwNa INvGjW7G4+k+OJGtyPokNEVIqMrCyrBqlbX8tOn50lBez4ObEy1xAeKaFq2am9Uf rvAUdkL5C7nrbhLMW4jp8ZqMSzPUI6aGZuj1ySzUr3Jmn4swKfBFMMQZUv2enGp8 m71W+okA51T+UsT9qudm/k4DDANyiXv3RSw7p7saLpubqzauyeqvCIxGDO90XIMW Me0qlzxz49rC9O4x57g59n3wwIcps2nq2MpyBpgn4mWcbBj9gVpE/goiC/eCObEJ JsDU0o9tl0rdrXUuHmbFM4xxaF5+rSoYuogm/Zy2xd7vhshgSszmHtNb3itRR4Ej qYn0s4rYRuA7flzwaP/a3o5LYHGANaplq8EMxdRx/f9N+1hvsgAetpWfZKD2wGJH lUc0Hzi1mioSHBXnBZg/oX9hLzmpzSE8SxqCsaQv4VGooyebnJ3kNDw79FRr5+28 TuEGfURYgdHfZYG5LcG0NlWLwL0knc5ArJqwcqzNkmqhGJdWOdeneNd9ResR5lME lutXovGT6dKK71nzAwVW7ihLG0pseYOMQbcs+YeApkHyCy+7vF4+1PC5rjkcEHFE BEK2BSe3YY1nRqZIeN+qBsbQZHjsyxJT3u3jD4Tg7428uQlEAIV9e5/QJMgGIn2D rcdE59YUg2vQk8EkJ8Rhv5y3R/dBp6G5T3hO3xpfzio1pknMerqMgbQlS/kC5US7 JPCC5IrHRpKdytcAamTBnguPJMfsUmpHeGwIWW958f/vRISAV6nYYPfgUyCVLHjr r/0MVj2o6AP/YylQKfFNS9nRs98jS5wari6ObJm/YHoGkh5ge7YZU+ZPQ8zut+b/ xE+82f2G6P+COGwe4yaGOKtn39FiHA97Q17LxItZukWwH1c4KyQWeX3bLRoZclBv 2lHOgSWJNnDlme5BIjDc2+cMkrFA8PaXhEQ1L/AmrNTMcAqKbDdnpcPACLsyip2U 3+NKSdRSqOt8r4r8FkZ+SeIN0zP5F/BTznU+6ZbKOJMV099XVl0ZL70qVPkjIV5c mkbOtGc1ZZE1pNs2MhFwjsXlQxNa2TLqZKHsDnzR81kk+tu082Pv/g8F0oAKqMt/ wKFNM+wES9f43w== ----------------------------------------------------------------------------------------- !!! DANGER !!! DON'T try to change files by yourself, DON'T use any third party software for restoring your data or antivirus solutions - its may entail damage of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!

URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/D84152300BC3497B

Signatures

Modifies extensions of user files 17 IoCs

Ransomware generally changes the extension on encrypted files.

ransomware

description	ioc	Process
File renamed	C:\Users\Admin\Pictures\WaitConnect.raw => \??\c:\users\admin\pictures\WaitConnect.raw.7c14u939	regsvr32.exe
File renamed	C:\Users\Admin\Pictures\ExpandRegister.tiff => \??\c:\users\admin\pictures\ExpandRegister.tiff.7c14u939	regsvr32.exe
File renamed	C:\Users\Admin\Pictures\FormatDebug.raw => \??\c:\users\admin\pictures\FormatDebug.raw.7c14u939	regsvr32.exe
File opened for modification	\??\c:\users\admin\pictures\MoveUse.tiff	regsvr32.exe
File renamed	C:\Users\Admin\Pictures\NewMove.png => \??\c:\users\admin\pictures\NewMove.png.7c14u939	regsvr32.exe
File renamed	C:\Users\Admin\Pictures\RemovePublish.crw => \??\c:\users\admin\pictures\RemovePublish.crw.7c14u939	regsvr32.exe
File renamed	C:\Users\Admin\Pictures\RepairUnlock.tif => \??\c:\users\admin\pictures\RepairUnlock.tif.7c14u939	regsvr32.exe
File renamed	C:\Users\Admin\Pictures\RestoreConfirm.tiff => \??\c:\users\admin\pictures\RestoreConfirm.tiff.7c14u939	regsvr32.exe
File renamed	C:\Users\Admin\Pictures\LimitGroup.crw => \??\c:\users\admin\pictures\LimitGroup.crw.7c14u939	regsvr32.exe
File renamed	C:\Users\Admin\Pictures\MeasureProtect.raw => \??\c:\users\admin\pictures\MeasureProtect.raw.7c14u939	regsvr32.exe
File opened for modification	\??\c:\users\admin\pictures\MergeBlock.tiff	regsvr32.exe
File renamed	C:\Users\Admin\Pictures\PingUse.png => \??\c:\users\admin\pictures\PingUse.png.7c14u939	regsvr32.exe
File renamed	C:\Users\Admin\Pictures\CompletePublish.png => \??\c:\users\admin\pictures\CompletePublish.png.7c14u939	regsvr32.exe
File opened for modification	\??\c:\users\admin\pictures\ExpandRegister.tiff	regsvr32.exe
File renamed	C:\Users\Admin\Pictures\MergeBlock.tiff => \??\c:\users\admin\pictures\MergeBlock.tiff.7c14u939	regsvr32.exe
File renamed	C:\Users\Admin\Pictures\MoveUse.tiff => \??\c:\users\admin\pictures\MoveUse.tiff.7c14u939	regsvr32.exe
File opened for modification	\??\c:\users\admin\pictures\RestoreConfirm.tiff	regsvr32.exe

Enumerates connected drives 3 TTPs 25 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\N:	regsvr32.exe
File opened (read-only)	\??\O:	regsvr32.exe
File opened (read-only)	\??\U:	regsvr32.exe
File opened (read-only)	\??\X:	regsvr32.exe
File opened (read-only)	\??\Y:	regsvr32.exe
File opened (read-only)	\??\B:	regsvr32.exe
File opened (read-only)	\??\I:	regsvr32.exe
File opened (read-only)	\??\J:	regsvr32.exe
File opened (read-only)	\??\L:	regsvr32.exe
File opened (read-only)	\??\M:	regsvr32.exe
File opened (read-only)	\??\P:	regsvr32.exe
File opened (read-only)	\??\Q:	regsvr32.exe
File opened (read-only)	\??\D:	regsvr32.exe
File opened (read-only)	\??\E:	regsvr32.exe
File opened (read-only)	\??\H:	regsvr32.exe
File opened (read-only)	\??\V:	regsvr32.exe
File opened (read-only)	\??\W:	regsvr32.exe
File opened (read-only)	\??\G:	regsvr32.exe
File opened (read-only)	\??\K:	regsvr32.exe
File opened (read-only)	\??\R:	regsvr32.exe
File opened (read-only)	\??\S:	regsvr32.exe
File opened (read-only)	\??\T:	regsvr32.exe
File opened (read-only)	\??\Z:	regsvr32.exe
File opened (read-only)	\??\A:	regsvr32.exe
File opened (read-only)	\??\F:	regsvr32.exe

Sets desktop wallpaper using registry 2 TTPs 1 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\lc77w72lx.bmp"	regsvr32.exe

Drops file in Program Files directory 13 IoCs

description	ioc	Process
File opened for modification	\??\c:\program files\UpdateUse.eps	regsvr32.exe
File opened for modification	\??\c:\program files\CheckpointSend.xltm	regsvr32.exe
File opened for modification	\??\c:\program files\CompareWatch.ini	regsvr32.exe
File opened for modification	\??\c:\program files\CloseUpdate.ps1xml	regsvr32.exe
File opened for modification	\??\c:\program files\FindConvertFrom.clr	regsvr32.exe
File opened for modification	\??\c:\program files\FormatUnprotect.contact	regsvr32.exe
File opened for modification	\??\c:\program files\GroupConvertTo.jpeg	regsvr32.exe
File opened for modification	\??\c:\program files\InstallFormat.mpg	regsvr32.exe
File opened for modification	\??\c:\program files\RenameSend.mpeg	regsvr32.exe
File created	\??\c:\program files\7c14u939-readme.txt	regsvr32.exe
File created	\??\c:\program files (x86)\7c14u939-readme.txt	regsvr32.exe
File opened for modification	\??\c:\program files\SwitchStep.txt	regsvr32.exe
File opened for modification	\??\c:\program files\UnpublishFind.asx	regsvr32.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3040	regsvr32.exe
3040	regsvr32.exe

Suspicious use of AdjustPrivilegeToken 8 IoCs

description	pid	Process
Token: SeDebugPrivilege	3040	regsvr32.exe
Token: SeTakeOwnershipPrivilege	3040	regsvr32.exe
Token: SeBackupPrivilege	3880	vssvc.exe
Token: SeRestorePrivilege	3880	vssvc.exe
Token: SeAuditPrivilege	3880	vssvc.exe
Token: SeBackupPrivilege	928	vssvc.exe
Token: SeRestorePrivilege	928	vssvc.exe
Token: SeAuditPrivilege	928	vssvc.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2728 wrote to memory of 3040	2728	regsvr32.exe	68
PID 2728 wrote to memory of 3040	2728	regsvr32.exe	68
PID 2728 wrote to memory of 3040	2728	regsvr32.exe	68

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\dff5690cd1a3474c6cac9dcf8efacdaf51a6be992e70029e21dcacd89cc71f05.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2728
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\dff5690cd1a3474c6cac9dcf8efacdaf51a6be992e70029e21dcacd89cc71f05.dll
  2⤵
  - Modifies extensions of user files
  - Enumerates connected drives
  - Sets desktop wallpaper using registry
  - Drops file in Program Files directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3040