36e4a3de5c4395d295bdf1d70a215d9669b626c58083ec2d8ab29513830faaa6

General

Target
kings.exe
Size 72KB
Sample220126-2aezbabbfq
SHA256 36e4a3de5c4395d295bdf1d70a215d9669b626c58083ec2d8ab29513830faaa6
MD5 5c754da92f7301dc2e44c65df7c2f0ca
SHA1 13fb3bcb9bceb9b8448004b650b37968df84eb70
SHA512 13a2eb67b9e401bf2b61bb0e91fee87cbbf08aa9c05ad58b49914c43ba0c86980a8360bb93ec843ef729a08d74357cd5dcac30ac9d2343b64285d32be9ab23b6
MD5 SHA1 SHA512

Score

10^/10

ransomware

Path

Ransom Note

Hello, friends! Your system has been compromised by our team.We have blocked your files and also uploaded useful data from your computers(doc, docx, pdf, xls and other office extensions) to our servers. You have 2 days to contact us to discuss the terms of payment for our services to restore your files.If you do not contact us or refuse to pay, we will place your stolen files in the public domain. Do not change the file namesand extensions.Do not try to decrypt the files yourself, they are encrypted using a good encryption algorithm. Main Mail: [email protected] Backup mail(if we don't reply 24 hours): [email protected] At the first contact, you can write to both emails for reliability.

Emails

Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware

File Deletion
T1107

Inhibit System Recovery
T1490

Modifies extensions of user files 15 IoCs

Ransomware generally changes the extension on encrypted files.

description	ioc	Process
File renamed	C:\Users\Admin\Pictures\InstallRequest.png => C:\Users\Admin\Pictures\InstallRequest.png.kings	kings.exe
File renamed	C:\Users\Admin\Pictures\SuspendSkip.tif => C:\Users\Admin\Pictures\SuspendSkip.tif.kings	kings.exe
File renamed	C:\Users\Admin\Pictures\HideConvert.tif => C:\Users\Admin\Pictures\HideConvert.tif.kings	kings.exe
File renamed	C:\Users\Admin\Pictures\SubmitLimit.tiff => C:\Users\Admin\Pictures\SubmitLimit.tiff.kings	kings.exe
File opened for modification	C:\Users\Admin\Pictures\SubmitLimit.tiff.kings	kings.exe
File opened for modification	C:\Users\Admin\Pictures\SuspendSkip.tif.kings	kings.exe
File opened for modification	C:\Users\Admin\Pictures\HideConvert.tif.kings	kings.exe
File opened for modification	C:\Users\Admin\Pictures\SubmitLimit.tiff	kings.exe
File renamed	C:\Users\Admin\Pictures\UnlockSubmit.png => C:\Users\Admin\Pictures\UnlockSubmit.png.kings	kings.exe
File opened for modification	C:\Users\Admin\Pictures\UnlockSubmit.png.kings	kings.exe
File opened for modification	C:\Users\Admin\Pictures\InstallRequest.png.kings	kings.exe
File renamed	C:\Users\Admin\Pictures\MountDisable.crw => C:\Users\Admin\Pictures\MountDisable.crw.kings	kings.exe
File opened for modification	C:\Users\Admin\Pictures\MountDisable.crw.kings	kings.exe
File renamed	C:\Users\Admin\Pictures\RepairTest.crw => C:\Users\Admin\Pictures\RepairTest.crw.kings	kings.exe
File opened for modification	C:\Users\Admin\Pictures\RepairTest.crw.kings	kings.exe

Enumerates connected drives 3 TTPs 24 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

Peripheral Device Discovery

System Information Discovery

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Interacts with shadow copies 2 TTPs 2 IoCs

Shadow copies are often targeted by ransomware to inhibit system recovery.

File Deletion

Inhibit System Recovery

pid	Process
1336	vssadmin.exe
1756	vssadmin.exe

Opens file in notepad (likely ransom note) 1 IoCs

pid	Process
1008	NOTEPAD.EXE

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
868	kings.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 868 wrote to memory of 1916	868	kings.exe	27
PID 868 wrote to memory of 1916	868	kings.exe	27
PID 868 wrote to memory of 1916	868	kings.exe	27
PID 868 wrote to memory of 1916	868	kings.exe	27
PID 1916 wrote to memory of 1336	1916	cmd.exe	29
PID 1916 wrote to memory of 1336	1916	cmd.exe	29
PID 1916 wrote to memory of 1336	1916	cmd.exe	29
PID 868 wrote to memory of 1304	868	kings.exe	35
PID 868 wrote to memory of 1304	868	kings.exe	35
PID 868 wrote to memory of 1304	868	kings.exe	35
PID 868 wrote to memory of 1304	868	kings.exe	35
PID 1304 wrote to memory of 1756	1304	cmd.exe	37
PID 1304 wrote to memory of 1756	1304	cmd.exe	37
PID 1304 wrote to memory of 1756	1304	cmd.exe	37

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:576

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Public\Desktop\RestoreFiles.txt
1⤵
- Opens file in notepad (likely ransom note)
PID:1008