Analysis
-
max time kernel
160s -
max time network
120s -
platform
windows7_x64 -
resource
win7-en-20211208 -
submitted
31-01-2022 04:00
Static task
static1
Behavioral task
behavioral1
Sample
aaf1c2e67e9049fcbfd9f97302d78837769e1ad20fb2c4f35c69339e95845938.exe
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
aaf1c2e67e9049fcbfd9f97302d78837769e1ad20fb2c4f35c69339e95845938.exe
Resource
win10-en-20211208
General
-
Target
aaf1c2e67e9049fcbfd9f97302d78837769e1ad20fb2c4f35c69339e95845938.exe
-
Size
994KB
-
MD5
0cefce0dbbbedc5eb1febe4d85b23c71
-
SHA1
6aef7d5a462268c438c8417ee0da3f130b8aa84a
-
SHA256
aaf1c2e67e9049fcbfd9f97302d78837769e1ad20fb2c4f35c69339e95845938
-
SHA512
1311cf0b918419c192b3914a01e467430f445aaf6a003338e2176b1527c74263f658d8d39bd6d9c78b70324615101026767034798945d42d25215ee4d45654bf
Malware Config
Extracted
C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\!Decrypt-All-Files-uqvplrh.txt
http://onja764ig6vah2jo.onion.cab
http://onja764ig6vah2jo.tor2web.org
http://onja764ig6vah2jo.onion/
Signatures
-
CTB-Locker
Ransomware family which uses Tor to hide its C2 communications.
-
Executes dropped EXE 2 IoCs
Processes:
wckayle.exewckayle.exepid process 1820 wckayle.exe 684 wckayle.exe -
Modifies extensions of user files 2 IoCs
Ransomware generally changes the extension on encrypted files.
Processes:
svchost.exedescription ioc process File renamed C:\Windows\Temp\laaaaaaa.tmp => C:\Users\Admin\Pictures\MountGrant.RAW.uqvplrh svchost.exe File renamed C:\Windows\Temp\laaaaaaa.tmp => C:\Users\Admin\Pictures\PushUnregister.RAW.uqvplrh svchost.exe -
Loads dropped DLL 1 IoCs
Processes:
wckayle.exepid process 1820 wckayle.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
aaf1c2e67e9049fcbfd9f97302d78837769e1ad20fb2c4f35c69339e95845938.exewckayle.exedescription pid process target process PID 1688 set thread context of 760 1688 aaf1c2e67e9049fcbfd9f97302d78837769e1ad20fb2c4f35c69339e95845938.exe aaf1c2e67e9049fcbfd9f97302d78837769e1ad20fb2c4f35c69339e95845938.exe PID 1820 set thread context of 684 1820 wckayle.exe wckayle.exe -
Drops file in Program Files directory 2 IoCs
Processes:
svchost.exedescription ioc process File created C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\!Decrypt-All-Files-uqvplrh.txt svchost.exe File created C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\!Decrypt-All-Files-uqvplrh.bmp svchost.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
aaf1c2e67e9049fcbfd9f97302d78837769e1ad20fb2c4f35c69339e95845938.exewckayle.exepid process 760 aaf1c2e67e9049fcbfd9f97302d78837769e1ad20fb2c4f35c69339e95845938.exe 684 wckayle.exe 684 wckayle.exe 684 wckayle.exe 684 wckayle.exe 684 wckayle.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
wckayle.exedescription pid process Token: SeDebugPrivilege 684 wckayle.exe Token: SeDebugPrivilege 684 wckayle.exe -
Suspicious use of WriteProcessMemory 28 IoCs
Processes:
aaf1c2e67e9049fcbfd9f97302d78837769e1ad20fb2c4f35c69339e95845938.exetaskeng.exewckayle.exewckayle.exesvchost.exedescription pid process target process PID 1688 wrote to memory of 760 1688 aaf1c2e67e9049fcbfd9f97302d78837769e1ad20fb2c4f35c69339e95845938.exe aaf1c2e67e9049fcbfd9f97302d78837769e1ad20fb2c4f35c69339e95845938.exe PID 1688 wrote to memory of 760 1688 aaf1c2e67e9049fcbfd9f97302d78837769e1ad20fb2c4f35c69339e95845938.exe aaf1c2e67e9049fcbfd9f97302d78837769e1ad20fb2c4f35c69339e95845938.exe PID 1688 wrote to memory of 760 1688 aaf1c2e67e9049fcbfd9f97302d78837769e1ad20fb2c4f35c69339e95845938.exe aaf1c2e67e9049fcbfd9f97302d78837769e1ad20fb2c4f35c69339e95845938.exe PID 1688 wrote to memory of 760 1688 aaf1c2e67e9049fcbfd9f97302d78837769e1ad20fb2c4f35c69339e95845938.exe aaf1c2e67e9049fcbfd9f97302d78837769e1ad20fb2c4f35c69339e95845938.exe PID 1688 wrote to memory of 760 1688 aaf1c2e67e9049fcbfd9f97302d78837769e1ad20fb2c4f35c69339e95845938.exe aaf1c2e67e9049fcbfd9f97302d78837769e1ad20fb2c4f35c69339e95845938.exe PID 1688 wrote to memory of 760 1688 aaf1c2e67e9049fcbfd9f97302d78837769e1ad20fb2c4f35c69339e95845938.exe aaf1c2e67e9049fcbfd9f97302d78837769e1ad20fb2c4f35c69339e95845938.exe PID 1688 wrote to memory of 760 1688 aaf1c2e67e9049fcbfd9f97302d78837769e1ad20fb2c4f35c69339e95845938.exe aaf1c2e67e9049fcbfd9f97302d78837769e1ad20fb2c4f35c69339e95845938.exe PID 1688 wrote to memory of 760 1688 aaf1c2e67e9049fcbfd9f97302d78837769e1ad20fb2c4f35c69339e95845938.exe aaf1c2e67e9049fcbfd9f97302d78837769e1ad20fb2c4f35c69339e95845938.exe PID 1240 wrote to memory of 1820 1240 taskeng.exe wckayle.exe PID 1240 wrote to memory of 1820 1240 taskeng.exe wckayle.exe PID 1240 wrote to memory of 1820 1240 taskeng.exe wckayle.exe PID 1240 wrote to memory of 1820 1240 taskeng.exe wckayle.exe PID 1820 wrote to memory of 684 1820 wckayle.exe wckayle.exe PID 1820 wrote to memory of 684 1820 wckayle.exe wckayle.exe PID 1820 wrote to memory of 684 1820 wckayle.exe wckayle.exe PID 1820 wrote to memory of 684 1820 wckayle.exe wckayle.exe PID 1820 wrote to memory of 684 1820 wckayle.exe wckayle.exe PID 1820 wrote to memory of 684 1820 wckayle.exe wckayle.exe PID 1820 wrote to memory of 684 1820 wckayle.exe wckayle.exe PID 1820 wrote to memory of 684 1820 wckayle.exe wckayle.exe PID 684 wrote to memory of 576 684 wckayle.exe svchost.exe PID 576 wrote to memory of 1308 576 svchost.exe wmiprvse.exe PID 576 wrote to memory of 1308 576 svchost.exe wmiprvse.exe PID 576 wrote to memory of 1308 576 svchost.exe wmiprvse.exe PID 576 wrote to memory of 1768 576 svchost.exe DllHost.exe PID 576 wrote to memory of 1768 576 svchost.exe DllHost.exe PID 576 wrote to memory of 1768 576 svchost.exe DllHost.exe PID 684 wrote to memory of 1412 684 wckayle.exe Explorer.EXE
Processes
-
C:\Users\Admin\AppData\Local\Temp\aaf1c2e67e9049fcbfd9f97302d78837769e1ad20fb2c4f35c69339e95845938.exe"C:\Users\Admin\AppData\Local\Temp\aaf1c2e67e9049fcbfd9f97302d78837769e1ad20fb2c4f35c69339e95845938.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\aaf1c2e67e9049fcbfd9f97302d78837769e1ad20fb2c4f35c69339e95845938.exe"C:\Users\Admin\AppData\Local\Temp\aaf1c2e67e9049fcbfd9f97302d78837769e1ad20fb2c4f35c69339e95845938.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k DcomLaunch1⤵
- Modifies extensions of user files
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\wbem\wmiprvse.exeC:\Windows\system32\wbem\wmiprvse.exe -Embedding2⤵
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}2⤵
-
C:\Windows\system32\taskeng.exetaskeng.exe {7D3B04BE-9000-4BD4-8EB3-DB1D8422DF6A} S-1-5-18:NT AUTHORITY\System:Service:1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\wckayle.exeC:\Users\Admin\AppData\Local\Temp\wckayle.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\wckayle.exeC:\Users\Admin\AppData\Local\Temp\wckayle.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\ProgramData\Microsoft\bduhcziMD5
3737dc6a1da4b78f4ca9780c79b056a8
SHA1ce9eea6b2983b692fe49a1d74e90536eb3aa29cf
SHA2566f108fff44bef589ef293c491758bc5e3706ac32959b7b29e7b8c4f5c6e4bf19
SHA5124f62362718938ab551290b2403a69cad1947b3b6555f1c55856c40fa9ca303f3aabcf5b524e1e3ee77fab7722969a9749948dc80ce9b3e8fa4b8adcc6178b5aa
-
C:\ProgramData\Microsoft\bduhcziMD5
6e760de5096fa5c12bf151a5c37debf3
SHA1beb1b82a083cc0201bdd3ae78a14f0c0f71e7211
SHA256a7cef84a0b3bd791609c150d5c9d8a551277425a8fe6e25f9b7c734272810dd4
SHA51273b3b5f2f194f3a2d465302d391fd33c7d8287f49ea8e33738ec06be9c0e5e6d8b7bdd1767245838f31e5c1f61016f9bd9dac3a7b56792ce9ae76fb58aeb17a5
-
C:\ProgramData\Microsoft\bduhcziMD5
a6243717d20d7d21cd61ce418ad5b29c
SHA1d064a1a1fd2af8c54cff4233c785df43ce340c1d
SHA2567a527fb8b966f6f133151ed68ba3335539f7882ef2a925f681634e81aa67e9ab
SHA512f4fbe48c111967acfa94d6b3d3fc1769bfb6a51f53af21cdee5c59398db545451f6c11df297393ba77e07ee6f9b294e7acc3a7e637ecb89a15a44b14df6a198c
-
C:\ProgramData\Microsoft\bduhcziMD5
a6243717d20d7d21cd61ce418ad5b29c
SHA1d064a1a1fd2af8c54cff4233c785df43ce340c1d
SHA2567a527fb8b966f6f133151ed68ba3335539f7882ef2a925f681634e81aa67e9ab
SHA512f4fbe48c111967acfa94d6b3d3fc1769bfb6a51f53af21cdee5c59398db545451f6c11df297393ba77e07ee6f9b294e7acc3a7e637ecb89a15a44b14df6a198c
-
C:\Users\Admin\AppData\Local\Temp\wckayle.exeMD5
0cefce0dbbbedc5eb1febe4d85b23c71
SHA16aef7d5a462268c438c8417ee0da3f130b8aa84a
SHA256aaf1c2e67e9049fcbfd9f97302d78837769e1ad20fb2c4f35c69339e95845938
SHA5121311cf0b918419c192b3914a01e467430f445aaf6a003338e2176b1527c74263f658d8d39bd6d9c78b70324615101026767034798945d42d25215ee4d45654bf
-
C:\Users\Admin\AppData\Local\Temp\wckayle.exeMD5
0cefce0dbbbedc5eb1febe4d85b23c71
SHA16aef7d5a462268c438c8417ee0da3f130b8aa84a
SHA256aaf1c2e67e9049fcbfd9f97302d78837769e1ad20fb2c4f35c69339e95845938
SHA5121311cf0b918419c192b3914a01e467430f445aaf6a003338e2176b1527c74263f658d8d39bd6d9c78b70324615101026767034798945d42d25215ee4d45654bf
-
C:\Users\Admin\AppData\Local\Temp\wckayle.exeMD5
0cefce0dbbbedc5eb1febe4d85b23c71
SHA16aef7d5a462268c438c8417ee0da3f130b8aa84a
SHA256aaf1c2e67e9049fcbfd9f97302d78837769e1ad20fb2c4f35c69339e95845938
SHA5121311cf0b918419c192b3914a01e467430f445aaf6a003338e2176b1527c74263f658d8d39bd6d9c78b70324615101026767034798945d42d25215ee4d45654bf
-
\Users\Admin\AppData\Local\Temp\wckayle.exeMD5
0cefce0dbbbedc5eb1febe4d85b23c71
SHA16aef7d5a462268c438c8417ee0da3f130b8aa84a
SHA256aaf1c2e67e9049fcbfd9f97302d78837769e1ad20fb2c4f35c69339e95845938
SHA5121311cf0b918419c192b3914a01e467430f445aaf6a003338e2176b1527c74263f658d8d39bd6d9c78b70324615101026767034798945d42d25215ee4d45654bf
-
memory/576-73-0x0000000000580000-0x00000000005F7000-memory.dmpFilesize
476KB
-
memory/576-74-0x0000000000580000-0x00000000005F7000-memory.dmpFilesize
476KB
-
memory/576-77-0x000007FEFC3C1000-0x000007FEFC3C3000-memory.dmpFilesize
8KB
-
memory/684-72-0x0000000000BD0000-0x0000000000E1B000-memory.dmpFilesize
2.3MB
-
memory/760-62-0x0000000000C70000-0x0000000000EBB000-memory.dmpFilesize
2.3MB
-
memory/760-61-0x0000000000400000-0x00000000004A5000-memory.dmpFilesize
660KB
-
memory/760-59-0x0000000000A50000-0x0000000000C6A000-memory.dmpFilesize
2.1MB
-
memory/760-58-0x0000000000400000-0x00000000004A5000-memory.dmpFilesize
660KB
-
memory/760-57-0x0000000000400000-0x00000000004A5000-memory.dmpFilesize
660KB
-
memory/1688-54-0x0000000075AB1000-0x0000000075AB3000-memory.dmpFilesize
8KB
-
memory/1688-56-0x0000000000A10000-0x0000000000A30000-memory.dmpFilesize
128KB
-
memory/1688-55-0x0000000001FB0000-0x0000000001FB1000-memory.dmpFilesize
4KB