Analysis
-
max time kernel
173s -
max time network
199s -
platform
windows10-2004_x64 -
resource
win10v2004-en-20220112 -
submitted
11-02-2022 06:36
General
-
Target
b59c1e665e2a6cd43c8e906239b6b5991f1205bc5298a9131384953be4a484a1.exe
-
Size
115KB
-
MD5
ea469ffdeb5e04efbc225017500f4d4c
-
SHA1
bde1e9e537081757c864d2ad50007bf1cb928849
-
SHA256
b59c1e665e2a6cd43c8e906239b6b5991f1205bc5298a9131384953be4a484a1
-
SHA512
487d419811a2aec7e5b3a154590d696eb7e2626f014ebea5feaa7c50bf4b0f276d860243c5bcf5e380a8f97232b5a595a6a1dc434dd55cc395389c915bcda94f
Score
10/10
Malware Config
Extracted
Path
C:\how_to_back_files.html
Ransom Note
<html>
<head>
<meta charset="windows-1251">
<title>HOW TO DECRYPT YOUR FILES</title>
<HTA:APPLICATION
ICON="UserAccountControlSettings.exe"
/>
<script language="JScript">
window.moveTo(50, 50);
window.resizeTo(screen.width - 100, screen.height - 100);
</script>
<style type="text/css">
body {
font: 15px Tahoma, sans-serif;
margin: 10px;
line-height: 25px;
background: #EDEDED;
}
.bold {
font-weight: bold;
}
.mark {
background: #D0D0E8;
padding: 2px 5px;
}
.header {
font-size: 30px;
height: 50px;
line-height: 50px;
font-weight: bold;
border-bottom: 10px solid #D0D0E8;
}
.info {
background: #D0D0E8;
border-left: 10px solid #00008B;
}
.alert {
background: #FFE4E4;
border-left: 10px solid #FF0000;
}
.private {
border: 1px dashed #000;
background: #FFFFEF;
}
.note {
height: auto;
padding-bottom: 1px;
margin: 15px 0;
}
.note .title {
font-weight: bold;
text-indent: 10px;
height: 30px;
line-height: 30px;
padding-top: 10px;
}
.note .mark {
background: #A2A2B5;
}
.note ul {
margin-top: 0;
}
.note pre {
margin-left: 15px;
line-height: 13px;
font-size: 13px;
}
</style>
</head>
<body>
<div class="header">All your files have been encrypted!</div>
<div class="note private">
<div class="title">Your personal ID</div>
<pre>�4C 0A B7 09 90 46 D4 FD 54 F0 95 5C 8A 24 A9 26
12 FA 56 94 52 61 91 75 D0 35 D4 97 80 39 FD 8C
A7 AC 51 BC FD 54 5E 30 DE 3D 51 1E 90 D9 52 27
6D 27 C0 D0 EA D6 0D 60 F6 9C 94 29 1A 50 FB 3D
09 8A FA 14 4C 6F DA 28 09 D6 3E 3E BC B8 E3 1B
0C A6 12 8B 9C 2B 32 7B B6 57 4D 90 FF D6 E1 B8
BB E0 4E 62 08 DE B3 A7 8E EF AC B1 8D E9 E3 9F
69 68 C8 C4 6F 4D FC 96 9F 9D 89 E8 27 F4 24 22
BC 1D 6C 66 B7 5F 44 D4 A6 44 33 74 CC 5E AF C8
89 10 5A 61 B6 39 ED D2 73 7D 42 07 6E A7 A5 EE
BF 36 91 BC 50 5E 99 E1 F9 A5 F4 10 A4 AB 2D 1F
A1 AD C9 D5 FB 0D C3 58 25 2D 59 56 84 F8 56 9B
FB 6E 74 E2 1A AC D9 56 A7 43 77 BA D2 98 4F 15
12 E8 0C 8D CC F3 BC 3A 53 1E 78 D3 58 45 78 02
28 75 A7 98 FD 96 92 59 AE 22 82 AB DD B6 58 25
C7 66 A9 A5 F3 48 DA 9C B4 45 C0 32 C9 35 08 88
</pre><!-- !!! do not change !!! -->
</div>
<div class="bold">All your files have been encrypted due to a security problem with your PC.</div>
<div class="bold">If you want to restore them, write us to the e-mail:<font color="FF0000">[email protected]</font></div>
<div class="bold">Additional Mailing Address e-mail:<font color="FF0000">[email protected]</font></div>
<div class="note info">
<div class="title">How to obtain Bitcoins</div>
<ul>
<li>The easiest way to buy bitcoins is LocalBitcoins site. You have to register, click 'Buy bitcoins', and select the seller by payment method and price.
<li><a href="https://localbitcoins.com/buy_bitcoins">https://localbitcoins.com/buy_bitcoins</a></li>
<li>Also you can find other places to buy Bitcoins and beginners guide here:
<li><a href="http://www.coindesk.com/information/how-can-i-buy-bitcoins/">http://www.coindesk.com/information/how-can-i-buy-bitcoins/</a></li>
</ul>
</div>
<div class="note info">
<div class="title">Free decryption as guarantee</div>
<ul>
<li>Before paying you can send to us up to 1 files for free decryption. Please note that files must NOT contain valuable information and their total size must be less than 1Mb</li>
</ul>
</div>
<div class="note alert">
<div class="title">Attention!</div>
<ul>
<li>Do not rename encrypted files.</li>
<li>Do not try to decrypt your data using third party software, it may cause permanent data loss.</li>
<li>Decryption of your files with the help of third parties may cause increased price (they add their fee to our) or you can become a victim of a scam.
</li>
</ul>
</div>
</body>
</html>�����
Emails
color="FF0000">[email protected]</font></div>
color="FF0000">[email protected]</font></div>
Signatures
-
Adds Run key to start application 2 TTPs 2 IoCs
-
Drops desktop.ini file(s) 9 IoCs
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes
-
C:\Users\Admin\AppData\Local\Temp\b59c1e665e2a6cd43c8e906239b6b5991f1205bc5298a9131384953be4a484a1.exe"C:\Users\Admin\AppData\Local\Temp\b59c1e665e2a6cd43c8e906239b6b5991f1205bc5298a9131384953be4a484a1.exe"1⤵
- Adds Run key to start application
- Drops desktop.ini file(s)
-
C:\Windows\system32\MusNotifyIcon.exe%systemroot%\system32\MusNotifyIcon.exe NotifyTrayIcon 131⤵
- Checks processor information in registry