Analysis
-
max time kernel
175s -
max time network
183s -
platform
windows10-2004_x64 -
resource
win10v2004-en-20220113 -
submitted
11-02-2022 06:50
General
-
Target
66658b354eb9f48c64dd7c5add4b562395cbae39f53085b08461e61f51d10d7f.exe
-
Size
55KB
-
MD5
c7d02bf2230853298ebccd17f5fd54a2
-
SHA1
4b737abe273228c2d7a2656aa12f1ea591b3f10e
-
SHA256
66658b354eb9f48c64dd7c5add4b562395cbae39f53085b08461e61f51d10d7f
-
SHA512
2d24f156faa09d622360b5a0e549eb7d8400d7004ea8febb88b3aa54bcf9c4a628e846bc99c9740aa30ec956dfed33b4f314ecb8f8f41eb898fc244fe9fb857e
Score
10/10
Malware Config
Extracted
Path
C:\how_to_back_files.html
Ransom Note
<html>
<style type="text/css">
body {
background-color: #404040;
}
{
margin: 0;
padding: 0;
}
h1, h3{
text-align: center;
text-transform: uppercase;
font-weight: normal;
}
/*---*/
.tabs1{
width: 800px;
display: block;
margin: auto;
position: relative;
}
.tabs1 .head{
text-align: center;
float: top;
text-transform: uppercase;
font-weight: normal;
display: block;
padding: 15px;
color: #000000;
background: #4A83FD;
}
.tabs1 .identi {
margin-left: 15px;
line-height: 13px;
font-size: 13px;
text-align: center;
float: top;
display: block;
padding: 15px;
background: #303030;
color: #DFDFDF;
}
/*---*/
.tabs{
width: 800px;
display: block;
margin: auto;
position: relative;
}
.tabs .tab{
float: left;
display: block;
}
.tabs .tab>input[type="radio"] {
position: absolute;
top: -9999px;
left: -9999px;
}
.tabs .tab>label {
display: block;
padding: 6px 21px;
font-size: 18x;
text-transform: uppercase;
cursor: pointer;
position: relative;
color: #FFF;
background: #4A83FD;
}
.tabs .content {
z-index: 0;/* or display: none; */
overflow: hidden;
width: 800px;
/*padding: 25px;*/
position: absolute;
top: 32px;
left: 0;
background: #303030;
color: #DFDFDF;
opacity:0;
transition: opacity 400ms ease-out;
}
.tabs .content .text{
width: 700px;
padding: 25px;
}
.tabs>.tab>[id^="tab"]:checked + label {
top: 0;
background: #303030;
color: #F5F5F5;
}
.tabs>.tab>[id^="tab"]:checked ~ [id^="tab-content"] {
z-index: 1;/* or display: block; */
opacity: 1;
transition: opacity 400ms ease-out;
}
</style>
<head>
<meta charset="utf-8">
<title>HOW TO DECRYPT YOUR FILES</title>
</head>
<body>
<div class="tabs1">
<div class="head" ><h3>Your personal ID</h3></div>
<div class="identi">
<pre>���������������55 79 BE 10 D7 8B 81 3D C7 FD 28 42 93 AA F7 1B
42 55 B8 50 DC 83 00 54 51 B8 1B C9 F5 F6 1E 48
FF 48 8E 14 C2 3D 90 D8 E7 7D 9A 05 27 00 7B 03
AB E3 AB 5A 36 E2 19 48 32 80 63 EB 89 30 A4 8B
89 C7 80 77 44 E5 9A 3A 5E 8A 6F 5F 42 A1 BA 86
99 85 07 6D 0A 67 26 8E 55 47 35 63 8B 2F 44 60
2D E2 8F 96 2E 6A E4 4C CC DE 32 48 2D B3 19 EC
DF 6A A8 57 D6 9A 53 C9 2A 62 AA 06 6F DA 55 E3
49 2B 17 5D 73 34 30 CC 32 63 F5 29 18 FE 11 F7
A1 44 04 17 6F 9C 03 1C 3E 6C EE 02 60 B7 D3 CE
EB 48 26 33 7C 09 CA 9A C6 82 25 E8 EE AB AD 8F
74 50 0C 00 C4 03 77 C5 7C B8 E9 A8 F1 36 17 45
04 51 94 67 27 A1 EC 25 9D 71 4C 9A 88 84 F0 25
94 17 F3 3A D4 E4 89 29 17 9B D0 96 E7 1C 65 A2
24 12 7B 47 81 C2 30 8B 11 0B 89 DC 9E 31 C9 20
00 62 9F 34 82 EE 04 62 02 01 89 FE D1 70 FF CF
</pre><!-- !!! dont changing this !!! -->
</div>
</div>
<!-- -->
<div class="tabs">
<!--tab-->
<div class="tab">
<input type="radio" name="tabs" checked="checked" id="tab1" />
<label for="tab1">English</label>
<div id="tab-content1" class="content">
<h1>☠ Your files are encrypted! ☠</h1>
<hr/>
<h3>How to quickly restore all files and protect data ?</h3>
<div class="text">
<!--text data -->
<p> Write a letter with this question to <span> [email protected]</span>.</br>
We really can help, make sure of this, attach to the letter an encrypted file (less than 5mb), and specify in the letter your personal ID (look at the beginning of this document).</p>
In the response letter you will receive a decrypted file and a complete recovery instruction.</p>
Save your time, write to <span> [email protected]</span> right now.</br>
<p>
</p>
</br>
<h3><center>Attention!</center></h3>
<ul>
<li>In one week all encrypted files will be destroyed.</li>
<li>Only [email protected] can decrypt your files</li>
<li>Attempts to self-decrypting files or run anti-virus tools will result in the loss of your data</li>
<li>Decoders other users are not compatible with your data, because each user's unique encryption key</li>
<li>If you have not received a response to your message for more than 12 hours, write to an alternate email address <span>[email protected]</span></li>
</ul>
<!--text data -->
</div>
</div>
</div>
<!--tab-->
</ul>
<!--text data -->
</div>
</div>
<!--tab-->
</div>
</div>
</body>
</html>
�����������
Emails
Signatures
-
Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs
-
Adds Run key to start application 2 TTPs 2 IoCs
-
Drops desktop.ini file(s) 9 IoCs
-
Drops file in Windows directory 6 IoCs
-
Program crash 2 IoCs
-
Enumerates system info in registry 2 TTPs 2 IoCs
-
Modifies data under HKEY_USERS 1 IoCs
-
Modifies registry class 33 IoCs
-
Suspicious use of AdjustPrivilegeToken 12 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
-
Suspicious use of WriteProcessMemory 5 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\66658b354eb9f48c64dd7c5add4b562395cbae39f53085b08461e61f51d10d7f.exe"C:\Users\Admin\AppData\Local\Temp\66658b354eb9f48c64dd7c5add4b562395cbae39f53085b08461e61f51d10d7f.exe"1⤵
- Adds Run key to start application
- Drops desktop.ini file(s)
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s wuauserv1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 1768 -s 43682⤵
- Program crash
-
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 1768 -s 43682⤵
- Program crash
-
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k netsvcs -p -s BITS1⤵
- Modifies data under HKEY_USERS
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k appmodel -p -s camsvc1⤵
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -pss -s 440 -p 1768 -ip 17681⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Suspicious use of WriteProcessMemory
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
16KB
-
Filesize
16KB