Overview

overview

10

Static

static

66658b354e...7f.exe

windows7_x64

10

66658b354e...7f.exe

windows10-2004_x64

10

Analysis

  • max time kernel
    175s
  • max time network
    183s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-en-20220113
  • submitted
    11/02/2022, 06:50

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    66658b354eb9f48c64dd7c5add4b562395cbae39f53085b08461e61f51d10d7f.exe
  • Size 55KB
  • Sample220211-hmbmwacaa9
  • SHA256 66658b354eb9f48c64dd7c5add4b562395cbae39f53085b08461e61f51d10d7f
  • MD5 SHA1 SHA512
Score
10/10
persistenceransomware

Malware Config

Extracted

Path

  • C:\how_to_back_files.html

Ransom Note
  • <html> <style type="text/css"> body { background-color: #404040; } { margin: 0; padding: 0; } h1, h3{ text-align: center; text-transform: uppercase; font-weight: normal; } /*---*/ .tabs1{ width: 800px; display: block; margin: auto; position: relative; } .tabs1 .head{ text-align: center; float: top; text-transform: uppercase; font-weight: normal; display: block; padding: 15px; color: #000000; background: #4A83FD; } .tabs1 .identi { margin-left: 15px; line-height: 13px; font-size: 13px; text-align: center; float: top; display: block; padding: 15px; background: #303030; color: #DFDFDF; } /*---*/ .tabs{ width: 800px; display: block; margin: auto; position: relative; } .tabs .tab{ float: left; display: block; } .tabs .tab>input[type="radio"] { position: absolute; top: -9999px; left: -9999px; } .tabs .tab>label { display: block; padding: 6px 21px; font-size: 18x; text-transform: uppercase; cursor: pointer; position: relative; color: #FFF; background: #4A83FD; } .tabs .content { z-index: 0;/* or display: none; */ overflow: hidden; width: 800px; /*padding: 25px;*/ position: absolute; top: 32px; left: 0; background: #303030; color: #DFDFDF; opacity:0; transition: opacity 400ms ease-out; } .tabs .content .text{ width: 700px; padding: 25px; } .tabs>.tab>[id^="tab"]:checked + label { top: 0; background: #303030; color: #F5F5F5; } .tabs>.tab>[id^="tab"]:checked ~ [id^="tab-content"] { z-index: 1;/* or display: block; */ opacity: 1; transition: opacity 400ms ease-out; } </style> <head> <meta charset="utf-8"> <title>HOW TO DECRYPT YOUR FILES</title> </head> <body> <div class="tabs1"> <div class="head" ><h3>Your personal ID</h3></div> <div class="identi"> <pre>���������������55 79 BE 10 D7 8B 81 3D C7 FD 28 42 93 AA F7 1B 42 55 B8 50 DC 83 00 54 51 B8 1B C9 F5 F6 1E 48 FF 48 8E 14 C2 3D 90 D8 E7 7D 9A 05 27 00 7B 03 AB E3 AB 5A 36 E2 19 48 32 80 63 EB 89 30 A4 8B 89 C7 80 77 44 E5 9A 3A 5E 8A 6F 5F 42 A1 BA 86 99 85 07 6D 0A 67 26 8E 55 47 35 63 8B 2F 44 60 2D E2 8F 96 2E 6A E4 4C CC DE 32 48 2D B3 19 EC DF 6A A8 57 D6 9A 53 C9 2A 62 AA 06 6F DA 55 E3 49 2B 17 5D 73 34 30 CC 32 63 F5 29 18 FE 11 F7 A1 44 04 17 6F 9C 03 1C 3E 6C EE 02 60 B7 D3 CE EB 48 26 33 7C 09 CA 9A C6 82 25 E8 EE AB AD 8F 74 50 0C 00 C4 03 77 C5 7C B8 E9 A8 F1 36 17 45 04 51 94 67 27 A1 EC 25 9D 71 4C 9A 88 84 F0 25 94 17 F3 3A D4 E4 89 29 17 9B D0 96 E7 1C 65 A2 24 12 7B 47 81 C2 30 8B 11 0B 89 DC 9E 31 C9 20 00 62 9F 34 82 EE 04 62 02 01 89 FE D1 70 FF CF </pre><!-- !!! dont changing this !!! --> </div> </div> <!-- --> <div class="tabs"> <!--tab--> <div class="tab"> <input type="radio" name="tabs" checked="checked" id="tab1" /> <label for="tab1">English</label> <div id="tab-content1" class="content"> <h1>&#9760; Your files are encrypted! &#9760;</h1> <hr/> <h3>How to quickly restore all files and protect data ?</h3> <div class="text"> <!--text data --> <p> Write a letter with this question to <span> [email protected]</span>.</br> We really can help, make sure of this, attach to the letter an encrypted file (less than 5mb), and specify in the letter your personal ID (look at the beginning of this document).</p> In the response letter you will receive a decrypted file and a complete recovery instruction.</p> Save your time, write to <span> [email protected]</span> right now.</br> <p> </p> </br> <h3><center>Attention!</center></h3> <ul> <li>In one week all encrypted files will be destroyed.</li> <li>Only [email protected] can decrypt your files</li> <li>Attempts to self-decrypting files or run anti-virus tools will result in the loss of your data</li> <li>Decoders other users are not compatible with your data, because each user's unique encryption key</li> <li>If you have not received a response to your message for more than 12 hours, write to an alternate email address <span>[email protected]</span></li> </ul> <!--text data --> </div> </div> </div> <!--tab--> </ul> <!--text data --> </div> </div> <!--tab--> </div> </div> </body> </html> �����������
Emails

Signatures

  • Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Drops desktop.ini file(s) 9 IoCs
  • Drops file in Windows directory 6 IoCs
  • Program crash 2 IoCs
  • Enumerates system info in registry 2 TTPs 2 IoCs
  • Modifies data under HKEY_USERS 1 IoCs
  • Modifies registry class 33 IoCs
  • Suspicious use of AdjustPrivilegeToken 12 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 5 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\66658b354eb9f48c64dd7c5add4b562395cbae39f53085b08461e61f51d10d7f.exe
    "C:\Users\Admin\AppData\Local\Temp\66658b354eb9f48c64dd7c5add4b562395cbae39f53085b08461e61f51d10d7f.exe"
    1⤵
    • Adds Run key to start application
    • Drops desktop.ini file(s)
    PID:1452
  • C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k netsvcs -p -s wuauserv
    1⤵
    • Drops file in Windows directory
    • Suspicious use of AdjustPrivilegeToken
    PID:1012
  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
    1⤵
    • Enumerates system info in registry
    • Modifies registry class
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1768
    • C:\Windows\system32\WerFault.exe
      C:\Windows\system32\WerFault.exe -u -p 1768 -s 4368
      2⤵
      • Program crash
      PID:4040
    • C:\Windows\system32\WerFault.exe
      C:\Windows\system32\WerFault.exe -u -p 1768 -s 4368
      2⤵
      • Program crash
      PID:4508
  • C:\Windows\System32\svchost.exe
    C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
    1⤵
    • Modifies data under HKEY_USERS
    PID:660
  • C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k appmodel -p -s camsvc
    1⤵
      PID:3724
    • C:\Windows\system32\WerFault.exe
      C:\Windows\system32\WerFault.exe -pss -s 440 -p 1768 -ip 1768
      1⤵
      • Suspicious use of NtCreateProcessExOtherParentProcess
      • Suspicious use of WriteProcessMemory
      PID:5020

    Network

          MITRE ATT&CK Enterprise v6

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          memory/660-130-0x000001D03D360000-0x000001D03D370000-memory.dmp
          Download

          memory/660-131-0x000001D03D3C0000-0x000001D03D3D0000-memory.dmp
          Download

          memory/660-141-0x000001D03F960000-0x000001D03F964000-memory.dmp
          Download

          memory/1012-142-0x000001FA0B540000-0x000001FA0B544000-memory.dmp
          Download