Analysis

  • max time kernel
    175s
  • max time network
    186s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-en-20220112
  • submitted
    11-02-2022 06:52

General

  • Target

    5e8dd811f63242d2bbc7cfd2c276c5783f68b44c89eb3a71c117854cc0ba7875.exe

  • Size

    55KB

  • MD5

    9d18249b677fbc70d5d7280884ee4aba

  • SHA1

    fce7f8dca532c5a7c442edd6803fdcabaa4218ca

  • SHA256

    5e8dd811f63242d2bbc7cfd2c276c5783f68b44c89eb3a71c117854cc0ba7875

  • SHA512

    d71f8930081e171bb53d7b187a34b4ccf58dc00a0dd1f7d4a438b1a11cb0c362d30eb9fd7ef2ba9317d86348970e79f3552435d8fc38563cf74e9a517641ba8d

Score
10/10

Malware Config

Extracted

Path

C:\how_to_back_files.html

Ransom Note
<html> <style type="text/css"> body { background-color: #FFFFFF; } { margin: 0; padding: 0; } h1, h3{ text-align: center; text-transform: uppercase; font-weight: normal; } /*---*/ .tabs1{ width: 800px; display: block; margin: auto; position: relative; } .tabs1 .head{ text-align: center; float: top; text-transform: uppercase; font-weight: normal; display: block; padding: 15px; color: #000000; background: #FFFFFFF; } .tabs1 .identi { margin-left: 15px; line-height: 13px; font-size: 13px; text-align: center; float: top; display: block; padding: 15px; background: #FFFFFF; color: #000000; } /*---*/ .tabs{ width: 800px; display: block; margin: auto; position: relative; } .tabs .tab{ float: left; display: block; } .tabs .tab>input[type="radio"] { position: absolute; top: -9999px; left: -9999px; } .tabs .tab>label { display: block; padding: 6px 21px; font-size: 18x; text-transform: uppercase; cursor: pointer; position: relative; color: #000000; background: #000000; } .tabs .content { z-index: 0;/* or display: none; */ overflow: hidden; width: 800px; /*padding: 25px;*/ position: absolute; top: 32px; left: 0; background: #FFFFFFF; color: #000000; opacity:0; transition: opacity 400ms ease-out; } .tabs .content .text{ width: 700px; padding: 25px; } .tabs>.tab>[id^="tab"]:checked + label { top: 0; background: #303030; color: #000000; } .tabs>.tab>[id^="tab"]:checked ~ [id^="tab-content"] { z-index: 1;/* or display: block; */ opacity: 1; transition: opacity 400ms ease-out; } </style> <head> <meta charset="utf-8"> <title>HOW TO DECRYPT YOUR FILES</title> </head> <body> <div class="tabs1"> <div class="head" ><h3>Your personal ID</h3></div> <div class="identi"> <pre>����������74 A3 10 61 CD 20 76 9B 66 6F 4D FB FB BF 55 D3 D3 BD 3A 40 F1 44 78 5B 2A 39 38 2A 9F A6 6A 36 BA 4E BE FE C5 A7 3B 94 F6 4B 67 4F ED D1 D6 E2 2C 24 6A D9 F9 3B CD 09 6E 07 A3 25 7B 31 4B C4 50 69 FC D9 53 C7 0D 42 94 9A E3 40 8D 9A 31 F0 2C 69 98 26 86 83 DF EF 88 4B FE 5E 01 40 9D C4 F1 6F EF C2 91 CE 11 3A 0D 13 4A 82 14 88 63 01 87 36 89 1A A2 47 3E 8C A6 4A 89 00 63 20 6A B6 38 E8 0A 99 24 FE 47 E0 F3 12 1C B8 71 27 FA 30 B2 2D 51 10 80 58 F0 82 40 16 2C 27 63 0B 75 3B 65 EC B4 3D D5 0D 2C 81 70 27 01 9A 49 DA 63 67 D4 0E 8F 53 A7 B6 6C 9F 7C 5B 93 E2 C2 0C 96 33 3A 49 1A 05 3C 34 DB FE BC 7E 79 49 B9 FC EB 46 04 7F B8 A4 3D A1 F7 F9 59 00 3C 76 DE 43 17 23 44 2E 22 C4 67 25 9C F8 B4 5D 37 47 AC 62 5D F5 58 47 72 A6 40 F1 10 D6 09 E9 67 EF 7B 74 34 72 </pre><!-- !!! dont changing this !!! --> </div> </div> <!-- --> <div class="tabs"> <!--tab--> <div class="tab"> <input type="radio" name="tabs" checked="checked" id="tab1" /> <label for="tab1">English</label> <div id="tab-content1" class="content"> <h1>&#9760; Your files are encrypted! &#9760;</h1> <hr/> <br/> <div class="text"> <!--text data --> Data recovery requires a decoder.</br> To get the decoder, you must:</br> <p>1. Send us an emaill:<span> [email protected] </span>.</p> In the letter include your personal identifier (written at the beginning of this document) and the external IP address of the device on which the encrypted files are stored.</p> 2. We will send you instructions on how to pay the decryption and after payment, you will receive a decoder. <p>* We can decrypt one file as evidence that we have a decoder. <br/>Send 1 test file (it must be an image or a text file) to the email address: <span> [email protected]<span>. <br/>We will provide you with a decrypted file.<p> 3.Send a copy of the letter to the second email address: <span>[email protected]<span> <br/> <br/> <center>Attention!</center> <br/> <ul> <li>Only we can decrypt your files</li> <li>Do not try to uninstall the program or run antivirus tools</li> <li>Attempts to self-decode the files will lead to the loss of your data</li> <li>If you did not receive a response from us, check the spam or try using a different email address and email us again.</li> </ul> <!--text data --> </div> </div> </div> <!--tab--> </ul> <!--text data --> </div> </div> <!--tab--> </div> </div> </body> </html> �������
Emails

Signatures

  • Adds Run key to start application 2 TTPs 2 IoCs
  • Drops desktop.ini file(s) 9 IoCs
  • Drops file in Windows directory 1 IoCs
  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies data under HKEY_USERS 45 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\5e8dd811f63242d2bbc7cfd2c276c5783f68b44c89eb3a71c117854cc0ba7875.exe
    "C:\Users\Admin\AppData\Local\Temp\5e8dd811f63242d2bbc7cfd2c276c5783f68b44c89eb3a71c117854cc0ba7875.exe"
    1⤵
    • Adds Run key to start application
    • Drops desktop.ini file(s)
    PID:2912
  • C:\Windows\system32\MusNotifyIcon.exe
    %systemroot%\system32\MusNotifyIcon.exe NotifyTrayIcon 13
    1⤵
    • Checks processor information in registry
    PID:1008
  • C:\Windows\System32\svchost.exe
    C:\Windows\System32\svchost.exe -k NetworkService -p
    1⤵
    • Drops file in Windows directory
    • Modifies data under HKEY_USERS
    PID:3016

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads