Analysis
-
max time kernel
167s -
max time network
173s -
platform
windows10-2004_x64 -
resource
win10v2004-en-20220113 -
submitted
11-02-2022 06:56
General
-
Target
53c444745c8fb794e800f8634af9986c6e0e4b025d760950409bb823a461d718.exe
-
Size
105KB
-
MD5
467cceb1ab90bf50dc35f65dc513a483
-
SHA1
907c7792120b5aee6970b4b13747a729fbd59f7d
-
SHA256
53c444745c8fb794e800f8634af9986c6e0e4b025d760950409bb823a461d718
-
SHA512
e85f314c33cb521ea3dabec4b2fcfde61a5bab2e5b06a2eb0268f0c35c510318a6510dd77bc2bfa11b7350533adf659895a440ee1496d335843dfad712121f1c
Score
10/10
Malware Config
Extracted
Path
C:\0_HELP_DECRYPT_FILE.html
Ransom Note
<html>
<head>
<meta charset="utf-8">
<title>0_HELP_DECRYPT_FILES</title>
<style type="text/css">
body {
font: 15px Tahoma, sans-serif;
margin: 10px;
line-height: 25px;
background-color: #EDEDED;
}
.bold {
font-weight: bold;
}
.xx {
border: 1px dashed #000;
background: #E3D5F1;
}
.mark {
background: #D0D0E8;
padding: 2px 5px;
}
.header {
font-size: 30px;
height: 50px;
line-height: 50px;
font-weight: bold;
border-bottom: 10px solid #D0D0E8;
}
.info {
background: #D0D0E8;
border-left: 10px solid #00008B;
}
.alert {
background: #FFE4E4;
border-left: 10px solid #FF0000;
}
.private {
border: 1px dashed #000;
background: #FFFFEF;
}
.note {
height: auto;
padding-bottom: 1px;
margin: 15px 0;
}
.note .title {
font-weight: bold;
text-indent: 10px;
height: 30px;
line-height: 30px;
padding-top: 10px;
}
.note .mark {
background: #A2A2B5;
}
.note ul {
margin-top: 0;
}
.note pre {
margin-left: 15px;
line-height: 13px;
font-size: 13px;
}
</style>
</head>
<body>
<div class="header">What happened to my files ?</div>
<div class="bold">All your files have been encrypted due to a security problem with your PC. If you want to restore them, write us to the e-mail [email protected] or [email protected]
</div>
<div class="note private">
<div class="title">Your personal ID</div>
<pre>8C 42 2A A3 33 42 70 11 8D 5B 68 59 EB C7 F5 6A
0A 4C 51 85 8B F1 9A 46 F2 6A 4A 83 29 A0 DE A1
5A 2B 01 B0 46 E8 EF F3 42 F8 B2 50 0A 04 E0 B5
29 B8 61 89 51 81 24 B5 75 B0 54 FA 97 9A D2 BD
BD ED 3F D8 BD CC 75 47 E9 19 8E 64 7E 62 F8 EF
BD 5B E7 34 7B 15 EC 71 B5 32 B7 EF 1F 77 80 2C
C8 65 88 1C 01 21 A6 AC FF 75 C1 95 AF 2E 18 93
C4 9A A4 36 09 67 0A 4A A5 68 55 35 30 4D A4 F7
AD 2B 35 9C F5 D3 FB 21 B6 59 35 88 23 8A 32 6C
D0 30 A2 03 2F 87 6A AF 02 68 36 BE C8 DB FF 5E
DF A7 08 61 78 26 DB DF A5 5F 6C 17 0A 3F EA BE
13 E2 35 A6 D5 CA E6 BD AC F1 1F 78 EA E0 04 2C
9C 68 C2 83 CF 8B AC 77 74 1E D8 A6 64 D0 9E 74
37 9C A0 FB 00 69 5F 78 EE 40 DC 5E 52 50 A5 4F
0D 4F 5D 24 C0 88 58 29 E2 EB D6 C8 73 6A 32 6F
FA B9 5E 52 30 68 FF 60 07 54 CA B7 C4 77 7A C1
</pre><!-- !!! CTpoкy He MeHяTb !!! -->
</div>
<div class="bold">
<div align="left">Write this ID in the title of your message</div>
</div>
<div class="bold">In case of no answer in 24 hours write us to theese e-mails: [email protected] or [email protected]
You have to pay for decryption in Bitcoins. The price depends on how fast you write to us. After payment we will send you the decryption tool that will decrypt all your files</div>
<div>
<h3 align="center">Free decryption as guarantee</h3>
<h5 align="left">Before paying you can send us up to 3 files for free decryption. The total size of files must be less than 10Mb (non archived), and files should not contain valuable information. (databases,backups, large excel sheets, etc.) </h5>
<div class="note xx">
<div align="left">
<h3>How to obtain Bitcoins<br>
</h3>
</div>
<div align="left"> <strong>Here are our recommendations:</strong> </div>
<div align="left">
<li><strong>If you have no Bitcoin address register https://blockchain.info/wallet</strong></li>
<li><strong>fill up your wallet some of the ways:</strong></li>
<li><strong>Btcdirect.eu - Good service for Europe</strong></li>
<li><strong>Bittylicious.com - Bitcoins through Visa / MC or through SEPA (EC) transfer</strong></li>
<li><strong>Localbitcoins.com - Here you can find people who want to sell Bitcoins directly (WU, in cash, SEPA, Paypal u.s.).</strong></li>
<li><strong>Cex.io - buy bitcoins with Visa / Mastercard or Wire Transfer.</strong></li>
<li><strong>Coincafe.com - Designed for quick and easy service. Payment methods: Western Union, Bank of America, cash by FedEx, Moneygram, as money transfer</strong></li>
<li><strong>Bitstamp.net - well known and established Bitcoins seller</strong></li>
<li><strong>Coinmama.com - Visa / Mastercard</strong></li>
<li><strong>Btc-e.com - Bitcoins vendor (Visa / Mastercard, etc.)</strong></li>
<li><strong>If you have not found any bitcoins in your region, try to find them here:</strong></li>
<li><strong>Buybitcoinworldwide.com - International Bicoins Exchange Directory</strong></li>
<li><strong>Bitcoin-net.com - Another directory of Bitcoins sellers</strong></li>
<li><strong>Howtobuybitcoins.info - International Bicoins Exchange Directory</strong></li>
<li><strong>Bittybot.co/eu - Directory for countries of the European Union</strong></li>
<li><strong>write to Google how to buy Bitcoin in your country?</strong></li>
</ol>
</div>
<div align="left">
</div>
<div class="note alert">
<div class="title">Attention!</div>
<ul><li>Do not rename encrypted files.</li>
<li>Do not rename encrypted files.</li>
<li>Decryption of your files with the help of third parties may cause increased price (they add their fee to our) or you can become a victim of a scam.</li>
</ul>
</div>
</body>
</html>
Signatures
-
Modifies system executable filetype association 2 TTPs 1 IoCs
-
Neshta
Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.
-
Suspicious use of NtCreateProcessExOtherParentProcess 2 IoCs
-
Executes dropped EXE 1 IoCs
-
Modifies extensions of user files 9 IoCs
Ransomware generally changes the extension on encrypted files.
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops desktop.ini file(s) 23 IoCs
-
Drops file in Program Files directory 64 IoCs
-
Drops file in Windows directory 7 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 2 IoCs
-
Checks processor information in registry 2 TTPs 6 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Enumerates system info in registry 2 TTPs 10 IoCs
-
Modifies data under HKEY_USERS 1 IoCs
-
Modifies registry class 64 IoCs
-
Suspicious behavior: EnumeratesProcesses 6 IoCs
-
Suspicious use of AdjustPrivilegeToken 6 IoCs
-
Suspicious use of SetWindowsHookEx 3 IoCs
-
Suspicious use of WriteProcessMemory 7 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\53c444745c8fb794e800f8634af9986c6e0e4b025d760950409bb823a461d718.exe"C:\Users\Admin\AppData\Local\Temp\53c444745c8fb794e800f8634af9986c6e0e4b025d760950409bb823a461d718.exe"1⤵
- Modifies system executable filetype association
- Checks computer location settings
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\3582-490\53c444745c8fb794e800f8634af9986c6e0e4b025d760950409bb823a461d718.exe"C:\Users\Admin\AppData\Local\Temp\3582-490\53c444745c8fb794e800f8634af9986c6e0e4b025d760950409bb823a461d718.exe"2⤵
- Executes dropped EXE
- Modifies extensions of user files
- Drops desktop.ini file(s)
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k netsvcs -p -s BITS1⤵
- Modifies data under HKEY_USERS
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 4944 -s 43482⤵
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -pss -s 428 -p 4944 -ip 49441⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s wuauserv1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 4084 -s 38642⤵
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -pss -s 360 -p 4084 -ip 40841⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Suspicious use of WriteProcessMemory
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\INetCache\Q5MJBNZQ\X6j0qPgNij1n_IogMJrgYaT9Kp8[1].jsMD5
8c82fd065b817078dd8befefd90db935
SHA13e92d13ea6a8f09419f52253a3af06d007620898
SHA256c5af42879c3d89b2d309c0f30a1bc8231da6fe4377528133f219923654c9b177
SHA5128837a5f5a661fea36697e8e62347cce6256ab884e5c1ac5ca474a3aba1d9ff8ffeb31da982e3febd54fde37ac206a0a60946c32e0d465c019a08a63eba584829
-
C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\3ZL5QLBD\www.bing[1].xmlMD5
d63a83d5e4e34d47ae55ea16456432aa
SHA12dd06a77d5b45d7b630676d124cd37f2d6cce94a
SHA2568e331487bec5a02f001a60d85ece3c3e6cb92e260ba3323a878a642c10171b66
SHA512606a8d2d0ef85f06282ddb255a5dc711cf4ff289dcceba70cdadc9127d4c6d22a76ddb2033f2253f010ae197234194bd5b500eb5fcbb8d8dee738dac9728bf43
-
C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\3ZL5QLBD\www.bing[1].xmlMD5
5e5877ffacf0a0ebfcece7c62853b4c9
SHA1808b323bb0eb5cf3171d0c7a234008ee1ae0dd9f
SHA256fa48d6e4ce33dd55685cf599671749b3ba348db27183c43c68a97f71863e8a50
SHA512d865515eb254186c8e8b81786e3dc082104f83f894f6143330b3773efbc5819653cd531b571d0b03d79b82c9a9d4a22b3f66955544b7dafde217d762ce8f0360
-
C:\Users\Admin\AppData\Local\Temp\3582-490\53c444745c8fb794e800f8634af9986c6e0e4b025d760950409bb823a461d718.exeMD5
694034feb1457fc087fcf8bfdbbeb1a5
SHA1c2732292c3d8b9e39b5e09e2fa0c07a9523201db
SHA256a65f644e5b9be65233b0e826ad5f8ecfd0f084c656a667c91fd7405dd98b5c48
SHA5123ea14a798cc7714e354c7ab0cbe690f58a21b3c086a16593a3a6d2a079bce1b7d74fdaf270037b3cb4af50024998491111c376ad0f372fe872dbb0f6ece8b428
-
C:\Users\Admin\AppData\Local\Temp\3582-490\53c444745c8fb794e800f8634af9986c6e0e4b025d760950409bb823a461d718.exeMD5
694034feb1457fc087fcf8bfdbbeb1a5
SHA1c2732292c3d8b9e39b5e09e2fa0c07a9523201db
SHA256a65f644e5b9be65233b0e826ad5f8ecfd0f084c656a667c91fd7405dd98b5c48
SHA5123ea14a798cc7714e354c7ab0cbe690f58a21b3c086a16593a3a6d2a079bce1b7d74fdaf270037b3cb4af50024998491111c376ad0f372fe872dbb0f6ece8b428
-
C:\Users\All Users\Adobe\Setup\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\setup.exeMD5
21047a4f4a46269068cc7c1c01a71cef
SHA17d2e76671340543f9d8f8ed1eb8e0ce9c87ac01f
SHA256a72a3b660eb3ab04fde1aa6159fc13cd6b1e71e6c3c24731d8e02ce7d1930939
SHA512f6d92c73999f52f0dfc019c04f3d89d41496812adbcd702959c2975ecf810fcde2662b824efaf77ffaece64665c629f5175aefef377a4b9659510d85f9e68a92
-
memory/2164-134-0x000002507FF60000-0x000002507FF70000-memory.dmpFilesize
64KB
-
memory/2164-135-0x0000025000100000-0x0000025000110000-memory.dmpFilesize
64KB
-
memory/2164-142-0x00000250026C0000-0x00000250026C4000-memory.dmpFilesize
16KB
-
memory/3728-154-0x0000025F5BDD0000-0x0000025F5BDD4000-memory.dmpFilesize
16KB