General
-
Target
RIP_YOUR_PC_LOL.exe
-
Size
5.8MB
-
Sample
220504-pxnhradgb6
-
MD5
637e757d38a8bf22ebbcd6c7a71b8d14
-
SHA1
0e711a8292de14d5aa0913536a1ae03ddfb933ec
-
SHA256
477c13d4ca09fdb7fea6487641c6a904d4dee1adecd74ac42e0b00a3842503f9
-
SHA512
e7a3576370967a4cbd53c33bf65ae26881cca3f713df5bdbcdc9ed76b79e9102c26d5bf940fc2a0e880c7b7ab83c13dcad24608d23981cbcaf551d4e800c67ac
Static task
static1
Behavioral task
behavioral1
Sample
RIP_YOUR_PC_LOL.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
RIP_YOUR_PC_LOL.exe
Resource
win10v2004-20220414-en
Malware Config
Extracted
C:\DECRYPT-FILES.txt
maze
http://aoacugmutagkwctu.onion/6b3b0c9b61af485f
https://mazedecrypt.top/6b3b0c9b61af485f
Extracted
Protocol: ftp- Host:
files.000webhost.com - Port:
21 - Username:
fcb-aws-host-4
Extracted
njrat
im523
Bot
DanilWhiteNjrat-57320.portmap.host:57320
802f813d3810aa536753efbd3390b541
-
reg_key
802f813d3810aa536753efbd3390b541
-
splitter
|'|'|
Extracted
C:\Users\Admin\Desktop\@[email protected]
wannacry
115p7UMMngoj1pMvkpHijcRdfJNXj6LrLn
Extracted
C:\DECRYPT-FILES.txt
maze
http://aoacugmutagkwctu.onion/6de30ce638de491
https://mazedecrypt.top/6de30ce638de491
Targets
-
-
Target
RIP_YOUR_PC_LOL.exe
-
Size
5.8MB
-
MD5
637e757d38a8bf22ebbcd6c7a71b8d14
-
SHA1
0e711a8292de14d5aa0913536a1ae03ddfb933ec
-
SHA256
477c13d4ca09fdb7fea6487641c6a904d4dee1adecd74ac42e0b00a3842503f9
-
SHA512
e7a3576370967a4cbd53c33bf65ae26881cca3f713df5bdbcdc9ed76b79e9102c26d5bf940fc2a0e880c7b7ab83c13dcad24608d23981cbcaf551d4e800c67ac
-
DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
-
Process spawned unexpected child process
This typically indicates the parent process was compromised via an exploit or macro.
-
suricata: ET MALWARE Maze/ID Ransomware Activity
suricata: ET MALWARE Maze/ID Ransomware Activity
-
NirSoft MailPassView
Password recovery tool for various email clients
-
NirSoft WebBrowserPassView
Password recovery tool for various web browsers
-
Nirsoft
-
Blocklisted process makes network request
-
Executes dropped EXE
-
Modifies Windows Firewall
-
Modifies extensions of user files
Ransomware generally changes the extension on encrypted files.
-
Office macro that triggers on suspicious action
Office document macro which triggers in special circumstances - often malicious.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Drops startup file
-
Loads dropped DLL
-
Modifies file permissions
-
Uses the VBS compiler for execution
-
Accesses Microsoft Outlook accounts
-
Adds Run key to start application
-
Legitimate hosting services abused for malware hosting/C2
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Drops file in System32 directory
-
Sets desktop wallpaper using registry
-
Suspicious use of SetThreadContext
-
MITRE ATT&CK Enterprise v6
Persistence
Hidden Files and Directories
1Modify Existing Service
1Registry Run Keys / Startup Folder
1Scheduled Task
1Defense Evasion
Bypass User Account Control
1Disabling Security Tools
1File Deletion
1File and Directory Permissions Modification
1Hidden Files and Directories
1Modify Registry
6Scripting
1Web Service
1