Overview

overview

10

Static

static

YourCyanide_obf.bat

windows7_x64

10

YourCyanide_obf.bat

windows10-2004_x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    YourCyanide_obf.bat
  • Size 136KB
  • Sample220519-wft3jadbgj
  • SHA256 e8266fb4c02fdf3d4b449814100c4839a52ceeeeb175f816b357cb695b4b1751
  • MD5 SHA1 SHA512
Score
10/10
evasionpersistenceransomware

Malware Config

Extracted

Language

  • ps1

Deobfuscated
Source
URLs
  • exe.dropper

    https://cdn.discordapp.com/attachments/974798125011198003/976894591552860220/NoKeyB.exe

Extracted

Language

  • ps1

Deobfuscated
Source
URLs
  • exe.dropper

    https://cdn.discordapp.com/attachments/971160786015772724/971191444410875914/GetToken.exe

Extracted

Path

  • C:\Users\Admin\Desktop\YcynNote.txt

Ransom Note
  • Q: What happened to my files? A: Oops your files have been encrypted by YourCyanide. Q: how can I get them back? A: You can get them back by paying $500 in bitcoin to this btc wallet bc1qrl532s9r2qge8d8p7qlrq57dc4uhssqjexmlwf. Q: What happens if I dont pay? A: You will never get your files back. A: contact at [email protected]. ++++++++++++++++++++++++++++++++++++++++++++ 26647 Files have been encrypted

Targets

    • Target
      YourCyanide_obf.bat
    • Size 136KB
    • SHA256 e8266fb4c02fdf3d4b449814100c4839a52ceeeeb175f816b357cb695b4b1751
    • MD5 SHA1 SHA512
    Score
    10/10
    evasionpersistenceransomware

    • Grants admin privileges

      Uses net.exe to modify the user's privileges.

    • Blocklisted process makes network request

    • Disables Task Manager via registry modification

      evasion

    • Downloads MZ/PE file

    • Executes dropped EXE

    • Modifies Windows Firewall

      evasion

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks