efb0f928648e6988c29bb03bb6b14f2760870f3040f0195ca1c6ad8ac5fa2dee

Analysis

max time kernel
150s
max time network
43s
platform
windows7_x64
resource
win7-20220414-en
submitted
03-06-2022 23:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ransomito.exe
Size

2.1MB
MD5

f48a1057059028a65f2ec37e90d4deec
SHA1

ca8c5636aa98948c3b25153188b98967cc65a42b
SHA256

efb0f928648e6988c29bb03bb6b14f2760870f3040f0195ca1c6ad8ac5fa2dee
SHA512

57d62b07741effba928c92d39b5bd2dfc9c341b237ab1f83ba33e9cdba079a14bec1bbf63333b18f964e982bc510f615314f4426c258538e5be80f0a36c2b0a2

Score

8^/10

evasion ransomware

Malware Config

Signatures

Disables RegEdit via registry modification 1 IoCs

evasion

Processes:

ransomito.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	ransomito.exe

Disables Task Manager via registry modification
evasion

Modifies extensions of user files 4 IoCs

Ransomware generally changes the extension on encrypted files.

ransomware

Processes:

ransomito.exe

description	ioc	process
File opened for modification	C:\Users\Admin\Pictures\CompareCopy.tiff	ransomito.exe
File renamed	C:\Users\Admin\Pictures\CompareCopy.tiff => C:\Users\Admin\Pictures\CompareCopy.tiff.PAY2DECRYPTRLDwcYuR13f3VWL6crJ0rFV	ransomito.exe
File opened for modification	C:\Users\Admin\Pictures\OpenAssert.tiff	ransomito.exe
File renamed	C:\Users\Admin\Pictures\OpenAssert.tiff => C:\Users\Admin\Pictures\OpenAssert.tiff.PAY2DECRYPTRLDwcYuR13f3VWL6crJ0rFV	ransomito.exe

Drops desktop.ini file(s) 18 IoCs

Processes:

ransomito.exe

description	ioc	process
File created	C:\Users\Public\Documents\desktop.ini	ransomito.exe
File created	C:\Users\Public\Recorded TV\desktop.ini	ransomito.exe
File created	C:\Users\Public\Videos\desktop.ini	ransomito.exe
File created	C:\Users\Public\Recorded TV\Sample Media\desktop.ini	ransomito.exe
File created	C:\Users\Admin\Music\desktop.ini	ransomito.exe
File created	C:\Users\Public\desktop.ini	ransomito.exe
File created	C:\Users\Public\Downloads\desktop.ini	ransomito.exe
File created	C:\Users\Public\Pictures\Sample Pictures\desktop.ini	ransomito.exe
File created	C:\Users\Public\Videos\Sample Videos\desktop.ini	ransomito.exe
File created	C:\Users\Admin\Desktop\desktop.ini	ransomito.exe
File created	C:\Users\Admin\Downloads\desktop.ini	ransomito.exe
File created	C:\Users\Public\Desktop\desktop.ini	ransomito.exe
File created	C:\Users\Public\Libraries\desktop.ini	ransomito.exe
File created	C:\Users\Public\Pictures\desktop.ini	ransomito.exe
File created	C:\Users\Admin\Documents\desktop.ini	ransomito.exe
File created	C:\Users\Admin\Pictures\desktop.ini	ransomito.exe
File created	C:\Users\Public\Music\desktop.ini	ransomito.exe
File created	C:\Users\Public\Music\Sample Music\desktop.ini	ransomito.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

C:\Users\Admin\AppData\Local\Temp\ransomito.exe
"C:\Users\Admin\AppData\Local\Temp\ransomito.exe"
1⤵
- Disables RegEdit via registry modification
- Modifies extensions of user files
- Drops desktop.ini file(s)
PID:316

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Web Service

T1102

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads