Analysis
-
max time kernel
97s -
max time network
102s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
08-06-2022 03:19
General
-
Target
1a6bed2afff1b9880e42a29cea9b8139bcb12e34085fb008de13aa983b82a4f2.exe
-
Size
164KB
-
MD5
5f2d13576e4906501c91b8bf400e0890
-
SHA1
adff2761a6afe9ecaa70486c0a04746c676a133b
-
SHA256
1a6bed2afff1b9880e42a29cea9b8139bcb12e34085fb008de13aa983b82a4f2
-
SHA512
29186d7c1702ab738844777a780ce982882727d8fb3ae6e1fd084bffef3ac63fcd7ca4624ee9bf047c909c303deece27f81650b1309280d6609d207e29131dfd
Score
10/10
Malware Config
Extracted
Path
C:\Users\Admin\Desktop\README_DECRYPT_HYDRA_ID_d3e7b4d.txt
Ransom Note
Attention!
All Your files and documents were encrypted!
Encryption was made with a special crypto-code!
There NO CHANCE to decrypt it without our special software and
your unique private key!
To buy your software You need to contact us by EMAIL:
1) [email protected]
or
2) [email protected]
Your email text should contain your unique ID number and one of your encrypted file.
We will decrypt one of your file for FREE! It`s your guarantee!
Remember! Your time has a limit: 72 hour.
If You will not send any email We will turn on a sanctions:
1) Your software`s price will be higher
2) Your unique private key will be destroyed (After that your files will stay encrypted forever)
3) Your private info, files, documents will be sold on the Dark Markets
Attention: all your attempts to decrypt your PC without our software can destroy or damage your files!
Signatures
-
HydraCrypt
Relatively unsophisticated ransomware family based on leaked CrypBoss source code.
-
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Modifies extensions of user files 26 IoCs
Ransomware generally changes the extension on encrypted files.
-
Drops startup file 3 IoCs
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 3 IoCs
-
Drops desktop.ini file(s) 64 IoCs
-
Enumerates connected drives 3 TTPs 24 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
-
Suspicious use of SetThreadContext 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 1 IoCs
-
Interacts with shadow copies 2 TTPs 27 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
-
Runs net.exe
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 43 IoCs
-
Suspicious use of SetWindowsHookEx 2 IoCs
-
Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\1a6bed2afff1b9880e42a29cea9b8139bcb12e34085fb008de13aa983b82a4f2.exe"C:\Users\Admin\AppData\Local\Temp\1a6bed2afff1b9880e42a29cea9b8139bcb12e34085fb008de13aa983b82a4f2.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\1a6bed2afff1b9880e42a29cea9b8139bcb12e34085fb008de13aa983b82a4f2.exeC:\Users\Admin\AppData\Local\Temp\1a6bed2afff1b9880e42a29cea9b8139bcb12e34085fb008de13aa983b82a4f2.exe2⤵
- Modifies extensions of user files
- Drops startup file
- Adds Run key to start application
- Drops desktop.ini file(s)
- Enumerates connected drives
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C net stop vss3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\net.exenet stop vss4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop vss5⤵
-
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C vssadmin Delete Shadows /All3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\vssadmin.exevssadmin Delete Shadows /All4⤵
- Interacts with shadow copies
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C wmic shadowcopy delete3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\Wbem\WMIC.exewmic shadowcopy delete4⤵
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C vssadmin Delete Shadows /For=Z: /All3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\vssadmin.exevssadmin Delete Shadows /For=Z: /All4⤵
- Interacts with shadow copies
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C vssadmin Delete Shadows /For=Y: /All3⤵
-
C:\Windows\SysWOW64\vssadmin.exevssadmin Delete Shadows /For=Y: /All4⤵
- Interacts with shadow copies
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C vssadmin Delete Shadows /For=X: /All3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\vssadmin.exevssadmin Delete Shadows /For=X: /All4⤵
- Interacts with shadow copies
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C vssadmin Delete Shadows /For=W: /All3⤵
-
C:\Windows\SysWOW64\vssadmin.exevssadmin Delete Shadows /For=W: /All4⤵
- Interacts with shadow copies
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C vssadmin Delete Shadows /For=V: /All3⤵
-
C:\Windows\SysWOW64\vssadmin.exevssadmin Delete Shadows /For=V: /All4⤵
- Interacts with shadow copies
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C vssadmin Delete Shadows /For=U: /All3⤵
-
C:\Windows\SysWOW64\vssadmin.exevssadmin Delete Shadows /For=U: /All4⤵
- Interacts with shadow copies
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C vssadmin Delete Shadows /For=T: /All3⤵
-
C:\Windows\SysWOW64\vssadmin.exevssadmin Delete Shadows /For=T: /All4⤵
- Interacts with shadow copies
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C vssadmin Delete Shadows /For=S: /All3⤵
-
C:\Windows\SysWOW64\vssadmin.exevssadmin Delete Shadows /For=S: /All4⤵
- Interacts with shadow copies
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C vssadmin Delete Shadows /For=R: /All3⤵
-
C:\Windows\SysWOW64\vssadmin.exevssadmin Delete Shadows /For=R: /All4⤵
- Interacts with shadow copies
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C vssadmin Delete Shadows /For=Q: /All3⤵
-
C:\Windows\SysWOW64\vssadmin.exevssadmin Delete Shadows /For=Q: /All4⤵
- Interacts with shadow copies
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C vssadmin Delete Shadows /For=P: /All3⤵
-
C:\Windows\SysWOW64\vssadmin.exevssadmin Delete Shadows /For=P: /All4⤵
- Interacts with shadow copies
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C vssadmin Delete Shadows /For=O: /All3⤵
-
C:\Windows\SysWOW64\vssadmin.exevssadmin Delete Shadows /For=O: /All4⤵
- Interacts with shadow copies
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C vssadmin Delete Shadows /For=N: /All3⤵
-
C:\Windows\SysWOW64\vssadmin.exevssadmin Delete Shadows /For=N: /All4⤵
- Interacts with shadow copies
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C vssadmin Delete Shadows /For=M: /All3⤵
-
C:\Windows\SysWOW64\vssadmin.exevssadmin Delete Shadows /For=M: /All4⤵
- Interacts with shadow copies
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C vssadmin Delete Shadows /For=L: /All3⤵
-
C:\Windows\SysWOW64\vssadmin.exevssadmin Delete Shadows /For=L: /All4⤵
- Interacts with shadow copies
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C vssadmin Delete Shadows /For=K: /All3⤵
-
C:\Windows\SysWOW64\vssadmin.exevssadmin Delete Shadows /For=K: /All4⤵
- Interacts with shadow copies
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C vssadmin Delete Shadows /For=J: /All3⤵
-
C:\Windows\SysWOW64\vssadmin.exevssadmin Delete Shadows /For=J: /All4⤵
- Interacts with shadow copies
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C vssadmin Delete Shadows /For=H: /All3⤵
-
C:\Windows\SysWOW64\vssadmin.exevssadmin Delete Shadows /For=H: /All4⤵
- Interacts with shadow copies
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C vssadmin Delete Shadows /For=I: /All3⤵
-
C:\Windows\SysWOW64\vssadmin.exevssadmin Delete Shadows /For=I: /All4⤵
- Interacts with shadow copies
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C vssadmin Delete Shadows /For=G: /All3⤵
-
C:\Windows\SysWOW64\vssadmin.exevssadmin Delete Shadows /For=G: /All4⤵
- Interacts with shadow copies
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C vssadmin Delete Shadows /For=F: /All3⤵
-
C:\Windows\SysWOW64\vssadmin.exevssadmin Delete Shadows /For=F: /All4⤵
- Interacts with shadow copies
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C vssadmin Delete Shadows /For=E: /All3⤵
-
C:\Windows\SysWOW64\vssadmin.exevssadmin Delete Shadows /For=E: /All4⤵
- Interacts with shadow copies
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C vssadmin Delete Shadows /For=D: /All3⤵
-
C:\Windows\SysWOW64\vssadmin.exevssadmin Delete Shadows /For=D: /All4⤵
- Interacts with shadow copies
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C vssadmin Delete Shadows /For=C: /All3⤵
-
C:\Windows\SysWOW64\vssadmin.exevssadmin Delete Shadows /For=C: /All4⤵
- Interacts with shadow copies
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C vssadmin Delete Shadows /For=B: /All3⤵
-
C:\Windows\SysWOW64\vssadmin.exevssadmin Delete Shadows /For=B: /All4⤵
- Interacts with shadow copies
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C vssadmin Delete Shadows /For=A: /All3⤵
-
C:\Windows\SysWOW64\vssadmin.exevssadmin Delete Shadows /For=A: /All4⤵
- Interacts with shadow copies
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1648 -s 80083⤵
- Program crash
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
-
-
-
-
Filesize
20KB
-
Filesize
8KB
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
Filesize
5.5MB
-
Filesize
5.5MB
-
Filesize
5.5MB
-
Filesize
56KB
-
Filesize
1024KB
-
Filesize
5.5MB
-
Filesize
56KB
-
Filesize
5.5MB
-
Filesize
5.5MB
-
Filesize
5.5MB
-
-
Filesize
5.5MB
-
Filesize
5.5MB
-
Filesize
5.5MB
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-