Analysis

  • max time kernel
    172s
  • max time network
    175s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220414-en
  • submitted
    25-06-2022 02:09

General

  • Target

    bffc07c822218280045b3de30a010b16e7dc3e8e24b66eafa502d2d1b09bd7d3.exe

  • Size

    552KB

  • MD5

    f864a5f13e37bab86d97343b4d16ea59

  • SHA1

    d068383fecb14f38b58ba76a79d6cd8ea616cadd

  • SHA256

    bffc07c822218280045b3de30a010b16e7dc3e8e24b66eafa502d2d1b09bd7d3

  • SHA512

    58ea72ffeef34ec3699e55ab0fa049709c184a4d13710c910ed089e0bbf75637fc54d5a59aa92e9b52478b8f2220fe514a28c7d5e029ed197b5c753b81671b3b

Malware Config

Extracted

Path

C:\Restore-My-Files.txt

Ransom Note
All your files are Encrypted! For data recovery needs decryptor. How to buy decryptor: ---------------------------------------------------------------------------------------- | 1. Download Tor browser - https://www.torproject.org/ and install it. | 2. Open link in TOR browser - http://decrmbgpvh6kvmti.onion/ | 3. Follow the instructions on this page ---------------------------------------------------------------------------------------- Note! This link is available via "Tor Browser" only. ------------------------------------------------------------ Free decryption as guarantee. Before paying you can send us 1 file for free decryption. ------------------------------------------------------------ alternate address - http://helpinfh6vj47ift.onion/ DO NOT CHANGE DATA BELOW ###s6dlsnhtjwbhr###�����������44 07 EA 05 E8 F0 CE 9A 29 AF B4 FF E6 A9 5F 4B 91 D6 23 6B 01 EE F0 DA CD 09 06 E9 26 1A 19 F1 9F 67 26 43 53 CB D3 2C 44 67 F9 B2 CA FC 88 67 80 A7 27 0B F6 82 B9 52 AC EB 39 58 4E E7 C8 0B E8 39 55 FF 39 EC 74 26 11 68 32 48 AB B9 D4 9C 01 1A B0 6D F9 AF AF A9 81 A7 7E 18 2D FD 4B 8B E2 0B BE 21 22 05 FA F6 80 64 59 DC 86 54 99 39 99 66 58 CD A3 44 73 76 78 46 94 83 D4 EF 39 C2 DF F1 77 89 BC 2D D5 9A BE B5 6A 70 43 F6 C7 A8 74 BE 9C DD 27 EA 49 7D 92 5D D5 08 D0 00 14 85 CD 7B 8D 2D 40 B9 00 29 6D A0 71 5C 81 79 3A 99 2F 5B 1B B9 46 70 30 33 05 07 BA FF 84 C7 A0 4B 7C 93 59 74 2A 87 CB 83 B5 05 44 3F 2E AB C0 AD F9 82 8B CF 82 E5 6E 08 AB D0 B3 29 A5 0F 69 0D CD 5D 5E 44 A3 84 7F DB 72 0F 57 B5 C6 CF 51 5F 4B 06 3A EF CB B7 CF 61 DC 1F 49 99 44 61 A0 BE ###�������������
URLs

http://decrmbgpvh6kvmti.onion/

http://helpinfh6vj47ift.onion/

Signatures

  • GlobeImposter

    GlobeImposter is a ransomware first seen in 2017.

  • Lockbit

    Ransomware family with multiple variants released since late 2019.

  • Modifies extensions of user files 10 IoCs

    Ransomware generally changes the extension on encrypted files.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Adds Run key to start application 2 TTPs 2 IoCs
  • Drops desktop.ini file(s) 24 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\bffc07c822218280045b3de30a010b16e7dc3e8e24b66eafa502d2d1b09bd7d3.exe
    "C:\Users\Admin\AppData\Local\Temp\bffc07c822218280045b3de30a010b16e7dc3e8e24b66eafa502d2d1b09bd7d3.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:4740
    • C:\Users\Admin\AppData\Local\Temp\bffc07c822218280045b3de30a010b16e7dc3e8e24b66eafa502d2d1b09bd7d3.exe
      C:\Users\Admin\AppData\Local\Temp\bffc07c822218280045b3de30a010b16e7dc3e8e24b66eafa502d2d1b09bd7d3.exe"
      2⤵
      • Modifies extensions of user files
      • Adds Run key to start application
      • Drops desktop.ini file(s)
      PID:4988

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/4740-134-0x0000000002270000-0x0000000002277000-memory.dmp

    Filesize

    28KB

  • memory/4740-136-0x0000000002270000-0x0000000002277000-memory.dmp

    Filesize

    28KB

  • memory/4740-137-0x00007FFE30D30000-0x00007FFE30F25000-memory.dmp

    Filesize

    2.0MB

  • memory/4740-138-0x0000000077630000-0x00000000777D3000-memory.dmp

    Filesize

    1.6MB

  • memory/4988-139-0x0000000000400000-0x000000000049A000-memory.dmp

    Filesize

    616KB

  • memory/4988-140-0x0000000000400000-0x000000000040E000-memory.dmp

    Filesize

    56KB

  • memory/4988-141-0x00007FFE30D30000-0x00007FFE30F25000-memory.dmp

    Filesize

    2.0MB

  • memory/4988-143-0x0000000000400000-0x000000000049A000-memory.dmp

    Filesize

    616KB

  • memory/4988-142-0x0000000077630000-0x00000000777D3000-memory.dmp

    Filesize

    1.6MB

  • memory/4988-144-0x00000000005B0000-0x00000000005B7000-memory.dmp

    Filesize

    28KB

  • memory/4988-146-0x0000000077630000-0x00000000777D3000-memory.dmp

    Filesize

    1.6MB

  • memory/4988-145-0x00007FFE30D30000-0x00007FFE30F25000-memory.dmp

    Filesize

    2.0MB