Analysis

  • max time kernel
    1691s
  • max time network
    1704s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    13-09-2022 17:54

General

  • Target

    RansomwareSamples/Cuba_08_03_2021_1130KB.exe

  • Size

    1.1MB

  • MD5

    a12e733ddbe6f404b27474fa0e5de61d

  • SHA1

    e8d0c95621a19131ef9480e58a8d6dd3d15c9acd

  • SHA256

    271ef3c1d022829f0b15f2471d05a28d4786abafd0a9e1e742bde3f6b36872ad

  • SHA512

    f27605a283e958690eb7ad50aa46110b6d155217ad09d658ad3f9c4368d4c66ab623a0cc3489d695a02db462fec3bcf8ebee13f9da1bd61e2e3db46de2d73ddf

  • SSDEEP

    12288:xtwee4XgIijsCMtcTCWVRapiyC9vwic8CPK3EOnA+u+:8efgIiICMtIChp8N2K3EOAK

Score
10/10

Malware Config

Extracted

Path

\??\Volume{5d2b4a7c-0000-0000-0000-d01200000000}\odt\!!FAQ for Decryption!!.txt

Ransom Note
Good day. All your files are encrypted. For decryption contact us. Write here aam_sysadmin@protonmail.com We also inform that your databases, ftp server and file server were downloaded by us to our servers. * Do not rename encrypted files. * Do not try to decrypt your data using third party software, it may cause permanent data loss.
Emails

aam_sysadmin@protonmail.com

Signatures

  • Suspicious behavior: EnumeratesProcesses 14 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\RansomwareSamples\Cuba_08_03_2021_1130KB.exe
    "C:\Users\Admin\AppData\Local\Temp\RansomwareSamples\Cuba_08_03_2021_1130KB.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:4792
    • C:\Windows\SysWOW64\cmd.exe
      /c del C:\Users\Admin\AppData\Local\Temp\RansomwareSamples\Cuba_08_03_2021_1130KB.exe >> NUL
      2⤵
        PID:3608

    Network

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/3608-135-0x0000000000000000-mapping.dmp
    • memory/4792-132-0x00000000022B0000-0x0000000002310000-memory.dmp
      Filesize

      384KB

    • memory/4792-133-0x0000000000400000-0x000000000051D000-memory.dmp
      Filesize

      1.1MB

    • memory/4792-134-0x0000000000400000-0x000000000051D000-memory.dmp
      Filesize

      1.1MB

    • memory/4792-136-0x0000000000400000-0x000000000051D000-memory.dmp
      Filesize

      1.1MB