Overview

overview

10

Static

static

10

Ransomware...KB.exe

windows10-2004-x64

10

Ransomware...KB.exe

windows10-2004-x64

10

Ransomware...KB.exe

windows10-2004-x64

10

Ransomware...KB.exe

windows10-2004-x64

10

Ransomware...KB.exe

windows10-2004-x64

10

Ransomware...KB.exe

windows10-2004-x64

10

Ransomware...KB.exe

windows10-2004-x64

10

Ransomware...KB.exe

windows10-2004-x64

10

Ransomware...KB.exe

windows10-2004-x64

10

Ransomware...KB.exe

windows10-2004-x64

10

Ransomware...KB.exe

windows10-2004-x64

10

Ransomware...KB.exe

windows10-2004-x64

10

Ransomware...KB.exe

windows10-2004-x64

10

Ransomware...KB.exe

windows10-2004-x64

10

Ransomware...KB.exe

windows10-2004-x64

10

Ransomware...KB.exe

windows10-2004-x64

10

Ransomware...KB.exe

windows10-2004-x64

10

Ransomware...KB.ps1

windows10-2004-x64

10

Ransomware...KB.exe

windows10-2004-x64

10

Ransomware...KB.exe

windows10-2004-x64

10

Ransomware...KB.exe

windows10-2004-x64

10

Ransomware...KB.exe

windows10-2004-x64

10

Ransomware...KB.exe

windows10-2004-x64

10

Ransomware...KB.exe

windows10-2004-x64

10

Ransomware...KB.exe

windows10-2004-x64

10

Ransomware...KB.exe

windows10-2004-x64

10

Ransomware...KB.exe

windows10-2004-x64

10

Ransomware...KB.msi

windows10-2004-x64

10

Ransomware...KB.exe

windows10-2004-x64

10

Ransomware...KB.ps1

windows10-2004-x64

10

Ransomware...KB.exe

windows10-2004-x64

8

Ransomware...KB.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    1775s
  • max time network
    1710s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    13-09-2022 17:54

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    RansomwareSamples/DearCry_13_03_2021_1292KB.exe

  • Size

    1.3MB

  • MD5

    0e55ead3b8fd305d9a54f78c7b56741a

  • SHA1

    f7b084e581a8dcea450c2652f8058d93797413c3

  • SHA256

    2b9838da7edb0decd32b086e47a31e8f5733b5981ad8247a2f9508e232589bff

  • SHA512

    5c3d58d1001dce6f2d23f33861e9c7fef766b7fe0a86972e9f1eeb70bfad970b02561da6b6d193cf24bc3c1aaf2a42a950fa6e5dff36386653b8aa725c9abaaa

  • SSDEEP

    24576:LU5NX2yJOiUXmEICxu2WAP0NIzkQM+KpPRQ9StIUDpl1fpxkHVZgMCS+:L7XP7P9o5QzUtl1fpxkHVZgMC3

Score
10/10
dearcrypersistenceransomwarespywarestealer

Malware Config

Extracted

Path

C:\USERS\PUBLIC\DESKTOP\README.TXT

Family

dearcry

Ransom Note
Your file has been encrypted! If you want to decrypt, please contact us. konedieyp@airmail.cc or uenwonken@memail.com And please send me the following hash! 638428e5021d4ae247b21acf9c0bf6f6
Emails

konedieyp@airmail.cc

uenwonken@memail.com

Signatures

  • DearCry

    DearCry is a ransomware first seen after the 2021 Microsoft Exchange hacks.

    ransomwaredearcry
  • Modifies Installed Components in the registry 2 TTPs 1 IoCs
    persistence
  • Modifies extensions of user files 3 IoCs

    Ransomware generally changes the extension on encrypted files.

    ransomware
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Drops desktop.ini file(s) 59 IoCs
  • Enumerates connected drives 3 TTPs 1 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Program Files directory 64 IoCs
  • Program crash 2 IoCs
  • Checks SCSI registry key(s) 3 TTPs 58 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 2 IoCs
  • Modifies data under HKEY_USERS 5 IoCs
  • Modifies registry class 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 48 IoCs
  • Suspicious use of FindShellTrayWindow 59 IoCs
  • Suspicious use of SendNotifyMessage 28 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\RansomwareSamples\DearCry_13_03_2021_1292KB.exe
    "C:\Users\Admin\AppData\Local\Temp\RansomwareSamples\DearCry_13_03_2021_1292KB.exe"
    1⤵
    • Modifies extensions of user files
    • Drops desktop.ini file(s)
    • Drops file in Program Files directory
    PID:4840
  • C:\Windows\system32\WerFault.exe
    C:\Windows\system32\WerFault.exe -pss -s 428 -p 376 -ip 376
    1⤵
      PID:4588
    • C:\Windows\system32\WerFault.exe
      C:\Windows\system32\WerFault.exe -u -p 376 -s 3292
      1⤵
      • Program crash
      PID:1336
    • C:\Windows\explorer.exe
      explorer.exe
      1⤵
      • Modifies Installed Components in the registry
      • Drops desktop.ini file(s)
      • Enumerates connected drives
      • Checks SCSI registry key(s)
      • Modifies registry class
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of SetWindowsHookEx
      PID:3740
    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
      1⤵
      • Modifies registry class
      • Suspicious use of SetWindowsHookEx
      PID:396
    • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
      "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
      1⤵
      • Enumerates system info in registry
      • Modifies data under HKEY_USERS
      • Modifies registry class
      • Suspicious use of SetWindowsHookEx
      PID:1268
    • C:\Windows\system32\WerFault.exe
      C:\Windows\system32\WerFault.exe -pss -s 468 -p 3432 -ip 3432
      1⤵
        PID:2052
      • C:\Windows\system32\WerFault.exe
        C:\Windows\system32\WerFault.exe -u -p 3432 -s 2432
        1⤵
        • Program crash
        PID:3064

      Network

      MITRE ATT&CK Matrix ATT&CK v6

      Initial Access

      Execution

      Persistence

      Registry Run Keys / Startup Folder

      1
      T1060

      Privilege Escalation

      Defense Evasion

      Modify Registry

      1
      T1112

      Credential Access

      Credentials in Files

      1
      T1081

      Discovery

      Query Registry

      3
      T1012

      Peripheral Device Discovery

      2
      T1120

      System Information Discovery

      3
      T1082

      Lateral Movement

      Collection

      Data from Local System

      1
      T1005

      Exfiltration

      Command and Control

      Impact

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\ProgramData\Microsoft\Windows\Caches\cversions.2.db
        Filesize

        16KB

        MD5

        4534f12102d235344cf8dda748f0cabf

        SHA1

        7db67baceeecb3a420bf37a7beca4a45185f8f3c

        SHA256

        1bd4db450abc8914c2fac721cace2704ff4c16028e6d07293154dad289835694

        SHA512

        7b4dacdbc6a2fccdd3818eb41b7fa23eeec51f333af0e842d9185c7ae45eba1623369b1caa27b824cba10c4cd6a2cdbf7f127ab2c6f7656eedce5fe25a0b84a2

        Download Submit
      • C:\USERS\PUBLIC\DESKTOP\README.TXT
        Filesize

        223B

        MD5

        dbac9649c4bd702f55fbd1afafe87c44

        SHA1

        0d914f4a809cfe400ca111ebfbd0ad552d500785

        SHA256

        b9dfa3b30224bd5eef298531c945d5f2f6bb978b7ef42e5ef09715a535172127

        SHA512

        86d7786b400303b1fb722689aba7e8ef6a01ad7e2776194c5d545a7d7357dd91e7079296790587210683db7f4385f98f281272fd3d1ad6770dabf401709a6415

        Download Submit
      • C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\cversions.3.db
        Filesize

        16KB

        MD5

        4534f12102d235344cf8dda748f0cabf

        SHA1

        7db67baceeecb3a420bf37a7beca4a45185f8f3c

        SHA256

        1bd4db450abc8914c2fac721cace2704ff4c16028e6d07293154dad289835694

        SHA512

        7b4dacdbc6a2fccdd3818eb41b7fa23eeec51f333af0e842d9185c7ae45eba1623369b1caa27b824cba10c4cd6a2cdbf7f127ab2c6f7656eedce5fe25a0b84a2

        Download Submit
      • C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\{03BA58C4-B905-4D30-88C9-B63C603DA134}.3.ver0x0000000000000001.db.CRYPT
        Filesize

        414KB

        MD5

        f7c84770acaf2497da3bc0f723d870f3

        SHA1

        eb179564f6f6979c2f79c8a38c9d21185c714280

        SHA256

        843630a0afe5aa75000e144209b8fd332c33c03ac875a73c14f1660112cca240

        SHA512

        8217465b4dcce22588dbb158447b1b1c76261da788c330a395bedc56bb112c83e051f8dae89b8ffa72a5f14ae98a27df4b606ac47286589ad1b84e4c15564d8b

        Download Submit
      • C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\{3DA71D5A-20CC-432F-A115-DFE92379E91F}.3.ver0x0000000000000025.db
        Filesize

        94KB

        MD5

        990ce62f56539446a56966543161869f

        SHA1

        a0d4c1821dbe48d452448eba979c3662ee8a7d9c

        SHA256

        833504d1462577340cdaee5ccf38c922c122a2db8c96e1478e80e3e3a9831238

        SHA512

        ed35828a63a21ce13fe7b8def42b532e76347d967d6d74bf369b9402376541fe81c10b0c60c53a00e886156296eaab24df7461c0ca34b6699a19567e48c4d895

        Download Submit
      • C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\{3DA71D5A-20CC-432F-A115-DFE92379E91F}.3.ver0x0000000000000025.db.CRYPT
        Filesize

        94KB

        MD5

        0db81eadd46a56fa7d2c174e81aaaf08

        SHA1

        c193548ef5378f5c2843ef82d3b30913cf74034d

        SHA256

        ca1e2a12fdc6f8b4dc192b4e5af011d91e1f962e879c40e4fa81143a40b27226

        SHA512

        4374e5afb4b67cb07892304a5aaf021edef28451bbe42af02698732d6241990b2177316cae0f5f1f0ae3003fafda40504e33e0a64b1a1bbb4be493ef42b19190

        Download Submit
      • C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\thumbcache_256.db
        Filesize

        1024KB

        MD5

        e6065c4aa2ab1603008fc18410f579d4

        SHA1

        9a7dcfd9029de86dc088ee6ebbef48df90e7c6cd

        SHA256

        4e29ad18ab9f42d7c233500771a39d7c852b200baf328fd00fbbe3fecea1eb56

        SHA512

        1339d6533a0b875db3f1f607290f8de0e8f79172390faa03fe1ae15cb738b9c64828b08ed11721acc2909cc9394cc9cc115c9d7c9895cefa76f5146614961277

        Download Submit
      • C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\thumbcache_48.db
        Filesize

        24B

        MD5

        c7c6abfa9cb508f7fc178d4045313a94

        SHA1

        4f130f23896bd6d0e95f2a42b2cb83d17ac8f1a2

        SHA256

        1bda9f0aed80857d43c9329457f28b1ca29f736a0c539901e1ba16a909eb07b4

        SHA512

        9f1c1e438b8cceda02663a61a64c1c5fc6fb6238aa92d30e6d8d1a7b0cb29a8a6f26b63b9964ad876617f71ee7dc3c05205158c4ed4be327149652b1c6900825

        Download Submit
      • C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\thumbcache_idx.db
        Filesize

        14KB

        MD5

        d62de45260290993ab8f379c928263eb

        SHA1

        1a885ddfea2427607247084565bf7b547005b7cc

        SHA256

        5443a81a010bc1ff7da14947d3737287a2045bac55e5a7057ce5d17171989c58

        SHA512

        66228c968e4691940ec8e3265de44ca328e7787dcd04fd4a6a0142a63164f70aaada515221e2a9654d7790e90ed1b73cf63024f65c72b3313b05c82c3ee67ec3

        Download Submit
      • memory/1268-253-0x000002AD6C698000-0x000002AD6C69C000-memory.dmp
        Filesize

        16KB

        Download
      • memory/1268-151-0x000002AD6C500000-0x000002AD6C520000-memory.dmp
        Filesize

        128KB

        Download
      • memory/1268-148-0x000002AD6C170000-0x000002AD6C190000-memory.dmp
        Filesize

        128KB

        Download
      • memory/1268-252-0x000002AD6C698000-0x000002AD6C69C000-memory.dmp
        Filesize

        16KB

        Download
      • memory/1268-145-0x000002AD6C1B0000-0x000002AD6C1D0000-memory.dmp
        Filesize

        128KB

        Download
      • memory/1268-254-0x000002AD6C698000-0x000002AD6C69C000-memory.dmp
        Filesize

        16KB

        Download
      • memory/1268-255-0x000002AD6C698000-0x000002AD6C69C000-memory.dmp
        Filesize

        16KB

        Download
      • memory/1268-256-0x000002AD6C698000-0x000002AD6C69C000-memory.dmp
        Filesize

        16KB

        Download
      • memory/1268-259-0x000002AD6C69C000-0x000002AD6C69F000-memory.dmp
        Filesize

        12KB

        Download
      • memory/1268-260-0x000002AD6C69C000-0x000002AD6C69F000-memory.dmp
        Filesize

        12KB

        Download
      • memory/1268-261-0x000002AD6C69C000-0x000002AD6C69F000-memory.dmp
        Filesize

        12KB

        Download
      • memory/1268-262-0x000002AD6C69C000-0x000002AD6C69F000-memory.dmp
        Filesize

        12KB

        Download