Overview

overview

10

Static

static

HEUR-Troja...f0.exe

windows7-x64

1

HEUR-Troja...f0.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    HEUR-Trojan-Ransom.MSIL.Crypren.gen-2d79357915d242766c873c8ab1d05e4731199a64ff23a43f41551ae92ab368f0.exe

  • Size

    142KB

  • Sample

    220920-fppleafehk

  • MD5

    0fded7a40dee3d9bea7ea8ad9a98152d

  • SHA1

    7bbccb29a376cd130352b8b8cbc55aa0bd337718

  • SHA256

    2d79357915d242766c873c8ab1d05e4731199a64ff23a43f41551ae92ab368f0

  • SHA512

    99b2132605f1b9aeb67f0b6f14bebb8b56181c06ddb8f992f2276e2260a1eddfa5bb48211cad6dc19d5ef313ef80b89522f91c9291be5ccb5e00e451b0cba147

  • SSDEEP

    3072:FNO9PU044R2JJ3YGf/B1co8aJ0Pk1eSGkNljeAx5zjuPmu5Sokz:WPm4vYQSj6AvzMmu5Sok

Score
10/10
persistenceransomware

Malware Config

Extracted

Path

C:\Users\Admin\Desktop\Readme.txt

Ransom Note
Q: What's wrong with my files? A: Ooops, your important files are encrypted. It means you will not be able to access them anymore until they are decrypted. If you follow our instructions, we guarantee that you can decrypt all your files quickly and safely! Let's start decrypting! Q: What do I do? A: First, you need to pay service fees for the decryption. Please send $600 worth of bitcoin to this bitcoin address: 114NHHMdrCuJ6P3mwHHeyWvwdWdDWzqdpo Next, please contact me at [email protected] with proof of payment (You may need to disable your antivirus for a while.) Q. Finding it hard to buy bitcoins ? A: You can also purchase bitcoins at a bitcoin ATM near you. Q: How do I know this is legit? A: You have two options. You either loose all your files or you pay the ransom and have your files decrypted. *If you need our assistance, send an email at [email protected] on the decryptor window.
Wallets

114NHHMdrCuJ6P3mwHHeyWvwdWdDWzqdpo

Extracted

Path

C:\Users\Admin\Desktop\index.html

Ransom Note
<!DOCTYPE html> <html lang='en'> <head> <meta charset='UTF-8'> <meta http - equiv='X-UA-Compatible' content='IE=edge'> <meta name='viewport' content='width=device-width, initial-scale=1.0'> <title> Document </title> </head> <body> <h2>What Happened to My Computer?</h2> <p> Your important files are encrypted. !!!!YOUR FILES ARE NOT DELETED THEY ARE SIMPLY ENCRYPTED!!!! Many of your documents, photos, videos, databases and other files are no longer accessible because they have been encrypted. Maybe you are busy looking for a way to recover your files, but do not waste your time. Nobody can recover your files without our decryption service. !!!FIND THE READ ME.txt file located on the desktop!!! </p> <h2>Can I Recover My Files?</h2> Sure. We guarantee that you can recover all your files safely and easily. But if you want to decrypt all your files, you need to pay in bitcoin. You have 24 hours to submit the payment. After that the payment will be doubled. Also, if you don't pay in 7 days, you will not be able to recover your files forever. <h2>How Do I Pay?</h2> <p> Payment is accepted in Bitcoin only. For more information, click on about bitcoin. Or feel free to lookup what bitcoin is etc... </p> <p> Please check the current price of Bitcoin and buy some bitcoins. For more information, click on How to buy bitcoins. </p> <p> And send the correct amount to the address specified in this window. </p> <p> After your payment, contact [email protected] with proof of payment!!! </p> <p> Once the payment is checked, decryption key will be sent over to you and files will be decrypted immediately. </p> <h2>Contact</h2> If you need our assistance, send a message to [email protected] <p style='color: red;'> We strongly recommend you to not remove this software, and disable your anti-virus for a while, until you pay and the payment gets processed. If your anti-virus gets updated and removes this software automatically, you will not be able to recover your files even if you pay! </p> </body> </html>
URLs

http

Targets

    • Target

      HEUR-Trojan-Ransom.MSIL.Crypren.gen-2d79357915d242766c873c8ab1d05e4731199a64ff23a43f41551ae92ab368f0.exe

    • Size

      142KB

    • MD5

      0fded7a40dee3d9bea7ea8ad9a98152d

    • SHA1

      7bbccb29a376cd130352b8b8cbc55aa0bd337718

    • SHA256

      2d79357915d242766c873c8ab1d05e4731199a64ff23a43f41551ae92ab368f0

    • SHA512

      99b2132605f1b9aeb67f0b6f14bebb8b56181c06ddb8f992f2276e2260a1eddfa5bb48211cad6dc19d5ef313ef80b89522f91c9291be5ccb5e00e451b0cba147

    • SSDEEP

      3072:FNO9PU044R2JJ3YGf/B1co8aJ0Pk1eSGkNljeAx5zjuPmu5Sokz:WPm4vYQSj6AvzMmu5Sok

    Score
    10/10
    persistenceransomware

    • Modifies extensions of user files

      Ransomware generally changes the extension on encrypted files.

      ransomware

    • Adds Run key to start application

      persistence

    • Drops desktop.ini file(s)

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks