Overview

overview

10

Static

static

HEUR-Troja...f0.exe

windows7-x64

1

HEUR-Troja...f0.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    177s
  • max time network
    218s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    20/09/2022, 05:03

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target

    HEUR-Trojan-Ransom.MSIL.Crypren.gen-2d79357915d242766c873c8ab1d05e4731199a64ff23a43f41551ae92ab368f0.exe

  • Size

    142KB

  • MD5

    0fded7a40dee3d9bea7ea8ad9a98152d

  • SHA1

    7bbccb29a376cd130352b8b8cbc55aa0bd337718

  • SHA256

    2d79357915d242766c873c8ab1d05e4731199a64ff23a43f41551ae92ab368f0

  • SHA512

    99b2132605f1b9aeb67f0b6f14bebb8b56181c06ddb8f992f2276e2260a1eddfa5bb48211cad6dc19d5ef313ef80b89522f91c9291be5ccb5e00e451b0cba147

  • SSDEEP

    3072:FNO9PU044R2JJ3YGf/B1co8aJ0Pk1eSGkNljeAx5zjuPmu5Sokz:WPm4vYQSj6AvzMmu5Sok

Score
10/10
persistenceransomware

Malware Config

Extracted

Path

C:\Users\Admin\Desktop\Readme.txt

Ransom Note
Q: What's wrong with my files? A: Ooops, your important files are encrypted. It means you will not be able to access them anymore until they are decrypted. If you follow our instructions, we guarantee that you can decrypt all your files quickly and safely! Let's start decrypting! Q: What do I do? A: First, you need to pay service fees for the decryption. Please send $600 worth of bitcoin to this bitcoin address: 114NHHMdrCuJ6P3mwHHeyWvwdWdDWzqdpo Next, please contact me at [email protected] with proof of payment (You may need to disable your antivirus for a while.) Q. Finding it hard to buy bitcoins ? A: You can also purchase bitcoins at a bitcoin ATM near you. Q: How do I know this is legit? A: You have two options. You either loose all your files or you pay the ransom and have your files decrypted. *If you need our assistance, send an email at [email protected] on the decryptor window.
Wallets

114NHHMdrCuJ6P3mwHHeyWvwdWdDWzqdpo

Extracted

Path

C:\Users\Admin\Desktop\index.html

Ransom Note
<!DOCTYPE html> <html lang='en'> <head> <meta charset='UTF-8'> <meta http - equiv='X-UA-Compatible' content='IE=edge'> <meta name='viewport' content='width=device-width, initial-scale=1.0'> <title> Document </title> </head> <body> <h2>What Happened to My Computer?</h2> <p> Your important files are encrypted. !!!!YOUR FILES ARE NOT DELETED THEY ARE SIMPLY ENCRYPTED!!!! Many of your documents, photos, videos, databases and other files are no longer accessible because they have been encrypted. Maybe you are busy looking for a way to recover your files, but do not waste your time. Nobody can recover your files without our decryption service. !!!FIND THE READ ME.txt file located on the desktop!!! </p> <h2>Can I Recover My Files?</h2> Sure. We guarantee that you can recover all your files safely and easily. But if you want to decrypt all your files, you need to pay in bitcoin. You have 24 hours to submit the payment. After that the payment will be doubled. Also, if you don't pay in 7 days, you will not be able to recover your files forever. <h2>How Do I Pay?</h2> <p> Payment is accepted in Bitcoin only. For more information, click on about bitcoin. Or feel free to lookup what bitcoin is etc... </p> <p> Please check the current price of Bitcoin and buy some bitcoins. For more information, click on How to buy bitcoins. </p> <p> And send the correct amount to the address specified in this window. </p> <p> After your payment, contact [email protected] with proof of payment!!! </p> <p> Once the payment is checked, decryption key will be sent over to you and files will be decrypted immediately. </p> <h2>Contact</h2> If you need our assistance, send a message to [email protected] <p style='color: red;'> We strongly recommend you to not remove this software, and disable your anti-virus for a while, until you pay and the payment gets processed. If your anti-virus gets updated and removes this software automatically, you will not be able to recover your files even if you pay! </p> </body> </html>
URLs

http

Signatures

  • Modifies extensions of user files 1 IoCs

    Ransomware generally changes the extension on encrypted files.

    ransomware
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Drops desktop.ini file(s) 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Modifies Internet Explorer settings 1 TTPs 4 IoCs
    adwarespyware
  • Suspicious use of SetWindowsHookEx 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\HEUR-Trojan-Ransom.MSIL.Crypren.gen-2d79357915d242766c873c8ab1d05e4731199a64ff23a43f41551ae92ab368f0.exe
    "C:\Users\Admin\AppData\Local\Temp\HEUR-Trojan-Ransom.MSIL.Crypren.gen-2d79357915d242766c873c8ab1d05e4731199a64ff23a43f41551ae92ab368f0.exe"
    1⤵
    • Modifies extensions of user files
    • Adds Run key to start application
    • Drops desktop.ini file(s)
    • Modifies Internet Explorer settings
    • Suspicious use of SetWindowsHookEx
    PID:5024

Network

        MITRE ATT&CK Enterprise v6

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • memory/5024-132-0x0000000000BA0000-0x0000000000BCA000-memory.dmp

          Filesize

          168KB

          Download

        • memory/5024-133-0x0000000005B00000-0x00000000060A4000-memory.dmp

          Filesize

          5.6MB

          Download

        • memory/5024-134-0x00000000055F0000-0x0000000005682000-memory.dmp

          Filesize

          584KB

          Download

        • memory/5024-135-0x0000000005590000-0x000000000559A000-memory.dmp

          Filesize

          40KB

          Download

        • memory/5024-136-0x000000000FF50000-0x00000000106F6000-memory.dmp

          Filesize

          7.6MB

          Download