Overview

overview

10

Static

static

10

HEUR-Troja...a5.exe

windows7-x64

10

HEUR-Troja...a5.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    171s
  • max time network
    46s
  • platform
    windows7_x64
  • resource
    win7-20220812-en
  • resource tags

    arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
  • submitted
    22-09-2022 17:42

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    HEUR-Trojan-Ransom.MSIL.Encoder.gen-d8784f71e2b19bc6750598f8cdebd6100add67bc8ca727aeee905d101abf77a5.exe

  • Size

    50KB

  • MD5

    38e37cf8e2d5c41a849ef6c41f183dc3

  • SHA1

    b3a1ebb4788e7925934299669806552a92c5c78f

  • SHA256

    d8784f71e2b19bc6750598f8cdebd6100add67bc8ca727aeee905d101abf77a5

  • SHA512

    82b3d3d7208fc8608e3d656d6c803e674118eb13b3f79ae0e82d962a54ea71b839bb96c69eb85ee92608327098daf226fdf4ebb06f0606c7cb7975d4135dfac4

  • SSDEEP

    768:ia7eCmQkZFMbwM1JmOj7Sfbb4P4THRmcVCEzL+2jBlUT0Iao0AzKYcKV1:nXbNJDiTb4PyHRmc5+2wFao0azV1

Score
10/10
evasionpersistenceransomware

Malware Config

Extracted

Path

C:\Users\Admin\Desktop\LegionReadMe.txt

Ransom Note
Ooops! All your important files are encrypted! What happend to my computer? All your important files are encrypted. No one can help you to restore files without our special decryptor Backups were either encrypted or deleted. Shadow copies also removed. If you want to restore some of your files for free write to email (contact is below) and attach 2-3 encrypted files. You will receive decrypted samples. To decrypt other files you have to pay $50. How do i pay? Payment is accepted in Bitcoin only. Please check the current price of Bitcoin and buy some Bitcoins. And send the correct amount to the address specified at the bottom of the sheet. Contact: 1.Download Tor browser (https://www.torproject.org/) 2.Create account on mail2tor (http://mail2tor2zyjdctd.onion/) 3.Write email to us (LegionLocker@mail2tor.com) In case of no anwser in 72 hours write us to this email: CobraLocker@mail2tor.com What if i already paid? Send your Bitcoin wallet ID to e-mail provided above. Attention! 1.Do not modify encrypted files. 2.Do not try decrypt your data using third party software, it may cause pernament data loss. Our Bitcoin address: 131fjhrB4wH8j6adZXudp1Wn23pR33tpAh
Emails

LegionLocker@mail2tor.com

CobraLocker@mail2tor.com
Wallets

131fjhrB4wH8j6adZXudp1Wn23pR33tpAh

URLs

http://mail2tor2zyjdctd.onion/

Signatures

  • Modifies WinLogon for persistence 2 TTPs 1 IoCs
    persistence
  • Disables Task Manager via registry modification
    evasion
  • Modifies extensions of user files 2 IoCs

    Ransomware generally changes the extension on encrypted files.

    ransomware
  • Sets desktop wallpaper using registry 2 TTPs 1 IoCs
    ransomware
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\HEUR-Trojan-Ransom.MSIL.Encoder.gen-d8784f71e2b19bc6750598f8cdebd6100add67bc8ca727aeee905d101abf77a5.exe
    "C:\Users\Admin\AppData\Local\Temp\HEUR-Trojan-Ransom.MSIL.Encoder.gen-d8784f71e2b19bc6750598f8cdebd6100add67bc8ca727aeee905d101abf77a5.exe"
    1⤵
    • Modifies WinLogon for persistence
    • Modifies extensions of user files
    • Sets desktop wallpaper using registry
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:1972

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Winlogon Helper DLL

1
T1004

Privilege Escalation

Defense Evasion

Modify Registry

2
T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Defacement

1
T1491

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1972-54-0x0000000001170000-0x0000000001182000-memory.dmp
    Filesize

    72KB

    Download
  • memory/1972-55-0x000007FEFBD21000-0x000007FEFBD23000-memory.dmp
    Filesize

    8KB

    Download
  • memory/1972-56-0x000000001B136000-0x000000001B155000-memory.dmp
    Filesize

    124KB

    Download
  • memory/1972-57-0x000000001B136000-0x000000001B155000-memory.dmp
    Filesize

    124KB

    Download