ctblocker | 21a1575646d545219ba6813d316cdf388f05c2d45d0b0011a5bfb77b1e2ca2cd

General

Target

21a1575646d545219ba6813d316cdf388f05c2d45d0b0011a5bfb77b1e2ca2cd.exe
Size

1019KB
MD5

1ea130f39d90ae08b289a13406410ec3
SHA1

f87fcf3b7becd3ada883a42f79e05943abb21c09
SHA256

21a1575646d545219ba6813d316cdf388f05c2d45d0b0011a5bfb77b1e2ca2cd
SHA512

3acadb8b2f9062f4c77c6056995f587b6828305ea9583917bd93105fa4233157fc9049271520ade6b69f93707d4bddc1c0aabfd8b15f04dd90a95c266074d017
SSDEEP

24576:fslszepLtFECEBMM4Zf40Pzm+XRtdaBVQIOaZf8P2r:fFepRFEXu4Gyc+J8P2r

Score

10^/10

ctblocker ransomware

Malware Config

Extracted

Path

C:\Users\Admin\Documents\!Decrypt-All-Files-kbzujrd.txt

Ransom Note

Your documents, photos, databases and other important files have been encrypted with strongest encryption and unique key, generated for this computer. Private decryption key is stored on a secret Internet server and nobody can decrypt your files until you pay and obtain the private key. If you see the main locker window, follow the instructions on the locker. Overwise, it's seems that you or your antivirus deleted the locker program. Now you have the last chance to decrypt your files. Open http://uwm2wosrob3gplxy.onion.cab or http://uwm2wosrob3gplxy.tor2web.org in your browser. They are public gates to the secret server. If you have problems with gates, use direct connection: 1. Download Tor Browser from http://torproject.org 2. In the Tor Browser open the http://uwm2wosrob3gplxy.onion/ Note that this server is available via Tor Browser only. Retry in 1 hour if site is not reachable. Copy and paste the following public key in the input form on server. Avoid missprints. O3NMDHW-TQICVK4-EGDIHXL-SUT3TNZ-XELWFYP-QF2QCHX-VFF5RD2-SDOTLRE WDCQQML-QQZUPWP-DQYOFWQ-DMT6NYH-Y6NPFED-JIRELMH-CMVD2BS-PTGC2KU 3CMDDUG-X6HOL3K-VKXUVO3-NRG7W6O-BL7NL42-XMBVHKS-AKQDKAX-YIXWJSW Follow the instructions on the server.

URLs

http://uwm2wosrob3gplxy.onion.cab

http://uwm2wosrob3gplxy.tor2web.org

http://uwm2wosrob3gplxy.onion/

Signatures

CTB-Locker
Ransomware family which uses Tor to hide its C2 communications.
ransomware ctblocker
Executes dropped EXE 1 IoCs

Processes:

xlobkpb.exe

pid process

4924 xlobkpb.exe

pid	process
4924	xlobkpb.exe

Modifies extensions of user files 2 IoCs

Ransomware generally changes the extension on encrypted files.

ransomware

Processes:

svchost.exe

description	ioc	process
File renamed	C:\Windows\Temp\laaaaaaa.tmp => C:\Users\Admin\Pictures\BlockSend.RAW.kbzujrd	svchost.exe
File renamed	C:\Windows\Temp\laaaaaaa.tmp => C:\Users\Admin\Pictures\InstallConvert.CRW.kbzujrd	svchost.exe

Drops desktop.ini file(s) 1 IoCs

Processes:

svchost.exe

description ioc process

File opened for modification C:\$RECYCLE.BIN\S-1-5-18\desktop.ini svchost.exe

description	ioc	process
File opened for modification	C:\$RECYCLE.BIN\S-1-5-18\desktop.ini	svchost.exe

Sets desktop wallpaper using registry 2 TTPs 1 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

Processes:

Explorer.EXE

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\Documents\\!Decrypt-All-Files-kbzujrd.bmp"	Explorer.EXE

Modifies data under HKEY_USERS 20 IoCs

Processes:

svchost.exe

description	ioc	process
Key created	\REGISTRY\USER\.DEFAULT\Software	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\BitBucket\Volume\{2fb4ccdc-0000-0000-0000-d01200000000}	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\CLSID	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}	svchost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}\DefaultIcon\Full = "%SystemRoot%\\System32\\imageres.dll,-54"	svchost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}\DefaultIcon\Empty = "%SystemRoot%\\System32\\imageres.dll,-55"	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\BitBucket\Volume	svchost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\BitBucket\Volume\{2fb4ccdc-0000-0000-0000-d01200000000}\NukeOnDelete = "0"	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}\DefaultIcon	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	svchost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}\DefaultIcon\ = "%SystemRoot%\\System32\\imageres.dll,-55"	svchost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Control Panel\Desktop\TileWallpaper = "0"	svchost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Control Panel\Desktop\WallpaperStyle = "0"	svchost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@%SystemRoot%\system32\shell32.dll,-50176 = "File Operation"	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\BitBucket	svchost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\BitBucket\Volume\{2fb4ccdc-0000-0000-0000-d01200000000}\MaxCapacity = "15140"	svchost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\BitBucket\LastEnum = 30002c007b00320066006200340063006300640063002d0030003000300030002d0030003000300030002d0030003000300030002d006400300031003200300030003000300030003000300030007d0000000000	svchost.exe

Suspicious behavior: EnumeratesProcesses 62 IoCs

Processes:

21a1575646d545219ba6813d316cdf388f05c2d45d0b0011a5bfb77b1e2ca2cd.exexlobkpb.exe

pid	process
1208	21a1575646d545219ba6813d316cdf388f05c2d45d0b0011a5bfb77b1e2ca2cd.exe
1208	21a1575646d545219ba6813d316cdf388f05c2d45d0b0011a5bfb77b1e2ca2cd.exe
4924	xlobkpb.exe
4924	xlobkpb.exe
4924	xlobkpb.exe
4924	xlobkpb.exe
4924	xlobkpb.exe
4924	xlobkpb.exe
4924	xlobkpb.exe
4924	xlobkpb.exe
4924	xlobkpb.exe
4924	xlobkpb.exe
4924	xlobkpb.exe
4924	xlobkpb.exe
4924	xlobkpb.exe
4924	xlobkpb.exe
4924	xlobkpb.exe
4924	xlobkpb.exe
4924	xlobkpb.exe
4924	xlobkpb.exe
4924	xlobkpb.exe
4924	xlobkpb.exe
4924	xlobkpb.exe
4924	xlobkpb.exe
4924	xlobkpb.exe
4924	xlobkpb.exe
4924	xlobkpb.exe
4924	xlobkpb.exe
4924	xlobkpb.exe
4924	xlobkpb.exe
4924	xlobkpb.exe
4924	xlobkpb.exe
4924	xlobkpb.exe
4924	xlobkpb.exe
4924	xlobkpb.exe
4924	xlobkpb.exe
4924	xlobkpb.exe
4924	xlobkpb.exe
4924	xlobkpb.exe
4924	xlobkpb.exe
4924	xlobkpb.exe
4924	xlobkpb.exe
4924	xlobkpb.exe
4924	xlobkpb.exe
4924	xlobkpb.exe
4924	xlobkpb.exe
4924	xlobkpb.exe
4924	xlobkpb.exe
4924	xlobkpb.exe
4924	xlobkpb.exe
4924	xlobkpb.exe
4924	xlobkpb.exe
4924	xlobkpb.exe
4924	xlobkpb.exe
4924	xlobkpb.exe
4924	xlobkpb.exe
4924	xlobkpb.exe
4924	xlobkpb.exe
4924	xlobkpb.exe
4924	xlobkpb.exe
4924	xlobkpb.exe
4924	xlobkpb.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

xlobkpb.exe

description pid process

Token: SeDebugPrivilege 4924 xlobkpb.exe
Token: SeDebugPrivilege 4924 xlobkpb.exe

description	pid	process
Token: SeDebugPrivilege	4924	xlobkpb.exe
Token: SeDebugPrivilege	4924	xlobkpb.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

xlobkpb.exesvchost.exe

description	pid	process	target process
PID 4924 wrote to memory of 764	4924	xlobkpb.exe	svchost.exe
PID 764 wrote to memory of 1780	764	svchost.exe	wmiprvse.exe
PID 764 wrote to memory of 1780	764	svchost.exe	wmiprvse.exe
PID 764 wrote to memory of 2612	764	svchost.exe	DllHost.exe
PID 764 wrote to memory of 2612	764	svchost.exe	DllHost.exe
PID 764 wrote to memory of 3804	764	svchost.exe	mousocoreworker.exe
PID 764 wrote to memory of 3804	764	svchost.exe	mousocoreworker.exe
PID 4924 wrote to memory of 2492	4924	xlobkpb.exe	Explorer.EXE

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p
1⤵
- Modifies extensions of user files
- Drops desktop.ini file(s)
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
PID:764

C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
2⤵
PID:1780

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}
2⤵
PID:2612

C:\Windows\System32\mousocoreworker.exe
C:\Windows\System32\mousocoreworker.exe -Embedding
2⤵
PID:3804

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Sets desktop wallpaper using registry
PID:2492

C:\Users\Admin\AppData\Local\Temp\21a1575646d545219ba6813d316cdf388f05c2d45d0b0011a5bfb77b1e2ca2cd.exe
"C:\Users\Admin\AppData\Local\Temp\21a1575646d545219ba6813d316cdf388f05c2d45d0b0011a5bfb77b1e2ca2cd.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1208

C:\Users\Admin\AppData\Local\Temp\xlobkpb.exe
C:\Users\Admin\AppData\Local\Temp\xlobkpb.exe
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4924

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Defacement

1

T1491

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\USOPrivate\xkefqne
Filesize
654B

MD5
452ba1166cdeae640f4537839ec0a860

SHA1
7e5da960e6fd45359b4adbf8476237924fdf9041

SHA256
ea83c76bd2a9c4f8d2a0c2df9a6ef07482bd681881fa7548f4e2cdb733ba991f

SHA512
06af8261436bcf5a7fcd9b5a16a84bb883e9673f8934f954f0ae2e3450f9a9b071d5c2ea3d6edd88423d8deb448fc0a3e02e22c60960ad3fbad68609fafcfe23

Download Submit
C:\ProgramData\USOPrivate\xkefqne
Filesize
654B

MD5
452ba1166cdeae640f4537839ec0a860

SHA1
7e5da960e6fd45359b4adbf8476237924fdf9041

SHA256
ea83c76bd2a9c4f8d2a0c2df9a6ef07482bd681881fa7548f4e2cdb733ba991f

SHA512
06af8261436bcf5a7fcd9b5a16a84bb883e9673f8934f954f0ae2e3450f9a9b071d5c2ea3d6edd88423d8deb448fc0a3e02e22c60960ad3fbad68609fafcfe23

Download Submit
C:\ProgramData\USOPrivate\xkefqne
Filesize
654B

MD5
cac6e39a40e803d7ef31b05aeb9076c0

SHA1
20d705d553ca887e9b03e0c047dbb087bd000430

SHA256
b2ca453fbd01e4f5d66347a38dfee0316a92b3006f79aaae9bc4f0de534a7b6c

SHA512
eceacb5412645250e9172e3003db4acd3764c6200034554e0b538c08c6a205db48a228b05223e6d7f520c108f2aa707407f7eaaa8beb81dc4960057eedc9f5bd

Download Submit
C:\ProgramData\USOPrivate\xkefqne
Filesize
654B

MD5
5e47edd5494f0bd7870a37a1f75478b7

SHA1
03dfe25a2a76be71e5cb020838fc8b7dfc647ff6

SHA256
35d67f4d5a68a3305e0ad626144ddaeef1fccce9776c128d0f413b7ff639e481

SHA512
7bd6abe762a54dfbadc4be10d3d406d9f8b3d064953f0b26c29d5ce159f76ee5354c73e9453efa34d0ccc30cf0e8bcf505e5baf996e9921e7a87c5ef9a6bd285

Download Submit
C:\ProgramData\USOPrivate\xkefqne
Filesize
654B

MD5
27d97519757ac144eb9e08a4601fa3bf

SHA1
74cdb867078cbf0d659ea80efcf8f99ad8ad8ff8

SHA256
3eaec7abfe27565f2977569ae29f02218ff03e0ef340b484eac8b73e9d1e2ed3

SHA512
64d3b11d6d67d06ff0207e7f1efa2044f60ccaca38d4418476fe00bb3322fed10b8702204f1c1788e62e3ba3583a02b6ff8b7b65d197785c6697ef479067da82

Download Submit
C:\Users\Admin\AppData\Local\Temp\xlobkpb.exe
Filesize
1019KB

MD5
1ea130f39d90ae08b289a13406410ec3

SHA1
f87fcf3b7becd3ada883a42f79e05943abb21c09

SHA256
21a1575646d545219ba6813d316cdf388f05c2d45d0b0011a5bfb77b1e2ca2cd

SHA512
3acadb8b2f9062f4c77c6056995f587b6828305ea9583917bd93105fa4233157fc9049271520ade6b69f93707d4bddc1c0aabfd8b15f04dd90a95c266074d017

Download Submit
C:\Users\Admin\AppData\Local\Temp\xlobkpb.exe
Filesize
1019KB

MD5
1ea130f39d90ae08b289a13406410ec3

SHA1
f87fcf3b7becd3ada883a42f79e05943abb21c09

SHA256
21a1575646d545219ba6813d316cdf388f05c2d45d0b0011a5bfb77b1e2ca2cd

SHA512
3acadb8b2f9062f4c77c6056995f587b6828305ea9583917bd93105fa4233157fc9049271520ade6b69f93707d4bddc1c0aabfd8b15f04dd90a95c266074d017

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\CachedFiles\CachedImage_1280_720_POS4.JPG.kbzujrd
Filesize
36KB

MD5
2b47b2f14bc9095b987c1688935b0203

SHA1
1a560e08565edcf9bd7f15c28342b80ee06ffd5d

SHA256
e7b36107824f47b3b10c913836b717e2924509e5a9df3ddb7cbafa6d25356cf3

SHA512
aa4534a30bcb2141d82609700b58b5bd7900ac1245eb8af25f582ab3e9fb5684f8def4537cf89582cae5f0ce615a8c13817e0a3434c5cd9c1a572e6a8a37d86b

Download Submit
memory/764-143-0x0000000020210000-0x0000000020287000-memory.dmp

Filesize
476KB

Download
memory/1208-139-0x0000000003B10000-0x0000000003B35000-memory.dmp

Filesize
148KB

Download
memory/1208-133-0x0000000000400000-0x0000000000505000-memory.dmp

Filesize
1.0MB

Download
memory/1208-132-0x0000000003B10000-0x0000000003B35000-memory.dmp

Filesize
148KB

Download
memory/1208-134-0x00000000007C0000-0x00000000009DA000-memory.dmp

Filesize
2.1MB

Download
memory/1208-135-0x0000000003D70000-0x0000000003FBB000-memory.dmp

Filesize
2.3MB

Download
memory/1780-147-0x0000000000000000-mapping.dmp

Download
memory/2612-149-0x0000000000000000-mapping.dmp

Download
memory/3804-150-0x0000000000000000-mapping.dmp

Download
memory/4924-142-0x0000000002870000-0x0000000002ABB000-memory.dmp

Filesize
2.3MB

Download
memory/4924-145-0x00000000022F0000-0x0000000002315000-memory.dmp

Filesize
148KB

Download
memory/4924-138-0x00000000022F0000-0x0000000002315000-memory.dmp

Filesize
148KB

Download
memory/4924-140-0x0000000000400000-0x0000000000505000-memory.dmp

Filesize
1.0MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads