bee867e70ba3d7b12de880b7c2cc1952c18e5487bc722cabaec83e73dc139525

General

Target

bee867e70ba3d7b12de880b7c2cc1952c18e5487bc722cabaec83e73dc139525.exe
Size

685KB
MD5

6dcb4ce3ae5aedc4876e9896073c77a5
SHA1

f9153a229d69934d1ec0320f10ef7029b5f38132
SHA256

bee867e70ba3d7b12de880b7c2cc1952c18e5487bc722cabaec83e73dc139525
SHA512

722357524bd83dc3347a57deb0da06ea06f5ab2a206810e1e40210b035ad7e31d7ac80365ce244de45433e102539fb053990c78a7ac0356f5495b4b80b92f683
SSDEEP

12288:C7jy0J9opbkjyhoHU7ye3Dbfrpfe9HMbIPvHSIVlvee15t+F1D036:C7bJowjyho07zTjtm9R3HTL5t4q6

Score

10^/10

ransomware spyware stealer

Malware Config

Extracted

Path

C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\DecryptAllFiles 7158839.txt

Ransom Note

Your documents, photos, databases and other important files have been encrypted with strongest encryption and unique key, generated for this computer. Private decryption key is stored on a secret Internet server and nobody can decrypt your files until you pay and obtain the private key. If you see the main locker window, follow the instructions on the locker. Overwise, it's seems that you or your antivirus deleted the locker program. Now you have the last chance to decrypt your files. 1. Type the address http://torproject.org in your Internet browser. It opens the Tor site. 2. Press 'Download Tor', then press 'DOWNLOAD Tor Browser Bundle', install and run it.\ 3. Now you have Tor Browser. In the Tor Browser open the http://zt6bycgnjvatzzvi.onion Note that this server is available via Tor Browser only. Retry in 1 hour if site is not reachable. 4. Copy and paste the following public key in the input form on server. Avoid missprints. RIXY2M-RZZZ6W-WQ7AQG-D3LPTZ-6ZCZU6-WEHJFB-3PL3AC-WRB7YH Q5UGUK-JY64UY-NXWCNQ-LTSOXC-MOFJYY-BPRTCN-OYGXQ4-RHBCM5 WVXYC3-3Y7QLA-ELUYP5-SVZMID-OMPCIM-HSVMYG-LGTTUM-ZCG55H 5. Follow the instructions on the server.

URLs

http://zt6bycgnjvatzzvi.onion

Signatures

Executes dropped EXE 2 IoCs

Processes:

pdfisga.exepdfisga.exe

pid process

584 pdfisga.exe
1764 pdfisga.exe

pid	process
584	pdfisga.exe
1764	pdfisga.exe

Modifies extensions of user files 3 IoCs

Ransomware generally changes the extension on encrypted files.

ransomware

Processes:

pdfisga.exe

description	ioc	process
File renamed	C:\Users\Admin\AppData\Local\Temp\0.tmp => C:\Users\Admin\Pictures\DismountOpen.raw.ctb2	pdfisga.exe
File renamed	C:\Users\Admin\AppData\Local\Temp\0.tmp => C:\Users\Admin\Pictures\GrantLimit.raw.ctb2	pdfisga.exe
File renamed	C:\Users\Admin\AppData\Local\Temp\0.tmp => C:\Users\Admin\Pictures\ReadClose.crw.ctb2	pdfisga.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

bee867e70ba3d7b12de880b7c2cc1952c18e5487bc722cabaec83e73dc139525.exepdfisga.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Control Panel\International\Geo\Nation	bee867e70ba3d7b12de880b7c2cc1952c18e5487bc722cabaec83e73dc139525.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Control Panel\International\Geo\Nation	pdfisga.exe

Loads dropped DLL 1 IoCs

Processes:

pdfisga.exe

pid process

584 pdfisga.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

pid	process
584	pdfisga.exe

Suspicious use of SetThreadContext 2 IoCs

Processes:

bee867e70ba3d7b12de880b7c2cc1952c18e5487bc722cabaec83e73dc139525.exepdfisga.exe

description	pid	process	target process
PID 1600 set thread context of 872	1600	bee867e70ba3d7b12de880b7c2cc1952c18e5487bc722cabaec83e73dc139525.exe	bee867e70ba3d7b12de880b7c2cc1952c18e5487bc722cabaec83e73dc139525.exe
PID 584 set thread context of 1764	584	pdfisga.exe	pdfisga.exe

Drops file in Program Files directory 2 IoCs

Processes:

pdfisga.exe

description	ioc	process
File created	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\AllFilesAreLocked 7158854.bmp	pdfisga.exe
File created	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\DecryptAllFiles 7158839.txt	pdfisga.exe

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1328 1208 WerFault.exe

pid	pid_target	process	target process
1328	1208	WerFault.exe

Suspicious use of WriteProcessMemory 18 IoCs

Processes:

bee867e70ba3d7b12de880b7c2cc1952c18e5487bc722cabaec83e73dc139525.exetaskeng.exepdfisga.exe

description	pid	process	target process
PID 1600 wrote to memory of 872	1600	bee867e70ba3d7b12de880b7c2cc1952c18e5487bc722cabaec83e73dc139525.exe	bee867e70ba3d7b12de880b7c2cc1952c18e5487bc722cabaec83e73dc139525.exe
PID 1600 wrote to memory of 872	1600	bee867e70ba3d7b12de880b7c2cc1952c18e5487bc722cabaec83e73dc139525.exe	bee867e70ba3d7b12de880b7c2cc1952c18e5487bc722cabaec83e73dc139525.exe
PID 1600 wrote to memory of 872	1600	bee867e70ba3d7b12de880b7c2cc1952c18e5487bc722cabaec83e73dc139525.exe	bee867e70ba3d7b12de880b7c2cc1952c18e5487bc722cabaec83e73dc139525.exe
PID 1600 wrote to memory of 872	1600	bee867e70ba3d7b12de880b7c2cc1952c18e5487bc722cabaec83e73dc139525.exe	bee867e70ba3d7b12de880b7c2cc1952c18e5487bc722cabaec83e73dc139525.exe
PID 1600 wrote to memory of 872	1600	bee867e70ba3d7b12de880b7c2cc1952c18e5487bc722cabaec83e73dc139525.exe	bee867e70ba3d7b12de880b7c2cc1952c18e5487bc722cabaec83e73dc139525.exe
PID 1600 wrote to memory of 872	1600	bee867e70ba3d7b12de880b7c2cc1952c18e5487bc722cabaec83e73dc139525.exe	bee867e70ba3d7b12de880b7c2cc1952c18e5487bc722cabaec83e73dc139525.exe
PID 1600 wrote to memory of 872	1600	bee867e70ba3d7b12de880b7c2cc1952c18e5487bc722cabaec83e73dc139525.exe	bee867e70ba3d7b12de880b7c2cc1952c18e5487bc722cabaec83e73dc139525.exe
PID 280 wrote to memory of 584	280	taskeng.exe	pdfisga.exe
PID 280 wrote to memory of 584	280	taskeng.exe	pdfisga.exe
PID 280 wrote to memory of 584	280	taskeng.exe	pdfisga.exe
PID 280 wrote to memory of 584	280	taskeng.exe	pdfisga.exe
PID 584 wrote to memory of 1764	584	pdfisga.exe	pdfisga.exe
PID 584 wrote to memory of 1764	584	pdfisga.exe	pdfisga.exe
PID 584 wrote to memory of 1764	584	pdfisga.exe	pdfisga.exe
PID 584 wrote to memory of 1764	584	pdfisga.exe	pdfisga.exe
PID 584 wrote to memory of 1764	584	pdfisga.exe	pdfisga.exe
PID 584 wrote to memory of 1764	584	pdfisga.exe	pdfisga.exe
PID 584 wrote to memory of 1764	584	pdfisga.exe	pdfisga.exe

C:\Users\Admin\AppData\Local\Temp\bee867e70ba3d7b12de880b7c2cc1952c18e5487bc722cabaec83e73dc139525.exe
"C:\Users\Admin\AppData\Local\Temp\bee867e70ba3d7b12de880b7c2cc1952c18e5487bc722cabaec83e73dc139525.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1600

C:\Users\Admin\AppData\Local\Temp\bee867e70ba3d7b12de880b7c2cc1952c18e5487bc722cabaec83e73dc139525.exe
"C:\Users\Admin\AppData\Local\Temp\bee867e70ba3d7b12de880b7c2cc1952c18e5487bc722cabaec83e73dc139525.exe"
2⤵
- Checks computer location settings
PID:872

C:\Windows\system32\taskeng.exe
taskeng.exe {0E240CDE-D8E9-4D8D-AA81-4C82559D24A1} S-1-5-21-4063495947-34355257-727531523-1000:RYNKSFQE\Admin:Interactive:[1]
1⤵
- Suspicious use of WriteProcessMemory
PID:280

C:\Users\Admin\AppData\Local\Temp\pdfisga.exe
C:\Users\Admin\AppData\Local\Temp\pdfisga.exe
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:584

C:\Users\Admin\AppData\Local\Temp\pdfisga.exe
"C:\Users\Admin\AppData\Local\Temp\pdfisga.exe"
3⤵
- Executes dropped EXE
- Modifies extensions of user files
- Checks computer location settings
- Drops file in Program Files directory
PID:1764

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 1208 -s 1208
1⤵
- Program crash
PID:1328

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

1

T1081

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\pdfisga.exe

Filesize
685KB

MD5
6dcb4ce3ae5aedc4876e9896073c77a5

SHA1
f9153a229d69934d1ec0320f10ef7029b5f38132

SHA256
bee867e70ba3d7b12de880b7c2cc1952c18e5487bc722cabaec83e73dc139525

SHA512
722357524bd83dc3347a57deb0da06ea06f5ab2a206810e1e40210b035ad7e31d7ac80365ce244de45433e102539fb053990c78a7ac0356f5495b4b80b92f683

Download Submit
C:\Users\Admin\AppData\Local\Temp\pdfisga.exe

Filesize
685KB

MD5
6dcb4ce3ae5aedc4876e9896073c77a5

SHA1
f9153a229d69934d1ec0320f10ef7029b5f38132

SHA256
bee867e70ba3d7b12de880b7c2cc1952c18e5487bc722cabaec83e73dc139525

SHA512
722357524bd83dc3347a57deb0da06ea06f5ab2a206810e1e40210b035ad7e31d7ac80365ce244de45433e102539fb053990c78a7ac0356f5495b4b80b92f683

Download Submit
C:\Users\Admin\AppData\Local\Temp\pdfisga.exe

Filesize
685KB

MD5
6dcb4ce3ae5aedc4876e9896073c77a5

SHA1
f9153a229d69934d1ec0320f10ef7029b5f38132

SHA256
bee867e70ba3d7b12de880b7c2cc1952c18e5487bc722cabaec83e73dc139525

SHA512
722357524bd83dc3347a57deb0da06ea06f5ab2a206810e1e40210b035ad7e31d7ac80365ce244de45433e102539fb053990c78a7ac0356f5495b4b80b92f683

Download Submit
C:\Users\Admin\AppData\Roaming\Media Center Programs\xptppml

Filesize
654B

MD5
a341952dc5a325acaf381ed7db17b96b

SHA1
dc3901e6102fbf722b8cb245560f2f42579d554e

SHA256
3613b73ca9214bd684370c8f3f7286468f7e59e28df621be2485447855ea3714

SHA512
d65fd7d4e14d6245b895f6b5dc48b736c32064a13af41cccea6439080ad47dfdbb61a578616e72df5d0825843e26b2343fdbeaf93772f1d9c62cf0253d6529d7

Download Submit
\Users\Admin\AppData\Local\Temp\pdfisga.exe

Filesize
685KB

MD5
6dcb4ce3ae5aedc4876e9896073c77a5

SHA1
f9153a229d69934d1ec0320f10ef7029b5f38132

SHA256
bee867e70ba3d7b12de880b7c2cc1952c18e5487bc722cabaec83e73dc139525

SHA512
722357524bd83dc3347a57deb0da06ea06f5ab2a206810e1e40210b035ad7e31d7ac80365ce244de45433e102539fb053990c78a7ac0356f5495b4b80b92f683

Download Submit
memory/584-86-0x0000000074100000-0x00000000746AB000-memory.dmp

Filesize
5.7MB

Download
memory/584-69-0x0000000000000000-mapping.dmp

Download
memory/584-72-0x0000000074100000-0x00000000746AB000-memory.dmp

Filesize
5.7MB

Download
memory/872-60-0x000000000047287B-mapping.dmp

Download
memory/872-61-0x0000000000220000-0x00000000002C7000-memory.dmp

Filesize
668KB

Download
memory/872-64-0x00000000007A0000-0x00000000009B0000-memory.dmp

Filesize
2.1MB

Download
memory/872-63-0x0000000000220000-0x00000000002C7000-memory.dmp

Filesize
668KB

Download
memory/872-66-0x00000000009B0000-0x0000000000BF1000-memory.dmp

Filesize
2.3MB

Download
memory/872-56-0x0000000000220000-0x00000000002C7000-memory.dmp

Filesize
668KB

Download
memory/872-57-0x0000000000220000-0x00000000002C7000-memory.dmp

Filesize
668KB

Download
memory/1600-55-0x0000000074100000-0x00000000746AB000-memory.dmp

Filesize
5.7MB

Download
memory/1600-54-0x00000000752B1000-0x00000000752B3000-memory.dmp

Filesize
8KB

Download
memory/1600-67-0x0000000074100000-0x00000000746AB000-memory.dmp

Filesize
5.7MB

Download
memory/1764-78-0x000000000047287B-mapping.dmp

Download
memory/1764-84-0x0000000000B20000-0x0000000000D61000-memory.dmp

Filesize
2.3MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads