Overview

overview

10

Static

static

1

1711ea5267...87.exe

windows7-x64

10

1711ea5267...87.exe

windows10-2004-x64

8

Sharing

Copy URL
Twitter E-mail

General

  • Target

    1711ea526738aaf92b92ed158b96d8d4c626adc6e98b70da6308903e1efc7487

  • Size

    770KB

  • Sample

    221124-n253xsca24

  • MD5

    5fb5607b0f61bb044ff17e28388df490

  • SHA1

    a5e0e097746b63d8ee36701dd040e16784df5da2

  • SHA256

    1711ea526738aaf92b92ed158b96d8d4c626adc6e98b70da6308903e1efc7487

  • SHA512

    37fa97795ae202377263b62dce420acad9397c17aefe1ac8ea35be43bd386bdb1aa0a0ef4a0ad659359269a29180bb0036d2c7310e8b511a1136df4ac4afa25d

  • SSDEEP

    12288:+MzEoDzA1NLzZJncwAVDZI2r1xZyLA6y3TlWW+X+a3qml9nkDRTXj69mfx:t7wnLzZ0Dr1xP6y3t+Z3Vl9nATzGGx

Score
10/10
ransomware

Malware Config

Extracted

Path

C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\Decrypt All Files nrlhicl.txt

Ransom Note
Your documents, photos, databases and other important files have been encrypted with strongest encryption and unique key, generated for this computer. Private decryption key is stored on a secret Internet server and nobody can decrypt your files until you pay and obtain the private key. If you see the main locker window, follow the instructions on the locker. Overwise, it's seems that you or your antivirus deleted the locker program. Now you have the last chance to decrypt your files. 1. Type the address http://torproject.org in your Internet browser. It opens the Tor site. 2. Press 'Download Tor', then press 'DOWNLOAD Tor Browser Bundle', install and run it.\ 3. Now you have Tor Browser. In the Tor Browser open the http://q4vyrzddq25a4jhf.onion Note that this server is available via Tor Browser only. Retry in 1 hour if site is not reachable. 4. Copy and paste the following public key in the input form on server. Avoid missprints. J3XCDB-Z74J3X-FKXMEZ-BNFYMX-OG7O4B-BD4EM2-QHDZXS-3QVGBA SHRICA-GFNLE4-ZQ26OO-YYYXOE-XVZHN4-FLB55A-MEX6K7-WKPXOV LCTTNP-F5SXCH-M4MTU2-RUFB73-F6LRUS-A72FQ6-QGAT4C-ABZU6F 5. Follow the instructions on the server.
URLs

http://q4vyrzddq25a4jhf.onion

Targets

    • Target

      1711ea526738aaf92b92ed158b96d8d4c626adc6e98b70da6308903e1efc7487

    • Size

      770KB

    • MD5

      5fb5607b0f61bb044ff17e28388df490

    • SHA1

      a5e0e097746b63d8ee36701dd040e16784df5da2

    • SHA256

      1711ea526738aaf92b92ed158b96d8d4c626adc6e98b70da6308903e1efc7487

    • SHA512

      37fa97795ae202377263b62dce420acad9397c17aefe1ac8ea35be43bd386bdb1aa0a0ef4a0ad659359269a29180bb0036d2c7310e8b511a1136df4ac4afa25d

    • SSDEEP

      12288:+MzEoDzA1NLzZJncwAVDZI2r1xZyLA6y3TlWW+X+a3qml9nkDRTXj69mfx:t7wnLzZ0Dr1xP6y3t+Z3Vl9nATzGGx

    Score
    10/10
    ransomware

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks