Analysis

  • max time kernel
    76s
  • max time network
    47s
  • platform
    windows7_x64
  • resource
    win7-20220812-en
  • resource tags

    arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
  • submitted
    07-12-2022 11:03

General

  • Target

    cf3bdf0f8ea4c8ece5f5a76524ab4c81fea6c3a1715b5a86b3ad4d397fca76f3.exe

  • Size

    875KB

  • MD5

    f1dd01a9e4b959e569250354d74e0423

  • SHA1

    7e2e524fd33261449571f1334868b17ef46e550d

  • SHA256

    cf3bdf0f8ea4c8ece5f5a76524ab4c81fea6c3a1715b5a86b3ad4d397fca76f3

  • SHA512

    d878f63456abdc4a67abd0bd208faf1e77c6baf470f84afa345c6c013f519fc4cff10ae5b3cd700e5fabf11fee3c7e1b357d81e89f7c8c09ce9ef53c99d76202

  • SSDEEP

    24576:B0cwn8nZ9FAQKlPntIQxbU5Wj1Lj8EAUbv170CrKwoUY:I8Z9FxaPuQxbUu1LjUUR7mUY

Score
10/10

Malware Config

Extracted

Path

C:\How To Restore Your Files.txt

Ransom Note
..;===+. .:=iiiiii=+= .=i))=;::+)i=+, ,=i);)I)))I):=i=; .=i==))))ii)))I:i++ +)+))iiiiiiii))I=i+:' .,:;;++++++;:,. )iii+:::;iii))+i=' .:;++=iiiiiiiiii=++;. =::,,,:::=i));=+' ,;+==ii)))))))))))ii==+;, ,,,:=i))+=: ,;+=ii))))))IIIIII))))ii===;. ,,:=i)=i+ ;+=ii)))IIIIITIIIIII))))iiii=+, ,:=));=, ,+=i))IIIIIITTTTTITIIIIII)))I)i=+,,:+i)=i+ ,+i))IIIIIITTTTTTTTTTTTI))IIII))i=::i))i=' ,=i))IIIIITLLTTTTTTTTTTIITTTTIII)+;+i)+i` =i))IIITTLTLTTTTTTTTTIITTLLTTTII+:i)ii:' +i))IITTTLLLTTTTTTTTTTTTLLLTTTT+:i)))=, =))ITTTTTTTTTTTLTTTTTTLLLLLLTi:=)IIiii; .i)IIITTTTTTTTLTTTITLLLLLLLT);=)I)))))i; :))# ASTRA LOCKER 2.0 #);=) :i)IIITTTTTTTTTLLLHLLHLL)+=)II)ITTTI)i= .i)IIITTTTITTLLLHHLLLL);=)II)ITTTTII)i+ =i)IIIIIITTLLLLLLHLL=:i)II)TTTTTTIII)i' +i)i)))IITTLLLLLLLLT=:i)II)TTTTLTTIII)i; +ii)i:)IITTLLTLLLLT=;+i)I)ITTTTLTTTII))i; =;)i=:,=)ITTTTLTTI=:i))I)TTTLLLTTTTTII)i; +i)ii::, +)IIITI+:+i)I))TTTTLLTTTTTII))=, :=;)i=:,, ,i++::i))I)ITTTTTTTTTTIIII)=+' .+ii)i=::,, ,,::=i)))iIITTTTTTTTIIIII)=+ ,==)ii=;:,,,,:::=ii)i)iIIIITIIITIIII))i+:' +=:))i==;:::;=iii)+)= `:i)))IIIII)ii+' .+=:))iiiiiiii)))+ii; .+=;))iiiiii)));ii+ .+=i:)))))))=+ii+ .;==i+::::=)i=; ,+==iiiiii+, `+=+++;` What happend? ---------------------------------------------- All Your files has been succesfully encrypted by AstraLocker 2.0 Can I get My files back? ---------------------------------------------- Sure! But You need special decryptor for that. You will get decryptor after paying. What can I do to get my files back? ---------------------------------------------- You can buy my decryption software, this software will allow you to recover all of your data and remove the Ransomware from your computer. The price for the software is about 50$ (USD). Payment can be made in Monero, or Bitcoin (Cryptocurrency) only. What guarantees? ---------------------------------------------- I value my reputation. If i do not do my work and liabilities, nobody will pay me. This is not in my interests. All my decryption software is perfectly tested and will decrypt your data. How do I pay, where do I get Monero or Bitcoin? ---------------------------------------------- Purchasing Monero or Bitcoin varies from country to country, you are best advised to do a quick Google search yourself to find out how to buy Monero or Bitcoin. Amount of Bitcoin to pay: 0,0012 (Bitcoin) or Amount of Monero to pay: 0,30 (XMR) Where i can pay? ---------------------------------------------- Monero Address: 47moe29QP2xF2myDYaaMCJHpLGsXLPw14aDK6F7pVSp7Nes4XDPMmNUgTeCPQi5arDUe4gP8h4w4pXCtX1gg7SpGAgh6qqS Bitcoin Addres: bc1qpjftnrmahzc8cjs23snk2rq0vt6l0ehu4gqxus Contact ---------------------------------------------- After payment contact: [email protected] Warning! If you report these emails, they may be suspended and NOBODY gets help. It is in Your INTEREST to get the decryptor. Do NOT: 1)Change the extension of the files. You will harm it. 2)Move encrypted files 3)Try to recover files by Yourself. It is impossible. Your files are encrypted with Curve25519 encryption algorithm, You can't decrypt files without private key. 4)Report to authoritaries. If You do it, key will be deleted, and Your files will be useless forever.

Signatures

  • Babuk Locker

    RaaS first seen in 2021 initially called Vasa Locker.

  • Deletes shadow copies 2 TTPs

    Ransomware often targets backup files to inhibit system recovery.

  • Modifies extensions of user files 7 IoCs

    Ransomware generally changes the extension on encrypted files.

  • Enumerates connected drives 3 TTPs 24 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Suspicious use of NtSetInformationThreadHideFromDebugger 10 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Enumerates system info in registry 2 TTPs 2 IoCs
  • Interacts with shadow copies 2 TTPs 2 IoCs

    Shadow copies are often targeted by ransomware to inhibit system recovery.

  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of WriteProcessMemory 14 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\cf3bdf0f8ea4c8ece5f5a76524ab4c81fea6c3a1715b5a86b3ad4d397fca76f3.exe
    "C:\Users\Admin\AppData\Local\Temp\cf3bdf0f8ea4c8ece5f5a76524ab4c81fea6c3a1715b5a86b3ad4d397fca76f3.exe"
    1⤵
    • Modifies extensions of user files
    • Enumerates connected drives
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Enumerates system info in registry
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:1044
    • C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /c vssadmin.exe delete shadows /all /quiet
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:1616
      • C:\Windows\system32\vssadmin.exe
        vssadmin.exe delete shadows /all /quiet
        3⤵
        • Interacts with shadow copies
        PID:1760
    • C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /c vssadmin.exe delete shadows /all /quiet
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:1916
      • C:\Windows\system32\vssadmin.exe
        vssadmin.exe delete shadows /all /quiet
        3⤵
        • Interacts with shadow copies
        PID:1932
  • C:\Windows\system32\vssvc.exe
    C:\Windows\system32\vssvc.exe
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:988

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1044-54-0x0000000075501000-0x0000000075503000-memory.dmp

    Filesize

    8KB

  • memory/1044-55-0x0000000000400000-0x00000000004DC000-memory.dmp

    Filesize

    880KB

  • memory/1044-57-0x00000000752B0000-0x00000000752F7000-memory.dmp

    Filesize

    284KB

  • memory/1044-463-0x0000000002130000-0x0000000002241000-memory.dmp

    Filesize

    1.1MB

  • memory/1044-464-0x0000000002130000-0x0000000002241000-memory.dmp

    Filesize

    1.1MB

  • memory/1044-465-0x0000000002130000-0x0000000002241000-memory.dmp

    Filesize

    1.1MB

  • memory/1044-467-0x0000000002130000-0x0000000002241000-memory.dmp

    Filesize

    1.1MB

  • memory/1044-466-0x0000000002130000-0x0000000002241000-memory.dmp

    Filesize

    1.1MB

  • memory/1044-468-0x0000000002130000-0x0000000002241000-memory.dmp

    Filesize

    1.1MB

  • memory/1044-470-0x0000000002130000-0x0000000002241000-memory.dmp

    Filesize

    1.1MB

  • memory/1044-469-0x0000000002130000-0x0000000002241000-memory.dmp

    Filesize

    1.1MB

  • memory/1044-472-0x0000000002130000-0x0000000002241000-memory.dmp

    Filesize

    1.1MB

  • memory/1044-471-0x0000000002130000-0x0000000002241000-memory.dmp

    Filesize

    1.1MB

  • memory/1044-473-0x0000000002130000-0x0000000002241000-memory.dmp

    Filesize

    1.1MB

  • memory/1044-474-0x0000000002130000-0x0000000002241000-memory.dmp

    Filesize

    1.1MB

  • memory/1044-475-0x0000000002130000-0x0000000002241000-memory.dmp

    Filesize

    1.1MB

  • memory/1044-477-0x0000000002130000-0x0000000002241000-memory.dmp

    Filesize

    1.1MB

  • memory/1044-476-0x0000000002130000-0x0000000002241000-memory.dmp

    Filesize

    1.1MB

  • memory/1044-478-0x0000000002130000-0x0000000002241000-memory.dmp

    Filesize

    1.1MB

  • memory/1044-480-0x0000000002130000-0x0000000002241000-memory.dmp

    Filesize

    1.1MB

  • memory/1044-481-0x0000000002130000-0x0000000002241000-memory.dmp

    Filesize

    1.1MB

  • memory/1044-479-0x0000000002130000-0x0000000002241000-memory.dmp

    Filesize

    1.1MB

  • memory/1044-482-0x0000000002130000-0x0000000002241000-memory.dmp

    Filesize

    1.1MB

  • memory/1044-483-0x0000000002130000-0x0000000002241000-memory.dmp

    Filesize

    1.1MB

  • memory/1044-484-0x0000000002130000-0x0000000002241000-memory.dmp

    Filesize

    1.1MB

  • memory/1044-485-0x0000000002130000-0x0000000002241000-memory.dmp

    Filesize

    1.1MB

  • memory/1044-486-0x0000000002130000-0x0000000002241000-memory.dmp

    Filesize

    1.1MB

  • memory/1044-487-0x0000000002130000-0x0000000002241000-memory.dmp

    Filesize

    1.1MB

  • memory/1044-488-0x0000000002130000-0x0000000002241000-memory.dmp

    Filesize

    1.1MB

  • memory/1044-489-0x0000000002130000-0x0000000002241000-memory.dmp

    Filesize

    1.1MB

  • memory/1044-490-0x0000000002130000-0x0000000002241000-memory.dmp

    Filesize

    1.1MB

  • memory/1044-491-0x0000000002130000-0x0000000002241000-memory.dmp

    Filesize

    1.1MB

  • memory/1044-492-0x0000000002130000-0x0000000002241000-memory.dmp

    Filesize

    1.1MB

  • memory/1044-493-0x0000000002130000-0x0000000002241000-memory.dmp

    Filesize

    1.1MB

  • memory/1044-494-0x0000000002130000-0x0000000002241000-memory.dmp

    Filesize

    1.1MB

  • memory/1044-495-0x0000000002130000-0x0000000002241000-memory.dmp

    Filesize

    1.1MB

  • memory/1044-497-0x0000000002130000-0x0000000002241000-memory.dmp

    Filesize

    1.1MB

  • memory/1044-496-0x0000000002130000-0x0000000002241000-memory.dmp

    Filesize

    1.1MB

  • memory/1044-498-0x0000000002130000-0x0000000002241000-memory.dmp

    Filesize

    1.1MB

  • memory/1044-500-0x0000000002130000-0x0000000002241000-memory.dmp

    Filesize

    1.1MB

  • memory/1044-499-0x0000000002130000-0x0000000002241000-memory.dmp

    Filesize

    1.1MB

  • memory/1044-501-0x0000000002130000-0x0000000002241000-memory.dmp

    Filesize

    1.1MB

  • memory/1044-502-0x0000000002130000-0x0000000002241000-memory.dmp

    Filesize

    1.1MB

  • memory/1044-503-0x0000000002130000-0x0000000002241000-memory.dmp

    Filesize

    1.1MB

  • memory/1044-504-0x0000000002130000-0x0000000002241000-memory.dmp

    Filesize

    1.1MB

  • memory/1044-505-0x0000000002130000-0x0000000002241000-memory.dmp

    Filesize

    1.1MB

  • memory/1044-506-0x0000000002130000-0x0000000002241000-memory.dmp

    Filesize

    1.1MB

  • memory/1044-508-0x0000000002130000-0x0000000002241000-memory.dmp

    Filesize

    1.1MB

  • memory/1044-507-0x0000000002130000-0x0000000002241000-memory.dmp

    Filesize

    1.1MB

  • memory/1044-509-0x0000000002130000-0x0000000002241000-memory.dmp

    Filesize

    1.1MB

  • memory/1044-510-0x0000000002130000-0x0000000002241000-memory.dmp

    Filesize

    1.1MB

  • memory/1044-511-0x0000000002130000-0x0000000002241000-memory.dmp

    Filesize

    1.1MB

  • memory/1044-512-0x0000000002130000-0x0000000002241000-memory.dmp

    Filesize

    1.1MB

  • memory/1044-513-0x0000000002130000-0x0000000002241000-memory.dmp

    Filesize

    1.1MB

  • memory/1044-514-0x0000000002130000-0x0000000002241000-memory.dmp

    Filesize

    1.1MB

  • memory/1044-515-0x0000000002130000-0x0000000002241000-memory.dmp

    Filesize

    1.1MB

  • memory/1044-516-0x0000000002130000-0x0000000002241000-memory.dmp

    Filesize

    1.1MB

  • memory/1044-517-0x0000000002130000-0x0000000002241000-memory.dmp

    Filesize

    1.1MB

  • memory/1044-518-0x0000000002130000-0x0000000002241000-memory.dmp

    Filesize

    1.1MB

  • memory/1044-519-0x0000000002130000-0x0000000002241000-memory.dmp

    Filesize

    1.1MB

  • memory/1044-520-0x0000000002130000-0x0000000002241000-memory.dmp

    Filesize

    1.1MB

  • memory/1044-521-0x0000000002130000-0x0000000002241000-memory.dmp

    Filesize

    1.1MB

  • memory/1044-522-0x0000000002130000-0x0000000002241000-memory.dmp

    Filesize

    1.1MB

  • memory/1044-523-0x0000000002130000-0x0000000002241000-memory.dmp

    Filesize

    1.1MB

  • memory/1044-524-0x0000000002130000-0x0000000002241000-memory.dmp

    Filesize

    1.1MB

  • memory/1044-1503-0x00000000002D0000-0x00000000003D0000-memory.dmp

    Filesize

    1024KB

  • memory/1044-1504-0x0000000001FA0000-0x0000000002121000-memory.dmp

    Filesize

    1.5MB

  • memory/1044-4811-0x0000000002130000-0x0000000002241000-memory.dmp

    Filesize

    1.1MB

  • memory/1044-4812-0x0000000001DC0000-0x0000000001E61000-memory.dmp

    Filesize

    644KB

  • memory/1044-4815-0x0000000002250000-0x0000000002351000-memory.dmp

    Filesize

    1.0MB

  • memory/1044-4816-0x00000000002D0000-0x00000000003D0000-memory.dmp

    Filesize

    1024KB

  • memory/1044-4818-0x0000000000400000-0x00000000004DC000-memory.dmp

    Filesize

    880KB

  • memory/1616-4813-0x0000000000000000-mapping.dmp

  • memory/1760-4814-0x0000000000000000-mapping.dmp

  • memory/1916-4817-0x0000000000000000-mapping.dmp

  • memory/1932-4819-0x0000000000000000-mapping.dmp