General
-
Target
RIP_YOUR_PC_LOL.bin.zip
-
Size
5.7MB
-
Sample
230205-ccqq6afh28
-
MD5
22bd0cd70a8393d0a042bab69bb5f2c5
-
SHA1
c874a813a40bdbe1833ad2176ea3e22e0fb4dec4
-
SHA256
b069cdfc74248f2244d96bfcdca0f40e7dca7053b7eea5a7846361cd47503f28
-
SHA512
5fcc40e02f5ac7645c515b71dee75d15886b99f9e4e7e7e73f68c86e518d54fa7ead9e82caf8a6857a121e2bef3f14c6b4207fe227d9956e75b4e90fc0471073
-
SSDEEP
98304:vcLQIJRWZjBWJYoQflboEfQD3E/WQILNSYH49ZUm0+qcGWQQFbm02abJU1SLHkVb:0LTwoi5fQj2W0YY9tqvW7FyubJUKK/+w
Static task
static1
Behavioral task
behavioral1
Sample
RIP_YOUR_PC_LOL.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
RIP_YOUR_PC_LOL.exe
Resource
win10v2004-20220812-en
Malware Config
Extracted
C:\Users\Admin\Desktop\@[email protected]
wannacry
115p7UMMngoj1pMvkpHijcRdfJNXj6LrLn
Extracted
C:\DECRYPT-FILES.txt
maze
http://aoacugmutagkwctu.onion/6d070cc32029c9e6
https://mazedecrypt.top/6d070cc32029c9e6
Extracted
C:\Users\Admin\Desktop\@[email protected]
wannacry
13AM4VW2dhxYgXeQepoHkHSQuy6NgaEb94
Extracted
C:\DECRYPT-FILES.txt
maze
http://aoacugmutagkwctu.onion/6ced0cbb855481b4
https://mazedecrypt.top/6ced0cbb855481b4
Extracted
Protocol: ftp- Host:
files.000webhost.com - Port:
21 - Username:
fcb-aws-host-4
Extracted
njrat
im523
Bot
DanilWhiteNjrat-57320.portmap.host:57320
802f813d3810aa536753efbd3390b541
-
reg_key
802f813d3810aa536753efbd3390b541
-
splitter
|'|'|
Targets
-
-
Target
RIP_YOUR_PC_LOL.bin
-
Size
5.8MB
-
MD5
637e757d38a8bf22ebbcd6c7a71b8d14
-
SHA1
0e711a8292de14d5aa0913536a1ae03ddfb933ec
-
SHA256
477c13d4ca09fdb7fea6487641c6a904d4dee1adecd74ac42e0b00a3842503f9
-
SHA512
e7a3576370967a4cbd53c33bf65ae26881cca3f713df5bdbcdc9ed76b79e9102c26d5bf940fc2a0e880c7b7ab83c13dcad24608d23981cbcaf551d4e800c67ac
-
SSDEEP
98304:ULToBBT1aRxcSUDk36SAkdhvxWa9v5d3R8yAVp2Q3Bus6f4PN3RREjgv4:WTe1Cxcxk3ZAkUa9TR8y84QR2foXJv4
-
DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
-
Process spawned unexpected child process
This typically indicates the parent process was compromised via an exploit or macro.
-
NirSoft MailPassView
Password recovery tool for various email clients
-
NirSoft WebBrowserPassView
Password recovery tool for various web browsers
-
Nirsoft
-
Modifies Windows Firewall
-
Modifies extensions of user files
Ransomware generally changes the extension on encrypted files.
-
Office macro that triggers on suspicious action
Office document macro which triggers in special circumstances - often malicious.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Drops startup file
-
Executes dropped EXE
-
Loads dropped DLL
-
Modifies file permissions
-
Uses the VBS compiler for execution
-
Accesses Microsoft Outlook accounts
-
Adds Run key to start application
-
Legitimate hosting services abused for malware hosting/C2
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Drops file in System32 directory
-
Sets desktop wallpaper using registry
-
Suspicious use of SetThreadContext
-
MITRE ATT&CK Enterprise v6
Persistence
Hidden Files and Directories
1Modify Existing Service
1Registry Run Keys / Startup Folder
1Scheduled Task
1Defense Evasion
Bypass User Account Control
1Disabling Security Tools
1File Deletion
2File and Directory Permissions Modification
1Hidden Files and Directories
1Modify Registry
6Scripting
1Web Service
1