Analysis
-
max time kernel
210s -
max time network
47s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system -
submitted
23/03/2023, 12:34
Static task
static1
Behavioral task
behavioral1
Sample
97a997a2a.dll
Resource
win7-20230220-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
97a997a2a.dll
Resource
win10v2004-20230220-en
windows10-2004-x64
4 signatures
150 seconds
General
-
Target
97a997a2a.dll
-
Size
1.6MB
-
MD5
c47487a80b0873549074634cdcf52937
-
SHA1
056dafdfe9de1460cc396e097947db8286fc845a
-
SHA256
97a997a2a3b270a4db3b56fec30319bc0f41f069a5089c47f08e4c554bf3ac32
-
SHA512
1f447151348b1cc4d2ed4b896d45a91cbe34674987135bad69701f54c15a4526c7235e07238ea5cbe1f89483a39542dd36ab546c41e99eb9e789d84743828759
-
SSDEEP
24576:yUbdgXkRLmlAbd3HVyenqbG1Wf1r/sx9NB2QIg7eCH+TQ0+:3bdgXkR8OFyenqbGoAjB2QIEneTr+
Score
10/10
Malware Config
Extracted
Path
C:\Program Files (x86)\instructions_read_me.txt
Ransom Note
ATTENTION!
Your network has been breached and all data was encrypted. Please contact us at:
https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/
Login ID: b3755e21-718d-4a53-a71f-ce2cf26b0e02
*!* To access .onion websites download and install Tor Browser at:
https://www.torproject.org/ (Tor Browser is not related to us)
*!* To restore all your PCs and get your network working again, follow these instructions:
- Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. It doesn't matter, who are trying to do this, either it will be your IT guys or a recovery agency.
Please follow these simple rules to avoid data corruption:
- Do not modify, rename or delete files. Any attempts to modify, decrypt or rename the files will lead to its fatal corruption.
- Do not hire a recovery company. They can't decrypt without the key.
They also don't care about your business. They believe that they are
good negotiators, but it is not. They usually fail. So speak for yourself.
Waiting you in a chat.
URLs
https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/
Signatures
-
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\DVD Maker\audiodepthconverter.ax rundll32.exe File opened for modification C:\Program Files\Internet Explorer\DiagnosticsHub.DataWarehouse.dll rundll32.exe File opened for modification C:\Program Files\Mozilla Firefox\locale.ini rundll32.exe File created C:\Program Files\7-Zip\Lang\instructions_read_me.txt rundll32.exe File opened for modification C:\Program Files\7-Zip\Lang\yo.txt rundll32.exe File created C:\Program Files\Windows Photo Viewer\it-IT\instructions_read_me.txt rundll32.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Document Themes 14\Equity.thmx rundll32.exe File opened for modification C:\Program Files\Windows Sidebar\settings.ini rundll32.exe File created C:\Program Files (x86)\Windows Defender\instructions_read_me.txt rundll32.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\BCSProxy32.dll rundll32.exe File opened for modification C:\Program Files\Internet Explorer\F12Tools.dll rundll32.exe File created C:\Program Files\Reference Assemblies\instructions_read_me.txt rundll32.exe File opened for modification C:\Program Files\7-Zip\Lang\ms.txt rundll32.exe File opened for modification C:\Program Files\VideoLAN\VLC\New_Skins.url rundll32.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\CharSetTable.chr rundll32.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\excelcnv.exe rundll32.exe File opened for modification C:\Program Files\Mozilla Firefox\mozglue.dll rundll32.exe File opened for modification C:\Program Files\7-Zip\Lang\hu.txt rundll32.exe File opened for modification C:\Program Files\Windows Defender\it-IT\MpAsDesc.dll.mui rundll32.exe File opened for modification C:\Program Files\Windows Media Player\de-DE\wmlaunch.exe.mui rundll32.exe File opened for modification C:\Program Files\DVD Maker\Eurosti.TTF rundll32.exe File opened for modification C:\Program Files\DVD Maker\SecretST.TTF rundll32.exe File created C:\Program Files\Java\instructions_read_me.txt rundll32.exe File created C:\Program Files (x86)\Microsoft SQL Server Compact Edition\instructions_read_me.txt rundll32.exe File opened for modification C:\Program Files (x86)\Windows Mail\wabimp.dll rundll32.exe File opened for modification C:\Program Files\7-Zip\Lang\cs.txt rundll32.exe File created C:\Program Files\Microsoft Games\Mahjong\instructions_read_me.txt rundll32.exe File opened for modification C:\Program Files\Windows Media Player\en-US\wmpnscfg.exe.mui rundll32.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\OISGRAPH.DLL rundll32.exe File opened for modification C:\Program Files\7-Zip\Lang\lv.txt rundll32.exe File created C:\Program Files\Internet Explorer\images\instructions_read_me.txt rundll32.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\IPIRMV.XML rundll32.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\mset7ge.kic rundll32.exe File opened for modification C:\Program Files\Windows NT\Accessories\WordpadFilter.dll rundll32.exe File opened for modification C:\Program Files\InitializeAssert.htm rundll32.exe File opened for modification C:\Program Files\7-Zip\Lang\bn.txt rundll32.exe File created C:\Program Files\Java\jre7\instructions_read_me.txt rundll32.exe File opened for modification C:\Program Files\Microsoft Games\Chess\ChessMCE.lnk rundll32.exe File opened for modification C:\Program Files\Windows Media Player\it-IT\setup_wm.exe.mui rundll32.exe File opened for modification C:\Program Files\Windows Media Player\it-IT\mpvis.dll.mui rundll32.exe File opened for modification C:\Program Files\Windows Media Player\ja-JP\wmpnscfg.exe.mui rundll32.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe rundll32.exe File opened for modification C:\Program Files\DVD Maker\soniccolorconverter.ax rundll32.exe File opened for modification C:\Program Files\DVD Maker\it-IT\OmdProject.dll.mui rundll32.exe File opened for modification C:\Program Files\VideoLAN\VLC\uninstall.exe rundll32.exe File opened for modification C:\Program Files\Windows Journal\Templates\To_Do_List.jtp rundll32.exe File opened for modification C:\Program Files\Mozilla Firefox\api-ms-win-core-file-l2-1-0.dll rundll32.exe File opened for modification C:\Program Files\Internet Explorer\pdmproxy100.dll rundll32.exe File opened for modification C:\Program Files\Internet Explorer\perfcore.dll rundll32.exe File opened for modification C:\Program Files\Windows Defender\de-DE\MpAsDesc.dll.mui rundll32.exe File created C:\Program Files\Windows Mail\it-IT\instructions_read_me.txt rundll32.exe File opened for modification C:\Program Files (x86)\Common Files\DESIGNER\MSADDNDR.DLL rundll32.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\ONBttnOL.dll rundll32.exe File opened for modification C:\Program Files\Internet Explorer\ieproxy.dll rundll32.exe File opened for modification C:\Program Files\Microsoft Office\Office14\GROOVEEX.DLL rundll32.exe File created C:\Program Files\Mozilla Firefox\browser\instructions_read_me.txt rundll32.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\JFONT.DAT rundll32.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\ONFILTER.DLL rundll32.exe File opened for modification C:\Program Files\7-Zip\License.txt rundll32.exe File opened for modification C:\Program Files\Windows Defender\MpOAV.dll rundll32.exe File opened for modification C:\Program Files (x86)\Windows Media Player\setup_wm.exe rundll32.exe File opened for modification C:\Program Files\Windows Mail\ja-JP\msoeres.dll.mui rundll32.exe File opened for modification C:\Program Files\Windows NT\TableTextService\TableTextServiceSimplifiedZhengMa.txt rundll32.exe File opened for modification C:\Program Files\Windows Photo Viewer\fr-FR\PhotoAcq.dll.mui rundll32.exe -
Modifies registry class 3 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.7raiawg89\DefaultIcon rundll32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.7raiawg89 rundll32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.7raiawg89\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\fkdjsadasd.ico" rundll32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 2004 wrote to memory of 2028 2004 rundll32.exe 28 PID 2004 wrote to memory of 2028 2004 rundll32.exe 28 PID 2004 wrote to memory of 2028 2004 rundll32.exe 28 PID 2004 wrote to memory of 2028 2004 rundll32.exe 28 PID 2004 wrote to memory of 2028 2004 rundll32.exe 28 PID 2004 wrote to memory of 2028 2004 rundll32.exe 28 PID 2004 wrote to memory of 2028 2004 rundll32.exe 28
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\97a997a2a.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:2004 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\97a997a2a.dll,#12⤵
- Drops file in Program Files directory
- Modifies registry class
PID:2028
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD50d52501b4dca47e2f0d4507a8814694c
SHA141fde8d323ead7f5507f4c15dfb11133387196ef
SHA256729562c350ab7780794b13fc00506bea1928f294eadf78145264d1c5b3180368
SHA512c694c1a35a1d001cd01eab0b0df10dd21e1bb4b96a9a42c87f157623bb296b5eaecafdbb5f6d90e6bde594d076793276f53ad9eb27606af68e2df5e4d71c427e