Analysis
-
max time kernel
210s -
max time network
211s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
23-03-2023 12:34
Static task
static1
Behavioral task
behavioral1
Sample
97a997a2a.dll
Resource
win7-20230220-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
97a997a2a.dll
Resource
win10v2004-20230220-en
windows10-2004-x64
4 signatures
150 seconds
General
-
Target
97a997a2a.dll
-
Size
1.6MB
-
MD5
c47487a80b0873549074634cdcf52937
-
SHA1
056dafdfe9de1460cc396e097947db8286fc845a
-
SHA256
97a997a2a3b270a4db3b56fec30319bc0f41f069a5089c47f08e4c554bf3ac32
-
SHA512
1f447151348b1cc4d2ed4b896d45a91cbe34674987135bad69701f54c15a4526c7235e07238ea5cbe1f89483a39542dd36ab546c41e99eb9e789d84743828759
-
SSDEEP
24576:yUbdgXkRLmlAbd3HVyenqbG1Wf1r/sx9NB2QIg7eCH+TQ0+:3bdgXkR8OFyenqbGoAjB2QIEneTr+
Score
10/10
Malware Config
Extracted
Path
C:\Program Files (x86)\instructions_read_me.txt
Ransom Note
ATTENTION!
Your network has been breached and all data was encrypted. Please contact us at:
https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/
Login ID: b3755e21-718d-4a53-a71f-ce2cf26b0e02
*!* To access .onion websites download and install Tor Browser at:
https://www.torproject.org/ (Tor Browser is not related to us)
*!* To restore all your PCs and get your network working again, follow these instructions:
- Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. It doesn't matter, who are trying to do this, either it will be your IT guys or a recovery agency.
Please follow these simple rules to avoid data corruption:
- Do not modify, rename or delete files. Any attempts to modify, decrypt or rename the files will lead to its fatal corruption.
- Do not hire a recovery company. They can't decrypt without the key.
They also don't care about your business. They believe that they are
good negotiators, but it is not. They usually fail. So speak for yourself.
Waiting you in a chat.
URLs
https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/
Signatures
-
Modifies extensions of user files 4 IoCs
Ransomware generally changes the extension on encrypted files.
description ioc Process File renamed C:\Users\Admin\Pictures\StopRename.tif => C:\Users\Admin\Pictures\StopRename.tif.7raiawg89 rundll32.exe File renamed C:\Users\Admin\Pictures\UseGrant.raw => C:\Users\Admin\Pictures\UseGrant.raw.7raiawg89 rundll32.exe File renamed C:\Users\Admin\Pictures\GrantTrace.crw => C:\Users\Admin\Pictures\GrantTrace.crw.7raiawg89 rundll32.exe File renamed C:\Users\Admin\Pictures\ResetTrace.raw => C:\Users\Admin\Pictures\ResetTrace.raw.7raiawg89 rundll32.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Internet Explorer\it-IT\instructions_read_me.txt rundll32.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\LICENSE rundll32.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\glass.dll rundll32.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\MondoR_Trial-ul-oob.xrm-ms rundll32.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTrial1-ppd.xrm-ms rundll32.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_Retail-ul-oob.xrm-ms rundll32.exe File created C:\Program Files\Internet Explorer\instructions_read_me.txt rundll32.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.NET.Native.Framework.2.2_2.2.27405.0_x64__8wekyb3d8bbwe\AppxBlockMap.xml rundll32.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-100_8wekyb3d8bbwe\AppxManifest.xml rundll32.exe File created C:\Program Files\WindowsApps\Microsoft.XboxSpeechToTextOverlay_1.17.29001.0_neutral_~_8wekyb3d8bbwe\instructions_read_me.txt rundll32.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusE5R_Subscription-ppd.xrm-ms rundll32.exe File created C:\Program Files\Windows Photo Viewer\es-ES\instructions_read_me.txt rundll32.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MixedReality.Portal_2000.19081.1301.0_x64__8wekyb3d8bbwe\IrisProtocol.winmd rundll32.exe File opened for modification C:\Program Files (x86)\Windows NT\TableTextService\TableTextService.dll rundll32.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\PowerPointVL_KMS_Client-ul-oob.xrm-ms rundll32.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\PowerPointR_Retail-ul-oob.xrm-ms rundll32.exe File opened for modification C:\Program Files\Windows Photo Viewer\ImagingDevices.exe rundll32.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsCamera_2018.826.98.0_x64__8wekyb3d8bbwe\CameraApp.Native.dll rundll32.exe File opened for modification C:\Program Files (x86)\Windows Photo Viewer\de-DE\PhotoViewer.dll.mui rundll32.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_OEM_Perp3-ul-oob.xrm-ms rundll32.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProPlusMSDNR_Retail-ul-phn.xrm-ms rundll32.exe File opened for modification C:\Program Files\7-Zip\Lang\ext.txt rundll32.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MixedReality.Portal_2000.19081.1301.0_neutral_split.scale-125_8wekyb3d8bbwe\AppxManifest.xml rundll32.exe File created C:\Program Files\WindowsApps\Microsoft.WebpImageExtension_1.0.22753.0_x64__8wekyb3d8bbwe\instructions_read_me.txt rundll32.exe File opened for modification C:\Program Files\Mozilla Firefox\osclientcerts.dll rundll32.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxGamingOverlay_2.34.28001.0_x64__8wekyb3d8bbwe\SegXbox2.ttf rundll32.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\MondoR_BypassTrial180-ppd.xrm-ms rundll32.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_Trial2-ppd.xrm-ms rundll32.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MSPaint_6.1907.29027.0_x64__8wekyb3d8bbwe\OnlineMediaComponent.winmd rundll32.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsSoundRecorder_10.1906.1972.0_x64__8wekyb3d8bbwe\AppxSignature.p7x rundll32.exe File created C:\Program Files\Java\jdk1.8.0_66\lib\instructions_read_me.txt rundll32.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\klist.exe rundll32.exe File opened for modification C:\Program Files\PingResize.m4a rundll32.exe File opened for modification C:\Program Files\7-Zip\descript.ion rundll32.exe File opened for modification C:\Program Files\7-Zip\Lang\sa.txt rundll32.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_18.1903.1152.0_x64__8wekyb3d8bbwe\System.ComponentModel.dll rundll32.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOSREC.EXE rundll32.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_Retail-ul-phn.xrm-ms rundll32.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\PersonalR_Trial-ul-oob.xrm-ms rundll32.exe File opened for modification C:\Program Files\7-Zip\Lang\br.txt rundll32.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_18.1903.1152.0_x64__8wekyb3d8bbwe\System.ObjectModel.dll rundll32.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\sa-jdi.jar rundll32.exe File opened for modification C:\Program Files\Windows Media Player\ja-JP\wmpnetwk.exe.mui rundll32.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.549981C3F5F10_1.1911.21713.0_x64__8wekyb3d8bbwe\CortanaApp.WinRT.dll rundll32.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxSpeechToTextOverlay_1.17.29001.0_x64__8wekyb3d8bbwe\SegXbox2.ttf rundll32.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\README.txt rundll32.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\Publisher2019R_Retail-ul-phn.xrm-ms rundll32.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxApp_48.49.31001.0_x64__8wekyb3d8bbwe\Generic.xbf rundll32.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\Outlook2019VL_MAK_AE-ul-oob.xrm-ms rundll32.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019R_Trial-ppd.xrm-ms rundll32.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_neutral_split.scale-100_8wekyb3d8bbwe\AppxSignature.p7x rundll32.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_Retail-pl.xrm-ms rundll32.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\Standard2019R_Retail-pl.xrm-ms rundll32.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WebMediaExtensions_1.0.20875.0_x64__8wekyb3d8bbwe\swresample-3_ms.dll rundll32.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsSoundRecorder_10.1906.1972.0_x64__8wekyb3d8bbwe\resources.pri rundll32.exe File opened for modification C:\Program Files\Common Files\System\Ole DB\oledb32.dll rundll32.exe File opened for modification C:\Program Files\Windows Photo Viewer\de-DE\PhotoViewer.dll.mui rundll32.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxGamingOverlay_2.34.28001.0_x64__8wekyb3d8bbwe\AppxBlockMap.xml rundll32.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-processthreads-l1-1-1.dll rundll32.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsStore_11910.1002.5.0_x64__8wekyb3d8bbwe\instructions_read_me.txt rundll32.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-math-l1-1-0.dll rundll32.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\InkObj.dll rundll32.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jps.exe rundll32.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\vccorlib140.dll rundll32.exe -
Modifies registry class 3 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.7raiawg89\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\fkdjsadasd.ico" rundll32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.7raiawg89\DefaultIcon rundll32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.7raiawg89 rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4380 wrote to memory of 2140 4380 rundll32.exe 85 PID 4380 wrote to memory of 2140 4380 rundll32.exe 85 PID 4380 wrote to memory of 2140 4380 rundll32.exe 85
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\97a997a2a.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:4380 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\97a997a2a.dll,#12⤵
- Modifies extensions of user files
- Drops file in Program Files directory
- Modifies registry class
PID:2140
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD50d52501b4dca47e2f0d4507a8814694c
SHA141fde8d323ead7f5507f4c15dfb11133387196ef
SHA256729562c350ab7780794b13fc00506bea1928f294eadf78145264d1c5b3180368
SHA512c694c1a35a1d001cd01eab0b0df10dd21e1bb4b96a9a42c87f157623bb296b5eaecafdbb5f6d90e6bde594d076793276f53ad9eb27606af68e2df5e4d71c427e