Analysis
-
max time kernel
150s -
max time network
33s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system -
submitted
28-03-2023 06:55
Static task
static1
Behavioral task
behavioral1
Sample
Crypter.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
Crypter.exe
Resource
win10v2004-20230221-en
General
-
Target
Crypter.exe
-
Size
129KB
-
MD5
9c62af504ce79cc4c0bbcc2612f3c4db
-
SHA1
37c01dc0342c161569e9d434246dc42962c00860
-
SHA256
43c9c228baf00bc4614fdeb578eb84ad2232cef6c2820046b0b9fec502be573f
-
SHA512
3572b9dde32844ba873de6c994dcf42e71bc217806390d6cf9d767d4c837266592087837aa70991604e3bd283a27a6e11d1d48177996213e8575326f86f839f3
-
SSDEEP
3072:qLbLpVIYbQf91G3im/2Ef07JysgNv8Ofr4pt6Y46ab6koEMQBfjS3f2vYeBgrOi4:qTpVXvxyq6ko0BSveYprzOu3ScuT06
Malware Config
Signatures
-
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Modifies extensions of user files 2 IoCs
Ransomware generally changes the extension on encrypted files.
Processes:
Crypter.exedescription ioc process File opened for modification C:\Users\Admin\Pictures\ConvertFromWatch.tiff Crypter.exe File opened for modification C:\Users\Admin\Pictures\SelectFind.tiff Crypter.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Enumerates connected drives 3 TTPs 1 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
Crypter.exedescription ioc process File opened (read-only) \??\D: Crypter.exe -
Drops file in Program Files directory 64 IoCs
Processes:
Crypter.exedescription ioc process File opened for modification C:\Program Files\VideoLAN\VLC\plugins\video_filter\libdeinterlace_plugin.dll.EMAIL=[antistrees2000@keemail.me]ID=[6A3C5245BE2098C3].BTC Crypter.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.widgets.nl_ja_4.4.0.v20140623020002.jar.EMAIL=[antistrees2000@keemail.me]ID=[6A3C5245BE2098C3].BTC Crypter.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Bahia.EMAIL=[antistrees2000@keemail.me]ID=[6A3C5245BE2098C3].BTC Crypter.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\es-ES\js\library.js Crypter.exe File opened for modification C:\Program Files\Microsoft Games\Multiplayer\Checkers\Chkr.dll Crypter.exe File created C:\Program Files\VideoLAN\VLC\locale\be\#FILE ENCRYPTED.txt Crypter.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD10297_.GIF Crypter.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD21337_.GIF.EMAIL=[antistrees2000@keemail.me]ID=[6A3C5245BE2098C3].BTC Crypter.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\applet\#FILE ENCRYPTED.txt Crypter.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Europe\Helsinki.EMAIL=[antistrees2000@keemail.me]ID=[6A3C5245BE2098C3].BTC Crypter.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\EAWFINTL.DLL Crypter.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\images\next_rest.png Crypter.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe AIR\Versions\1.0\airappinstaller.exe Crypter.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\J0115867.GIF Crypter.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0187817.WMF.EMAIL=[antistrees2000@keemail.me]ID=[6A3C5245BE2098C3].BTC Crypter.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\COMPASS\COMPASS.INF Crypter.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\BS00136_.WMF Crypter.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0145361.JPG Crypter.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBSPAPR\ZPDIR43F.GIF Crypter.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\images\novelty_h.png Crypter.exe File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\fr\System.Xml.Linq.Resources.dll Crypter.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Niue.EMAIL=[antistrees2000@keemail.me]ID=[6A3C5245BE2098C3].BTC Crypter.exe File opened for modification C:\Program Files\DVD Maker\bod_r.TTF Crypter.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0185778.WMF.EMAIL=[antistrees2000@keemail.me]ID=[6A3C5245BE2098C3].BTC Crypter.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\CAGCAT10\J0222019.WMF Crypter.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PAGESIZE\PGLBL054.XML.EMAIL=[antistrees2000@keemail.me]ID=[6A3C5245BE2098C3].BTC Crypter.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\video_output\libdirectdraw_plugin.dll Crypter.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\RSSFeeds.Gadget\ja-JP\css\flyout.css Crypter.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Cayman Crypter.exe File opened for modification C:\Program Files\Java\jre7\lib\jfxrt.jar.EMAIL=[antistrees2000@keemail.me]ID=[6A3C5245BE2098C3].BTC Crypter.exe File opened for modification C:\Program Files (x86)\Common Files\System\Ole DB\msdaenum.dll Crypter.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\QUERIES\MSN MoneyCentral Investor Major Indicies.iqy Crypter.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-modules-favorites.xml Crypter.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0292272.WMF Crypter.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0341455.JPG Crypter.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Fonts\Paper.xml.EMAIL=[antistrees2000@keemail.me]ID=[6A3C5245BE2098C3].BTC Crypter.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\OFFICE10.MMW Crypter.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\images\bg-today.png Crypter.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\btn_search_over_BIDI.png Crypter.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBSPAPR\PDIR39F.GIF.EMAIL=[antistrees2000@keemail.me]ID=[6A3C5245BE2098C3].BTC Crypter.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\db\lib\derbyLocale_it.jar Crypter.exe File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\WidevineCdm\manifest.json.EMAIL=[antistrees2000@keemail.me]ID=[6A3C5245BE2098C3].BTC Crypter.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\ModuleAutoDeps\org-netbeans-modules-queries.xml Crypter.exe File opened for modification C:\Program Files\Windows Media Player\wmpenc.exe Crypter.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.rcp.ja_5.5.0.165303\#FILE ENCRYPTED.txt Crypter.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\25.png Crypter.exe File created C:\Program Files (x86)\Common Files\microsoft shared\VBA\VBA6\#FILE ENCRYPTED.txt Crypter.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD14829_.GIF.EMAIL=[antistrees2000@keemail.me]ID=[6A3C5245BE2098C3].BTC Crypter.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBSPAPR\ZPDIR31F.GIF.EMAIL=[antistrees2000@keemail.me]ID=[6A3C5245BE2098C3].BTC Crypter.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Bahia_Banderas Crypter.exe File opened for modification C:\Program Files\Windows Journal\it-IT\Journal.exe.mui Crypter.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0107490.WMF Crypter.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0195260.WMF Crypter.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\FLYER98.POC Crypter.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\BabyBoyMainToNotesBackground.wmv Crypter.exe File created C:\Program Files (x86)\Common Files\Adobe AIR\Versions\1.0\#FILE ENCRYPTED.txt Crypter.exe File opened for modification C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\it\System.IO.Log.Resources.dll Crypter.exe File opened for modification C:\Program Files\Windows Media Player\es-ES\WMPDMC.exe.mui Crypter.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\SCNPST64.DLL Crypter.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\AG00057_.GIF.EMAIL=[antistrees2000@keemail.me]ID=[6A3C5245BE2098C3].BTC Crypter.exe File opened for modification C:\Program Files (x86)\Common Files\System\Ole DB\it-IT\msdasqlr.dll.mui Crypter.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\include\win32\bridge\AccessBridgeCalls.h.EMAIL=[antistrees2000@keemail.me]ID=[6A3C5245BE2098C3].BTC Crypter.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.security.win32.x86_64_1.0.100.v20130327-1442.jar Crypter.exe File opened for modification C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\fr\System.Speech.resources.dll Crypter.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Interacts with shadow copies 2 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
Processes:
vssadmin.exepid process 464 vssadmin.exe -
Suspicious behavior: EnumeratesProcesses 60 IoCs
Processes:
Crypter.exepid process 2000 Crypter.exe 2000 Crypter.exe 2000 Crypter.exe 2000 Crypter.exe 2000 Crypter.exe 2000 Crypter.exe 2000 Crypter.exe 2000 Crypter.exe 2000 Crypter.exe 2000 Crypter.exe 2000 Crypter.exe 2000 Crypter.exe 2000 Crypter.exe 2000 Crypter.exe 2000 Crypter.exe 2000 Crypter.exe 2000 Crypter.exe 2000 Crypter.exe 2000 Crypter.exe 2000 Crypter.exe 2000 Crypter.exe 2000 Crypter.exe 2000 Crypter.exe 2000 Crypter.exe 2000 Crypter.exe 2000 Crypter.exe 2000 Crypter.exe 2000 Crypter.exe 2000 Crypter.exe 2000 Crypter.exe 2000 Crypter.exe 2000 Crypter.exe 2000 Crypter.exe 2000 Crypter.exe 2000 Crypter.exe 2000 Crypter.exe 2000 Crypter.exe 2000 Crypter.exe 2000 Crypter.exe 2000 Crypter.exe 2000 Crypter.exe 2000 Crypter.exe 2000 Crypter.exe 2000 Crypter.exe 2000 Crypter.exe 2000 Crypter.exe 2000 Crypter.exe 2000 Crypter.exe 2000 Crypter.exe 2000 Crypter.exe 2000 Crypter.exe 2000 Crypter.exe 2000 Crypter.exe 2000 Crypter.exe 2000 Crypter.exe 2000 Crypter.exe 2000 Crypter.exe 2000 Crypter.exe 2000 Crypter.exe 2000 Crypter.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
vssvc.exedescription pid process Token: SeBackupPrivilege 1468 vssvc.exe Token: SeRestorePrivilege 1468 vssvc.exe Token: SeAuditPrivilege 1468 vssvc.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
NOTEPAD.EXEpid process 2040 NOTEPAD.EXE -
Suspicious use of WriteProcessMemory 7 IoCs
Processes:
Crypter.execmd.exedescription pid process target process PID 2000 wrote to memory of 932 2000 Crypter.exe cmd.exe PID 2000 wrote to memory of 932 2000 Crypter.exe cmd.exe PID 2000 wrote to memory of 932 2000 Crypter.exe cmd.exe PID 2000 wrote to memory of 932 2000 Crypter.exe cmd.exe PID 932 wrote to memory of 464 932 cmd.exe vssadmin.exe PID 932 wrote to memory of 464 932 cmd.exe vssadmin.exe PID 932 wrote to memory of 464 932 cmd.exe vssadmin.exe -
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\Crypter.exe"C:\Users\Admin\AppData\Local\Temp\Crypter.exe"1⤵
- Modifies extensions of user files
- Enumerates connected drives
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c vssadmin.exe delete shadows /all /quiet2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\vssadmin.exevssadmin.exe delete shadows /all /quiet3⤵
- Interacts with shadow copies
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\#FILE ENCRYPTED.txt1⤵
-
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Documents\#FILE ENCRYPTED.txt1⤵
- Suspicious use of FindShellTrayWindow
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"1⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\#FILE ENCRYPTED.txtFilesize
332B
MD594250996214fbc1194e5d00ca0472059
SHA14aa601fd325613df0d1e070cd9b97aaeba31033e
SHA2569dbda2ff049da53281eb3336461d309b8da1de14c11169187dcfc08dcbfe4b7d
SHA5128ff4dfbe8cfd6c7ab86d045827a3fa79303f77e6fa4c9ef1d5000cbf36e9a8b8c397ec2fc98de341305151872e7a50e9184a385fc703907384cb5fdaba57938f
-
C:\Users\Admin\Desktop\#FILE ENCRYPTED.txtFilesize
332B
MD594250996214fbc1194e5d00ca0472059
SHA14aa601fd325613df0d1e070cd9b97aaeba31033e
SHA2569dbda2ff049da53281eb3336461d309b8da1de14c11169187dcfc08dcbfe4b7d
SHA5128ff4dfbe8cfd6c7ab86d045827a3fa79303f77e6fa4c9ef1d5000cbf36e9a8b8c397ec2fc98de341305151872e7a50e9184a385fc703907384cb5fdaba57938f
-
C:\Users\Admin\Documents\#FILE ENCRYPTED.txtFilesize
332B
MD594250996214fbc1194e5d00ca0472059
SHA14aa601fd325613df0d1e070cd9b97aaeba31033e
SHA2569dbda2ff049da53281eb3336461d309b8da1de14c11169187dcfc08dcbfe4b7d
SHA5128ff4dfbe8cfd6c7ab86d045827a3fa79303f77e6fa4c9ef1d5000cbf36e9a8b8c397ec2fc98de341305151872e7a50e9184a385fc703907384cb5fdaba57938f