ee65e9d7a7bc9d17e894e0b775fc0bbfb35e72c65c3d768e34bfe059d521cc16

Resubmissions

21-01-2024 14:52

240121-r8syqaeac7 10

21-01-2024 14:51

240121-r8k8waeac5 10

01-01-2024 13:55

240101-q776kscacp 10

Analysis

max time kernel
148s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
01-01-2024 13:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5474e75872eeb1e34cbe407c73409d4c65da7bd6aa9378b356bb3c12f316c506.exe
Size

263KB
MD5

111e7dd338f7a7db306c95e05797747f
SHA1

aff72034cbbc21693425306ad42b1bb182582743
SHA256

5474e75872eeb1e34cbe407c73409d4c65da7bd6aa9378b356bb3c12f316c506
SHA512

215ee93c5faf2af3a55cceed281b56aecb5990baf4ae508f02eb481c7c22081f05b73a2657279205ff5d4edfc63722ea1405a9e8cdf65939021c9f052ffb6fec
SSDEEP

6144:jeHgRe/IfHES0cVZrDjuNywKGOCWVoYkNMbU:jeHgM4HxZG1KGjWVoVO

Score

10^/10

ransomware upx

Malware Config

Extracted

Path

C:\Users\Admin\Downloads\How To Recover Encrypted Files.hta

Ransom Note

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/strict.dtd"> <html> <head> <meta charset="windows-1251"> <title>HOW TO DECRYPT YOUR FILES</title> <HTA:APPLICATION ICON="mstsc.exe" SINGLEINSTANCE="yes"> <script language="JScript"> window.moveTo(50, 50); window.resizeTo(screen.width - 100, screen.height - 100); </script> <style type="text/css"> body { font: 15px Tahoma, sans-serif; margin: 10px; line-height: 25px; background-color: #C1AB8F; } .bold { font-weight: bold; } .xx { border: 1px dashed #000; background: #E3D5F1; } .mark { background: #D0D0E8; padding: 2px 5px; } .header { font-size: 30px; height: 50px; line-height: 50px; font-weight: bold; border-bottom: 10px solid #D0D0E8; } .info { background: #D0D0E8; border-left: 10px solid #00008B; } .alert { background: #FFE4E4; border-left: 10px solid #FF0000; } .private { border: 1px dashed #000; background: #FFFFEF; } .note { height: auto; padding-bottom: 1px; margin: 15px 0; } .note .title { font-weight: bold; text-indent: 10px; height: 30px; line-height: 30px; padding-top: 10px; } .note .mark { background: #A2A2B5; } .note ul { margin-top: 0; } .note pre { margin-left: 15px; line-height: 13px; font-size: 13px; } </style> </head> <body> <div class="header">Your files are encrypted!</div> <div class="note private"> <div class="title">Your personal ID</div> <pre>1338293958240407902345024026521805574704617186171510682405152745499214602257250818947395149537919553 8262017829038239904437205983096705446922188817426329641294295766601445618108849762543125458844932359 6769609071084627943058124759036549583580797734114380493724336657888753915025146517608878949170852586 5611414894296257106743555014306312198511736385604080018741996975303526506626885449912250119710667223 1113152121228999087498055829965826035829586990930923297359135477559887124751656826340015652828066079 4137321391137398465401077483711385452038568305165628430797997282362790506399692711317711608506352298 517502002509073538</pre> </div> <div class="bold"> <div align="left">All your important data has been encrypted.</div> </div> <div class="bold">To recover data you need decryptor.</div> <div> <h2 align="center">To get the decryptor you should:</h2> <h1 align="left">pay for decrypt:</h1> <div class="note xx"> <div align="left"> <h1>to send 1 bitcoin today (tomorrow 2 bitcoins) to bitcoin the address 1EQiMGLApzDdPYLWoDMyUo27q5ashMXdQ<br> </h1> </div> <div align="left"> <strong>Here are our recommendations:</strong> </div> <div align="left"> <ol> <li><strong>If you have no Bitcoin address register https://blockchain.info/wallet</strong></li> <li><strong>fill up your wallet some of the ways:</strong></li> <li><strong>Btcdirect.eu - Good service for Europe</strong></li> <li><strong>Bittylicious.com - Bitcoins through Visa / MC or through SEPA (��) transfer</strong></li> <li><strong>Localbitcoins.com - Here you can find people who want to sell Bitcoins directly (WU, in cash, SEPA, Paypal u.s.).</strong></li> <li><strong>Cex.io - buy bitcoins with Visa / Mastercard or Wire Transfer.</strong></li> <li><strong>Coincafe.com - Designed for quick and easy service. Payment methods: Western Union, Bank of America, cash by FedEx, Moneygram, as money transfer</strong></li> <li><strong>Bitstamp.net - well known and established Bitcoins seller</strong></li> <li><strong>Coinmama.com - Visa / Mastercard</strong></li> <li><strong>Btc-e.com - Bitcoins vendor (Visa / Mastercard, etc.)</strong></li> <li><strong>If you have not found any bitcoins in your region, try to find them here:</strong></li> <li><strong>Buybitcoinworldwide.com - International Bicoins Exchange Directory</strong></li> <li><strong>Bitcoin-net.com - Another directory of Bitcoins sellers</strong></li> <li><strong>Howtobuybitcoins.info - International Bicoins Exchange Directory</strong></li> <li><strong>Bittybot.co/eu - Directory for countries of the European Union</strong></li> <li><strong>write to Google how to buy Bitcoin in your country?</strong></li> </ol> </div> <div align="left"> <h1>mail support [email protected]<br> </h1> </div> <h1>After the payment: </h1> </div> <div><p>Send screenshot of payment to mail support <span class="mark">[email protected]</span>. In the letter include your personal ID (look at the beginning of this document).</p> </div> <div> <h1 align="center">After you will receive a decryptor and instructions</h1> </div> <div class="note alert"> <div class="title">Attention!</div> <ul><li>No Payment = No decryption</li> <li>You really get the decryptor after payment</li> <li>Do not attempt to remove the program or run the anti-virus tools</li> <li>Attempts to self-decrypting files will result in the loss of your data</li> <li>Decoders other users are not compatible with your data, because each user's unique encryption key</li> </ul> </div> </body> </html>

Emails

[email protected]<br>

class="mark">[email protected]</span>

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3791175113-1062217823-1177695025-1000\Control Panel\International\Geo\Nation	5474e75872eeb1e34cbe407c73409d4c65da7bd6aa9378b356bb3c12f316c506.exe

Executes dropped EXE 1 IoCs

pid	Process
232	svchost.exe

UPX packed file 6 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral6/memory/4308-0-0x0000000000400000-0x0000000000478000-memory.dmp	upx
behavioral6/files/0x000200000001fafe-5.dat	upx
behavioral6/memory/232-10-0x0000000000400000-0x0000000000478000-memory.dmp	upx
behavioral6/memory/4308-9-0x0000000000400000-0x0000000000478000-memory.dmp	upx
behavioral6/memory/232-587-0x0000000000400000-0x0000000000478000-memory.dmp	upx
behavioral6/memory/232-643-0x0000000000400000-0x0000000000478000-memory.dmp	upx

Drops desktop.ini file(s) 25 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Saved Games\desktop.ini	svchost.exe
File opened for modification	C:\Users\Public\Desktop\desktop.ini	svchost.exe
File opened for modification	C:\Users\Public\AccountPictures\desktop.ini	svchost.exe
File opened for modification	C:\Users\Public\Documents\desktop.ini	svchost.exe
File opened for modification	C:\Users\Public\Libraries\desktop.ini	svchost.exe
File opened for modification	C:\Users\Admin\Desktop\desktop.ini	svchost.exe
File opened for modification	C:\Users\Admin\OneDrive\desktop.ini	svchost.exe
File opened for modification	C:\Users\Admin\Pictures\Camera Roll\desktop.ini	svchost.exe
File opened for modification	C:\Users\Admin\Pictures\Saved Pictures\desktop.ini	svchost.exe
File opened for modification	C:\Users\Public\desktop.ini	svchost.exe
File opened for modification	C:\Users\Admin\Contacts\desktop.ini	svchost.exe
File opened for modification	C:\Users\Admin\Music\desktop.ini	svchost.exe
File opened for modification	C:\Users\Admin\Videos\desktop.ini	svchost.exe
File opened for modification	C:\Users\Public\Music\desktop.ini	svchost.exe
File opened for modification	C:\Users\Public\Videos\desktop.ini	svchost.exe
File opened for modification	C:\Users\Admin\Downloads\desktop.ini	svchost.exe
File opened for modification	C:\Users\Admin\Favorites\desktop.ini	svchost.exe
File opened for modification	C:\Users\Admin\Pictures\desktop.ini	svchost.exe
File opened for modification	C:\Users\Public\Pictures\desktop.ini	svchost.exe
File opened for modification	C:\Users\Admin\3D Objects\desktop.ini	svchost.exe
File opened for modification	C:\Users\Admin\Searches\desktop.ini	svchost.exe
File opened for modification	C:\Users\Public\Downloads\desktop.ini	svchost.exe
File opened for modification	C:\Users\Admin\Documents\desktop.ini	svchost.exe
File opened for modification	C:\Users\Admin\Favorites\Links\desktop.ini	svchost.exe
File opened for modification	C:\Users\Admin\Links\desktop.ini	svchost.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4796	232	WerFault.exe	90

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 4308 wrote to memory of 232	4308	5474e75872eeb1e34cbe407c73409d4c65da7bd6aa9378b356bb3c12f316c506.exe	90
PID 4308 wrote to memory of 232	4308	5474e75872eeb1e34cbe407c73409d4c65da7bd6aa9378b356bb3c12f316c506.exe	90
PID 4308 wrote to memory of 232	4308	5474e75872eeb1e34cbe407c73409d4c65da7bd6aa9378b356bb3c12f316c506.exe	90
PID 4308 wrote to memory of 3228	4308	5474e75872eeb1e34cbe407c73409d4c65da7bd6aa9378b356bb3c12f316c506.exe	91
PID 4308 wrote to memory of 3228	4308	5474e75872eeb1e34cbe407c73409d4c65da7bd6aa9378b356bb3c12f316c506.exe	91
PID 4308 wrote to memory of 3228	4308	5474e75872eeb1e34cbe407c73409d4c65da7bd6aa9378b356bb3c12f316c506.exe	91
PID 232 wrote to memory of 3576	232	svchost.exe	92
PID 232 wrote to memory of 3576	232	svchost.exe	92
PID 232 wrote to memory of 3576	232	svchost.exe	92

C:\Users\Admin\AppData\Local\Temp\5474e75872eeb1e34cbe407c73409d4c65da7bd6aa9378b356bb3c12f316c506.exe
"C:\Users\Admin\AppData\Local\Temp\5474e75872eeb1e34cbe407c73409d4c65da7bd6aa9378b356bb3c12f316c506.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4308
- C:\Users\Admin\AppData\Roaming\svchost.exe
  "C:\Users\Admin\AppData\Roaming\svchost.exe"
  2⤵
  - Executes dropped EXE
  - Drops desktop.ini file(s)
  - Suspicious use of WriteProcessMemory
  PID:232
- - C:\Windows\SysWOW64\mshta.exe
    mshta.exe "javascript:o=new ActiveXObject('WScript.Shell');setInterval(function(){try{o.RegWrite('HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce\\Scanner','C:\\Users\\Admin\\AppData\\Roaming\\svchost.exe');}catch(e){}},10);"
    3⤵
    PID:3576
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 232 -s 740
    3⤵
    - Program crash
    PID:4796
- C:\Windows\SysWOW64\mshta.exe
  mshta.exe "javascript:o=new ActiveXObject('Scripting.FileSystemObject');setInterval(function(){try{o.DeleteFile('C:\\Users\\Admin\\AppData\\Local\\Temp\\5474E7~1.EXE');close()}catch(e){}},10);"
  2⤵
  PID:3228

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 232 -ip 232
1⤵
PID:2300

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\3D Objects\P1DgXjAgpQ7-LbwGnieUPCW0CnnW4kyKaT06zp6akYyhsjm6AdD6iwUAgFpEdIb7.hnumkhotep@india.com.hnumkhotep

Filesize
5KB

MD5
f6efd510ff7e5009f5c0ae8342c1f968

SHA1
08e18cffb24008619f7ca2c9d825cda6a7ebc995

SHA256
4f4515fdf350c27918f94261788d6b02b2ffae7e90e0746afbd5a886fd0aaad0

SHA512
8c52d994e25554a10b2aed5d5633c5c52b360a7bf4c08261a75898d0779acef267ab4860c375d757d555d68b00fe34682e8f761388b335ed18026b7dfb85175a

Download Submit
C:\Users\Admin\AppData\Roaming\svchost.exe

Filesize
263KB

MD5
111e7dd338f7a7db306c95e05797747f

SHA1
aff72034cbbc21693425306ad42b1bb182582743

SHA256
5474e75872eeb1e34cbe407c73409d4c65da7bd6aa9378b356bb3c12f316c506

SHA512
215ee93c5faf2af3a55cceed281b56aecb5990baf4ae508f02eb481c7c22081f05b73a2657279205ff5d4edfc63722ea1405a9e8cdf65939021c9f052ffb6fec

Download Submit
C:\Users\Admin\Downloads\How To Recover Encrypted Files.hta

Filesize
5KB

MD5
9c34c25a54f51d99a24be92a528b3725

SHA1
534970df972892d832564ce3b0d1b7ef92c50e23

SHA256
b5cd9972de5782d938c9c31ce7f56ca847a907e04e96337f37b4999b178dcac2

SHA512
a31fb8bf682762b070b127c2882189ae8204ed517b8870245ca75ef2a156e295f601ca60aaa376ac04af545a816b768420ca695217a0c8c9b53b87db4ff577a5

Download Submit
C:\sk2BzDtBYlmltPT50IoX67nTL5nEWx1PvGyYx8t2jLc.hnumkhotep@india.com.hnumkhotep

Filesize
82KB

MD5
2d4e1bff3493bdfc84e3de6c63ad18da

SHA1
ba715d8e7bf21754bca8b037e5851b191707ed3c

SHA256
7a66a1b242bc0fbda35482653bec30e5566f28b9816a8bbb1c3959ffefe1e9d4

SHA512
71b0518a33833eaf91ea6ae53fb7ef7ee4464cf2b4fbe5aebf7097dda4e6a0d8c89df982a8081cb2abd4d40d3931b5472ab518c174328a235388e628f7a7934a

Download Submit
memory/232-10-0x0000000000400000-0x0000000000478000-memory.dmp

Filesize
480KB

Download
memory/232-587-0x0000000000400000-0x0000000000478000-memory.dmp

Filesize
480KB

Download
memory/232-643-0x0000000000400000-0x0000000000478000-memory.dmp

Filesize
480KB

Download
memory/4308-0-0x0000000000400000-0x0000000000478000-memory.dmp

Filesize
480KB

Download
memory/4308-9-0x0000000000400000-0x0000000000478000-memory.dmp

Filesize
480KB

Download