ctblocker | 7ae4167445cef80f080de5b84c6490a61c1834aa1e05fce43e611c5d054da858

Analysis

max time kernel
119s
max time network
137s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
01/01/2024, 15:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
5ee5166c02636f294fb8f6da69d5c0ae893a1c4694ae1bcc3753b497598121a0/5ee5166c02636f294fb8f6da69d5c0ae893.exe
Size 2.2MB
Sample240101-s2944adcem
SHA256 5ee5166c02636f294fb8f6da69d5c0ae893a1c4694ae1bcc3753b497598121a0
MD5 71a4ba0fe0bc0cb450b8966cb585f757
SHA1 eccb76a942b3359d8dbf4c12e6bc3be0c8627eca
SHA512 5748e02e83ea32118013741680be6e2eea398b05cde8c359e0db9126175ce63a4890e7ca654e5a5930970889aa2598c650395972107d41522e55207dd5460c01
SSDEEP 12288:QnQY+2XG1Inz4vM/nlBKSduzxx73zDJnaPxMrFHQJGTTqTdd1o/CMj:QbGOnbzuHT5naPxUHQATTqzi/Cu
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

ctblocker ransomware

Malware Config

Signatures

CTB-Locker
Ransomware family which uses Tor to hide its C2 communications.
ransomware ctblocker
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware

File Deletion
T1070.004

Inhibit System Recovery
T1490

Executes dropped EXE 2 IoCs

pid	Process
2736	xuwiumk.exe
800	xuwiumk.exe

Drops desktop.ini file(s) 2 IoCs

description	ioc	Process
File opened for modification	C:\$RECYCLE.BIN\S-1-5-18\desktop.ini	svchost.exe
File opened for modification	F:\$RECYCLE.BIN\S-1-5-18\desktop.ini	svchost.exe

Enumerates connected drives 3 TTPs 1 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\F:	svchost.exe

Sets desktop wallpaper using registry 2 TTPs 1 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\Documents\\!Decrypt-All-Files-iyznxxc.bmp"	Explorer.EXE

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\!Decrypt-All-Files-iyznxxc.txt	svchost.exe
File created	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\!Decrypt-All-Files-iyznxxc.bmp	svchost.exe

Interacts with shadow copies 2 TTPs 1 IoCs

Shadow copies are often targeted by ransomware to inhibit system recovery.

ransomware

File Deletion

T1070.004

Inhibit System Recovery

T1490

pid	Process
1524	vssadmin.exe

Modifies data under HKEY_USERS 23 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}\DefaultIcon	svchost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\BitBucket\Volume\{bb077ec4-9b9f-11ee-97c7-806e6f6e6963}\MaxCapacity = "14116"	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\BitBucket\Volume\{69d89a81-9b61-11ee-a14d-ce9b5d0c5de4}	svchost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\BitBucket\Volume\{69d89a81-9b61-11ee-a14d-ce9b5d0c5de4}\NukeOnDelete = "0"	svchost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\BitBucket\LastEnum = 30002c007b00620062003000370037006500630034002d0039006200390066002d0031003100650065002d0039003700630037002d003800300036006500360066003600650036003900360033007d00000030002c007b00360039006400380039006100380031002d0039006200360031002d0031003100650065002d0061003100340064002d006300650039006200350064003000630035006400650034007d0000000000	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\CLSID	svchost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}\DefaultIcon\Full = "%SystemRoot%\\System32\\imageres.dll,-54"	svchost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Control Panel\Desktop\TileWallpaper = "0"	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\BitBucket	svchost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\BitBucket\Volume\{bb077ec4-9b9f-11ee-97c7-806e6f6e6963}\NukeOnDelete = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\BitBucket\Volume\{69d89a81-9b61-11ee-a14d-ce9b5d0c5de4}\MaxCapacity = "2047"	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}\DefaultIcon	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion	svchost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Control Panel\Desktop\WallpaperStyle = "0"	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\BitBucket\Volume\{bb077ec4-9b9f-11ee-97c7-806e6f6e6963}	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\BitBucket\Volume	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer	svchost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}\DefaultIcon\ = "%SystemRoot%\\System32\\imageres.dll,-55"	svchost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}\DefaultIcon\Empty = "%SystemRoot%\\System32\\imageres.dll,-55"	svchost.exe

Suspicious behavior: EnumeratesProcesses 5 IoCs

pid	Process
2676	5ee5166c02636f294fb8f6da69d5c0ae893.exe
2736	xuwiumk.exe
2736	xuwiumk.exe
2736	xuwiumk.exe
2736	xuwiumk.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2736	xuwiumk.exe
Token: SeDebugPrivilege	2736	xuwiumk.exe

Suspicious use of UnmapMainImage 1 IoCs

pid	Process
1204	Explorer.EXE

Suspicious use of WriteProcessMemory 20 IoCs

description	pid	Process	procid_target
PID 2868 wrote to memory of 2736	2868	taskeng.exe	31
PID 2868 wrote to memory of 2736	2868	taskeng.exe	31
PID 2868 wrote to memory of 2736	2868	taskeng.exe	31
PID 2868 wrote to memory of 2736	2868	taskeng.exe	31
PID 2736 wrote to memory of 608	2736	xuwiumk.exe	28
PID 608 wrote to memory of 2560	608	svchost.exe	33
PID 608 wrote to memory of 2560	608	svchost.exe	33
PID 608 wrote to memory of 2560	608	svchost.exe	33
PID 608 wrote to memory of 1336	608	svchost.exe	34
PID 608 wrote to memory of 1336	608	svchost.exe	34
PID 608 wrote to memory of 1336	608	svchost.exe	34
PID 2736 wrote to memory of 1204	2736	xuwiumk.exe	18
PID 2736 wrote to memory of 1524	2736	xuwiumk.exe	35
PID 2736 wrote to memory of 1524	2736	xuwiumk.exe	35
PID 2736 wrote to memory of 1524	2736	xuwiumk.exe	35
PID 2736 wrote to memory of 1524	2736	xuwiumk.exe	35
PID 2736 wrote to memory of 800	2736	xuwiumk.exe	36
PID 2736 wrote to memory of 800	2736	xuwiumk.exe	36
PID 2736 wrote to memory of 800	2736	xuwiumk.exe	36
PID 2736 wrote to memory of 800	2736	xuwiumk.exe	36

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Sets desktop wallpaper using registry
- Suspicious use of UnmapMainImage
PID:1204
- C:\Users\Admin\AppData\Local\Temp\5ee5166c02636f294fb8f6da69d5c0ae893a1c4694ae1bcc3753b497598121a0\5ee5166c02636f294fb8f6da69d5c0ae893.exe
  "C:\Users\Admin\AppData\Local\Temp\5ee5166c02636f294fb8f6da69d5c0ae893a1c4694ae1bcc3753b497598121a0\5ee5166c02636f294fb8f6da69d5c0ae893.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2676

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
1⤵
- Drops desktop.ini file(s)
- Enumerates connected drives
- Drops file in Program Files directory
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
PID:608
- C:\Windows\system32\wbem\wmiprvse.exe
  C:\Windows\system32\wbem\wmiprvse.exe -Embedding
  2⤵
  PID:2560
- C:\Windows\system32\DllHost.exe
  C:\Windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}
  2⤵
  PID:1336

C:\Windows\system32\taskeng.exe
taskeng.exe {DA96CEF5-8231-4C57-8C72-6C078EC0B9FE} S-1-5-18:NT AUTHORITY\System:Service:
1⤵
- Suspicious use of WriteProcessMemory
PID:2868
- C:\Users\Admin\AppData\Local\Temp\xuwiumk.exe
  C:\Users\Admin\AppData\Local\Temp\xuwiumk.exe
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2736
- - C:\Windows\SysWOW64\vssadmin.exe
    vssadmin delete shadows all
    3⤵
    - Interacts with shadow copies
    PID:1524
- - C:\Users\Admin\AppData\Local\Temp\xuwiumk.exe
    "C:\Users\Admin\AppData\Local\Temp\xuwiumk.exe" -u
    3⤵
    - Executes dropped EXE
    PID:800

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Defacement

T1491

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

fkayusg

Path C:\ProgramData\Adobe\fkayusg
Size 654B
SHA256 bc0d58f65ea394bd70903960dfa8613acad4901e35f8a10cab5df6789b6672e9
MD5 b835d5d36dd5ad8e66e2b809a5dd3839
SHA1 d20d121c209dcf0d12cbf5da16de80e7159838f9
SHA512 4037988e0c4e4ea0d283230229eb88076f7f4f163ce8f4e95b60d5b24fb93ac6d41c841e822b95097a42f202cefef6bbc4ef3bce4a12526625a794dbeca3a733
MD5 SHA1 SHA512

Submit Download

fkayusg

Path C:\ProgramData\Adobe\fkayusg
Size 654B
SHA256 c85cba278eb93b9c0c6f19636f23bcfe39577ba16da703fe1d012b19ce3edcbb
MD5 d4c3ab1feac13d04b2a2a73602f40aed
SHA1 beee1ca749cd62616172d5b14695f1aa40060a16
SHA512 d96b70818421be7ea1689dbff06fcdf62eb160c32cf63e83a098255b72ca239419a9bd8b4b0be9506ac7a4061df89949c5006c672f47a3d52c23c4b48414a081
MD5 SHA1 SHA512

Submit Download

xuwiumk.exe

Path C:\Users\Admin\AppData\Local\Temp\xuwiumk.exe
Size 1.1MB
SHA256 f210148ae3309d2a6adb8442c730dc44ce2cf89db3cd0b467a0322a97c6853b8
MD5 b825019cda619718ed5c704327d8832d
SHA1 305ca2cd4dac0c560ee4bec107a8a3fdfaa4ec95
SHA512 d993ee286274b1f5df35677dbe85dbe2629a6f8d569bbfb4df05282b8aeb250ca7b1eba6bc10bbfc94742d2d1b930a1126e30636314aa1f472a427d0f5b836e5
SSDEEP 12288:QnQY+2XG1Inz4vM/nlBKSduzxx73zDJnaPxMrFHQJGTTq:QbGOnbzuHT5naPxUHQATTq
MD5 SHA1 SHA512 SSDEEP

Submit Download

xuwiumk.exe

Path C:\Users\Admin\AppData\Local\Temp\xuwiumk.exe
Size 844KB
SHA256 a127ad26fed4453f4150f8d527a82e698be2eac4820953df54565cd1ecfbe6d9
MD5 c7a4045f61227cbc8d16e4fe8a07ff63
SHA1 a4bc953936cda6de6958fa91ad5f44e3e9bff5bd
SHA512 9fbb74410dd200cd6b6ebfcc99c89d6a58d64a2c880b33bcdb9df58f0ae487022433ab057c04e77ac9966997f8d07a7b7e5c2b1d15f163d085e3bd76b52813b3
SSDEEP 12288:QnQY+2XG1Inz4vM/nlBKSduzxx73zDJnaPxMrFHQJGTTq:QbGOnbzuHT5naPxUHQATTq
MD5 SHA1 SHA512 SSDEEP

Submit Download

xuwiumk.exe

Path C:\Users\Admin\AppData\Local\Temp\xuwiumk.exe
Size 462KB
SHA256 8abbc04966d9f4566c5f2a008181aa4013d42a53898b2637b79042f7419e6ff1
MD5 71552eb371b63cb3c482dba415cbd032
SHA1 228ec45275065ebc0a0492a5fdc66cf626696af5
SHA512 90c5920be8c566cc3c8fa7a71835318bce941d26e61bcae3b76f608afe1980435ab2e217359d8ba17b377bf3dcc68e7892d48d5f9977324764ea561a32aeea4d
SSDEEP 12288:QnQY+2XG1Inz4vM/nlBKSduzxx73zDJnaPxMrFz:QbGOnbzuHT5naPxUz
MD5 SHA1 SHA512 SSDEEP

Submit Download

desktop.ini

Path F:\$RECYCLE.BIN\S-1-5-18\desktop.ini
Size 129B
SHA256 e1b9ce9b57957b1a0607a72a057d6b7a9b34ea60f3f8aa8f38a3af979bd23066
MD5 a526b9e7c716b3489d8cc062fbce4005
SHA1 2df502a944ff721241be20a9e449d2acd07e0312
SHA512 d83d4c656c96c3d1809ad06ce78fa09a77781461c99109e4b81d1a186fc533a7e72d65a4cb7edf689eeccda8f687a13d3276f1111a1e72f7c3cd92a49bce0f88
MD5 SHA1 SHA512

Submit Download

memory/608-1222-0x0000000000510000-0x0000000000587000-memory.dmp

Download

memory/608-21-0x0000000000510000-0x0000000000587000-memory.dmp

Download

memory/608-14-0x0000000000510000-0x0000000000587000-memory.dmp

Download

memory/608-15-0x0000000000510000-0x0000000000587000-memory.dmp

Download

memory/608-18-0x0000000000510000-0x0000000000587000-memory.dmp

Download

memory/608-11-0x0000000000510000-0x0000000000587000-memory.dmp

Download

memory/608-20-0x0000000000510000-0x0000000000587000-memory.dmp

Download

memory/608-12-0x0000000000510000-0x0000000000587000-memory.dmp

Download

memory/608-324-0x0000000000510000-0x0000000000587000-memory.dmp

Download

memory/2676-1-0x0000000000030000-0x0000000000031000-memory.dmp

Download

memory/2676-2-0x00000000007E0000-0x0000000000A2B000-memory.dmp

Download

memory/2676-0-0x00000000005C0000-0x00000000007DA000-memory.dmp

Download

memory/2736-8-0x0000000000B10000-0x0000000000D5B000-memory.dmp

Download

memory/2736-1234-0x0000000000B10000-0x0000000000D5B000-memory.dmp

Download

memory/2736-1244-0x0000000000B10000-0x0000000000D5B000-memory.dmp

Download