Analysis
- max time kernel
154s - max time network
161s - platform
windows10-2004_x64 - resource
win10v2004-20231215-en - resource tags
- submitted
01/01/2024, 15:38
General
- Target 1ce5dd21fbff44289d22647277a94f2611ee661cdcab323548caa0a7082ddc7d/1ce5dd21fbff44289d22647277a94f2611e.exe
- Size 919KB
- Sample240101-s2944adcem
- SHA256 1ce5dd21fbff44289d22647277a94f2611ee661cdcab323548caa0a7082ddc7d
Malware Config
Extracted
-
F:\$RECYCLE.BIN\How To Restore Your Files.txt
- !!! Your network is infected by the RTM Locker command!!! All your documents, photos, reports, customer and employee data, databases and other important files are encrypted and you cannot decrypt them yourself. They are also on our servers! But don't worry, we will help you recover all your files! The only way to recover your files is to buy our dedicated software. Only we can provide you with this software, and only we can recover your files! You can contact us by downloading and installing the TOR browser (https://www.torproject.org/download/languages/) We value our reputation. If we do not fulfill our work and obligations, no one will pay us. It's not in our interest. All of our decryption software is perfectly tested and will decrypt your data. We will also provide support in case of problems. ================================================= ============================================== Login link: http://3wugtklp46ufx7dnr6j5cd6ate7wnvnivsyvwuni7hqcqt7hm5r72nid.onion/1D85262A4B3F59090972E7EE7804FC641E9CBB6D65E5F4B376DF37D6180CD1/connect For authorization you need to enter your ID. !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! Warning!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! If you do not contact the support team within 48 hours, your data will be published in the public domain, and data compromising you will be sent to your competitors, as well as to the relevant regulatory authorities. ================================================================================================ You can also contact us at tox. You can download it here: https://tox.chat/download.html Our contact: A0FE105A82525ECB94DD2977B4A1F8A5A7CF82F12D720DD8C8D9CCA3F98B6F52D911126AC1DF ================================================================================================ DO NOT ATTEMPT TO RECOVER THE FILES YOURSELF! DO NOT MODIFY ENCRYPTED FILES! OTHERWISE YOU MAY LOSE ALL YOUR FILES FOREVER! ================================================================================================
-
http://3wugtklp46ufx7dnr6j5cd6ate7wnvnivsyvwuni7hqcqt7hm5r72nid.onion/1D85262A4B3F59090972E7EE7804FC641E9CBB6D65E5F4B376DF37D6180CD1/connect
-
https://tox.chat/download.html
Signatures
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Drops desktop.ini file(s) 18 IoCs
- Enumerates connected drives 3 TTPs 24 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
- Drops file in System32 directory 1 IoCs
- Sets desktop wallpaper using registry 2 TTPs 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
- Enumerates system info in registry 2 TTPs 3 IoCs
- Runs ping.exe 1 TTPs 1 IoCs
- Suspicious behavior: EnumeratesProcesses 4 IoCs
- Suspicious use of AdjustPrivilegeToken 7 IoCs
- Suspicious use of SetWindowsHookEx 13 IoCs
- Suspicious use of WriteProcessMemory 10 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\1ce5dd21fbff44289d22647277a94f2611ee661cdcab323548caa0a7082ddc7d\1ce5dd21fbff44289d22647277a94f2611e.exe"C:\Users\Admin\AppData\Local\Temp\1ce5dd21fbff44289d22647277a94f2611ee661cdcab323548caa0a7082ddc7d\1ce5dd21fbff44289d22647277a94f2611e.exe"1⤵
- Checks computer location settings
- Drops desktop.ini file(s)
- Enumerates connected drives
- Sets desktop wallpaper using registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\splwow64.exeC:\Windows\splwow64.exe 122882⤵
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c PING -n 5 127.0.0.1 > NUL && del "C:\Users\Admin\AppData\Local\Temp\1ce5dd21fbff44289d22647277a94f2611ee661cdcab323548caa0a7082ddc7d\1ce5dd21fbff44289d22647277a94f2611e.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\PING.EXEPING -n 5 127.0.0.13⤵
- Runs ping.exe
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc1⤵
-
C:\Windows\system32\printfilterpipelinesvc.exeC:\Windows\system32\printfilterpipelinesvc.exe -Embedding1⤵
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE/insertdoc "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\{866BC266-E6DD-4B69-8033-7C456D240731}.xps" 1334859736941700002⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
{110E73F9-E4FD-4D1B-BBD6-473CBB68FCB7}
How To Restore Your Files.txt
memory/4756-444-0x00007FFA4F430000-0x00007FFA4F625000-memory.dmp
memory/4756-440-0x00007FFA0F4B0000-0x00007FFA0F4C0000-memory.dmp
memory/4756-436-0x00007FFA0F4B0000-0x00007FFA0F4C0000-memory.dmp
memory/4756-439-0x00007FFA4F430000-0x00007FFA4F625000-memory.dmp
memory/4756-438-0x00007FFA0F4B0000-0x00007FFA0F4C0000-memory.dmp
memory/4756-441-0x00007FFA4F430000-0x00007FFA4F625000-memory.dmp
memory/4756-435-0x00007FFA4F430000-0x00007FFA4F625000-memory.dmp
memory/4756-443-0x00007FFA4F430000-0x00007FFA4F625000-memory.dmp
memory/4756-442-0x00007FFA0F4B0000-0x00007FFA0F4C0000-memory.dmp
memory/4756-437-0x00007FFA4F430000-0x00007FFA4F625000-memory.dmp
memory/4756-445-0x00007FFA4F430000-0x00007FFA4F625000-memory.dmp
memory/4756-448-0x00007FFA0CB50000-0x00007FFA0CB60000-memory.dmp
memory/4756-449-0x00007FFA0CB50000-0x00007FFA0CB60000-memory.dmp
memory/4756-434-0x00007FFA0F4B0000-0x00007FFA0F4C0000-memory.dmp
memory/4756-467-0x00007FFA4F430000-0x00007FFA4F625000-memory.dmp
memory/4756-468-0x00007FFA4F430000-0x00007FFA4F625000-memory.dmp
memory/4756-472-0x00007FFA4F430000-0x00007FFA4F625000-memory.dmp