Overview

overview

10

Static

static

8

samples (2) (4).zip

windows7-x64

1

samples (2) (4).zip

windows10-2004-x64

1

10d1a82f3c...61.exe

windows7-x64

1

10d1a82f3c...61.exe

windows10-2004-x64

1

133dd26c0a...f0.exe

windows7-x64

10

133dd26c0a...f0.exe

windows10-2004-x64

10

1ab3aad04e...7d.exe

windows7-x64

6

1ab3aad04e...7d.exe

windows10-2004-x64

1

1ad4c9e3d0...7d.exe

windows7-x64

1

1ad4c9e3d0...7d.exe

windows10-2004-x64

1

27cc1f6adc...35.wsf

windows7-x64

8

27cc1f6adc...35.wsf

windows10-2004-x64

8

35b7dbc8a3...31.exe

windows7-x64

9

35b7dbc8a3...31.exe

windows10-2004-x64

10

3716dc17e9...c6.dll

windows7-x64

1

3716dc17e9...c6.dll

windows10-2004-x64

3

5e94c0f064...2e.exe

windows7-x64

6

5e94c0f064...2e.exe

windows10-2004-x64

7

70f166f51e...ad.exe

windows7-x64

1

70f166f51e...ad.exe

windows10-2004-x64

1

93dc1dee6b...1a.chm

windows7-x64

10

93dc1dee6b...1a.chm

windows10-2004-x64

10

a37f77fafa...58.ps1

windows7-x64

1

a37f77fafa...58.ps1

windows10-2004-x64

1

b875cc39a6...395.js

windows7-x64

8

b875cc39a6...395.js

windows10-2004-x64

8

b906da71fe...be.exe

windows7-x64

1

b906da71fe...be.exe

windows10-2004-x64

1

bae7ee765f...c.docm

windows7-x64

1

bae7ee765f...c.docm

windows10-2004-x64

1

c3fdcec878...07.exe

windows7-x64

4

c3fdcec878...07.exe

windows10-2004-x64

4

Analysis

  • max time kernel
    157s
  • max time network
    147s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    01-01-2024 15:12

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    35b7dbc8a3f456bdafd02383b8a849a6f5fea5f541b3f0c8502e31c2370e8f31.exe

  • Size

    27KB

  • MD5

    c07f470b64e08cbd00007511018aae5d

  • SHA1

    8cc03df9554f3f2b88f9a416908aa2e35c0ef386

  • SHA256

    35b7dbc8a3f456bdafd02383b8a849a6f5fea5f541b3f0c8502e31c2370e8f31

  • SHA512

    21472125818d699a7da51cb765f3364a1f8b696a4fdbb4f8c6d9572f49e3858fac84fe76d796d1488b64ecb590ad74b9db950071420815879408c6ca5e3a10f5

  • SSDEEP

    768:lYIyiTHKDpYIvJbEoc59Rdh7dQV6kzZt5txJc49WQ:UimJbEj59JpQV6kzZ3Jc49Z

Score
10/10
fantomransomwarespywarestealer

Malware Config

Extracted

Path

C:\ProgramData\Adobe\Setup\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\DECRYPT_YOUR_FILES.HTML

Ransom Note
<div style="text-align: center;">&nbsp;</div> <div style="text-align: center;">&nbsp;</div> <div> <div style="text-align: center;"><strong><img src="http://img07.deviantart.net/b958/i/2012/173/1/5/fuck_society_by_florinbrl-d54eqhq.jpg" alt="" width="500" height="250" /></strong></div> <div style="text-align: center;">&nbsp;</div> <div style="text-align: center;"><strong>All your files have been encrypted with Fuck Society Ransomware</strong></div> <div style="text-align: center;">&nbsp;</div> <div style="text-align: center;"><strong>YOU HAVE 5 DAY TO MAKE PAYMENT OR ALL YOUR FILES HAVE BEEN DELETED!</strong></div> <div style="text-align: center;"><strong>For each file unique ,strong key. Algorithm RSA4096 look at https://en.wikipedia.org/wiki/RSA_(cryptosystem) </strong></div> <div style="text-align: center;">&nbsp;</div> <div style="text-align: center;">-All your attempts to restore files on their own, lead to the loss of the possibility of recovery and we are not going to help you.</div> <div style="text-align: center;">&nbsp;</div> <div> <div style="text-align: center;"><strong>Your unique ID for decrypt:</strong>&nbsp; &nbsp; &nbsp; &nbsp;<strong>505064e8-1f21-48a5-9c26-f3a774f4319e</strong></div> <div style="text-align: center;">&nbsp;</div> <div style="text-align: center;"><strong>FOR DECRYPT YOUR FILES , BUY YOUR UNIQUE DECRYPTION CONFIG:</strong></div> <div style="text-align: center;"><a href="https://satoshibox.com/r557zcj83k6gppy5rxbj3yqj/buy">https://satoshibox.com/r557zcj83k6gppy5rxbj3yqj/buy</a></div> <div>&nbsp;</div> <div>&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;<strong> &nbsp;In file you find link to decryptor , and link to decryption config file</strong></div> <div style="text-align: center;">&nbsp;</div> <div style="text-align: center;">&nbsp;</div> <div style="text-align: center;"><strong>Make your Bitcoin Wallet on:</strong></div> <div style="text-align: center;">&nbsp;</div> <div style="text-align: center;"><img src="http://bittrust.s3.amazonaws.com/1437541807.png" alt="" width="300" height="100" /></div> <div style="text-align: center;">&nbsp;</div> <div style="text-align: center;"><strong><a href="https://www.coinbase.com/" target="_parent"><img src="https://forum.bits.media/uploads/monthly_08_2014/post-9579-0-08769900-1409248426.png" alt="" width="400" height="93" /></a></strong></div> <div style="text-align: center;"><strong><a href="https://blockchain.info" target="_parent"><img src="http://www.obzorbtc.com/wp-content/uploads/2015/12/Blockchain-Logo-Blue6.png" alt="" width="400" height="117" /></a></strong></div> <div style="text-align: center;">&nbsp;</div> <div style="text-align: center;">&nbsp;</div> <div style="text-align: center;">&nbsp;</div> <div style="text-align: center;">&nbsp;</div> <div style="text-align: center;">&nbsp;</div> <div style="text-align: center;">&nbsp;</div> <div style="text-align: center;"><strong>YOU CAN BUY BITCOINS ON:</strong></div> <div style="text-align: center;">&nbsp;</div> <div style="text-align: center;">&nbsp;</div> <div style="text-align: center;">&nbsp;</div> <a href="btc-e.nz"><img style="display: block; margin-left: auto; margin-right: auto;" src="https://change-wm.com/wp-content/uploads/btc-e-bitcoin-exchange.png" alt="" width="400" height="139" /></a></div> <div> <div style="text-align: center;">&nbsp;</div> <div style="text-align: center;">&nbsp;</div> <div style="text-align: center;">&nbsp;</div> <div style="text-align: center;">&nbsp;<a href="https://localbitcoins.com"><img src="http://cryptoboom.info/002img/2014/btc/btc-038.png" alt="" width="400" height="136" /></a></div> <div style="text-align: center;">&nbsp;</div> <div style="text-align: center;"><strong>AND OTHER EXCHANGE SITES.</strong></div> <div style="text-align: center;"><strong>&nbsp;&nbsp;</strong></div> </div> </div> <p>&nbsp;</p>

Signatures

  • Fantom

    Ransomware which hides encryption process behind fake Windows Update screen.

    ransomwarefantom
  • Deletes shadow copies 2 TTPs

    Ransomware often targets backup files to inhibit system recovery.

    ransomware
  • Renames multiple (994) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file 2 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Interacts with shadow copies 2 TTPs 1 IoCs

    Shadow copies are often targeted by ransomware to inhibit system recovery.

    ransomware
  • Modifies registry class 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 6 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\35b7dbc8a3f456bdafd02383b8a849a6f5fea5f541b3f0c8502e31c2370e8f31.exe
    "C:\Users\Admin\AppData\Local\Temp\35b7dbc8a3f456bdafd02383b8a849a6f5fea5f541b3f0c8502e31c2370e8f31.exe"
    1⤵
    • Checks computer location settings
    • Drops startup file
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Modifies registry class
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:3240
    • C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Roaming\delback.bat"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:2200
      • C:\Windows\system32\vssadmin.exe
        vssadmin delete shadows /all /quiet
        3⤵
        • Interacts with shadow copies
        PID:2796
  • C:\Windows\system32\vssvc.exe
    C:\Windows\system32\vssvc.exe
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:2640

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\ProgramData\Adobe\Setup\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\DECRYPT_YOUR_FILES.HTML
    Filesize

    3KB

    MD5

    5fc6de48f8daef2747843818447db979

    SHA1

    d8bf8b4811596f37023c73ee3c3873ba9969bfd3

    SHA256

    0928285b5f9fc55f8cbf6253cc6e95447d370c91b407a21507f0b75b90424fd5

    SHA512

    af37d73a51d48b9d07d253bc3f100a67a2724a99615ebc19fb0d55194ff183f5f2a95b9d27b2565876c0822f92ee7f4b286dd40716bf92e2a05f2f7ddac16b08

    Download Submit

  • C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\C2RManifest.DCF.DCF.x-none.msi.16.x-none.xml
    Filesize

    15KB

    MD5

    58714eb7ff4b649084bb5c49d8c823c3

    SHA1

    fecab29d3d78a9e31c4c4d5157839441b8adb4c3

    SHA256

    d54fe2399fa4ba5986811d55d4474889249123f40f36d850682cf4b7c50c1cb0

    SHA512

    f5bc513c21f06c0b7e28b7c1ef9eebe423fda54f927c693296c0948600c427d160b553fae213f0a923e3c41eec69f3b65c0939bfa5678b3f2b5b6fe4f493b764

    Download Submit

  • C:\ProgramData\Microsoft\User Account Pictures\guest.png
    Filesize

    5KB

    MD5

    ce6ddd725b819a43517fe7d18353dec6

    SHA1

    8bbbf59a7f89c6acd1fe4473175f6b5c74f2e7a4

    SHA256

    f64982b1e5778c2f32712c600800517ff2675428d449bb95a01fa2585c938b38

    SHA512

    64276330fd3d63723b21e83ecd296c04a7cac89c3d659ca85ae721fb1bbf083a25a0988655af336709ea1618ce1306fd3477490409b3de5902bbe711294bad7a

    Download Submit

  • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133471062776609623.txt.dll
    Filesize

    47KB

    MD5

    5048b281201d68bb47f76cb69d27b1a4

    SHA1

    ed1bc5d37fa3b2c70aa186cc286b2ebdf064e774

    SHA256

    fa8fbee57263599cbf9f9171ccc60e4120a2e91f53d17d7c6347922c40b87166

    SHA512

    439bbb5ffbdb1b452acff09e033f24bdb629cc197b93f44a0f8f528a7a4d7125966ced8e9a884d9ccdc5ba6ecee1789bc1adceff83fe87c1dd8a79f55cf448f8

    Download Submit

  • C:\Users\Admin\AppData\Roaming\delback.bat
    Filesize

    35B

    MD5

    d41ac96c53b4fe0dfbe1b080649141c1

    SHA1

    b4d75213c61646b5bd48eadf723542fa9aef8b00

    SHA256

    325de85e48afabcc0d53d5f6d9371314d0ed6e46d91c271abceccca58cbbd238

    SHA512

    a65c10d4face73078643ebc99c022a19a5944cef222c27739bc94456bd7601b5f118d4f2738fbc8374b8ad86c927fa0dcca7177fc936409f3000b7b58a6c1563

    Download Submit

  • C:\vcredist2010_x86.log.html.dll
    Filesize

    81KB

    MD5

    10961b5899f613fb654d40b9e490043c

    SHA1

    200c3d0996f52b5711625583b0fe30c738bb7a1e

    SHA256

    2f5c6bce753d7741b5b8192ca5bb25eaaac804a0b9c08402ea0ce0f58a874182

    SHA512

    4da495cfe13e068a66b3a8c6cdb4fac5bd2e221c3683c26e0848c679ec8fc34642819520fcc163fbeeb55407f3598b7954f945efbe7eab1387b8e7d6a09a0a9c

    Download Submit

  • memory/3240-0-0x0000013C21A40000-0x0000013C21A4E000-memory.dmp

    Filesize

    56KB

    Download

  • memory/3240-1-0x00007FFBE7020000-0x00007FFBE7AE1000-memory.dmp

    Filesize

    10.8MB

    Download

  • memory/3240-2-0x00007FFBE7020000-0x00007FFBE7AE1000-memory.dmp

    Filesize

    10.8MB

    Download

  • memory/3240-5-0x0000013C238F0000-0x0000013C23900000-memory.dmp

    Filesize

    64KB

    Download