Analysis
-
max time kernel
1560s -
max time network
1562s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
13-05-2024 12:21
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
Ransom.exe
Resource
win7-20240221-en
windows7-x64
12 signatures
1800 seconds
General
-
Target
Ransom.exe
-
Size
478KB
-
MD5
84031b20c90d39fbe5cf32d911d9d97f
-
SHA1
59d39489b0a6df6cebdca58582aae00570e77ffb
-
SHA256
cd4a0eb09f75eec216da6059e0192a1a544b4ee4a97c1af6a11151ecad1fd546
-
SHA512
a286e1806a94a5919dab1c200c6dd7eea4a0d723890e9d883d77b91ca73e27d8ea6d5961995512b4730c1f28f245d0c7d51f916e5fdf945b7c1d0b661ddccce2
-
SSDEEP
6144:g0wWJI6+TLinfTRwkL74ST1AtwEfDasWxxsBhi37b8o6XCFy/dCZB8n4DT:4QfSkL74STmtqsWxxAhIIlXC4/S8GT
Score
10/10
Malware Config
Extracted
Path
\Device\HarddiskVolume1\HOW TO BACK FILES.txt
Ransom Note
Hello
Your data has been stolen and encrypted
We will delete the stolen data and help with the recovery of encrypted files after payment has been made
Do not try to change or restore files yourself, this will break them
We provide free decryption for any 3 files up to 3MB in size on our website
How to contact with us:
1) Download and install TOR browser by this link: https://www.torproject.org/download/
2) If TOR blocked in your country and you can't access to the link then use any VPN software
3) Run TOR browser and open the site: wtyafjyhwqrgo4a45wdvvwhen3cx4euie73qvlhkhvlrexljoyuklaad.onion/mallox/privateSignin
4) Copy your private ID in the input field. Your Private key: 7849111CA05A565DC6A00E45
5) You will see chat, payment information and we can make free test decryption here
Our blog of leaked companies:
wtyafjyhwqrgo4a45wdvvwhen3cx4euie73qvlhkhvlrexljoyuklaad.onion
�
URLs
http://wtyafjyhwqrgo4a45wdvvwhen3cx4euie73qvlhkhvlrexljoyuklaad.onion/mallox/privateSignin
http://wtyafjyhwqrgo4a45wdvvwhen3cx4euie73qvlhkhvlrexljoyuklaad.onion
Signatures
-
TargetCompany,Mallox
TargetCompany (aka Mallox) is a ransomware which encrypts files using a combination of ChaCha20, AES-128, and Curve25519, first seen in June 2021.
-
Modifies boot configuration data using bcdedit 1 TTPs 2 IoCs
pid Process 2908 bcdedit.exe 1940 bcdedit.exe -
Renames multiple (7252) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Enumerates connected drives 3 TTPs 24 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\U: Ransom.exe File opened (read-only) \??\E: Ransom.exe File opened (read-only) \??\G: Ransom.exe File opened (read-only) \??\I: Ransom.exe File opened (read-only) \??\Q: Ransom.exe File opened (read-only) \??\D: Ransom.exe File opened (read-only) \??\L: Ransom.exe File opened (read-only) \??\N: Ransom.exe File opened (read-only) \??\V: Ransom.exe File opened (read-only) \??\W: Ransom.exe File opened (read-only) \??\X: Ransom.exe File opened (read-only) \??\Z: Ransom.exe File opened (read-only) \??\B: Ransom.exe File opened (read-only) \??\P: Ransom.exe File opened (read-only) \??\R: Ransom.exe File opened (read-only) \??\K: Ransom.exe File opened (read-only) \??\M: Ransom.exe File opened (read-only) \??\O: Ransom.exe File opened (read-only) \??\S: Ransom.exe File opened (read-only) \??\T: Ransom.exe File opened (read-only) \??\A: Ransom.exe File opened (read-only) \??\H: Ransom.exe File opened (read-only) \??\J: Ransom.exe File opened (read-only) \??\Y: Ransom.exe -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 4 api.ipify.org -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-modules-favorites.xml Ransom.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-autoupdate-services_ja.jar Ransom.exe File opened for modification C:\Program Files\Windows Media Player\de-DE\WMPSideShowGadget.exe.mui Ransom.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0185818.WMF Ransom.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\PH03205I.JPG Ransom.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBSPAPR\PDIR13F.GIF Ransom.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\ext\zipfs.jar Ransom.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\nb\LC_MESSAGES\vlc.mo Ransom.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\PH02746U.BMP Ransom.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Templates\1033\MedianReport.Dotx Ransom.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\ResizingPanels\bandwidth.png Ransom.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Etc\GMT-11 Ransom.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\SY01563_.WMF Ransom.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD14578_.GIF Ransom.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\SEARCH.GIF Ransom.exe File opened for modification C:\Program Files\Windows Media Player\ja-JP\WMPDMC.exe.mui Ransom.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\css\ui-lightness\images\ui-bg_highlight-soft_75_ffe45c_1x100.png Ransom.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0107152.WMF Ransom.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Swirl.css Ransom.exe File created C:\Program Files (x86)\Microsoft Visual Studio 8\VSTA\HOW TO BACK FILES.txt Ransom.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\fur\HOW TO BACK FILES.txt Ransom.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0216600.WMF Ransom.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0287641.JPG Ransom.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0183198.WMF Ransom.exe File created C:\Program Files\VideoLAN\VLC\lua\meta\HOW TO BACK FILES.txt Ransom.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\HOW TO BACK FILES.txt Ransom.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Zaporozhye Ransom.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\hr\LC_MESSAGES\vlc.mo Ransom.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\EXLIRM.XML Ransom.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolBMPs\spacebackupicons.jpg Ransom.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.css.core.nl_ja_4.4.0.v20140623020002.jar Ransom.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\Mac\GREEK.TXT Ransom.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\TR00172_.WMF Ransom.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBFTSCM\SCHEME46.CSS Ransom.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\mc.jar Ransom.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\bg_FormsHomePageBlank.gif Ransom.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\PARNT_03.MID Ransom.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD21310_.GIF Ransom.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\MSTORE_COL.HXT Ransom.exe File opened for modification C:\Program Files\DVD Maker\en-US\HOW TO BACK FILES.txt Ransom.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Hebron Ransom.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0086420.WMF Ransom.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\NA00530_.WMF Ransom.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins3d\2d.x3d Ransom.exe File created C:\Program Files\VideoLAN\VLC\plugins\packetizer\HOW TO BACK FILES.txt Ransom.exe File opened for modification C:\Program Files (x86)\Windows Media Player\Visualizations\HOW TO BACK FILES.txt Ransom.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ecf.provider.filetransfer.httpclient4_1.0.800.v20140827-1444.jar Ransom.exe File opened for modification C:\Program Files\Windows Media Player\ja-JP\wmpnetwk.exe.mui Ransom.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.core_5.5.0.165303\HOW TO BACK FILES.txt Ransom.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0188511.WMF Ransom.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\core\org-openide-filesystems.jar Ransom.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0182902.WMF Ransom.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PAGESIZE\PGLBL081.XML Ransom.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\HOW TO BACK FILES.txt Ransom.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\LINES\BD21324_.GIF Ransom.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolBMPs\LoginTool24x24ImagesMask.bmp Ransom.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PUBBA\MSPUB11.BDR Ransom.exe File created C:\Program Files\Mozilla Firefox\browser\features\HOW TO BACK FILES.txt Ransom.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\HOW TO BACK FILES.txt Ransom.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0105328.WMF Ransom.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\TEAROFF.POC Ransom.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\HOW TO BACK FILES.txt Ransom.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\org-netbeans-modules-templates.xml_hidden Ransom.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\AUTOSHAP\BD18255_.WMF Ransom.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 856 Ransom.exe 856 Ransom.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeTakeOwnershipPrivilege 856 Ransom.exe Token: SeDebugPrivilege 856 Ransom.exe Token: SeTakeOwnershipPrivilege 856 Ransom.exe Token: SeTakeOwnershipPrivilege 856 Ransom.exe Token: SeTakeOwnershipPrivilege 856 Ransom.exe Token: SeTakeOwnershipPrivilege 856 Ransom.exe Token: SeTakeOwnershipPrivilege 856 Ransom.exe Token: SeTakeOwnershipPrivilege 856 Ransom.exe Token: SeTakeOwnershipPrivilege 856 Ransom.exe Token: SeTakeOwnershipPrivilege 856 Ransom.exe Token: SeTakeOwnershipPrivilege 856 Ransom.exe Token: SeTakeOwnershipPrivilege 856 Ransom.exe Token: SeTakeOwnershipPrivilege 856 Ransom.exe Token: SeTakeOwnershipPrivilege 856 Ransom.exe Token: SeTakeOwnershipPrivilege 856 Ransom.exe Token: SeTakeOwnershipPrivilege 856 Ransom.exe Token: SeTakeOwnershipPrivilege 856 Ransom.exe Token: SeTakeOwnershipPrivilege 856 Ransom.exe Token: SeTakeOwnershipPrivilege 856 Ransom.exe Token: SeTakeOwnershipPrivilege 856 Ransom.exe Token: SeTakeOwnershipPrivilege 856 Ransom.exe Token: SeTakeOwnershipPrivilege 856 Ransom.exe Token: SeTakeOwnershipPrivilege 856 Ransom.exe Token: SeTakeOwnershipPrivilege 856 Ransom.exe Token: SeTakeOwnershipPrivilege 856 Ransom.exe Token: SeTakeOwnershipPrivilege 856 Ransom.exe Token: SeTakeOwnershipPrivilege 856 Ransom.exe Token: SeTakeOwnershipPrivilege 856 Ransom.exe Token: SeTakeOwnershipPrivilege 856 Ransom.exe Token: SeTakeOwnershipPrivilege 856 Ransom.exe Token: SeTakeOwnershipPrivilege 856 Ransom.exe Token: SeTakeOwnershipPrivilege 856 Ransom.exe Token: SeTakeOwnershipPrivilege 856 Ransom.exe Token: SeTakeOwnershipPrivilege 856 Ransom.exe Token: SeTakeOwnershipPrivilege 856 Ransom.exe Token: SeTakeOwnershipPrivilege 856 Ransom.exe Token: SeTakeOwnershipPrivilege 856 Ransom.exe Token: SeTakeOwnershipPrivilege 856 Ransom.exe Token: SeTakeOwnershipPrivilege 856 Ransom.exe Token: SeTakeOwnershipPrivilege 856 Ransom.exe Token: SeTakeOwnershipPrivilege 856 Ransom.exe Token: SeTakeOwnershipPrivilege 856 Ransom.exe Token: SeTakeOwnershipPrivilege 856 Ransom.exe Token: SeTakeOwnershipPrivilege 856 Ransom.exe Token: SeTakeOwnershipPrivilege 856 Ransom.exe Token: SeTakeOwnershipPrivilege 856 Ransom.exe Token: SeTakeOwnershipPrivilege 856 Ransom.exe Token: SeTakeOwnershipPrivilege 856 Ransom.exe Token: SeTakeOwnershipPrivilege 856 Ransom.exe Token: SeTakeOwnershipPrivilege 856 Ransom.exe Token: SeTakeOwnershipPrivilege 856 Ransom.exe Token: SeTakeOwnershipPrivilege 856 Ransom.exe Token: SeTakeOwnershipPrivilege 856 Ransom.exe Token: SeTakeOwnershipPrivilege 856 Ransom.exe Token: SeTakeOwnershipPrivilege 856 Ransom.exe Token: SeTakeOwnershipPrivilege 856 Ransom.exe Token: SeTakeOwnershipPrivilege 856 Ransom.exe Token: SeTakeOwnershipPrivilege 856 Ransom.exe Token: SeTakeOwnershipPrivilege 856 Ransom.exe Token: SeTakeOwnershipPrivilege 856 Ransom.exe Token: SeTakeOwnershipPrivilege 856 Ransom.exe Token: SeTakeOwnershipPrivilege 856 Ransom.exe Token: SeTakeOwnershipPrivilege 856 Ransom.exe Token: SeTakeOwnershipPrivilege 856 Ransom.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 3244 NOTEPAD.EXE -
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 856 wrote to memory of 2368 856 Ransom.exe 28 PID 856 wrote to memory of 2368 856 Ransom.exe 28 PID 856 wrote to memory of 2368 856 Ransom.exe 28 PID 856 wrote to memory of 3052 856 Ransom.exe 30 PID 856 wrote to memory of 3052 856 Ransom.exe 30 PID 856 wrote to memory of 3052 856 Ransom.exe 30 PID 2368 wrote to memory of 2908 2368 cmd.exe 32 PID 2368 wrote to memory of 2908 2368 cmd.exe 32 PID 2368 wrote to memory of 2908 2368 cmd.exe 32 PID 3052 wrote to memory of 1940 3052 cmd.exe 33 PID 3052 wrote to memory of 1940 3052 cmd.exe 33 PID 3052 wrote to memory of 1940 3052 cmd.exe 33 -
System policy modification 1 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\shutdownwithoutlogon = "0" Ransom.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Ransom.exe"C:\Users\Admin\AppData\Local\Temp\Ransom.exe"1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:856 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c bcdedit /set {current} bootstatuspolicy ignoreallfailures2⤵
- Suspicious use of WriteProcessMemory
PID:2368 -
C:\Windows\system32\bcdedit.exebcdedit /set {current} bootstatuspolicy ignoreallfailures3⤵
- Modifies boot configuration data using bcdedit
PID:2908
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c bcdedit /set {current} recoveryenabled no2⤵
- Suspicious use of WriteProcessMemory
PID:3052 -
C:\Windows\system32\bcdedit.exebcdedit /set {current} recoveryenabled no3⤵
- Modifies boot configuration data using bcdedit
PID:1940
-
-
-
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\HOW TO BACK FILES.txt1⤵
- Suspicious use of FindShellTrayWindow
PID:3244
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
908B
MD530f8ce4208ff6bc25d82e14450716784
SHA1b41c54f64b838b15085c4e23c39ca9ce30c4d1b5
SHA2566dccd925fbddc6d382feda262b6162e73759ef1ff7a240a71d7b64f8753ca633
SHA51205249e2b56575f0e25b75e2cda5ad94893b66942f98ef39f91f2087d20924d66e3f1e7b49d1b48da10eb21ca347e121241a19343f7927cf2e6511e1138c4d04a