Analysis
-
max time kernel
1560s -
max time network
1560s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
13-05-2024 18:07
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
Ransom.exe
Resource
win7-20240221-en
windows7-x64
11 signatures
1800 seconds
General
-
Target
Ransom.exe
-
Size
478KB
-
MD5
84031b20c90d39fbe5cf32d911d9d97f
-
SHA1
59d39489b0a6df6cebdca58582aae00570e77ffb
-
SHA256
cd4a0eb09f75eec216da6059e0192a1a544b4ee4a97c1af6a11151ecad1fd546
-
SHA512
a286e1806a94a5919dab1c200c6dd7eea4a0d723890e9d883d77b91ca73e27d8ea6d5961995512b4730c1f28f245d0c7d51f916e5fdf945b7c1d0b661ddccce2
-
SSDEEP
6144:g0wWJI6+TLinfTRwkL74ST1AtwEfDasWxxsBhi37b8o6XCFy/dCZB8n4DT:4QfSkL74STmtqsWxxAhIIlXC4/S8GT
Score
10/10
Malware Config
Extracted
Path
C:\HOW TO BACK FILES.txt
Ransom Note
Hello
Your data has been stolen and encrypted
We will delete the stolen data and help with the recovery of encrypted files after payment has been made
Do not try to change or restore files yourself, this will break them
We provide free decryption for any 3 files up to 3MB in size on our website
How to contact with us:
1) Download and install TOR browser by this link: https://www.torproject.org/download/
2) If TOR blocked in your country and you can't access to the link then use any VPN software
3) Run TOR browser and open the site: wtyafjyhwqrgo4a45wdvvwhen3cx4euie73qvlhkhvlrexljoyuklaad.onion/mallox/privateSignin
4) Copy your private ID in the input field. Your Private key: 0BABF58254AF52B561CE8B9C
5) You will see chat, payment information and we can make free test decryption here
Our blog of leaked companies:
wtyafjyhwqrgo4a45wdvvwhen3cx4euie73qvlhkhvlrexljoyuklaad.onion
�
URLs
http://wtyafjyhwqrgo4a45wdvvwhen3cx4euie73qvlhkhvlrexljoyuklaad.onion/mallox/privateSignin
http://wtyafjyhwqrgo4a45wdvvwhen3cx4euie73qvlhkhvlrexljoyuklaad.onion
Signatures
-
TargetCompany,Mallox
TargetCompany (aka Mallox) is a ransomware which encrypts files using a combination of ChaCha20, AES-128, and Curve25519, first seen in June 2021.
-
Modifies boot configuration data using bcdedit 1 TTPs 2 IoCs
pid Process 2928 bcdedit.exe 860 bcdedit.exe -
Renames multiple (7281) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Enumerates connected drives 3 TTPs 24 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\Y: Ransom.exe File opened (read-only) \??\D: Ransom.exe File opened (read-only) \??\B: Ransom.exe File opened (read-only) \??\H: Ransom.exe File opened (read-only) \??\J: Ransom.exe File opened (read-only) \??\Q: Ransom.exe File opened (read-only) \??\V: Ransom.exe File opened (read-only) \??\R: Ransom.exe File opened (read-only) \??\T: Ransom.exe File opened (read-only) \??\A: Ransom.exe File opened (read-only) \??\G: Ransom.exe File opened (read-only) \??\I: Ransom.exe File opened (read-only) \??\L: Ransom.exe File opened (read-only) \??\M: Ransom.exe File opened (read-only) \??\P: Ransom.exe File opened (read-only) \??\U: Ransom.exe File opened (read-only) \??\X: Ransom.exe File opened (read-only) \??\Z: Ransom.exe File opened (read-only) \??\N: Ransom.exe File opened (read-only) \??\O: Ransom.exe File opened (read-only) \??\E: Ransom.exe File opened (read-only) \??\K: Ransom.exe File opened (read-only) \??\S: Ransom.exe File opened (read-only) \??\W: Ransom.exe -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 4 api.ipify.org -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\FORMS\1033\SCHDRESP.CFG Ransom.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\MSTHED98.POC Ransom.exe File opened for modification C:\Program Files (x86)\Windows Media Player\it-IT\WMPMediaSharing.dll.mui Ransom.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.workbench.renderers.swt_0.12.1.v20140903-1023.jar Ransom.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\SO02054_.WMF Ransom.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\BD19986_.WMF Ransom.exe File created C:\Program Files\VideoLAN\VLC\locale\te\LC_MESSAGES\HOW TO BACK FILES.txt Ransom.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-modules-options-keymap.jar Ransom.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PAGESIZE\PGMN058.XML Ransom.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBSPAPR\PDIR49F.GIF Ransom.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\SpringGreen.css Ransom.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0287642.JPG Ransom.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\CAGCAT10\J0293234.WMF Ransom.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\CALENDAR.GIF Ransom.exe File created C:\Program Files\VideoLAN\VLC\locale\uk\HOW TO BACK FILES.txt Ransom.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0090779.WMF Ransom.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\WNTER_01.MID Ransom.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.launcher.nl_ja_4.4.0.v20140623020002.jar Ransom.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0178932.JPG Ransom.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\BL00252_.WMF Ransom.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\HH00687_.WMF Ransom.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0099160.JPG Ransom.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0386764.JPG Ransom.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\PH02758U.BMP Ransom.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Discussion.css Ransom.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\button-highlight.png Ransom.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.jetty.continuation_8.1.14.v20131031.jar Ransom.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\viewSelectionChanged.js Ransom.exe File opened for modification C:\Program Files\Java\jre7\lib\deploy\messages_sv.properties Ransom.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0153087.WMF Ransom.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\CAGCAT10\J0196164.WMF Ransom.exe File opened for modification C:\Program Files\Reference Assemblies\HOW TO BACK FILES.txt Ransom.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\ga\HOW TO BACK FILES.txt Ransom.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\Publisher\Backgrounds\WB02198_.GIF Ransom.exe File created C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\SubsetList\HOW TO BACK FILES.txt Ransom.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Argentina\San_Luis Ransom.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\VDKHome\ENU\VDK10.SYD Ransom.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\LINES\BD14595_.GIF Ransom.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\EXCEL.HXS Ransom.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\GMT-10 Ransom.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.equinox.p2.rcp.feature_1.2.0.v20140523-0116\META-INF\MANIFEST.MF Ransom.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Bibliography\Author2String.XSL Ransom.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\bg_OliveGreen.gif Ransom.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\SO02067_.WMF Ransom.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\MSOUC_K_COL.HXK Ransom.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0105396.WMF Ransom.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0153091.WMF Ransom.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\PH02040U.BMP Ransom.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBSPAPR\ZPDIR3B.GIF Ransom.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Full\NavigationRight_SelectionSubpicture.png Ransom.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-openide-actions.jar Ransom.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Port-au-Prince Ransom.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Pyongyang Ransom.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Palau Ransom.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\ModuleAutoDeps\org-netbeans-modules-options-api.xml Ransom.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0099163.WMF Ransom.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\PE00608_.WMF Ransom.exe File opened for modification C:\Program Files\AssertShow.ppsx Ransom.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\amd64\jvm.cfg Ransom.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\LINES\BD14882_.GIF Ransom.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Asia\Karachi Ransom.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\LINES\BD15034_.GIF Ransom.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\IN00915_.WMF Ransom.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\FieldTypePreview\RADIO.JPG Ransom.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2828 Ransom.exe 2828 Ransom.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeTakeOwnershipPrivilege 2828 Ransom.exe Token: SeDebugPrivilege 2828 Ransom.exe Token: SeTakeOwnershipPrivilege 2828 Ransom.exe Token: SeTakeOwnershipPrivilege 2828 Ransom.exe Token: SeTakeOwnershipPrivilege 2828 Ransom.exe Token: SeTakeOwnershipPrivilege 2828 Ransom.exe Token: SeTakeOwnershipPrivilege 2828 Ransom.exe Token: SeTakeOwnershipPrivilege 2828 Ransom.exe Token: SeTakeOwnershipPrivilege 2828 Ransom.exe Token: SeTakeOwnershipPrivilege 2828 Ransom.exe Token: SeTakeOwnershipPrivilege 2828 Ransom.exe Token: SeTakeOwnershipPrivilege 2828 Ransom.exe Token: SeTakeOwnershipPrivilege 2828 Ransom.exe Token: SeTakeOwnershipPrivilege 2828 Ransom.exe Token: SeTakeOwnershipPrivilege 2828 Ransom.exe Token: SeTakeOwnershipPrivilege 2828 Ransom.exe Token: SeTakeOwnershipPrivilege 2828 Ransom.exe Token: SeTakeOwnershipPrivilege 2828 Ransom.exe Token: SeTakeOwnershipPrivilege 2828 Ransom.exe Token: SeTakeOwnershipPrivilege 2828 Ransom.exe Token: SeTakeOwnershipPrivilege 2828 Ransom.exe Token: SeTakeOwnershipPrivilege 2828 Ransom.exe Token: SeTakeOwnershipPrivilege 2828 Ransom.exe Token: SeTakeOwnershipPrivilege 2828 Ransom.exe Token: SeTakeOwnershipPrivilege 2828 Ransom.exe Token: SeTakeOwnershipPrivilege 2828 Ransom.exe Token: SeTakeOwnershipPrivilege 2828 Ransom.exe Token: SeTakeOwnershipPrivilege 2828 Ransom.exe Token: SeTakeOwnershipPrivilege 2828 Ransom.exe Token: SeTakeOwnershipPrivilege 2828 Ransom.exe Token: SeTakeOwnershipPrivilege 2828 Ransom.exe Token: SeTakeOwnershipPrivilege 2828 Ransom.exe Token: SeTakeOwnershipPrivilege 2828 Ransom.exe Token: SeTakeOwnershipPrivilege 2828 Ransom.exe Token: SeTakeOwnershipPrivilege 2828 Ransom.exe Token: SeTakeOwnershipPrivilege 2828 Ransom.exe Token: SeTakeOwnershipPrivilege 2828 Ransom.exe Token: SeTakeOwnershipPrivilege 2828 Ransom.exe Token: SeTakeOwnershipPrivilege 2828 Ransom.exe Token: SeTakeOwnershipPrivilege 2828 Ransom.exe Token: SeTakeOwnershipPrivilege 2828 Ransom.exe Token: SeTakeOwnershipPrivilege 2828 Ransom.exe Token: SeTakeOwnershipPrivilege 2828 Ransom.exe Token: SeTakeOwnershipPrivilege 2828 Ransom.exe Token: SeTakeOwnershipPrivilege 2828 Ransom.exe Token: SeTakeOwnershipPrivilege 2828 Ransom.exe Token: SeTakeOwnershipPrivilege 2828 Ransom.exe Token: SeTakeOwnershipPrivilege 2828 Ransom.exe Token: SeTakeOwnershipPrivilege 2828 Ransom.exe Token: SeTakeOwnershipPrivilege 2828 Ransom.exe Token: SeTakeOwnershipPrivilege 2828 Ransom.exe Token: SeTakeOwnershipPrivilege 2828 Ransom.exe Token: SeTakeOwnershipPrivilege 2828 Ransom.exe Token: SeTakeOwnershipPrivilege 2828 Ransom.exe Token: SeTakeOwnershipPrivilege 2828 Ransom.exe Token: SeTakeOwnershipPrivilege 2828 Ransom.exe Token: SeTakeOwnershipPrivilege 2828 Ransom.exe Token: SeTakeOwnershipPrivilege 2828 Ransom.exe Token: SeTakeOwnershipPrivilege 2828 Ransom.exe Token: SeTakeOwnershipPrivilege 2828 Ransom.exe Token: SeTakeOwnershipPrivilege 2828 Ransom.exe Token: SeTakeOwnershipPrivilege 2828 Ransom.exe Token: SeTakeOwnershipPrivilege 2828 Ransom.exe Token: SeTakeOwnershipPrivilege 2828 Ransom.exe -
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 2828 wrote to memory of 2340 2828 Ransom.exe 28 PID 2828 wrote to memory of 2340 2828 Ransom.exe 28 PID 2828 wrote to memory of 2340 2828 Ransom.exe 28 PID 2828 wrote to memory of 2772 2828 Ransom.exe 30 PID 2828 wrote to memory of 2772 2828 Ransom.exe 30 PID 2828 wrote to memory of 2772 2828 Ransom.exe 30 PID 2340 wrote to memory of 2928 2340 cmd.exe 32 PID 2340 wrote to memory of 2928 2340 cmd.exe 32 PID 2340 wrote to memory of 2928 2340 cmd.exe 32 PID 2772 wrote to memory of 860 2772 cmd.exe 33 PID 2772 wrote to memory of 860 2772 cmd.exe 33 PID 2772 wrote to memory of 860 2772 cmd.exe 33 -
System policy modification 1 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\shutdownwithoutlogon = "0" Ransom.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Ransom.exe"C:\Users\Admin\AppData\Local\Temp\Ransom.exe"1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2828 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c bcdedit /set {current} bootstatuspolicy ignoreallfailures2⤵
- Suspicious use of WriteProcessMemory
PID:2340 -
C:\Windows\system32\bcdedit.exebcdedit /set {current} bootstatuspolicy ignoreallfailures3⤵
- Modifies boot configuration data using bcdedit
PID:2928
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c bcdedit /set {current} recoveryenabled no2⤵
- Suspicious use of WriteProcessMemory
PID:2772 -
C:\Windows\system32\bcdedit.exebcdedit /set {current} recoveryenabled no3⤵
- Modifies boot configuration data using bcdedit
PID:860
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
908B
MD5ec11feb48cfb0d46a6046f7cbf46aa4b
SHA1eb45612fd2fadf27e4bc5064051ebea088a60a65
SHA256df4a68a2160ff261ee096d9e1ea1f9ce8021e02e4ae75658cdca2697916ba561
SHA51264bd2f7cb5c3faeaa73d34924f83f141f985c4c44f7e0320feac11aef8515728f2d662f4d44b0d08f8c11cb79293b3945886e5a5e5418dc94d5aa0c435959dad