1c72875191a80e6e69d6e6c2edda738ad206767979851cfbb18dc0398ea191e4

General

Target

1c72875191a80e6e69d6e6c2edda738ad206767979851cfbb18dc0398ea191e4.exe
Size

136KB
MD5

ce1eefe48010f4946cf45ffd6c4bebfa
SHA1

18522badae740c53c22b0b05f58a233d390caab6
SHA256

1c72875191a80e6e69d6e6c2edda738ad206767979851cfbb18dc0398ea191e4
SHA512

9c021178294d28a5cb83732a99c5d8bc5dc375c716895ef1aa53df24af45b01bb221029fede634e72ca2e3c3711d5f992f181820c35a80fa315db4231ddb4ff8
SSDEEP

1536:Nxd+ReKXU/MQaL7k0B/L7s+Zi+GrZxtQpfyHvtICS4A4UdZls8XzUXiWr4X5F4GC:NtchTojrZxtMhiiZHjUyWr4X5FTDU

Score

10^/10

evasion ransomware

Malware Config

Extracted

Path

C:\Users\oreh4i-readme.txt

Ransom Note

---=== Welcome. Again. ===--- [-] Whats HapPen? [-] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension oreh4i. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practice - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/DE9B6522CECF0BF4 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decoder.re/DE9B6522CECF0BF4 Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: ml0wH1SsdFBZfJ5SVWzvskOpGky84/5ATYnAyq2x0QinSlZx9ziHosqI3ZinE8XY GIS86AKGLMZPAsTgLoNZk1WxTXyD25xcs+WGxpZYNf47N2bMjJoFIBTeiHPfoPIz kaTtxh/dn8Z5NG3Y8GogTp3b7zkN3A23lX/ey7fZOTGumTCinfedFEHg0v3691LI uZk21eVaL7DYQpGyM1VdwxCIjdceokH2nWv6w0kFp74PCqUyP0qjZfhHKOP1papn uNGaJ/RrTVhthZIKqTphelIYjDPomVMxGLWaLsmfPBfkSeJ2U4bHuXs4j6rSMlkB +B0kWHiIjtchSiEiywZ9iiYnEE4ZeLfqZo7rQomM4f7T3G02b+XWO6n0NvQV6z+y n78y7EK6Sm1B4mIrZai5+qHCsZXM5KZV+Wbw/eqfmIZ/JHESo0K5/LHEzN1a/eNE WXuM0N6vf77I0mVg+PfvdLwswK5aGtTEqOVey6n/xD1meyavvTuHhrVhI3VWJzZp sdlACF6nlCmdXTtojdIsJUObKnJniN4C/ZCyqiW2ThVPQ4ow9luv4LaY1B+SNVTW ljvSadGztBLfXF5xbqKaNPuh8ch9oEmcIC2IyBqR3Etl81V2l9GS9PCF+fjCKlwe 9Lx6fzyqr1HfcNuMVIAYhSk3c9mJra8+M+OyEWHG4xJbDPBHpEAYuGEi4GPUXycE L6PGG4bHIPxUwB3z+qtDJl9psqGqR6pjlVRmh1aG7FoxG5hSEN5jtuR9i+HnYc35 gK6FQDmY/AWAWw6hdyJf0Ka5CA3CWHeAlc5UdPV3TWlrSQoGPLSNI5INvtxbadIP Ndz88XD728tAPAE40k03KbxC+Ec+PAfh15KfHzSn9TN5PDlqeIQiyMIkZnkXKsJV Wd5Kbfkv9OlNSwBc/DmumztNzTzDlIQM+foz2Whw1Et+IugETP2lQ3iGe2tF+08m IJeZjKdtl0/gWK6+mUUIz+RIsE5EInTpn2eYNFa9YJDyCTYqm4XmCmFaXu5LsDL8 k3UeSYULIYltDpQVsOtt8P8RSBwDqQ+XI3D/S6rPmybcAqzAPxIc8SgK8CDCJ7r7 hohYqXwB5ecQUeM+ouBDuhIOBaDnUxeIuy81i7iawCIAsNJeKZDC6liTx27rSewm QeNrFd4o+cmH0GIjNt9YugKfFl4kRtKWsGIC1eYnG7MVthxIcQQt/vgOb8zhG0ds 6nv3u3QxlN3zvK7KCQOtpqBKjc3uJnI1cHo060tYhaCoZuqqE7mgedz0LpDYpBcG rI+YBAXkExGd3JMJ1U41uvwcgKBDW5og9aeWT4WBKKxWwk4EjQBsDdK0FuxZJyc+ LzOHIakqyFPW6UJ4E/IzrlYtoFWa6w== ----------------------------------------------------------------------------------------- !!! DANGER !!! DON'T try to change files by yourself, DON'T use any third party software for restoring your data or antivirus solutions - its may entail damage of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!

URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/DE9B6522CECF0BF4

http://decoder.re/DE9B6522CECF0BF4

Signatures

Modifies Windows Firewall 2 TTPs 1 IoCs
evasion

Windows Service
T1543.003

Disable or Modify System Firewall
T1562.004

Processes:

netsh.exe

pid process

2248 netsh.exe

pid	process
2248	netsh.exe

Enumerates connected drives 3 TTPs 25 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

1c72875191a80e6e69d6e6c2edda738ad206767979851cfbb18dc0398ea191e4.exe

description	ioc	process
File opened (read-only)	\??\B:	1c72875191a80e6e69d6e6c2edda738ad206767979851cfbb18dc0398ea191e4.exe
File opened (read-only)	\??\V:	1c72875191a80e6e69d6e6c2edda738ad206767979851cfbb18dc0398ea191e4.exe
File opened (read-only)	\??\Y:	1c72875191a80e6e69d6e6c2edda738ad206767979851cfbb18dc0398ea191e4.exe
File opened (read-only)	\??\A:	1c72875191a80e6e69d6e6c2edda738ad206767979851cfbb18dc0398ea191e4.exe
File opened (read-only)	\??\E:	1c72875191a80e6e69d6e6c2edda738ad206767979851cfbb18dc0398ea191e4.exe
File opened (read-only)	\??\O:	1c72875191a80e6e69d6e6c2edda738ad206767979851cfbb18dc0398ea191e4.exe
File opened (read-only)	\??\G:	1c72875191a80e6e69d6e6c2edda738ad206767979851cfbb18dc0398ea191e4.exe
File opened (read-only)	\??\H:	1c72875191a80e6e69d6e6c2edda738ad206767979851cfbb18dc0398ea191e4.exe
File opened (read-only)	\??\J:	1c72875191a80e6e69d6e6c2edda738ad206767979851cfbb18dc0398ea191e4.exe
File opened (read-only)	\??\K:	1c72875191a80e6e69d6e6c2edda738ad206767979851cfbb18dc0398ea191e4.exe
File opened (read-only)	\??\Q:	1c72875191a80e6e69d6e6c2edda738ad206767979851cfbb18dc0398ea191e4.exe
File opened (read-only)	\??\T:	1c72875191a80e6e69d6e6c2edda738ad206767979851cfbb18dc0398ea191e4.exe
File opened (read-only)	\??\Z:	1c72875191a80e6e69d6e6c2edda738ad206767979851cfbb18dc0398ea191e4.exe
File opened (read-only)	\??\D:	1c72875191a80e6e69d6e6c2edda738ad206767979851cfbb18dc0398ea191e4.exe
File opened (read-only)	\??\F:	1c72875191a80e6e69d6e6c2edda738ad206767979851cfbb18dc0398ea191e4.exe
File opened (read-only)	\??\I:	1c72875191a80e6e69d6e6c2edda738ad206767979851cfbb18dc0398ea191e4.exe
File opened (read-only)	\??\N:	1c72875191a80e6e69d6e6c2edda738ad206767979851cfbb18dc0398ea191e4.exe
File opened (read-only)	\??\P:	1c72875191a80e6e69d6e6c2edda738ad206767979851cfbb18dc0398ea191e4.exe
File opened (read-only)	\??\U:	1c72875191a80e6e69d6e6c2edda738ad206767979851cfbb18dc0398ea191e4.exe
File opened (read-only)	\??\W:	1c72875191a80e6e69d6e6c2edda738ad206767979851cfbb18dc0398ea191e4.exe
File opened (read-only)	\??\L:	1c72875191a80e6e69d6e6c2edda738ad206767979851cfbb18dc0398ea191e4.exe
File opened (read-only)	\??\M:	1c72875191a80e6e69d6e6c2edda738ad206767979851cfbb18dc0398ea191e4.exe
File opened (read-only)	\??\S:	1c72875191a80e6e69d6e6c2edda738ad206767979851cfbb18dc0398ea191e4.exe
File opened (read-only)	\??\X:	1c72875191a80e6e69d6e6c2edda738ad206767979851cfbb18dc0398ea191e4.exe
File opened (read-only)	\??\R:	1c72875191a80e6e69d6e6c2edda738ad206767979851cfbb18dc0398ea191e4.exe

Sets desktop wallpaper using registry 2 TTPs 1 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

Processes:

1c72875191a80e6e69d6e6c2edda738ad206767979851cfbb18dc0398ea191e4.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\3250862.bmp"	1c72875191a80e6e69d6e6c2edda738ad206767979851cfbb18dc0398ea191e4.exe

Drops file in Program Files directory 27 IoCs

Processes:

1c72875191a80e6e69d6e6c2edda738ad206767979851cfbb18dc0398ea191e4.exe

description	ioc	process
File created	\??\c:\program files (x86)\oreh4i-readme.txt	1c72875191a80e6e69d6e6c2edda738ad206767979851cfbb18dc0398ea191e4.exe
File opened for modification	\??\c:\program files\ApproveConfirm.csv	1c72875191a80e6e69d6e6c2edda738ad206767979851cfbb18dc0398ea191e4.exe
File opened for modification	\??\c:\program files\SearchUse.fon	1c72875191a80e6e69d6e6c2edda738ad206767979851cfbb18dc0398ea191e4.exe
File opened for modification	\??\c:\program files\GrantLock.aiff	1c72875191a80e6e69d6e6c2edda738ad206767979851cfbb18dc0398ea191e4.exe
File opened for modification	\??\c:\program files\RenameConvertFrom.wpl	1c72875191a80e6e69d6e6c2edda738ad206767979851cfbb18dc0398ea191e4.exe
File opened for modification	\??\c:\program files\SkipCompare.vstx	1c72875191a80e6e69d6e6c2edda738ad206767979851cfbb18dc0398ea191e4.exe
File created	\??\c:\program files (x86)\microsoft sql server compact edition\oreh4i-readme.txt	1c72875191a80e6e69d6e6c2edda738ad206767979851cfbb18dc0398ea191e4.exe
File created	\??\c:\program files (x86)\microsoft sql server compact edition\v3.5\tmp	1c72875191a80e6e69d6e6c2edda738ad206767979851cfbb18dc0398ea191e4.exe
File created	\??\c:\program files\tmp	1c72875191a80e6e69d6e6c2edda738ad206767979851cfbb18dc0398ea191e4.exe
File opened for modification	\??\c:\program files\CheckpointNew.m3u	1c72875191a80e6e69d6e6c2edda738ad206767979851cfbb18dc0398ea191e4.exe
File opened for modification	\??\c:\program files\GroupResolve.shtml	1c72875191a80e6e69d6e6c2edda738ad206767979851cfbb18dc0398ea191e4.exe
File opened for modification	\??\c:\program files\HideRevoke.xml	1c72875191a80e6e69d6e6c2edda738ad206767979851cfbb18dc0398ea191e4.exe
File opened for modification	\??\c:\program files\InvokePublish.mpeg	1c72875191a80e6e69d6e6c2edda738ad206767979851cfbb18dc0398ea191e4.exe
File opened for modification	\??\c:\program files\StepConnect.jpg	1c72875191a80e6e69d6e6c2edda738ad206767979851cfbb18dc0398ea191e4.exe
File opened for modification	\??\c:\program files\TraceConvert.potx	1c72875191a80e6e69d6e6c2edda738ad206767979851cfbb18dc0398ea191e4.exe
File created	\??\c:\program files (x86)\microsoft sql server compact edition\v3.5\desktop\tmp	1c72875191a80e6e69d6e6c2edda738ad206767979851cfbb18dc0398ea191e4.exe
File created	\??\c:\program files\oreh4i-readme.txt	1c72875191a80e6e69d6e6c2edda738ad206767979851cfbb18dc0398ea191e4.exe
File created	\??\c:\program files (x86)\microsoft sql server compact edition\tmp	1c72875191a80e6e69d6e6c2edda738ad206767979851cfbb18dc0398ea191e4.exe
File created	\??\c:\program files (x86)\tmp	1c72875191a80e6e69d6e6c2edda738ad206767979851cfbb18dc0398ea191e4.exe
File opened for modification	\??\c:\program files\SendPush.mht	1c72875191a80e6e69d6e6c2edda738ad206767979851cfbb18dc0398ea191e4.exe
File opened for modification	\??\c:\program files\TraceTest.vsd	1c72875191a80e6e69d6e6c2edda738ad206767979851cfbb18dc0398ea191e4.exe
File created	\??\c:\program files (x86)\microsoft sql server compact edition\v3.5\desktop\oreh4i-readme.txt	1c72875191a80e6e69d6e6c2edda738ad206767979851cfbb18dc0398ea191e4.exe
File opened for modification	\??\c:\program files\ReadRepair.rar	1c72875191a80e6e69d6e6c2edda738ad206767979851cfbb18dc0398ea191e4.exe
File opened for modification	\??\c:\program files\RegisterSubmit.nfo	1c72875191a80e6e69d6e6c2edda738ad206767979851cfbb18dc0398ea191e4.exe
File opened for modification	\??\c:\program files\UnregisterCheckpoint.htm	1c72875191a80e6e69d6e6c2edda738ad206767979851cfbb18dc0398ea191e4.exe
File created	\??\c:\program files (x86)\microsoft sql server compact edition\v3.5\oreh4i-readme.txt	1c72875191a80e6e69d6e6c2edda738ad206767979851cfbb18dc0398ea191e4.exe
File opened for modification	\??\c:\program files\EditClear.ex_	1c72875191a80e6e69d6e6c2edda738ad206767979851cfbb18dc0398ea191e4.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 5 IoCs

Processes:

1c72875191a80e6e69d6e6c2edda738ad206767979851cfbb18dc0398ea191e4.exe

pid	process
2812	1c72875191a80e6e69d6e6c2edda738ad206767979851cfbb18dc0398ea191e4.exe
2812	1c72875191a80e6e69d6e6c2edda738ad206767979851cfbb18dc0398ea191e4.exe
2812	1c72875191a80e6e69d6e6c2edda738ad206767979851cfbb18dc0398ea191e4.exe
2812	1c72875191a80e6e69d6e6c2edda738ad206767979851cfbb18dc0398ea191e4.exe
2812	1c72875191a80e6e69d6e6c2edda738ad206767979851cfbb18dc0398ea191e4.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

Processes:

1c72875191a80e6e69d6e6c2edda738ad206767979851cfbb18dc0398ea191e4.exevssvc.exe

description	pid	process
Token: SeDebugPrivilege	2812	1c72875191a80e6e69d6e6c2edda738ad206767979851cfbb18dc0398ea191e4.exe
Token: SeTakeOwnershipPrivilege	2812	1c72875191a80e6e69d6e6c2edda738ad206767979851cfbb18dc0398ea191e4.exe
Token: SeBackupPrivilege	828	vssvc.exe
Token: SeRestorePrivilege	828	vssvc.exe
Token: SeAuditPrivilege	828	vssvc.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

1c72875191a80e6e69d6e6c2edda738ad206767979851cfbb18dc0398ea191e4.exe

description	pid	process	target process
PID 2812 wrote to memory of 2248	2812	1c72875191a80e6e69d6e6c2edda738ad206767979851cfbb18dc0398ea191e4.exe	netsh.exe
PID 2812 wrote to memory of 2248	2812	1c72875191a80e6e69d6e6c2edda738ad206767979851cfbb18dc0398ea191e4.exe	netsh.exe
PID 2812 wrote to memory of 2248	2812	1c72875191a80e6e69d6e6c2edda738ad206767979851cfbb18dc0398ea191e4.exe	netsh.exe
PID 2812 wrote to memory of 2248	2812	1c72875191a80e6e69d6e6c2edda738ad206767979851cfbb18dc0398ea191e4.exe	netsh.exe

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\1c72875191a80e6e69d6e6c2edda738ad206767979851cfbb18dc0398ea191e4.exe
"C:\Users\Admin\AppData\Local\Temp\1c72875191a80e6e69d6e6c2edda738ad206767979851cfbb18dc0398ea191e4.exe"
1⤵
- Enumerates connected drives
- Sets desktop wallpaper using registry
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2812

C:\Windows\SysWOW64\netsh.exe
netsh advfirewall firewall set rule group="Network Discovery" new enable=Yes
2⤵
- Modifies Windows Firewall
PID:2248

C:\Windows\system32\wbem\unsecapp.exe
C:\Windows\system32\wbem\unsecapp.exe -Embedding
1⤵
PID:1492

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:828

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Privilege Escalation

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Defense Evasion

Impair Defenses

1

T1562

Disable or Modify System Firewall

Modify Registry

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Defacement

1

T1491

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\oreh4i-readme.txt
Filesize
6KB

MD5
3e03be3491237a87a39a988109f74da8

SHA1
c31144fa9633c44bf005b94c76c125d759bb6328

SHA256
a0da750c747468ac4161ac8585e93f864e0792ae195d1d5329b80d15dba35d86

SHA512
f2bf156361c03adee0bb58c00a045cc4d6c8c5785a9d5636b02a787fe491ed0527b9d7d29bb26e75d5a556dd63812a6394a0bd9526d089cc5521121436aaae62

Download Submit

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads