Analysis
-
max time kernel
3s -
max time network
113s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
-
submitted
16-05-2024 23:05
General
-
Target
6db9f96b1c56bcb56bc88904683465da.exe
-
Size
87KB
-
MD5
6db9f96b1c56bcb56bc88904683465da
-
SHA1
dd832f01d83be81a1d3afe8344fe0d0f9c02ae76
-
SHA256
047de76c965b9cf4a8671185d889438e4b6150326802e87470d20a3390aad304
-
SHA512
8deac0c28648d9d5a018cdb3a68e889214df6599f327a09f5d30f5d3d78a8cacbff6c37d6048e6fb362c028c6310c848fb08a1917387bc1960b4ee0f368052d5
-
SSDEEP
1536:onTG2LbwZSWG/Ib9hrsg/KNj1zmymisF6PSovbFyxjRB2GuxaOzD4DuypgWRxmY:on11Ab9hogydlmyEAnvb6Y85pg8o
Score
10/10
Malware Config
Extracted
Path
C:\Users\Admin\3D Objects\# How to Decrypt Files.html
Ransom Note
<!DOCTYPE html>
<html lang="en">
<head>
<meta charset="utf-8">
<title>Decryption Instructions</title>
<style>
a {
color: #04a;
text-decoration: none;
}
a:hover {
text-decoration: underline;
}
body {
background-color: #e7e7e7;
color: #222;
font-family: "Lucida Sans Unicode", "Lucida Grande", sans-serif;
font-size: 12pt;
line-height: 16pt;
}
body,
h1 {
margin: 0;
padding: 0;
}
h1 {
color: #555;
text-align: center;
padding-bottom: 1.5em;
line-height: 1.2;
}
h2 {
color: #555;
text-align: center;
line-height: 1.2;
}
ol li {
padding-bottom: 13pt;
}
.container {
background-color: white;
border: 2pt solid #C7C7C7;
margin: 3%;
min-width: 600px;
padding: 5% 10%;
color: #444;
}
.header {
border-bottom: 2pt solid #c7c7c7;
padding-bottom: 5%;
}
.hr {
display: block;
height: 2pt;
margin-top: 1.5%;
margin-bottom: 1.5%;
overflow: hidden;
width: 100%;
}
.info {
border: 1px solid #888;
background-color: #E4E4E4;
padding: 0.5em 3em;
margin: 1em 0;
}
.text {
text-align: justify;
}
.lsb{
display: none;
margin: 3%;
text-align: center;
}
.ls {
cursor: pointer;
border: 1px solid #888;
border-radius: 3px;
padding: 0 0.5em;
margin: 0.2em 0.1em;
line-height: 2em;
display: inline-block;
}
.ls:hover {
background-color: #D0D0D0;
}
.l {
display: none;
}
.lu {
display: none;
}
#change_language {
float: right;
display: none;
}
</style>
<script language="javascript">
function aIndexOf(arr, v) {
for (var i = 0; i < arr.length; i++)
if (arr[i] == v) return i;
return -1;
}
function tweakClass(cl, f) {
var els;
if (document.getElementByClassName != null) {
els = document.getElementsByClassName(cl);
} else {
els = [];
var tmp = document.getElementsByTagName('*');
for (var i = 0; i < tmp.length; i++) {
var c = tmp[i].className;
if ((c == cl) || ((c.indexOf(cl) != 1) && ((' ' + c + ' ').indexOf(' ' + cl + ' ') != -1))) els.push(tmp[i]);
}
}
for (var i = 0; i < els.length; i++) f(els[i]);
}
function show(el) {
el.style.display = 'block';
}
function hide(el) {
el.style.display = 'none';
}
function onPageLoaded() {
try {
tweakClass('lsb', show);
} catch (e) {}
try {
tweakClass('lu-orig', show);
} catch (e) {}
try {
setLang('en');
} catch (e) {}
}
</script>
</head>
<body onload='javascript:onPageLoaded()'>
<div class='lsb'>
</div>
<div class='container'>
<div class="text l l-en" style='display:block'>
<br>
<div>
<img src="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAL8AAAEICAMAAAA5jNVNAAAAeFBMVEX///8AAAD8/PxQUFCJiYk0NDSenp5TU1M9PT329vb6+vrv7+/z8/Pl5eXKyspfX18oKCjCwsKPj4/o6Oivr699fX1xcXGioqLa2tq7u7uTk5PS0tI6OjogICCCgoJoaGh1dXUXFxeqqqpHR0cODg4cHBxaWlotLS1/4KDGAAAHlUlEQVR4nO2daVciPRCFaRpkRzYXXNCGUf7/P3zldUZn6O6bSmrDc3I/a/IASaVSqVQ6HQWt55v97rpcLIo/el4cXnr77eNYoztBjZZ3L78KpPJqO/WmbNZks8PoX6p226437ZnuV0ca+9fvsB95M39ptqri4D91vfUGP6m7GabAf+rBey5MVunw/+t17Ug/e2XSu36CyY0A/Uk7j6ncvRKiP2lvjj9fhKkiVN6b0k9vRelPujLEX1bi+EUxMJvHPQX6k+Ym9OtSCd9mDD2+qeEXxa26X7dVpP9QqexQ3OniF8Vhpon/oI1fFH3FD2CAr/kBTPD1PoCkwwM1nGjgb6zwP6yQghmd2+EXxYs4/qyy5C9Wwvjjgyl+UQjv7eX95ZBENwSGc/ePDoKxxvv47qvypne1Xc5n6/lye9W7KavYFnZi+N1Ij7nsbdfTMxPYna43u7hI0VKKP2rhetlMWq33eH03oLe0EFrGIkZPuQn6v7OHitraqwz/O7k/ms3obqixC5ENJXXH8hrhdm1om7gnARs0pX1Zgzh73aXFTR/4/LSO4pfLGckYsV3pGaWX9yRLsSO0fMvlp8RoU3/lJaHtRx4+xXamrzOE1q95/AS/jeNoEUYny4YS2ufNsEmw/QGn+fDo5xqI8DfE+AEmwQNd/gr5GOqCMQOCtl8i4BrcWyRPsGnoTPpdAL/TCR0CJq8BQc9HKMwR8lBS/eiQ48lcW74UmsOJwYhQszdC+MHA5DHtfDU0ewU32IERlLTCj59wo5IRmkBwL8mEBgzzQRC/07nGnaUcTQbWXqnJ+6nAXEtYZ0bY+DP9wpqwo3iIt9SB4SP79Qdd6Xg3Cw+fUhg/NAOit0gjbH3EYmNfwiYoegDh3/NZHD+0BsQOILwkahz04yhlbI/Y99E4YMNbsUh7J9oYUXgGx31leDZtVPjxRibOXcEpPjr5dlPYZ5y3C8P0OsMnMICiYrl4+GtlC+LklhgfDg9/rUQ17MTFTDq4dekr4Xe6cAmLmQAvqKGeFj/2uYb0CYDPLPTS3rEFpa8Aa6F2YoX7pcf6YOBnoZcjOH5GHdPDKHD6so9EgOAujJ5UA5vRTDKFPuiCuuyP+qgZzSxffKJEnXh49dW8bIBdIOo3B/deleYdOjyBqSMXmmGZmHmb4MJJXYGh86y3+ga7HhAtNzxQ0M1xhy5oRZt6OF1J99IcjprRktNHcBKp5ocHDBAt6OdnPj++O9g3beMEtxFvuleQuzArheYBwUUwIRIcJWhAaSmJ0AZoem8nQQNKCxxA71PX/Afiln3S4IV5RQIZXVB4C0YyHnAIat+0xJEPygKAly/5wP+/wgsAZfHBB1/S50Zx/JTecQvaV41HMDOUEsPy5R/DX/+O0IKn+9AJHJxQrB90HxbqFUyg805ZfaAF66tfEIWrD4Ufuj9aof9vsWNPe19+GAKqb76758L8vfo/yAp3/177835NcPf19lT/B1nB7ou3s7/uwL++fGV+X2V+X2V+X2V+X2V+X2V+X2V+X2V+XzXyHwflBWrQlNXQxP80Ut7jpqlxZ9/Erx9jSBOVn3XjU1GZ31eZ31eZ31eZ31eZ31eZ31eZ31eZ31eZ31fW/N35ditZBdOW//F3Gt2NWMKxJf/krys0K6GcFUP++T+Fm4YyFybt+GtJnCLTwIy/oSOJS0tW/I0ZMAK/gBF/y+VDvhmy4W+7AXJkv0xgwr9uLRl3zTWjFvyoTje3JrgFP7xBzcz9NuDHFeN+8W4+6/Pj+9PckxF9/kAVLmbhEXX+cD1Y1ghS5w8UjDuJc/1Hm5/0wgRjFdPmJz2GR7mB4MM/puBzyvYp81OqORec6hfK/MRXAtJNqDI/8S3IdC9ImZ/4wkr6BVBlflj04lvp9QuU+Qmr10npN4Au4/tPN6DK/EHn7VPpPqgyP/El3XQPSJmf+LRfev0LZX7SSxOcQJC2/1aR+NMvUGrzU97jKF6T8dX5Se8MMe5vq++/CB4E5/7qBex/WRt4/fhD8Adg1Y7T5w++ZcE6BjCIvwWei7n0+FVnhB8sufT4YSCGcvnxW7gL5pausTl/aa3+wi4cZ3T+1VK6mP8WnBF/c+X6J/7D3Fbnp9OGGlwC+Ibn77UaJkOJZ9EN8x/O1rGDSNUXQ/6zBAiZt2QN+c9jiSI5QHb8NRPEiPp/y46/dg4p8h63Y/4P8+TXmr9+Cv+T8n+aKrBJPAZtxt8QyYooHu/P39SRgAU142+KRAuU/TXz3xralLjUasXfnETzc/zn5hwmfuFKI/5x8+MT/NcWjfhbwrg/Zv/YVsGWbUFt+FvLt7ItqA1/a/lNtgW14W8vIMy1oDb87WkcXAtqwj+uWvm5PqgJPzgE41pQ7/gt14Ka8KMsCOYu3oIfvj/A3MVb8OMTMF4YzoIfJ/HxdvEW/DiJj3eDwYAfv/9TlKwrJAb8uPY404Uw4A9lELAevzHg3x+HSH3W6xP5/rKvMr+vMr+vMr+vMr+vMr+vMr+vMr+vMr+vMr+vMr+vMr+vMr+vfjp/0wXRJv7jqneJWjVdLGji/0nK/L7K/L7K/L7K/L7K/L7K/L7K/L7K/L7K/L76DxuakMqfwNR4AAAAAElFTkSuQmCC" alt="LockLogo" />
</div>
<br>
<p><samp># All your files has been encrypted by “KRAKEN CRYPTOR”.</samp></p>
<p><samp># Read the following instructions carefully to decrypt your files.</samp></p>
<br>
<div class="info">
-----BEGIN KRAKEN ENCRYPTED UNIQUE KEY-----
<br>
XyRIStY73QWK27oRwwLiz0Z8OAsN7QurakZS8FGwIA4fqU8LcIvx0JVFtMCUxIt1<br>SflGXIkSTA+qPBaGhmcUe0wgAzj2wWvPVf5mW1P8iY9dEs+BaqQ3m2YmpI02EFcO<br>5HoMjGant8PYpRwPvHzz/IW0pEU7ksgTG3XgwFjruR0wPVOd+xZwgRCYZguHJR8k<br>NGhjAAHmeuM9xYI/ustE/bU+C53UmC4Tz0UkTgYfUeDEPiDs1o4axgRkDyK+lxOJ<br>jqJldr7MLD74OYLmuVqXGx/TwFyTHAJs2wNIcrcnUk98q9MEVmdsblq4Ed0E3mTw<br>Q9Ndt3tcfX9CaXfTFtHdxXZIsJ2SYih6T6YLgAo/vOchdizYoMNnyCBxXGf5YoiB<br>35LWkUxS4pJjF/xRPnOaNxh3sfk+/73lgRuiGQPMYgxlzWAw71wqd5iqov0p1FHn<br>66l9AvisS2EyqqBrfvIh/JFFFdbNYMWCovERWHQcsu/+Y9wk/S77+2e2DWfx1vnL<br>GkGnkCgyhdaqjSxEWoKbeDJL2ohiksErZAurmGfqoigpB8wr6AhjYTE2gcvNrt7F<br>KNYhLoVC0imIXA0gR2ervq2B1vyuPX/gMEBmVUXW9LxgH71x/Fffe2jr+4fLikKz<br>gwHwVsslnaF1ApkCrzyy42lcUWGiYuwiB1JZsYKGPbcwNcoxNKBUYRl1j3GsrP1R<br>FINAQ8q1rtVDDAyYgq0YBg2hgScIhaQYCEXS9AC/6p7G
<br>
-----END KRAKEN ENCRYPTED UNIQUE KEY-----
</div>
<br>
<p style="color: #D91E18;">What happened to my computer?</p>
<hr>
<p>All of your files such as documents, images, videos and other files with the different names and extensions are encrypted by “KRAKEN CRYPTOR”!</p>
<p>The speed, power and complexity of this encryption have been high and if you are now viewing this guide.</p>
<p>It means that “KRAKEN CRYPTOR” immediately removed form your system!</p>
<p>No way to recovery your files without “KRAKEN DECRYPTOR” software and your computer “UNIQUE KEY”!</p>
<p>You need to buy it from us because only we can help you!</p>
<br>
<p style="color: #D91E18;">What the mean is encryption?</p>
<hr>
<p>In cryptography, encryption is the process of encoding a message or information in such a way that only authorized parties can access it.</p>
<p>And those who are not authorized cannot.</p>
<br>
<p style="color: #D91E18;">How can recovery my files?</p>
<hr>
<p>We guarantee that you can recover all your files soon safely.</p>
<p>You can decrypt one of your encrypted smaller file for free in the first contact with us.</p>
<p>For the decryption service, we also need your “KRAKEN ENCRYPTED UNIQUE KEY” you can see this in the top!</p>
<p>Are you want to decrypt all of your encrypted files? If yes! You need to pay for decryption service to us!</p>
<p>After your payment made, all of your encrypted files has been decrypted.</p>
<br>
<p style="color: #D91E18;">How much is need to pay?</p>
<hr>
<p>You need to pay (0.125 <font size="3" color="green">BTC</font>), payment only can made as Bitcoins.</p>
<p>This links help you to understand whats is a Bitcoins and how it work.</p>
<p><a href="https://wikipedia.org/wiki/Bitcoin">https://en.wikipedia.org/wiki/Bitcoin</a></p>
<br>
<p><strong>Note:</strong><font size="3" color="red"> This price is for the contact with us in first week otherwise it will increase.</font></p>
<br>
<p style="color: #D91E18;">Where can buy Bitcoins?</p>
<hr>
<p>The easiest way to buy Bitcoins is LocalBitcoins website.</p>
<p>You must register on this site and click “BUY Bitcoins” then choose your country to find sellers and their prices.</p>
<p><a href="https://localBitcoins.com/buy_Bitcoins">https://localBitcoins.com/buy_Bitcoins</a></p>
<br>
<p>Other places to buy Bitcoins in exchange for other currencies worldwide:</p>
<p><a href="https://www.bestbitcoinexchange.io/">https://www.bestbitcoinexchange.io</a></p>
<br>
<p style="color: #D91E18;">How to contact you?</p>
<hr>
<p>We use best and easy way to communications. It's email support, you can see our emails below.</p>
<p>Please send your message with same subject to both address.</p>
<br>
E-Mail
<div class="info">
[email protected]
</div>
<br>
Alternative
<div class="info">
[email protected]
</div>
<br>
<p style="color: #D91E18;">Attention</p>
<hr>
<ul type="disc">
<li>DON'T MODIFY OR RENAME ENCRYPTED FILES!</li>
<li>DON'T MODIFY “KRAKEN ENCRYPT UNIQUE KEY”!</li>
<li>DON'T USE THIRD PARTY, PUBLIC TOOLS/SOFTWARE TO DECRYPT YOUR FILES, THIS CAUSE DAMAGE YOUR FILES PERMANENTLY!</li>
<li>DON'T ASK PEOPLE OR DATA RECOVERY CENTERS, THEY ARE MAY ADD EXTRA CHARGE!</li>
</ul>
<br>
<p><b>Additional</b></p>
<hr>
<ul type="square">
<li>Project “KRAKEN CRYPTOR” doesn't damage any of your files, this action is reversible if you follow the instructions above.</li>
<li>Also, our policy is obvious: “NO PAYMENT, NO DECRYPT”.</li>
</ul>
</div>
</div>
</body>
</html>
Signatures
-
Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Enumerates processes with tasklist 1 TTPs 1 IoCs
-
Runs ping.exe 1 TTPs 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 11 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\6db9f96b1c56bcb56bc88904683465da.exe"C:\Users\Admin\AppData\Local\Temp\6db9f96b1c56bcb56bc88904683465da.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\tasklist.exe"tasklist" /V /FO CSV2⤵
- Enumerates processes with tasklist
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C cd C:\ProgramData\ && release.bat2⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKEY_CURRENT_USER\Software\Sysinternals\SDelete"3⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKEY_CURRENT_USER\Software\Sysinternals\SDelete" /v EulaAccepted /t REG_DWORD /d 1 /f3⤵
-
C:\Windows\SysWOW64\cmd.execmd.exe /c C:\ProgramData\sdelete.exe -c -z C:3⤵
-
C:\ProgramData\sdelete.exeC:\ProgramData\sdelete.exe -c -z C:4⤵
-
C:\Windows\SysWOW64\cmd.execmd.exe /c C:\ProgramData\sdelete.exe -z D:3⤵
-
C:\ProgramData\sdelete.exeC:\ProgramData\sdelete.exe -z D:4⤵
-
C:\Windows\SysWOW64\cmd.execmd.exe /c C:\ProgramData\sdelete.exe -z F:3⤵
-
C:\ProgramData\sdelete.exeC:\ProgramData\sdelete.exe -z F:4⤵
-
C:\Windows\SysWOW64\shutdown.exeshutdown /S /F /T 300 /C "Unexpected shutdown due to maintenance break."3⤵
-
C:\Windows\SysWOW64\Wbem\WMIC.exewmic SHADOWCOPY DELETE3⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C ping 127.0.0.1 -n 3 > NUL&&del /Q /F /S "C:\Users\Admin\AppData\Local\Temp\6db9f96b1c56bcb56bc88904683465da.exe"2⤵
-
C:\Windows\SysWOW64\PING.EXEping 127.0.0.1 -n 33⤵
- Runs ping.exe
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\ProgramData\release.batFilesize
875B
MD5c01df9dddd89e6a3be6be7d83f73eb3f
SHA118f610d8b1653bfcb35ce34508529f0224bdccea
SHA256b237074769c6a797f39ba5c89c0364793a8111ac8e9bf5907e86765d1f0931f5
SHA512d35e461d1c77ab2fd2c3a7d4e726ea38941d339a9685d222e5161960b8277c068f986e9c001e3f86d473bd14638578bf7d22eb3f45670f20704ddc46c3488c8b
-
C:\ProgramData\sdelete.exeFilesize
218KB
MD56a4e049d8c497d350a7bd54dfff99808
SHA17f1d32424c961542ae172c5b8c1611291c30fc4f
SHA25659e5ae1e99c6a4ccc01e8abdc2534210ec5faa945754a89524b06381da8c20a1
SHA51241169089fa67e1a0ff1360dc5428b89dcee0d642204ddb7dac80d6cf859caae3c2b14fa89ce72072fb780c0a93f53eb0ff9414a8e88b1d783bfa75c9c4ea353d
-
C:\Users\Admin\3D Objects\# How to Decrypt Files.htmlFilesize
10KB
MD50a79fcc114682d64cd0c5e3f1ff53b3f
SHA17a243cb1a5ff53771074c35f30458ccf811a467c
SHA256d7ae82e0d28154e599361f35db042115a54873232835df50a93b8f1e2caaaa27
SHA51252f958f32e29a9e947e661d9b26b0d3fe8a33ed8ac10299fbcc735b4c8ce4de5c2d2ba4ae0ddae9a042e78e5cb670c246de37dce2ea47df72167595fd2af706a
-
memory/2604-3-0x0000000074730000-0x0000000074CE1000-memory.dmpFilesize
5.7MB
-
memory/2604-4-0x0000000074730000-0x0000000074CE1000-memory.dmpFilesize
5.7MB
-
memory/2604-5-0x0000000074730000-0x0000000074CE1000-memory.dmpFilesize
5.7MB
-
memory/2604-6-0x0000000074730000-0x0000000074CE1000-memory.dmpFilesize
5.7MB
-
memory/2604-7-0x0000000074730000-0x0000000074CE1000-memory.dmpFilesize
5.7MB
-
memory/2604-8-0x0000000074730000-0x0000000074CE1000-memory.dmpFilesize
5.7MB
-
memory/2604-0-0x0000000074732000-0x0000000074733000-memory.dmpFilesize
4KB
-
memory/2604-367-0x0000000074730000-0x0000000074CE1000-memory.dmpFilesize
5.7MB
-
memory/2604-1-0x0000000074730000-0x0000000074CE1000-memory.dmpFilesize
5.7MB
-
memory/2604-2-0x0000000074730000-0x0000000074CE1000-memory.dmpFilesize
5.7MB