Analysis

  • max time kernel
    117s
  • max time network
    119s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    16-05-2024 23:05

General

  • Target

    353b1a5ced1e9c3341cf45160576b852.exe

  • Size

    90KB

  • MD5

    353b1a5ced1e9c3341cf45160576b852

  • SHA1

    c86dfcef3b348d59391d8e4a724b6328a4cc97ea

  • SHA256

    cae152c9d91c26c1b052c82642670dfb343ce00004fe0ca5d9ebb4560c64703b

  • SHA512

    92329753aa2158cce3bd662bf31674022ba29eb19a880be26531966068a6808789f034dc1358fcb10d815570940b2c13d40f4f7c2bbb26e27bbf550db1d234fc

  • SSDEEP

    1536:oMv7odcxk1p242SAlFkJ2M8xR5AnbFDPWrRBHoiVUhsoEjqZ4S5sgUgb6XY8r88W:dtI52SAlF82M82EFVdVUhsoEjqZ4S+OD

Score
10/10

Malware Config

Extracted

Path

C:\PerfLogs\# How to Decrypt Files-YIPDC.html

Ransom Note
<!DOCTYPE html> <html lang="en"> <head> <meta charset="utf-8"> <title>Decryption Instructions</title> <style> a { color: #04a; text-decoration: none; } a:hover { text-decoration: underline; } body { background-color: #e7e7e7; color: #222; font-family: "Lucida Sans Unicode", "Lucida Grande", sans-serif; font-size: 12pt; line-height: 16pt; } body, h1 { margin: 0; padding: 0; } h1 { color: #555; text-align: center; padding-bottom: 1.5em; line-height: 1.2; } h2 { color: #555; text-align: center; line-height: 1.2; } ol li { padding-bottom: 13pt; } .container { background-color: white; border: 2pt solid #C7C7C7; margin: 3%; min-width: 600px; padding: 5% 10%; color: #444; } .header { border-bottom: 2pt solid #c7c7c7; padding-bottom: 5%; } .hr { display: block; height: 2pt; margin-top: 1.5%; margin-bottom: 1.5%; overflow: hidden; width: 100%; } .info { border: 1px solid #888; background-color: #E4E4E4; padding: 0.5em 3em; margin: 1em 0; } .text { text-align: justify; } .lsb{ display: none; margin: 3%; text-align: center; } .ls { cursor: pointer; border: 1px solid #888; border-radius: 3px; padding: 0 0.5em; margin: 0.2em 0.1em; line-height: 2em; display: inline-block; } .ls:hover { background-color: #D0D0D0; } .l { display: none; } .lu { display: none; } #change_language { float: right; display: none; } </style> </head> <body onload='javascript:onPageLoaded()'> <div class='lsb'> </div> <div class='container'> <div class="text l l-en" style='display:block'> <br> <div> <img src="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAL8AAAEICAMAAAA5jNVNAAAAeFBMVEX///8AAAD8/PxQUFCJiYk0NDSenp5TU1M9PT329vb6+vrv7+/z8/Pl5eXKyspfX18oKCjCwsKPj4/o6Oivr699fX1xcXGioqLa2tq7u7uTk5PS0tI6OjogICCCgoJoaGh1dXUXFxeqqqpHR0cODg4cHBxaWlotLS1/4KDGAAAHlUlEQVR4nO2daVciPRCFaRpkRzYXXNCGUf7/P3zldUZn6O6bSmrDc3I/a/IASaVSqVQ6HQWt55v97rpcLIo/el4cXnr77eNYoztBjZZ3L78KpPJqO/WmbNZks8PoX6p226437ZnuV0ca+9fvsB95M39ptqri4D91vfUGP6m7GabAf+rBey5MVunw/+t17Ug/e2XSu36CyY0A/Uk7j6ncvRKiP2lvjj9fhKkiVN6b0k9vRelPujLEX1bi+EUxMJvHPQX6k+Ym9OtSCd9mDD2+qeEXxa26X7dVpP9QqexQ3OniF8Vhpon/oI1fFH3FD2CAr/kBTPD1PoCkwwM1nGjgb6zwP6yQghmd2+EXxYs4/qyy5C9Wwvjjgyl+UQjv7eX95ZBENwSGc/ePDoKxxvv47qvypne1Xc5n6/lye9W7KavYFnZi+N1Ij7nsbdfTMxPYna43u7hI0VKKP2rhetlMWq33eH03oLe0EFrGIkZPuQn6v7OHitraqwz/O7k/ms3obqixC5ENJXXH8hrhdm1om7gnARs0pX1Zgzh73aXFTR/4/LSO4pfLGckYsV3pGaWX9yRLsSO0fMvlp8RoU3/lJaHtRx4+xXamrzOE1q95/AS/jeNoEUYny4YS2ufNsEmw/QGn+fDo5xqI8DfE+AEmwQNd/gr5GOqCMQOCtl8i4BrcWyRPsGnoTPpdAL/TCR0CJq8BQc9HKMwR8lBS/eiQ48lcW74UmsOJwYhQszdC+MHA5DHtfDU0ewU32IERlLTCj59wo5IRmkBwL8mEBgzzQRC/07nGnaUcTQbWXqnJ+6nAXEtYZ0bY+DP9wpqwo3iIt9SB4SP79Qdd6Xg3Cw+fUhg/NAOit0gjbH3EYmNfwiYoegDh3/NZHD+0BsQOILwkahz04yhlbI/Y99E4YMNbsUh7J9oYUXgGx31leDZtVPjxRibOXcEpPjr5dlPYZ5y3C8P0OsMnMICiYrl4+GtlC+LklhgfDg9/rUQ17MTFTDq4dekr4Xe6cAmLmQAvqKGeFj/2uYb0CYDPLPTS3rEFpa8Aa6F2YoX7pcf6YOBnoZcjOH5GHdPDKHD6so9EgOAujJ5UA5vRTDKFPuiCuuyP+qgZzSxffKJEnXh49dW8bIBdIOo3B/deleYdOjyBqSMXmmGZmHmb4MJJXYGh86y3+ga7HhAtNzxQ0M1xhy5oRZt6OF1J99IcjprRktNHcBKp5ocHDBAt6OdnPj++O9g3beMEtxFvuleQuzArheYBwUUwIRIcJWhAaSmJ0AZoem8nQQNKCxxA71PX/Afiln3S4IV5RQIZXVB4C0YyHnAIat+0xJEPygKAly/5wP+/wgsAZfHBB1/S50Zx/JTecQvaV41HMDOUEsPy5R/DX/+O0IKn+9AJHJxQrB90HxbqFUyg805ZfaAF66tfEIWrD4Ufuj9aof9vsWNPe19+GAKqb76758L8vfo/yAp3/177835NcPf19lT/B1nB7ou3s7/uwL++fGV+X2V+X2V+X2V+X2V+X2V+X2V+X2V+XzXyHwflBWrQlNXQxP80Ut7jpqlxZ9/Erx9jSBOVn3XjU1GZ31eZ31eZ31eZ31eZ31eZ31eZ31eZ31eZ31fW/N35ditZBdOW//F3Gt2NWMKxJf/krys0K6GcFUP++T+Fm4YyFybt+GtJnCLTwIy/oSOJS0tW/I0ZMAK/gBF/y+VDvhmy4W+7AXJkv0xgwr9uLRl3zTWjFvyoTje3JrgFP7xBzcz9NuDHFeN+8W4+6/Pj+9PckxF9/kAVLmbhEXX+cD1Y1ghS5w8UjDuJc/1Hm5/0wgRjFdPmJz2GR7mB4MM/puBzyvYp81OqORec6hfK/MRXAtJNqDI/8S3IdC9ImZ/4wkr6BVBlflj04lvp9QuU+Qmr10npN4Au4/tPN6DK/EHn7VPpPqgyP/El3XQPSJmf+LRfev0LZX7SSxOcQJC2/1aR+NMvUGrzU97jKF6T8dX5Se8MMe5vq++/CB4E5/7qBex/WRt4/fhD8Adg1Y7T5w++ZcE6BjCIvwWei7n0+FVnhB8sufT4YSCGcvnxW7gL5pausTl/aa3+wi4cZ3T+1VK6mP8WnBF/c+X6J/7D3Fbnp9OGGlwC+Ibn77UaJkOJZ9EN8x/O1rGDSNUXQ/6zBAiZt2QN+c9jiSI5QHb8NRPEiPp/y46/dg4p8h63Y/4P8+TXmr9+Cv+T8n+aKrBJPAZtxt8QyYooHu/P39SRgAU142+KRAuU/TXz3xralLjUasXfnETzc/zn5hwmfuFKI/5x8+MT/NcWjfhbwrg/Zv/YVsGWbUFt+FvLt7ItqA1/a/lNtgW14W8vIMy1oDb87WkcXAtqwj+uWvm5PqgJPzgE41pQ7/gt14Ka8KMsCOYu3oIfvj/A3MVb8OMTMF4YzoIfJ/HxdvEW/DiJj3eDwYAfv/9TlKwrJAb8uPY404Uw4A9lELAevzHg3x+HSH3W6xP5/rKvMr+vMr+vMr+vMr+vMr+vMr+vMr+vMr+vMr+vMr+vMr+vMr+vfjp/0wXRJv7jqneJWjVdLGji/0nK/L7K/L7K/L7K/L7K/L7K/L7K/L7K/L7K/L76DxuakMqfwNR4AAAAAElFTkSuQmCC" alt="LockLogo" /> </div> <br> <p><samp># All your files has been encrypted by "KRAKEN CRYPTOR".</samp></p> <p><samp># Read the following instructions carefully to decrypt your files.</samp></p> <br> <div class="info"> -----BEGIN KRAKEN ENCRYPTED UNIQUE KEY----- <br> ixEZsfwtRZ+JIJRy68f3l1cZMvSsWD+iutLq9BM5ZFlwXP1R93WaN8ylR8eGTQDD<br>CFX2/WyEqdc7dI68UKeUrlZbGJdGPg0mP7dhn59jBqb9rp0ws64X5YmPpKS4lRi8<br>YoSRchuotS443TsDxKYixPKSL8g48obIRFSGaywlIfnKzrsPonvgZhcwwC57rWbX<br>0M5S7aDzyWLcDD/4C7PaKIhfBpK24Kka2xyOifBTYIjcwDXgoj1gcJCH/nAsB0nm<br>Yka7+DbzQWPcXLIXh0fHibMrA5bOzE/nRMy4lt/EHTKxz74Q8cL82tdBl/9x2cwn<br>Bxr92LqR3G5yEOwbRTlqdQCsNXPj0oWCKq6w6GKG/Ybs8fuTqgYesriRGGMzsq0U<br>Q7mPhw2QUMd9P31TKNy1tQqmSGPT62JfmgLzAN57qKuOsLXP2FCV8WjexM6V+8VK<br>auqA4KbXxWXOeGDsA3J4QQ8sl0oMnu2d6kLTtIapRtG4uyEmf/uompvz/BHvMCoa<br>NsT9rOhw7HknKwx55YMfeoHpvTZ3SNJddhdVp0Mgq8Pn6spwOg/rnomBU8zuygld<br>KoszeZBT+9yGJePHB11srHXkrKOecFyjRp/3eMcBLta2taXyORG0OCVvFhMZPS4/<br>MGzo/sfSeQn9OmBfaFPig/TdcjNXZcb4XiqEKY6X2URF0ydj/zFv7kBFHdqkTfvc<br>R77xU2of1bHazeJ1ww4EUOzWU6Kr1A== <br> -----END KRAKEN ENCRYPTED UNIQUE KEY----- </div> <br> Extension <div class="info"> .YIPDC </div> <br> <p style="color: #D91E18;">What happened to my computer?</p> <hr> <p>All of your files such as documents, images, videos and other files with the different names and extensions are encrypted by "KRAKEN CRYPTOR"!</p> <p>Don't delete .YIPDC files! there are not virus and are your files, but encrypted!</p> <p>The speed, power and complexity of this encryption have been high and if you are now viewing this guide.</p> <p>It means that "KRAKEN CRYPTOR" immediately removed form your system!</p> <p>No way to recovery your files without "KRAKEN DECRYPTOR" software and your computer "UNIQUE KEY"!</p> <p>You need to buy it from us because only we can help you!</p> <br> <p style="color: #D91E18;">How can recovery my files?</p> <hr> <p>We guarantee that you can recover all your files soon safely.</p> <p>You can decrypt one of your encrypted smaller file for free in the first contact with us.</p> <p>For the decryption service, we also need your "KRAKEN ENCRYPTED UNIQUE KEY" you can see this in the top!</p> <p>Are you want to decrypt all of your encrypted files? If yes! You need to pay for decryption service to us!</p> <p>After your payment made, all of your encrypted files has been decrypted.</p> <br> <p style="color: #D91E18;">How much is need to pay?</p> <hr> <p>You need to pay (0.256 BTC), payment only can made as Bitcoins.</p> <p>This links help you to understand whats is a Bitcoins and how it work.</p> <p><a href="https://wikipedia.org/wiki/Bitcoin">https://en.wikipedia.org/wiki/Bitcoin</a></p> <p><font size="3" color="red"> This price is for the contact with us in first week otherwise it will increase.</font></p> <br> <p style="color: #D91E18;">Where can buy Bitcoins?</p> <hr> <p>The easiest way to buy Bitcoins is LocalBitcoins website.</p> <p>You must register on this site and click "BUY Bitcoins" then choose your country to find sellers and their prices.</p> <p><a href="https://localBitcoins.com">https://localBitcoins.com</a></p> <br> <p>Other places to buy Bitcoins in exchange for other currencies worldwide:</p> <p><a href="https://www.bestbitcoinexchange.io/">https://www.bestbitcoinexchange.io</a></p> <br> <p style="color: #D91E18;">How to contact you?</p> <hr> <p>We use best and easy way to communications. It's email support, you can see our emails below.</p> <p>Please send your message with same subject to both address.</p> <br> E-Mail <div class="info"> [email protected] </div> <br> Alternative <div class="info"> [email protected] </div> <br> <p style="color: #D91E18;">Attention</p> <hr> <ul type="disc"> <li>DON'T MODIFY OR RENAME ENCRYPTED FILES.</li> <li>DON'T MODIFY "KRAKEN ENCRYPT UNIQUE KEY".</li> <li>DON'T USE THIRD PARTY, PUBLIC TOOLS/SOFTWARE TO DECRYPT YOUR FILES, THIS CAUSE DAMAGE YOUR FILES PERMANENTLY.</li> <li>DON'T ASK PEOPLE OR DATA RECOVERY CENTERS, THEY ARE MAY ADD EXTRA CHARGE.</li> </ul> <br> <p><b>Additional</b></p> <hr> <ul type="square"> <li>Project "KRAKEN CRYPTOR" doesn't damage any of your files, this action is reversible if you follow the instructions above.</li> <li>Also, our policy is obvious: "NO PAYMENT, NO DECRYPT".</li> </ul> </div> </div> </body> </html>

Signatures

  • Deletes itself 1 IoCs
  • Looks up external IP address via web service 7 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Drops file in Program Files directory 2 IoCs
  • Drops file in Windows directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Enumerates processes with tasklist 1 TTPs 1 IoCs
  • Runs ping.exe 1 TTPs 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 14 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\353b1a5ced1e9c3341cf45160576b852.exe
    "C:\Users\Admin\AppData\Local\Temp\353b1a5ced1e9c3341cf45160576b852.exe"
    1⤵
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2188
    • C:\Windows\SysWOW64\tasklist.exe
      "tasklist" /V /FO CSV
      2⤵
      • Enumerates processes with tasklist
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2040
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /C ping 127.0.0.1 -n 3 > NUL&&del /Q /F /S "C:\Users\Admin\AppData\Local\Temp\353b1a5ced1e9c3341cf45160576b852.exe"
      2⤵
      • Deletes itself
      • Suspicious use of WriteProcessMemory
      PID:2420
      • C:\Windows\SysWOW64\PING.EXE
        ping 127.0.0.1 -n 3
        3⤵
        • Runs ping.exe
        PID:2576

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\PerfLogs\# How to Decrypt Files-YIPDC.html

    Filesize

    9KB

    MD5

    5c56cbc9b017c3b3a245560bf9d0b3c2

    SHA1

    a04ff8e297dd582a6a9eb5d829a98d30e088da2a

    SHA256

    9a88b4521493a3a685689d5fe1cda11595d99b1cd6ce7143db7617c4b1b20e9f

    SHA512

    b46f229107a018366085a0752a677dff45c5e003ead8b67a3fccb3b9232401e5c96025e9022c24f3220f96e7ec3948230045278773e22b8fc9bff068047c7a1a

  • memory/2188-0-0x0000000074531000-0x0000000074532000-memory.dmp

    Filesize

    4KB

  • memory/2188-1-0x0000000074530000-0x0000000074ADB000-memory.dmp

    Filesize

    5.7MB

  • memory/2188-2-0x0000000074530000-0x0000000074ADB000-memory.dmp

    Filesize

    5.7MB

  • memory/2188-3-0x0000000074530000-0x0000000074ADB000-memory.dmp

    Filesize

    5.7MB

  • memory/2188-4-0x0000000074530000-0x0000000074ADB000-memory.dmp

    Filesize

    5.7MB

  • memory/2188-347-0x0000000074530000-0x0000000074ADB000-memory.dmp

    Filesize

    5.7MB