Overview

overview

10

Static

static

3

d6629a9b61...08.iso

windows7-x64

10

d6629a9b61...08.iso

windows10-2004-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    152s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    03/06/2024, 09:23

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    d6629a9b618ede05e9e75a2cebfb69bc7b1a34fe00a42ff60d88828a307c0d08.iso
  • Size 544KB
  • Sample240603-lcsp7aaa4z
  • SHA256 d6629a9b618ede05e9e75a2cebfb69bc7b1a34fe00a42ff60d88828a307c0d08
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
targetcompanyevasionexecutionransomware

Malware Config

Extracted

Path

  • \Device\HarddiskVolume1\HOW TO BACK FILES.txt

Ransom Note
  • Hello Your data has been stolen and encrypted We will delete the stolen data and help with the recovery of encrypted files after payment has been made Do not try to change or restore files yourself, this will break them We provide free decryption for any 3 files up to 3MB in size on our website How to contact with us: 1) Download and install TOR browser by this link: https://www.torproject.org/download/ 2) If TOR blocked in your country and you can't access to the link then use any VPN software 3) Run TOR browser and open the site: wtyafjyhwqrgo4a45wdvvwhen3cx4euie73qvlhkhvlrexljoyuklaad.onion/mallox/privateSignin 4) Copy your private ID in the input field. Your Private key: C20BBF8E22A6E8D22DF798B4 5) You will see chat, payment information and we can make free test decryption here Our blog of leaked companies: wtyafjyhwqrgo4a45wdvvwhen3cx4euie73qvlhkhvlrexljoyuklaad.onion �
URLs

  • http://wtyafjyhwqrgo4a45wdvvwhen3cx4euie73qvlhkhvlrexljoyuklaad.onion/mallox/privateSignin

  • http://wtyafjyhwqrgo4a45wdvvwhen3cx4euie73qvlhkhvlrexljoyuklaad.onion

Signatures

  • TargetCompany,Mallox

    TargetCompany (aka Mallox) is a ransomware which encrypts files using a combination of ChaCha20, AES-128, and Curve25519, first seen in June 2021.

    ransomwaretargetcompany
  • Modifies boot configuration data using bcdedit 1 TTPs 4 IoCs
    ransomwareevasion
  • Renames multiple (6514) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware
  • Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

    Run Powershell and hide display window.

    execution
  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 2 IoCs
  • Enumerates connected drives 3 TTPs 24 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Drops file in Program Files directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies registry class 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 9 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of WriteProcessMemory 18 IoCs
  • System policy modification 1 TTPs 3 IoCs
    evasion

Processes

  • C:\Windows\system32\cmd.exe
    cmd /c C:\Users\Admin\AppData\Local\Temp\d6629a9b618ede05e9e75a2cebfb69bc7b1a34fe00a42ff60d88828a307c0d08.iso
    1⤵
    • Modifies registry class
    • Suspicious use of AdjustPrivilegeToken
    PID:1588
  • C:\Windows\System32\rundll32.exe
    C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
    1⤵
      PID:1192
    • C:\Program Files\7-Zip\7zFM.exe
      "C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\d6629a9b618ede05e9e75a2cebfb69bc7b1a34fe00a42ff60d88828a307c0d08.iso"
      1⤵
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      PID:4660
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w hidden -command start red.exe "1"
      1⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:4904
      • C:\Users\Admin\Desktop\red.exe
        "C:\Users\Admin\Desktop\red.exe" 1
        2⤵
        • Checks computer location settings
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        • System policy modification
        PID:4268
        • C:\Windows\System32\cmd.exe
          "C:\Windows\System32\cmd.exe" /c bcdedit /set {current} bootstatuspolicy ignoreallfailures
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:4636
          • C:\Windows\system32\bcdedit.exe
            bcdedit /set {current} bootstatuspolicy ignoreallfailures
            4⤵
            • Modifies boot configuration data using bcdedit
            PID:4372
        • C:\Windows\System32\cmd.exe
          "C:\Windows\System32\cmd.exe" /c bcdedit /set {current} recoveryenabled no
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:2088
          • C:\Windows\system32\bcdedit.exe
            bcdedit /set {current} recoveryenabled no
            4⤵
            • Modifies boot configuration data using bcdedit
            PID:4936
    • C:\Users\Admin\Desktop\red.exe
      "C:\Users\Admin\Desktop\red.exe"
      1⤵
      • Checks computer location settings
      • Executes dropped EXE
      • Enumerates connected drives
      • Drops file in Program Files directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      • System policy modification
      PID:1060
      • C:\Windows\System32\cmd.exe
        "C:\Windows\System32\cmd.exe" /c bcdedit /set {current} bootstatuspolicy ignoreallfailures
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:2216
        • C:\Windows\system32\bcdedit.exe
          bcdedit /set {current} bootstatuspolicy ignoreallfailures
          3⤵
          • Modifies boot configuration data using bcdedit
          PID:3508
      • C:\Windows\System32\cmd.exe
        "C:\Windows\System32\cmd.exe" /c bcdedit /set {current} recoveryenabled no
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:1056
        • C:\Windows\system32\bcdedit.exe
          bcdedit /set {current} recoveryenabled no
          3⤵
          • Modifies boot configuration data using bcdedit
          PID:2252

    Network

          MITRE ATT&CK Enterprise v15

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          powershell.exe.log
          • Path C:\Documents and Settings\Admin\Local Settings\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
          • Size 3KB
          • SHA256 b1b43928560fb71e14c95836e96b6533d0d7fd1eaf0b65523e76f493414f9e71
          • MD5 SHA1 SHA512
          Submit Download

          d2905e77b2d1aac0.customDestinations-ms
          • Path C:\Documents and Settings\Admin\Recent\CustomDestinations\d2905e77b2d1aac0.customDestinations-ms
          • Size 5KB
          • SHA256 4c921f19a39fb95e8ed20e74b3e9ad50229c7f9f38bf3d008ed4f3fe4447ce61
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          __PSScriptPolicyTest_yhzwx1xh.4is.ps1
          • Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_yhzwx1xh.4is.ps1
          • Size 60B
          • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
          • MD5 SHA1 SHA512
          Submit Download

          Reader.lnk
          • Path C:\Users\Admin\Desktop\Reader.lnk
          • Size 2KB
          • SHA256 61f36c5ae038faa2b58a9a17b464d01414b4265e46634f353319c471d0a35789
          • MD5 SHA1 SHA512
          Submit Download

          red.exe
          • Path C:\Users\Admin\Desktop\red.exe
          • Size 478KB
          • SHA256 45a236e7aa80515aafb6c656c758faad6e77fb435b35bfa407aef3918212078d
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          HOW TO BACK FILES.txt
          • Path \Device\HarddiskVolume1\HOW TO BACK FILES.txt
          • Size 910B
          • SHA256 cdcf517b57695aa656793de12b8de971493d460a6bf020bd6cfb84ac46159f2d
          • MD5 SHA1 SHA512
          Submit Download

          memory/4904-6-0x00000182EAC10000-0x00000182EAC32000-memory.dmp
          Download