Resubmissions

28-07-2024 16:38

240728-t5tryssgmm 10

07-07-2024 14:07

240707-rfgd8atekm 10

07-07-2024 14:07

240707-re689awdpe 10

13-09-2022 17:54

220913-wg1lpsgbg7 10

Analysis

  • max time kernel
    1560s
  • max time network
    1566s
  • platform
    windows7_x64
  • resource
    win7-20240705-en
  • resource tags

    arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
  • submitted
    07-07-2024 14:07

General

  • Target

    RansomwareSamples/Cuba_08_03_2021_1130KB.exe

  • Size

    1.1MB

  • MD5

    a12e733ddbe6f404b27474fa0e5de61d

  • SHA1

    e8d0c95621a19131ef9480e58a8d6dd3d15c9acd

  • SHA256

    271ef3c1d022829f0b15f2471d05a28d4786abafd0a9e1e742bde3f6b36872ad

  • SHA512

    f27605a283e958690eb7ad50aa46110b6d155217ad09d658ad3f9c4368d4c66ab623a0cc3489d695a02db462fec3bcf8ebee13f9da1bd61e2e3db46de2d73ddf

  • SSDEEP

    12288:xtwee4XgIijsCMtcTCWVRapiyC9vwic8CPK3EOnA+u+:8efgIiICMtIChp8N2K3EOAK

Score
10/10

Malware Config

Extracted

Path

C:\Program Files\Common Files\Microsoft Shared\ink\bg-BG\!!FAQ for Decryption!!.txt

Ransom Note
Good day. All your files are encrypted. For decryption contact us. Write here [email protected] We also inform that your databases, ftp server and file server were downloaded by us to our servers. * Do not rename encrypted files. * Do not try to decrypt your data using third party software, it may cause permanent data loss.

Signatures

  • Deletes itself 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 7 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\RansomwareSamples\Cuba_08_03_2021_1130KB.exe
    "C:\Users\Admin\AppData\Local\Temp\RansomwareSamples\Cuba_08_03_2021_1130KB.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:2108
    • C:\Windows\SysWOW64\cmd.exe
      /c del C:\Users\Admin\AppData\Local\Temp\RansomwareSamples\Cuba_08_03_2021_1130KB.exe >> NUL
      2⤵
      • Deletes itself
      PID:2940

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Program Files\Common Files\Microsoft Shared\ink\bg-BG\!!FAQ for Decryption!!.txt

    Filesize

    346B

    MD5

    69acb73a5829bdddc9a7cf322178c70f

    SHA1

    3cd71f6cc40c90322e027712403899db2976218b

    SHA256

    9aaf714f40a29e0b10c038a79e26a95a934b7eeec3512a970d8c80f8a6daebd5

    SHA512

    380b506e330f4592cceee56334131cf6493bd989464afc5503bbd6bec0b9073475cfabbd8f37e471cac9f67fbfe07e747660ff6b9f5e0d9d14761e80ead6c57e

  • memory/2108-0-0x0000000000520000-0x0000000000580000-memory.dmp

    Filesize

    384KB

  • memory/2108-1-0x0000000000400000-0x000000000046C000-memory.dmp

    Filesize

    432KB

  • memory/2108-1800-0x0000000000400000-0x000000000051D000-memory.dmp

    Filesize

    1.1MB

  • memory/2108-3317-0x0000000000400000-0x000000000051D000-memory.dmp

    Filesize

    1.1MB

  • memory/2108-4023-0x0000000000400000-0x000000000046C000-memory.dmp

    Filesize

    432KB

  • memory/2108-5030-0x0000000000400000-0x000000000051D000-memory.dmp

    Filesize

    1.1MB

  • memory/2108-6488-0x0000000000400000-0x000000000051D000-memory.dmp

    Filesize

    1.1MB

  • memory/2108-8218-0x0000000000400000-0x000000000051D000-memory.dmp

    Filesize

    1.1MB

  • memory/2108-8549-0x0000000000400000-0x000000000046C000-memory.dmp

    Filesize

    432KB

  • memory/2108-8548-0x0000000000400000-0x000000000051D000-memory.dmp

    Filesize

    1.1MB