Overview

overview

10

Static

static

10

0715240d1a...ce.exe

windows7-x64

9

07fec2205c...42.exe

windows7-x64

10

10dc6e128c...c0.exe

windows7-x64

3

133bf8be0c...de.exe

windows7-x64

10

139a8bb2c5...c1.exe

windows7-x64

10

19f7d53c4a...a0.exe

windows7-x64

10

2896b38ec3...9c.exe

windows7-x64

10

2d301697ff...f4.exe

windows7-x64

3337576503...d8.exe

windows7-x64

3

3e04fe9f42...f1.exe

windows7-x64

10

3e6fbc358e...45.exe

windows7-x64

10

3f7458e658...df.exe

windows7-x64

434ea9832e...27.exe

windows7-x64

10

47792144c9...6f.exe

windows7-x64

10

5114aae6e8...8c.exe

windows7-x64

10

537a2fd4d2...ba.exe

windows7-x64

3

55754358dd...1c.exe

windows7-x64

1

5b1caa9bec...c1.exe

windows7-x64

1

60c24a4c6b...21.exe

windows7-x64

9

63396a28b7...cc.exe

windows7-x64

9

78d4fce0c2...2e.exe

windows7-x64

3

7c27b9fef6...33.exe

windows7-x64

3

81689f1be9...ed.exe

windows7-x64

10

995a91e668...55.exe

windows7-x64

10

9d90421b2e...56.exe

windows7-x64

10

a597d34bc2...40.exe

windows7-x64

10

a5e6df754a...d1.exe

windows7-x64

10

add2850732...6b.exe

windows7-x64

10

b098486c49...0d.exe

windows7-x64

10

b923f1d2ec...ed.exe

windows7-x64

10

bbdac308d2...4b.exe

windows7-x64

9

c3fb821138...c1.exe

windows7-x64

9

Analysis

  • max time kernel
    1559s
  • max time network
    1561s
  • platform
    windows7_x64
  • resource
    win7-20240705-en
  • resource tags

    arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
  • submitted
    16-07-2024 08:54

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    5114aae6e86c7eedfbf181110e4fddfad88fe296ec590390705e00272121e48c.exe

  • Size

    301KB

  • MD5

    be8859e72a538589970efcbd1c198876

  • SHA1

    5d2a73e2de793c081ccb782fdd1ef319dbd7d8e7

  • SHA256

    5114aae6e86c7eedfbf181110e4fddfad88fe296ec590390705e00272121e48c

  • SHA512

    acefe94eeaf7c20714c21d4ef52b33950b8caeae06e24a81c732757251888d504cf98ab958fc82542749421ef5c74655d6f03f4fdf7257159c4cb89367cd8de3

  • SSDEEP

    3072:uqJogYkcSNm9VE84DATVPHNtQAtZfkE44iNsTc:uq2kc4m9i8PBPQAzfk14K

Score
10/10
ransomwarespywarestealer

Malware Config

Extracted

Path

C:\0YiWGiIoC.README.txt

Ransom Note
Note the time. You're already falling behind. The race is already underway. To recover your encrypted data, you must purchase a decryptor from us. Bitcoin (BTC) payment must be sent to: 1CnvpuszJsuMfzJpTrBx4ZQhK7byzt3XCC If you pay within 12 hours, then you only have to pay 0.008 BTC. If you pay within 24 hours, then you only have to pay 0.08 BTC. If you pay within 48 hours, then you must pay 0.8 BTC. If you pay within 96 hours, then you must pay 8 BTC. If you pay within 192 hours, then you must pay 80 BTC. If you pay within 384 hours, then you must pay 800 BTC. -OR- Monero (XMR) payment must be sent to: 88dfUQ7fydN8gDw7ajQyY52KHE6fpdXabRUr3C2tAjK14GBprRcoRpL5vwuT8DKQgSZ8TgNSewHuSLJ5zX9keJgCMxrS3fh If you pay within 12 hours, then you only have to pay 1 XMR. If you pay within 24 hours, then you only have to pay 10 XMR. If you pay within 48 hours, then you must pay 100 XMR. If you pay within 96 hours, then you must pay 1000 XMR. If you pay within 192 hours, then you must pay 10000 XMR. If you pay within 384 hours, then you must pay 100000 BTC. After 384 hours your data will be unrecoverable. The race is over. If you cooperate with us, then you will recover your data. If you change or rename your files, or if you attempt to recover the data yourself, then your data will be locked forever. The decryptor uses a unique key and will not work if you modify anything. To receive the decryptor to recover your data, carefully follow these instructions: 1. Send BTC or XMR in one transaction, not multiple transactions. 2. Copy and paste the BTC or XMR address. Do NOT type it by hand. Double check it is the correct address. Pay in full. Any lesser amount will be ignored. 3. Email us at [email protected] 4. At the beginning of your email, include the transaction hash/TXID of your BTC payment OR the TxKEY and TxID of your XMR payment, so we know it is really from you and you receive the correct key. 5. Emails without this information will be ignored. The race began when you first received communication from us. It will when we receive payment. Timestamps matter. 6. Use your regular email address. Suspicious email addresses will be ignored. Be patient. We check email often but not every second. 7. If our email is broken, bounces back, or is compromised, then you may instead email us at: [email protected] 8. After 1 confirmation on the blockchain, of the correct amount according to the timetable, only then will we reply with the decryptor. 9. You may need to check your spam folder for our reply. The decryptor will include full instructions and the key to fully recover your data. If you're smart enough to understand WHY you're racing, then tell is in your email, and we'll refund you in full and send the decryptor for free. We don't think you're that clever, but we hope to be surprised. We are not joking. If you're dumb enough to think you can recover your data without our help, then not even the decryptor can save you. WE WILL NOT REPLY UNTIL PAYMENT IS RECEIVED. WE WILL NOT SEND THE DECRYPTOR IF YOU ATTEMPT TO IDENTIFY US OR STOP US. WE WILL NOT SEND THE DECRYPTOR IF YOU DO NOT FOLLOW THE INSTRUCTIONS EXACTLY. IF YOU COMPLY AND PAY, YOUR DATA CAN BE RECOVERED IN LESS THAN A DAY. DO NOT BLAME US IF YOU DEVIATE FROM THE RULES OF THE RACE. IF YOU WANT YOUR DATA, THEN YOU KNOW WHAT TO DO. IF YOU HAVE BACKUPS AND DO NOT NEED THE DECRYPTOR, THEN CONGRATULATIONS. YOU ALREADY WON.
Wallets

1CnvpuszJsuMfzJpTrBx4ZQhK7byzt3XCC

Signatures

  • Renames multiple (318) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware
  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Drops desktop.ini file(s) 2 IoCs
  • Sets desktop wallpaper using registry 2 TTPs 2 IoCs
    ransomware
  • Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies Control Panel 2 IoCs
    evasion
  • Modifies registry class 5 IoCs
  • Opens file in notepad (likely ransom note) 1 IoCs
    ransomware
  • Suspicious behavior: EnumeratesProcesses 14 IoCs
  • Suspicious behavior: RenamesItself 26 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\5114aae6e86c7eedfbf181110e4fddfad88fe296ec590390705e00272121e48c.exe
    "C:\Users\Admin\AppData\Local\Temp\5114aae6e86c7eedfbf181110e4fddfad88fe296ec590390705e00272121e48c.exe"
    1⤵
    • Loads dropped DLL
    • Drops desktop.ini file(s)
    • Sets desktop wallpaper using registry
    • Modifies Control Panel
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2524
    • C:\ProgramData\F103.tmp
      "C:\ProgramData\F103.tmp"
      2⤵
      • Deletes itself
      • Executes dropped EXE
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • Suspicious behavior: RenamesItself
      • Suspicious use of WriteProcessMemory
      PID:632
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /C DEL /F /Q C:\PROGRA~3\F103.tmp >> NUL
        3⤵
          PID:608
    • C:\Windows\system32\AUDIODG.EXE
      C:\Windows\system32\AUDIODG.EXE 0x14c
      1⤵
        PID:804
      • C:\Windows\system32\NOTEPAD.EXE
        "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\0YiWGiIoC.README.txt
        1⤵
        • Opens file in notepad (likely ransom note)
        PID:2556

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\$Recycle.Bin\S-1-5-21-2172136094-3310281978-782691160-1000\desktop.ini
        Filesize

        129B

        MD5

        52e0d9e81c717190b421c4ff0f7db6fe

        SHA1

        d81723a124018b10c945620a57960dacaf5d85ac

        SHA256

        d068a3b381426e18627de9126dc6115b0571d0e76d739bdb868fa3f429b2041e

        SHA512

        9257ecf3e1a135521520301bfaa6889d969a2ffac7069bdc03412aabeace759f47d3fdb6b2d801c5f0fb71d151b24373388baf1bedcf72053d0e6dd5ec60b141

        Download Submit

      • C:\0YiWGiIoC.README.txt
        Filesize

        3KB

        MD5

        fe13e4b8155009dd9a53d4acf31edb89

        SHA1

        de8cbfa8c54c5efd1719ab23cfe4d1fee644b084

        SHA256

        878f27c80985fb22cc7c97e1f4f0693a650259946b7ec89da5bbf702314cbc01

        SHA512

        2cd23f0671f585811a84e8894e99a885fe6e8866faf536d448ebd75ff5adc5c6371e349803588878c9e61250016daa77e4ed13579b4aca4031fe5871a90e42d3

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\DDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDD
        Filesize

        301KB

        MD5

        3844140e2a54e0014669f5954e07f0de

        SHA1

        bb26ef7c48014563c73958dcef8e15ba692bd88d

        SHA256

        c9752c71a6cf9009094804f54c1ccf8c6200fbaed0d94441fb756066187bde95

        SHA512

        3be25ce1be92aecde200efa68600687b39e4d050594fb9da3fe3d2d59794e2b1b7d4b46b145ffcb86f1c88f3355fcfdc2f82e36cfa52fe69e9c886d3e9d46e09

        Download Submit

      • F:\$RECYCLE.BIN\S-1-5-21-2172136094-3310281978-782691160-1000\BBBBBBBBBBB
        Filesize

        129B

        MD5

        26ef5b5510e54a4f88baff68c26a54b0

        SHA1

        7540fbbd4aa649da174dbcdf1261c91f0b2e6998

        SHA256

        b144d3548537ddab4cfd78444ec10e7e1d83ccf8dc3601f2bfc9fad198c480f7

        SHA512

        c3c7d418994bc8e4f4cefaff476ce7179ce16e37a2f081edb303426fc182aaad39916019a2c4890d70f6effe23374397367147b24d4f951b6114ddfca23ab8eb

        Download Submit

      • \ProgramData\F103.tmp
        Filesize

        14KB

        MD5

        294e9f64cb1642dd89229fff0592856b

        SHA1

        97b148c27f3da29ba7b18d6aee8a0db9102f47c9

        SHA256

        917e115cc403e29b4388e0d175cbfac3e7e40ca1742299fbdb353847db2de7c2

        SHA512

        b87d531890bf1577b9b4af41dddb2cdbbfa164cf197bd5987df3a3075983645a3acba443e289b7bfd338422978a104f55298fbfe346872de0895bde44adc89cf

        Download Submit

      • memory/632-857-0x000000007EF80000-0x000000007EF81000-memory.dmp

        Filesize

        4KB

        Download

      • memory/632-855-0x00000000022F0000-0x0000000002330000-memory.dmp

        Filesize

        256KB

        Download

      • memory/632-858-0x000000007EF20000-0x000000007EF21000-memory.dmp

        Filesize

        4KB

        Download

      • memory/632-856-0x00000000022F0000-0x0000000002330000-memory.dmp

        Filesize

        256KB

        Download

      • memory/632-854-0x000000007EFA0000-0x000000007EFA1000-memory.dmp

        Filesize

        4KB

        Download

      • memory/632-888-0x000000007EF60000-0x000000007EF61000-memory.dmp

        Filesize

        4KB

        Download

      • memory/632-887-0x000000007EF40000-0x000000007EF41000-memory.dmp

        Filesize

        4KB

        Download

      • memory/2524-853-0x0000000001350000-0x000000000137D000-memory.dmp

        Filesize

        180KB

        Download

      • memory/2524-0-0x0000000001350000-0x000000000137D000-memory.dmp

        Filesize

        180KB

        Download

      • memory/2524-1-0x0000000000D50000-0x0000000000D90000-memory.dmp

        Filesize

        256KB

        Download