84bebbe2cc14519a656dd6ee54e892191872f7122ebf53ef6b2349a5218c11e1

Resubmissions

18-07-2024 07:25

240718-h84wjs1hpb 10

18-07-2024 07:19

240718-h51pqa1gng 10

17-07-2024 20:55

240717-zqkhmaydmq 10

17-07-2024 19:21

240717-x2pwdaycjb 10

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
17-07-2024 20:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Bit Paymer.exe
Size

92KB
MD5

998246bd0e51f9582b998ca514317c33
SHA1

5a2d799ac4cca8954fc117c7fb3e868f93c6f009
SHA256

d693c33dd550529f3634e3c7e53d82df70c9d4fbd0c339dbc1849ada9e539ea2
SHA512

773d9838be9c09bd43a22aa1eada8f623f95739b21828712236a4a209c6d9266647ef43592d072d68399224965253c37f9ce9ef36e46e8191169c03ac7789130
SSDEEP

1536:tacFdjxs2TlWlpnXv91nhixG8/lA5jG8387SpK6jXOMVHoi5e+vRb:taqJC6lWlpnXv7nhixhlAU83VwMCifvR

Score

10^/10

persistence ransomware spyware stealer

Malware Config

Extracted

Path

C:\vcredist2010_x86.log-MSI_vc_red.msi.txt.readme_txt

Ransom Note

YOUR COMPANY HAS BEEN SUCCESSFULLY PENETRATED! All files are encrypted. We accept only bitcoins to share the decryption software for your network. Also, we have gathered all your private sensitive data.So if you decide not to pay anytime soon, we would share it with media's. It may harm your business reputation and the company's capitalization fell sharply. Do not try to do it with 3rd-parties programs, files might be damaged then. Decrypting of your files is only possible with the special decryption software. To receive your private key and the decryption software please follow the link (using tor2web service): https://qmnmrba4s4a3py6z.onion.to/order/43e4593a-5dc7-11e7-8803-00163e417ea3 If this address is not available, follow these steps: 1. Download and install Tor Browser: https://www.torproject.org/projects/torbrowser.html.en 2. After a successful installation, run the browser and wait for initialization. 3. Type in the address bar: http://qmnmrba4s4a3py6z.onion/order/43e4593a-5dc7-11e7-8803-00163e417ea3 4. Follow the instructions on the site 5. This link is valid for 72 hours only. Afetr that period your local data would be lost completely. 6. Any questions: [email protected]

Emails

[email protected]

URLs

https://qmnmrba4s4a3py6z.onion.to/order/43e4593a-5dc7-11e7-8803-00163e417ea3

http://qmnmrba4s4a3py6z.onion/order/43e4593a-5dc7-11e7-8803-00163e417ea3

Signatures

Renames multiple (9958) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Executes dropped EXE 3 IoCs

pid	Process
3040	6xzF0T:exe
2696	FFg.exe
2812	FCh:exe

Loads dropped DLL 6 IoCs

pid	Process
2484	Bit Paymer.exe
2484	Bit Paymer.exe
2220	cmd.exe
2220	cmd.exe
2696	FFg.exe
2696	FFg.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Windows\CurrentVersion\Run\w7v0z = "C:\\Users\\Admin\\AppData\\Local\\f3i\\IgVC5.exe"	Bit Paymer.exe

Drops desktop.ini file(s) 1 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\DataServices\DESKTOP.INI	FCh:exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Microsoft Office\Office14\mset7jp.kic.locked	FCh:exe
File created	C:\Program Files (x86)\Microsoft Office\Office14\OART.DLL.readme_txt	FCh:exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.ui_5.5.0.165303.jar.locked	FCh:exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\css\blafdoc.css.readme_txt	FCh:exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-modules-editor-mimelookup-impl.jar	FCh:exe
File opened for modification	C:\Program Files\Mozilla Firefox\browser\features\[email protected]	FCh:exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0149118.JPG.locked	FCh:exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\schemagen.exe.locked	FCh:exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\GMT-10.readme_txt	FCh:exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\America\Cuiaba.readme_txt	FCh:exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\info.png	FCh:exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\MEDIA\CAGCAT10\J0233312.WMF.locked	FCh:exe
File created	C:\Program Files (x86)\Microsoft Office\Office14\CONVERT\ORG97.SAM.readme_txt	FCh:exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\content-background.png	FCh:exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\win\CP1250.TXT.locked	FCh:exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0101857.BMP.readme_txt	FCh:exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0107148.WMF.locked	FCh:exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Colors\Newsprint.xml.locked	FCh:exe
File created	C:\Program Files\Microsoft Games\Minesweeper\en-US\Minesweeper.exe.mui.readme_txt	FCh:exe
File created	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0153299.WMF.readme_txt	FCh:exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\ADVTEL.DIC.locked	FCh:exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBFTSCM\SCHEME40.CSS.locked	FCh:exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-modules-keyring.xml.locked	FCh:exe
File created	C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateSetup.exe.locked	FCh:exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0239953.WMF.locked	FCh:exe
File created	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0382960.JPG.locked	FCh:exe
File created	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\CommonData\AlertImage_MediumMAsk.bmp.readme_txt	FCh:exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\jmc.ini.readme_txt	FCh:exe
File created	C:\Program Files\Microsoft Games\Multiplayer\Spades\en-US\shvlzm.exe.mui.readme_txt	FCh:exe
File opened for modification	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\UIAutomationClient.dll	FCh:exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0250504.WMF	FCh:exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\LINES\BD14801_.GIF.readme_txt	FCh:exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\PIXEL\PREVIEW.GIF.locked	FCh:exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBSPAPR\ZPDIR00.GIF	FCh:exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\PAGESIZE\PGMN010.XML.locked	FCh:exe
File created	C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\FOLDPROJ.DPV.readme_txt	FCh:exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\AUDIOSEARCHSAPIFE.DLL	FCh:exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\DGWEBHD.DPV.readme_txt	FCh:exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\WATERMAR\PREVIEW.GIF	FCh:exe
File created	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\EN00320_.WMF.readme_txt	FCh:exe
File created	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0153273.WMF.readme_txt	FCh:exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\DGACCBAR.DPV	FCh:exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\SpringGreen.css.readme_txt	FCh:exe
File created	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\bg_Casual.gif.readme_txt	FCh:exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\DGCHKBRD.XML.locked	FCh:exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\update_tracking\com-sun-tools-visualvm-host.xml	FCh:exe
File opened for modification	C:\Program Files\Microsoft Office\Office14\ONLNTCOMLIB.DLL.readme_txt	FCh:exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.151\goopdateres_cs.dll	FCh:exe
File created	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\FD00419_.WMF.locked	FCh:exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\OUTLOOK.EXE.MANIFEST.locked	FCh:exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Macau.locked	FCh:exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\Web Server Extensions\14\BIN\1033\FPEXT.MSG.readme_txt	FCh:exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\CUPINST.WMF	FCh:exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0107512.WMF	FCh:exe
File created	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\CommonData\CommsIncomingImageSmall.jpg.readme_txt	FCh:exe
File created	C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\CERT98.POC.locked	FCh:exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\RSSFeeds.Gadget\ja-JP\flyout.html	FCh:exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ecf.provider.filetransfer.ssl_1.0.0.v20140827-1444.jar.readme_txt	FCh:exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0090089.WMF	FCh:exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0341344.JPG	FCh:exe
File created	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\SO02228_.WMF.locked	FCh:exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\BCSClientManifest.man.locked	FCh:exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\GFX.DLL.readme_txt	FCh:exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\Casual.css	FCh:exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Discovers systems in the same network 1 TTPs 2 IoCs

discovery

Remote System Discovery

T1018

pid	Process
2316	net.exe
2428	net.exe

NTFS ADS 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Local\6xzF0T:exe	Bit Paymer.exe
File created	C:\Users\Admin\AppData\Local\FCh:exe	FFg.exe

Suspicious use of WriteProcessMemory 24 IoCs

description	pid	Process	procid_target
PID 2484 wrote to memory of 2220	2484	Bit Paymer.exe	32
PID 2484 wrote to memory of 2220	2484	Bit Paymer.exe	32
PID 2484 wrote to memory of 2220	2484	Bit Paymer.exe	32
PID 2484 wrote to memory of 2220	2484	Bit Paymer.exe	32
PID 2484 wrote to memory of 3040	2484	Bit Paymer.exe	34
PID 2484 wrote to memory of 3040	2484	Bit Paymer.exe	34
PID 2484 wrote to memory of 3040	2484	Bit Paymer.exe	34
PID 2484 wrote to memory of 3040	2484	Bit Paymer.exe	34
PID 2220 wrote to memory of 2696	2220	cmd.exe	36
PID 2220 wrote to memory of 2696	2220	cmd.exe	36
PID 2220 wrote to memory of 2696	2220	cmd.exe	36
PID 2220 wrote to memory of 2696	2220	cmd.exe	36
PID 2696 wrote to memory of 2812	2696	FFg.exe	37
PID 2696 wrote to memory of 2812	2696	FFg.exe	37
PID 2696 wrote to memory of 2812	2696	FFg.exe	37
PID 2696 wrote to memory of 2812	2696	FFg.exe	37
PID 3040 wrote to memory of 2428	3040	6xzF0T:exe	39
PID 3040 wrote to memory of 2428	3040	6xzF0T:exe	39
PID 3040 wrote to memory of 2428	3040	6xzF0T:exe	39
PID 3040 wrote to memory of 2428	3040	6xzF0T:exe	39
PID 3040 wrote to memory of 2316	3040	6xzF0T:exe	41
PID 3040 wrote to memory of 2316	3040	6xzF0T:exe	41
PID 3040 wrote to memory of 2316	3040	6xzF0T:exe	41
PID 3040 wrote to memory of 2316	3040	6xzF0T:exe	41

C:\Users\Admin\AppData\Local\Temp\Bit Paymer.exe
"C:\Users\Admin\AppData\Local\Temp\Bit Paymer.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- NTFS ADS
- Suspicious use of WriteProcessMemory
PID:2484
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c C:\Users\Admin\AppData\Local\P0r7j\FFg.exe 2
  2⤵
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:2220
- - C:\Users\Admin\AppData\Local\P0r7j\FFg.exe
    C:\Users\Admin\AppData\Local\P0r7j\FFg.exe 2
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - NTFS ADS
    - Suspicious use of WriteProcessMemory
    PID:2696
  - - C:\Users\Admin\AppData\Local\FCh:exe
      C:\Users\Admin\AppData\Local\FCh:exe 3 C:\Users\Admin\AppData\Local\P0r7j\FFg.exe
      4⤵
      Executes dropped EXE
      Drops desktop.ini file(s)
      Drops file in Program Files directory
      PID:2812
- C:\Users\Admin\AppData\Local\6xzF0T:exe
  C:\Users\Admin\AppData\Local\6xzF0T:exe 1 C:\Users\Admin\AppData\Local\Temp\Bit Paymer.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:3040
- - C:\Windows\SysWOW64\net.exe
    C:\Windows\system32\net.exe view
    3⤵
    - Discovers systems in the same network
    PID:2428
- - C:\Windows\SysWOW64\net.exe
    C:\Windows\system32\net.exe view \\PDIZKVQX
    3⤵
    - Discovers systems in the same network
    PID:2316

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Remote System Discovery

T1018

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Microsoft\Windows\Caches\cversions.2.db

Filesize
16KB

MD5
dd3a509df4710fdad75e87ba6b3587ad

SHA1
c6318271352e526c9ace87c2f60a2407b451fd75

SHA256
8cd5961e0a65ff73a4e70b00bf77de2095eedf15386a6f90cfbdf65e63e71f9b

SHA512
3d488b9dae317e5e2fb5c7b083cba4533ddccb0f1a3acd332935167ad64a658781f940491540ad311297e7188f623a54bbf2836045e2a6c9ecf6a76f16955051

Download Submit
C:\ProgramData\Microsoft\Windows\Caches\{2125A17D-41B7-4CA3-BFA4-F4AE7A5C7BD1}.2.ver0x0000000000000001.db

Filesize
2KB

MD5
47623f95395fb35bee9d82c4dec2137b

SHA1
b96bcd7fcf35ef3b07d04e5409582685bee2f5c3

SHA256
38f589645d3c6e079161923d26f852642c71e12e65cc1057c6a59feff1975feb

SHA512
5ff776460981fe423b94d412e6eeceb4e8006f55924255c8dff22497dd767046fc73187e954f6c38b99166e8b3d20788e25a736c55d2f246fc4d24e8b05b699b

Download Submit
C:\ProgramData\Microsoft\Windows\Caches\{493464EB-934A-41D4-9FB7-C8E0D637396A}.2.ver0x0000000000000001.db

Filesize
1KB

MD5
50dc1044d5588ddb6c5cb5cdd62dee5b

SHA1
432d0d5202130ed0c79d7eacf5aef82337fef3e6

SHA256
aa95e1a0bd1762fca2d26515d03d60e1e4b2afa17a60a638fec512f59841b1ea

SHA512
6a10c2d949220851e09176a1e21a525541b18f877f0f7a60079cf424dd221ce2938eca4681e624b03301e8f116ffbd73bfb92b9aecdf0b2060ba7592a625aa50

Download Submit
C:\ProgramData\Microsoft\Windows\Caches\{C15A4447-2FA3-4E5A-9400-E1DC34969F58}.2.ver0x0000000000000002.db

Filesize
1KB

MD5
03f307883d3144cd8d9c3072dacf6fc4

SHA1
746d7a17cafd187a3a5bf07cc2047aed91854dc7

SHA256
e50cb0848c9a3973ab7ba1aaa244f5a28d2e74807ddea9cf7cacf8744469fa57

SHA512
fb1077a2af24bf784728014630873729b39ecc5ee304ecd677bbacc641b2839c6e1571176f64c239a46370175fd44dcf59975bf739cd22c38a5c75764911e477

Download Submit
C:\ProgramData\Microsoft\Windows\Caches\{DDF571F2-BE98-426D-8288-1A9A39C3FDA2}.2.ver0x0000000000000002.db

Filesize
405KB

MD5
9641bc98d0335bff9a2ce20bb3cd3d4a

SHA1
be4bdff3a5ee4588bf7d88ffd318091c957c8dc7

SHA256
00cfafcc42a97025ac850dcd1a656fad7e095d53818157d7f9c7f8014717dff4

SHA512
2d9dfb40d55a87bf642e540eb169efe3faab84ecc7f84ab54bb80e771d3ff9aff7309baa13781fa910d9109548adc0f27d05c33fb08c301711e34a5ed9b3f29b

Download Submit
C:\Users\Admin\AppData\Local\P0r7j\FFg.exe

Filesize
92KB

MD5
998246bd0e51f9582b998ca514317c33

SHA1
5a2d799ac4cca8954fc117c7fb3e868f93c6f009

SHA256
d693c33dd550529f3634e3c7e53d82df70c9d4fbd0c339dbc1849ada9e539ea2

SHA512
773d9838be9c09bd43a22aa1eada8f623f95739b21828712236a4a209c6d9266647ef43592d072d68399224965253c37f9ce9ef36e46e8191169c03ac7789130

Download Submit
C:\vcredist2010_x86.log-MSI_vc_red.msi.txt

Filesize
4B

MD5
76390d3429ba451f1e37daae6bc85b51

SHA1
c8e633f4a5ad8991f348fa8bf85dfec134e2c4dc

SHA256
31d694956ddcdb8b2d61ee7b91beb5af37ce0557b6ca44438d2c3ca9f96c56d9

SHA512
cff8a95d7efbabc3ac3c06b721166ac26254eadcbed6296bb17712be07c1b7245ab22fb9b558371b0a69e855451706180ef20ccb57f639cbe818c14d90bd3e54

Download Submit
C:\vcredist2010_x86.log-MSI_vc_red.msi.txt.readme_txt

Filesize
1KB

MD5
51fab08a170e3c398e696a5d36cde259

SHA1
b60d83b9db3831998bb5672e4a4a1610cf4e1cb1

SHA256
bab1199a9b43d11429c79f0b15c7e8c8d61ec612aca223aa66fd253eab11f1cb

SHA512
50b95e5bd31ab894e997773c374592bda8a0cf44f92c9b92aad8155928240c1a2d177f81bcdefe72d686413dd9494f8010f66f9e191b7a549fb99902c6f2c3d6

Download Submit
memory/2484-14-0x0000000001000000-0x0000000001020000-memory.dmp

Filesize
128KB

Download
memory/2484-0-0x0000000001000000-0x0000000001020000-memory.dmp

Filesize
128KB

Download
memory/2484-1-0x0000000000240000-0x0000000000246000-memory.dmp

Filesize
24KB

Download
memory/2696-28-0x0000000001000000-0x0000000001020000-memory.dmp

Filesize
128KB

Download
memory/2812-7311-0x0000000001000000-0x0000000001020000-memory.dmp

Filesize
128KB

Download
memory/3040-7297-0x0000000001000000-0x0000000001020000-memory.dmp

Filesize
128KB

Download

Resubmissions

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads