Analysis
-
max time kernel
121s -
max time network
144s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
05-08-2024 10:41
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
Project2.exe
Resource
win7-20240708-en
windows7-x64
15 signatures
150 seconds
Behavioral task
behavioral2
Sample
Project2.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
15 signatures
150 seconds
General
-
Target
Project2.exe
-
Size
12KB
-
MD5
2e098fe6d840861abc61a0b542a0069b
-
SHA1
e4dd6bb202abb8defa8688fd122e979311a80a0b
-
SHA256
29c12e35c1942362bdb1e41cc45e65f51ec5f40a0b84c1406b56addf24d814bc
-
SHA512
46323dbfacb5e67012300b207d8143bdc227f679c37104feefa91e62845457683d63de2de3457359b701e3f919289ef66af1293c8d5c2e9a65312f626f5f3ab2
-
SSDEEP
96:QQJsYdT/L3YhpwbmTt7YJ/zUce6rsPX0zjQqeZ8CjRdGLj7jPrmFxe3Q5tfcsDJu:QYdTzI3OUe3SkjQxe3Q5tfFDA+Z2
Malware Config
Extracted
Path
C:\HOW TO BACK FILES.txt
Family
targetcompany
Ransom Note
Hello
Your data has been stolen and encrypted
We will delete the stolen data and help with the recovery of encrypted files after payment has been made
Do not try to change or restore files yourself, this will break them
We provide free decryption for any 3 files up to 3MB in size on our website
How to contact with us:
1) Download and install TOR browser by this link: https://www.torproject.org/download/
2) If TOR blocked in your country and you can't access to the link then use any VPN software
3) Run TOR browser and open the site: wtyafjyhwqrgo4a45wdvvwhen3cx4euie73qvlhkhvlrexljoyuklaad.onion/mallox/privateSignin
4) Copy your private ID in the input field. Your Private key: 1D074FC2E748BAA03A2E3E4E
5) You will see chat, payment information and we can make free test decryption here
Our blog of leaked companies:
wtyafjyhwqrgo4a45wdvvwhen3cx4euie73qvlhkhvlrexljoyuklaad.onion
If you are unable to contact us through the site, then you can email us:
[email protected]
[email protected]
Waiting for a response via mail can be several days. Do not use it if you have not tried contacting through the site.
�
URLs
http://wtyafjyhwqrgo4a45wdvvwhen3cx4euie73qvlhkhvlrexljoyuklaad.onion/mallox/privateSignin
http://wtyafjyhwqrgo4a45wdvvwhen3cx4euie73qvlhkhvlrexljoyuklaad.onion
Signatures
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
TargetCompany,Mallox
TargetCompany (aka Mallox) is a ransomware which encrypts files using a combination of ChaCha20, AES-128, and Curve25519, first seen in June 2021.
-
Modifies boot configuration data using bcdedit 1 TTPs 2 IoCs
pid Process 2892 bcdedit.exe 2712 bcdedit.exe -
Renames multiple (7236) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Downloads MZ/PE file
-
Executes dropped EXE 1 IoCs
pid Process 2800 fkFSqdHI.exe -
Loads dropped DLL 2 IoCs
pid Process 2980 Project2.exe 2980 Project2.exe -
Enumerates connected drives 3 TTPs 24 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\S: fkFSqdHI.exe File opened (read-only) \??\W: fkFSqdHI.exe File opened (read-only) \??\E: fkFSqdHI.exe File opened (read-only) \??\G: fkFSqdHI.exe File opened (read-only) \??\J: fkFSqdHI.exe File opened (read-only) \??\Q: fkFSqdHI.exe File opened (read-only) \??\P: fkFSqdHI.exe File opened (read-only) \??\U: fkFSqdHI.exe File opened (read-only) \??\D: fkFSqdHI.exe File opened (read-only) \??\A: fkFSqdHI.exe File opened (read-only) \??\M: fkFSqdHI.exe File opened (read-only) \??\O: fkFSqdHI.exe File opened (read-only) \??\X: fkFSqdHI.exe File opened (read-only) \??\H: fkFSqdHI.exe File opened (read-only) \??\K: fkFSqdHI.exe File opened (read-only) \??\L: fkFSqdHI.exe File opened (read-only) \??\R: fkFSqdHI.exe File opened (read-only) \??\V: fkFSqdHI.exe File opened (read-only) \??\Y: fkFSqdHI.exe File opened (read-only) \??\Z: fkFSqdHI.exe File opened (read-only) \??\B: fkFSqdHI.exe File opened (read-only) \??\I: fkFSqdHI.exe File opened (read-only) \??\N: fkFSqdHI.exe File opened (read-only) \??\T: fkFSqdHI.exe -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 12 api.ipify.org -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Multimedia\MPP\HOW TO BACK FILES.txt fkFSqdHI.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\SO00177_.WMF fkFSqdHI.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\Sounds\Places\ALARM.WAV fkFSqdHI.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Boise fkFSqdHI.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\GRDEN_01.MID fkFSqdHI.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\HH02298_.WMF fkFSqdHI.exe File created C:\Program Files\Windows Journal\fr-FR\HOW TO BACK FILES.txt fkFSqdHI.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.engine.nl_ja_4.4.0.v20140623020002.jar fkFSqdHI.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Boa_Vista fkFSqdHI.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\NA02126_.WMF fkFSqdHI.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\EXCEL.DEV_COL.HXC fkFSqdHI.exe File created C:\Program Files (x86)\Microsoft Office\Office14\PAGESIZE\HOW TO BACK FILES.txt fkFSqdHI.exe File opened for modification C:\Program Files\Microsoft Games\Solitaire\en-US\Solitaire.exe.mui fkFSqdHI.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0144773.JPG fkFSqdHI.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0314068.JPG fkFSqdHI.exe File opened for modification C:\Program Files\Windows Media Player\it-IT\wmplayer.exe.mui fkFSqdHI.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\AG00169_.GIF fkFSqdHI.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\OCEAN_01.MID fkFSqdHI.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.core_5.5.0.165303\HOW TO BACK FILES.txt fkFSqdHI.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Africa\Windhoek fkFSqdHI.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\ach\LC_MESSAGES\vlc.mo fkFSqdHI.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\DD01182_.WMF fkFSqdHI.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0099160.JPG fkFSqdHI.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\NA00452_.WMF fkFSqdHI.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD14692_.GIF fkFSqdHI.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBSPAPR\PDIR48F.GIF fkFSqdHI.exe File created C:\Program Files\Java\jre7\lib\amd64\HOW TO BACK FILES.txt fkFSqdHI.exe File created C:\Program Files\VideoLAN\VLC\locale\sv\LC_MESSAGES\HOW TO BACK FILES.txt fkFSqdHI.exe File created C:\Program Files (x86)\Microsoft Office\Office14\Library\Analysis\HOW TO BACK FILES.txt fkFSqdHI.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\TitleButtonIcon.png fkFSqdHI.exe File opened for modification C:\Program Files\Windows Media Player\en-US\wmpnssci.dll.mui fkFSqdHI.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\reviews_super.gif fkFSqdHI.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0386120.JPG fkFSqdHI.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\SpringGreen\BUTTON.GIF fkFSqdHI.exe File created C:\Program Files\VideoLAN\VLC\locale\he\LC_MESSAGES\HOW TO BACK FILES.txt fkFSqdHI.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Atlantic\South_Georgia fkFSqdHI.exe File opened for modification C:\Program Files\Java\jre7\lib\tzmappings fkFSqdHI.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\MyriadPro-Bold.otf fkFSqdHI.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\HH01242_.WMF fkFSqdHI.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\PH01247U.BMP fkFSqdHI.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\HM00005_.WMF fkFSqdHI.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\NA02426_.WMF fkFSqdHI.exe File created C:\Program Files\VideoLAN\VLC\locale\fur\HOW TO BACK FILES.txt fkFSqdHI.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\OldAge\decorative_rule.png fkFSqdHI.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-core_zh_CN.jar fkFSqdHI.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\FORMS\1033\SCHDREQ.CFG fkFSqdHI.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsViewAttachmentIcons.jpg fkFSqdHI.exe File created C:\Program Files\VideoLAN\VLC\locale\or_IN\HOW TO BACK FILES.txt fkFSqdHI.exe File opened for modification C:\Program Files\Microsoft Games\Multiplayer\Spades\fr-FR\HOW TO BACK FILES.txt fkFSqdHI.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.attach_5.5.0.165303.jar fkFSqdHI.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\DD01160_.WMF fkFSqdHI.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\IN00233_.WMF fkFSqdHI.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\SO01566_.WMF fkFSqdHI.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\POWERPNT.DEV.HXS fkFSqdHI.exe File created C:\Program Files (x86)\Microsoft Office\Office14\BORDERS\HOW TO BACK FILES.txt fkFSqdHI.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\NavigationRight_SelectionSubpicture.png fkFSqdHI.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\Mso Example Intl Setup File A.txt fkFSqdHI.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\BL00932_.WMF fkFSqdHI.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\CAGCAT10\J0297551.WMF fkFSqdHI.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\InfoPathOM\InfoPathOMFormServices\HOW TO BACK FILES.txt fkFSqdHI.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\css\ui-lightness\images\ui-bg_highlight-soft_75_ffe45c_1x100.png fkFSqdHI.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0107134.WMF fkFSqdHI.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\PH02208U.BMP fkFSqdHI.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Colors\Thatch.xml fkFSqdHI.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 2980 Project2.exe 2980 Project2.exe 2800 fkFSqdHI.exe 2800 fkFSqdHI.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeTakeOwnershipPrivilege 2800 fkFSqdHI.exe Token: SeDebugPrivilege 2800 fkFSqdHI.exe Token: SeTakeOwnershipPrivilege 2800 fkFSqdHI.exe Token: SeTakeOwnershipPrivilege 2800 fkFSqdHI.exe Token: SeTakeOwnershipPrivilege 2800 fkFSqdHI.exe Token: SeTakeOwnershipPrivilege 2800 fkFSqdHI.exe Token: SeTakeOwnershipPrivilege 2800 fkFSqdHI.exe Token: SeTakeOwnershipPrivilege 2800 fkFSqdHI.exe Token: SeTakeOwnershipPrivilege 2800 fkFSqdHI.exe Token: SeTakeOwnershipPrivilege 2800 fkFSqdHI.exe Token: SeTakeOwnershipPrivilege 2800 fkFSqdHI.exe Token: SeTakeOwnershipPrivilege 2800 fkFSqdHI.exe Token: SeTakeOwnershipPrivilege 2800 fkFSqdHI.exe Token: SeTakeOwnershipPrivilege 2800 fkFSqdHI.exe Token: SeTakeOwnershipPrivilege 2800 fkFSqdHI.exe Token: SeTakeOwnershipPrivilege 2800 fkFSqdHI.exe Token: SeTakeOwnershipPrivilege 2800 fkFSqdHI.exe Token: SeTakeOwnershipPrivilege 2800 fkFSqdHI.exe Token: SeTakeOwnershipPrivilege 2800 fkFSqdHI.exe Token: SeTakeOwnershipPrivilege 2800 fkFSqdHI.exe Token: SeTakeOwnershipPrivilege 2800 fkFSqdHI.exe Token: SeTakeOwnershipPrivilege 2800 fkFSqdHI.exe Token: SeTakeOwnershipPrivilege 2800 fkFSqdHI.exe Token: SeTakeOwnershipPrivilege 2800 fkFSqdHI.exe Token: SeTakeOwnershipPrivilege 2800 fkFSqdHI.exe Token: SeTakeOwnershipPrivilege 2800 fkFSqdHI.exe Token: SeTakeOwnershipPrivilege 2800 fkFSqdHI.exe Token: SeTakeOwnershipPrivilege 2800 fkFSqdHI.exe Token: SeTakeOwnershipPrivilege 2800 fkFSqdHI.exe Token: SeTakeOwnershipPrivilege 2800 fkFSqdHI.exe Token: SeTakeOwnershipPrivilege 2800 fkFSqdHI.exe Token: SeTakeOwnershipPrivilege 2800 fkFSqdHI.exe Token: SeTakeOwnershipPrivilege 2800 fkFSqdHI.exe Token: SeTakeOwnershipPrivilege 2800 fkFSqdHI.exe Token: SeTakeOwnershipPrivilege 2800 fkFSqdHI.exe Token: SeTakeOwnershipPrivilege 2800 fkFSqdHI.exe Token: SeTakeOwnershipPrivilege 2800 fkFSqdHI.exe Token: SeTakeOwnershipPrivilege 2800 fkFSqdHI.exe Token: SeTakeOwnershipPrivilege 2800 fkFSqdHI.exe Token: SeTakeOwnershipPrivilege 2800 fkFSqdHI.exe Token: SeTakeOwnershipPrivilege 2800 fkFSqdHI.exe Token: SeTakeOwnershipPrivilege 2800 fkFSqdHI.exe Token: SeTakeOwnershipPrivilege 2800 fkFSqdHI.exe Token: SeTakeOwnershipPrivilege 2800 fkFSqdHI.exe Token: SeTakeOwnershipPrivilege 2800 fkFSqdHI.exe Token: SeTakeOwnershipPrivilege 2800 fkFSqdHI.exe Token: SeTakeOwnershipPrivilege 2800 fkFSqdHI.exe Token: SeTakeOwnershipPrivilege 2800 fkFSqdHI.exe Token: SeTakeOwnershipPrivilege 2800 fkFSqdHI.exe Token: SeTakeOwnershipPrivilege 2800 fkFSqdHI.exe Token: SeTakeOwnershipPrivilege 2800 fkFSqdHI.exe Token: SeTakeOwnershipPrivilege 2800 fkFSqdHI.exe Token: SeTakeOwnershipPrivilege 2800 fkFSqdHI.exe Token: SeTakeOwnershipPrivilege 2800 fkFSqdHI.exe Token: SeTakeOwnershipPrivilege 2800 fkFSqdHI.exe Token: SeTakeOwnershipPrivilege 2800 fkFSqdHI.exe Token: SeTakeOwnershipPrivilege 2800 fkFSqdHI.exe Token: SeTakeOwnershipPrivilege 2800 fkFSqdHI.exe Token: SeTakeOwnershipPrivilege 2800 fkFSqdHI.exe Token: SeTakeOwnershipPrivilege 2800 fkFSqdHI.exe Token: SeTakeOwnershipPrivilege 2800 fkFSqdHI.exe Token: SeTakeOwnershipPrivilege 2800 fkFSqdHI.exe Token: SeTakeOwnershipPrivilege 2800 fkFSqdHI.exe Token: SeTakeOwnershipPrivilege 2800 fkFSqdHI.exe -
Suspicious use of WriteProcessMemory 15 IoCs
description pid Process procid_target PID 2980 wrote to memory of 2800 2980 Project2.exe 33 PID 2980 wrote to memory of 2800 2980 Project2.exe 33 PID 2980 wrote to memory of 2800 2980 Project2.exe 33 PID 2800 wrote to memory of 2772 2800 fkFSqdHI.exe 34 PID 2800 wrote to memory of 2772 2800 fkFSqdHI.exe 34 PID 2800 wrote to memory of 2772 2800 fkFSqdHI.exe 34 PID 2800 wrote to memory of 2464 2800 fkFSqdHI.exe 36 PID 2800 wrote to memory of 2464 2800 fkFSqdHI.exe 36 PID 2800 wrote to memory of 2464 2800 fkFSqdHI.exe 36 PID 2772 wrote to memory of 2892 2772 cmd.exe 38 PID 2772 wrote to memory of 2892 2772 cmd.exe 38 PID 2772 wrote to memory of 2892 2772 cmd.exe 38 PID 2464 wrote to memory of 2712 2464 cmd.exe 39 PID 2464 wrote to memory of 2712 2464 cmd.exe 39 PID 2464 wrote to memory of 2712 2464 cmd.exe 39 -
System policy modification 1 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\shutdownwithoutlogon = "0" fkFSqdHI.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Project2.exe"C:\Users\Admin\AppData\Local\Temp\Project2.exe"1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2980 -
C:\Users\Public\fkFSqdHI.exeC:\Users\Public\fkFSqdHI.exe2⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2800 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c bcdedit /set {current} bootstatuspolicy ignoreallfailures3⤵
- Suspicious use of WriteProcessMemory
PID:2772 -
C:\Windows\system32\bcdedit.exebcdedit /set {current} bootstatuspolicy ignoreallfailures4⤵
- Modifies boot configuration data using bcdedit
PID:2892
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c bcdedit /set {current} recoveryenabled no3⤵
- Suspicious use of WriteProcessMemory
PID:2464 -
C:\Windows\system32\bcdedit.exebcdedit /set {current} recoveryenabled no4⤵
- Modifies boot configuration data using bcdedit
PID:2712
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD5238e44aa7c7079f6700b2da4301b72f8
SHA1357fca9c0374c64103580cf4c6ba9600b02541b8
SHA25618d42b77456dcd8991cc3e80c02532a2d1f389e6eeec804d41068c520aab319c
SHA51244475c6c091444c6f1e676dd091a068f865fef46f632caf05d6404a0a67dc70a25bb87a5b0577f841a0f7bc218d11d043bb34f9c6eb9636a356ff078538f9569
-
Filesize
84B
MD546ec5e5765bfea48c4f3384daade4051
SHA19c3ddbb1b32df22d7a28a01240a06907d081e739
SHA25618b33e7c2b477ee114e5b6f6f2ce73131021856b9479ec3b30479982ee95907b
SHA512ef5192f70e2bf49ac69e233f304c3ad7433b41a5764c8bc71eec14e51e8897c96eb451502983d98028cd7b4938b6f2933be6edd508d0f406fed467be99e0c557
-
Filesize
484KB
MD50aab6bab5024b02b33b3a1ab6403a63b
SHA1042571a56c890ec611c626602573dba953155512
SHA256d6e3f6e93f95b70c8d5c4721cc1dbe09e9ae5eaa4b5a0fb7da1e1206ab601d0b
SHA5122470de2c1ba96989bab3a61c96e8dbedc1b51ca72def312cd352a21e1abd5b4b003e624079241948c978fd51e0c1842eb56c931ffb4c34609b531e274cc7d07e