hellokitty | 4b082cfa36133e66c3ed8918ed775bd656890c3c7373606d67e0ee9edd6aa3b4

Analysis

max time kernel
113s
max time network
114s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
08/09/2024, 16:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4b082cfa36133e66c3ed8918ed775bd656890c3c7373606d67e0ee9edd6aa3b4.exe
Size

473KB
MD5

a3dc8739c25b9b0c0348fc12fddcef65
SHA1

37fa81ea2346e2110715c604d451097b95bb4698
SHA256

4b082cfa36133e66c3ed8918ed775bd656890c3c7373606d67e0ee9edd6aa3b4
SHA512

e75715dbfd4ad26cf0ed0666c3f293963eafdcd94847346e5a3104b53018155d41cca9220147e5f23621abb9955d496c5aa83edad572b56bc9e3d401cfe6323f
SSDEEP

3072:WLObLmjqGR2l/mlHaMwGkHJhqDLcClct:WLkLmjqGk/m2ghlC

Score

10^/10

hellokitty discovery ransomware

Malware Config

Extracted

Path

C:\Users\Admin\Contacts\read_me_lkdtt.txt

Ransom Note

Hello CEMIG! All your fileservers, HyperV infrastructure and backups have been encrypted! Trying to decrypt or modify the files with programs other than our decryptor can lead to permanent loss of data! The only way to recover your files is by cooperating with us. To prove our seriousness, we can decrypt 1 non-critical file for free as proof. We have over 10 TB data of your private files, databases, personal data... etc, you have 24 hours to contact us, another way we publish this information in public channels, and this site will be unavailable. -- Contact with us by method below 1) Open this website in TOR browser: http://x6gjpqs4jjvgpfvhghdz2dk7be34emyzluimticj5s5fexf4wa65ngad.onion/0c04b15081595448821e25e8dd07423d9927fa54cd56d8797ea4d1315a682692 2) Follow instructions in chat.

URLs

http://x6gjpqs4jjvgpfvhghdz2dk7be34emyzluimticj5s5fexf4wa65ngad.onion/0c04b15081595448821e25e8dd07423d9927fa54cd56d8797ea4d1315a682692

Signatures

HelloKitty Ransomware
Ransomware family which has been active since late 2020, and in early 2021 a variant compromised the CDProjektRed game studio.
ransomware hellokitty
Renames multiple (157) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Enumerates connected drives 3 TTPs 1 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\F:	4b082cfa36133e66c3ed8918ed775bd656890c3c7373606d67e0ee9edd6aa3b4.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	4b082cfa36133e66c3ed8918ed775bd656890c3c7373606d67e0ee9edd6aa3b4.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeBackupPrivilege	3468	vssvc.exe
Token: SeRestorePrivilege	3468	vssvc.exe
Token: SeAuditPrivilege	3468	vssvc.exe

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\4b082cfa36133e66c3ed8918ed775bd656890c3c7373606d67e0ee9edd6aa3b4.exe
"C:\Users\Admin\AppData\Local\Temp\4b082cfa36133e66c3ed8918ed775bd656890c3c7373606d67e0ee9edd6aa3b4.exe"
1⤵
- Enumerates connected drives
- System Location Discovery: System Language Discovery
PID:4816

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3468

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\Contacts\read_me_lkdtt.txt

Filesize
1KB

MD5
039d96e315e46c95b340887c1376d31a

SHA1
e4c03b1f13710f9888bbd554ffef8ec2f5bc438e

SHA256
e9f4ecd100413d581c14bed13ad22c9448035b0a04bacaafdf9a50edf5546c68

SHA512
cbe6929c548fc8d5650b67bab0c6effcd1cf95e0f472db4628dedd1a3920ad5a985bfdfcc6a19975529e8e3dbbfa8d36ed41548fd999c119110a00e9695526da

Download Submit