89b2aa58ec00c53d1d50886d1e6f7e1508697fd5b05196abc8f7bd3c93a4b89d

General

Target
file.exe
Size 2.2MB
Sample240927-tahffasejd
SHA256 89b2aa58ec00c53d1d50886d1e6f7e1508697fd5b05196abc8f7bd3c93a4b89d
MD5 dcc5a651f81ac6e1db96c5929ccbe5b0
SHA1 3f4e513291163eb6ff808c466e2de3f0961dee30
SHA512 6f9f0bbce46de5c6b807c2bc985e236c1bef2ad4079c37210cf2fec68aca9ea086304c36756faf87590fcad0f971e1ceb8ef538352576e693750aed44dadb9d8
SSDEEP 49152:wHRp5WY3G3K4shofROg6sBTfuHbZChUYd:0nj3opOg66WZChU
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

ransomware spyware stealer

Malware Config

Extracted

Path

C:\temp\important.txt

Ransom Note

=============================================== | 重要通知 - 重要通知 | =============================================== 你好，尊敬的用户，我们已经成功侵入你的系统，并对你的文件进行了强力加密。你数据库和其他重要文件都已被锁定，无法访问。为了解锁你的文件，你需要支付赎金。我们采用匿名的支付方式，即比特币。以下是支付细节：支付金额：5 BTC（比特币）充币网络：BTC-Bitconin 比特币地址：3PztoCUcREzAhVhTwKT1hf2ManFP3eQQJC 请在下面的比特币地址中支付赎金。一旦支付完成，你将收到解密密钥，并能够恢复你的所有文件。倒计时：你有 72 小时来支付赎金。一旦倒计时结束，解密密钥将永久失效，文件将无法恢复。 ==================== 警告 ===================== 如果你尝试解密文件或与当地执法机关联系，你的文件将被永久销毁，并且你将失去所有数据。为避免不必要的损失，请遵循我们的指示支付赎金。联系我们：[email protected] =============================================== =============================================== | Important Notice | =============================================== Hello, dear user, We have successfully infiltrated your system and encrypted your files with strong encryption. Your photos, documents, databases, and other important files are now locked and inaccessible. To unlock your files, you need to pay a ransom. We prefer an anonymous payment method, namely Bitcoin. Below are the payment details: Payment Amount: 5 BTC (Bitcoin) Bitcoin network：BTC-Bitconin Bitcoin Address: 3PztoCUcREzAhVhTwKT1hf2ManFP3eQQJC Please pay the ransom to the Bitcoin address provided. Once the payment is complete, you will receive the decryption key and be able to recover all your files. Countdown: You have 72 hours to pay the ransom. Once the countdown expires, the decryption key will permanently expire, and your files will be unrecoverable. ==================== Warning ===================== If you attempt to decrypt the files or contact local law enforcement, your files will be permanently destroyed, and you will lose all data. To avoid unnecessary losses, follow our instructions to pay the ransom. Contact us: [email protected] ===============================================

Emails

联系我们：[email protected]
[email protected]

Wallets

3PztoCUcREzAhVhTwKT1hf2ManFP3eQQJC

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\Control Panel\International\Geo\Nation	cmd.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Drops file in System32 directory 4 IoCs

description	ioc	Process
File created	C:\Windows\System32\dp.exe	cmd.exe
File opened for modification	C:\Windows\System32\dp.exe	cmd.exe
File opened for modification	C:\Windows\System32\boot.sdi.Mirage	file.exe
File opened for modification	C:\Windows\SysWOW64\boot.sdi.Mirage	file.exe

Drops file in Windows directory 8 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Boot\DVD\PCAT\boot.sdi.Mirage	file.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-winre-recoverytools_31bf3856ad364e35_10.0.19041.1_none_8b3ee1f81086d0e3\boot.sdi.Mirage	file.exe
File opened for modification	C:\Windows\Boot\DVD\EFI\boot.sdi.Mirage	file.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-b..nvironment-dvd-pcat_31bf3856ad364e35_10.0.19041.1_none_5008dee6cfdc303c\boot.sdi.Mirage	file.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-winre-recoverytools_31bf3856ad364e35_10.0.19041.572_none_b322aa88d0148356\boot.sdi.Mirage	file.exe
File opened for modification	C:\Windows\WinSxS\wow64_microsoft-windows-winre-recoverytools_31bf3856ad364e35_10.0.19041.746_none_bd9bc99304595128\boot.sdi.Mirage	file.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-b..environment-dvd-efi_31bf3856ad364e35_10.0.19041.1_none_8b38a4d923e0a37e\boot.sdi.Mirage	file.exe
File opened for modification	C:\Windows\WinSxS\wow64_microsoft-windows-winre-recoverytools_31bf3856ad364e35_10.0.19041.1_none_95938c4a44e792de\boot.sdi.Mirage	file.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000_Classes\Local Settings	cmd.exe

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

pid	Process
1296	NOTEPAD.EXE

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3088	schtasks.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 4572 wrote to memory of 1352	4572	file.exe	82
PID 4572 wrote to memory of 1352	4572	file.exe	82
PID 4572 wrote to memory of 1748	4572	file.exe	83
PID 4572 wrote to memory of 1748	4572	file.exe	83
PID 4572 wrote to memory of 1640	4572	file.exe	84
PID 4572 wrote to memory of 1640	4572	file.exe	84
PID 4572 wrote to memory of 3088	4572	file.exe	85
PID 4572 wrote to memory of 3088	4572	file.exe	85
PID 1352 wrote to memory of 1296	1352	cmd.exe	90
PID 1352 wrote to memory of 1296	1352	cmd.exe	90

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:4572
- C:\Windows\system32\cmd.exe
  cmd /c start C:\temp\important.txt
  2⤵
  - Checks computer location settings
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:1352
- - C:\Windows\system32\NOTEPAD.EXE
    "C:\Windows\system32\NOTEPAD.EXE" C:\temp\important.txt
    3⤵
    - Opens file in notepad (likely ransom note)
    PID:1296
- C:\Windows\system32\cmd.exe
  cmd /c copy C:\Users\Admin\AppData\Local\Temp\file.exe C:\temp\file.exe
  2⤵
  PID:1748
- C:\Windows\system32\cmd.exe
  cmd /c copy C:\Users\Admin\AppData\Local\Temp\file.exe C:\Windows\System32\dp.exe
  2⤵
  - Drops file in System32 directory
  PID:1640
- C:\Windows\system32\schtasks.exe
  schtasks /create /tn DeepMountains /tr C:\temp\file.exe /sc minute /mo 5
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:3088

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Persistence

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Privilege Escalation

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Defense Evasion

Credential Access

Credentials from Password Stores

1

T1555

Credentials from Web Browsers

1

T1555.003

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

Query Registry

2

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

important.txt

Path C:\temp\important.txt
Size 2KB
SHA256 476c4c8fe3a601ca0adead4a090608e2c7ca0119dc0b59cec95da9e67be47fb0
MD5 0ac358b953b3bd80a9ea536cefff54f6
SHA1 1d77b988a261c0b4370224cc9d4dcd94e44208ca
SHA512 fbf0c817114e46d2c089689c49c759f13403943c8363c4e862f985c5bc13e9a19c7e6909222ba17fe1f3007434ea68f1a3b6440322aae308fb5747e17f44a95b
MD5 SHA1 SHA512

Submit Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads