Analysis

  • max time kernel
    150s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    14-10-2024 18:25

General

  • Target

    91abe280381d0faf55b521f51d16d8aa022f0cc14b1310334d4fffc3474459d4.exe

  • Size

    1.7MB

  • MD5

    2519f369f426e4d2cdd88290d1c25d3c

  • SHA1

    e464001902893ab6aea89b8ccfc66f9eb1d45988

  • SHA256

    91abe280381d0faf55b521f51d16d8aa022f0cc14b1310334d4fffc3474459d4

  • SHA512

    bedda8d51127c186946cdb3755f9bcc049a0efc308ed645de52d58cdffa8fad85778e4a77338f1c3d68bd2b725ff68e5829a4bba8879983f7380df350754d443

  • SSDEEP

    24576:4E6seIAzWNS0LSaN9EBrx+dbsOCK/91/oc1EDnbLmVrkfvDUdhu3z7L/40NM+Sf2:tKpCSrEdbsOn/4sEDnB3z7E0CzzK

Malware Config

Extracted

Path

C:\info.hta

Ransom Note
<!DOCTYPE HTML PUBLIC '-//W3C//DTD HTML 4.01//EN' 'http://www.w3.org/TR/html4/strict.dtd'> <html> <head> <meta charset='windows-1251'> <title>cartilage</title> <HTA:APPLICATION ICON='msiexec.exe' SINGLEINSTANCE='yes' SysMenu="no"> <script language='JScript'> window.moveTo(50, 50); window.resizeTo(screen.width - 100, screen.height - 100); </script> <style type='text/css'> body { font: 15px Tahoma, sans-serif; margin: 10px; line-height: 25px; background: #C6B5C4; } img { display:inline-block; } .bold { font-weight: bold; } .mark { background: #B5CC8E; padding: 2px 5px; } .header { text-align: center; font-size: 30px; line-height: 50px; font-weight: bold; margin-bottom:20px; } .info { background: #e6ecf2; border-left: 10px solid #B58CB2; } .alert { background: #FFE4E4; border-left: 10px solid #FFA07A; } .private { border: 1px dashed #000; background: #FFFFEF; } .note { height: auto; padding-bottom: 1px; margin: 15px 0; } .note .title { font-weight: bold; text-indent: 10px; height: 30px; line-height: 30px; padding-top: 10px; } .note .mark { background: #A2A2B5; } .note ul { margin-top: 0; } .note pre { margin-left: 15px; line-height: 13px; font-size: 13px; } .footer { position:fixed; bottom:0; right:0; text-align: right; } </style> </head> <body> <div class='header'> <img src='data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAEAAAABACAQAAAAAYLlVAAAABGdBTUEAALGPC/xhBQAAACBjSFJNAAB6JQAAgIMAAPn/AACA6QAAdTAAAOpgAAA6mAAAF2+SX8VGAAAAAmJLR0QA/4ePzL8AAAAJcEhZcwAACxMAAAsTAQCanBgAAAAHdElNRQfjAwwMJwSFwIn8AAADNklEQVRo3u2ZTUhUURTHfzozmprmZ1pYEmkfJNEmiwwkSEyFECIQpEUboYhqFYHQXlcti9rUKldWBEUiuQpbtDDNzD5G8qM0HRXLRtO5LdJx3puPd++8+xyIztm88zgf/3veufeee18SdimDI1RxnL0U4gbAzxhDdPGCfpZs+49JWTTyFB8iAq8wTju1pDgXvopOliIGX+d57rHPieBuLvLNIvgaD1KvP/x1FiTDCwQTNOkFcJVfCuEFgq+c0he+minF8AJBH2WRnCUph8/nIZVhb2d5w1smEbjYSTn7SQ/TucsFlnWkPxBW6Xc4RkbIoHKooSNshsxRbT98Eb0mtyM04oqgmR6hUNvtrwrnWDa4nOVMVF0XLfw2aPuosBfezQPTmNpiVtFmnpj0W+wBKMFrcPeJ3RYWNfwwWHSSZgdAHX6Du5uWFpl0myqm1KiQrASgnNQQaZFOS4t5nhvkAnbZAbDHIE0wIGHzmsUQKdXkQwlACtsN8ijfJay8zBjkovgBbCLPlAG/hNUcswa5IH4Ayasdzxr5pBbWRRYMstGHYg04QAkH4FbQFSwTCKbdI7mzWVipbMceKtiCCFqO0OeY1caRbAaKOcgOCpQ+WWTyM8EwvfjkTfJoYZDFONqwaPyTHs7LbktlPNMYep2XuE22dfhsHjkS/i+3Wn/SK2EdoE72UeuyGH8rxbbLLjqlkRlb4TAzDo5fIJiOvRTnR+ju9VJuwveC/wASDsD+2h5KUyyQTVZiALzjFt3MsY16mtmqx2mt9BbUw4EQuzpGpVcCLQB8nDBZXmJFDoCeInzFS9ObxwzLmeoBMGA4/QBM4t1IAOHXDi7Zqwg9ACrCWotS8xnQWQCHOGsafzOFOhzLT8NxmoI3RZncULjG1ARA8DHYupxUucbUtxd4ghnw4JI30wdARHneMABx0j8FYD3xCkdefQByKFl9KsOjy6nKNBR0cZRCTjOk1JhrBCCY5r3pZtSS9bZkueSqmljVgPoPDa0Algk4HD8QG8AXph0G8Dk2AC89DgPosFKodvR83G/dtiRzTevtUChP0SCTpBQuM+bI6Bvk51gl96X/FFvzCh9oW0v+H2zO2tYtz/EgAAAAJXRFWHRkYXRlOmNyZWF0ZQAyMDE5LTAzLTEyVDEyOjM5OjA0KzAwOjAwG6lIYwAAACV0RVh0ZGF0ZTptb2RpZnkAMjAxOS0wMy0xMlQxMjozOTowNCswMDowMGr08N8AAAAASUVORK5CYII='> <div>All your files have been encrypted!</div> </div> <div class='bold'>All your files have been encrypted due to a security problem with your PC.</div> <div class='bold'>If you want to restore them, write us to the e-mail <span class='mark'>[email protected]</span></div> <div class='bold'>Or write us to the Tox: <span class='mark'>78E21CFF7AA85F713C1530AEF2E74E62830BEE77238F4B0A73E5E3251EAD56427BF9F7A1A074</span></div> <div class='bold'>Write this ID in the title of your message <span class='mark'>DDAC2ADD-3483</span></div> <div> You have to pay for decryption in Bitcoins. The price depends on how fast you write to us. After payment we will send you the tool that will decrypt all your files. </div> <div class='note info'> <div class='title'>Free decryption as guarantee</div> <ul>Before paying you can send us up to 3 files for free decryption. The total size of files must be less than 4Mb (non archived), and files should not contain valuable information. (databases,backups, large excel sheets, etc.) </ul> </div> <div class='note info'> <div class='title'>How to obtain Bitcoins</div> <ul> The easiest way to buy bitcoins is LocalBitcoins site. You have to register, click 'Buy bitcoins', and select the seller by payment method and price. <br><a href='https://localbitcoins.com/buy_bitcoins'>https://localbitcoins.com/buy_bitcoins</a> <br> Also you can find other places to buy Bitcoins and beginners guide here: <br><a href='http://www.coindesk.com/information/how-can-i-buy-bitcoins/'>http://www.coindesk.com/information/how-can-i-buy-bitcoins/</a> </ul> </div> <div class='note alert'> <div class='title'>Attention!</div> <ul> <li>Do not rename encrypted files.</li> <li>Do not try to decrypt your data using third party software, it may cause permanent data loss.</li> <li>Decryption of your files with the help of third parties may cause increased price (they add their fee to our) or you can become a victim of a scam.</li> </ul> </div> </body> </html>
Emails

class='mark'>[email protected]</span></div>

URLs

http://www.w3.org/TR/html4/strict.dtd'>

Signatures

  • Phobos

    Phobos ransomware appeared at the beginning of 2019.

  • Deletes shadow copies 3 TTPs

    Ransomware often targets backup files to inhibit system recovery.

  • Modifies boot configuration data using bcdedit 1 TTPs 4 IoCs
  • Renames multiple (514) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

  • Deletes backup catalog 3 TTPs 2 IoCs

    Uses wbadmin.exe to inhibit system recovery.

  • Modifies Windows Firewall 2 TTPs 2 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Credentials from Password Stores: Windows Credential Manager 1 TTPs

    Suspicious access to Credentials History.

  • Drops startup file 3 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Adds Run key to start application 2 TTPs 2 IoCs
  • Drops desktop.ini file(s) 64 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Event Triggered Execution: Netsh Helper DLL 1 TTPs 6 IoCs

    Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

  • System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Checks SCSI registry key(s) 3 TTPs 4 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Interacts with shadow copies 3 TTPs 2 IoCs

    Shadow copies are often targeted by ransomware to inhibit system recovery.

  • Modifies registry class 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 62 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

Processes

  • C:\Users\Admin\AppData\Local\Temp\91abe280381d0faf55b521f51d16d8aa022f0cc14b1310334d4fffc3474459d4.exe
    "C:\Users\Admin\AppData\Local\Temp\91abe280381d0faf55b521f51d16d8aa022f0cc14b1310334d4fffc3474459d4.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • System Location Discovery: System Language Discovery
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:3420
    • C:\Users\Admin\AppData\Local\Temp\91abe280381d0faf55b521f51d16d8aa022f0cc14b1310334d4fffc3474459d4.exe
      C:\Users\Admin\AppData\Local\Temp\91abe280381d0faf55b521f51d16d8aa022f0cc14b1310334d4fffc3474459d4.exe
      2⤵
      • Checks computer location settings
      • Drops startup file
      • Adds Run key to start application
      • Drops desktop.ini file(s)
      • Drops file in Program Files directory
      • System Location Discovery: System Language Discovery
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:2784
      • C:\Users\Admin\AppData\Local\Temp\91abe280381d0faf55b521f51d16d8aa022f0cc14b1310334d4fffc3474459d4.exe
        "C:\Users\Admin\AppData\Local\Temp\91abe280381d0faf55b521f51d16d8aa022f0cc14b1310334d4fffc3474459d4.exe"
        3⤵
        • Suspicious use of SetThreadContext
        • System Location Discovery: System Language Discovery
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:264
        • C:\Users\Admin\AppData\Local\Temp\91abe280381d0faf55b521f51d16d8aa022f0cc14b1310334d4fffc3474459d4.exe
          C:\Users\Admin\AppData\Local\Temp\91abe280381d0faf55b521f51d16d8aa022f0cc14b1310334d4fffc3474459d4.exe
          4⤵
            PID:4120
        • C:\Windows\system32\cmd.exe
          "C:\Windows\system32\cmd.exe"
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:2520
          • C:\Windows\system32\vssadmin.exe
            vssadmin delete shadows /all /quiet
            4⤵
            • Interacts with shadow copies
            PID:232
          • C:\Windows\System32\Wbem\WMIC.exe
            wmic shadowcopy delete
            4⤵
            • Suspicious use of AdjustPrivilegeToken
            PID:1480
          • C:\Windows\system32\bcdedit.exe
            bcdedit /set {default} bootstatuspolicy ignoreallfailures
            4⤵
            • Modifies boot configuration data using bcdedit
            PID:3748
          • C:\Windows\system32\bcdedit.exe
            bcdedit /set {default} recoveryenabled no
            4⤵
            • Modifies boot configuration data using bcdedit
            PID:1880
          • C:\Windows\system32\wbadmin.exe
            wbadmin delete catalog -quiet
            4⤵
            • Deletes backup catalog
            PID:1892
        • C:\Windows\system32\cmd.exe
          "C:\Windows\system32\cmd.exe"
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:4536
          • C:\Windows\system32\netsh.exe
            netsh advfirewall set currentprofile state off
            4⤵
            • Modifies Windows Firewall
            • Event Triggered Execution: Netsh Helper DLL
            PID:5060
          • C:\Windows\system32\netsh.exe
            netsh firewall set opmode mode=disable
            4⤵
            • Modifies Windows Firewall
            • Event Triggered Execution: Netsh Helper DLL
            PID:1656
        • C:\Windows\SysWOW64\mshta.exe
          "C:\Windows\SysWOW64\mshta.exe" "C:\Users\Admin\Desktop\info.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}
          3⤵
          • System Location Discovery: System Language Discovery
          PID:2848
        • C:\Windows\SysWOW64\mshta.exe
          "C:\Windows\SysWOW64\mshta.exe" "C:\users\public\desktop\info.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}
          3⤵
          • System Location Discovery: System Language Discovery
          PID:4600
        • C:\Windows\SysWOW64\mshta.exe
          "C:\Windows\SysWOW64\mshta.exe" "C:\info.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}
          3⤵
          • System Location Discovery: System Language Discovery
          PID:4108
        • C:\Windows\SysWOW64\mshta.exe
          "C:\Windows\SysWOW64\mshta.exe" "F:\info.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}
          3⤵
          • System Location Discovery: System Language Discovery
          PID:3804
        • C:\Windows\system32\cmd.exe
          "C:\Windows\system32\cmd.exe"
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:2276
          • C:\Windows\system32\vssadmin.exe
            vssadmin delete shadows /all /quiet
            4⤵
            • Interacts with shadow copies
            PID:3244
          • C:\Windows\System32\Wbem\WMIC.exe
            wmic shadowcopy delete
            4⤵
            • Suspicious use of AdjustPrivilegeToken
            PID:2100
          • C:\Windows\system32\bcdedit.exe
            bcdedit /set {default} bootstatuspolicy ignoreallfailures
            4⤵
            • Modifies boot configuration data using bcdedit
            PID:4324
          • C:\Windows\system32\bcdedit.exe
            bcdedit /set {default} recoveryenabled no
            4⤵
            • Modifies boot configuration data using bcdedit
            PID:2740
          • C:\Windows\system32\wbadmin.exe
            wbadmin delete catalog -quiet
            4⤵
            • Deletes backup catalog
            PID:1824
    • C:\Windows\system32\vssvc.exe
      C:\Windows\system32\vssvc.exe
      1⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:3464
    • C:\Windows\system32\wbengine.exe
      "C:\Windows\system32\wbengine.exe"
      1⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:284
    • C:\Windows\System32\vdsldr.exe
      C:\Windows\System32\vdsldr.exe -Embedding
      1⤵
        PID:2140
      • C:\Windows\System32\vds.exe
        C:\Windows\System32\vds.exe
        1⤵
        • Checks SCSI registry key(s)
        PID:4988

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Program Files\Common Files\microsoft shared\ClickToRun\C2R32.dll.id[DDAC2ADD-3483].[[email protected]].8base

        Filesize

        2.7MB

        MD5

        d5bca6c2a1603edb44d29ce87a4784d0

        SHA1

        02413b7028577da599a51ab36e610f0d8dc491d9

        SHA256

        65c7755bc71e66fb1b7f114adcf75c5ab0f7b97e76afa6f56998338c77322217

        SHA512

        017bc6e853f9f80d449974bc839856b64c092ffaadbcdffe9b83ff2c7d2e3ebcb5ec47d2174e0e5792fd67daeb9287c7915c2da1065e4735ae6b272b950e1680

      • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\91abe280381d0faf55b521f51d16d8aa022f0cc14b1310334d4fffc3474459d4.exe.log

        Filesize

        1016B

        MD5

        4353288293ab8929e492327245a7ccb2

        SHA1

        89b365f2f5e14faaf17715e5764b60d344250d67

        SHA256

        61954fc5184dd88a959f803ee98ca9af53eb0c942dbb00b98ba4f8a46081b587

        SHA512

        48c07ca1b769cf02af6ec938aad8b5a03133e82a451bdff5a03bf4ba47cfd7add0ab28ee6622c22fb54e127472a7cf68dd7d05da15ec439cc18aed2ca76cd08a

      • C:\info.hta

        Filesize

        5KB

        MD5

        56086e376017559aecdc778c3db1632e

        SHA1

        ac92b32290e5000215114009bd18c7461edf8086

        SHA256

        7c9980b669b4ed48e1183df89211fb220f23c00669845f5399d1bd5ab9fab952

        SHA512

        b2d4f9d8a8bb35c9c572efa7ec5d66171bae37cc76e4b2812b4d273eb29d3c0d13cb5af7ee85745ac89a75e2f566fb44294982287dfd14e6a1e36a9c6aaf757d

      • memory/264-17-0x00000000748DE000-0x00000000748DF000-memory.dmp

        Filesize

        4KB

      • memory/264-23-0x00000000748D0000-0x0000000075080000-memory.dmp

        Filesize

        7.7MB

      • memory/264-18-0x00000000748D0000-0x0000000075080000-memory.dmp

        Filesize

        7.7MB

      • memory/2784-34-0x0000000000400000-0x0000000000413000-memory.dmp

        Filesize

        76KB

      • memory/2784-166-0x0000000000400000-0x0000000000413000-memory.dmp

        Filesize

        76KB

      • memory/2784-12620-0x0000000000400000-0x0000000000413000-memory.dmp

        Filesize

        76KB

      • memory/2784-1920-0x0000000000400000-0x0000000000413000-memory.dmp

        Filesize

        76KB

      • memory/2784-10-0x0000000000400000-0x0000000000413000-memory.dmp

        Filesize

        76KB

      • memory/2784-13-0x0000000000400000-0x0000000000413000-memory.dmp

        Filesize

        76KB

      • memory/2784-14-0x0000000000400000-0x0000000000413000-memory.dmp

        Filesize

        76KB

      • memory/2784-1846-0x0000000000400000-0x0000000000413000-memory.dmp

        Filesize

        76KB

      • memory/2784-1857-0x0000000000400000-0x0000000000413000-memory.dmp

        Filesize

        76KB

      • memory/2784-1851-0x0000000000400000-0x0000000000413000-memory.dmp

        Filesize

        76KB

      • memory/2784-1429-0x0000000000400000-0x0000000000413000-memory.dmp

        Filesize

        76KB

      • memory/2784-1244-0x0000000000400000-0x0000000000413000-memory.dmp

        Filesize

        76KB

      • memory/2784-161-0x0000000000400000-0x0000000000413000-memory.dmp

        Filesize

        76KB

      • memory/2784-35-0x0000000000400000-0x0000000000413000-memory.dmp

        Filesize

        76KB

      • memory/2784-164-0x0000000000400000-0x0000000000413000-memory.dmp

        Filesize

        76KB

      • memory/2784-39-0x0000000000400000-0x0000000000413000-memory.dmp

        Filesize

        76KB

      • memory/2784-38-0x0000000000400000-0x0000000000413000-memory.dmp

        Filesize

        76KB

      • memory/2784-37-0x0000000000400000-0x0000000000413000-memory.dmp

        Filesize

        76KB

      • memory/2784-36-0x0000000000400000-0x0000000000413000-memory.dmp

        Filesize

        76KB

      • memory/2784-171-0x0000000000400000-0x0000000000413000-memory.dmp

        Filesize

        76KB

      • memory/2784-183-0x0000000000400000-0x0000000000413000-memory.dmp

        Filesize

        76KB

      • memory/2784-196-0x0000000000400000-0x0000000000413000-memory.dmp

        Filesize

        76KB

      • memory/2784-203-0x0000000000400000-0x0000000000413000-memory.dmp

        Filesize

        76KB

      • memory/2784-194-0x0000000000400000-0x0000000000413000-memory.dmp

        Filesize

        76KB

      • memory/3420-2-0x0000000004CD0000-0x0000000004D62000-memory.dmp

        Filesize

        584KB

      • memory/3420-7-0x0000000005070000-0x00000000050A4000-memory.dmp

        Filesize

        208KB

      • memory/3420-0-0x000000007483E000-0x000000007483F000-memory.dmp

        Filesize

        4KB

      • memory/3420-3-0x0000000074830000-0x0000000074FE0000-memory.dmp

        Filesize

        7.7MB

      • memory/3420-4-0x0000000004DD0000-0x0000000004EFC000-memory.dmp

        Filesize

        1.2MB

      • memory/3420-5-0x00000000052B0000-0x00000000052FE000-memory.dmp

        Filesize

        312KB

      • memory/3420-6-0x0000000005030000-0x0000000005066000-memory.dmp

        Filesize

        216KB

      • memory/3420-15-0x0000000074830000-0x0000000074FE0000-memory.dmp

        Filesize

        7.7MB

      • memory/3420-9-0x00000000058C0000-0x0000000005E64000-memory.dmp

        Filesize

        5.6MB

      • memory/3420-8-0x00000000050D0000-0x000000000511C000-memory.dmp

        Filesize

        304KB

      • memory/3420-1-0x0000000000140000-0x0000000000302000-memory.dmp

        Filesize

        1.8MB

      • memory/4120-22-0x0000000000400000-0x0000000000413000-memory.dmp

        Filesize

        76KB