aa99c913decb96133a013abe8d71a057862e3328e8297c959c8eeb063c283a66

General

Target

aa99c913decb96133a013abe8d71a057862e3328e8297c959c8eeb063c283a66.exe
Size

16KB
MD5

c9fc5ead99455414732c85614c676afa
SHA1

99ae4a704b37bd1c3f190f99b52493f68bcbe3df
SHA256

aa99c913decb96133a013abe8d71a057862e3328e8297c959c8eeb063c283a66
SHA512

45ffeb541e4124939243a61b982ff11ece9ae8d8171148d354a346766f95f22e85e4504dcb705ac83bbc96ce1d8567c294c5c5f6bdeb01c251dd51328ec89e72
SSDEEP

384:5iNZKe9HBSEbVfBD6LeGzauQibQzisfIIG42RzRTK9oXjfdrMEn+eSkjvka95WVB:g3Ke9HBSEbVdUeGzBQoJKua6dsr

Score

10^/10

discovery ransomware

Malware Config

Extracted

Path

C:\README.txt

Ransom Note

!!! ALL YOUR FILES ARE ENCRYPTED!!! All your files, documents, photos, databases and other important files are encrypted. The only way to recover your files is to get a decryptor. To get the decryptor, write to us by mail or telegram, specify the ID of the encrypted files in the letter: Email: [email protected] Telegram: https://t.me/returnbackcyberfearcom Warning!!! * Do not rename files. * Do not attempt to decrypt data using third party software, as this may result in permanent data loss. * Do not contact other people, only we can help you and recover your data. Your personal decryption ID: lGiKf865

Emails

[email protected]

URLs

https://t.me/returnbackcyberfearcom

Signatures

Renames multiple (190) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops desktop.ini file(s) 25 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Searches\desktop.ini	aa99c913decb96133a013abe8d71a057862e3328e8297c959c8eeb063c283a66.exe
File opened for modification	C:\Users\Admin\Pictures\Saved Pictures\desktop.ini	aa99c913decb96133a013abe8d71a057862e3328e8297c959c8eeb063c283a66.exe
File opened for modification	C:\Users\Admin\Favorites\desktop.ini	aa99c913decb96133a013abe8d71a057862e3328e8297c959c8eeb063c283a66.exe
File opened for modification	C:\Users\Admin\Downloads\desktop.ini	aa99c913decb96133a013abe8d71a057862e3328e8297c959c8eeb063c283a66.exe
File opened for modification	C:\Users\Public\desktop.ini	aa99c913decb96133a013abe8d71a057862e3328e8297c959c8eeb063c283a66.exe
File opened for modification	C:\Users\Public\Documents\desktop.ini	aa99c913decb96133a013abe8d71a057862e3328e8297c959c8eeb063c283a66.exe
File opened for modification	C:\Users\Public\AccountPictures\desktop.ini	aa99c913decb96133a013abe8d71a057862e3328e8297c959c8eeb063c283a66.exe
File opened for modification	C:\Users\Admin\Saved Games\desktop.ini	aa99c913decb96133a013abe8d71a057862e3328e8297c959c8eeb063c283a66.exe
File opened for modification	C:\Users\Admin\Pictures\desktop.ini	aa99c913decb96133a013abe8d71a057862e3328e8297c959c8eeb063c283a66.exe
File opened for modification	C:\Users\Admin\Music\desktop.ini	aa99c913decb96133a013abe8d71a057862e3328e8297c959c8eeb063c283a66.exe
File opened for modification	C:\Users\Admin\3D Objects\desktop.ini	aa99c913decb96133a013abe8d71a057862e3328e8297c959c8eeb063c283a66.exe
File opened for modification	C:\Users\Public\Videos\desktop.ini	aa99c913decb96133a013abe8d71a057862e3328e8297c959c8eeb063c283a66.exe
File opened for modification	C:\Users\Public\Libraries\desktop.ini	aa99c913decb96133a013abe8d71a057862e3328e8297c959c8eeb063c283a66.exe
File opened for modification	C:\Users\Public\Downloads\desktop.ini	aa99c913decb96133a013abe8d71a057862e3328e8297c959c8eeb063c283a66.exe
File opened for modification	C:\Users\Public\Desktop\desktop.ini	aa99c913decb96133a013abe8d71a057862e3328e8297c959c8eeb063c283a66.exe
File opened for modification	C:\Users\Admin\Pictures\Camera Roll\desktop.ini	aa99c913decb96133a013abe8d71a057862e3328e8297c959c8eeb063c283a66.exe
File opened for modification	C:\Users\Admin\OneDrive\desktop.ini	aa99c913decb96133a013abe8d71a057862e3328e8297c959c8eeb063c283a66.exe
File opened for modification	C:\Users\Admin\Documents\desktop.ini	aa99c913decb96133a013abe8d71a057862e3328e8297c959c8eeb063c283a66.exe
File opened for modification	C:\Users\Public\Pictures\desktop.ini	aa99c913decb96133a013abe8d71a057862e3328e8297c959c8eeb063c283a66.exe
File opened for modification	C:\Users\Public\Music\desktop.ini	aa99c913decb96133a013abe8d71a057862e3328e8297c959c8eeb063c283a66.exe
File opened for modification	C:\Users\Admin\Videos\desktop.ini	aa99c913decb96133a013abe8d71a057862e3328e8297c959c8eeb063c283a66.exe
File opened for modification	C:\Users\Admin\Links\desktop.ini	aa99c913decb96133a013abe8d71a057862e3328e8297c959c8eeb063c283a66.exe
File opened for modification	C:\Users\Admin\Favorites\Links\desktop.ini	aa99c913decb96133a013abe8d71a057862e3328e8297c959c8eeb063c283a66.exe
File opened for modification	C:\Users\Admin\Desktop\desktop.ini	aa99c913decb96133a013abe8d71a057862e3328e8297c959c8eeb063c283a66.exe
File opened for modification	C:\Users\Admin\Contacts\desktop.ini	aa99c913decb96133a013abe8d71a057862e3328e8297c959c8eeb063c283a66.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	aa99c913decb96133a013abe8d71a057862e3328e8297c959c8eeb063c283a66.exe

C:\Users\Admin\AppData\Local\Temp\aa99c913decb96133a013abe8d71a057862e3328e8297c959c8eeb063c283a66.exe
"C:\Users\Admin\AppData\Local\Temp\aa99c913decb96133a013abe8d71a057862e3328e8297c959c8eeb063c283a66.exe"
1⤵
- Drops desktop.ini file(s)
- System Location Discovery: System Language Discovery
PID:2928

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Microsoft\SmsRouter\MessageStore\edbres00002.jrs

Filesize
64KB

MD5
379d6bad007316cf807ac3c5bc7b1145

SHA1
6cc4f921978a7981ca6b7ee7d15540edeae0269c

SHA256
bf9affa0444eb8d1711ddd8a6ea9b08f0c19d8d5d667b81bb1dfb4eec58c64ab

SHA512
a9e8bb57e91f5943f48da2719e4e7a4bdef6daba9f6e17cf0ecf73c877fa371076d071070597fea95ee21ccc8b26ec170c615a18c0569ad9e47618a52fff9a6b

Download Submit
C:\ProgramData\Package Cache\{7447A794-FA2E-42BE-BA9A-5FCBD54C5DF3}v48.108.8828\dotnet-hostfxr-6.0.27-win-x64.msi

Filesize
804KB

MD5
3311e8d636121c155902d38fc99e128a

SHA1
688df6a210282bda8ae7f8ad22d9928da76e9727

SHA256
0a18a1a15ba8351dc451ffb820fe8dd51572bb72b0dd60118c1d71f95ccd9871

SHA512
426eb689f67bf739ea0086c80e31a2c1f1147c5f5952e02fce2e120b0d3438467f95426a22492895e837b0da3972c32ec36d40a9195f5372fdf7369bac4daa82

Download Submit
C:\ProgramData\Package Cache\{79043ED0-7ED1-4227-A5E5-04C5594D21F7}v48.108.8828\dotnet-runtime-6.0.27-win-x64.msi

Filesize
25.7MB

MD5
e23b59eb72f034d1e3e4ec3e73bf63a9

SHA1
3c54082f61ff159d7c83280cc04863da996aeee6

SHA256
f7d736e38dc58b9dd2a5af766415263b7a65cc70efebc3c26e43ab1e7c7edcc0

SHA512
928611efe25f226b77981e53a519ddcb0f26338631e650e6d25d81fa311b1a38d1a7c49004338f681c737094adc87ae183e9492d040a29e9a58e4fc1b32ef207

Download Submit
C:\ProgramData\Package Cache\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\packages\vcRuntimeMinimum_amd64\vc_runtimeMinimum_x64.msi

Filesize
148KB

MD5
b98059b4d884f2df2b320a5a105834bb

SHA1
5d65f1a7fd7d39c46c78efd645f5ce60cdd02124

SHA256
5aaaaa39919a6ecfa8c95a73693cd2324fd96fc41010e703e5e582e3566ff75e

SHA512
9034018bd82942d39fdeaf6e7e107ef7cda2a7420ab5175bf0f8d35b7f5943d7508ee4ece0bb08fbc03d72dfebccf7a186634dd11bca8ceda40bc124b0ec543f

Download Submit
C:\README.txt

Filesize
632B

MD5
e5947abbf99045df634eede07180fa46

SHA1
b3506e3118715199707ac9a62557fcb4512719ac

SHA256
98611e811a96098298daa934d52960ce9f716a36ae3fdfc316b2b75ae2b54830

SHA512
e8fe24857094c4f07dfd584120be204f41cf057e3cf3bd5ade2c5f7cc88bfaddba0f4d5d26a6d2e201894a0c284ba64393f68216556f48a4014a98be90b9a49c

Download Submit
memory/2928-0-0x0000000074DAE000-0x0000000074DAF000-memory.dmp

Filesize
4KB

Download
memory/2928-1-0x0000000000E70000-0x0000000000E7A000-memory.dmp

Filesize
40KB

Download
memory/2928-34-0x0000000074DA0000-0x0000000075550000-memory.dmp

Filesize
7.7MB

Download
memory/2928-1362-0x0000000074DA0000-0x0000000075550000-memory.dmp

Filesize
7.7MB

Download

Analysis

Sharing