Overview
overview
10Static
static
3main.exe
windows7-x64
1main.exe
windows10-2004-x64
1ransom.exe
windows7-x64
10ransom.exe
windows10-2004-x64
10key_gen/main.exe
windows7-x64
1key_gen/main.exe
windows10-2004-x64
1key_gen/ransom.exe
windows7-x64
9key_gen/ransom.exe
windows10-2004-x64
9ransom/Rel...om.exe
windows7-x64
6ransom/Rel...om.exe
windows10-2004-x64
6ransom/ran...ts.vbs
windows7-x64
1ransom/ran...ts.vbs
windows10-2004-x64
1ransom/ran...hic.js
windows7-x64
3ransom/ran...hic.js
windows10-2004-x64
3ransom/ran...som.js
windows7-x64
3ransom/ran...som.js
windows10-2004-x64
3Analysis
- max time kernel
150s - max time network
121s - platform
windows7_x64 - resource
win7-20241023-en - resource tags
arch:x64arch:x86image:win7-20241023-enlocale:en-usos:windows7-x64system - submitted
06/11/2024, 02:31
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
main.exe
Resource
win7-20241010-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral2
Sample
main.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral3
Sample
ransom.exe
Resource
win7-20241023-en
windows7-x64
9 signatures
150 seconds
Behavioral task
behavioral4
Sample
ransom.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
9 signatures
150 seconds
Behavioral task
behavioral5
Sample
key_gen/main.exe
Resource
win7-20241010-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral6
Sample
key_gen/main.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral7
Sample
key_gen/ransom.exe
Resource
win7-20241010-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral8
Sample
key_gen/ransom.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
8 signatures
150 seconds
Behavioral task
behavioral9
Sample
ransom/Release/ransom.exe
Resource
win7-20240903-en
windows7-x64
6 signatures
150 seconds
Behavioral task
behavioral10
Sample
ransom/Release/ransom.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
6 signatures
150 seconds
Behavioral task
behavioral11
Sample
ransom/ransom/Crypto/RSA/bigdigits.vbs
Resource
win7-20241023-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral12
Sample
ransom/ransom/Crypto/RSA/bigdigits.vbs
Resource
win10v2004-20241007-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral13
Sample
ransom/ransom/Cryptographic.js
Resource
win7-20240708-en
windows7-x64
1 signatures
150 seconds
Behavioral task
behavioral14
Sample
ransom/ransom/Cryptographic.js
Resource
win10v2004-20241007-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral15
Sample
ransom/ransom/ransom.js
Resource
win7-20240903-en
windows7-x64
1 signatures
150 seconds
Behavioral task
behavioral16
Sample
ransom/ransom/ransom.js
Resource
win10v2004-20241007-en
windows10-2004-x64
1 signatures
150 seconds
General
- Target ransom.exe
- Size 7.8MB
- Sample241106-cztrbstepk
- SHA256 102276ae1f518745695fe8f291bf6e69856b91723244881561bb1a2338d54b12
- MD5 648bd793d9e54fc2741e0ba10980c7de
- SHA1 f5d0c94b2be91342dc01ecf2f89e7e6f21a74b90
- SHA512 d1428b934a360d7f3651947d11081892c93c7cd29a17dc38190cbb46c95939928ac6f805adf586be2937e27fc20aec8bd1fc2c782c681e7e94e9e8d33b8ebf15
- SSDEEP 98304:9+v9K8MgmB4oIWcCJ3ZZVL8oYi5lTkZkmla1DXL:S4uWcCT9Gzl
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Extracted
Path
-
C:\Users\Admin\AppData\Local\Adobe\Acrobat\9.0\CyberVolk_ReadMe.txt
Ransom Note
- Greetings. All your files have been encrypted by CyberVolk ransomware. Please never try to recover your files without decryption key which I give you after pay. They could be disappeared� You should follow my words. Pay $1000 BTC to below address. My telegram : @hacker7 Our Team : https://t.me/cubervolk We always welcome you and your payment.
URLs
-
https://t.me/cubervolk
Signatures
- Renames multiple (922) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
- Credentials from Password Stores: Windows Credential Manager 1 TTPs
Suspicious access to Credentials History.
- Drops startup file 6 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\CyberVolk_ReadMe.txt ransom.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\CyberVolk_ReadMe.txt ransom.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\CyberVolk_ReadMe.txt ransom.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini ransom.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini.cvenc ransom.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\CyberVolk_ReadMe.txt ransom.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Drops desktop.ini file(s) 64 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\desktop.ini ransom.exe File opened for modification C:\Users\Admin\Desktop\desktop.ini ransom.exe File opened for modification C:\Users\Admin\Favorites\Links\desktop.ini ransom.exe File opened for modification \??\f:\$RECYCLE.BIN\S-1-5-21-1163522206-1469769407-485553996-1000\desktop.ini ransom.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini ransom.exe File opened for modification C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini ransom.exe File opened for modification C:\Users\All Users\Microsoft\Windows\Start Menu\desktop.ini ransom.exe File opened for modification C:\Users\Public\Recorded TV\Sample Media\desktop.ini ransom.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\DQFI3FMT\desktop.ini ransom.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\desktop.ini ransom.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Desktop.ini ransom.exe File opened for modification C:\Users\Admin\Videos\desktop.ini ransom.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini ransom.exe File opened for modification C:\Users\Public\Music\desktop.ini ransom.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\SMFN3Z3Q\desktop.ini ransom.exe File opened for modification C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Desktop.ini ransom.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini ransom.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\desktop.ini ransom.exe File opened for modification C:\Users\Admin\Downloads\desktop.ini ransom.exe File opened for modification C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini ransom.exe File opened for modification C:\Users\Admin\Documents\desktop.ini ransom.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini ransom.exe File opened for modification C:\Users\Public\Documents\desktop.ini ransom.exe File opened for modification C:\Users\Public\Recorded TV\desktop.ini ransom.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Desktop.ini ransom.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\4JFE2I4S\desktop.ini ransom.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\desktop.ini ransom.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Accessibility\Desktop.ini ransom.exe File opened for modification C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\Games\Desktop.ini ransom.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Desktop.ini ransom.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6SLTOM5C\desktop.ini ransom.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Desktop.ini ransom.exe File opened for modification C:\Users\Admin\Music\desktop.ini ransom.exe File opened for modification C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\desktop.ini ransom.exe File opened for modification C:\Users\Public\desktop.ini ransom.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\History\History.IE5\desktop.ini ransom.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini ransom.exe File opened for modification C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini ransom.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Accessibility\Desktop.ini ransom.exe File opened for modification C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\desktop.ini ransom.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\Desktop.ini ransom.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn\desktop.ini ransom.exe File opened for modification C:\Users\Admin\Favorites\desktop.ini ransom.exe File opened for modification C:\Users\Admin\Favorites\Links for United States\desktop.ini ransom.exe File opened for modification C:\Users\Admin\Links\desktop.ini ransom.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\IJMS2YBB\desktop.ini ransom.exe File opened for modification C:\Users\Admin\Contacts\desktop.ini ransom.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\desktop.ini ransom.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\JEDNWX6E\desktop.ini ransom.exe File opened for modification C:\Users\Public\Pictures\desktop.ini ransom.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini ransom.exe File opened for modification C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\Accessories\Desktop.ini ransom.exe File opened for modification C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\Accessories\Tablet PC\Desktop.ini ransom.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SendTo\Desktop.ini ransom.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini ransom.exe File opened for modification C:\Users\Admin\Pictures\desktop.ini ransom.exe File opened for modification C:\Users\Admin\Saved Games\desktop.ini ransom.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\History\desktop.ini ransom.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\3D87ST3G\desktop.ini ransom.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows Mail\Stationery\Desktop.ini ransom.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\desktop.ini ransom.exe File opened for modification C:\Users\Public\Music\Sample Music\desktop.ini ransom.exe File opened for modification C:\Users\Public\Pictures\Sample Pictures\desktop.ini ransom.exe File opened for modification C:\Users\All Users\Microsoft\Windows\Ringtones\desktop.ini ransom.exe - Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\o: ransom.exe File opened (read-only) \??\q: ransom.exe File opened (read-only) \??\u: ransom.exe File opened (read-only) \??\b: ransom.exe File opened (read-only) \??\k: ransom.exe File opened (read-only) \??\l: ransom.exe File opened (read-only) \??\m: ransom.exe File opened (read-only) \??\n: ransom.exe File opened (read-only) \??\v: ransom.exe File opened (read-only) \??\w: ransom.exe File opened (read-only) \??\y: ransom.exe File opened (read-only) \??\a: ransom.exe File opened (read-only) \??\h: ransom.exe File opened (read-only) \??\i: ransom.exe File opened (read-only) \??\r: ransom.exe File opened (read-only) \??\s: ransom.exe File opened (read-only) \??\e: ransom.exe File opened (read-only) \??\j: ransom.exe File opened (read-only) \??\t: ransom.exe File opened (read-only) \??\x: ransom.exe File opened (read-only) \??\g: ransom.exe File opened (read-only) \??\p: ransom.exe File opened (read-only) \??\z: ransom.exe - Sets desktop wallpaper using registry 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\\\tmp.bmp" ransom.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ransom.exe
Processes
Network
MITRE ATT&CK Enterprise v15
Credential Access
Credentials from Password Stores
2Credentials from Web Browsers
1Windows Credential Manager
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\ProgramData\Package Cache\{7DAD0258-515C-3DD4-8964-BD714199E0F7}v12.0.40660\packages\vcRuntimeAdditional_x86\vc_runtimeAdditional_x86.msi.cvenc
- Size 141KB
- SHA256 8ec40bc8ace02664a0eb4befbc2ced48db5037704ef77b091701da4d1797ff5e
- MD5 1e9390bad9769c0a49cd4ff1d814e7ae
- SHA1 c11c8767f22ace6279e99c33297a3510eadf92f2
- SHA512 1d6d800d1c1bba4ab60500ff081ea9da73f0ece75de56d59355badad888c737327a80bd6b02ce43078374a28f969fbcc4cd08351bcc553626c996d4ff02d75d6
- SSDEEP 3072:EyjFGJv70IcEcSq49ieCIngA9Vv5NZ2XREbbc:xpIcEgqie7UMbc
- MD5 SHA1 SHA512 SSDEEP
- Path C:\ProgramData\Package Cache\{F6080405-9FA8-4CAA-9982-14E95D1A3DAC}v14.30.30704\packages\vcRuntimeMinimum_x86\vc_runtimeMinimum_x86.msi.cvenc
- Size 181KB
- SHA256 5871cc02c93d4bcdeb29a132b909477aafa71bc408b308e4808acf176c8d1266
- MD5 555456b25900bbedff7e724a56f60f05
- SHA1 08593b7a98cbd0879ebaaa7088fe0827e2c58947
- SHA512 61301b3b16ebba0e9709d32f4a0db6030bcea7d55e3a5a681f328bca54d363c38ef3a20fbe171256c4d4880868f13199b0c5743c2a24aaf2db6099cc3effd388
- SSDEEP 3072:JAdiSpBgdxVg3zoGcKHZlGrCkFPM+BxWy2bYZRaXd0:J4iYBgkDoLcZSP/1Zs0
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Adobe\Acrobat\9.0\CyberVolk_ReadMe.txt
- Size 348B
- SHA256 894bc59f5227b4d545412b2a2897367d7ac88090c86f5a1728bf733e70bd93ee
- MD5 ce7ff0a9361571a2dcb08f50500ace3f
- SHA1 5d8bed459f55a37e2fcb801d04de337a01c5d623
- SHA512 bba6d46fae5b4099b047b192f7df21fdf01675b09f3da38a365710fc9aa5b126cc6a2c2547be48deecfaa360e1521cf04a9793af083735de4a8cb7be9bd4c52a
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB\CURRENT.cvenc
- Size 1KB
- SHA256 6eb9ef5e188e67f270b23e17bd75320e557fd80aec2a2dd0d70a36378ab32b23
- MD5 40d52685bb017e0c13ae9f998f72738f
- SHA1 ac73f90a290955c076cc59a159adc8ab0664000d
- SHA512 97e74e3c97210db3b59db85f6397140c06cfc686c1c97ac64bd45e072a431bd5c0cfd6685bb49a6b98de19c96aee7ca785537e8dd9a8906052e807e1f39f8deb
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\SMFN3Z3Q\desktop.ini.cvenc
- Size 1KB
- SHA256 dbdb9d5d51ffaa5374466434e2224dffa5f239bf094030236361403b3747c358
- MD5 f9ca3641b5acc918dd1fcd3288c2f86b
- SHA1 8e90e84d157e5ffcef2b7df9805205cf5d5c6d16
- SHA512 ce5181b48ac34b577d9b3f0ef3082c43d6190ff441108b07d4eea6157176cc665f07b90b09964b6a87a1f1ef2d4e667843eee491e3262ff99fcfe9fe129c8016
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Feeds\Microsoft Feeds~\MSNBC News~.feed-ms.cvenc
- Size 29KB
- SHA256 6b654b133cf4369bcbda2fa1d72fa5d0f0795439aaaa9b2f5094a5ae2ecda923
- MD5 3c5c8abc8c4e7e8a1f3fbb3620b57f74
- SHA1 eec2fb8cd8acc2bfbb6c10ecf29fc3416bd6707c
- SHA512 ab9823349d7d6093cf1568cfb4049ee7c3c5a4c2d0880b47bb2e680252c30982f2d7ca4da44dc321404a57c039a750ea365a1cbbb311068b71076842e161f366
- SSDEEP 96:QyVnn/kW07rlA5QO3wh0X/DXt9f8iEcYqyMO1SPu/ZSdwNmP:QyVnn/kKOswh0X/p90fBqyH1SPAQP
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\IJMS2YBB\desktop.ini.cvenc
- Size 1KB
- SHA256 9117851a255bea5d5479f1749131088a7848efc2de40a383de66b9811c110509
- MD5 8978e21a29b00a87d9e657e77c0fb5c1
- SHA1 38c58115ea0f03d6e8a485c8aedb757f8ad8d004
- SHA512 bdd7cde0d91937c424128e5f33f9c50d9f325bb954a7281d3e6c80c64ef5386a1a9bed33ea3f2f57e84df8e90e67ddd0a245c944a4111e97a8344f20a666f383
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\z3l10m6w.default-release\storage\permanent\chrome\idb\3561288849sdhlie.sqlite.cvenc
- Size 49KB
- SHA256 568da66a54cb4e4e6c3dfb17f88f9114f5fe1c0641ac57a59af815c51ad924f2
- MD5 511b935a702cebc715b2a12f24633105
- SHA1 d857ec3aaa65aba41e8be52788045f5f6000058c
- SHA512 7a2f5e9d12537faccc4a3e5215fcfc69feb8536a358dd18bffd306d5b1ce14248a7630ac49217ad3d1ec3282303a7209eff688638e48606356eace4cc0c3562c
- SSDEEP 192:DlrlzVlN6CdFAWAJldHG6zz/K/KJ2xL4i:Lpz6CrAWABHGeDKCFi
- MD5 SHA1 SHA512 SSDEEP