Analysis
-
max time kernel
1563s -
max time network
1564s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
11-11-2024 07:17
General
-
Target
2016-09-29-EITest-Rig-EK-payload-1st-run-CryptFile2.exe
-
Size
87KB
-
MD5
bf39f469e4af87274c2b97134fabdc93
-
SHA1
bbc7b5877148271a572ef3899de7be51a7c1cd6a
-
SHA256
269253135ed7108a0981a821dcbd41b5f3037e2f55bba790dba5955287344efd
-
SHA512
e6c7adb007fd75701b0f832ff8e81649dc3e20ebece4d5e614b35a0ef5e50cd5c041ddf9ec36e128513c35947c23399103b1833d4ab349c0baa79d705a91f27e
-
SSDEEP
1536:o04ryQiYjoJTPUA5tZUz7ubezM9XOzn0QEor9/tQS6XKRyp:d8A5t+7uyN70QEoJVMr
Score
10/10
Malware Config
Extracted
Path
C:\PerfLogs\HELP_DECRYPT_YOUR_FILES.TXT
Ransom Note
NOT YOUR LANGUAGE? USE https://translate.google.com
What happened to your files ?
All of your files were protected by a strong encryption with RSA-2048.
More information about the encryption keys using RSA-2048 can be found here:-> http://en.wikipedia.org/wiki/RSA_(cryptosystem)
How did this happen ?
!!! Specially for your PC was generated personal RSA-2048 KEY, both public and private.
!!! ALL YOUR FILES were encrypted with the public key, which has been transferred to your computer via the Internet.
!!! Decrypting of your files is only possible with the help of the private key and decrypt program , which is on our Secret Server
What do I do ?
So, there are two ways you can choose: wait for a miracle and get your price doubled, or start send email now for more specific instructions! , and restore your data easy way.
If You have really valuable data, you better not waste your time, because there is no other way to get your files, except make a payment.
For more specific instructions:
Contact us by email only, send us an email along with your ID number and wait for further instructions. Our specialist will contact you within 24 hours.
For you to be sure, that we can decrypt your files - you can send us a single encrypted file and we will send you back it in a decrypted form. This will be your guarantee.
Please do not waste your time! You have 72 hours only! After that The Main Server will double your price!
So right now You have a chance to buy your individual private softWare with a low price!
E-MAIL1: [email protected]
E-MAIL2: [email protected]
Spare email:
E-MAIL1: [email protected]
E-MAIL2: [email protected]
Extracted
Path
C:\PerfLogs\HELP_DECRYPT_YOUR_FILES.TXT
Ransom Note
NOT YOUR LANGUAGE? USE https://translate.google.com
What happened to your files ?
All of your files were protected by a strong encryption with RSA-2048.
More information about the encryption keys using RSA-2048 can be found here:-> http://en.wikipedia.org/wiki/RSA_(cryptosystem)
How did this happen ?
!!! Specially for your PC was generated personal RSA-2048 KEY, both public and private.
!!! ALL YOUR FILES were encrypted with the public key, which has been transferred to your computer via the Internet.
!!! Decrypting of your files is only possible with the help of the private key and decrypt program , which is on our Secret Server
What do I do ?
So, there are two ways you can choose: wait for a miracle and get your price doubled, or start send email now for more specific instructions! , and restore your data easy way.
If You have really valuable data, you better not waste your time, because there is no other way to get your files, except make a payment.
For more specific instructions:
Contact us by email only, send us an email along with your ID number and wait for further instructions. Our specialist will contact you within 24 hours.
For you to be sure, that we can decrypt your files - you can send us a single encrypted file and we will send you back it in a decrypted form. This will be your guarantee.
Please do not waste your time! You have 72 hours only! After that The Main Server will double your price!
So right now You have a chance to buy your individual private softWare with a low price!
E-MAIL1: [email protected]
E-MAIL2: [email protected]
Spare email:
E-MAIL1: [email protected]
E-MAIL2: [email protected]
YOUR_ID: 4acb86b31c9b74ea
Signatures
-
Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Adds Run key to start application 2 TTPs 4 IoCs
-
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
-
Drops file in Program Files directory 4 IoCs
-
Drops file in Windows directory 2 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Interacts with shadow copies 3 TTPs 27 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
-
Opens file in notepad (likely ransom note) 1 IoCs
-
Runs net.exe
-
Suspicious use of AdjustPrivilegeToken 46 IoCs
-
Suspicious use of WriteProcessMemory 64 IoCs
-
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\2016-09-29-EITest-Rig-EK-payload-1st-run-CryptFile2.exe"C:\Users\Admin\AppData\Local\Temp\2016-09-29-EITest-Rig-EK-payload-1st-run-CryptFile2.exe"1⤵
- Adds Run key to start application
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C vssadmin.exe Delete Shadows /All /Quiet2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\vssadmin.exevssadmin.exe Delete Shadows /All /Quiet3⤵
- Interacts with shadow copies
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C wmic shadowcopy delete2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\Wbem\WMIC.exewmic shadowcopy delete3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C vssadmin Delete Shadows /For=Z: /All /Quiet2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\vssadmin.exevssadmin Delete Shadows /For=Z: /All /Quiet3⤵
- System Location Discovery: System Language Discovery
- Interacts with shadow copies
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C vssadmin Delete Shadows /For=Y: /All /Quiet2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\vssadmin.exevssadmin Delete Shadows /For=Y: /All /Quiet3⤵
- System Location Discovery: System Language Discovery
- Interacts with shadow copies
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C vssadmin Delete Shadows /For=X: /All /Quiet2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\vssadmin.exevssadmin Delete Shadows /For=X: /All /Quiet3⤵
- System Location Discovery: System Language Discovery
- Interacts with shadow copies
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C vssadmin Delete Shadows /For=W: /All /Quiet2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\vssadmin.exevssadmin Delete Shadows /For=W: /All /Quiet3⤵
- System Location Discovery: System Language Discovery
- Interacts with shadow copies
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C vssadmin Delete Shadows /For=V: /All /Quiet2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\vssadmin.exevssadmin Delete Shadows /For=V: /All /Quiet3⤵
- System Location Discovery: System Language Discovery
- Interacts with shadow copies
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C vssadmin Delete Shadows /For=U: /All /Quiet2⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\vssadmin.exevssadmin Delete Shadows /For=U: /All /Quiet3⤵
- System Location Discovery: System Language Discovery
- Interacts with shadow copies
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C vssadmin Delete Shadows /For=T: /All /Quiet2⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\vssadmin.exevssadmin Delete Shadows /For=T: /All /Quiet3⤵
- System Location Discovery: System Language Discovery
- Interacts with shadow copies
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C vssadmin Delete Shadows /For=S: /All /Quiet2⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\vssadmin.exevssadmin Delete Shadows /For=S: /All /Quiet3⤵
- System Location Discovery: System Language Discovery
- Interacts with shadow copies
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C vssadmin Delete Shadows /For=R: /All /Quiet2⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\vssadmin.exevssadmin Delete Shadows /For=R: /All /Quiet3⤵
- System Location Discovery: System Language Discovery
- Interacts with shadow copies
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C vssadmin Delete Shadows /For=Q: /All /Quiet2⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\vssadmin.exevssadmin Delete Shadows /For=Q: /All /Quiet3⤵
- System Location Discovery: System Language Discovery
- Interacts with shadow copies
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C vssadmin Delete Shadows /For=P: /All /Quiet2⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\vssadmin.exevssadmin Delete Shadows /For=P: /All /Quiet3⤵
- System Location Discovery: System Language Discovery
- Interacts with shadow copies
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C vssadmin Delete Shadows /For=O: /All /Quiet2⤵
-
C:\Windows\SysWOW64\vssadmin.exevssadmin Delete Shadows /For=O: /All /Quiet3⤵
- System Location Discovery: System Language Discovery
- Interacts with shadow copies
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C vssadmin Delete Shadows /For=N: /All /Quiet2⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\vssadmin.exevssadmin Delete Shadows /For=N: /All /Quiet3⤵
- System Location Discovery: System Language Discovery
- Interacts with shadow copies
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C vssadmin Delete Shadows /For=M: /All /Quiet2⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\vssadmin.exevssadmin Delete Shadows /For=M: /All /Quiet3⤵
- System Location Discovery: System Language Discovery
- Interacts with shadow copies
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C vssadmin Delete Shadows /For=L: /All /Quiet2⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\vssadmin.exevssadmin Delete Shadows /For=L: /All /Quiet3⤵
- System Location Discovery: System Language Discovery
- Interacts with shadow copies
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C vssadmin Delete Shadows /For=K: /All /Quiet2⤵
-
C:\Windows\SysWOW64\vssadmin.exevssadmin Delete Shadows /For=K: /All /Quiet3⤵
- System Location Discovery: System Language Discovery
- Interacts with shadow copies
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C vssadmin Delete Shadows /For=J: /All /Quiet2⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\vssadmin.exevssadmin Delete Shadows /For=J: /All /Quiet3⤵
- System Location Discovery: System Language Discovery
- Interacts with shadow copies
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C vssadmin Delete Shadows /For=I: /All /Quiet2⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\vssadmin.exevssadmin Delete Shadows /For=I: /All /Quiet3⤵
- System Location Discovery: System Language Discovery
- Interacts with shadow copies
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C vssadmin Delete Shadows /For=H: /All /Quiet2⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\vssadmin.exevssadmin Delete Shadows /For=H: /All /Quiet3⤵
- System Location Discovery: System Language Discovery
- Interacts with shadow copies
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C vssadmin Delete Shadows /For=G: /All /Quiet2⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\vssadmin.exevssadmin Delete Shadows /For=G: /All /Quiet3⤵
- System Location Discovery: System Language Discovery
- Interacts with shadow copies
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C vssadmin Delete Shadows /For=F: /All /Quiet2⤵
-
C:\Windows\SysWOW64\vssadmin.exevssadmin Delete Shadows /For=F: /All /Quiet3⤵
- System Location Discovery: System Language Discovery
- Interacts with shadow copies
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C vssadmin Delete Shadows /For=E: /All /Quiet2⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\vssadmin.exevssadmin Delete Shadows /For=E: /All /Quiet3⤵
- System Location Discovery: System Language Discovery
- Interacts with shadow copies
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C vssadmin Delete Shadows /For=D: /All /Quiet2⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\vssadmin.exevssadmin Delete Shadows /For=D: /All /Quiet3⤵
- System Location Discovery: System Language Discovery
- Interacts with shadow copies
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C vssadmin Delete Shadows /For=C: /All /Quiet2⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\vssadmin.exevssadmin Delete Shadows /For=C: /All /Quiet3⤵
- Interacts with shadow copies
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C vssadmin Delete Shadows /For=B: /All /Quiet2⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\vssadmin.exevssadmin Delete Shadows /For=B: /All /Quiet3⤵
- System Location Discovery: System Language Discovery
- Interacts with shadow copies
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C vssadmin Delete Shadows /For=A: /All /Quiet2⤵
-
C:\Windows\SysWOW64\vssadmin.exevssadmin Delete Shadows /For=A: /All /Quiet3⤵
- System Location Discovery: System Language Discovery
- Interacts with shadow copies
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C net stop vss2⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\net.exenet stop vss3⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop vss4⤵
- System Location Discovery: System Language Discovery
-
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C bcdedit /set {default} recoveryenabled No2⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C bcdedit /set {default} bootstatuspolicy ignoreallfailures2⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" bcdedit /set {default} recoveryenabled No2⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" bcdedit /set {default} bootstatuspolicy ignoreallfailures2⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" bcdedit /set bootstatuspolicy ignoreallfailures2⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C bcdedit /set bootstatuspolicy ignoreallfailures2⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" bcdedit /set recoveryenabled NO2⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C bcdedit /set recoveryenabled NO2⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C wbadmin delete catalog -quiet2⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" wbadmin delete catalog -quiet2⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Documents\HELP_DECRYPT_YOUR_FILES.TXT2⤵
- System Location Discovery: System Language Discovery
- Opens file in notepad (likely ransom note)
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Defense Evasion
Direct Volume Access
1Indicator Removal
2File Deletion
2Modify Registry
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3KB
MD5a2055997c8035d5ddedcc5e320a71aa9
SHA13749338fe70104e808c368ff4375e8a763d91034
SHA256b4513c07ca8c741c7128f273654afae79ead9420a17a624c9c0f375bea133618
SHA512d3624f8ca4080ed87252a5260514e27d399cf3338cfdb6e6b9b7cd86e781bd47afe9df8e96263a74ae98de6562d863c00dce6367634787050f21af4e103b7334
-
Filesize
3KB
MD51904023d4748caceb87a3b7d85077c97
SHA1a45a031979ba659752adc6380e889028ba925447
SHA2565da529dbafa0628b64ae7e92b1c93e3ec8915023ce5bb8755e8c3a23dd74de37
SHA512fb9dd90603df2664d6b86238fe874099e8c103ad5fbdadf3f0ea8c5c43e076c3835e5e62fb0fef6c1a4094817515f81b12d0a3ed245be72e2c2782cff83199fe
-
Filesize
44KB