Analysis
-
max time kernel
1561s -
max time network
1562s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
11-11-2024 07:17
General
-
Target
2016-11-16-4th-run-Rig-standard-payload-CryptFile2.exe
-
Size
79KB
-
MD5
eb2972b9ac8a5db042cbadce971f64de
-
SHA1
40e03dde3562e379fa1be28f45eb36107c37c0de
-
SHA256
4b447266bd7a130c5b27c9ec4bd68a9ebf731a4ce0300702f41b37da1d6384ef
-
SHA512
10cdec84cd819270b57e37d730efe6fcd615adf744b54c0e9bf075fdf29067b4408748cb069750bb2067c1c569a1ff39c38f20f183a44c28e2c8e03d780e15ad
-
SSDEEP
1536:sRu6a2/bEPH2dFzd5Bsnu7jjd405wfGtu76KvJ:sRvdFR5Bsnu7jjKcYQY6KvJ
Score
10/10
Malware Config
Extracted
Path
C:\PerfLogs\Admin\# HELP_DECRYPT_YOUR_FILES #.TXT
Ransom Note
NOT YOUR LANGUAGE? USE https://translate.google.com
What happened to your files ?
All of your files protected by a strong encryption with RSA-2048.
More information about the encryption keys using RSA-2048 can be found here: https://en.wikipedia.org/wiki/RSA_(cryptosystem)
How did this happen ?
!!! Specially for your PC was generated personal RSA-2048 KEY, both public and private.
!!! ALL YOUR FILES were encrypted with the public key, which has been transferred to your computer via the Internet.
!!! Decrypting of your files is only possible with the help of the private key and decrypt program , which is on our Secret Server
What do I do ?
So, there are two ways you can choose: wait for a miracle and get your price doubled, or start send email now for more specific instructions! , and restore your data easy way.
If You have really valuable data, you better not waste your time, because there is no other way to get your files, except make a payment.
For more specific instructions:
Contact us by email only, send us an email along with your ID number and wait for further instructions. Our specialist will contact you within 24 hours.
For you to be sure, that we can decrypt your files - you can send us a single encrypted file and we will send you back it in a decrypted form. This will be your guarantee.
Please do not waste your time! You have 72 hours only! After that The Main Server will double your price!
So right now You have a chance to buy your individual private SoftWare with a low price!
E-MAIL1: [email protected]
E-MAIL2: [email protected]
YOUR_ID: 1c9b74eade2b146b
Extracted
Path
C:\Users\Admin\Desktop\# HELP_DECRYPT_YOUR_FILES #.TXT
Ransom Note
NOT YOUR LANGUAGE? USE https://translate.google.com
What happened to your files ?
All of your files protected by a strong encryption with RSA-2048.
More information about the encryption keys using RSA-2048 can be found here: https://en.wikipedia.org/wiki/RSA_(cryptosystem)
How did this happen ?
!!! Specially for your PC was generated personal RSA-2048 KEY, both public and private.
!!! ALL YOUR FILES were encrypted with the public key, which has been transferred to your computer via the Internet.
!!! Decrypting of your files is only possible with the help of the private key and decrypt program , which is on our Secret Server
What do I do ?
So, there are two ways you can choose: wait for a miracle and get your price doubled, or start send email now for more specific instructions! , and restore your data easy way.
If You have really valuable data, you better not waste your time, because there is no other way to get your files, except make a payment.
For more specific instructions:
Contact us by email only, send us an email along with your ID number and wait for further instructions. Our specialist will contact you within 24 hours.
For you to be sure, that we can decrypt your files - you can send us a single encrypted file and we will send you back it in a decrypted form. This will be your guarantee.
Please do not waste your time! You have 72 hours only! After that The Main Server will double your price!
So right now You have a chance to buy your individual private SoftWare with a low price!
E-MAIL1: [email protected]
E-MAIL2: [email protected]
Signatures
-
Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Adds Run key to start application 2 TTPs 4 IoCs
-
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Interacts with shadow copies 3 TTPs 27 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
-
Runs net.exe
-
Suspicious use of AdjustPrivilegeToken 46 IoCs
-
Suspicious use of WriteProcessMemory 64 IoCs
-
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\2016-11-16-4th-run-Rig-standard-payload-CryptFile2.exe"C:\Users\Admin\AppData\Local\Temp\2016-11-16-4th-run-Rig-standard-payload-CryptFile2.exe"1⤵
- Adds Run key to start application
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C vssadmin.exe Delete Shadows /All /Quiet2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\vssadmin.exevssadmin.exe Delete Shadows /All /Quiet3⤵
- System Location Discovery: System Language Discovery
- Interacts with shadow copies
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C wmic shadowcopy delete2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\Wbem\WMIC.exewmic shadowcopy delete3⤵
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C vssadmin Delete Shadows /For=Z: /All /Quiet2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\vssadmin.exevssadmin Delete Shadows /For=Z: /All /Quiet3⤵
- System Location Discovery: System Language Discovery
- Interacts with shadow copies
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C vssadmin Delete Shadows /For=Y: /All /Quiet2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\vssadmin.exevssadmin Delete Shadows /For=Y: /All /Quiet3⤵
- System Location Discovery: System Language Discovery
- Interacts with shadow copies
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C vssadmin Delete Shadows /For=X: /All /Quiet2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\vssadmin.exevssadmin Delete Shadows /For=X: /All /Quiet3⤵
- System Location Discovery: System Language Discovery
- Interacts with shadow copies
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C vssadmin Delete Shadows /For=W: /All /Quiet2⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\vssadmin.exevssadmin Delete Shadows /For=W: /All /Quiet3⤵
- System Location Discovery: System Language Discovery
- Interacts with shadow copies
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C vssadmin Delete Shadows /For=V: /All /Quiet2⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\vssadmin.exevssadmin Delete Shadows /For=V: /All /Quiet3⤵
- System Location Discovery: System Language Discovery
- Interacts with shadow copies
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C vssadmin Delete Shadows /For=U: /All /Quiet2⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\vssadmin.exevssadmin Delete Shadows /For=U: /All /Quiet3⤵
- System Location Discovery: System Language Discovery
- Interacts with shadow copies
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C vssadmin Delete Shadows /For=T: /All /Quiet2⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\vssadmin.exevssadmin Delete Shadows /For=T: /All /Quiet3⤵
- System Location Discovery: System Language Discovery
- Interacts with shadow copies
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C vssadmin Delete Shadows /For=S: /All /Quiet2⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\vssadmin.exevssadmin Delete Shadows /For=S: /All /Quiet3⤵
- System Location Discovery: System Language Discovery
- Interacts with shadow copies
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C vssadmin Delete Shadows /For=R: /All /Quiet2⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\vssadmin.exevssadmin Delete Shadows /For=R: /All /Quiet3⤵
- System Location Discovery: System Language Discovery
- Interacts with shadow copies
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C vssadmin Delete Shadows /For=Q: /All /Quiet2⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\vssadmin.exevssadmin Delete Shadows /For=Q: /All /Quiet3⤵
- System Location Discovery: System Language Discovery
- Interacts with shadow copies
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C vssadmin Delete Shadows /For=P: /All /Quiet2⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\vssadmin.exevssadmin Delete Shadows /For=P: /All /Quiet3⤵
- System Location Discovery: System Language Discovery
- Interacts with shadow copies
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C vssadmin Delete Shadows /For=O: /All /Quiet2⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\vssadmin.exevssadmin Delete Shadows /For=O: /All /Quiet3⤵
- Interacts with shadow copies
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C vssadmin Delete Shadows /For=N: /All /Quiet2⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\vssadmin.exevssadmin Delete Shadows /For=N: /All /Quiet3⤵
- System Location Discovery: System Language Discovery
- Interacts with shadow copies
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C vssadmin Delete Shadows /For=M: /All /Quiet2⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\vssadmin.exevssadmin Delete Shadows /For=M: /All /Quiet3⤵
- System Location Discovery: System Language Discovery
- Interacts with shadow copies
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C vssadmin Delete Shadows /For=L: /All /Quiet2⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\vssadmin.exevssadmin Delete Shadows /For=L: /All /Quiet3⤵
- System Location Discovery: System Language Discovery
- Interacts with shadow copies
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C vssadmin Delete Shadows /For=K: /All /Quiet2⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\vssadmin.exevssadmin Delete Shadows /For=K: /All /Quiet3⤵
- System Location Discovery: System Language Discovery
- Interacts with shadow copies
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C vssadmin Delete Shadows /For=J: /All /Quiet2⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\vssadmin.exevssadmin Delete Shadows /For=J: /All /Quiet3⤵
- System Location Discovery: System Language Discovery
- Interacts with shadow copies
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C vssadmin Delete Shadows /For=I: /All /Quiet2⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\vssadmin.exevssadmin Delete Shadows /For=I: /All /Quiet3⤵
- Interacts with shadow copies
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C vssadmin Delete Shadows /For=H: /All /Quiet2⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\vssadmin.exevssadmin Delete Shadows /For=H: /All /Quiet3⤵
- System Location Discovery: System Language Discovery
- Interacts with shadow copies
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C vssadmin Delete Shadows /For=G: /All /Quiet2⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\vssadmin.exevssadmin Delete Shadows /For=G: /All /Quiet3⤵
- System Location Discovery: System Language Discovery
- Interacts with shadow copies
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C vssadmin Delete Shadows /For=F: /All /Quiet2⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\vssadmin.exevssadmin Delete Shadows /For=F: /All /Quiet3⤵
- System Location Discovery: System Language Discovery
- Interacts with shadow copies
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C vssadmin Delete Shadows /For=E: /All /Quiet2⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\vssadmin.exevssadmin Delete Shadows /For=E: /All /Quiet3⤵
- System Location Discovery: System Language Discovery
- Interacts with shadow copies
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C vssadmin Delete Shadows /For=D: /All /Quiet2⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\vssadmin.exevssadmin Delete Shadows /For=D: /All /Quiet3⤵
- System Location Discovery: System Language Discovery
- Interacts with shadow copies
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C vssadmin Delete Shadows /For=C: /All /Quiet2⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\vssadmin.exevssadmin Delete Shadows /For=C: /All /Quiet3⤵
- System Location Discovery: System Language Discovery
- Interacts with shadow copies
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C vssadmin Delete Shadows /For=B: /All /Quiet2⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\vssadmin.exevssadmin Delete Shadows /For=B: /All /Quiet3⤵
- System Location Discovery: System Language Discovery
- Interacts with shadow copies
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C vssadmin Delete Shadows /For=A: /All /Quiet2⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\vssadmin.exevssadmin Delete Shadows /For=A: /All /Quiet3⤵
- System Location Discovery: System Language Discovery
- Interacts with shadow copies
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C net stop vss2⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\net.exenet stop vss3⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop vss4⤵
- System Location Discovery: System Language Discovery
-
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C bcdedit /set {default} recoveryenabled No2⤵
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C bcdedit /set {default} bootstatuspolicy ignoreallfailures2⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" bcdedit /set {default} recoveryenabled No2⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" bcdedit /set {default} bootstatuspolicy ignoreallfailures2⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" bcdedit /set bootstatuspolicy ignoreallfailures2⤵
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C bcdedit /set bootstatuspolicy ignoreallfailures2⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" bcdedit /set recoveryenabled NO2⤵
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C bcdedit /set recoveryenabled NO2⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C wbadmin delete catalog -quiet2⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" wbadmin delete catalog -quiet2⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Documents\# HELP_DECRYPT_YOUR_FILES #.TXT2⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Defense Evasion
Direct Volume Access
1Indicator Removal
2File Deletion
2Modify Registry
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3KB
MD5ac8d86831e37b01871264094cb89bb22
SHA1bc8a034753e7b738eb1eb6c74304a64bf7970010
SHA256aa036d9f9d8aa4329d8815b78ecae49893a7fe1f064fbd6b1a42115db6dab5e8
SHA5120e998581d36db1217908e16fe08d529365117a17efadbb892d2ddf8cb0b50e519bf849224cb50a66011c68813a4660d17aff52dbaba8deb6e2489f8258838594
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
3KB
MD5d7009ba025c96b2a98f578f54894063a
SHA17c0044d11276410d362ccd58158e3ca7376dbda3
SHA256efc5834ae9a7350f12c3c4d9c00eaf9c934e4bfb3a9b28091e9b39988c558605
SHA512a09981914f8370de3685bf7005631780b809e2db5abdecee1ace156c5fa6719c71600f63c6f81099678a30054710cc8d9c3bfa90cd38149f7318dd5c950664ec
-
Filesize
48KB
-
Filesize
48KB
-
Filesize
48KB