Analysis
- max time kernel
95s - max time network
146s - platform
windows10-2004_x64 - resource
win10v2004-20241007-en - resource tags
- submitted
15/11/2024, 14:35
General
- Target c94b70dff50e69639b0ef1e828621c5fddcf144fea93e27520f48264ddd33273.exe
- Size 1.4MB
- Sample241115-ryfweayrcq
- SHA256 c94b70dff50e69639b0ef1e828621c5fddcf144fea93e27520f48264ddd33273
Score
10/10
Malware Config
Extracted
Path
-
C:\ProgramData\Adobe\Setup\readme.txt
Ransom Note
- What's happened? Your corporate network has been encrypted. And that’s not all - we studied and downloaded a lot of your data, many of them have confidential status. If you ignore this incident, we will ensure that your confidential data is widely available to the public. We will make sure that your clients and partners know about everything, and attacks will continue. Some of the data will be sold to scammers who will attack your clients and employees. What's next? You must contact us via qTox to make a deal. To install qTox follow the following instructions: 1. Follow the link to the official release and download the installation file. https://github.com/qTox/qTox/releases/download/v1.17.6/setup-qtox-x86_64-release.exe 2. Open and install setup-qtox-x86_64-release.exe 3. Double-click the qTox shortcut on your desktop. 4. In the username field, enter the name of your company. 5. Create your password and enter it in the password field. 6. Enter your password again in the confirm field 7. Click the "Create Profile" button. 8. In the Add Friends window, in the ToxID field, enter this: 74773DBD4085BA39A1643CFA561488124771BE839961793DA10245560E1F2D3A3DBD566445E8 then click the "Send friend request" button 9. Wait for technical support to contact you. Advantages of dealing with us: 1. We will not mention this incident. 2. You will receive a recovery tool for all your systems that have been encrypted. 3. We guarantee that there will be no data leakage and will delete all your data from our servers. 4. We will provide a security report and give advice on how to prevent similar attacks in the future. 5. We will never attack you again. What not to do: Do not attempt to change or rename any files - this will render them unrecoverable. Do not make any changes until you receive the decryption tool to avoid permanent data damage.
URLs
-
https://github.com/qTox/qTox/releases/download/v1.17.6/setup-qtox-x86_64-release.exe
Signatures
- Renames multiple (1530) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
- Credentials from Password Stores: Windows Credential Manager 1 TTPs
Suspicious access to Credentials History.
- Drops startup file 1 IoCs
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Drops desktop.ini file(s) 28 IoCs
- Browser Information Discovery 1 TTPs
Enumerate browser information.
Processes
-
C:\Users\Admin\AppData\Local\Temp\c94b70dff50e69639b0ef1e828621c5fddcf144fea93e27520f48264ddd33273.exe"C:\Users\Admin\AppData\Local\Temp\c94b70dff50e69639b0ef1e828621c5fddcf144fea93e27520f48264ddd33273.exe"1⤵
- Drops startup file
- Drops desktop.ini file(s)
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
readme.txt
edbres00001.jrs
USSres00002.jrs
CURRENT
MANIFEST-000001.NBA
CURRENT
MANIFEST-000001.NBA
index
CURRENT
MANIFEST-000001
data_0
data_1
data_2
data_3
index
MANIFEST-000001
settings.dat
wctA316.tmp
TM02851227[[fn=sist02]].xsl
places.sqlite-shm
2918063365piupsah.sqlite
memory/824-4409-0x00007FF6FD450000-0x00007FF6FD5B3000-memory.dmp
memory/824-4439-0x00007FF6FD450000-0x00007FF6FD5B3000-memory.dmp