Analysis
-
max time kernel
118s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
20-11-2024 10:04
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
新建文件夹/x.exe
Resource
win7-20240708-en
windows7-x64
12 signatures
150 seconds
Behavioral task
behavioral2
Sample
新建文件夹/x.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
14 signatures
150 seconds
General
-
Target
新建文件夹/x.exe
-
Size
484KB
-
MD5
5d279e53008bcf128c79d18913073440
-
SHA1
710f5671c5326c9b722a69284a30039c2bd00628
-
SHA256
380e081dbf5550146db4e9d874a796f6d5d80c49b5cbe50f9247a556192ea129
-
SHA512
f093db7036d75ee03c0cf6b170b1d7206ee81d57d199df69930979c15ebd5fcc365333be514abea69b196faaa592cd47ff2f778875521060c3ebe4bf931c3627
-
SSDEEP
6144:40Kf3dwCiJOp5DzwQTSmKMuYREY4nLy95/YjVD+IyaFV/GCc7IfxB7f:255QySNaEY4nW9sl+ja3/GCT
Score
10/10
Malware Config
Extracted
Path
C:\$Recycle.Bin\HOW TO BACK FILES.txt
Family
targetcompany
Ransom Note
Hello
Your data has been stolen and encrypted
We will delete the stolen data and help with the recovery of encrypted files after payment has been made
Do not try to change or restore files yourself, this will break them
We provide free decryption for any 3 files up to 3MB in size on our website
How to contact with us:
1) Download and install TOR browser by this link: https://www.torproject.org/download/
2) If TOR blocked in your country and you can't access to the link then use any VPN software
3) Run TOR browser and open the site: wtyafjyhwqrgo4a45wdvvwhen3cx4euie73qvlhkhvlrexljoyuklaad.onion/mallox/privateSignin
4) Copy your private ID in the input field. Your Private key: 052ED147EA7893944EB65E8B
5) You will see chat, payment information and we can make free test decryption here
Our blog of leaked companies:
wtyafjyhwqrgo4a45wdvvwhen3cx4euie73qvlhkhvlrexljoyuklaad.onion
If you are unable to contact us through the site, then you can email us: [email protected]
Waiting for a response via mail can be several days. Do not use it if you have not tried contacting through the site.�
Emails
URLs
http://wtyafjyhwqrgo4a45wdvvwhen3cx4euie73qvlhkhvlrexljoyuklaad.onion/mallox/privateSignin
http://wtyafjyhwqrgo4a45wdvvwhen3cx4euie73qvlhkhvlrexljoyuklaad.onion
Signatures
-
TargetCompany,Mallox
TargetCompany (aka Mallox) is a ransomware which encrypts files using a combination of ChaCha20, AES-128, and Curve25519, first seen in June 2021.
-
Targetcompany family
-
Modifies boot configuration data using bcdedit 1 TTPs 2 IoCs
pid Process 2780 bcdedit.exe 2836 bcdedit.exe -
Renames multiple (7220) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Enumerates connected drives 3 TTPs 24 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\G: x.exe File opened (read-only) \??\S: x.exe File opened (read-only) \??\V: x.exe File opened (read-only) \??\W: x.exe File opened (read-only) \??\Y: x.exe File opened (read-only) \??\E: x.exe File opened (read-only) \??\A: x.exe File opened (read-only) \??\B: x.exe File opened (read-only) \??\I: x.exe File opened (read-only) \??\J: x.exe File opened (read-only) \??\M: x.exe File opened (read-only) \??\Q: x.exe File opened (read-only) \??\R: x.exe File opened (read-only) \??\T: x.exe File opened (read-only) \??\U: x.exe File opened (read-only) \??\O: x.exe File opened (read-only) \??\P: x.exe File opened (read-only) \??\X: x.exe File opened (read-only) \??\D: x.exe File opened (read-only) \??\H: x.exe File opened (read-only) \??\K: x.exe File opened (read-only) \??\L: x.exe File opened (read-only) \??\N: x.exe File opened (read-only) \??\Z: x.exe -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 4 api.ipify.org -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0099154.JPG x.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0153273.WMF x.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBSPAPR\PDIR14F.GIF x.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\QuickStyles\Modern.dotx x.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\HOW TO BACK FILES.txt x.exe File opened for modification C:\Program Files\7-Zip\Lang\nl.txt x.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Barbados x.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.help.webapp.nl_zh_4.4.0.v20140623020002.jar x.exe File created C:\Program Files\VideoLAN\VLC\locale\hu\LC_MESSAGES\HOW TO BACK FILES.txt x.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\css\ui-lightness\images\ui-bg_highlight-soft_100_eeeeee_1x100.png x.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\SO00938_.WMF x.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\LINES\BD21413_.GIF x.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\btn-next-static.png x.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\GMT-12 x.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0107090.WMF x.exe File created C:\Program Files\VideoLAN\VLC\plugins\services_discovery\HOW TO BACK FILES.txt x.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ecf.filetransfer_5.0.0.v20140827-1444.jar x.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Multimedia.api x.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\LanguageNames2\DisplayLanguageNames.en_US.txt x.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\WING2.WMF x.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\bg_GreenTea.gif x.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\FORMS\1033\DOC.CFG x.exe File created C:\Program Files\VideoLAN\VLC\locale\hi\HOW TO BACK FILES.txt x.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\lt\HOW TO BACK FILES.txt x.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\HOW TO BACK FILES.txt x.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\HOW TO BACK FILES.txt x.exe File opened for modification C:\Program Files\Microsoft Games\Minesweeper\fr-FR\Minesweeper.exe.mui x.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0217262.WMF x.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0387882.JPG x.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\meta\reader\HOW TO BACK FILES.txt x.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\AcroForm\PMP\HOW TO BACK FILES.txt x.exe File opened for modification C:\Program Files\Windows Journal\es-ES\JNTFiltr.dll.mui x.exe File opened for modification C:\Program Files\Windows Media Player\it-IT\WMPDMCCore.dll.mui x.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\SO00190_.WMF x.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Bibliography\Style\TURABIAN.XSL x.exe File created C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\SoftBlue\HOW TO BACK FILES.txt x.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-heapdump_ja.jar x.exe File opened for modification C:\Program Files\7-Zip\Lang\hy.txt x.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\PH02466U.BMP x.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-lib-uihandler.xml x.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\CT_ROOTS.XML x.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-coredump_ja.jar x.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Europe\Budapest x.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\PH02208U.BMP x.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\WB01745_.GIF x.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\CAGCAT10\J0196400.WMF x.exe File opened for modification C:\Program Files\7-Zip\Lang\cs.txt x.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Tallinn x.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-favorites_zh_CN.jar x.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\en_GB\LC_MESSAGES\vlc.mo x.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\OliveGreen.css x.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\FormToolImages.jpg x.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Antarctica\Mawson x.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Bahia x.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\ja\LC_MESSAGES\vlc.mo x.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\PICSTYLES.DPV x.exe File created C:\Program Files\7-Zip\HOW TO BACK FILES.txt x.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\bear_formatted_matte2.wmv x.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-modules-keyring.jar x.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\CAGCAT10\J0229385.WMF x.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD10298_.GIF x.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\DataServices\+Connect to New Data Source.odc x.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PROOF\MSSP7FR.dub x.exe File created C:\Program Files\VideoLAN\VLC\plugins\meta_engine\HOW TO BACK FILES.txt x.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 1900 x.exe 1900 x.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeTakeOwnershipPrivilege 1900 x.exe Token: SeDebugPrivilege 1900 x.exe Token: SeTakeOwnershipPrivilege 1900 x.exe Token: SeTakeOwnershipPrivilege 1900 x.exe Token: SeTakeOwnershipPrivilege 1900 x.exe Token: SeTakeOwnershipPrivilege 1900 x.exe Token: SeTakeOwnershipPrivilege 1900 x.exe Token: SeTakeOwnershipPrivilege 1900 x.exe Token: SeTakeOwnershipPrivilege 1900 x.exe Token: SeTakeOwnershipPrivilege 1900 x.exe Token: SeTakeOwnershipPrivilege 1900 x.exe Token: SeTakeOwnershipPrivilege 1900 x.exe Token: SeTakeOwnershipPrivilege 1900 x.exe Token: SeTakeOwnershipPrivilege 1900 x.exe Token: SeTakeOwnershipPrivilege 1900 x.exe Token: SeTakeOwnershipPrivilege 1900 x.exe Token: SeTakeOwnershipPrivilege 1900 x.exe Token: SeTakeOwnershipPrivilege 1900 x.exe Token: SeTakeOwnershipPrivilege 1900 x.exe Token: SeTakeOwnershipPrivilege 1900 x.exe Token: SeTakeOwnershipPrivilege 1900 x.exe Token: SeTakeOwnershipPrivilege 1900 x.exe Token: SeTakeOwnershipPrivilege 1900 x.exe Token: SeTakeOwnershipPrivilege 1900 x.exe Token: SeTakeOwnershipPrivilege 1900 x.exe Token: SeTakeOwnershipPrivilege 1900 x.exe Token: SeTakeOwnershipPrivilege 1900 x.exe Token: SeTakeOwnershipPrivilege 1900 x.exe Token: SeTakeOwnershipPrivilege 1900 x.exe Token: SeTakeOwnershipPrivilege 1900 x.exe Token: SeTakeOwnershipPrivilege 1900 x.exe Token: SeTakeOwnershipPrivilege 1900 x.exe Token: SeTakeOwnershipPrivilege 1900 x.exe Token: SeTakeOwnershipPrivilege 1900 x.exe Token: SeTakeOwnershipPrivilege 1900 x.exe Token: SeTakeOwnershipPrivilege 1900 x.exe Token: SeTakeOwnershipPrivilege 1900 x.exe Token: SeTakeOwnershipPrivilege 1900 x.exe Token: SeTakeOwnershipPrivilege 1900 x.exe Token: SeTakeOwnershipPrivilege 1900 x.exe Token: SeTakeOwnershipPrivilege 1900 x.exe Token: SeTakeOwnershipPrivilege 1900 x.exe Token: SeTakeOwnershipPrivilege 1900 x.exe Token: SeTakeOwnershipPrivilege 1900 x.exe Token: SeTakeOwnershipPrivilege 1900 x.exe Token: SeTakeOwnershipPrivilege 1900 x.exe Token: SeTakeOwnershipPrivilege 1900 x.exe Token: SeTakeOwnershipPrivilege 1900 x.exe Token: SeTakeOwnershipPrivilege 1900 x.exe Token: SeTakeOwnershipPrivilege 1900 x.exe Token: SeTakeOwnershipPrivilege 1900 x.exe Token: SeTakeOwnershipPrivilege 1900 x.exe Token: SeTakeOwnershipPrivilege 1900 x.exe Token: SeTakeOwnershipPrivilege 1900 x.exe Token: SeTakeOwnershipPrivilege 1900 x.exe Token: SeTakeOwnershipPrivilege 1900 x.exe Token: SeTakeOwnershipPrivilege 1900 x.exe Token: SeTakeOwnershipPrivilege 1900 x.exe Token: SeTakeOwnershipPrivilege 1900 x.exe Token: SeTakeOwnershipPrivilege 1900 x.exe Token: SeTakeOwnershipPrivilege 1900 x.exe Token: SeTakeOwnershipPrivilege 1900 x.exe Token: SeTakeOwnershipPrivilege 1900 x.exe Token: SeTakeOwnershipPrivilege 1900 x.exe -
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 1900 wrote to memory of 1924 1900 x.exe 30 PID 1900 wrote to memory of 1924 1900 x.exe 30 PID 1900 wrote to memory of 1924 1900 x.exe 30 PID 1900 wrote to memory of 2696 1900 x.exe 31 PID 1900 wrote to memory of 2696 1900 x.exe 31 PID 1900 wrote to memory of 2696 1900 x.exe 31 PID 2696 wrote to memory of 2780 2696 cmd.exe 34 PID 2696 wrote to memory of 2780 2696 cmd.exe 34 PID 2696 wrote to memory of 2780 2696 cmd.exe 34 PID 1924 wrote to memory of 2836 1924 cmd.exe 35 PID 1924 wrote to memory of 2836 1924 cmd.exe 35 PID 1924 wrote to memory of 2836 1924 cmd.exe 35 -
System policy modification 1 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\shutdownwithoutlogon = "0" x.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\新建文件夹\x.exe"C:\Users\Admin\AppData\Local\Temp\新建文件夹\x.exe"1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1900 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c bcdedit /set {current} bootstatuspolicy ignoreallfailures2⤵
- Suspicious use of WriteProcessMemory
PID:1924 -
C:\Windows\system32\bcdedit.exebcdedit /set {current} bootstatuspolicy ignoreallfailures3⤵
- Modifies boot configuration data using bcdedit
PID:2836
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c bcdedit /set {current} recoveryenabled no2⤵
- Suspicious use of WriteProcessMemory
PID:2696 -
C:\Windows\system32\bcdedit.exebcdedit /set {current} recoveryenabled no3⤵
- Modifies boot configuration data using bcdedit
PID:2780
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD5a8b8ed2025d8eeabc260a9e42cdc3c7a
SHA1b48ea85f40f6035d5eda9ebdc5e845be120b1d6c
SHA2560dc6e7f089542ebd757be561be4fbcd36d07a36b935399789dc3601c89ac282d
SHA5126898e6874fa241a96ba399c039aa3e178c31df29066b405df68f74667e361cc7b07a3e9fa0b4da0e253474b320175c6a82767915724ec824be630cafa13fe576