Overview

overview

10

Static

static

6

DUMP_00A10...iR.exe

windows7-x64

7

DUMP_00A10...iR.exe

windows10-2004-x64

7

DgH5SjZFle...DI.exe

windows7-x64

10

DgH5SjZFle...DI.exe

windows10-2004-x64

5

Dumped_.exe

windows7-x64

7

Dumped_.exe

windows10-2004-x64

7

EntrateSetup.exe

windows7-x64

9

EntrateSetup.exe

windows10-2004-x64

9

ErrorFileRemover.exe

windows7-x64

10

ErrorFileRemover.exe

windows10-2004-x64

10

ExtraTools.exe

windows7-x64

7

ExtraTools.exe

windows10-2004-x64

7

F45F47EDCE...54.exe

windows7-x64

10

F45F47EDCE...54.exe

windows10-2004-x64

10

decrypt_00...00.exe

windows7-x64

6

decrypt_00...00.exe

windows10-2004-x64

6

dffde400ad...3d.exe

windows7-x64

10

dffde400ad...3d.exe

windows10-2004-x64

10

dircrypt.deobf.exe

windows7-x64

10

dircrypt.deobf.exe

windows10-2004-x64

10

dma locker 4.0.exe

windows7-x64

9

dma locker 4.0.exe

windows10-2004-x64

9

downloader.js

windows7-x64

10

downloader.js

windows10-2004-x64

8

dump.mem.exe

windows7-x64

6

dump.mem.exe

windows10-2004-x64

6

e0ff79cc94...ss.exe

windows7-x64

7

e0ff79cc94...ss.exe

windows10-2004-x64

10

e37dc428ec...ad.vbs

windows7-x64

1

e37dc428ec...ad.vbs

windows10-2004-x64

1

e5df2d114c...8a.exe

windows7-x64

10

e5df2d114c...8a.exe

windows10-2004-x64

3

Sharing

Copy URL Twitter E-mail

General

  • Target
    Batch_7.zip
  • Size 6.8MB
  • Sample241122-d6bprstne1
  • SHA256 17b4d01d32c64a62e36496829da323fe308437048ca87143de7365fabd4194fd
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
crypvaultponycollectioncredential_accessdefense_evasiondiscoveryevasionexecutionimpactpersistenceransomwareratspywarestealertrojanupx

Malware Config

Extracted

Family

  • pony

C2

  • http://hollandfintech.net/api/gate.php

Extracted

Path

  • C:\Users\Admin\AppData\Local\Temp\360390_readme.txt

Ransom Note
  • ATTENTION: All your documents, photos, databases and other important personal files were encrypted using strong RSA-1024 algorithm with a unique key. To restore your files you have to pay 0.5 BTC (bitcoins). To do this: 1. Create Bitcoin wallet here: https://blockchain.info/wallet/new 2. Buy 0.5 BTC with cash, using search here: https://localbitcoins.com/buy_bitcoins 3. Send 0.5 BTC to this Bitcoin address: oJHR97yvh97wrjvwlkrcnqrp79w9rvqnrvj 4. Send any e-mail to: [email protected] After that you will recieve e-mail with detailed instructions how to restore your files. Remember: nobody can help you except us. It is useless to reinstall Windows, rename files, etc. Your files will be decrypted as quick as you make payment.

Extracted

Path

  • C:\Program Files (x86)\Internet Explorer\en-US\ReadMe.html

Ransom Note
  • <html> <head> <meta content="text/html; charset=UTF-8" http-equiv="content-type"> <title>jaff decryptor system</title> </head> <body style="background-color: rgb(102, 204, 204); color: rgb(0, 0, 0);" alink="#ee0000" link="#0000ee" vlink="#551a8b"> <div style="position: absolute; top:0; text-align:center; width:100%" > <h1 style="font-family: System; color: rgb(102, 102, 102);"><big>jaff decryptor system</big></h1> </div> <style> .center { width: 1000px; padding: 10px; margin: auto; background: #fc0; } </style> <div style="position: absolute; top:15%; left: 30%;" > <p style="border: 3px solid rgb(255, 255, 10); padding: 10px; background-color: rgb(223, 213, 209); text-align: left;"><big><big>Files are encrypted!</big></big><br> <br> <big><big>To decrypt flies you need to obtain the private key.<br> The only copy of the private key, which will allow you to decrypt your files, is located on a secret server in the Internet<br> <br> </big></big>&#10102;<big><big> You must install Tor Browser: https://www.torproject.org/download/download-easy.html.en<br> <br> </big></big>&#10103;<big><big> After instalation, run the Tor Browser and enter address: http://rktazuzi7hbln7sy.onion/<br> <br> Follow the instruction on the web-site.</big></big><br> </p> <br> <br> <center><h1><big>Your decrypt ID: 4269048812</big></h1></center> </div> </div> </body> </html>
URLs

  • http-equiv="content-type">

  • http://rktazuzi7hbln7sy.onion/<br>

Extracted

Path

  • C:\Program Files (x86)\Internet Explorer\en-US\ReadMe.txt

Ransom Note
  • jaff decryptor system Files are encrypted! To decrypt flies you need to obtain the private key. The only copy of the private key, which will allow you to decrypt your files, is located on a secret server in the Internet You must install Tor Browser: https://www.torproject.org/download/download-easy.html.en After instalation,run the Tor Browser and enter address: http://rktazuzi7hbln7sy.onion/ Follow the instruction on the web-site. Your decrypt ID: 4269048812
URLs

  • http://rktazuzi7hbln7sy.onion/

Targets

    • Target
      DUMP_00A10000-00A1D000.exe.ViR.exe
    • Size 52KB
    • SHA256 2c4c8066a1a7dfdf42c57ff4f9016f1ba05bcb004ff8b0ffc0989165d2ad30e2
    • MD5 SHA1 SHA512 SSDEEP
    Score
    7/10
    discoverypersistenceupx

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral1behavioral2
    • Target
      DgH5SjZFleOYoBTyxcgMDlZF9brN1mDI.exe
    • Size 176KB
    • SHA256 ebea4a46175b0e9c24e74b774f9ecfb036030f916ec5f2fced34fcb6c1f3ba57
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    discoverypersistenceupx

    • Modifies WinLogon for persistence

      persistence

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    • Suspicious use of SetThreadContext

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral3behavioral4
    • Target
      Dumped_.exe
    • Size 72KB
    • SHA256 86a4ec02684bfd8a055929b0aa6f687bd54e80da0ed689be4e315adf76edbbcb
    • MD5 SHA1 SHA512 SSDEEP
    Score
    7/10
    discovery

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    behavioral5behavioral6
    • Target
      EntrateSetup.exe
    • Size 261KB
    • SHA256 103bc884dce60ec680dd00bcd2d45721319b526b2f6ae7ebe75c73a5c977dafe
    • MD5 SHA1 SHA512 SSDEEP
    Score
    9/10
    defense_evasiondiscoveryevasionexecutionimpactpersistenceransomwaretrojan
    behavioral7behavioral8
    • Target
      ErrorFileRemover.exe
    • Size 2.4MB
    • SHA256 68b0e1932f3b4439865be848c2d592d5174dbdbaab8f66104a0e5b28c928ee0c
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    discoverypersistence

    • Modifies WinLogon for persistence

      persistence

    • Loads dropped DLL

    • Blocklisted process makes network request

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    behavioral10behavioral9
    • Target
      ExtraTools.exe
    • Size 280KB
    • SHA256 06c8e0f6fa2616f4fa92c610a1faea23887ac31db8fa78cede49b6b8c80ec22f
    • MD5 SHA1 SHA512 SSDEEP
    Score
    7/10
    discovery

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    behavioral11behavioral12
    • Target
      F45F47EDCED7FAC5A99C45AB4B8C2D54.exe
    • Size 86KB
    • SHA256 0529cdbc893fee664d3ac540b1e41e184797e0770808254058fc21de0a10b6c8
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    discoveryevasionpersistenceupx

    • Modifies WinLogon for persistence

      persistence

    • Identifies VirtualBox via ACPI registry values (likely anti-VM)

      evasion

    • Disables RegEdit via registry modification

      evasion

    • Disables Task Manager via registry modification

      evasion

    • Deletes itself

    • Executes dropped EXE

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral13behavioral14
    • Target
      decrypt_0000000000000020-000A0000.exe
    • Size 611KB
    • SHA256 94f36b586379137a58862ca46cd1cd6c01c20ea9f56755f7b193f0c97b7a57bd
    • MD5 SHA1 SHA512 SSDEEP
    Score
    6/10
    discoverypersistence
    behavioral15behavioral16
    • Target
      dffde400ad3d2af2bbd61c58bed9dcf7e3e37cec6210c9841d8ed5dc9117343d.exe
    • Size 182KB
    • SHA256 dffde400ad3d2af2bbd61c58bed9dcf7e3e37cec6210c9841d8ed5dc9117343d
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    crypvaultponycollectioncredential_accessdefense_evasiondiscoveryexecutionimpactpersistenceransomwareratspywarestealer

    • CrypVault

      Ransomware family which makes encrypted files look like they have been quarantined by AV.

      ransomwarecrypvault

    • Crypvault family

      crypvault

    • Pony family

      pony

    • Pony,Fareit

      Pony is a Remote Access Trojan application that steals information.

      ratspywarestealerpony

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • Deletes shadow copies

      Ransomware often targets backup files to inhibit system recovery.

      ransomwaredefense_evasionimpactexecution

    • Adds policy Run key to start application

      persistence

    • Deletes itself

    • Drops startup file

    • Unsecured Credentials: Credentials In Files

      Steal credentials from unsecured files.

      credential_accessstealer

    • Accesses Microsoft Outlook accounts

      collection

    • Accesses Microsoft Outlook profiles

      collection

    • Adds Run key to start application

      persistence

    • Drops file in System32 directory

    • Enumerates processes with tasklist

      discovery

    • Suspicious use of SetThreadContext

    behavioral17behavioral18
    • Target
      dircrypt.deobf.exe
    • Size 321KB
    • SHA256 9c67320f0a29796abfb5b53ef2fa2fbcb56b33cff6cdb3f96a8d303685e17263
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    discoveryevasionpersistencetrojanupx

    • Modifies WinLogon for persistence

      persistence

    • Modifies firewall policy service

      evasion

    • Modifies security service

      evasion

    • UAC bypass

      evasiontrojan

    • Windows security bypass

      evasiontrojan

    • Disables Task Manager via registry modification

      evasion

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Drops startup file

    • Executes dropped EXE

    • Loads dropped DLL

    • Windows security modification

      evasiontrojan

    • Adds Run key to start application

      persistence

    • Checks whether UAC is enabled

      evasiontrojan

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral19behavioral20
    • Target
      dma locker 4.0.exe
    • Size 315KB
    • SHA256 53a0dc85e447c58cb8d7c7e00381c8548878390c7a1443326625faa2b461ebe8
    • MD5 SHA1 SHA512 SSDEEP
    Score
    9/10
    defense_evasiondiscoveryexecutionimpactpersistenceransomware

    • Deletes shadow copies

      Ransomware often targets backup files to inhibit system recovery.

      ransomwaredefense_evasionimpactexecution

    • Adds Run key to start application

      persistence

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    behavioral21behavioral22
    • Target
      downloader.js
    • Size 8KB
    • SHA256 f6e2c1b42ce68165fd2cd8580daf47d594c4960fc8fb5cdbf1ec210e3ffae87f
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    executionransomwarespywarestealer

    • Blocklisted process makes network request

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer
    behavioral23behavioral24
    • Target
      dump.mem.exe
    • Size 53KB
    • SHA256 ea3745e02a69f4123e06115b3abeb8dc6930000ed97d8a55351641b76b4d5e1a
    • MD5 SHA1 SHA512 SSDEEP
    Score
    6/10
    discoverypersistence
    behavioral25behavioral26
    • Target
      e0ff79cc943f489668067ec3be11398a084a76ecd0283c9e18b2d0bf6e464c32_not_packed_maybe_useless.exe
    • Size 89KB
    • SHA256 e0ff79cc943f489668067ec3be11398a084a76ecd0283c9e18b2d0bf6e464c32
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    persistencediscovery

    • Modifies WinLogon for persistence

      persistence

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Adds Run key to start application

      persistence
    behavioral27behavioral28
    • Target
      e37dc428ec65a38707ad9e247950f3501a94e4abccb737a3562d69032c8505ad.exe
    • Size 54KB
    • SHA256 e37dc428ec65a38707ad9e247950f3501a94e4abccb737a3562d69032c8505ad
    • MD5 SHA1 SHA512 SSDEEP
    Score
    1/10
    behavioral29behavioral30
    • Target
      e5df2d114c5f69c219923fed56c8aa7ee912020ba7589e88f2729285c1f5788a.exe
    • Size 33KB
    • SHA256 e5df2d114c5f69c219923fed56c8aa7ee912020ba7589e88f2729285c1f5788a
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    defense_evasiondiscoveryransomwarespywarestealer

    • Renames multiple (4015) files with added filename extension

      This suggests ransomware activity of encrypting all the files on the system.

      ransomware

    • Drops file in Drivers directory

    • Deletes itself

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Indicator Removal: File Deletion

      Adversaries may delete files left behind by the actions of their intrusion activity.

      defense_evasion

    • Drops file in System32 directory

    • Sets desktop wallpaper using registry

      ransomware
    behavioral31behavioral32

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1
T1059

JavaScript

1
T1059.007

Windows Management Instrumentation

1
T1047

Persistence

Boot or Logon Autostart Execution

3
T1547

Registry Run Keys / Startup Folder

2
T1547.001

Winlogon Helper DLL

1
T1547.004

Create or Modify System Process

2
T1543

Windows Service

2
T1543.003

Privilege Escalation

Abuse Elevation Control Mechanism

1
T1548

Bypass User Account Control

1
T1548.002

Boot or Logon Autostart Execution

3
T1547

Registry Run Keys / Startup Folder

2
T1547.001

Winlogon Helper DLL

1
T1547.004

Create or Modify System Process

2
T1543

Windows Service

2
T1543.003

Defense Evasion

Abuse Elevation Control Mechanism

1
T1548

Bypass User Account Control

1
T1548.002

Direct Volume Access

1
T1006

Impair Defenses

4
T1562

Disable or Modify System Firewall

1
T1562.004

Disable or Modify Tools

3
T1562.001

Indicator Removal

3
T1070

File Deletion

3
T1070.004

Modify Registry

12
T1112

Virtualization/Sandbox Evasion

1
T1497

Credential Access

Credentials from Password Stores

1
T1555

Credentials from Web Browsers

1
T1555.003

Unsecured Credentials

2
T1552

Credentials In Files

2
T1552.001

Discovery

Browser Information Discovery

1
T1217

Peripheral Device Discovery

2
T1120

Process Discovery

1
T1057

Query Registry

5
T1012

System Information Discovery

6
T1082

System Location Discovery

1
T1614

System Language Discovery

1
T1614.001

Virtualization/Sandbox Evasion

1
T1497

Lateral Movement

Collection

Data from Local System

1
T1005

Email Collection

2
T1114

Command and Control

Exfiltration

Impact

Defacement

1
T1491

Inhibit System Recovery

2
T1490

Tasks

static1

upx
Score
6/10

behavioral1

discoverypersistenceupx
Score
7/10

behavioral2

discoverypersistenceupx
Score
7/10

behavioral3

discoverypersistenceupx
Score
10/10

behavioral4

discoveryupx
Score
5/10

behavioral5

Score
7/10

behavioral6

discovery
Score
7/10

behavioral7

defense_evasiondiscoveryevasionexecutionimpactpersistenceransomwaretrojan
Score
9/10

behavioral8

defense_evasiondiscoveryevasionexecutionimpactpersistenceransomwaretrojan
Score
9/10

behavioral9

discoverypersistence
Score
10/10

behavioral10

discoverypersistence
Score
10/10

behavioral11

discovery
Score
7/10

behavioral12

discovery
Score
7/10

behavioral13

discoveryevasionpersistenceupx
Score
10/10

behavioral14

discoveryevasionpersistenceupx
Score
10/10

behavioral15

discoverypersistence
Score
6/10

behavioral16

discoverypersistence
Score
6/10

behavioral17

crypvaultponycollectioncredential_accessdefense_evasiondiscoveryexecutionimpactpersistenceransomwareratspywarestealer
Score
10/10

behavioral18

crypvaultponycollectioncredential_accessdefense_evasiondiscoveryexecutionimpactpersistenceransomwareratspywarestealer
Score
10/10

behavioral19

discoveryevasionpersistencetrojanupx
Score
10/10

behavioral20

discoveryevasionpersistencetrojanupx
Score
10/10

behavioral21

defense_evasiondiscoveryexecutionimpactpersistenceransomware
Score
9/10

behavioral22

defense_evasiondiscoveryexecutionimpactpersistenceransomware
Score
9/10

behavioral23

executionransomwarespywarestealer
Score
10/10

behavioral24

executionspywarestealer
Score
8/10

behavioral25

discoverypersistence
Score
6/10

behavioral26

discoverypersistence
Score
6/10

behavioral27

persistence
Score
7/10

behavioral28

discoverypersistence
Score
10/10

behavioral29

Score
1/10

behavioral30

Score
1/10

behavioral31

defense_evasiondiscoveryransomwarespywarestealer
Score
10/10

behavioral32

discovery
Score
3/10