21015517c1ced96b58b6597e50d1805610b48292cfba20c730ae69123f15d684

General

Target
Pay 5000 Robux Ransomware.exe
Size 584KB
Sample260719-w4fvtabw4s
SHA256 21015517c1ced96b58b6597e50d1805610b48292cfba20c730ae69123f15d684
MD5 8dae31dc9349c0466dd5716629086efc
SHA1 10ba027460e9a4281271d644e09ab65e93df3d1d
SHA512 d2f3920337c3313d98413f77c3af98320abaf22763aa169739651bcbbe8cfeb528a6e2db19afca2f1a27afa291146a77157c6048cc64980fbf01f4c94559c486
SSDEEP 12288:egVnZB7EmxB0QnEhCZeCE4Va9lOybpjLMvL+WQoj9iTgEVcfMbQjTph8Q/:e0nn0QnEgeCBVix0ucfdv8Q
TLSH
T1B2D4234A6DF9E12BC0258B3D9A1F99C2071056D5DD12F2E77C5893220BE6A644A0F3FF
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

ransomware spyware stealer

Malware Config

Signatures

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\Control Panel\International\Geo\Nation	Pay 5000 Robux Ransomware.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\Control Panel\International\Geo\Nation	svchost.exe

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.url	svchost.exe

Executes dropped EXE 1 IoCs

pid	Process
3964	svchost.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

ConfuserEx .NET packer 3 IoCs

Detects ConfuserEx .NET packer.

resource	yara_rule
behavioral2/memory/1572-0-0x00000000008C0000-0x0000000000958000-memory.dmp	ConfuserEx
behavioral2/memory/1572-1-0x000000001B4B0000-0x000000001B54A000-memory.dmp	ConfuserEx
behavioral2/files/0x000600000001d8a6-9.dat	ConfuserEx

Sets desktop wallpaper using registry 2 TTPs 1 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\p6q24fnvc.jpg"	svchost.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings	svchost.exe

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

pid	Process
3052	NOTEPAD.EXE

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
3964	svchost.exe

Suspicious behavior: EnumeratesProcesses 47 IoCs

pid	Process
1572	Pay 5000 Robux Ransomware.exe
1572	Pay 5000 Robux Ransomware.exe
1572	Pay 5000 Robux Ransomware.exe
1572	Pay 5000 Robux Ransomware.exe
1572	Pay 5000 Robux Ransomware.exe
1572	Pay 5000 Robux Ransomware.exe
1572	Pay 5000 Robux Ransomware.exe
1572	Pay 5000 Robux Ransomware.exe
1572	Pay 5000 Robux Ransomware.exe
1572	Pay 5000 Robux Ransomware.exe
1572	Pay 5000 Robux Ransomware.exe
1572	Pay 5000 Robux Ransomware.exe
1572	Pay 5000 Robux Ransomware.exe
1572	Pay 5000 Robux Ransomware.exe
1572	Pay 5000 Robux Ransomware.exe
1572	Pay 5000 Robux Ransomware.exe
1572	Pay 5000 Robux Ransomware.exe
1572	Pay 5000 Robux Ransomware.exe
1572	Pay 5000 Robux Ransomware.exe
1572	Pay 5000 Robux Ransomware.exe
1572	Pay 5000 Robux Ransomware.exe
1572	Pay 5000 Robux Ransomware.exe
1572	Pay 5000 Robux Ransomware.exe
3964	svchost.exe
3964	svchost.exe
3964	svchost.exe
3964	svchost.exe
3964	svchost.exe
3964	svchost.exe
3964	svchost.exe
3964	svchost.exe
3964	svchost.exe
3964	svchost.exe
3964	svchost.exe
3964	svchost.exe
3964	svchost.exe
3964	svchost.exe
3964	svchost.exe
3964	svchost.exe
3964	svchost.exe
3964	svchost.exe
3964	svchost.exe
3964	svchost.exe
3964	svchost.exe
3964	svchost.exe
3964	svchost.exe
3964	svchost.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1572	Pay 5000 Robux Ransomware.exe
Token: SeDebugPrivilege	3964	svchost.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 1572 wrote to memory of 3964	1572	Pay 5000 Robux Ransomware.exe	96
PID 3964 wrote to memory of 3052	3964	svchost.exe	97

C:\Users\Admin\AppData\Local\Temp\Pay 5000 Robux Ransomware.exe
"C:\Users\Admin\AppData\Local\Temp\Pay 5000 Robux Ransomware.exe"
1⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1572
- C:\Users\Admin\AppData\Roaming\svchost.exe
  "C:\Users\Admin\AppData\Roaming\svchost.exe"
  2⤵
  - Checks computer location settings
  - Drops startup file
  - Executes dropped EXE
  - Sets desktop wallpaper using registry
  - Modifies registry class
  - Suspicious behavior: AddClipboardFormatListener
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3964
- - C:\Windows\system32\NOTEPAD.EXE
    "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Roaming\read_it.txt
    3⤵
    - Opens file in notepad (likely ransom note)
    PID:3052

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Credentials from Password Stores

1

T1555

Credentials from Web Browsers

1

T1555.003

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Defacement

1

T1491

Replay Monitor

Loading Replay Monitor...

Downloads

svchost.exe

Path C:\Users\Admin\AppData\Roaming\svchost.exe
Size 584KB
SHA256 21015517c1ced96b58b6597e50d1805610b48292cfba20c730ae69123f15d684
MD5 8dae31dc9349c0466dd5716629086efc
SHA1 10ba027460e9a4281271d644e09ab65e93df3d1d
SHA512 d2f3920337c3313d98413f77c3af98320abaf22763aa169739651bcbbe8cfeb528a6e2db19afca2f1a27afa291146a77157c6048cc64980fbf01f4c94559c486
SSDEEP 12288:egVnZB7EmxB0QnEhCZeCE4Va9lOybpjLMvL+WQoj9iTgEVcfMbQjTph8Q/:e0nn0QnEgeCBVix0ucfdv8Q
TLSH
T1B2D4234A6DF9E12BC0258B3D9A1F99C2071056D5DD12F2E77C5893220BE6A644A0F3FF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

read_it.txt

Path C:\Users\Admin\Music\read_it.txt
Size 521B
SHA256 8d0d2ce31f4bd9b13f5aa317b38441f7ebc4284a7f2a051b9d244002da1e112c
MD5 b45f3f2c73dff25a228cfb48415f35c0
SHA1 ac33e0bf83dd4f827d1e0101ed3a5675e256e9d1
SHA512 e91a3b6bc25791e3588332849f7d5b8e4c938ba58bbeb5667df961e11776e4e48f6c9b4256431c8bf353cba34448cbf0e511f8fd20bad7a99931221456b11231
TLSH
T15AF0055E6E870013192176A9711E70C19913F05C0375DB8D1835E67D79397A706F247C
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1572-0-0x00000000008C0000-0x0000000000958000-memory.dmp

Download

memory/1572-1-0x000000001B4B0000-0x000000001B54A000-memory.dmp

Download

memory/1572-2-0x0000000000FE0000-0x0000000000FE6000-memory.dmp

Download

memory/1572-3-0x00007FFB37650000-0x00007FFB37845000-memory.dmp

Download

memory/1572-4-0x00007FFB37650000-0x00007FFB37845000-memory.dmp

Download

memory/1572-17-0x00007FFB37650000-0x00007FFB37845000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads