I literally can't think of a fitting pun - mrdec ransomware By f0wL Published: 2019-12-23 ยท Archived: 2026-04-05 13:58:04 UTC Mon 23 December 2019 in Ransomware I took notice of the Ransomware Family after a series of posts in the Bleeping Computer Forum. It employs techniques that are not seen very often in other ransomware samples, so the Analysis is actually quite difficult, but I'm hoping reading this is also a bit interesting atleast. Work in Progress Because Christmas and 36c3 is coming up in the next few I days I might have to push this analysis back a bit. A general disclaimer as always: downloading and running the samples linked below will lead to the encryption of your personal data, so be f$cking careful. Also check with your local laws as owning malware binaries/ sources might be illegal depending on where you live. MrDec @ AnyRun | VirusTotal | HybridAnalysis --> sha256 a700f9ced75c4143da6c4d1e09d6778e84ff570ea7d297fc130a0844e56c96ad Let's see what we're dealing with here and fire up Detect it easy: https://dissectingmalwa.re/i-literally-cant-think-of-a-fitting-pun-mrdec-ransomware.html Page 1 of 13 The Ransomnote is delivered via a .hta file. Like most other strains active in the last few month the criminals use two E-Mail addresses: a "primary" and a "backup". In this case they are using Protonmail and AOL which has been kind of a pattern for them (Tutanota is their third preferred service, a list of previously used mailboxes is available down below in the IOCs Section). https://dissectingmalwa.re/i-literally-cant-think-of-a-fitting-pun-mrdec-ransomware.html Page 2 of 13 Opening the note in another browser (Chrome in this case) won't show the instructions but a countdown timer. The victim won't be able to see the timer in most cases because when using Internet Explorer because scrolling is disabled :D Ransomnote in Chrome https://dissectingmalwa.re/i-literally-cant-think-of-a-fitting-pun-mrdec-ransomware.html Page 3 of 13 https://dissectingmalwa.re/i-literally-cant-think-of-a-fitting-pun-mrdec-ransomware.html Page 4 of 13 https://dissectingmalwa.re/i-literally-cant-think-of-a-fitting-pun-mrdec-ransomware.html Page 5 of 13 https://dissectingmalwa.re/i-literally-cant-think-of-a-fitting-pun-mrdec-ransomware.html Page 6 of 13 https://dissectingmalwa.re/i-literally-cant-think-of-a-fitting-pun-mrdec-ransomware.html Page 7 of 13 https://dissectingmalwa.re/i-literally-cant-think-of-a-fitting-pun-mrdec-ransomware.html Page 8 of 13 In the following screenshot you can see the "Process Killing" routine of MrDec. https://dissectingmalwa.re/i-literally-cant-think-of-a-fitting-pun-mrdec-ransomware.html Page 9 of 13 Last but not least we have a weird discovery. https://dissectingmalwa.re/i-literally-cant-think-of-a-fitting-pun-mrdec-ransomware.html Page 10 of 13 MITRE ATT&CK T1215 --> Kernel Modules and Extensions --> Persistence T1179 --> Hooking --> Persistence T1060 --> Registry Run Keys / Start Folder --> Persistence T1055 --> Process Injection --> Privilege Escalation T1179 --> Hooking --> Privilege Escalation T1055 --> Process Injection --> Defense Evasion T1045 --> Software Packing --> Defense Evasion T1112 --> Modify Registry --> Defense Evasion T1107 --> File Deletion --> Defense Evasion T1179 --> Hooking --> Credential Access T1012 --> Query Registry --> Discovery T1057 --> Process Discovery --> Discovery T1076 --> Remote Desktop Protocol --> Lateral Movement IOCs MrDec searchfiles.exe --> SHA256: a700f9ced75c4143da6c4d1e09d6778e84ff570ea7d297fc130a0844e56c96ad SSDEEP: 192:QEsTzSIs3HIuvipDu3uTtKTzTwmH+STs8fpgiRHIYGL4vKrGoO:QE0JoapKeTtKTz8s+S https://dissectingmalwa.re/i-literally-cant-think-of-a-fitting-pun-mrdec-ransomware.html Page 11 of 13 Registry Keys HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run unlock --> "c:\Decoding help.hta" searchfiles --> C:\windows\searchfiles.exe HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\DateTime orsa--> 06 02 00 00 00 A4 00 00 52 53 41 31 00 08 00 00 01 00 01 00 07 AF 04 2E A4 1A 3C 08 5E 32 C rsa --> 3C 53 81 1E 96 58 52 7C 67 7D 5F 60 14 15 29 1B 72 AC F5 F6 B7 B8 54 32 B7 63 1A 24 4F B2 HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System PromptOnSecureDesktop --> 0 EnableLUA --> 0 ConsentPromptBehaviorAdmin --> 0 HKEY_CLASSES_ROOT\[ID]PFOzv5ecUnxnfV9F[ID]_auto_file HKEY_CLASSES_ROOT\.[ID]PFOBHpZYUnxnfV9F[ID] --> HKEY_CLASSES_ROOT\[ID]PFOBHpZYUnxnfV9F[ID]_auto_file HKEY_CLASSES_ROOT\[ID]PFOBHpZYUnxnfV9F[ID]_auto_file\shell\open\command --> %SystemRoot%\System32\run HKEY_CLASSES_ROOT\[ID]PFOBHpZYUnxnfV9F[ID]_auto_file\shell\open\DropTarget --> {FFE2A43C-56B9-4bf5-9A HKEY_CLASSES_ROOT\[ID]PFOBHpZYUnxnfV9F[ID]_auto_file\shell\open --> @photoviewer.dll,-3043 HKEY_CLASSES_ROOT\[ID]PFOBHpZYUnxnfV9F[ID]_auto_file\shell\print\command --> %SystemRoot%\System32\ru HKEY_CLASSES_ROOT\[ID]PFOBHpZYUnxnfV9F[ID]_auto_file\shell\print\DropTarget --> {60fd46de-f830-4894-a HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.[ID]PFOBHpZYUnxnfV9F[I HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.[ID]PFOBHpZYUnxnfV9F[I E-Mail Addresses First campaign (May 2018): shine1@tutanota[.]com shine2@protonmail.com Second campaign (September/October 2019): JonStokton@Protonmail[.]com JonStokton@tutanota[.]com filessnoop@aol[.]com filessnoop@tutanota[.]com Third campaign: localgroup@protonmail[.]com localgroup@tutanota[.]com https://dissectingmalwa.re/i-literally-cant-think-of-a-fitting-pun-mrdec-ransomware.html Page 12 of 13 ZiCoyote@protonmail[.]com ZiCoyote@aol[.]com Forth campaign: mr.dec@protonmail[.]com mr.dec@tutanota[.]com Frederik888@protonmail[.]com Frederik888@aol[.]com Ransomnote V1 You are unlucky! The terrible virus has captured your files! For decoding please contact by email Fre Your [ID]PFOBHpZYUnxnfV9F[ID] 1. In the subject line, write your ID. 2. Attach 1-2 infected files that do not contain important information (less than 2 mb) are required to generate the decoder and restore the test file. Hurry up! Time is limited! Attention!!! At the end of this time, the private key for generating the decoder will be destroyed. Files will not Source: https://dissectingmalwa.re/i-literally-cant-think-of-a-fitting-pun-mrdec-ransomware.html https://dissectingmalwa.re/i-literally-cant-think-of-a-fitting-pun-mrdec-ransomware.html Page 13 of 13