8ab65ceef6b8a5d2d0c0fb3ddbe1c1756b5c224bafc8065c161424d63937721c

General

Target

8ab65ceef6b8a5d2d0c0fb3ddbe1c1756b5c224bafc8065c161424d63937721c.exe
Size

113KB
MD5

3bceadd4c2c546aba24e24307f1defcd
SHA1

81e4110a72821a1b1f01a3f3a8bf89188af40067
SHA256

8ab65ceef6b8a5d2d0c0fb3ddbe1c1756b5c224bafc8065c161424d63937721c
SHA512

fbe80ee6902b76a533e8662e580cf887e7a6735752731a53a6189d7b8c1e1c7c881d817a137c3553ab1b6f40c673887d83460d35d01ad0ace18a89c7f5bea525

Score

10^/10

ransomware persistence

Malware Config

Extracted

Path

C:\# !!!HELP_FILE!!! #.TXT

Ransom Note

===ENGLISH=== All of your files were encrypted using REVENGE Ransomware. The action required to restore the files. Your files are not lost, they can be returned to their normal state by decoding them. The only way to do this is to get the software and your personal decryption key. Using any other software that claims to be able to recover your files will result in corrupted or destroyed files. You can purchase the software and the decryption key by sending us an email with your ID. And we send instructions for payment . After payment, you receive the software to return all files. For proof, we can decrypt one file for free. Attach it to an e-mail. ===ITALIAN=== Tutti i file sono stati crittografati utilizzando REVENGE ransomware. L'azione richiesta per ripristinare i file. I file non sono persi, possono essere restituiti al loro normale stato di loro decodifica. L'unico modo per farlo è quello di ottenere il software e la decrittografia personale chiave. L'uso di qualsiasi altro software che sostiene di essere in grado di recuperare i file si tradurrà in file danneggiati o distrutti. È possibile acquistare la chiave di software e decifratura con l'invio di una e-mail con il tuo ID. E mandiamo le istruzioni per il pagamento. Dopo il pagamento, si riceve il software per ripristinare tutti i file. Per dimostrare che siamo in grado di decodificare il file. Inviaci un file di e-mail. ===GERMAN=== Alle Dateien wurden mit REVENGE Ransomware verschlüsselt. Die notwendigen Schritte, um die Dateien wiederherzustellen. Die Dateien werden nicht verloren, können sie dekodiert werden. Der einzige Weg, zu tun ist, um die Software zu erhalten, und den privaten Schlüssel zu entschlüsseln. Mit Software, die auf Ihre Dateien zu können behauptet, bewegen als Folge von beschädigten oder zerstörten Dateien wiederhergestellt werden. Sie können die Software und Entschlüsselungsschlüssel erwerben, indem Sie uns per E-Mail Ihre ID senden. Und wir werden Anweisungen für die Zahlung senden. Nach der Bezahlung werden Sie eine Rückkehr von Software erhalten, die alle Dateien wiederherstellen würde. Um zu beweisen, dass wir eine Datei kostenlos entschlüsseln kann. Anhängen einer Datei an eine E-Mail. ===POLISH=== Wszystkie pliki zostały zaszyfrowane przy użyciu REVENGE szkodnika. Konieczne działania w celu przywrócenia plików. Pliki nie są tracone, mogą one zostać zwrócone do swojego normalnego stanu poprzez ich dekodowania. Jedynym sposobem na to jest, aby oprogramowanie i swój osobisty klucz deszyfrowania. Korzystanie z innego oprogramowania, które twierdzi, że jest w stanie odzyskać pliki spowoduje uszkodzonych lub zniszczonych plików. Można kupić oprogramowanie i klucz deszyfrowania wysyłając do nas e-maila z ID. A my wyślemy instrukcje dotyczące płatności. Po dokonaniu płatności otrzymasz oprogramowanie do zwrotu plików. W celu udowodnienia, że możemy odszyfrować plik. Dołączyć go do wiadomości e-mail. ===KOREAN=== 모든 파일은 REVENGE Ransomware를 사용하여 암호화되었습니다. 파일을 복원하는 데 필요한 작업. 파일은 손실되지 않으며 디코딩하여 정상 상태로 되돌릴 수 있습니다. 이를 수행하는 유일한 방법은 소프트웨어와 개인 암호 해독 키를 얻는 것입니다. 파일을 복구 할 수 있다고 주장하는 다른 소프트웨어를 사용하면 파일이 손상되거나 파손됩니다. 신분증을 이메일로 보내 소프트웨어 및 암호 해독 키를 구입할 수 있습니다. 그리고 우리는 지불 지시를 보낸다. 지불 후 모든 파일을 반환하는 소프트웨어를 받게됩니다. 우리는 무료로 하나의 파일의 암호를 해독 할 수 있습니다. 전자 메일 파일을 보내 주시기 바랍니다. CONTACT E-MAILS: EMAIL: rev00@india.com EMAIL: revenge00@writeme.com EMAIL: rev_reserv@india.com

Emails

rev00@india.com

revenge00@writeme.com

rev_reserv@india.com

Signatures

Interacts with shadow copies 2 TTPs 2 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
ransomware

File Deletion
T1107

Inhibit System Recovery
T1490

Processes:

vssadmin.exevssadmin.exe

pid process

632 vssadmin.exe
1232 vssadmin.exe

pid	process
632	vssadmin.exe
1232	vssadmin.exe

Modifies registry class 1 IoCs

Processes:

8ab65ceef6b8a5d2d0c0fb3ddbe1c1756b5c224bafc8065c161424d63937721c.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-1231583446-2617009595-2137880041-1000_Classes\Local Settings	8ab65ceef6b8a5d2d0c0fb3ddbe1c1756b5c224bafc8065c161424d63937721c.exe

Enumerates connected drives 3 TTPs

Query Registry
T1012

Peripheral Device Discovery
T1120

System Information Discovery
T1082
Runs net.exe

Drops file in Program Files directory 2 IoCs

Processes:

8ab65ceef6b8a5d2d0c0fb3ddbe1c1756b5c224bafc8065c161424d63937721c.exe

description	ioc	process
File opened for modification	C:\Program Files\# !!!HELP_FILE!!! #.TXT	8ab65ceef6b8a5d2d0c0fb3ddbe1c1756b5c224bafc8065c161424d63937721c.exe
File opened for modification	C:\Program Files (x86)\# !!!HELP_FILE!!! #.TXT	8ab65ceef6b8a5d2d0c0fb3ddbe1c1756b5c224bafc8065c161424d63937721c.exe

Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware

File Deletion
T1107

Inhibit System Recovery
T1490

Drops file in Windows directory 1 IoCs

Processes:

8ab65ceef6b8a5d2d0c0fb3ddbe1c1756b5c224bafc8065c161424d63937721c.exe

description	ioc	process
File opened for modification	C:\Windows\# !!!HELP_FILE!!! #.TXT	8ab65ceef6b8a5d2d0c0fb3ddbe1c1756b5c224bafc8065c161424d63937721c.exe

Suspicious use of WriteProcessMemory 39 IoCs

Processes:

8ab65ceef6b8a5d2d0c0fb3ddbe1c1756b5c224bafc8065c161424d63937721c.execmd.execmd.execmd.execmd.exenet.exenet.exe

description	pid	process	target process
PID 3848 wrote to memory of 3556	3848	8ab65ceef6b8a5d2d0c0fb3ddbe1c1756b5c224bafc8065c161424d63937721c.exe	cmd.exe
PID 3848 wrote to memory of 3556	3848	8ab65ceef6b8a5d2d0c0fb3ddbe1c1756b5c224bafc8065c161424d63937721c.exe	cmd.exe
PID 3848 wrote to memory of 3556	3848	8ab65ceef6b8a5d2d0c0fb3ddbe1c1756b5c224bafc8065c161424d63937721c.exe	cmd.exe
PID 3848 wrote to memory of 692	3848	8ab65ceef6b8a5d2d0c0fb3ddbe1c1756b5c224bafc8065c161424d63937721c.exe	cmd.exe
PID 3848 wrote to memory of 692	3848	8ab65ceef6b8a5d2d0c0fb3ddbe1c1756b5c224bafc8065c161424d63937721c.exe	cmd.exe
PID 3848 wrote to memory of 692	3848	8ab65ceef6b8a5d2d0c0fb3ddbe1c1756b5c224bafc8065c161424d63937721c.exe	cmd.exe
PID 3848 wrote to memory of 1792	3848	8ab65ceef6b8a5d2d0c0fb3ddbe1c1756b5c224bafc8065c161424d63937721c.exe	cmd.exe
PID 3848 wrote to memory of 1792	3848	8ab65ceef6b8a5d2d0c0fb3ddbe1c1756b5c224bafc8065c161424d63937721c.exe	cmd.exe
PID 3848 wrote to memory of 1792	3848	8ab65ceef6b8a5d2d0c0fb3ddbe1c1756b5c224bafc8065c161424d63937721c.exe	cmd.exe
PID 3848 wrote to memory of 4012	3848	8ab65ceef6b8a5d2d0c0fb3ddbe1c1756b5c224bafc8065c161424d63937721c.exe	cmd.exe
PID 3848 wrote to memory of 4012	3848	8ab65ceef6b8a5d2d0c0fb3ddbe1c1756b5c224bafc8065c161424d63937721c.exe	cmd.exe
PID 3848 wrote to memory of 4012	3848	8ab65ceef6b8a5d2d0c0fb3ddbe1c1756b5c224bafc8065c161424d63937721c.exe	cmd.exe
PID 3848 wrote to memory of 3088	3848	8ab65ceef6b8a5d2d0c0fb3ddbe1c1756b5c224bafc8065c161424d63937721c.exe	cmd.exe
PID 3848 wrote to memory of 3088	3848	8ab65ceef6b8a5d2d0c0fb3ddbe1c1756b5c224bafc8065c161424d63937721c.exe	cmd.exe
PID 3848 wrote to memory of 3088	3848	8ab65ceef6b8a5d2d0c0fb3ddbe1c1756b5c224bafc8065c161424d63937721c.exe	cmd.exe
PID 3848 wrote to memory of 2224	3848	8ab65ceef6b8a5d2d0c0fb3ddbe1c1756b5c224bafc8065c161424d63937721c.exe	cmd.exe
PID 3848 wrote to memory of 2224	3848	8ab65ceef6b8a5d2d0c0fb3ddbe1c1756b5c224bafc8065c161424d63937721c.exe	cmd.exe
PID 3848 wrote to memory of 2224	3848	8ab65ceef6b8a5d2d0c0fb3ddbe1c1756b5c224bafc8065c161424d63937721c.exe	cmd.exe
PID 3556 wrote to memory of 632	3556	cmd.exe	vssadmin.exe
PID 3556 wrote to memory of 632	3556	cmd.exe	vssadmin.exe
PID 3556 wrote to memory of 632	3556	cmd.exe	vssadmin.exe
PID 3088 wrote to memory of 1232	3088	cmd.exe	vssadmin.exe
PID 3088 wrote to memory of 1232	3088	cmd.exe	vssadmin.exe
PID 3088 wrote to memory of 1232	3088	cmd.exe	vssadmin.exe
PID 4012 wrote to memory of 3568	4012	cmd.exe	net.exe
PID 4012 wrote to memory of 3568	4012	cmd.exe	net.exe
PID 4012 wrote to memory of 3568	4012	cmd.exe	net.exe
PID 3848 wrote to memory of 3428	3848	8ab65ceef6b8a5d2d0c0fb3ddbe1c1756b5c224bafc8065c161424d63937721c.exe	NOTEPAD.EXE
PID 3848 wrote to memory of 3428	3848	8ab65ceef6b8a5d2d0c0fb3ddbe1c1756b5c224bafc8065c161424d63937721c.exe	NOTEPAD.EXE
PID 3848 wrote to memory of 3428	3848	8ab65ceef6b8a5d2d0c0fb3ddbe1c1756b5c224bafc8065c161424d63937721c.exe	NOTEPAD.EXE
PID 2224 wrote to memory of 964	2224	cmd.exe	net.exe
PID 2224 wrote to memory of 964	2224	cmd.exe	net.exe
PID 2224 wrote to memory of 964	2224	cmd.exe	net.exe
PID 964 wrote to memory of 2336	964	net.exe	net1.exe
PID 964 wrote to memory of 2336	964	net.exe	net1.exe
PID 964 wrote to memory of 2336	964	net.exe	net1.exe
PID 3568 wrote to memory of 2656	3568	net.exe	net1.exe
PID 3568 wrote to memory of 2656	3568	net.exe	net1.exe
PID 3568 wrote to memory of 2656	3568	net.exe	net1.exe

Suspicious behavior: EnumeratesProcesses 48 IoCs

Processes:

8ab65ceef6b8a5d2d0c0fb3ddbe1c1756b5c224bafc8065c161424d63937721c.exe

pid	process
3848	8ab65ceef6b8a5d2d0c0fb3ddbe1c1756b5c224bafc8065c161424d63937721c.exe
3848	8ab65ceef6b8a5d2d0c0fb3ddbe1c1756b5c224bafc8065c161424d63937721c.exe
3848	8ab65ceef6b8a5d2d0c0fb3ddbe1c1756b5c224bafc8065c161424d63937721c.exe
3848	8ab65ceef6b8a5d2d0c0fb3ddbe1c1756b5c224bafc8065c161424d63937721c.exe
3848	8ab65ceef6b8a5d2d0c0fb3ddbe1c1756b5c224bafc8065c161424d63937721c.exe
3848	8ab65ceef6b8a5d2d0c0fb3ddbe1c1756b5c224bafc8065c161424d63937721c.exe
3848	8ab65ceef6b8a5d2d0c0fb3ddbe1c1756b5c224bafc8065c161424d63937721c.exe
3848	8ab65ceef6b8a5d2d0c0fb3ddbe1c1756b5c224bafc8065c161424d63937721c.exe
3848	8ab65ceef6b8a5d2d0c0fb3ddbe1c1756b5c224bafc8065c161424d63937721c.exe
3848	8ab65ceef6b8a5d2d0c0fb3ddbe1c1756b5c224bafc8065c161424d63937721c.exe
3848	8ab65ceef6b8a5d2d0c0fb3ddbe1c1756b5c224bafc8065c161424d63937721c.exe
3848	8ab65ceef6b8a5d2d0c0fb3ddbe1c1756b5c224bafc8065c161424d63937721c.exe
3848	8ab65ceef6b8a5d2d0c0fb3ddbe1c1756b5c224bafc8065c161424d63937721c.exe
3848	8ab65ceef6b8a5d2d0c0fb3ddbe1c1756b5c224bafc8065c161424d63937721c.exe
3848	8ab65ceef6b8a5d2d0c0fb3ddbe1c1756b5c224bafc8065c161424d63937721c.exe
3848	8ab65ceef6b8a5d2d0c0fb3ddbe1c1756b5c224bafc8065c161424d63937721c.exe
3848	8ab65ceef6b8a5d2d0c0fb3ddbe1c1756b5c224bafc8065c161424d63937721c.exe
3848	8ab65ceef6b8a5d2d0c0fb3ddbe1c1756b5c224bafc8065c161424d63937721c.exe
3848	8ab65ceef6b8a5d2d0c0fb3ddbe1c1756b5c224bafc8065c161424d63937721c.exe
3848	8ab65ceef6b8a5d2d0c0fb3ddbe1c1756b5c224bafc8065c161424d63937721c.exe
3848	8ab65ceef6b8a5d2d0c0fb3ddbe1c1756b5c224bafc8065c161424d63937721c.exe
3848	8ab65ceef6b8a5d2d0c0fb3ddbe1c1756b5c224bafc8065c161424d63937721c.exe
3848	8ab65ceef6b8a5d2d0c0fb3ddbe1c1756b5c224bafc8065c161424d63937721c.exe
3848	8ab65ceef6b8a5d2d0c0fb3ddbe1c1756b5c224bafc8065c161424d63937721c.exe
3848	8ab65ceef6b8a5d2d0c0fb3ddbe1c1756b5c224bafc8065c161424d63937721c.exe
3848	8ab65ceef6b8a5d2d0c0fb3ddbe1c1756b5c224bafc8065c161424d63937721c.exe
3848	8ab65ceef6b8a5d2d0c0fb3ddbe1c1756b5c224bafc8065c161424d63937721c.exe
3848	8ab65ceef6b8a5d2d0c0fb3ddbe1c1756b5c224bafc8065c161424d63937721c.exe
3848	8ab65ceef6b8a5d2d0c0fb3ddbe1c1756b5c224bafc8065c161424d63937721c.exe
3848	8ab65ceef6b8a5d2d0c0fb3ddbe1c1756b5c224bafc8065c161424d63937721c.exe
3848	8ab65ceef6b8a5d2d0c0fb3ddbe1c1756b5c224bafc8065c161424d63937721c.exe
3848	8ab65ceef6b8a5d2d0c0fb3ddbe1c1756b5c224bafc8065c161424d63937721c.exe
3848	8ab65ceef6b8a5d2d0c0fb3ddbe1c1756b5c224bafc8065c161424d63937721c.exe
3848	8ab65ceef6b8a5d2d0c0fb3ddbe1c1756b5c224bafc8065c161424d63937721c.exe
3848	8ab65ceef6b8a5d2d0c0fb3ddbe1c1756b5c224bafc8065c161424d63937721c.exe
3848	8ab65ceef6b8a5d2d0c0fb3ddbe1c1756b5c224bafc8065c161424d63937721c.exe
3848	8ab65ceef6b8a5d2d0c0fb3ddbe1c1756b5c224bafc8065c161424d63937721c.exe
3848	8ab65ceef6b8a5d2d0c0fb3ddbe1c1756b5c224bafc8065c161424d63937721c.exe
3848	8ab65ceef6b8a5d2d0c0fb3ddbe1c1756b5c224bafc8065c161424d63937721c.exe
3848	8ab65ceef6b8a5d2d0c0fb3ddbe1c1756b5c224bafc8065c161424d63937721c.exe
3848	8ab65ceef6b8a5d2d0c0fb3ddbe1c1756b5c224bafc8065c161424d63937721c.exe
3848	8ab65ceef6b8a5d2d0c0fb3ddbe1c1756b5c224bafc8065c161424d63937721c.exe
3848	8ab65ceef6b8a5d2d0c0fb3ddbe1c1756b5c224bafc8065c161424d63937721c.exe
3848	8ab65ceef6b8a5d2d0c0fb3ddbe1c1756b5c224bafc8065c161424d63937721c.exe
3848	8ab65ceef6b8a5d2d0c0fb3ddbe1c1756b5c224bafc8065c161424d63937721c.exe
3848	8ab65ceef6b8a5d2d0c0fb3ddbe1c1756b5c224bafc8065c161424d63937721c.exe
3848	8ab65ceef6b8a5d2d0c0fb3ddbe1c1756b5c224bafc8065c161424d63937721c.exe
3848	8ab65ceef6b8a5d2d0c0fb3ddbe1c1756b5c224bafc8065c161424d63937721c.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

vssvc.exe

description pid process

Token: SeBackupPrivilege 3588 vssvc.exe
Token: SeRestorePrivilege 3588 vssvc.exe
Token: SeAuditPrivilege 3588 vssvc.exe

description	pid	process
Token: SeBackupPrivilege	3588	vssvc.exe
Token: SeRestorePrivilege	3588	vssvc.exe
Token: SeAuditPrivilege	3588	vssvc.exe

Modifies service 2 TTPs 4 IoCs

persistence

Modify Registry

T1112

Modify Existing Service

T1031

Processes:

vssvc.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\Registry Writer	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\COM+ REGDB Writer	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\ASR Writer	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\Shadow Copy Optimization Writer	vssvc.exe

Adds Run entry to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

8ab65ceef6b8a5d2d0c0fb3ddbe1c1756b5c224bafc8065c161424d63937721c.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-1231583446-2617009595-2137880041-1000\Software\Microsoft\Windows\CurrentVersion\Run\MS Common User Interface = "\"C:\\ProgramData\\Microsofts\\Windows NT\\svchost.exe\""	8ab65ceef6b8a5d2d0c0fb3ddbe1c1756b5c224bafc8065c161424d63937721c.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1231583446-2617009595-2137880041-1000\Software\Microsoft\Windows\CurrentVersion\Run\MS Common User Interface Updater = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\8ab65ceef6b8a5d2d0c0fb3ddbe1c1756b5c224bafc8065c161424d63937721c.exe\""	8ab65ceef6b8a5d2d0c0fb3ddbe1c1756b5c224bafc8065c161424d63937721c.exe

C:\Users\Admin\AppData\Local\Temp\8ab65ceef6b8a5d2d0c0fb3ddbe1c1756b5c224bafc8065c161424d63937721c.exe
"C:\Users\Admin\AppData\Local\Temp\8ab65ceef6b8a5d2d0c0fb3ddbe1c1756b5c224bafc8065c161424d63937721c.exe"
1⤵
- Modifies registry class
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
- Suspicious behavior: EnumeratesProcesses
- Adds Run entry to start application
PID:3848

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /C vssadmin.exe Delete Shadows /All /Quiet
2⤵
- Suspicious use of WriteProcessMemory
PID:3556

C:\Windows\SysWOW64\vssadmin.exe
vssadmin.exe Delete Shadows /All /Quiet
3⤵
- Interacts with shadow copies
PID:632

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /C bcdedit /set {default} recoveryenabled No
2⤵
PID:692

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /C bcdedit /set {default} bootstatuspolicy ignoreallfailures
2⤵
PID:1792

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /C net stop vss
2⤵
- Suspicious use of WriteProcessMemory
PID:4012

C:\Windows\SysWOW64\net.exe
net stop vss
3⤵
- Suspicious use of WriteProcessMemory
PID:3568

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop vss
4⤵
PID:2656

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /C vssadmin.exe Delete Shadows /All /Quiet
2⤵
- Suspicious use of WriteProcessMemory
PID:3088