59316fc8224622a24b95b621828b5704481d6ea5001e00a108f60716210d9881

Path

C:\$Recycle.Bin\S-1-5-21-2066881839-3229799743-3576549721-1000\w5t1le5-readme.txt

Ransom Note

OH NO! Your Files Have been Encrypted!! All of your personal files have been encrypted with AES 256 and RSA 2048 ciphers The only way to recover them is to send your Personal Installation ID to [email protected] !ANY ATTEMPT AT DECRYPTION COULD CAUSE PERMANENT DAMAGE TO YOUR FILES! Personal Installation ID -----BEGIN INSTALLATION ID----- EuplDiPOhA6cjCfIGswRgtpkK5V+PF4xcygUitVRS5FcM7g4mExgFmTFl4gpGxxyQVT5pk3nSfEIS u1zaNv4vJMmaqw9askuj2DP9cwbVi7cFGQApyIOxktaC4oofJE+D7ORr3UibUQhc4+AAGWaBc7PI pZnryr4V9NfufRlwBquxy57h4n16W2Ho1wTLOJ2mVRMX9GV0+4I8tkhlmgV/D3y7Uz3ZqFa9WYj6 BTT8i33mAGbmFaQaSuoJ6vxgbpL3/YXH48uRGh37URcZrPtxVFfXJ5wAdwgaO/fJLGXorD43vqFQ VzeMKMBxwGaPncFP5jBJpQHpjhKx8NPU8qoy+4zTipmPA8LrfoMyf4VFxLq6WdgwE8n9IvuaniIm bFySLMywk6EdLnnuNtYOQTqpR1buU8Pl3SYu7xtQYxbgjTTh9r8RyxI0cQrSiZ8lZbWU2fRa/X+/ EtA8CFIg3GxTJ6uFySfnTxttW7Iq6IfnsUQq6aLb0I/B3pq3re+1lec3kk7jM6W6d+oz6tzRa9h0 H8cpsnnboWUK4JjUmjn5Nm+89RMX+IerJL+Prb4h4/b2pvkYEaitlgXWp+T4eZZ9nYc7/aTOuV4W IB6F8jkSy/noXsjkrccbiU015ty7bL5Iuz1B+0wYWurb2avSXjLs/qG9RNQ7/9W28vniYGKTyQ= -----END INSTALLATION ID----- Extension: w5t1le5

Emails

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\w5t1le5-readme.txt	59316fc8224622a24b95b621828b5704481d6ea5001e00a108f60716210d9881.bin.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\w5t1le5-readme.txt	59316fc8224622a24b95b621828b5704481d6ea5001e00a108f60716210d9881.bin.exe

description	ioc	Process
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SwProvider_{b5946137-7b9f-4925-af80-51abd60b20d5}	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\Registry Writer	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\COM+ REGDB Writer	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\ASR Writer	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\Shadow Copy Optimization Writer	vssvc.exe

description	ioc	Process
File opened for modification	C:\Program Files\SelectMove.mhtml	59316fc8224622a24b95b621828b5704481d6ea5001e00a108f60716210d9881.bin.exe
File opened for modification	C:\Program Files\SuspendNew.jtx	59316fc8224622a24b95b621828b5704481d6ea5001e00a108f60716210d9881.bin.exe
File opened for modification	C:\Program Files\WriteSearch.midi	59316fc8224622a24b95b621828b5704481d6ea5001e00a108f60716210d9881.bin.exe
File created	C:\Program Files (x86)\w5t1le5-readme.txt	59316fc8224622a24b95b621828b5704481d6ea5001e00a108f60716210d9881.bin.exe
File opened for modification	C:\Program Files\InitializeWait.dot	59316fc8224622a24b95b621828b5704481d6ea5001e00a108f60716210d9881.bin.exe
File opened for modification	C:\Program Files\PushSync.wav	59316fc8224622a24b95b621828b5704481d6ea5001e00a108f60716210d9881.bin.exe
File created	C:\Program Files\w5t1le5-readme.txt	59316fc8224622a24b95b621828b5704481d6ea5001e00a108f60716210d9881.bin.exe
File opened for modification	C:\Program Files\MoveSuspend.MOD	59316fc8224622a24b95b621828b5704481d6ea5001e00a108f60716210d9881.bin.exe
File opened for modification	C:\Program Files\OptimizeRepair.WTV	59316fc8224622a24b95b621828b5704481d6ea5001e00a108f60716210d9881.bin.exe
File opened for modification	C:\Program Files\PublishStep.mp3	59316fc8224622a24b95b621828b5704481d6ea5001e00a108f60716210d9881.bin.exe
File opened for modification	C:\Program Files\CheckpointOut.ico	59316fc8224622a24b95b621828b5704481d6ea5001e00a108f60716210d9881.bin.exe
File opened for modification	C:\Program Files\ShowConvertFrom.dwg	59316fc8224622a24b95b621828b5704481d6ea5001e00a108f60716210d9881.bin.exe
File opened for modification	C:\Program Files\WriteShow.xlsx	59316fc8224622a24b95b621828b5704481d6ea5001e00a108f60716210d9881.bin.exe
File opened for modification	C:\Program Files\ConfirmShow.nfo	59316fc8224622a24b95b621828b5704481d6ea5001e00a108f60716210d9881.bin.exe
File opened for modification	C:\Program Files\PublishFind.7z	59316fc8224622a24b95b621828b5704481d6ea5001e00a108f60716210d9881.bin.exe
File opened for modification	C:\Program Files\UnprotectStop.exe	59316fc8224622a24b95b621828b5704481d6ea5001e00a108f60716210d9881.bin.exe
File opened for modification	C:\Program Files\ResizeNew.mp2	59316fc8224622a24b95b621828b5704481d6ea5001e00a108f60716210d9881.bin.exe
File opened for modification	C:\Program Files\RestartSplit.mov	59316fc8224622a24b95b621828b5704481d6ea5001e00a108f60716210d9881.bin.exe
File opened for modification	C:\Program Files\SkipMerge.vsdx	59316fc8224622a24b95b621828b5704481d6ea5001e00a108f60716210d9881.bin.exe
File opened for modification	C:\Program Files\SplitRestart.rmi	59316fc8224622a24b95b621828b5704481d6ea5001e00a108f60716210d9881.bin.exe
File opened for modification	C:\Program Files\SubmitSave.avi	59316fc8224622a24b95b621828b5704481d6ea5001e00a108f60716210d9881.bin.exe
File opened for modification	C:\Program Files\FormatHide.mp3	59316fc8224622a24b95b621828b5704481d6ea5001e00a108f60716210d9881.bin.exe
File opened for modification	C:\Program Files\RemoveReceive.png	59316fc8224622a24b95b621828b5704481d6ea5001e00a108f60716210d9881.bin.exe
File opened for modification	C:\Program Files\RequestConvertFrom.xhtml	59316fc8224622a24b95b621828b5704481d6ea5001e00a108f60716210d9881.bin.exe
File opened for modification	C:\Program Files\UseJoin.bat	59316fc8224622a24b95b621828b5704481d6ea5001e00a108f60716210d9881.bin.exe
File opened for modification	C:\Program Files\DisconnectSearch.wma	59316fc8224622a24b95b621828b5704481d6ea5001e00a108f60716210d9881.bin.exe
File opened for modification	C:\Program Files\MountStart.dib	59316fc8224622a24b95b621828b5704481d6ea5001e00a108f60716210d9881.bin.exe
File opened for modification	C:\Program Files\SyncResolve.001	59316fc8224622a24b95b621828b5704481d6ea5001e00a108f60716210d9881.bin.exe
File opened for modification	C:\Program Files\RequestPing.m4a	59316fc8224622a24b95b621828b5704481d6ea5001e00a108f60716210d9881.bin.exe
File opened for modification	C:\Program Files\ResumeCompare.vsdm	59316fc8224622a24b95b621828b5704481d6ea5001e00a108f60716210d9881.bin.exe
File opened for modification	C:\Program Files\UnpublishSync.WTV	59316fc8224622a24b95b621828b5704481d6ea5001e00a108f60716210d9881.bin.exe
File opened for modification	C:\Program Files\DismountDisconnect.gif	59316fc8224622a24b95b621828b5704481d6ea5001e00a108f60716210d9881.bin.exe
File opened for modification	C:\Program Files\HideUnprotect.AAC	59316fc8224622a24b95b621828b5704481d6ea5001e00a108f60716210d9881.bin.exe
File opened for modification	C:\Program Files\PublishProtect.xltm	59316fc8224622a24b95b621828b5704481d6ea5001e00a108f60716210d9881.bin.exe

description	ioc	Process
File opened for modification	C:\Windows\PFRO.log	59316fc8224622a24b95b621828b5704481d6ea5001e00a108f60716210d9881.bin.exe
File opened for modification	C:\Windows\explorer.exe	59316fc8224622a24b95b621828b5704481d6ea5001e00a108f60716210d9881.bin.exe
File opened for modification	C:\Windows\DtcInstall.log	59316fc8224622a24b95b621828b5704481d6ea5001e00a108f60716210d9881.bin.exe
File opened for modification	C:\Windows\setupact.log	59316fc8224622a24b95b621828b5704481d6ea5001e00a108f60716210d9881.bin.exe
File opened for modification	C:\Windows\setuperr.log	59316fc8224622a24b95b621828b5704481d6ea5001e00a108f60716210d9881.bin.exe
File opened for modification	C:\Windows\splwow64.exe	59316fc8224622a24b95b621828b5704481d6ea5001e00a108f60716210d9881.bin.exe
File opened for modification	C:\Windows\WMSysPr9.prx	59316fc8224622a24b95b621828b5704481d6ea5001e00a108f60716210d9881.bin.exe
File opened for modification	C:\Windows\Professional.xml	59316fc8224622a24b95b621828b5704481d6ea5001e00a108f60716210d9881.bin.exe
File opened for modification	C:\Windows\bfsvc.exe	59316fc8224622a24b95b621828b5704481d6ea5001e00a108f60716210d9881.bin.exe
File opened for modification	C:\Windows\write.exe	59316fc8224622a24b95b621828b5704481d6ea5001e00a108f60716210d9881.bin.exe
File opened for modification	C:\Windows\mib.bin	59316fc8224622a24b95b621828b5704481d6ea5001e00a108f60716210d9881.bin.exe
File opened for modification	C:\Windows\HelpPane.exe	59316fc8224622a24b95b621828b5704481d6ea5001e00a108f60716210d9881.bin.exe
File opened for modification	C:\Windows\notepad.exe	59316fc8224622a24b95b621828b5704481d6ea5001e00a108f60716210d9881.bin.exe
File opened for modification	C:\Windows\lsasetup.log	59316fc8224622a24b95b621828b5704481d6ea5001e00a108f60716210d9881.bin.exe
File opened for modification	C:\Windows\WindowsUpdate.log	59316fc8224622a24b95b621828b5704481d6ea5001e00a108f60716210d9881.bin.exe
File opened for modification	C:\Windows\winhlp32.exe	59316fc8224622a24b95b621828b5704481d6ea5001e00a108f60716210d9881.bin.exe
File opened for modification	C:\Windows\WindowsShell.Manifest	59316fc8224622a24b95b621828b5704481d6ea5001e00a108f60716210d9881.bin.exe
File created	C:\Windows\w5t1le5-readme.txt	59316fc8224622a24b95b621828b5704481d6ea5001e00a108f60716210d9881.bin.exe
File opened for modification	C:\Windows\regedit.exe	59316fc8224622a24b95b621828b5704481d6ea5001e00a108f60716210d9881.bin.exe
File opened for modification	C:\Windows\hh.exe	59316fc8224622a24b95b621828b5704481d6ea5001e00a108f60716210d9881.bin.exe

pid	Process
3848	powershell.exe
3024	powershell.exe
3024	powershell.exe
3848	powershell.exe
3024	powershell.exe
3848	powershell.exe

description	pid	Process
Token: SeDebugPrivilege	2896	59316fc8224622a24b95b621828b5704481d6ea5001e00a108f60716210d9881.bin.exe
Token: SeDebugPrivilege	3848	powershell.exe
Token: SeDebugPrivilege	3024	powershell.exe
Token: SeIncreaseQuotaPrivilege	3024	powershell.exe
Token: SeSecurityPrivilege	3024	powershell.exe
Token: SeTakeOwnershipPrivilege	3024	powershell.exe
Token: SeLoadDriverPrivilege	3024	powershell.exe
Token: SeSystemProfilePrivilege	3024	powershell.exe
Token: SeSystemtimePrivilege	3024	powershell.exe
Token: SeProfSingleProcessPrivilege	3024	powershell.exe
Token: SeIncBasePriorityPrivilege	3024	powershell.exe
Token: SeCreatePagefilePrivilege	3024	powershell.exe
Token: SeBackupPrivilege	3024	powershell.exe
Token: SeRestorePrivilege	3024	powershell.exe
Token: SeShutdownPrivilege	3024	powershell.exe
Token: SeDebugPrivilege	3024	powershell.exe
Token: SeSystemEnvironmentPrivilege	3024	powershell.exe
Token: SeIncreaseQuotaPrivilege	3848	powershell.exe
Token: SeRemoteShutdownPrivilege	3024	powershell.exe
Token: SeSecurityPrivilege	3848	powershell.exe
Token: SeUndockPrivilege	3024	powershell.exe
Token: SeTakeOwnershipPrivilege	3848	powershell.exe
Token: SeManageVolumePrivilege	3024	powershell.exe
Token: SeLoadDriverPrivilege	3848	powershell.exe
Token: 33	3024	powershell.exe
Token: SeSystemProfilePrivilege	3848	powershell.exe
Token: 34	3024	powershell.exe
Token: SeSystemtimePrivilege	3848	powershell.exe
Token: 35	3024	powershell.exe
Token: SeProfSingleProcessPrivilege	3848	powershell.exe
Token: 36	3024	powershell.exe
Token: SeIncBasePriorityPrivilege	3848	powershell.exe
Token: SeCreatePagefilePrivilege	3848	powershell.exe
Token: SeBackupPrivilege	3848	powershell.exe
Token: SeRestorePrivilege	3848	powershell.exe
Token: SeShutdownPrivilege	3848	powershell.exe
Token: SeDebugPrivilege	3848	powershell.exe
Token: SeSystemEnvironmentPrivilege	3848	powershell.exe
Token: SeRemoteShutdownPrivilege	3848	powershell.exe
Token: SeUndockPrivilege	3848	powershell.exe
Token: SeManageVolumePrivilege	3848	powershell.exe
Token: 33	3848	powershell.exe
Token: 34	3848	powershell.exe
Token: 35	3848	powershell.exe
Token: 36	3848	powershell.exe
Token: SeBackupPrivilege	512	vssvc.exe
Token: SeRestorePrivilege	512	vssvc.exe
Token: SeAuditPrivilege	512	vssvc.exe
Token: SeIncreaseQuotaPrivilege	3848	powershell.exe
Token: SeSecurityPrivilege	3848	powershell.exe
Token: SeTakeOwnershipPrivilege	3848	powershell.exe
Token: SeLoadDriverPrivilege	3848	powershell.exe
Token: SeSystemProfilePrivilege	3848	powershell.exe
Token: SeSystemtimePrivilege	3848	powershell.exe
Token: SeProfSingleProcessPrivilege	3848	powershell.exe
Token: SeIncBasePriorityPrivilege	3848	powershell.exe
Token: SeCreatePagefilePrivilege	3848	powershell.exe
Token: SeBackupPrivilege	3848	powershell.exe
Token: SeRestorePrivilege	3848	powershell.exe
Token: SeShutdownPrivilege	3848	powershell.exe
Token: SeDebugPrivilege	3848	powershell.exe
Token: SeSystemEnvironmentPrivilege	3848	powershell.exe
Token: SeRemoteShutdownPrivilege	3848	powershell.exe
Token: SeUndockPrivilege	3848	powershell.exe
Token: SeManageVolumePrivilege	3848	powershell.exe
Token: 33	3848	powershell.exe
Token: 34	3848	powershell.exe
Token: 35	3848	powershell.exe
Token: 36	3848	powershell.exe
Token: SeIncreaseQuotaPrivilege	3024	powershell.exe
Token: SeSecurityPrivilege	3024	powershell.exe
Token: SeTakeOwnershipPrivilege	3024	powershell.exe
Token: SeLoadDriverPrivilege	3024	powershell.exe
Token: SeSystemProfilePrivilege	3024	powershell.exe
Token: SeSystemtimePrivilege	3024	powershell.exe
Token: SeProfSingleProcessPrivilege	3024	powershell.exe
Token: SeIncBasePriorityPrivilege	3024	powershell.exe
Token: SeCreatePagefilePrivilege	3024	powershell.exe
Token: SeBackupPrivilege	3024	powershell.exe
Token: SeRestorePrivilege	3024	powershell.exe
Token: SeShutdownPrivilege	3024	powershell.exe
Token: SeDebugPrivilege	3024	powershell.exe
Token: SeSystemEnvironmentPrivilege	3024	powershell.exe
Token: SeRemoteShutdownPrivilege	3024	powershell.exe
Token: SeUndockPrivilege	3024	powershell.exe
Token: SeManageVolumePrivilege	3024	powershell.exe
Token: 33	3024	powershell.exe
Token: 34	3024	powershell.exe
Token: 35	3024	powershell.exe
Token: 36	3024	powershell.exe

description	pid	Process	procid_target
PID 2896 wrote to memory of 3848	2896	59316fc8224622a24b95b621828b5704481d6ea5001e00a108f60716210d9881.bin.exe	67
PID 2896 wrote to memory of 3848	2896	59316fc8224622a24b95b621828b5704481d6ea5001e00a108f60716210d9881.bin.exe	67
PID 2896 wrote to memory of 3024	2896	59316fc8224622a24b95b621828b5704481d6ea5001e00a108f60716210d9881.bin.exe	68
PID 2896 wrote to memory of 3024	2896	59316fc8224622a24b95b621828b5704481d6ea5001e00a108f60716210d9881.bin.exe	68
PID 2896 wrote to memory of 1256	2896	59316fc8224622a24b95b621828b5704481d6ea5001e00a108f60716210d9881.bin.exe	75
PID 2896 wrote to memory of 1256	2896	59316fc8224622a24b95b621828b5704481d6ea5001e00a108f60716210d9881.bin.exe	75

Analysis

Sharing

General

Malware Config

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted