a2de3fcae1e3bedd417e90dd4bac8644165632e1bae2c7cdaa3f500c9f19bfa7

General

Target
win.bin.exe
Size 4.7MB
Sample200903-nn7y32a41e
SHA256 f8766ecc7775a6b14e6e46ef1e162cb609179c7a44e39a393c8fcd2ef0cd8ff0
MD5 5c53adced5f26c4d2e5112316a67ffd1
SHA1 c64636e272b0d1e881c68fda45df4f9c19d4aadc
SHA512 78687f9f8d1364e4caf6a3d553b3559ccf0e5d5443494fbc14639ec2f98e25e999962985bb71477fa1773a75b74e367388f1f628ccf85de531f39dad9815eead
MD5 SHA1 SHA512

Score

10^/10

ransomware

Path

Ransom Note

Hello IF YOU ARE READING THIS, IT MEANS YOUR DATA IS ENCRYPTED AND YOUR PRIVATE SENSIVITIVE INFORMATION WAS STOLEN! READ CAREFULLY THE WHOLE INSTRUCTIONS TO AVOID PROBLEMS WITH YOUR DATA YOU HAVE TO CONTACT US IMMEDIATELY TO RESOLVE THIS ISSUE AND MAKE A DEAL! !!!WARNING!!! DO NOT Modify, Rename, Copy or Move any file. You can DAMAGE them and decryption will be impossible! DO NOT Use any third-party or public decryption software, it also may DAMAGE files. DO NOT SHUTDOWN or RESET your system, it can damage files. There is ONLY ONE possible way to get back your files Do not waste your time, contact us and pay for special DECRYPTION KEY. The key is all you need. For your guarantee we will decrypt 2 of your files for free, as a proof that it works. Your network was fully COMPROMISED! We Can discuss how to secure it as a bonus. The data that we gathered could be published in MASS MEDIA for BREAKING NEWS! If we make a deal everything would be kept in secret and all your data will be restored. I could make them public them if you decide not to pay. contact us immediately: [email protected]

Emails

Drops desktop.ini file(s) 3 IoCs

description	ioc	Process
File created	C:\users\Public\Downloads\desktop.ini	win.bin.exe
File created	C:\users\Public\Documents\desktop.ini	win.bin.exe
File created	C:\users\Public\Desktop\desktop.ini	win.bin.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\ServiceProfiles\LocalService\winhttp\cachev3.dat	svchost.exe

Modifies data under HKEY_USERS 5 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0e-3e-6f-2c-c8-c7	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0e-3e-6f-2c-c8-c7\WpadDecisionReason = "1"	svchost.exe
Set value (data)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0e-3e-6f-2c-c8-c7\WpadDecisionTime = 577c3c17fc81d601	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0e-3e-6f-2c-c8-c7\WpadDecision = "0"	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad	svchost.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1164	svchost.exe
Token: SeCreatePagefilePrivilege	1164	svchost.exe

C:\Users\Admin\AppData\Local\Temp\win.bin.exe
"C:\Users\Admin\AppData\Local\Temp\win.bin.exe"
1⤵
- Drops desktop.ini file(s)
PID:3832

memory/3832-0-0x0000000000400000-0x00000000008F2000-memory.dmp

Download