General

  • Target

    GZTJoxx.exe

  • Size

    88KB

  • Sample

    210122-s195dsrzqn

  • MD5

    19f207b20b1d2a05aba1a1eb59da54d2

  • SHA1

    8d75108ec34fd79f8336041d5ff31443cc527add

  • SHA256

    8e775324fc69a677394cf6d079d1d45bf53af10acd683bda53e5f86a8a192393

  • SHA512

    6a6b97e5f4543437270628af70a67e51a32d1ad9afbc0f19611d0131d9e84154f8525e3aeeb41c82f1c4437694be898b7ef520ac8eddf9b227f3d1013e57f749

Malware Config

Extracted

Path

C:\Users\Admin\AppData\Local\Temp\RESTORE_FILES_INFO.txt

Ransom Note
Don't worry, you can return all your files! All your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key. The only method of recovering files is to purchase decrypt tool and unique key for you. This software will decrypt all your encrypted files. What guarantees you have? You can send one of your encrypted file from your PC and we decrypt it for free. But we can decrypt only 1 file for free. File must not contain valuable information. We also downloaded your corporate files (databases, tables, accounting information, etc.) and we will have to publish them if you do not agree to cooperation. To get this software you need write on our e-mail: workplus111@protonmail.com Reserve e-mail address to contact us: worker400@airmail.cc Key Identifier: ZrtC2g8mLlxHion6LFaKfoGEHSl8cQJ+3Vha+GRXgl8i1/4rnOdVZ2K5FAKpBbqV2M2kpnU3ZLq5ftaQHeS3JqSWgjW+90CW8kp5HJqNRX8Aynm61r2k3heJTrsMfHJLIkzMafo1Xl9ppU4G+bu98wwxaivaUjDu8wxU9+a9glYie9sxA4sqjOr+enYPlzcEkj4LafgWpwvyeSq8EuSAd2xuyjnqQKmPiOfD6OQNXwf5inNaz6aw12TUAoGbcGvqJw5hsCKuRxkIs4h7xRZdDQiaE/2+f3a1A6kiAdWKRB38vnlt5un7Oezv8p5a7v4Hn1XGdx4DRtZxwn7VReRtVJXXVG6PIbW0o58nVohEu2BT0Bko5Ec7Zd0fM77FHJxfYf9rsT3DPlOGqIJnViQER/UqDuuBFZByituO1lDlVGs155owt8UVFV9oBIsybcz1eqjSY5X3BjGSZ0IHhtKXomKtvLEqaUd1M2FAqxaIo8E/XplQwfM96au5a3MNC55vIGzUfZyOY3UHKGN7YMBcI9dATfof/gv84BqXCj61f8NfUlZJ6Il8W36XKf1OHrVa5/7hmaqDvnEjpNSZSAq5dsLnRBgQsRYGyt+a8B/p/hgzyXO4kVh0cP13uczl0sPfl0zEgxut4XIzFELodGUkZl20d2qfUDON/m6XP9Vq/tY=
Emails

workplus111@protonmail.com

worker400@airmail.cc

Extracted

Path

C:\Users\Admin\Desktop\RESTORE_FILES_INFO.txt

Ransom Note
Don't worry, you can return all your files! All your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key. The only method of recovering files is to purchase decrypt tool and unique key for you. This software will decrypt all your encrypted files. What guarantees you have? You can send one of your encrypted file from your PC and we decrypt it for free. But we can decrypt only 1 file for free. File must not contain valuable information. We also downloaded your corporate files (databases, tables, accounting information, etc.) and we will have to publish them if you do not agree to cooperation. To get this software you need write on our e-mail: workplus111@protonmail.com Reserve e-mail address to contact us: worker400@airmail.cc Key Identifier: ZrtC2g8mLlxHion6LFaKfoGEHSl8cQJ+3Vha+GRXgl8i1/4rnOdVZ2K5FAKpBbqV2M2kpnU3ZLq5ftaQHeS3JqSWgjW+90CW8kp5HJqNRX8Aynm61r2k3heJTrsMfHJLIkzMafo1Xl9ppU4G+bu98wwxaivaUjDu8wxU9+a9glYie9sxA4sqjOr+enYPlzcEkj4LafgWpwvyeSq8EuSAd2xuyjnqQKmPiOfD6OQNXwf5inNaz6aw12TUAoGbcGvqJw5hsCKuRxkIs4h7xRZdDQiaE/2+f3a1A6kiAdWKRB38vnlt5un7Oezv8p5a7v4Hn1XGdx4DRtZxwn7VReRtVJXXVG6PIbW0o58nVohEu2BT0Bko5Ec7Zd0fM77FHJxfYf9rsT3DPlOGqIJnViQER/UqDuuBFZByituO1lDlVGs155owt8UVFV9oBIsybcz1eqjSY5X3BjGSZ0IHhtKXomKtvLEqaUd1M2FAqxaIo8E/XplQwfM96au5a3MNC55vIGzUfZyOY3UHKGN7YMBcI9dATfof/gv84BqXCj61f8NfUlZJ6Il8W36XKf1OHrVa5/7hmaqDvnEjpNSZSAq5dsLnRBgQsRYGyt+a8B/p/hgzyXO4kVh0cP13uczl0sPfl0zEgxut4XIzFELodGUkZl20d2qfUDON/m6XP9Vq/tY= Number of files that were processed is: 63
Emails

workplus111@protonmail.com

worker400@airmail.cc

Extracted

Path

C:\Users\Admin\AppData\Local\Temp\RESTORE_FILES_INFO.txt

Ransom Note
Don't worry, you can return all your files! All your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key. The only method of recovering files is to purchase decrypt tool and unique key for you. This software will decrypt all your encrypted files. What guarantees you have? You can send one of your encrypted file from your PC and we decrypt it for free. But we can decrypt only 1 file for free. File must not contain valuable information. We also downloaded your corporate files (databases, tables, accounting information, etc.) and we will have to publish them if you do not agree to cooperation. To get this software you need write on our e-mail: workplus111@protonmail.com Reserve e-mail address to contact us: worker400@airmail.cc Key Identifier: ruIEJYipPBQ0Ge9KOXDjKrypFF0FBvH/RAPJO2HxUwIjOtuklxgya3h2mH8qTZBPW7QoG4GN5cIOFwEGTzWdPwdfAosHeWBy6Oi7/PrWkiWWK1pIcySXcu4t2SeftV2RrCZZ/OjcieCKrXuBP1QIdYyi2dtWqybztRFtl7/V1gpYCpfKn373aDJwJekNizNDb3YEY7NJxBzFOUzR+rtl2tpjpeQSi/raFU/TkcXD+pphFW25Ueg9FOFkd2XQ6D6weA/9KEnHjp4Jy4o1XodXn/Tkxv8E/jGj41Bc4jwbWNQxTHvnYNIjR6NDkMZYCavwThvr01KMES36fbXH6mw26XSXoCAtA0zxPOwMBNuTJ2SHr7jUOG+zB0xSwlypj3rE2vpES6zk6Jazd8xWaw3ZaS+CuSMKL0FxafC9+J4dnCX4X67F4U69w/Qv4a4fv1Mbds8tslxta85qyZmA4v9nBhdrz+0lQc6ghvVenIOj1hYWWobq/js+4mLrjukRJemCnQXfmlkpyNKIvIRBMKMDUKR5ZVc/Vd2ltouV0DIqFySQBLtMcfT7K9TEJnBTptk5bWBAKs1XotD7ZBvqUzR1UiytwyPHeK+SsFf+d4O8XzQpcK8F8HrX1pnLfphXYlOfYG18IPkRYcpD4hazHS0ivqM+V2cRV4eL/UW0h9Vx6eM=
Emails

workplus111@protonmail.com

worker400@airmail.cc

Extracted

Path

C:\Users\Admin\Desktop\RESTORE_FILES_INFO.txt

Ransom Note
Don't worry, you can return all your files! All your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key. The only method of recovering files is to purchase decrypt tool and unique key for you. This software will decrypt all your encrypted files. What guarantees you have? You can send one of your encrypted file from your PC and we decrypt it for free. But we can decrypt only 1 file for free. File must not contain valuable information. We also downloaded your corporate files (databases, tables, accounting information, etc.) and we will have to publish them if you do not agree to cooperation. To get this software you need write on our e-mail: workplus111@protonmail.com Reserve e-mail address to contact us: worker400@airmail.cc Key Identifier: ruIEJYipPBQ0Ge9KOXDjKrypFF0FBvH/RAPJO2HxUwIjOtuklxgya3h2mH8qTZBPW7QoG4GN5cIOFwEGTzWdPwdfAosHeWBy6Oi7/PrWkiWWK1pIcySXcu4t2SeftV2RrCZZ/OjcieCKrXuBP1QIdYyi2dtWqybztRFtl7/V1gpYCpfKn373aDJwJekNizNDb3YEY7NJxBzFOUzR+rtl2tpjpeQSi/raFU/TkcXD+pphFW25Ueg9FOFkd2XQ6D6weA/9KEnHjp4Jy4o1XodXn/Tkxv8E/jGj41Bc4jwbWNQxTHvnYNIjR6NDkMZYCavwThvr01KMES36fbXH6mw26XSXoCAtA0zxPOwMBNuTJ2SHr7jUOG+zB0xSwlypj3rE2vpES6zk6Jazd8xWaw3ZaS+CuSMKL0FxafC9+J4dnCX4X67F4U69w/Qv4a4fv1Mbds8tslxta85qyZmA4v9nBhdrz+0lQc6ghvVenIOj1hYWWobq/js+4mLrjukRJemCnQXfmlkpyNKIvIRBMKMDUKR5ZVc/Vd2ltouV0DIqFySQBLtMcfT7K9TEJnBTptk5bWBAKs1XotD7ZBvqUzR1UiytwyPHeK+SsFf+d4O8XzQpcK8F8HrX1pnLfphXYlOfYG18IPkRYcpD4hazHS0ivqM+V2cRV4eL/UW0h9Vx6eM= Number of files that were processed is: 144
Emails

workplus111@protonmail.com

worker400@airmail.cc

Targets

    • Target

      GZTJoxx.exe

    • Size

      88KB

    • MD5

      19f207b20b1d2a05aba1a1eb59da54d2

    • SHA1

      8d75108ec34fd79f8336041d5ff31443cc527add

    • SHA256

      8e775324fc69a677394cf6d079d1d45bf53af10acd683bda53e5f86a8a192393

    • SHA512

      6a6b97e5f4543437270628af70a67e51a32d1ad9afbc0f19611d0131d9e84154f8525e3aeeb41c82f1c4437694be898b7ef520ac8eddf9b227f3d1013e57f749

    • Modifies Windows Defender Real-time Protection settings

    • TeslaCrypt, AlphaCrypt

      Ransomware based on CryptoLocker. Shut down by the developers in 2016.

    • Executes dropped EXE

    • Modifies Windows Firewall

    • Modifies extensions of user files

      Ransomware generally changes the extension on encrypted files.

    • Drops startup file

    • Loads dropped DLL

    • Modifies file permissions

    • Windows security modification

MITRE ATT&CK Matrix ATT&CK v6

Persistence

Modify Existing Service

2
T1031

Defense Evasion

Modify Registry

4
T1112

Disabling Security Tools

2
T1089

File Permissions Modification

1
T1222

Discovery

System Information Discovery

1
T1082

Remote System Discovery

2
T1018

Tasks