General

  • Target

    wqm58yk7.exe

  • Size

    104KB

  • Sample

    210122-vrb63wpxca

  • MD5

    48ea3794091a9f17e12f5c1a90e1f7d7

  • SHA1

    1bb17eef59764e84f95b7a5c0aad649b8517ee43

  • SHA256

    dcd725c415cebc7df170edf49af18d6f86e76ef75185737de5959405f4aecc56

  • SHA512

    0355be6a2b2cf58d4ca5b11de5f84803240587937cd28d064df20ac38c945352e14c78e21006824114f67ede71be3ab27cc27b05759fc23a1fb8dcfa31a7244f

Malware Config

Extracted

Path

C:\Users\Admin\AppData\Local\Temp\RESTORE_FILES_INFO.txt

Ransom Note
Don't worry, you can return all your files! All your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key. The only method of recovering files is to purchase decrypt tool and unique key for you. This software will decrypt all your encrypted files. What guarantees you have? You can send one of your encrypted file from your PC and we decrypt it for free. But we can decrypt only 1 file for free. File must not contain valuable information. We also downloaded your corporate files (databases, tables, accounting information, etc.) and we will have to publish them if you do not agree to cooperation. To get this software you need write on our e-mail: workplus111@protonmail.com Reserve e-mail address to contact us: worker400@airmail.cc Key Identifier: rfajKDsRKQ4lXn8u18Tpawm243lfDZS7LlyjWNDqeDVq1prpJkqzkruLUaQFiXqDWB4KlkSG0P6gk6AUl01GI/zUEGHkAdT/m2/8AjKs1pt1nd9+9dKg/LpZnm/Lks4s+2hpWcex84e70iRxFEjUEJ6RVlOSaBz/FYUX5Yen1mfwCHVvexeHd4MR9wDec12Bo/2wIFx4uVl3DgKzBCR0pD0eCNwAIlYCvAMi5IMvD4RrlQdk4VWtzbM1YNLgAtNETWlDrwnRvU/cXGdMxYtuXaIKwHvOoi59oCKzFudlfjAsfmEc+Gzm0hmtvCnG5a5PCHvj9GMHXzFS6XjImy6+ofRxnbWBvzkku5t3pF9PTSIORPYHKL9rict+ceLplAtJfUX31MW4LPSD8RN7nAzror3UkqWviXgCSYsGkjNnnFiC4stRAorh0Ddufw/Irb5tM19nUf+T5qngsscXyQTvBAEhul2t3JgGE15kUquQOKIAfsmdo9IO+YOoTxjQKpHGvHrdLYL74y6kD7ZZJWW9w/fFN3nIGUB4et/NCy5wX33qQ4J2xbfd25lBBLtux+Qj+ygyHpRM+0rPtS642nXgOkU8HIkQjTi7EHFT4TMab1EiU9WNWdpleaRD4KA8e8WY9atUwAIEuJb0K26CUi5N4oHVM3t7AdzkAFLWrQAUx5w=
Emails

workplus111@protonmail.com

worker400@airmail.cc

Extracted

Path

C:\Users\Admin\AppData\Local\Temp\RESTORE_FILES_INFO.txt

Ransom Note
Don't worry, you can return all your files! All your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key. The only method of recovering files is to purchase decrypt tool and unique key for you. This software will decrypt all your encrypted files. What guarantees you have? You can send one of your encrypted file from your PC and we decrypt it for free. But we can decrypt only 1 file for free. File must not contain valuable information. We also downloaded your corporate files (databases, tables, accounting information, etc.) and we will have to publish them if you do not agree to cooperation. To get this software you need write on our e-mail: workplus111@protonmail.com Reserve e-mail address to contact us: worker400@airmail.cc Key Identifier: fvVTTLr4/T3xT5dbQe0ltZHrHIDbGkllnoGveYkIL0bnmpUKaJf2ZPd1wmwNvgXQr8X0arr+OkTzzP8xYiEmtzfr7IeM9OIppwgVZTpACSzAIUHXXfx8WQPPtQI9mOisUmlngi6oX3m4HyWIqqUuWn40SynvwV65avcF6i8aU8/I8EvyUoHi8M7ZDbHGIsdbIkufNWm1eDFpr/1RiprcAvlAYjobucHwKAaXty+M53om7m7q/LYmzu5Fl+mLntTgzpsUi87ypqoSYc2MDM4Jld6p83BaLsJjT/N7gHmdn3QlFTEI7R1zIsGoO3GSjcUlEHWoa43XyEQm3iz6YCf5V9kikufDPtZ0bJ8bD6KBfD91phLVbb9jPyYOQWVEtKNGRMYqzOQDH4oIfeau92F33mePKFIdxE+sl29PCVjMIks7lwW3I7gGiWJYEVIcCQl4uolO7FGd1+YBg81jAlqAxSs/XL3BeydMfsYEoMIHl2GruDKOugTavyShU510moCoecXNc191+cZcbE9K8NbH8J1s6z83btNiLaqeVZ7qsMFXEt10CmbuKuD0SwsGpdZb7p8zE3Ul0e1VR4guJCTsnvfR4W4iG/8iiiqBvrHudqhT5BSZURVgsuWJ5VsosWe9qbdV3ePrVhF4EFh9+B+3AFPiGxM+cKvW0LkFYSDjEWk=
Emails

workplus111@protonmail.com

worker400@airmail.cc

Extracted

Path

C:\Users\Admin\Desktop\RESTORE_FILES_INFO.txt

Ransom Note
Don't worry, you can return all your files! All your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key. The only method of recovering files is to purchase decrypt tool and unique key for you. This software will decrypt all your encrypted files. What guarantees you have? You can send one of your encrypted file from your PC and we decrypt it for free. But we can decrypt only 1 file for free. File must not contain valuable information. We also downloaded your corporate files (databases, tables, accounting information, etc.) and we will have to publish them if you do not agree to cooperation. To get this software you need write on our e-mail: workplus111@protonmail.com Reserve e-mail address to contact us: worker400@airmail.cc Key Identifier: fvVTTLr4/T3xT5dbQe0ltZHrHIDbGkllnoGveYkIL0bnmpUKaJf2ZPd1wmwNvgXQr8X0arr+OkTzzP8xYiEmtzfr7IeM9OIppwgVZTpACSzAIUHXXfx8WQPPtQI9mOisUmlngi6oX3m4HyWIqqUuWn40SynvwV65avcF6i8aU8/I8EvyUoHi8M7ZDbHGIsdbIkufNWm1eDFpr/1RiprcAvlAYjobucHwKAaXty+M53om7m7q/LYmzu5Fl+mLntTgzpsUi87ypqoSYc2MDM4Jld6p83BaLsJjT/N7gHmdn3QlFTEI7R1zIsGoO3GSjcUlEHWoa43XyEQm3iz6YCf5V9kikufDPtZ0bJ8bD6KBfD91phLVbb9jPyYOQWVEtKNGRMYqzOQDH4oIfeau92F33mePKFIdxE+sl29PCVjMIks7lwW3I7gGiWJYEVIcCQl4uolO7FGd1+YBg81jAlqAxSs/XL3BeydMfsYEoMIHl2GruDKOugTavyShU510moCoecXNc191+cZcbE9K8NbH8J1s6z83btNiLaqeVZ7qsMFXEt10CmbuKuD0SwsGpdZb7p8zE3Ul0e1VR4guJCTsnvfR4W4iG/8iiiqBvrHudqhT5BSZURVgsuWJ5VsosWe9qbdV3ePrVhF4EFh9+B+3AFPiGxM+cKvW0LkFYSDjEWk= Number of files that were processed is: 133
Emails

workplus111@protonmail.com

worker400@airmail.cc

Targets

    • Target

      wqm58yk7.exe

    • Size

      104KB

    • MD5

      48ea3794091a9f17e12f5c1a90e1f7d7

    • SHA1

      1bb17eef59764e84f95b7a5c0aad649b8517ee43

    • SHA256

      dcd725c415cebc7df170edf49af18d6f86e76ef75185737de5959405f4aecc56

    • SHA512

      0355be6a2b2cf58d4ca5b11de5f84803240587937cd28d064df20ac38c945352e14c78e21006824114f67ede71be3ab27cc27b05759fc23a1fb8dcfa31a7244f

    • Modifies Windows Defender Real-time Protection settings

    • TeslaCrypt, AlphaCrypt

      Ransomware based on CryptoLocker. Shut down by the developers in 2016.

    • Modifies Windows Firewall

    • Drops startup file

    • Modifies file permissions

    • Windows security modification

MITRE ATT&CK Matrix ATT&CK v6

Persistence

Modify Existing Service

2
T1031

Defense Evasion

Modify Registry

4
T1112

Disabling Security Tools

2
T1089

File Permissions Modification

1
T1222

Discovery

System Information Discovery

1
T1082

Remote System Discovery

2
T1018

Tasks