Analysis

  • max time kernel
    52s
  • max time network
    110s
  • platform
    windows10_x64
  • resource
    win10v20210408
  • submitted
    16-04-2021 03:19

General

  • Target

    2e434bd96b08293786cd010883adfeacce5a30f5743d89c5187f38966b2e5d21.exe

  • Size

    125KB

  • MD5

    173ab5a59490ea2f66fe37c5e20e05b8

  • SHA1

    ac091ce1281a16f9d7766a7853108c612f058c09

  • SHA256

    2e434bd96b08293786cd010883adfeacce5a30f5743d89c5187f38966b2e5d21

  • SHA512

    0e0d2480fb1bcef185a91d49eb49116dd0fc1837fe634d69451adbdfca00e157495590a59d14409073b0b8b5c96ff3a7f34a7f29976e8fa6cd5aa0b8eedeb05e

Score
10/10

Malware Config

Extracted

Path

C:\GANGBANG-NOTE.txt

Ransom Note
Two things have happened to your company. ========================================================================================================================== Gigabytes of archived files that we deemed valuable or sensitive were downloaded from your network to a secure location. When you contact us we will tell you how much data was downloaded and can provide extensive proof of the data extraction. You can analyze the type of the data we download on our websites. If you do not contact us we will start leaking the data periodically in parts. ========================================================================================================================== We have also encrypted files on your computers with military grade algorithms. If you don't have extensive backups the only way to retrieve your data is with our software. Restoration of your data with our software requires a private key which only we possess. ========================================================================================================================== To confirm that our decryption software works send 2 encrypted files from random computers to us via email. You will receive further instructions after you send us the test files. We will make sure you retrieve your data swiftly and securely and your data that we downloaded will be securely deleted when our demands are met. If we do not come to an agreement your data will be leaked on this website. Website: http://corpleaks.net TOR link: http://hxt254aygrsziejn.onion Contact us via email: Jeremyspineberg11@tutanota.com GeromeSkinggagard1999@tutanota.com Jeremyspineberg11@protonmail.com
Emails

Jeremyspineberg11@tutanota.com

GeromeSkinggagard1999@tutanota.com

Jeremyspineberg11@protonmail.com

URLs

http://corpleaks.net

http://hxt254aygrsziejn.onion

Signatures

  • Modifies extensions of user files 10 IoCs

    Ransomware generally changes the extension on encrypted files.

  • Enumerates connected drives 3 TTPs 24 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

Processes

  • C:\Users\Admin\AppData\Local\Temp\2e434bd96b08293786cd010883adfeacce5a30f5743d89c5187f38966b2e5d21.exe
    "C:\Users\Admin\AppData\Local\Temp\2e434bd96b08293786cd010883adfeacce5a30f5743d89c5187f38966b2e5d21.exe"
    1⤵
    • Modifies extensions of user files
    • Enumerates connected drives
    PID:804

Network

MITRE ATT&CK Matrix ATT&CK v6

Discovery

Query Registry

1
T1012

Peripheral Device Discovery

1
T1120

System Information Discovery

1
T1082

Replay Monitor

Loading Replay Monitor...

Downloads