General

  • Target

    data.cmp.exe

  • Size

    281KB

  • Sample

    210518-vvkc9pfsfn

  • MD5

    0e61e496fc218c1c6dc1f5640a3ac7e5

  • SHA1

    aae1b11aa9f2b0a2e32577db8026b843dc16a79d

  • SHA256

    a0070951284e17ec843b498d0a11f4a2ebb8ce64c9f27faf7af96124fd691b1e

  • SHA512

    7b7d6acf3a8f1f2c948cdac035543715d0dc235a169f01127579685f54c7851b06130d5ac4db9345cdb2a6fedfec0395fe306d2f2f2a2bfa45847e325e0c49fd

Malware Config

Extracted

Path

C:\Users\Admin\Desktop\FILES ENCRYPTED.txt

Ransom Note
Attention! All your files, documents, photos, databases and other important files are encrypted and have the extension: .4E2840E1 The only method of recovering files is to purchase an unique private key. Only we can give you this key and only we can recover your files. The server with your key is in a closed network TOR. You can get there by the following ways: ---------------------------------------------------------------------------------------- | 0. Download Tor browser - https://www.torproject.org/ | 1. Install Tor browser | 2. Open Tor Browser | 3. Open link in TOR browser: 7puh3g2lpzut32wetfpohiireazmhoyrkllqescem2jd567rdur2ojyd.onion/contact/4E2840E1 | 4. Follow the instructions on this page ---------------------------------------------------------------------------------------- If your country have blocked the TOR network.You can get there by the following ways: ---------------------------------------------------------------------------------------- | 1. Open link in any browser: decryptmyfiles.top/contact/4E2840E1 | 2. Follow the instructions on this page ---------------------------------------------------------------------------------------- On our page you will see instructions on payment and get the opportunity to decrypt 1 file for free. ATTENTION! IN ORDER TO PREVENT DATA DAMAGE: * DO NOT MODIFY ENCRYPTED FILES * DO NOT CHANGE DATA BELOW ---BEGIN KEY--- KR8fSB0QHkwdHEofS0sQHxFMHExKSB0RTRtPGh8ZTRkfHx9IHRAeTB0cSh9LSxAfEUwcTEpIHRFNSBoZGxFNSxhLSE9PShkcHhEdGx5PEUwdHRoRERBIHSk4jQWred91ml6zpMrAuPL/u53vtMML6uqEc17emfyEFgN8V7PRsQU+qGYwwsg5j1k9BlzXqfyJVuTRTUtukHf62kYCBlAZS+I6H8efD35IT9DfoOKpQkfi0N+g4qlCR+KpXUo/PbutIP6sW1V41LbOlKo9MC19uFpvyFGS12HJjbUrndbS/WIlrVybi9Gxwti2Ob1sO7dz+KZ9hoFnjixtwAHub+ALWrqBiE9plZNjFV6l4WW8ZWpQDxmriSHFJKkzg6Fepyhww4kNXrIaeHIt3oO5f5xC2OUWjzmchRACkWznWJsqDeCDTNW5gfySyO6EgLXmgv59ooSAteaC/n2i� ---END KEY---
URLs

http://7puh3g2lpzut32wetfpohiireazmhoyrkllqescem2jd567rdur2ojyd.onion/contact/4E2840E1

Extracted

Path

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\info.hta

Ransom Note
All your files have been encrypted! All your files, documents, photos, databases and other important files are encrypted and have the extension: .4E2840E1 The only method of recovering files is to purchase an unique private key. Only we can give you this key and only we can recover your files. Free decryption as guarantee Before paying you can decrypt 1 file for free on our site. The size of file must be less than 2Mb (non archived), and the file should not contain valuable information. (databases,backups, large excel sheets, etc.) The server with your key is in a closed network Tor. You can get there by the following ways: Download Tor browser - https://www.torproject.org/ Install Tor browser Open link in Tor browser: http://7puh3g2lpzut32wetfpohiireazmhoyrkllqescem2jd567rdur2ojyd.onion/contact/4E2840E1 Follow the instructions on this page If your country have blocked the Tor network.You can get there by the following ways: Open link in any browser: http://decryptmyfiles.top/contact/4E2840E1 Follow the instructions on this page Attention! Do not rename encrypted files. Do not try to decrypt your data using third party software, it may cause permanent data loss. Decryption of your files with the help of third parties may cause increased price (they add their fee to our) or you can become a victim of a scam.
URLs

http://7puh3g2lpzut32wetfpohiireazmhoyrkllqescem2jd567rdur2ojyd.onion/contact/4E2840E1

http://decryptmyfiles.top/contact/4E2840E1

Extracted

Path

C:\Users\Admin\Desktop\FILES ENCRYPTED.txt

Ransom Note
Attention! All your files, documents, photos, databases and other important files are encrypted and have the extension: .4E2840E1 The only method of recovering files is to purchase an unique private key. Only we can give you this key and only we can recover your files. The server with your key is in a closed network TOR. You can get there by the following ways: ---------------------------------------------------------------------------------------- | 0. Download Tor browser - https://www.torproject.org/ | 1. Install Tor browser | 2. Open Tor Browser | 3. Open link in TOR browser: 7puh3g2lpzut32wetfpohiireazmhoyrkllqescem2jd567rdur2ojyd.onion/contact/4E2840E1 | 4. Follow the instructions on this page ---------------------------------------------------------------------------------------- If your country have blocked the TOR network.You can get there by the following ways: ---------------------------------------------------------------------------------------- | 1. Open link in any browser: decryptmyfiles.top/contact/4E2840E1 | 2. Follow the instructions on this page ---------------------------------------------------------------------------------------- On our page you will see instructions on payment and get the opportunity to decrypt 1 file for free. ATTENTION! IN ORDER TO PREVENT DATA DAMAGE: * DO NOT MODIFY ENCRYPTED FILES * DO NOT CHANGE DATA BELOW ---BEGIN KEY--- a11dCl9SXA5fXghdCQlSXVMOXg4ICl9TD1kNWF1bD1tdXV0KX1JcDl9eCF0JCVJdUw5eDggKX1MPClhbWVMPCVoJCg0NCFteXFNfWVwNUw5fX1hTU1IKX0I4jQWred91ml6zpMrAuPL/u53vtMML6uqEc17emfyEFgN8V7PRsQU+qGYwwsg5j1k9BlzXqfyJVuTRTUtukHf62kYCBlAZS+I6H8efD35ITxs7wy332yq03U8qVsTwVgR+89AaJivMDPoiVu+J4WNq+dBIoH0/EkIvs91lIZgLlwzhBbt7ywNA5OXlOIRaTWI7DYhybtPYiL7f1wcvPmzFFHMRk5p7BdBNALrqqcjGiGt1KmEexY/9XRARWgU4wrHrP4ShICZOr45A/iodUCZ+6xX5YxJMq/bQWw5Vdz75djcFN+aHxjBGsQfwd7tMT+sVEI9F/xZ14S/OWa6iHKqR� ---END KEY---
URLs

http://7puh3g2lpzut32wetfpohiireazmhoyrkllqescem2jd567rdur2ojyd.onion/contact/4E2840E1

Extracted

Path

C:\Users\Admin\Desktop\FILES ENCRYPTED.txt

Ransom Note
Attention! All your files, documents, photos, databases and other important files are encrypted and have the extension: .5940DACA The only method of recovering files is to purchase an unique private key. Only we can give you this key and only we can recover your files. The server with your key is in a closed network TOR. You can get there by the following ways: ---------------------------------------------------------------------------------------- | 0. Download Tor browser - https://www.torproject.org/ | 1. Install Tor browser | 2. Open Tor Browser | 3. Open link in TOR browser: 7puh3g2lpzut32wetfpohiireazmhoyrkllqescem2jd567rdur2ojyd.onion/contact/5940DACA | 4. Follow the instructions on this page ---------------------------------------------------------------------------------------- If your country have blocked the TOR network.You can get there by the following ways: ---------------------------------------------------------------------------------------- | 1. Open link in any browser: decryptmyfiles.top/contact/5940DACA | 2. Follow the instructions on this page ---------------------------------------------------------------------------------------- On our page you will see instructions on payment and get the opportunity to decrypt 1 file for free. ATTENTION! IN ORDER TO PREVENT DATA DAMAGE: * DO NOT MODIFY ENCRYPTED FILES * DO NOT CHANGE DATA BELOW ---BEGIN KEY--- KUodTU0aHEpLSxoQSEgRHUwZGxEfHh4fTEsbGRgfEB8bSh1NTRocSktLGhBISBEdTBkbER8eHh8pTxxMSBwYTUgfHx5MSk0fSxxPG0sQTRkfTB1IGk9KKSmgvmh9WHau0XTR6Fl8+Dkoo/+vIsMckWFPgx3mi+6DscODp5sGihjp6tGORBUpdaQiaqF5D7fMVd7I0OFS/UYN612JjDLg21f/hRnK7XEBftDSkrjQnko60NKSuNCeSjoY5/AAlYUOnEoF3uWwLmhH8CS/lj/JJsfex+RFzBiG3qYhIKQ39HTs+hAJoK5OTEODwkguJ9Boi8QVFGi4mIdhs0rf9Vin11r2kNDZKzbwpFumHM+fUOXjuId7SoyXG0Ar8ATQhHCquY6GNQDxL1dCbqFa2w3gWjpCORLL4MAnvVO/PzTkg2shgiCRtQZA2n3tjg3xhoutbe2ODfGGi61t� ---END KEY---
URLs

http://7puh3g2lpzut32wetfpohiireazmhoyrkllqescem2jd567rdur2ojyd.onion/contact/5940DACA

Extracted

Path

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\info.hta

Ransom Note
All your files have been encrypted! All your files, documents, photos, databases and other important files are encrypted and have the extension: .5940DACA The only method of recovering files is to purchase an unique private key. Only we can give you this key and only we can recover your files. Free decryption as guarantee Before paying you can decrypt 1 file for free on our site. The size of file must be less than 2Mb (non archived), and the file should not contain valuable information. (databases,backups, large excel sheets, etc.) The server with your key is in a closed network Tor. You can get there by the following ways: Download Tor browser - https://www.torproject.org/ Install Tor browser Open link in Tor browser: http://7puh3g2lpzut32wetfpohiireazmhoyrkllqescem2jd567rdur2ojyd.onion/contact/5940DACA Follow the instructions on this page If your country have blocked the Tor network.You can get there by the following ways: Open link in any browser: http://decryptmyfiles.top/contact/5940DACA Follow the instructions on this page Attention! Do not rename encrypted files. Do not try to decrypt your data using third party software, it may cause permanent data loss. Decryption of your files with the help of third parties may cause increased price (they add their fee to our) or you can become a victim of a scam.
URLs

http://7puh3g2lpzut32wetfpohiireazmhoyrkllqescem2jd567rdur2ojyd.onion/contact/5940DACA

http://decryptmyfiles.top/contact/5940DACA

Targets

    • Target

      data.cmp.exe

    • Size

      281KB

    • MD5

      0e61e496fc218c1c6dc1f5640a3ac7e5

    • SHA1

      aae1b11aa9f2b0a2e32577db8026b843dc16a79d

    • SHA256

      a0070951284e17ec843b498d0a11f4a2ebb8ce64c9f27faf7af96124fd691b1e

    • SHA512

      7b7d6acf3a8f1f2c948cdac035543715d0dc235a169f01127579685f54c7851b06130d5ac4db9345cdb2a6fedfec0395fe306d2f2f2a2bfa45847e325e0c49fd

    • Deletes shadow copies

      Ransomware often targets backup files to inhibit system recovery.

    • Drops startup file

    • Checks whether UAC is enabled

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

MITRE ATT&CK Matrix ATT&CK v6

Defense Evasion

File Deletion

2
T1107

Modify Registry

2
T1112

Install Root Certificate

1
T1130

Discovery

System Information Discovery

2
T1082

Impact

Inhibit System Recovery

2
T1490

Tasks