a0070951284e17ec843b498d0a11f4a2ebb8ce64c9f27faf7af96124fd691b1e

General

Target

data.cmp.exe
Size

281KB
MD5

0e61e496fc218c1c6dc1f5640a3ac7e5
SHA1

aae1b11aa9f2b0a2e32577db8026b843dc16a79d
SHA256

a0070951284e17ec843b498d0a11f4a2ebb8ce64c9f27faf7af96124fd691b1e
SHA512

7b7d6acf3a8f1f2c948cdac035543715d0dc235a169f01127579685f54c7851b06130d5ac4db9345cdb2a6fedfec0395fe306d2f2f2a2bfa45847e325e0c49fd

Score

10^/10

ransomware

Malware Config

Extracted

Path

C:\Users\Admin\Desktop\FILES ENCRYPTED.txt

Ransom Note

Attention! All your files, documents, photos, databases and other important files are encrypted and have the extension: .5940DACA The only method of recovering files is to purchase an unique private key. Only we can give you this key and only we can recover your files. The server with your key is in a closed network TOR. You can get there by the following ways: ---------------------------------------------------------------------------------------- | 0. Download Tor browser - https://www.torproject.org/ | 1. Install Tor browser | 2. Open Tor Browser | 3. Open link in TOR browser: 7puh3g2lpzut32wetfpohiireazmhoyrkllqescem2jd567rdur2ojyd.onion/contact/5940DACA | 4. Follow the instructions on this page ---------------------------------------------------------------------------------------- If your country have blocked the TOR network.You can get there by the following ways: ---------------------------------------------------------------------------------------- | 1. Open link in any browser: decryptmyfiles.top/contact/5940DACA | 2. Follow the instructions on this page ---------------------------------------------------------------------------------------- On our page you will see instructions on payment and get the opportunity to decrypt 1 file for free. ATTENTION! IN ORDER TO PREVENT DATA DAMAGE: * DO NOT MODIFY ENCRYPTED FILES * DO NOT CHANGE DATA BELOW ---BEGIN KEY--- KUodTU0aHEpLSxoQSEgRHUwZGxEfHh4fTEsbGRgfEB8bSh1NTRocSktLGhBISBEdTBkbER8eHh8pTxxMSBwYTUgfHx5MSk0fSxxPG0sQTRkfTB1IGk9KKSmgvmh9WHau0XTR6Fl8+Dkoo/+vIsMckWFPgx3mi+6DscODp5sGihjp6tGORBUpdaQiaqF5D7fMVd7I0OFS/UYN612JjDLg21f/hRnK7XEBftDSkrjQnko60NKSuNCeSjoY5/AAlYUOnEoF3uWwLmhH8CS/lj/JJsfex+RFzBiG3qYhIKQ39HTs+hAJoK5OTEODwkguJ9Boi8QVFGi4mIdhs0rf9Vin11r2kNDZKzbwpFumHM+fUOXjuId7SoyXG0Ar8ATQhHCquY6GNQDxL1dCbqFa2w3gWjpCORLL4MAnvVO/PzTkg2shgiCRtQZA2n3tjg3xhoutbe2ODfGGi61t� ---END KEY---

URLs

http://7puh3g2lpzut32wetfpohiireazmhoyrkllqescem2jd567rdur2ojyd.onion/contact/5940DACA

Extracted

Path

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\info.hta

Ransom Note

All your files have been encrypted! All your files, documents, photos, databases and other important files are encrypted and have the extension: .5940DACA The only method of recovering files is to purchase an unique private key. Only we can give you this key and only we can recover your files. Free decryption as guarantee Before paying you can decrypt 1 file for free on our site. The size of file must be less than 2Mb (non archived), and the file should not contain valuable information. (databases,backups, large excel sheets, etc.) The server with your key is in a closed network Tor. You can get there by the following ways: Download Tor browser - https://www.torproject.org/ Install Tor browser Open link in Tor browser: http://7puh3g2lpzut32wetfpohiireazmhoyrkllqescem2jd567rdur2ojyd.onion/contact/5940DACA Follow the instructions on this page If your country have blocked the Tor network.You can get there by the following ways: Open link in any browser: http://decryptmyfiles.top/contact/5940DACA Follow the instructions on this page Attention! Do not rename encrypted files. Do not try to decrypt your data using third party software, it may cause permanent data loss. Decryption of your files with the help of third parties may cause increased price (they add their fee to our) or you can become a victim of a scam.

URLs

http://7puh3g2lpzut32wetfpohiireazmhoyrkllqescem2jd567rdur2ojyd.onion/contact/5940DACA

http://decryptmyfiles.top/contact/5940DACA

Signatures

Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware

File Deletion
T1107

Inhibit System Recovery
T1490

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\info.hta	data.cmp.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
7	api.ipify.org

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Interacts with shadow copies 2 TTPs 1 IoCs

Shadow copies are often targeted by ransomware to inhibit system recovery.

ransomware

File Deletion

T1107

Inhibit System Recovery

T1490

pid	Process
2280	vssadmin.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings	explorer.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeBackupPrivilege	3196	vssvc.exe
Token: SeRestorePrivilege	3196	vssvc.exe
Token: SeAuditPrivilege	3196	vssvc.exe

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 668 wrote to memory of 2236	668	data.cmp.exe	78
PID 668 wrote to memory of 2236	668	data.cmp.exe	78
PID 668 wrote to memory of 2236	668	data.cmp.exe	78
PID 2236 wrote to memory of 1380	2236	cmd.exe	80
PID 2236 wrote to memory of 1380	2236	cmd.exe	80
PID 2236 wrote to memory of 1380	2236	cmd.exe	80
PID 668 wrote to memory of 1160	668	data.cmp.exe	82
PID 668 wrote to memory of 1160	668	data.cmp.exe	82
PID 668 wrote to memory of 1160	668	data.cmp.exe	82
PID 668 wrote to memory of 2124	668	data.cmp.exe	84
PID 668 wrote to memory of 2124	668	data.cmp.exe	84
PID 668 wrote to memory of 2124	668	data.cmp.exe	84
PID 668 wrote to memory of 3560	668	data.cmp.exe	85
PID 668 wrote to memory of 3560	668	data.cmp.exe	85
PID 668 wrote to memory of 3560	668	data.cmp.exe	85
PID 1160 wrote to memory of 2280	1160	cmd.exe	89
PID 1160 wrote to memory of 2280	1160	cmd.exe	89
PID 1160 wrote to memory of 2280	1160	cmd.exe	89
PID 4016 wrote to memory of 2156	4016	explorer.exe	91
PID 4016 wrote to memory of 2156	4016	explorer.exe	91
PID 4016 wrote to memory of 2156	4016	explorer.exe	91

C:\Users\Admin\AppData\Local\Temp\data.cmp.exe
"C:\Users\Admin\AppData\Local\Temp\data.cmp.exe"
1⤵
- Drops startup file
- Suspicious use of WriteProcessMemory
PID:668
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c start "" "explorer.exe" C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\info.hta
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2236
- - C:\Windows\SysWOW64\explorer.exe
    "explorer.exe" C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\info.hta
    3⤵
    PID:1380
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c vssadmin.exe Delete Shadows /All /Quiet
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1160
- - C:\Windows\SysWOW64\vssadmin.exe
    vssadmin.exe Delete Shadows /All /Quiet
    3⤵
    - Interacts with shadow copies
    PID:2280
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c bcdedit.exe /set {default} recoveryenabled No
  2⤵
  PID:2124
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c bcdedit.exe /set {default} bootstatuspolicy ignoreallfailures
  2⤵
  PID:3560

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4016
- C:\Windows\SysWOW64\mshta.exe
  "C:\Windows\SysWOW64\mshta.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\info.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}
  2⤵
  PID:2156

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3196

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File Deletion

2

T1107

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Inhibit System Recovery

2

T1490

Analysis

Sharing

General

Malware Config

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads