General

  • Target

    20d9efe472c01a0a23c9764db679b27a4b6a4d72e697e3508e44f218b8b952f5.bin

  • Size

    222KB

  • Sample

    210528-43bj78bba6

  • MD5

    1493deb48d84805f19ba35e60d485e87

  • SHA1

    a34a1aeda6019b041f112b1ddbbc290ef523042b

  • SHA256

    20d9efe472c01a0a23c9764db679b27a4b6a4d72e697e3508e44f218b8b952f5

  • SHA512

    ce83d28d70a0d3f108431aa31858030a2cfb91d77f470fd7ef4aecbcd213541f4e393e2d59cdad1d2578dbd3411f43be9c1612e2a63dab8560bc64a16bb589ef

Malware Config

Extracted

Path

C:\Users\Admin\AppData\Local\Temp\RESTORE_FILES_INFO.txt

Family

prometheus

Ransom Note
YOUR COMPANY NETWORK HAS BEEN HACKED All your important files have been encrypted! Your files are safe! Only modified.(AES) No software available on internet can help you. We are the only ones able to decrypt your files. -------------------------------------------------------------------------------- We also gathered highly confidential/personal data. These data are currently stored on a private server. Files are also encrypted and stored securely. -------------------------------------------------------------------------------- As a result of working with us, you will receive: Fully automatic decryptor, all your data will be recovered within a few hours after it's run. Server with your data will be immediately destroyed after your payment. Save time and continue working. You will can send us 2-3 non-important files and we will decrypt it for free to prove we are able to give your files back. -------------------------------------------------------------------------------- !!!!!!!!!!!!!!!!!!!!!!!! If you decide not to work with us: All data on your computers will remain encrypted forever. YOUR DATA ON OUR SERVER AND WE WILL RELEASE YOUR DATA TO PUBLIC OR RE-SELLER! So you can expect your data to be publicly available in the near future.. The price will increase over time. !!!!!!!!!!!!!!!!!!!!!!!!! -------------------------------------------------------------------------------- It doesn't matter to us what you choose. We only seek money and our goal is not to damage your reputation or prevent your business from running. Write to us now and we will provide the best prices. Instructions for contacting us: 1. Type the addres "https://www.torproject.org" in your Internet browser. It opens the Tor site. 2. Press "Download Tor", then press "Download Tor Browser Bundle", install it. 3. Open the Tor browser. Copy the link http://promethw27cbrcot.onion/ticket.php?track=AA4-MX4-GGQD and paste it in the Tor browser. 7. Start a chat and follow the further instructions. Attention! Any attempt to restore your files with third-party software will corrupt it. Modify or rename files will result in a loose of data. If you decide to try anyway, make copies before that Key Identifier: HmernopoIzrKDiV/yij8C97R7rIu/wQHBgyKrkT8HS02Xp+s5Oyy9RnZFLI5uRj9QeUcORJIwYqbBgpNv9CFGUZbbhDVzrOxIY4qoUxNafdOyZ8g8BGO5rDB4nXZ9XZ4IsjE4R9R+UKAxditLslrHn8auuAFhRGQqPb2zL0C5Ys7j3LI0mwp9+EGijMNFvGoffCfjRKwWnz9sWx69BhCgeNhpsX2+TdCcgS9Pa1/Vxrm1ConAZzCODUQ2kzeMODNKXG2pZ+xopUZtfg85W82Pppm988ZVmiZKH158ReEg2zCvspCo2T/JfpmecwVxboPOtM/wD+2QbAdIObHygCeY5kdwf0eLRo7t8P6UMiDRDUEZ28GW/oJR/3obU567Mz8ufzpbUwlKhkXofdNCdwc1RzRiYEITYSAT6JbM3HJ8BBeqkYlTGujy+BnciSOLp1lG3g1kvA5iWTeYIZ3w+X8NQ1vBctWSVZs1b1GztUKd7LyUvRTA+EsPQV4wf5mtKlkCLoOI5J3QuSFh1s8MMYU6V7wlTIDjKx9KNGo0x/11eZQJymE7SCfitrAayDggAOKXz5iicYoY9PmJGw5si00zC5XBEfL/Ck/NBV//2qDTHr0XSNXBb419knuMcW3sqszSi5qZyizN/yL7UzqM1oZqDBFatgYKYsCu2YRLzhwf4o=
URLs

http://promethw27cbrcot.onion/ticket.php?track=AA4-MX4-GGQD

Extracted

Path

C:\Users\Admin\AppData\Local\Temp\RESTORE_FILES_INFO.txt

Family

prometheus

Ransom Note
YOUR COMPANY NETWORK HAS BEEN HACKED All your important files have been encrypted! Your files are safe! Only modified.(AES) No software available on internet can help you. We are the only ones able to decrypt your files. -------------------------------------------------------------------------------- We also gathered highly confidential/personal data. These data are currently stored on a private server. Files are also encrypted and stored securely. -------------------------------------------------------------------------------- As a result of working with us, you will receive: Fully automatic decryptor, all your data will be recovered within a few hours after it's run. Server with your data will be immediately destroyed after your payment. Save time and continue working. You will can send us 2-3 non-important files and we will decrypt it for free to prove we are able to give your files back. -------------------------------------------------------------------------------- !!!!!!!!!!!!!!!!!!!!!!!! If you decide not to work with us: All data on your computers will remain encrypted forever. YOUR DATA ON OUR SERVER AND WE WILL RELEASE YOUR DATA TO PUBLIC OR RE-SELLER! So you can expect your data to be publicly available in the near future.. The price will increase over time. !!!!!!!!!!!!!!!!!!!!!!!!! -------------------------------------------------------------------------------- It doesn't matter to us what you choose. We only seek money and our goal is not to damage your reputation or prevent your business from running. Write to us now and we will provide the best prices. Instructions for contacting us: 1. Type the addres "https://www.torproject.org" in your Internet browser. It opens the Tor site. 2. Press "Download Tor", then press "Download Tor Browser Bundle", install it. 3. Open the Tor browser. Copy the link http://promethw27cbrcot.onion/ticket.php?track=AA4-MX4-GGQD and paste it in the Tor browser. 7. Start a chat and follow the further instructions. Attention! Any attempt to restore your files with third-party software will corrupt it. Modify or rename files will result in a loose of data. If you decide to try anyway, make copies before that Key Identifier: GdOgdPDhucVMKOmOUql3cp17Cej9kR1B8p5jHYKOXxzgENTj21dg0jLW97bUEtOQqcf28UDOKX4aPwZ6Ol3GVyOFgXmwk+mOLwX07Y3dS9K6K7HKLVzjPgKE87KfLSNEQSrP+h200/imfPCltL9XcWkBVNv3PimI/DLHDZl498vLSFwanWFnlhN9Nj9PVufyzP/2qEnRBus0Nz+8nIyrvupJMGoBouIjflO/RKnnDlOO7dvQkmHUBdxRweS+fKBpFV5Mn7/PLGhXFAPHuM4TY0cPomxiOwtbDRG9IvyW2itnFDGyBUHzzfLTO9sVhQWBcWS4U/rN18o3YGcuOwwteA1egeB1s802kdK+HdSCye3lf6ROYoGhIzmeKxJEPr0JaJixxVamiofxkSPjNgxb+Q0Qk0hYC7UZdHt58lFGSwVbQyDOOSDVljig3liKvGN5AiM++Az5g8Lhy+Zzv28wQGfTfoj/fPVyxrS6yjrv3l9M18rDoBhX2TuuKJwyqMJeG74N2ZQCguoKysBhnJfDYRQ4CrpWYYkwCeyeTFf54sGSCmfaxg9/zRBav/FFXYDkhbiP7lcY+kCT5LaKcMXoPMdDEoITTG8qwo7WIcHQhhUafLz13fjnqmXZdC/lGSIWrkHRRjlrNC0cThyXcXjpP4RJnLX+VwkH4A2IJRAtd/A=
URLs

http://promethw27cbrcot.onion/ticket.php?track=AA4-MX4-GGQD

Extracted

Path

C:\Users\Admin\Desktop\RESTORE_FILES_INFO.hta

Family

prometheus

Ransom Note
YOUR COMPANY NETWORK HAS BEEN HACKED All your important files have been encrypted! Your files are safe! Only modified.(AES) No software available on internet can help you. We are the only ones able to decrypt your files. We also gathered highly confidential/personal data. These data are currently stored on a private server. Files are also encrypted and stored securely. As a result of working with us, you will receive: Fully automatic decryptor, all your data will be recovered within a few hours after it’s installation. Server with your data will be immediately destroyed after your payment. Save time and continue working. You will can send us 2-3 non-important files and we will decrypt it for free to prove we are able to give your files back. If you decide not to work with us: All data on your computers will remain encrypted forever. YOUR DATA ON OUR SERVER AND WE WILL RELEASE YOUR DATA TO PUBLIC OR RE-SELLER! So you can expect your data to be publicly available in the near future.. The price will increase over time. It doesn't matter to us what you choose. We only seek money and our goal is not to damage your reputation or prevent your business from running. Write to us now and we will provide the best prices. Instructions for contacting us: 1. Type the addres "https://www.torproject.org" in your Internet browser. It opens the Tor site. 2. Press "Download Tor", then press "Download Tor Browser Bundle", install it. 3. Open the Tor browser. Copy the link http://promethw27cbrcot.onion/ticket.php?track=AA4-MX4-GGQD and paste it in the Tor browser. 7. Start a chat and follow the further instructions. Attention! Any attempt to restore your files with third-party software will corrupt it. Modify or rename files will result in a loose of data. If you decide to try anyway, make copies before that Key Identifier: GdOgdPDhucVMKOmOUql3cp17Cej9kR1B8p5jHYKOXxzgENTj21dg0jLW97bUEtOQqcf28UDOKX4aPwZ6Ol3GVyOFgXmwk+mOLwX07Y3dS9K6K7HKLVzjPgKE87KfLSNEQSrP+h200/imfPCltL9XcWkBVNv3PimI/DLHDZl498vLSFwanWFnlhN9Nj9PVufyzP/2qEnRBus0Nz+8nIyrvupJMGoBouIjflO/RKnnDlOO7dvQkmHUBdxRweS+fKBpFV5Mn7/PLGhXFAPHuM4TY0cPomxiOwtbDRG9IvyW2itnFDGyBUHzzfLTO9sVhQWBcWS4U/rN18o3YGcuOwwteA1egeB1s802kdK+HdSCye3lf6ROYoGhIzmeKxJEPr0JaJixxVamiofxkSPjNgxb+Q0Qk0hYC7UZdHt58lFGSwVbQyDOOSDVljig3liKvGN5AiM++Az5g8Lhy+Zzv28wQGfTfoj/fPVyxrS6yjrv3l9M18rDoBhX2TuuKJwyqMJeG74N2ZQCguoKysBhnJfDYRQ4CrpWYYkwCeyeTFf54sGSCmfaxg9/zRBav/FFXYDkhbiP7lcY+kCT5LaKcMXoPMdDEoITTG8qwo7WIcHQhhUafLz13fjnqmXZdC/lGSIWrkHRRjlrNC0cThyXcXjpP4RJnLX+VwkH4A2IJRAtd/A=
URLs

http://promethw27cbrcot.onion/ticket.php?track=AA4-MX4-GGQD

Targets

    • Target

      20d9efe472c01a0a23c9764db679b27a4b6a4d72e697e3508e44f218b8b952f5.bin

    • Size

      222KB

    • MD5

      1493deb48d84805f19ba35e60d485e87

    • SHA1

      a34a1aeda6019b041f112b1ddbbc290ef523042b

    • SHA256

      20d9efe472c01a0a23c9764db679b27a4b6a4d72e697e3508e44f218b8b952f5

    • SHA512

      ce83d28d70a0d3f108431aa31858030a2cfb91d77f470fd7ef4aecbcd213541f4e393e2d59cdad1d2578dbd3411f43be9c1612e2a63dab8560bc64a16bb589ef

    • Prometheus Ransomware

      Ransomware family mostly targeting manufacturing industry and claims to be affiliated with REvil.

    • Modifies Windows Firewall

    • Modifies extensions of user files

      Ransomware generally changes the extension on encrypted files.

    • Drops startup file

    • Modifies file permissions

    • Modifies WinLogon

MITRE ATT&CK Matrix ATT&CK v6

Persistence

Modify Existing Service

1
T1031

Winlogon Helper DLL

1
T1004

Defense Evasion

File Permissions Modification

1
T1222

Modify Registry

3
T1112

Discovery

System Information Discovery

1
T1082

Remote System Discovery

1
T1018

Tasks