General

  • Target

    779db1c725f71e54d4f31452763784abe783afa6a78cc222e17796b0045f33fc.bin

  • Size

    233KB

  • Sample

    210528-acjqsda27j

  • MD5

    96c565af56a5ba8339f35121bf9ff196

  • SHA1

    2edae92d476225b00b4a7ea1e9d7f7ccfda462cb

  • SHA256

    779db1c725f71e54d4f31452763784abe783afa6a78cc222e17796b0045f33fc

  • SHA512

    6d4a3d91396bccae3dff43f6ee295980c1919a48f7914d9b8b6eca3e603aa97b8e05a0b78af27e7f1c86691fff6fc26fad69ddb774f8ed5d8011aa87b511b6c1

Malware Config

Extracted

Path

C:\Users\Admin\AppData\Local\Temp\RESTORE_FILES_INFO.txt

Family

prometheus

Ransom Note
YOUR COMPANY NETWORK HAS BEEN HACKED All your important files have been encrypted! Your files are safe! Only modified.(AES) No software available on internet can help you. We are the only ones able to decrypt your files. -------------------------------------------------------------------------------- We also gathered highly confidential/personal data. These data are currently stored on a private server. Files are also encrypted and stored securely. -------------------------------------------------------------------------------- As a result of working with us, you will receive: Fully automatic decryptor, all your data will be recovered within a few hours after it's run. Server with your data will be immediately destroyed after your payment. Save time and continue working. You will can send us 2-3 non-important files and we will decrypt it for free to prove we are able to give your files back. -------------------------------------------------------------------------------- !!!!!!!!!!!!!!!!!!!!!!!! If you decide not to work with us: All data on your computers will remain encrypted forever. YOUR DATA ON OUR SERVER AND WE WILL RELEASE YOUR DATA TO PUBLIC OR RE-SELLER! So you can expect your data to be publicly available in the near future.. The price will increase over time. !!!!!!!!!!!!!!!!!!!!!!!!! -------------------------------------------------------------------------------- It doesn't matter to us what you choose pay us or we will sell your data. We only seek money and our goal is not to damage your reputation or prevent your business from running. Write to us now and we will provide the best prices. Instructions for contacting us: ____________________________________________________________________________________ You have way: 1) Using a TOR browser! a. Download and install TOR browser from this site: https://torproject.org/ b. Open the Tor browser. Copy the link: http://promethw27cbrcot.onion/ticket.php?track=LZG-ZNM-YDNM and paste it in the Tor browser. c. Start a chat and follow the further instructions. _____________________________________________________________________________________ Attention! Any attempt to restore your files with third-party software will corrupt it. Modify or rename files will result in a loose of data. If you decide to try anyway, make copies before that Key Identifier: lmjsYi45FeI8JlfNqcXBmBuQNFVdBGLvfXs3a9aZMC9HdSAUPCjFgF5KWj75mMcPgJ1rGdtwp1wOM5Bur8f3fnaVb03saxWG16YEj6MrquLHlqHv7MGl/O8XeNhcBci1XGi+wI9BzSkr0YHfOjEBXouvhNlVcnkxPhwho+mEmI0f12TpoiVoFSopmM1NK8ZcZimuhcl6sVwNX4rFf9NZGxN729nbPZuwrt2NxjOl7wbuPXVMR8Lf1v29TcaCx3/lit5abmmFgJE0rI9Q/Sx11UOYXcjXWgpTs+dst1xmoajgia/Gf4tp3tSOXHJMdbph2GseTMTuNQOVuP6zKflNJ5VEcj3H5zXs7HrZw2w8b5giAZnu6eKu+xTjXSxIDK76tBTPc9NABiG0pTDjZVGROWIq8oKmvd46hgvqx7ISvfdlBwllXNvkAJd4zJFBi16PfS8LsmWjdhjHMltpemJMcN74sGmQ5QdK09iPdlFydYC56lHjTXKDWGz0guI/Hnw6W7ZD7wF5D2cqsw0HEYc/We/RRLw+TLdeWARhQBKAXzawlTFmAhbu6e5qH3nj++xGIARZG0r74pHodbvUWf7hHEJyeSgQJXv/5qx9k7p1ASJ3otrwZiBs7KR3pyZMsngzQXgyZ4HAegQZH3HYCik7/w9pKy0V0lc6krV4Q9C1nk8=
URLs

http://promethw27cbrcot.onion/ticket.php?track=LZG-ZNM-YDNM

Extracted

Path

C:\Users\Admin\Desktop\RESTORE_FILES_INFO.hta

Family

prometheus

Ransom Note
YOUR COMPANY NETWORK HAS BEEN HACKED All your important files have been encrypted! Your files are safe! Only modified.(AES) No software available on internet can help you. We are the only ones able to decrypt your files. We also gathered highly confidential/personal data. These data are currently stored on a private server. Files are also encrypted and stored securely. As a result of working with us, you will receive: Fully automatic decryptor, all your data will be recovered within a few hours after it’s installation. Server with your data will be immediately destroyed after your payment. Save time and continue working. You will can send us 2-3 non-important files and we will decrypt it for free to prove we are able to give your files back. If you decide not to work with us: All data on your computers will remain encrypted forever. YOUR DATA ON OUR SERVER AND WE WILL RELEASE YOUR DATA TO PUBLIC OR RE-SELLER! So you can expect your data to be publicly available in the near future.. The price will increase over time. It doesn't matter to us what you choose pay us or we will sell your data. We only seek money and our goal is not to damage your reputation or prevent your business from running. Write to us now and we will provide the best prices. Instructions for contacting us: You have way: 1) Using a TOR browser! a. Download and install TOR browser from this site: https://torproject.org/ b. Open the Tor browser. Copy the link: http://promethw27cbrcot.onion/ticket.php?track=LZG-ZNM-YDNM and paste it in the Tor browser. c. Start a chat and follow the further instructions. Attention! Any attempt to restore your files with third-party software will corrupt it. Modify or rename files will result in a loose of data. If you decide to try anyway, make copies before that Key Identifier: lmjsYi45FeI8JlfNqcXBmBuQNFVdBGLvfXs3a9aZMC9HdSAUPCjFgF5KWj75mMcPgJ1rGdtwp1wOM5Bur8f3fnaVb03saxWG16YEj6MrquLHlqHv7MGl/O8XeNhcBci1XGi+wI9BzSkr0YHfOjEBXouvhNlVcnkxPhwho+mEmI0f12TpoiVoFSopmM1NK8ZcZimuhcl6sVwNX4rFf9NZGxN729nbPZuwrt2NxjOl7wbuPXVMR8Lf1v29TcaCx3/lit5abmmFgJE0rI9Q/Sx11UOYXcjXWgpTs+dst1xmoajgia/Gf4tp3tSOXHJMdbph2GseTMTuNQOVuP6zKflNJ5VEcj3H5zXs7HrZw2w8b5giAZnu6eKu+xTjXSxIDK76tBTPc9NABiG0pTDjZVGROWIq8oKmvd46hgvqx7ISvfdlBwllXNvkAJd4zJFBi16PfS8LsmWjdhjHMltpemJMcN74sGmQ5QdK09iPdlFydYC56lHjTXKDWGz0guI/Hnw6W7ZD7wF5D2cqsw0HEYc/We/RRLw+TLdeWARhQBKAXzawlTFmAhbu6e5qH3nj++xGIARZG0r74pHodbvUWf7hHEJyeSgQJXv/5qx9k7p1ASJ3otrwZiBs7KR3pyZMsngzQXgyZ4HAegQZH3HYCik7/w9pKy0V0lc6krV4Q9C1nk8=
URLs

http://promethw27cbrcot.onion/ticket.php?track=LZG-ZNM-YDNM

Extracted

Path

C:\Users\Admin\AppData\Local\Temp\RESTORE_FILES_INFO.txt

Family

prometheus

Ransom Note
YOUR COMPANY NETWORK HAS BEEN HACKED All your important files have been encrypted! Your files are safe! Only modified.(AES) No software available on internet can help you. We are the only ones able to decrypt your files. -------------------------------------------------------------------------------- We also gathered highly confidential/personal data. These data are currently stored on a private server. Files are also encrypted and stored securely. -------------------------------------------------------------------------------- As a result of working with us, you will receive: Fully automatic decryptor, all your data will be recovered within a few hours after it's run. Server with your data will be immediately destroyed after your payment. Save time and continue working. You will can send us 2-3 non-important files and we will decrypt it for free to prove we are able to give your files back. -------------------------------------------------------------------------------- !!!!!!!!!!!!!!!!!!!!!!!! If you decide not to work with us: All data on your computers will remain encrypted forever. YOUR DATA ON OUR SERVER AND WE WILL RELEASE YOUR DATA TO PUBLIC OR RE-SELLER! So you can expect your data to be publicly available in the near future.. The price will increase over time. !!!!!!!!!!!!!!!!!!!!!!!!! -------------------------------------------------------------------------------- It doesn't matter to us what you choose pay us or we will sell your data. We only seek money and our goal is not to damage your reputation or prevent your business from running. Write to us now and we will provide the best prices. Instructions for contacting us: ____________________________________________________________________________________ You have way: 1) Using a TOR browser! a. Download and install TOR browser from this site: https://torproject.org/ b. Open the Tor browser. Copy the link: http://promethw27cbrcot.onion/ticket.php?track=LZG-ZNM-YDNM and paste it in the Tor browser. c. Start a chat and follow the further instructions. _____________________________________________________________________________________ Attention! Any attempt to restore your files with third-party software will corrupt it. Modify or rename files will result in a loose of data. If you decide to try anyway, make copies before that Key Identifier: xU/GlkGV2gPKE6JR8E3qsD03icvJwnibDhsINA0DAXwDw3jCYwiV7qhW1TczQ77OkDzuIFLseU3UHSVzzx6CMipLDtI2f5YevCfzbHJHMTZuyxCZ04SFkMk6qflu0Vjqg/WOT2ZBvph/xGx+SIhlaV8sNeOqnY0QhoTTqgPhNvHnfPronPYAm0Kqg8PwZpgrLZHBsd7UT6bTcBtJIwhBUSZExgIzXb6UkcHWYh4uj/0pa9FpGVV2ZRXNZbWv0K3jiu+IdrS3bGsyneHF5vej501bUjHxrNKHpukPs618uL2iSURA+35I4BEzJuiFk8gRQEbAAMsgBCAsPJuGyI9wTpr1MBozPCDUSuc7tZK9ZcQ/miPmqOBHHPvl8yc92vXH+NzOgOgkB6IGoHldepTbiJI3jHBKeQr4YIk/anR3v+4IUIyRxx3apcHATTQfggPVM+uB9onKqRBY3xAT89jqu999LwEZx2QorQ25iefPuubPy3ApcL9dSPWWjm6AZglA2fs/cgflMXnx4YbtYO1smdUJ/O+Xpo+TZ1oa6Khsv6i3E6F19lJ14uZ7TlPa0nF6OeBgg5R8aFy+UIfo4jjCwfys502EIQpYUWbzePQ1H5TLBXTlI81p0xwRaCxmnft7RisYkrRJLwf8JAGqwRDpO4LTqHbhsnAzQAzq00PSYP4=
URLs

http://promethw27cbrcot.onion/ticket.php?track=LZG-ZNM-YDNM

Extracted

Path

C:\Users\Admin\Desktop\RESTORE_FILES_INFO.hta

Family

prometheus

Ransom Note
YOUR COMPANY NETWORK HAS BEEN HACKED All your important files have been encrypted! Your files are safe! Only modified.(AES) No software available on internet can help you. We are the only ones able to decrypt your files. We also gathered highly confidential/personal data. These data are currently stored on a private server. Files are also encrypted and stored securely. As a result of working with us, you will receive: Fully automatic decryptor, all your data will be recovered within a few hours after it’s installation. Server with your data will be immediately destroyed after your payment. Save time and continue working. You will can send us 2-3 non-important files and we will decrypt it for free to prove we are able to give your files back. If you decide not to work with us: All data on your computers will remain encrypted forever. YOUR DATA ON OUR SERVER AND WE WILL RELEASE YOUR DATA TO PUBLIC OR RE-SELLER! So you can expect your data to be publicly available in the near future.. The price will increase over time. It doesn't matter to us what you choose pay us or we will sell your data. We only seek money and our goal is not to damage your reputation or prevent your business from running. Write to us now and we will provide the best prices. Instructions for contacting us: You have way: 1) Using a TOR browser! a. Download and install TOR browser from this site: https://torproject.org/ b. Open the Tor browser. Copy the link: http://promethw27cbrcot.onion/ticket.php?track=LZG-ZNM-YDNM and paste it in the Tor browser. c. Start a chat and follow the further instructions. Attention! Any attempt to restore your files with third-party software will corrupt it. Modify or rename files will result in a loose of data. If you decide to try anyway, make copies before that Key Identifier: xU/GlkGV2gPKE6JR8E3qsD03icvJwnibDhsINA0DAXwDw3jCYwiV7qhW1TczQ77OkDzuIFLseU3UHSVzzx6CMipLDtI2f5YevCfzbHJHMTZuyxCZ04SFkMk6qflu0Vjqg/WOT2ZBvph/xGx+SIhlaV8sNeOqnY0QhoTTqgPhNvHnfPronPYAm0Kqg8PwZpgrLZHBsd7UT6bTcBtJIwhBUSZExgIzXb6UkcHWYh4uj/0pa9FpGVV2ZRXNZbWv0K3jiu+IdrS3bGsyneHF5vej501bUjHxrNKHpukPs618uL2iSURA+35I4BEzJuiFk8gRQEbAAMsgBCAsPJuGyI9wTpr1MBozPCDUSuc7tZK9ZcQ/miPmqOBHHPvl8yc92vXH+NzOgOgkB6IGoHldepTbiJI3jHBKeQr4YIk/anR3v+4IUIyRxx3apcHATTQfggPVM+uB9onKqRBY3xAT89jqu999LwEZx2QorQ25iefPuubPy3ApcL9dSPWWjm6AZglA2fs/cgflMXnx4YbtYO1smdUJ/O+Xpo+TZ1oa6Khsv6i3E6F19lJ14uZ7TlPa0nF6OeBgg5R8aFy+UIfo4jjCwfys502EIQpYUWbzePQ1H5TLBXTlI81p0xwRaCxmnft7RisYkrRJLwf8JAGqwRDpO4LTqHbhsnAzQAzq00PSYP4=
URLs

http://promethw27cbrcot.onion/ticket.php?track=LZG-ZNM-YDNM

Targets

    • Target

      779db1c725f71e54d4f31452763784abe783afa6a78cc222e17796b0045f33fc.bin

    • Size

      233KB

    • MD5

      96c565af56a5ba8339f35121bf9ff196

    • SHA1

      2edae92d476225b00b4a7ea1e9d7f7ccfda462cb

    • SHA256

      779db1c725f71e54d4f31452763784abe783afa6a78cc222e17796b0045f33fc

    • SHA512

      6d4a3d91396bccae3dff43f6ee295980c1919a48f7914d9b8b6eca3e603aa97b8e05a0b78af27e7f1c86691fff6fc26fad69ddb774f8ed5d8011aa87b511b6c1

    • Modifies Windows Defender Real-time Protection settings

    • Prometheus Ransomware

      Ransomware family mostly targeting manufacturing industry and claims to be affiliated with REvil.

    • Downloads MZ/PE file

    • Downloads PsExec from SysInternals website

      Sysinternals tools like PsExec are often leveraged maliciously by malware families due to being commonly used by testers/administrators.

    • Executes dropped EXE

    • Modifies Windows Firewall

    • Modifies extensions of user files

      Ransomware generally changes the extension on encrypted files.

    • Deletes itself

    • Drops startup file

    • Windows security modification

    • Legitimate hosting services abused for malware hosting/C2

    • Modifies WinLogon

MITRE ATT&CK Matrix ATT&CK v6

Persistence

Modify Existing Service

2
T1031

Winlogon Helper DLL

1
T1004

Defense Evasion

Modify Registry

6
T1112

Disabling Security Tools

2
T1089

Discovery

System Information Discovery

1
T1082

Remote System Discovery

1
T1018

Command and Control

Web Service

1
T1102

Tasks