General

  • Target

    75768b049c2604de6db876b29e47e570baba75850cc322f1abe96331abfa975f

  • Size

    702KB

  • Sample

    210528-s1w3th9nen

  • MD5

    a91ec7acf0d5902de0f7cb78bd2408d5

  • SHA1

    cebd771eb44d932dff4197cdcd19f86f0003e9e9

  • SHA256

    75768b049c2604de6db876b29e47e570baba75850cc322f1abe96331abfa975f

  • SHA512

    02cac15f62be2e17367cc1c1dcc59d9e9571455ce79a46e289d1d4f04066da6267e1d435b6d3ff3e3f6d582b8ffec1197fe716928512cf1f13d96184c658cd3d

Malware Config

Extracted

Path

C:\Users\Admin\Desktop\WnYM0_readme_.txt

Ransom Note
-------=== Your network has been infected! ===------- ********* DO NOT DELETE THIS FILE UNTIL ALL YOUR DATA HAVE BEEN RECOVERED ********* All your documents, photos, databases and other important files have been encrypted and have the extension: .accABDDace You are not able to decrypt it by yourself. But don't worry, we can help you to restore all your files! The only way to restore your files is to buy our special software. Only we can give you this software and only we can restore your files! You can get more information on our page, which is located in a Tor hidden network. How to get to our page -------------------------------------------------------------------------------- | | 1. Download Tor browser - https://www.torproject.org/ | | 2. Install Tor browser | | 3. Open link in Tor browser - {{link}} | | 4. Follow the instructions on this page | -------------------------------------------------------------------------------- Your ID: -------------------------------------------------------------------------------- 5CD7CE3561A9678DD6F71B2651EA676A3C6FAB83FBD6964008175D2DB041D7E37D172758A9583C4E9F36BD627BBF203686649994AA5908106D193EE52159989B3DA8DB874D551B14E9E8F64A69068AFDE59F5980884E71419B34665AF3C1090875CB97716EEB4900C398F7CA2B196D338600337037316A12ED370F30BE9C48032A5D15A26CA1B4E063B0CC5A324AA1CFC8697FE99DDB12602C5238B1BE3AD2ED5D69E2DCCE6E56A24DB0974CBC3F05858EA7C8FA5AB90F97011E43B32E593DBCF685D74D17507E31AC53FF1199F0B4941D432D239E956DD969C01FD37FDEA523CEC22FBFDAC8D192B2A6F7F9E8F8BE7FFC60C21D0B2C5496CF58B70A607D377093C52BBFCB449C14FA4F1EEBE2B3DD4E1126642D773BE10E4034E33CDFADF31293DE3724F03C95FFF7E17B8D471B2DEF33B19FFB0E4212604B34874324F64C967A35B0767237F2CFB095DAA1F954F2E8FE0C9CFF9FF9B7364737B3E77980E398FC8A811FF48CDA011933B26CA4189BBB45FCBD1717425D21CB2FB0D986D2654498E7113CEAAE20EEEE2F086E10D59321F456C23F678C63F18DDE82CA6BA03A38BB848ABD03FCF4B2587A08153D3DBF94741A214B440AF2C1F43BB6B4D242924AC2A9A2FFA7D7B90D42E6E727855F00A11D6AD4A9FC4C1937A89FD47E9A6199B4B886C664AAA2EE95FD733261CF0C8714B07A675452056F975A1032A4E9130044 -------------------------------------------------------------------------------- * DO NOT TRY TO RECOVER FILES YOURSELF! * DO NOT MODIFY ENCRYPTED FILES! * * * OTHERWISE, YOU MAY LOSE ALL YOUR FILES FOREVER! * * * svfiL

Extracted

Path

C:\Users\Admin\Downloads\WnYM0_readme_.txt

Ransom Note
-------=== Your network has been infected! ===------- ********* DO NOT DELETE THIS FILE UNTIL ALL YOUR DATA HAVE BEEN RECOVERED ********* All your documents, photos, databases and other important files have been encrypted and have the extension: .accABDDace You are not able to decrypt it by yourself. But don't worry, we can help you to restore all your files! The only way to restore your files is to buy our special software. Only we can give you this software and only we can restore your files! You can get more information on our page, which is located in a Tor hidden network. How to get to our page -------------------------------------------------------------------------------- | | 1. Download Tor browser - https://www.torproject.org/ | | 2. Install Tor browser | | 3. Open link in Tor browser - {{link}} | | 4. Follow the instructions on this page | -------------------------------------------------------------------------------- Your ID: -------------------------------------------------------------------------------- 5CD7CE3561A9678DD6F71B2651EA676A3C6FAB83FBD6964008175D2DB041D7E37D172758A9583C4E9F36BD627BBF203686649994AA5908106D193EE52159989B3DA8DB874D551B14E9E8F64A69068AFDE59F5980884E71419B34665AF3C1090875CB97716EEB4900C398F7CA2B196D338600337037316A12ED370F30BE9C48032A5D15A26CA1B4E063B0CC5A324AA1CFC8697FE99DDB12602C5238B1BE3AD2ED5D69E2DCCE6E56A24DB0974CBC3F05858EA7C8FA5AB90F97011E43B32E593DBCF685D74D17507E31AC53FF1199F0B4941D432D239E956DD969C01FD37FDEA523CEC22FBFDAC8D192B2A6F7F9E8F8BE7FFC60C21D0B2C5496CF58B70A607D377093C52BBFCB449C14FA4F1EEBE2B3DD4E1126642D773BE10E4034E33CDFADF31293DE3724F03C95FFF7E17B8D471B2DEF33B19FFB0E4212604B34874324F64C967A35B0767237F2CFB095DAA1F954F2E8FE0C9CFF9FF9B7364737B3E77980E398FC8A811FF48CDA011933B26CA4189BBB45FCBD1717425D21CB2FB0D986D2654498E7113CEAAE20EEEE2F086E10D59321F456C23F678C63F18DDE82CA6BA03A38BB848ABD03FCF4B2587A08153D3DBF94741A214B440AF2C1F43BB6B4D242924AC2A9A2FFA7D7B90D42E6E727855F00A11D6AD4A9FC4C1937A89FD47E9A6199B4B886C664AAA2EE95FD733261CF0C8714B07A675452056F975A1032A4E9130044 -------------------------------------------------------------------------------- * DO NOT TRY TO RECOVER FILES YOURSELF! * DO NOT MODIFY ENCRYPTED FILES! * * * OTHERWISE, YOU MAY LOSE ALL YOUR FILES FOREVER! * * * jYGZfKvV

Extracted

Path

C:\Users\Default\WnYM0_readme_.txt

Ransom Note
-------=== Your network has been infected! ===------- ********* DO NOT DELETE THIS FILE UNTIL ALL YOUR DATA HAVE BEEN RECOVERED ********* All your documents, photos, databases and other important files have been encrypted and have the extension: .accABDDace You are not able to decrypt it by yourself. But don't worry, we can help you to restore all your files! The only way to restore your files is to buy our special software. Only we can give you this software and only we can restore your files! You can get more information on our page, which is located in a Tor hidden network. How to get to our page -------------------------------------------------------------------------------- | | 1. Download Tor browser - https://www.torproject.org/ | | 2. Install Tor browser | | 3. Open link in Tor browser - {{link}} | | 4. Follow the instructions on this page | -------------------------------------------------------------------------------- Your ID: -------------------------------------------------------------------------------- 5CD7CE3561A9678DD6F71B2651EA676A3C6FAB83FBD6964008175D2DB041D7E37D172758A9583C4E9F36BD627BBF203686649994AA5908106D193EE52159989B3DA8DB874D551B14E9E8F64A69068AFDE59F5980884E71419B34665AF3C1090875CB97716EEB4900C398F7CA2B196D338600337037316A12ED370F30BE9C48032A5D15A26CA1B4E063B0CC5A324AA1CFC8697FE99DDB12602C5238B1BE3AD2ED5D69E2DCCE6E56A24DB0974CBC3F05858EA7C8FA5AB90F97011E43B32E593DBCF685D74D17507E31AC53FF1199F0B4941D432D239E956DD969C01FD37FDEA523CEC22FBFDAC8D192B2A6F7F9E8F8BE7FFC60C21D0B2C5496CF58B70A607D377093C52BBFCB449C14FA4F1EEBE2B3DD4E1126642D773BE10E4034E33CDFADF31293DE3724F03C95FFF7E17B8D471B2DEF33B19FFB0E4212604B34874324F64C967A35B0767237F2CFB095DAA1F954F2E8FE0C9CFF9FF9B7364737B3E77980E398FC8A811FF48CDA011933B26CA4189BBB45FCBD1717425D21CB2FB0D986D2654498E7113CEAAE20EEEE2F086E10D59321F456C23F678C63F18DDE82CA6BA03A38BB848ABD03FCF4B2587A08153D3DBF94741A214B440AF2C1F43BB6B4D242924AC2A9A2FFA7D7B90D42E6E727855F00A11D6AD4A9FC4C1937A89FD47E9A6199B4B886C664AAA2EE95FD733261CF0C8714B07A675452056F975A1032A4E9130044 -------------------------------------------------------------------------------- * DO NOT TRY TO RECOVER FILES YOURSELF! * DO NOT MODIFY ENCRYPTED FILES! * * * OTHERWISE, YOU MAY LOSE ALL YOUR FILES FOREVER! * * * 5AswUWioh9bh

Extracted

Path

C:\odt\ABwzf_readme_.txt

Ransom Note
-------=== Your network has been infected! ===------- ********* DO NOT DELETE THIS FILE UNTIL ALL YOUR DATA HAVE BEEN RECOVERED ********* All your documents, photos, databases and other important files have been encrypted and have the extension: .eCeDadbe You are not able to decrypt it by yourself. But don't worry, we can help you to restore all your files! The only way to restore your files is to buy our special software. Only we can give you this software and only we can restore your files! You can get more information on our page, which is located in a Tor hidden network. How to get to our page -------------------------------------------------------------------------------- | | 1. Download Tor browser - https://www.torproject.org/ | | 2. Install Tor browser | | 3. Open link in Tor browser - {{link}} | | 4. Follow the instructions on this page | -------------------------------------------------------------------------------- Your ID: -------------------------------------------------------------------------------- C2FD94BD52C4795CE318AD84FBDFDF9B7A74983ED71C278B341BD82581F9F6AD3625C74F53421F808B440A526BB066892A92C08B8292B789D21B2BB8DA86AC4F24E91D29FCD7AB6CAF62E9183DF45699B4319B9F96D3736340E644A76F540389B7157FEA33C046CEF654E0A3B195EEFE13570935DA10746B312CEA04EBAA6F78709858BEC5063CBEECC1CDA0911617CC59A9E5A1575028AEEF7E65E3017C8BB494017BF484C6CC9EEDEFBBE9BA03A8A6BB2D99986E71E133F6E9EBC85F182800C98AF43B20C53FB69A494B82914884870F20267D059F6B14856A3B84549627F0187ADF3AA9AF98CB4B6937E1C7514F3744A07263158C1EFF67F3262A4CF7CA67662ACAFF48E5836557EFC360F27BF16E4CC06EFA47A65A45E6AAC8EDCAD35EE26B23C8A81CEFE46146085ACBD5A4C3D782842B953BF9B7C8B0EB4E455AF754D943E6AF0DCE34B189EC5FB1F5B99DE4A7DB9F1E8C67462589E3B95B4421E42A2801E0AA84EE53B7AFCF3AA99D7C0B83EAB8369E1F06062FD5CE9BA059DFEFFE7A9E8B488A247BDA1861429B3E4F9230C51E421602C6889CD537F7B2297494AF5A6FCF1032B656E35FBB8FE18B8EFA41C581BC8AF8F421B0A539490A2DE8CDDE53CD290E1921EF4A5005F70D64BE1D9AA5DD5C79AE1D25852257A8E165FC5076D6192554800B54D95C7113BFE9A57D24C1020E4CCDFE1603AD30C153F1BC147E00 -------------------------------------------------------------------------------- * DO NOT TRY TO RECOVER FILES YOURSELF! * DO NOT MODIFY ENCRYPTED FILES! * * * OTHERWISE, YOU MAY LOSE ALL YOUR FILES FOREVER! * * * svfiL

Extracted

Path

C:\Users\Admin\Documents\ABwzf_readme_.txt

Ransom Note
-------=== Your network has been infected! ===------- ********* DO NOT DELETE THIS FILE UNTIL ALL YOUR DATA HAVE BEEN RECOVERED ********* All your documents, photos, databases and other important files have been encrypted and have the extension: .eCeDadbe You are not able to decrypt it by yourself. But don't worry, we can help you to restore all your files! The only way to restore your files is to buy our special software. Only we can give you this software and only we can restore your files! You can get more information on our page, which is located in a Tor hidden network. How to get to our page -------------------------------------------------------------------------------- | | 1. Download Tor browser - https://www.torproject.org/ | | 2. Install Tor browser | | 3. Open link in Tor browser - {{link}} | | 4. Follow the instructions on this page | -------------------------------------------------------------------------------- Your ID: -------------------------------------------------------------------------------- C2FD94BD52C4795CE318AD84FBDFDF9B7A74983ED71C278B341BD82581F9F6AD3625C74F53421F808B440A526BB066892A92C08B8292B789D21B2BB8DA86AC4F24E91D29FCD7AB6CAF62E9183DF45699B4319B9F96D3736340E644A76F540389B7157FEA33C046CEF654E0A3B195EEFE13570935DA10746B312CEA04EBAA6F78709858BEC5063CBEECC1CDA0911617CC59A9E5A1575028AEEF7E65E3017C8BB494017BF484C6CC9EEDEFBBE9BA03A8A6BB2D99986E71E133F6E9EBC85F182800C98AF43B20C53FB69A494B82914884870F20267D059F6B14856A3B84549627F0187ADF3AA9AF98CB4B6937E1C7514F3744A07263158C1EFF67F3262A4CF7CA67662ACAFF48E5836557EFC360F27BF16E4CC06EFA47A65A45E6AAC8EDCAD35EE26B23C8A81CEFE46146085ACBD5A4C3D782842B953BF9B7C8B0EB4E455AF754D943E6AF0DCE34B189EC5FB1F5B99DE4A7DB9F1E8C67462589E3B95B4421E42A2801E0AA84EE53B7AFCF3AA99D7C0B83EAB8369E1F06062FD5CE9BA059DFEFFE7A9E8B488A247BDA1861429B3E4F9230C51E421602C6889CD537F7B2297494AF5A6FCF1032B656E35FBB8FE18B8EFA41C581BC8AF8F421B0A539490A2DE8CDDE53CD290E1921EF4A5005F70D64BE1D9AA5DD5C79AE1D25852257A8E165FC5076D6192554800B54D95C7113BFE9A57D24C1020E4CCDFE1603AD30C153F1BC147E00 -------------------------------------------------------------------------------- * DO NOT TRY TO RECOVER FILES YOURSELF! * DO NOT MODIFY ENCRYPTED FILES! * * * OTHERWISE, YOU MAY LOSE ALL YOUR FILES FOREVER! * * * jYGZfKvV

Extracted

Path

C:\Users\Admin\Favorites\ABwzf_readme_.txt

Ransom Note
-------=== Your network has been infected! ===------- ********* DO NOT DELETE THIS FILE UNTIL ALL YOUR DATA HAVE BEEN RECOVERED ********* All your documents, photos, databases and other important files have been encrypted and have the extension: .eCeDadbe You are not able to decrypt it by yourself. But don't worry, we can help you to restore all your files! The only way to restore your files is to buy our special software. Only we can give you this software and only we can restore your files! You can get more information on our page, which is located in a Tor hidden network. How to get to our page -------------------------------------------------------------------------------- | | 1. Download Tor browser - https://www.torproject.org/ | | 2. Install Tor browser | | 3. Open link in Tor browser - {{link}} | | 4. Follow the instructions on this page | -------------------------------------------------------------------------------- Your ID: -------------------------------------------------------------------------------- C2FD94BD52C4795CE318AD84FBDFDF9B7A74983ED71C278B341BD82581F9F6AD3625C74F53421F808B440A526BB066892A92C08B8292B789D21B2BB8DA86AC4F24E91D29FCD7AB6CAF62E9183DF45699B4319B9F96D3736340E644A76F540389B7157FEA33C046CEF654E0A3B195EEFE13570935DA10746B312CEA04EBAA6F78709858BEC5063CBEECC1CDA0911617CC59A9E5A1575028AEEF7E65E3017C8BB494017BF484C6CC9EEDEFBBE9BA03A8A6BB2D99986E71E133F6E9EBC85F182800C98AF43B20C53FB69A494B82914884870F20267D059F6B14856A3B84549627F0187ADF3AA9AF98CB4B6937E1C7514F3744A07263158C1EFF67F3262A4CF7CA67662ACAFF48E5836557EFC360F27BF16E4CC06EFA47A65A45E6AAC8EDCAD35EE26B23C8A81CEFE46146085ACBD5A4C3D782842B953BF9B7C8B0EB4E455AF754D943E6AF0DCE34B189EC5FB1F5B99DE4A7DB9F1E8C67462589E3B95B4421E42A2801E0AA84EE53B7AFCF3AA99D7C0B83EAB8369E1F06062FD5CE9BA059DFEFFE7A9E8B488A247BDA1861429B3E4F9230C51E421602C6889CD537F7B2297494AF5A6FCF1032B656E35FBB8FE18B8EFA41C581BC8AF8F421B0A539490A2DE8CDDE53CD290E1921EF4A5005F70D64BE1D9AA5DD5C79AE1D25852257A8E165FC5076D6192554800B54D95C7113BFE9A57D24C1020E4CCDFE1603AD30C153F1BC147E00 -------------------------------------------------------------------------------- * DO NOT TRY TO RECOVER FILES YOURSELF! * DO NOT MODIFY ENCRYPTED FILES! * * * OTHERWISE, YOU MAY LOSE ALL YOUR FILES FOREVER! * * * 5AswUWioh9bh

Extracted

Path

C:\Users\Admin\Searches\ABwzf_readme_.txt

Ransom Note
-------=== Your network has been infected! ===------- ********* DO NOT DELETE THIS FILE UNTIL ALL YOUR DATA HAVE BEEN RECOVERED ********* All your documents, photos, databases and other important files have been encrypted and have the extension: .eCeDadbe You are not able to decrypt it by yourself. But don't worry, we can help you to restore all your files! The only way to restore your files is to buy our special software. Only we can give you this software and only we can restore your files! You can get more information on our page, which is located in a Tor hidden network. How to get to our page -------------------------------------------------------------------------------- | | 1. Download Tor browser - https://www.torproject.org/ | | 2. Install Tor browser | | 3. Open link in Tor browser - {{link}} | | 4. Follow the instructions on this page | -------------------------------------------------------------------------------- Your ID: -------------------------------------------------------------------------------- C2FD94BD52C4795CE318AD84FBDFDF9B7A74983ED71C278B341BD82581F9F6AD3625C74F53421F808B440A526BB066892A92C08B8292B789D21B2BB8DA86AC4F24E91D29FCD7AB6CAF62E9183DF45699B4319B9F96D3736340E644A76F540389B7157FEA33C046CEF654E0A3B195EEFE13570935DA10746B312CEA04EBAA6F78709858BEC5063CBEECC1CDA0911617CC59A9E5A1575028AEEF7E65E3017C8BB494017BF484C6CC9EEDEFBBE9BA03A8A6BB2D99986E71E133F6E9EBC85F182800C98AF43B20C53FB69A494B82914884870F20267D059F6B14856A3B84549627F0187ADF3AA9AF98CB4B6937E1C7514F3744A07263158C1EFF67F3262A4CF7CA67662ACAFF48E5836557EFC360F27BF16E4CC06EFA47A65A45E6AAC8EDCAD35EE26B23C8A81CEFE46146085ACBD5A4C3D782842B953BF9B7C8B0EB4E455AF754D943E6AF0DCE34B189EC5FB1F5B99DE4A7DB9F1E8C67462589E3B95B4421E42A2801E0AA84EE53B7AFCF3AA99D7C0B83EAB8369E1F06062FD5CE9BA059DFEFFE7A9E8B488A247BDA1861429B3E4F9230C51E421602C6889CD537F7B2297494AF5A6FCF1032B656E35FBB8FE18B8EFA41C581BC8AF8F421B0A539490A2DE8CDDE53CD290E1921EF4A5005F70D64BE1D9AA5DD5C79AE1D25852257A8E165FC5076D6192554800B54D95C7113BFE9A57D24C1020E4CCDFE1603AD30C153F1BC147E00 -------------------------------------------------------------------------------- * DO NOT TRY TO RECOVER FILES YOURSELF! * DO NOT MODIFY ENCRYPTED FILES! * * * OTHERWISE, YOU MAY LOSE ALL YOUR FILES FOREVER! * * * SITIpj1cWlJFHOm

Targets

    • Target

      75768b049c2604de6db876b29e47e570baba75850cc322f1abe96331abfa975f

    • Size

      702KB

    • MD5

      a91ec7acf0d5902de0f7cb78bd2408d5

    • SHA1

      cebd771eb44d932dff4197cdcd19f86f0003e9e9

    • SHA256

      75768b049c2604de6db876b29e47e570baba75850cc322f1abe96331abfa975f

    • SHA512

      02cac15f62be2e17367cc1c1dcc59d9e9571455ce79a46e289d1d4f04066da6267e1d435b6d3ff3e3f6d582b8ffec1197fe716928512cf1f13d96184c658cd3d

    • UAC bypass

    • Deletes shadow copies

      Ransomware often targets backup files to inhibit system recovery.

    • Modifies extensions of user files

      Ransomware generally changes the extension on encrypted files.

    • Checks whether UAC is enabled

    • Drops desktop.ini file(s)

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

MITRE ATT&CK Enterprise v6

Tasks