General

  • Target

    svchosts.exe

  • Size

    13KB

  • Sample

    210610-9aj6xcwssa

  • MD5

    43859f9a480451304b2efb0e2bc5ba72

  • SHA1

    c05a69cfa4bede3a58f48ff09de4f49aa988faee

  • SHA256

    17ba67b2b5ec20c5fec06a580e293eefc665fc89f8bfc00d6b9b715bffa2d845

  • SHA512

    22e3da706a0b5e4e360c97f3bc80c4ab55e4ffff62aab92adc13e5c2ee2d06f93178504049a3a620a88d30c57b7cf3a53c9ef9166804a1115c4b821f9d092afe

Malware Config

Extracted

Path

C:\$Recycle.Bin\S-1-5-21-2513283230-931923277-594887482-1000\#Decrypt#.txt

Ransom Note
Hello my dear friend! All your files have been encrypted due to a security problem with your PC! If you want to restore them, install ICQ software on your PC https://icq.com/windows/ or on your mobile phone search in Appstore / Google market ICQ Write to our ICQ @xhamster2020 https://icq.im/xhamster2020 Attention! Do not rename encrypted files. Do not try to decrypt your data using third party software, it may cause permanent data loss. Price depends on how fast you contact us. We give all guarantees of your files decryption. IF WE DONT SEE MESSAGE FROM YOU IN 48 HOURS - ALL IMPORTANT INFORMATION FROM YOUR SERVERS (DATABASES, COMPANY DOCUMENTS, ACCESS DATA ETC) WILL BE UPLOADED TO THE DARKNET tell your unique ID yvh+ByG+XJwc1Rko33QInRj9bY+AyOorsAOmB9SNHfwbYxzHkfl6XYNSvjevEfs0MkZk1dMqceNMqOXOHpB4s3yvpWzmyTxgJY6mkz9TjuOcP+lU128mB7bbPnY391/KhHSb0RiKwkZR9w/A4jOARWLeY1ncfh1eUuUfbdjru+InsjxuzmVrhnOY0oDH/5QAbyyrhB73PUrksoidZu5NqIaKUgkVA4NTKHuSu2yYyfid3skCa7R1MpOKaZgTHWNayAuP5wroY/8T/of81qEqspHkvJ1xqRkSl8dp7VEaou2sQZEdvpN6OLFV5pzpc6Jd92eHHy4OvD8+eLO6lGN0po2Ms6QPU3RSzrn/5G3Ww4FeEZGz02DZzxcG4knzJU8XUGBVBoDO34QJGQbX2OASI8HABGD3cHYtUw7XP9MYMowIB8tv67lVBV3b0ibsSrOI+3YHTark8VNG2+AkxRWkV+LD6B0lRXDA36SPKM7j30+BGQKqOSDqRDoke4FIbab06RJQez1UzGcAW5qCeLYRB86jjtpsqzdqzdmUXbjtDst/v2MZ8/a/sd0smUxFh3s9zZQ5qNboTfZLVsURmqGjOY3w2A0TayWhdCL9icoQCDHX2BslQwUtZOst/VWNRVy2uXnzoCQ84vUuOIvMJBqSb5uv9DEWw+klevQRV+ylxnFGSsRKUaDv4chjd+CMAh2r9RFxs31Ezd2P8S9KwEy8PJvWRcXOOOZlYldZflmv95HnNd+T9akBHtgIxUQXZ76hYZ8T336sz1ynNj0z+zF81odUY9wAzSz4ZmMqGRCKNnXWakub4CXyqtIALKv5+9fFBJ+jkwGugYGKTm1tfcqwEiVd8ECOM/3ulYUX9n8NDoiePE5qxb1nmd9Dgp49QG3Q2hGa/kbk5tXJtMQycPcMcDdPh5HpwBFsEtlFJDaWMzTCxibDGgg37IswpVtSYL44SGuOYhv46anov8jKO3pjFNvFdykTFILYz8IObft9rnWxAhFfZFdG1lNH77wHQAlA77p2RQPVXApJS9R2rxdnW9GRID6opStsSK/FKiwYePE+0MsaLgVKsWrsblcVOlB4CKimwH7tdbH0euMaxzhWm83w06Nl/j4Cg3X6BXqkGr/5h308EK1PXE0XW2RZx3joKde3bHaM02XTL+8ZCcmdm3tfjptTWt/rwaAG3immBVn/Qy5LnEsuZe+iNf4q2UMmj8boL9ZkUj67QL2n4K/Iz4NHfJP8Un1T7nYaiTk2fZhmcEb7YXc+oUqif2rwx7XOsEqvzSnpUYYXNP90zSTXbnVfWhM3jjxsuRM0jurWNF9YTCZ2FFjAMoXZCAmz81KApB5dvTUtFTeZuU2ZuawmNw==
URLs

https://icq.com/windows/

https://icq.im/xhamster2020

Extracted

Path

C:\$Recycle.Bin\S-1-5-21-1594587808-2047097707-2163810515-1000\#Decrypt#.txt

Ransom Note
Hello my dear friend! All your files have been encrypted due to a security problem with your PC! If you want to restore them, install ICQ software on your PC https://icq.com/windows/ or on your mobile phone search in Appstore / Google market ICQ Write to our ICQ @xhamster2020 https://icq.im/xhamster2020 Attention! Do not rename encrypted files. Do not try to decrypt your data using third party software, it may cause permanent data loss. Price depends on how fast you contact us. We give all guarantees of your files decryption. IF WE DONT SEE MESSAGE FROM YOU IN 48 HOURS - ALL IMPORTANT INFORMATION FROM YOUR SERVERS (DATABASES, COMPANY DOCUMENTS, ACCESS DATA ETC) WILL BE UPLOADED TO THE DARKNET tell your unique ID 4qK0tmnmSbOyvfB8jNcIKBxvCx1USG5k9ug23BPRNbq9aRQflrKH9vhr8r17zSizQhl01ZYvTOEl8lZLmJWWopgXIdKJSn09HJd02s4hmGx4liHBYKlG/+5bSVERBWcTf3WkasbUGy6x8qOBPe5XU2J/I4nkKmr6nHdVS1NzuewewbUaP0IT+ZCDjeMlEf2egS0TOBN5gH1Tzq/nkU6CD7pVPB/2STa7+JugCpgDzNjABPvmXzHjNCx7YECkZXE+4l/rjwIupd0ouw3dfY7667QE8YOUERIi4RXtkeChNoIfZwEWPc/m+bgy+RKEptLhs4sIaHUOdo32RZYVD2pdqZtQk2x1awkoGGrFChhYK+7KuOCjFVC6ll6SUixHWat2UzdAZXjALnvzNiArXtWYmqoYFBuVgTOHt1kOwOgjedZH5jbkqjd/+1A2mrwkb8SI/MzZHOGhC7idtJfqv31xS4XOdR6lTsVJuKF+bkCmHtE1r1Q0rhh2YxeEdGBT7Xmib6QYawr96QMbTlQgwhlEEPh5/C/DHLiBqoDRLpfsbTWgpQ05Op7f1bc+Es2hyQI2NxkrJvW2JwYBb+2tjquw/jr58m6hCy2J4IyCvEqYbMdRQrktjwgYAQczaS/cf6BoxbOdGPgP31/FrWaK+3XYwsB8UR/ncCngJ/+Ay9Hx1IN49+Z0EAZHg5UH7EeEJG2YUZCtYwG0zQFcVnAQou08uMVnv1o55Jmpt+fl0bMVL+cGrk99UpdSlbx8QN9mfrYppdiwLjUmQgKiJeI+C8Tc/fb6D/4AvfKwcsR2Nu8r4XHLFcNe5btQ3bjexIPPjpztaHT88wG069GBBHASiyuBqs7Z5by/O2p4cXdOazVmQApGWaCPTjQ4NeYA/QUKJ50SuX6wd3BiR1z7aGOhQFT+vAlmjGA7U5+ulejxIcGZTfUJ28tEIIAqG46jj8ZHETr9sauSI/8uR4bC+qUgWotEFRI3E/vJ4ISBdQC2qz6IQsCaADeuivOmcYl7Mc1v6TFDVmV+hpQb1C1qORKjrPlYv56L6M32eu2zJ00oCH/S3NroLyKQeYd9qgxBEQCjNhLo/cN9126o4CTWNEFFOTNBV3+uAUuGmsRAzTLJWLx7BhIttBenQVGFgGy2yfunHPcrYlW/G1efIb53jToAvcw6vt98E4a+wlYpru929C6eOTmbxJeGIISSOa39q/WIlT102ChC3Ygg0QOvrq/fyF9D/sJhTfWkYnApW5vPDbV4GHkQQmdxzwHVtwIQ1KYvvkTZtJhdXtaA0n843/iGlWds6r/za5HfEa6rT381r0ObbMkPOmFcRx7gLnfvvSd8cb3gyqjkEAB+4oi2WpxASMsMHg==
URLs

https://icq.com/windows/

https://icq.im/xhamster2020

Targets

    • Target

      svchosts.exe

    • Size

      13KB

    • MD5

      43859f9a480451304b2efb0e2bc5ba72

    • SHA1

      c05a69cfa4bede3a58f48ff09de4f49aa988faee

    • SHA256

      17ba67b2b5ec20c5fec06a580e293eefc665fc89f8bfc00d6b9b715bffa2d845

    • SHA512

      22e3da706a0b5e4e360c97f3bc80c4ab55e4ffff62aab92adc13e5c2ee2d06f93178504049a3a620a88d30c57b7cf3a53c9ef9166804a1115c4b821f9d092afe

    • Deletes shadow copies

      Ransomware often targets backup files to inhibit system recovery.

    • Modifies boot configuration data using bcdedit

    • Modifies Windows Firewall

    • Modifies extensions of user files

      Ransomware generally changes the extension on encrypted files.

    • Deletes itself

    • Drops startup file

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Drops desktop.ini file(s)

    • Sets desktop wallpaper using registry

MITRE ATT&CK Matrix ATT&CK v6

Persistence

Modify Existing Service

1
T1031

Defense Evasion

File Deletion

2
T1107

Modify Registry

1
T1112

Credential Access

Credentials in Files

1
T1081

Discovery

System Information Discovery

1
T1082

Collection

Data from Local System

1
T1005

Impact

Inhibit System Recovery

3
T1490

Defacement

1
T1491

Tasks