e92bd8498d8a868a7a9fdf5bf0776096a42b7dc8a9d0af9a294bfad5983076f5

General

Target
e25eaaac03aa958688cbe950275156169eb4955e145bc9627fcbfb36cd832a84.exe
Size 116KB
Sample210629-eb8ghw1fma
SHA256 e25eaaac03aa958688cbe950275156169eb4955e145bc9627fcbfb36cd832a84
MD5 d1c9c12e08c8e2111da989e2318b1c42
SHA1 d0c7f3c8de28d0fccec9d4925afeb5fa9dd62b5d
SHA512 152f93308e6d15910e01d77c74bb86284e5929ece91627c1aa82fe5050f7a233e3b27a6c5834110478789d5d845c49775c3473b3ee838488f1cd19c6af17312c
MD5 SHA1 SHA512

Score

10^/10

ransomware

Malware Config

Extracted

Path

C:\0q43lemo1-README.txt

Ransom Note

---=== Welcome. Again. ===--- [+] What's Happened? [+] Your files have been encrypted and currently unavailable. You can check it. All files in your system have 0q43lemo1 extension. By the way, everything is possible to recover (restore) but you should follow our instructions. Otherwise you can NEVER return your data. [+] What are our guarantees? [+] It's just a business and we care only about getting benefits. If we don't meet our obligations, nobody will deal with us. It doesn't hold our interest. So you can check the ability to restore your files. For this purpose you should visit our website where you can decrypt one file for free. That is our guarantee. It doesn't metter for us whether you cooperate with us or not. But if you don't, you'll lose your time and data cause only we have the private key to decrypt your files. In practice - time is much more valuable than money. [+] How to get access to our website? [+] Use TOR browser: 1. Download and install TOR browser from this site: https://torproject.org/ 2. Visit our website: http://4to43yp4mng2gdc3jgnep5bt7lkhqvjqiritbv4x2ebj3qun7wz4y2id.onion When you visit our website, put the following data into the input form: Key: jhYzXjopSSeMWN5HDAUAv50qdq06/LOZs1t5MY0KjKOzy/1WLS1vWQ4h7Lwq7Avi nMMhoA37mNU7SRkS46AU1BdC8srS/c1AhVudwKm7dAoOuWsu2amEtSGrgIC3p5PY X7hg6UiC/o/85i1M5R/BCmIJAQUKL3aqGPhiPuFEbD/gBhqwJ28IBeNdo5UkbCL+ z4HsYufiKE1ftxOl9uUXdzvwLdXMSc+esUVPXOvT+ZLqcxcWcmvdBzBpBu9iK0/q i8xb0Vsqs/B1tjlESfVBK5CXGBE7XD6cY7RIvDfF7NfAhXDfcvDQMnD/MFc1ADgQ u3sBzdpjfdpkdib9paWfn/GU1m3r0z8ZR19AJT/cD339B1dZuOBMvoZkYe5JCDUm Bca7yMZ9Btep9122a8t6G/rqKiXSPFc6EIvI6gkFWu+L1tdS8icPSLRTCIvvKH/A WTlRlg9EaWLXlHnnK0AuPWcuPQKnsGopavcdSkWv8hOk6t/8j3mQFpaOI9MSYZPm tkpqmzCmfxUyU6A1M8mbqWrF8Qb3rKnRy1h8rF08nxTaer8tBI5jnHxI11cwQ8Dr oPOLfNwaKPITUaabpaOTyhx9ArEpWr+APdBsWO0eAi84cAJJSmIcPBvi7hbGSy3a tU7/1N79bnqkTtLVnZt6UO5mEmqGnnjvcb1pDoi7CEYahQzYEtPWk6rz+peZ/CO7 E7+FYRO74g4xV9gF6GTekHW56+2spBlHODlG9SiO8n4bN/FDqj3aU0KmFNS3t23+ qU/U8/U9l9lflrGMG3vxXIkdPMnhPXo6gSjuBYYK4KmJmL0z4KCwVgH5r5m7YBhd FQ/i84mopbnCt/OcOsBobeZXYjYuRSO5jBPWI/zewKQ2JmirzWBpH8hSrbkbPQQ/ eTR8vek1BZWUuJRh7Hzuv4l7GUT1IhibLlfHHgpYo/YjAp4AHVEwem51CPa9gQnz RcVHZ0ETfp2+iR8QypszeYQUn2jphrpmFkP+P3f6DqKw+Hvt52wGWVHnGkTzxOas bv2L5IkttEc90nK+ptUvHu43HHbFSvQQ/p1rTjir8gNzbRv9eGRPhlk+gSNVx+wd DW9OtpKU/im6YFDQVWIqWNYyd7Zsc8OXF+ZhqHakcwnDNI8INM077oYjTtPFMN89 KOKSbp35SYlPqMA4OOt1mGjh8QfeHpeBFFmuTFXquzjboBLrJsMEOx9eKXnadcmf ymt1YACJuLWIUGIbUwBRL7ZWC3AisqFKz83FX8z1RNhtKkjc43AxTTMRFBwSAstS tNgOHGvDlS2wA63Rv+tEiQOa !!! DANGER !!! DON'T try to change files by yourself, DON'T use any third party software or antivirus solutions to restore your data - it may entail the private key damage and as a result all your data loss! !!! !!! !!! ONE MORE TIME: It's in your best interests to get your files back. From our side we (the best specialists in this sphere) ready to make everything for restoring but please do not interfere. !!! !!! !!

URLs

http://4to43yp4mng2gdc3jgnep5bt7lkhqvjqiritbv4x2ebj3qun7wz4y2id.onion

Signatures

Modifies extensions of user files 11 IoCs

Ransomware generally changes the extension on encrypted files.

ransomware

description	ioc	Process
File renamed	C:\Users\Admin\Pictures\HideGrant.raw => \??\c:\users\admin\pictures\HideGrant.raw.0q43lemo1	e25eaaac03aa958688cbe950275156169eb4955e145bc9627fcbfb36cd832a84.exe
File renamed	C:\Users\Admin\Pictures\ResetCompress.png => \??\c:\users\admin\pictures\ResetCompress.png.0q43lemo1	e25eaaac03aa958688cbe950275156169eb4955e145bc9627fcbfb36cd832a84.exe
File renamed	C:\Users\Admin\Pictures\CheckpointClear.png => \??\c:\users\admin\pictures\CheckpointClear.png.0q43lemo1	e25eaaac03aa958688cbe950275156169eb4955e145bc9627fcbfb36cd832a84.exe
File renamed	C:\Users\Admin\Pictures\DismountFind.png => \??\c:\users\admin\pictures\DismountFind.png.0q43lemo1	e25eaaac03aa958688cbe950275156169eb4955e145bc9627fcbfb36cd832a84.exe
File renamed	C:\Users\Admin\Pictures\LimitPing.png => \??\c:\users\admin\pictures\LimitPing.png.0q43lemo1	e25eaaac03aa958688cbe950275156169eb4955e145bc9627fcbfb36cd832a84.exe
File renamed	C:\Users\Admin\Pictures\JoinPush.crw => \??\c:\users\admin\pictures\JoinPush.crw.0q43lemo1	e25eaaac03aa958688cbe950275156169eb4955e145bc9627fcbfb36cd832a84.exe
File renamed	C:\Users\Admin\Pictures\MoveOpen.raw => \??\c:\users\admin\pictures\MoveOpen.raw.0q43lemo1	e25eaaac03aa958688cbe950275156169eb4955e145bc9627fcbfb36cd832a84.exe
File renamed	C:\Users\Admin\Pictures\ResizeWrite.raw => \??\c:\users\admin\pictures\ResizeWrite.raw.0q43lemo1	e25eaaac03aa958688cbe950275156169eb4955e145bc9627fcbfb36cd832a84.exe
File renamed	C:\Users\Admin\Pictures\UseOut.tif => \??\c:\users\admin\pictures\UseOut.tif.0q43lemo1	e25eaaac03aa958688cbe950275156169eb4955e145bc9627fcbfb36cd832a84.exe
File renamed	C:\Users\Admin\Pictures\DisableRegister.tif => \??\c:\users\admin\pictures\DisableRegister.tif.0q43lemo1	e25eaaac03aa958688cbe950275156169eb4955e145bc9627fcbfb36cd832a84.exe
File renamed	C:\Users\Admin\Pictures\EnterCopy.crw => \??\c:\users\admin\pictures\EnterCopy.crw.0q43lemo1	e25eaaac03aa958688cbe950275156169eb4955e145bc9627fcbfb36cd832a84.exe

Enumerates connected drives 3 TTPs 25 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\W:	e25eaaac03aa958688cbe950275156169eb4955e145bc9627fcbfb36cd832a84.exe
File opened (read-only)	\??\Y:	e25eaaac03aa958688cbe950275156169eb4955e145bc9627fcbfb36cd832a84.exe
File opened (read-only)	\??\B:	e25eaaac03aa958688cbe950275156169eb4955e145bc9627fcbfb36cd832a84.exe
File opened (read-only)	\??\H:	e25eaaac03aa958688cbe950275156169eb4955e145bc9627fcbfb36cd832a84.exe
File opened (read-only)	\??\J:	e25eaaac03aa958688cbe950275156169eb4955e145bc9627fcbfb36cd832a84.exe
File opened (read-only)	\??\P:	e25eaaac03aa958688cbe950275156169eb4955e145bc9627fcbfb36cd832a84.exe
File opened (read-only)	\??\Q:	e25eaaac03aa958688cbe950275156169eb4955e145bc9627fcbfb36cd832a84.exe
File opened (read-only)	\??\S:	e25eaaac03aa958688cbe950275156169eb4955e145bc9627fcbfb36cd832a84.exe
File opened (read-only)	\??\T:	e25eaaac03aa958688cbe950275156169eb4955e145bc9627fcbfb36cd832a84.exe
File opened (read-only)	\??\U:	e25eaaac03aa958688cbe950275156169eb4955e145bc9627fcbfb36cd832a84.exe
File opened (read-only)	\??\A:	e25eaaac03aa958688cbe950275156169eb4955e145bc9627fcbfb36cd832a84.exe
File opened (read-only)	\??\F:	e25eaaac03aa958688cbe950275156169eb4955e145bc9627fcbfb36cd832a84.exe
File opened (read-only)	\??\I:	e25eaaac03aa958688cbe950275156169eb4955e145bc9627fcbfb36cd832a84.exe
File opened (read-only)	\??\L:	e25eaaac03aa958688cbe950275156169eb4955e145bc9627fcbfb36cd832a84.exe
File opened (read-only)	\??\N:	e25eaaac03aa958688cbe950275156169eb4955e145bc9627fcbfb36cd832a84.exe
File opened (read-only)	\??\O:	e25eaaac03aa958688cbe950275156169eb4955e145bc9627fcbfb36cd832a84.exe
File opened (read-only)	\??\K:	e25eaaac03aa958688cbe950275156169eb4955e145bc9627fcbfb36cd832a84.exe
File opened (read-only)	\??\M:	e25eaaac03aa958688cbe950275156169eb4955e145bc9627fcbfb36cd832a84.exe
File opened (read-only)	\??\Z:	e25eaaac03aa958688cbe950275156169eb4955e145bc9627fcbfb36cd832a84.exe
File opened (read-only)	\??\E:	e25eaaac03aa958688cbe950275156169eb4955e145bc9627fcbfb36cd832a84.exe
File opened (read-only)	\??\G:	e25eaaac03aa958688cbe950275156169eb4955e145bc9627fcbfb36cd832a84.exe
File opened (read-only)	\??\R:	e25eaaac03aa958688cbe950275156169eb4955e145bc9627fcbfb36cd832a84.exe
File opened (read-only)	\??\V:	e25eaaac03aa958688cbe950275156169eb4955e145bc9627fcbfb36cd832a84.exe
File opened (read-only)	\??\X:	e25eaaac03aa958688cbe950275156169eb4955e145bc9627fcbfb36cd832a84.exe
File opened (read-only)	\??\D:	e25eaaac03aa958688cbe950275156169eb4955e145bc9627fcbfb36cd832a84.exe

Sets desktop wallpaper using registry 2 TTPs 1 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\48u.bmp"	e25eaaac03aa958688cbe950275156169eb4955e145bc9627fcbfb36cd832a84.exe

Drops file in Program Files directory 23 IoCs

description	ioc	Process
File opened for modification	\??\c:\program files\SendAdd.rtf	e25eaaac03aa958688cbe950275156169eb4955e145bc9627fcbfb36cd832a84.exe
File opened for modification	\??\c:\program files\UnregisterSave.mp2	e25eaaac03aa958688cbe950275156169eb4955e145bc9627fcbfb36cd832a84.exe
File opened for modification	\??\c:\program files\MergeTest.jtx	e25eaaac03aa958688cbe950275156169eb4955e145bc9627fcbfb36cd832a84.exe
File opened for modification	\??\c:\program files\PopEnable.wma	e25eaaac03aa958688cbe950275156169eb4955e145bc9627fcbfb36cd832a84.exe
File opened for modification	\??\c:\program files\SelectUninstall.dib	e25eaaac03aa958688cbe950275156169eb4955e145bc9627fcbfb36cd832a84.exe
File opened for modification	\??\c:\program files\OptimizeGroup.mpg	e25eaaac03aa958688cbe950275156169eb4955e145bc9627fcbfb36cd832a84.exe
File opened for modification	\??\c:\program files\RestoreRemove.vstx	e25eaaac03aa958688cbe950275156169eb4955e145bc9627fcbfb36cd832a84.exe
File opened for modification	\??\c:\program files\SendProtect.pub	e25eaaac03aa958688cbe950275156169eb4955e145bc9627fcbfb36cd832a84.exe
File created	\??\c:\program files\0q43lemo1-README.txt	e25eaaac03aa958688cbe950275156169eb4955e145bc9627fcbfb36cd832a84.exe
File created	\??\c:\program files (x86)\0q43lemo1-README.txt	e25eaaac03aa958688cbe950275156169eb4955e145bc9627fcbfb36cd832a84.exe
File opened for modification	\??\c:\program files\InvokeRead.rtf	e25eaaac03aa958688cbe950275156169eb4955e145bc9627fcbfb36cd832a84.exe
File opened for modification	\??\c:\program files\SubmitJoin.aiff	e25eaaac03aa958688cbe950275156169eb4955e145bc9627fcbfb36cd832a84.exe
File opened for modification	\??\c:\program files\UninstallStart.tiff	e25eaaac03aa958688cbe950275156169eb4955e145bc9627fcbfb36cd832a84.exe
File opened for modification	\??\c:\program files\EnterAssert.htm	e25eaaac03aa958688cbe950275156169eb4955e145bc9627fcbfb36cd832a84.exe
File opened for modification	\??\c:\program files\HideSync.m1v	e25eaaac03aa958688cbe950275156169eb4955e145bc9627fcbfb36cd832a84.exe
File opened for modification	\??\c:\program files\RedoUnprotect.clr	e25eaaac03aa958688cbe950275156169eb4955e145bc9627fcbfb36cd832a84.exe
File opened for modification	\??\c:\program files\ResolveAdd.wma	e25eaaac03aa958688cbe950275156169eb4955e145bc9627fcbfb36cd832a84.exe
File opened for modification	\??\c:\program files\ShowGrant.kix	e25eaaac03aa958688cbe950275156169eb4955e145bc9627fcbfb36cd832a84.exe
File opened for modification	\??\c:\program files\StopCompress.mht	e25eaaac03aa958688cbe950275156169eb4955e145bc9627fcbfb36cd832a84.exe
File opened for modification	\??\c:\program files\UninstallEdit.potm	e25eaaac03aa958688cbe950275156169eb4955e145bc9627fcbfb36cd832a84.exe
File opened for modification	\??\c:\program files\CloseDisable.pcx	e25eaaac03aa958688cbe950275156169eb4955e145bc9627fcbfb36cd832a84.exe
File opened for modification	\??\c:\program files\ConvertFromUndo.pptx	e25eaaac03aa958688cbe950275156169eb4955e145bc9627fcbfb36cd832a84.exe
File opened for modification	\??\c:\program files\RemoveOpen.temp	e25eaaac03aa958688cbe950275156169eb4955e145bc9627fcbfb36cd832a84.exe

Suspicious behavior: EnumeratesProcesses 5 IoCs

pid	Process
4648	e25eaaac03aa958688cbe950275156169eb4955e145bc9627fcbfb36cd832a84.exe
4648	e25eaaac03aa958688cbe950275156169eb4955e145bc9627fcbfb36cd832a84.exe
4248	powershell.exe
4248	powershell.exe
4248	powershell.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeDebugPrivilege	4648	e25eaaac03aa958688cbe950275156169eb4955e145bc9627fcbfb36cd832a84.exe
Token: SeDebugPrivilege	4248	powershell.exe
Token: SeBackupPrivilege	908	vssvc.exe
Token: SeRestorePrivilege	908	vssvc.exe
Token: SeAuditPrivilege	908	vssvc.exe
Token: SeTakeOwnershipPrivilege	4648	e25eaaac03aa958688cbe950275156169eb4955e145bc9627fcbfb36cd832a84.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4648 wrote to memory of 4248	4648	e25eaaac03aa958688cbe950275156169eb4955e145bc9627fcbfb36cd832a84.exe	77
PID 4648 wrote to memory of 4248	4648	e25eaaac03aa958688cbe950275156169eb4955e145bc9627fcbfb36cd832a84.exe	77

C:\Users\Admin\AppData\Local\Temp\e25eaaac03aa958688cbe950275156169eb4955e145bc9627fcbfb36cd832a84.exe
"C:\Users\Admin\AppData\Local\Temp\e25eaaac03aa958688cbe950275156169eb4955e145bc9627fcbfb36cd832a84.exe"
1⤵
- Modifies extensions of user files
- Enumerates connected drives
- Sets desktop wallpaper using registry
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4648
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -e RwBlAHQALQBXAG0AaQBPAGIAagBlAGMAdAAgAFcAaQBuADMAMgBfAFMAaABhAGQAbwB3AGMAbwBwAHkAIAB8ACAARgBvAHIARQBhAGMAaAAtAE8AYgBqAGUAYwB0ACAAewAkAF8ALgBEAGUAbABlAHQAZQAoACkAOwB9AA==
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4248