General

  • Target

    52f7f9e8369a3e89899d40e89766c9642b137b25bfd58a2b564dac67a40445f3

  • Size

    254KB

  • Sample

    210906-jdz5jsdhan

  • MD5

    d70181d031e35f86d26be56d230b7d4e

  • SHA1

    27ad13e49541f0f9806a21ea825aab95fba11608

  • SHA256

    52f7f9e8369a3e89899d40e89766c9642b137b25bfd58a2b564dac67a40445f3

  • SHA512

    ad97d1a955f864751ac7243c54d3c611507f7c541aa4a9761ff7b587545a3aee0d23faa24ecd983f71458b9307197cf062181dd51503cc05a6a3f741162cfb2e

Malware Config

Extracted

Path

C:\Users\Admin\AppData\Local\Temp\RESTORE_FILES_INFO.txt

Ransom Note
!!! ALL YOUR FILES ARE ENCRYPTED !!! All your files, documents, photos, databases and other important files are encrypted. You are not able to decrypt it by yourself! The only method of recovering files is to purchase an unique private key. Only we can give you this key and only we can recover your files. !!!!!!!!! We backed up all your documents and databases. IF YOU NOT START DIALOGUE WITH US, WE WILL POST ALL YOUR DOCUMENTS AND DATABASES ON INTERNET. !!!!!!!!! We recommend you upload 3 encrypted files in https://privatlab.com/file and paste link to you message. We will demonstrate that we can recover your files. * Please note that files must not contain any valuable information. Do you really want to restore your files? 1) Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open website: http://sonarmsniko2lvfu.onion/?a=reg c) Register account  d) Click Compose  and write to us, our username: Prometheus, in message write Your key identifier (it is at the end of file) and file extension (forexample .TEST[[email protected]]) and link to 3 encrypted files in https://privatlab.com/file 2) Using a email Write to 3 emails address at once, in message write Your key identifier (it is at the end of file) and file extension (forexample .TEST[[email protected]]) and link to 3 encrypted files in https://privatlab.com/file : [email protected] [email protected] [email protected] We recommend using 1 method via TOR browser to contact us. Email letters may not reach us. Therefore, if you do not receive a response within 12 hours, please use method 1. * Do not rename encrypted files. * Do not try to decrypt your data using third party software, it may cause permanent data loss. * Decryption of your files with the help of third parties may cause increased price (they add their fee to our) or you can become a victim of a scam. * For our safety, all information about your server and your decryption key will be automaticaly DELETED AFTER 7 DAYS! You will irrevocably lose all your data! Key Identifier: Y5TSwUazPAzsV/47aMWYWPr+uuND67SrVwyV+hbSqWXS49Yze33sYkX5Up8/rY+S6nfIhXRC8M1djJNUHRJUCDdDLWT8mvm20Qlm3efByTlzs01C38jdAlUDYTvCzDHtSAAd5RnGHwq+4dizL0EUeJP4LnL8L8GrovOuVlnrWYhwNWQN2su1IHhxT95AQ4646ZNG3zALeEba+3PYuMVcrBX1WqEu10A4pCOn2520RlvVlIbX2ngyDADDzTMDOMeOI7ImXZtMriZK1TkxCjy483qvhxq1P4M8v7GLJcOhOn1UfVV+aWFd7d0AieesJMzZHy+atxXXIQqgYABVdj5kMUxS14a29i4zwARDyhgDrPO7cQh+79RnYDSpX8VyUBE8+qUlv4fqGXje+lCb2SnubhndcczPT9QPrDVfFEFfcBC2MVP3mV7Xae/hwMym+ewRH5pcJpiN5m9PZzXRuqMhhdc3teZIOiIUjNc2nh1biAfkxMiV96KbyHmgd6K0Sj8reL6ehFZ9HUowAueFiBttewNKkU2Dr7lYnBelXA0WhaAKXISLWo5koYPE7QtHWLr1XkF/R4uw6oELtjnYHaJGQWn5FPke5Kh0HcHEZZ0XvPpvCuETwknEU5Osv2VIBiEA20T/uocaVOdw8STaajxkWZnY91JnAPkU5jsrU3uzxYg=
URLs

https://privatlab.com/file

http://sonarmsniko2lvfu.onion/?a=reg

Extracted

Path

C:\Users\Admin\Desktop\RESTORE_FILES_INFO.hta

Ransom Note
!!! ALL YOUR FILES ARE ENCRYPTED !!! All your files, documents, photos, databases and other important files are encrypted. You are not able to decrypt it by yourself! The only method of recovering files is to purchase an unique private key. Only we can give you this key and only we can recover your files. !!!!!!!!! We backed up all your documents and databases. IF YOU NOT START DIALOGUE WITH US, WE WILL POST ALL YOUR DOCUMENTS AND DATABASES ON INTERNET. !!!!!!!!! We recommend you upload 3 encrypted files in https://privatlab.com/file and paste link to you message. We will demonstrate that we can recover your files. * Please note that files must not contain any valuable information. Do you really want to restore your files? 1) Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open website: http://sonarmsniko2lvfu.onion/?a=reg c) Register account d) Click Compose and write to us, our username: Prometheus, in message write Your key identifier (it is at the end of file) and file extension (forexample .TEST[[email protected]]) and link to 3 encrypted files in https://privatlab.com/file 2) Using a email Write to 3 emails address at once, in message write Your key identifier (it is at the end of file) and file extension (forexample .TEST[[email protected]]) and link to 3 encrypted files in https://privatlab.com/file : [email protected] [email protected] [email protected] We recommend using 1 method via TOR browser to contact us. Email letters may not reach us. Therefore, if you do not receive a response within 12 hours, please use method 1. * Do not rename encrypted files. * Do not try to decrypt your data using third party software, it may cause permanent data loss. * Decryption of your files with the help of third parties may cause increased price (they add their fee to our) or you can become a victim of a scam. * For our safety, all information about your server and your decryption key will be automaticaly DELETED AFTER 7 DAYS! You will irrevocably lose all your data! Key Identifier: Y5TSwUazPAzsV/47aMWYWPr+uuND67SrVwyV+hbSqWXS49Yze33sYkX5Up8/rY+S6nfIhXRC8M1djJNUHRJUCDdDLWT8mvm20Qlm3efByTlzs01C38jdAlUDYTvCzDHtSAAd5RnGHwq+4dizL0EUeJP4LnL8L8GrovOuVlnrWYhwNWQN2su1IHhxT95AQ4646ZNG3zALeEba+3PYuMVcrBX1WqEu10A4pCOn2520RlvVlIbX2ngyDADDzTMDOMeOI7ImXZtMriZK1TkxCjy483qvhxq1P4M8v7GLJcOhOn1UfVV+aWFd7d0AieesJMzZHy+atxXXIQqgYABVdj5kMUxS14a29i4zwARDyhgDrPO7cQh+79RnYDSpX8VyUBE8+qUlv4fqGXje+lCb2SnubhndcczPT9QPrDVfFEFfcBC2MVP3mV7Xae/hwMym+ewRH5pcJpiN5m9PZzXRuqMhhdc3teZIOiIUjNc2nh1biAfkxMiV96KbyHmgd6K0Sj8reL6ehFZ9HUowAueFiBttewNKkU2Dr7lYnBelXA0WhaAKXISLWo5koYPE7QtHWLr1XkF/R4uw6oELtjnYHaJGQWn5FPke5Kh0HcHEZZ0XvPpvCuETwknEU5Osv2VIBiEA20T/uocaVOdw8STaajxkWZnY91JnAPkU5jsrU3uzxYg=
URLs

https://privatlab.com/file

http://sonarmsniko2lvfu.onion/?a=reg

Extracted

Path

C:\Users\Admin\AppData\Local\Temp\RESTORE_FILES_INFO.txt

Ransom Note
!!! ALL YOUR FILES ARE ENCRYPTED !!! All your files, documents, photos, databases and other important files are encrypted. You are not able to decrypt it by yourself! The only method of recovering files is to purchase an unique private key. Only we can give you this key and only we can recover your files. !!!!!!!!! We backed up all your documents and databases. IF YOU NOT START DIALOGUE WITH US, WE WILL POST ALL YOUR DOCUMENTS AND DATABASES ON INTERNET. !!!!!!!!! We recommend you upload 3 encrypted files in https://privatlab.com/file and paste link to you message. We will demonstrate that we can recover your files. * Please note that files must not contain any valuable information. Do you really want to restore your files? 1) Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open website: http://sonarmsniko2lvfu.onion/?a=reg c) Register account  d) Click Compose  and write to us, our username: Prometheus, in message write Your key identifier (it is at the end of file) and file extension (forexample .TEST[[email protected]]) and link to 3 encrypted files in https://privatlab.com/file 2) Using a email Write to 3 emails address at once, in message write Your key identifier (it is at the end of file) and file extension (forexample .TEST[[email protected]]) and link to 3 encrypted files in https://privatlab.com/file : [email protected] [email protected] [email protected] We recommend using 1 method via TOR browser to contact us. Email letters may not reach us. Therefore, if you do not receive a response within 12 hours, please use method 1. * Do not rename encrypted files. * Do not try to decrypt your data using third party software, it may cause permanent data loss. * Decryption of your files with the help of third parties may cause increased price (they add their fee to our) or you can become a victim of a scam. * For our safety, all information about your server and your decryption key will be automaticaly DELETED AFTER 7 DAYS! You will irrevocably lose all your data! Key Identifier: B05QAvu1NNvtlfESrIbTPLrH6GWkNyu6xYJmqmAkH0h6BLPT92MyHMpMNZcGnYRYMRYQOQVKhYfyoi9ZO1LimnBnNkMynuO7Z1/WE9MDeMTLicjdjnFXRCV2F/lH0RJWYyGgNNHI099IM+rDsqpcmUbSUloKwf75oTSNawiPOXAgHODs/oSUs5EtBL5Bts9YS1wLFFjZdetEciUyfWwPGpcvMIjcJsNbdX7shk60AnNC9IJ+69c2kL173+M2EbpBpvAtbjaMVhHVs67K1iqYKZjy9EZv1wYzUJJ/yMf2g7c1d4Wnzj65EZnXXMlFQRAqNSi+AjP4+DLt2+Pdj8FdyTlKkkQhszzKFHASFI+55NHImyPqYGIB0n/s66TxcwRowtiQ5Y1fPQNuCKmk2NIHNvYLZ3iHJyTSWuXzE+nSbzJg+akkMR8ant27GCE+wUaOtg+jO/vA5WV2F9b+qKa5eJWe8T2am8SphTANH8rWRNmHnFhXjDc4jErB3xSzU6f4+nGBh7CmYXS+UNeIw7TvI5mdCk+KFWzsVWtUnVp/Nz7oBCB8QGP4XdT4ioZmZR8yAlFLsUTWZdLIWAQWPj2rCzLcoSvlRocaSLkaozZGXpM48XUTibgxRUEwIos3wvxoJT58tC3N+aCefjQp5Ino/W8nk6hiVDhD96Uu5Zyuitc=
URLs

https://privatlab.com/file

http://sonarmsniko2lvfu.onion/?a=reg

Extracted

Path

C:\Users\Admin\Desktop\RESTORE_FILES_INFO.hta

Ransom Note
!!! ALL YOUR FILES ARE ENCRYPTED !!! All your files, documents, photos, databases and other important files are encrypted. You are not able to decrypt it by yourself! The only method of recovering files is to purchase an unique private key. Only we can give you this key and only we can recover your files. !!!!!!!!! We backed up all your documents and databases. IF YOU NOT START DIALOGUE WITH US, WE WILL POST ALL YOUR DOCUMENTS AND DATABASES ON INTERNET. !!!!!!!!! We recommend you upload 3 encrypted files in https://privatlab.com/file and paste link to you message. We will demonstrate that we can recover your files. * Please note that files must not contain any valuable information. Do you really want to restore your files? 1) Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open website: http://sonarmsniko2lvfu.onion/?a=reg c) Register account d) Click Compose and write to us, our username: Prometheus, in message write Your key identifier (it is at the end of file) and file extension (forexample .TEST[[email protected]]) and link to 3 encrypted files in https://privatlab.com/file 2) Using a email Write to 3 emails address at once, in message write Your key identifier (it is at the end of file) and file extension (forexample .TEST[[email protected]]) and link to 3 encrypted files in https://privatlab.com/file : [email protected] [email protected] [email protected] We recommend using 1 method via TOR browser to contact us. Email letters may not reach us. Therefore, if you do not receive a response within 12 hours, please use method 1. * Do not rename encrypted files. * Do not try to decrypt your data using third party software, it may cause permanent data loss. * Decryption of your files with the help of third parties may cause increased price (they add their fee to our) or you can become a victim of a scam. * For our safety, all information about your server and your decryption key will be automaticaly DELETED AFTER 7 DAYS! You will irrevocably lose all your data! Key Identifier: B05QAvu1NNvtlfESrIbTPLrH6GWkNyu6xYJmqmAkH0h6BLPT92MyHMpMNZcGnYRYMRYQOQVKhYfyoi9ZO1LimnBnNkMynuO7Z1/WE9MDeMTLicjdjnFXRCV2F/lH0RJWYyGgNNHI099IM+rDsqpcmUbSUloKwf75oTSNawiPOXAgHODs/oSUs5EtBL5Bts9YS1wLFFjZdetEciUyfWwPGpcvMIjcJsNbdX7shk60AnNC9IJ+69c2kL173+M2EbpBpvAtbjaMVhHVs67K1iqYKZjy9EZv1wYzUJJ/yMf2g7c1d4Wnzj65EZnXXMlFQRAqNSi+AjP4+DLt2+Pdj8FdyTlKkkQhszzKFHASFI+55NHImyPqYGIB0n/s66TxcwRowtiQ5Y1fPQNuCKmk2NIHNvYLZ3iHJyTSWuXzE+nSbzJg+akkMR8ant27GCE+wUaOtg+jO/vA5WV2F9b+qKa5eJWe8T2am8SphTANH8rWRNmHnFhXjDc4jErB3xSzU6f4+nGBh7CmYXS+UNeIw7TvI5mdCk+KFWzsVWtUnVp/Nz7oBCB8QGP4XdT4ioZmZR8yAlFLsUTWZdLIWAQWPj2rCzLcoSvlRocaSLkaozZGXpM48XUTibgxRUEwIos3wvxoJT58tC3N+aCefjQp5Ino/W8nk6hiVDhD96Uu5Zyuitc=
URLs

https://privatlab.com/file

http://sonarmsniko2lvfu.onion/?a=reg

Targets

    • Target

      52f7f9e8369a3e89899d40e89766c9642b137b25bfd58a2b564dac67a40445f3

    • Size

      254KB

    • MD5

      d70181d031e35f86d26be56d230b7d4e

    • SHA1

      27ad13e49541f0f9806a21ea825aab95fba11608

    • SHA256

      52f7f9e8369a3e89899d40e89766c9642b137b25bfd58a2b564dac67a40445f3

    • SHA512

      ad97d1a955f864751ac7243c54d3c611507f7c541aa4a9761ff7b587545a3aee0d23faa24ecd983f71458b9307197cf062181dd51503cc05a6a3f741162cfb2e

    • Blocklisted process makes network request

    • Modifies Windows Firewall

    • Deletes itself

    • Drops startup file

    • Modifies file permissions

    • Modifies WinLogon

MITRE ATT&CK Enterprise v6

Tasks