Overview

overview

10

Static

static

10

52f7f9e836...f3.exe

windows7_x64

10

52f7f9e836...f3.exe

windows10_x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    52f7f9e8369a3e89899d40e89766c9642b137b25bfd58a2b564dac67a40445f3
  • Size 254KB
  • Sample210906-jdz5jsdhan
  • SHA256 52f7f9e8369a3e89899d40e89766c9642b137b25bfd58a2b564dac67a40445f3
  • MD5 SHA1 SHA512
Score
10/10
thanosdiscoveryevasionpersistenceransomware

Malware Config

Extracted

Path

  • C:\Users\Admin\AppData\Local\Temp\RESTORE_FILES_INFO.txt

Ransom Note
  • !!! ALL YOUR FILES ARE ENCRYPTED !!! All your files, documents, photos, databases and other important files are encrypted. You are not able to decrypt it by yourself! The only method of recovering files is to purchase an unique private key. Only we can give you this key and only we can recover your files. !!!!!!!!! We backed up all your documents and databases. IF YOU NOT START DIALOGUE WITH US, WE WILL POST ALL YOUR DOCUMENTS AND DATABASES ON INTERNET. !!!!!!!!! We recommend you upload 3 encrypted files in https://privatlab.com/file and paste link to you message. We will demonstrate that we can recover your files. * Please note that files must not contain any valuable information. Do you really want to restore your files? 1) Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open website: http://sonarmsniko2lvfu.onion/?a=reg c) Register account  d) Click Compose  and write to us, our username: Prometheus, in message write Your key identifier (it is at the end of file) and file extension (forexample .TEST[[email protected]]) and link to 3 encrypted files in https://privatlab.com/file 2) Using a email Write to 3 emails address at once, in message write Your key identifier (it is at the end of file) and file extension (forexample .TEST[[email protected]]) and link to 3 encrypted files in https://privatlab.com/file : [email protected] [email protected] [email protected] We recommend using 1 method via TOR browser to contact us. Email letters may not reach us. Therefore, if you do not receive a response within 12 hours, please use method 1. * Do not rename encrypted files. * Do not try to decrypt your data using third party software, it may cause permanent data loss. * Decryption of your files with the help of third parties may cause increased price (they add their fee to our) or you can become a victim of a scam. * For our safety, all information about your server and your decryption key will be automaticaly DELETED AFTER 7 DAYS! You will irrevocably lose all your data! Key Identifier: Y5TSwUazPAzsV/47aMWYWPr+uuND67SrVwyV+hbSqWXS49Yze33sYkX5Up8/rY+S6nfIhXRC8M1djJNUHRJUCDdDLWT8mvm20Qlm3efByTlzs01C38jdAlUDYTvCzDHtSAAd5RnGHwq+4dizL0EUeJP4LnL8L8GrovOuVlnrWYhwNWQN2su1IHhxT95AQ4646ZNG3zALeEba+3PYuMVcrBX1WqEu10A4pCOn2520RlvVlIbX2ngyDADDzTMDOMeOI7ImXZtMriZK1TkxCjy483qvhxq1P4M8v7GLJcOhOn1UfVV+aWFd7d0AieesJMzZHy+atxXXIQqgYABVdj5kMUxS14a29i4zwARDyhgDrPO7cQh+79RnYDSpX8VyUBE8+qUlv4fqGXje+lCb2SnubhndcczPT9QPrDVfFEFfcBC2MVP3mV7Xae/hwMym+ewRH5pcJpiN5m9PZzXRuqMhhdc3teZIOiIUjNc2nh1biAfkxMiV96KbyHmgd6K0Sj8reL6ehFZ9HUowAueFiBttewNKkU2Dr7lYnBelXA0WhaAKXISLWo5koYPE7QtHWLr1XkF/R4uw6oELtjnYHaJGQWn5FPke5Kh0HcHEZZ0XvPpvCuETwknEU5Osv2VIBiEA20T/uocaVOdw8STaajxkWZnY91JnAPkU5jsrU3uzxYg=
URLs

  • https://privatlab.com/file

  • http://sonarmsniko2lvfu.onion/?a=reg

Extracted

Path

  • C:\Users\Admin\Desktop\RESTORE_FILES_INFO.hta

Ransom Note
  • !!! ALL YOUR FILES ARE ENCRYPTED !!! All your files, documents, photos, databases and other important files are encrypted. You are not able to decrypt it by yourself! The only method of recovering files is to purchase an unique private key. Only we can give you this key and only we can recover your files. !!!!!!!!! We backed up all your documents and databases. IF YOU NOT START DIALOGUE WITH US, WE WILL POST ALL YOUR DOCUMENTS AND DATABASES ON INTERNET. !!!!!!!!! We recommend you upload 3 encrypted files in https://privatlab.com/file and paste link to you message. We will demonstrate that we can recover your files. * Please note that files must not contain any valuable information. Do you really want to restore your files? 1) Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open website: http://sonarmsniko2lvfu.onion/?a=reg c) Register account d) Click Compose and write to us, our username: Prometheus, in message write Your key identifier (it is at the end of file) and file extension (forexample .TEST[[email protected]]) and link to 3 encrypted files in https://privatlab.com/file 2) Using a email Write to 3 emails address at once, in message write Your key identifier (it is at the end of file) and file extension (forexample .TEST[[email protected]]) and link to 3 encrypted files in https://privatlab.com/file : [email protected] [email protected] [email protected] We recommend using 1 method via TOR browser to contact us. Email letters may not reach us. Therefore, if you do not receive a response within 12 hours, please use method 1. * Do not rename encrypted files. * Do not try to decrypt your data using third party software, it may cause permanent data loss. * Decryption of your files with the help of third parties may cause increased price (they add their fee to our) or you can become a victim of a scam. * For our safety, all information about your server and your decryption key will be automaticaly DELETED AFTER 7 DAYS! You will irrevocably lose all your data! Key Identifier: Y5TSwUazPAzsV/47aMWYWPr+uuND67SrVwyV+hbSqWXS49Yze33sYkX5Up8/rY+S6nfIhXRC8M1djJNUHRJUCDdDLWT8mvm20Qlm3efByTlzs01C38jdAlUDYTvCzDHtSAAd5RnGHwq+4dizL0EUeJP4LnL8L8GrovOuVlnrWYhwNWQN2su1IHhxT95AQ4646ZNG3zALeEba+3PYuMVcrBX1WqEu10A4pCOn2520RlvVlIbX2ngyDADDzTMDOMeOI7ImXZtMriZK1TkxCjy483qvhxq1P4M8v7GLJcOhOn1UfVV+aWFd7d0AieesJMzZHy+atxXXIQqgYABVdj5kMUxS14a29i4zwARDyhgDrPO7cQh+79RnYDSpX8VyUBE8+qUlv4fqGXje+lCb2SnubhndcczPT9QPrDVfFEFfcBC2MVP3mV7Xae/hwMym+ewRH5pcJpiN5m9PZzXRuqMhhdc3teZIOiIUjNc2nh1biAfkxMiV96KbyHmgd6K0Sj8reL6ehFZ9HUowAueFiBttewNKkU2Dr7lYnBelXA0WhaAKXISLWo5koYPE7QtHWLr1XkF/R4uw6oELtjnYHaJGQWn5FPke5Kh0HcHEZZ0XvPpvCuETwknEU5Osv2VIBiEA20T/uocaVOdw8STaajxkWZnY91JnAPkU5jsrU3uzxYg=
URLs

  • https://privatlab.com/file

  • http://sonarmsniko2lvfu.onion/?a=reg

Extracted

Path

  • C:\Users\Admin\AppData\Local\Temp\RESTORE_FILES_INFO.txt

Ransom Note
  • !!! ALL YOUR FILES ARE ENCRYPTED !!! All your files, documents, photos, databases and other important files are encrypted. You are not able to decrypt it by yourself! The only method of recovering files is to purchase an unique private key. Only we can give you this key and only we can recover your files. !!!!!!!!! We backed up all your documents and databases. IF YOU NOT START DIALOGUE WITH US, WE WILL POST ALL YOUR DOCUMENTS AND DATABASES ON INTERNET. !!!!!!!!! We recommend you upload 3 encrypted files in https://privatlab.com/file and paste link to you message. We will demonstrate that we can recover your files. * Please note that files must not contain any valuable information. Do you really want to restore your files? 1) Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open website: http://sonarmsniko2lvfu.onion/?a=reg c) Register account  d) Click Compose  and write to us, our username: Prometheus, in message write Your key identifier (it is at the end of file) and file extension (forexample .TEST[[email protected]]) and link to 3 encrypted files in https://privatlab.com/file 2) Using a email Write to 3 emails address at once, in message write Your key identifier (it is at the end of file) and file extension (forexample .TEST[[email protected]]) and link to 3 encrypted files in https://privatlab.com/file : [email protected] [email protected] [email protected] We recommend using 1 method via TOR browser to contact us. Email letters may not reach us. Therefore, if you do not receive a response within 12 hours, please use method 1. * Do not rename encrypted files. * Do not try to decrypt your data using third party software, it may cause permanent data loss. * Decryption of your files with the help of third parties may cause increased price (they add their fee to our) or you can become a victim of a scam. * For our safety, all information about your server and your decryption key will be automaticaly DELETED AFTER 7 DAYS! You will irrevocably lose all your data! Key Identifier: B05QAvu1NNvtlfESrIbTPLrH6GWkNyu6xYJmqmAkH0h6BLPT92MyHMpMNZcGnYRYMRYQOQVKhYfyoi9ZO1LimnBnNkMynuO7Z1/WE9MDeMTLicjdjnFXRCV2F/lH0RJWYyGgNNHI099IM+rDsqpcmUbSUloKwf75oTSNawiPOXAgHODs/oSUs5EtBL5Bts9YS1wLFFjZdetEciUyfWwPGpcvMIjcJsNbdX7shk60AnNC9IJ+69c2kL173+M2EbpBpvAtbjaMVhHVs67K1iqYKZjy9EZv1wYzUJJ/yMf2g7c1d4Wnzj65EZnXXMlFQRAqNSi+AjP4+DLt2+Pdj8FdyTlKkkQhszzKFHASFI+55NHImyPqYGIB0n/s66TxcwRowtiQ5Y1fPQNuCKmk2NIHNvYLZ3iHJyTSWuXzE+nSbzJg+akkMR8ant27GCE+wUaOtg+jO/vA5WV2F9b+qKa5eJWe8T2am8SphTANH8rWRNmHnFhXjDc4jErB3xSzU6f4+nGBh7CmYXS+UNeIw7TvI5mdCk+KFWzsVWtUnVp/Nz7oBCB8QGP4XdT4ioZmZR8yAlFLsUTWZdLIWAQWPj2rCzLcoSvlRocaSLkaozZGXpM48XUTibgxRUEwIos3wvxoJT58tC3N+aCefjQp5Ino/W8nk6hiVDhD96Uu5Zyuitc=
URLs

  • https://privatlab.com/file

  • http://sonarmsniko2lvfu.onion/?a=reg

Extracted

Path

  • C:\Users\Admin\Desktop\RESTORE_FILES_INFO.hta

Ransom Note
  • !!! ALL YOUR FILES ARE ENCRYPTED !!! All your files, documents, photos, databases and other important files are encrypted. You are not able to decrypt it by yourself! The only method of recovering files is to purchase an unique private key. Only we can give you this key and only we can recover your files. !!!!!!!!! We backed up all your documents and databases. IF YOU NOT START DIALOGUE WITH US, WE WILL POST ALL YOUR DOCUMENTS AND DATABASES ON INTERNET. !!!!!!!!! We recommend you upload 3 encrypted files in https://privatlab.com/file and paste link to you message. We will demonstrate that we can recover your files. * Please note that files must not contain any valuable information. Do you really want to restore your files? 1) Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open website: http://sonarmsniko2lvfu.onion/?a=reg c) Register account d) Click Compose and write to us, our username: Prometheus, in message write Your key identifier (it is at the end of file) and file extension (forexample .TEST[[email protected]]) and link to 3 encrypted files in https://privatlab.com/file 2) Using a email Write to 3 emails address at once, in message write Your key identifier (it is at the end of file) and file extension (forexample .TEST[[email protected]]) and link to 3 encrypted files in https://privatlab.com/file : [email protected] [email protected] [email protected] We recommend using 1 method via TOR browser to contact us. Email letters may not reach us. Therefore, if you do not receive a response within 12 hours, please use method 1. * Do not rename encrypted files. * Do not try to decrypt your data using third party software, it may cause permanent data loss. * Decryption of your files with the help of third parties may cause increased price (they add their fee to our) or you can become a victim of a scam. * For our safety, all information about your server and your decryption key will be automaticaly DELETED AFTER 7 DAYS! You will irrevocably lose all your data! Key Identifier: B05QAvu1NNvtlfESrIbTPLrH6GWkNyu6xYJmqmAkH0h6BLPT92MyHMpMNZcGnYRYMRYQOQVKhYfyoi9ZO1LimnBnNkMynuO7Z1/WE9MDeMTLicjdjnFXRCV2F/lH0RJWYyGgNNHI099IM+rDsqpcmUbSUloKwf75oTSNawiPOXAgHODs/oSUs5EtBL5Bts9YS1wLFFjZdetEciUyfWwPGpcvMIjcJsNbdX7shk60AnNC9IJ+69c2kL173+M2EbpBpvAtbjaMVhHVs67K1iqYKZjy9EZv1wYzUJJ/yMf2g7c1d4Wnzj65EZnXXMlFQRAqNSi+AjP4+DLt2+Pdj8FdyTlKkkQhszzKFHASFI+55NHImyPqYGIB0n/s66TxcwRowtiQ5Y1fPQNuCKmk2NIHNvYLZ3iHJyTSWuXzE+nSbzJg+akkMR8ant27GCE+wUaOtg+jO/vA5WV2F9b+qKa5eJWe8T2am8SphTANH8rWRNmHnFhXjDc4jErB3xSzU6f4+nGBh7CmYXS+UNeIw7TvI5mdCk+KFWzsVWtUnVp/Nz7oBCB8QGP4XdT4ioZmZR8yAlFLsUTWZdLIWAQWPj2rCzLcoSvlRocaSLkaozZGXpM48XUTibgxRUEwIos3wvxoJT58tC3N+aCefjQp5Ino/W8nk6hiVDhD96Uu5Zyuitc=
URLs

  • https://privatlab.com/file

  • http://sonarmsniko2lvfu.onion/?a=reg

Targets

    • Target
      52f7f9e8369a3e89899d40e89766c9642b137b25bfd58a2b564dac67a40445f3
    • Size 254KB
    • SHA256 52f7f9e8369a3e89899d40e89766c9642b137b25bfd58a2b564dac67a40445f3
    • MD5 SHA1 SHA512
    Score
    10/10
    discoveryevasionpersistenceransomware

    • Blocklisted process makes network request

    • Modifies Windows Firewall

      evasion

    • Deletes itself

    • Drops startup file

    • Modifies file permissions

      discovery

    • Modifies WinLogon

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks