Overview

overview

10

Static

static

d0e763139d...fe.exe

windows7_x64

3

d0e763139d...fe.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    d0e763139d8ae4919323f584a1750cfe.exe

  • Size

    46KB

  • Sample

    211019-sn192ahabk

  • MD5

    d0e763139d8ae4919323f584a1750cfe

  • SHA1

    09cd2fd8de9b4968c9ea154c5f71c3273fc74087

  • SHA256

    8ecd99368b83efde6f0d0d538e135394c5aec47faf430e86c5d9449eb0c9f770

  • SHA512

    bc2a9c9fc703cedec5dfe087fb36f5eadd9335420c07018c7dfcf2ed45296370cc37b4e8da5afbcf12831ed94037281a64f37fa90cf75adc61bfe11506fe7700

Score
10/10
evasionransomwaretrojan

Malware Config

Extracted

Path

C:\Boot\bg-BG\Read_Me.txt

Ransom Note
Attention! All your files, documents, photos, databases and other important files are encrypted The only method of recovering files is to purchase an unique decryptor. Only we can give you this decryptor and only we can recover your files. The server with your decryptor is in a closed network TOR. You can get there by the following ways: ---------------------------------------------------------------------------------------- 1. Download Tor browser - https://www.torproject.org/ 2. Install Tor browser 3. Open Tor Browser 4. Open link in TOR browser: http://mmeeiix2ejdwkmseycljetmpiwebdvgjts75c63camjofn2cjdoulzqd.onion/?101TVBYKBDK 5. and open ticket ---------------------------------------------------------------------------------------- Alternate communication channel here: https://yip.su/2QstD5
URLs

http://mmeeiix2ejdwkmseycljetmpiwebdvgjts75c63camjofn2cjdoulzqd.onion/?101TVBYKBDK

https://yip.su/2QstD5

Targets

    • Target

      d0e763139d8ae4919323f584a1750cfe.exe

    • Size

      46KB

    • MD5

      d0e763139d8ae4919323f584a1750cfe

    • SHA1

      09cd2fd8de9b4968c9ea154c5f71c3273fc74087

    • SHA256

      8ecd99368b83efde6f0d0d538e135394c5aec47faf430e86c5d9449eb0c9f770

    • SHA512

      bc2a9c9fc703cedec5dfe087fb36f5eadd9335420c07018c7dfcf2ed45296370cc37b4e8da5afbcf12831ed94037281a64f37fa90cf75adc61bfe11506fe7700

    Score
    10/10
    evasionransomwaretrojan

    • Turns off Windows Defender SpyNet reporting

      evasion

    • Windows security bypass

      evasiontrojan

    • Nirsoft

    • Executes dropped EXE

    • Windows security modification

      evasiontrojan

    • Drops desktop.ini file(s)

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Disabling Security Tools

3
T1089

Modify Registry

3
T1112

Credential Access

Discovery

Query Registry

1
T1012

Peripheral Device Discovery

1
T1120

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks