9d4458f6de6fb97b9b2a6ee9a69b62f4

General
Target

9d4458f6de6fb97b9b2a6ee9a69b62f4

Size

58KB

Sample

211021-rg9r6aadf2

Score
10 /10
MD5

9d4458f6de6fb97b9b2a6ee9a69b62f4

SHA1

b7e91d625d95e6b6c8452c0beb4d9900da1931a2

SHA256

dfdf48403506835206467e72952fc59fa3fb3c9dabc36090e82979e0b3a624c7

SHA512

a7b91a7df43fa0902192d34b556d6957954c2878f3329a347226bb2edcfa5a5c44de3e0e245bfd1bcf2efd3c4bcbbb6e7dc17528d5917798cb9795a53dd53e06

Malware Config

Extracted

Path \??\M:\Boot\cs-CZ\Read_Me.txt
Ransom Note
Attention! All your files, documents, photos, databases and other important files are encrypted The only method of recovering files is to purchase an unique decryptor. Only we can give you this decryptor and only we can recover your files. The server with your decryptor is in a closed network TOR. You can get there by the following ways: ---------------------------------------------------------------------------------------- 1. Download Tor browser - https://www.torproject.org/ 2. Install Tor browser 3. Open Tor Browser 4. Open link in TOR browser: http://mmeeiix2ejdwkmseycljetmpiwebdvgjts75c63camjofn2cjdoulzqd.onion/?101IYODTIYO 5. and open ticket ---------------------------------------------------------------------------------------- Alternate communication channel here: https://yip.su/2QstD5
URLs

http://mmeeiix2ejdwkmseycljetmpiwebdvgjts75c63camjofn2cjdoulzqd.onion/?101IYODTIYO

https://yip.su/2QstD5

Targets
Target

9d4458f6de6fb97b9b2a6ee9a69b62f4

MD5

9d4458f6de6fb97b9b2a6ee9a69b62f4

Filesize

58KB

Score
10/10
SHA1

b7e91d625d95e6b6c8452c0beb4d9900da1931a2

SHA256

dfdf48403506835206467e72952fc59fa3fb3c9dabc36090e82979e0b3a624c7

SHA512

a7b91a7df43fa0902192d34b556d6957954c2878f3329a347226bb2edcfa5a5c44de3e0e245bfd1bcf2efd3c4bcbbb6e7dc17528d5917798cb9795a53dd53e06

Tags

Signatures

  • Modifies Windows Defender Real-time Protection settings

    Tags

    TTPs

    Modify RegistryModify Existing ServiceDisabling Security Tools
  • Windows security bypass

    Tags

    TTPs

    Disabling Security ToolsModify Registry
  • Nirsoft

  • Executes dropped EXE

  • Modifies Installed Components in the registry

    Tags

    TTPs

    Registry Run Keys / Startup FolderModify Registry
  • Loads dropped DLL

  • Windows security modification

    Tags

    TTPs

    Disabling Security ToolsModify Registry
  • Adds Run key to start application

    Tags

    TTPs

    Registry Run Keys / Startup FolderModify Registry
  • Drops desktop.ini file(s)

  • Enumerates connected drives

    Description

    Attempts to read the root path of hard drives other than the default C: drive.

    TTPs

    Query RegistryPeripheral Device DiscoverySystem Information Discovery
  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

Related Tasks

MITRE ATT&CK Matrix
Collection
    Command and Control
      Credential Access
        Execution
          Exfiltration
            Impact
              Initial Access
                Lateral Movement
                  Privilege Escalation
                    Tasks

                    static1

                    behavioral2

                    10/10