Overview

overview

10

Static

static

3

microsoft-...le.exe

windows7_x64

7

microsoft-...le.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    microsoft-service.file

  • Size

    8.7MB

  • Sample

    211025-srr6jagcg9

  • MD5

    ea68e41df9270259b9132fb4939ccb9f

  • SHA1

    317f2b5d2a7ed69abb121f9a59502a5dd9d8c00e

  • SHA256

    314302e1fee3d78fa6c3ce096ed2f87fb87124255eee67b42d422c6525680abd

  • SHA512

    7f2659935956d93869ae373e1283a09b59a9ba6911332a84635ea330ab983a1a539c345bc621de009e7cd70a8a28a97835609e740e69ada56ca995427873469b

Score
10/10
pyinstallerransomware

Malware Config

Extracted

Path

C:\Users\Admin\Desktop\README.txt

Ransom Note
Your network has been penetrated. All files on your device has been encrypted with a strong algorithm. All your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key. The only method of recovering files is to purchase decrypt tool and unique key for you. We exclusively have decryption software for your situation. If you want to restore your files write an email to us (contacts at the bottom of the page). DO NOT USE third party software to decrypt, this will damage the files and will not be able to decrypt them. For your files to be decrypted we only ask for a small portion of Bitcoin. Our asking amount is ($100 in Bitcoin). To create a Bitcoin wallet vist bitcoin.org Then transfer $100 in Bitcoin to the following Bitcoin Address: 3MHWyofVSoTCUywa4fRnnrhobtijRL6aSQ Once we have payment we will then send you the decryption software private key for getting back to business. If you feel you do not need the software or want to may payment we will release all your valuable data that will be open to public. ---------------------NOTE--------------------- DO NOT RESET OR SHUTDOWN - FILES MAY BE DAMAGED. NO NOT DELETE README FILE. Email Address: johnpeter27@protonmail.com
Emails

johnpeter27@protonmail.com

Wallets

3MHWyofVSoTCUywa4fRnnrhobtijRL6aSQ

Targets

    • Target

      microsoft-service.file

    • Size

      8.7MB

    • MD5

      ea68e41df9270259b9132fb4939ccb9f

    • SHA1

      317f2b5d2a7ed69abb121f9a59502a5dd9d8c00e

    • SHA256

      314302e1fee3d78fa6c3ce096ed2f87fb87124255eee67b42d422c6525680abd

    • SHA512

      7f2659935956d93869ae373e1283a09b59a9ba6911332a84635ea330ab983a1a539c345bc621de009e7cd70a8a28a97835609e740e69ada56ca995427873469b

    Score
    10/10
    ransomware

    • Loads dropped DLL

    • Generic Ransomware Note

      Ransomware often writes a note containing information on how to pay the ransom.

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks