148845af1fc1221f27992cac24273aada38ef2482624850897bce87413f79888

General

Target

xxx.exe
Size

2.5MB
MD5

e358685d7f843a7c91a6ba328f4d900c
SHA1

05aaba7ad51b253861714ff74a665461606e14ab
SHA256

148845af1fc1221f27992cac24273aada38ef2482624850897bce87413f79888
SHA512

69f5dc5bd415e69554a274fbda8fed69d79e216496f7907436161537c5a52ca2e299a381a13bf5fc1948b121c23866e66c5a244a066cb46d98e4e3a97f8a6b1e

Score

10^/10

ransomware

Malware Config

Extracted

Path

C:\$Recycle.Bin\PUSSY!!!DANGER.txt

Ransom Note

Two things have happened to your company. ========================================================================================================================== Gigabytes of archived files that we deemed valuable or sensitive were downloaded from your network to a secure location. When you contact us we will tell you how much data was downloaded and can provide extensive proof of the data extraction. You can analyze the type of the data we download on our websites. If you do not contact us we will start leaking the data periodically in parts. ========================================================================================================================== We have also encrypted files on your computers with military grade algorithms. If you don't have extensive backups the only way to retrieve your data is with our software. Restoration of your data with our software requires a private key which only we possess. ========================================================================================================================== To confirm that our decryption software works send 2 encrypted files from random computers to us via email. You will receive further instructions after you send us the test files. We will make sure you retrieve your data swiftly and securely and your data that we downloaded will be securely deleted when our demands are met. If we do not come to an agreement your data will be leaked on this website. Website: http://corpleaks.net TOR link: http://hxt254aygrsziejn.onion Contact us via email: [email protected] [email protected] [email protected]

Emails

[email protected]

URLs

http://corpleaks.net

http://hxt254aygrsziejn.onion

Signatures

Modifies extensions of user files 5 IoCs

Ransomware generally changes the extension on encrypted files.

ransomware

description	ioc	Process
File renamed	C:\Users\Admin\Pictures\UpdateDismount.tif => C:\Users\Admin\Pictures\UpdateDismount.tif.PUSSY	xxx.exe
File renamed	C:\Users\Admin\Pictures\ApproveRequest.tif => C:\Users\Admin\Pictures\ApproveRequest.tif.PUSSY	xxx.exe
File opened for modification	C:\Users\Admin\Pictures\JoinDismount.tiff	xxx.exe
File renamed	C:\Users\Admin\Pictures\JoinDismount.tiff => C:\Users\Admin\Pictures\JoinDismount.tiff.PUSSY	xxx.exe
File renamed	C:\Users\Admin\Pictures\ProtectShow.png => C:\Users\Admin\Pictures\ProtectShow.png.PUSSY	xxx.exe

Drops desktop.ini file(s) 27 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Desktop\desktop.ini	xxx.exe
File opened for modification	C:\Users\Admin\Favorites\desktop.ini	xxx.exe
File opened for modification	C:\Users\Admin\Searches\desktop.ini	xxx.exe
File opened for modification	C:\Users\Public\Music\Sample Music\desktop.ini	xxx.exe
File opened for modification	C:\Users\Public\Videos\desktop.ini	xxx.exe
File opened for modification	C:\$Recycle.Bin\S-1-5-21-2955169046-2371869340-1800780948-1000\desktop.ini	xxx.exe
File opened for modification	C:\Users\Public\Music\desktop.ini	xxx.exe
File opened for modification	C:\Users\Public\Pictures\Sample Pictures\desktop.ini	xxx.exe
File opened for modification	C:\Users\Admin\Documents\desktop.ini	xxx.exe
File opened for modification	C:\Users\Admin\Favorites\Links for United States\desktop.ini	xxx.exe
File opened for modification	C:\Users\Admin\Links\desktop.ini	xxx.exe
File opened for modification	C:\Users\Public\Documents\desktop.ini	xxx.exe
File opened for modification	C:\Users\Public\Downloads\desktop.ini	xxx.exe
File opened for modification	C:\Users\Public\Recorded TV\desktop.ini	xxx.exe
File opened for modification	C:\Users\Public\desktop.ini	xxx.exe
File opened for modification	C:\Users\Admin\Downloads\desktop.ini	xxx.exe
File opened for modification	C:\Users\Public\Libraries\desktop.ini	xxx.exe
File opened for modification	C:\Users\Public\Recorded TV\Sample Media\desktop.ini	xxx.exe
File opened for modification	C:\Users\Admin\Contacts\desktop.ini	xxx.exe
File opened for modification	C:\Users\Admin\Music\desktop.ini	xxx.exe
File opened for modification	C:\Users\Admin\Pictures\desktop.ini	xxx.exe
File opened for modification	C:\Users\Admin\Saved Games\desktop.ini	xxx.exe
File opened for modification	C:\Users\Admin\Videos\desktop.ini	xxx.exe
File opened for modification	C:\Users\Public\Pictures\desktop.ini	xxx.exe
File opened for modification	C:\Users\Admin\Favorites\Links\desktop.ini	xxx.exe
File opened for modification	C:\Users\Public\Desktop\desktop.ini	xxx.exe
File opened for modification	C:\Users\Public\Videos\Sample Videos\desktop.ini	xxx.exe

C:\Users\Admin\AppData\Local\Temp\xxx.exe
"C:\Users\Admin\AppData\Local\Temp\xxx.exe"
1⤵
- Modifies extensions of user files
- Drops desktop.ini file(s)
PID:1156

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\PUSSY!!!DANGER.txt
1⤵
PID:772

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/772-56-0x000007FEFC3C1000-0x000007FEFC3C3000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing