148845af1fc1221f27992cac24273aada38ef2482624850897bce87413f79888

General

Target

xxx.exe
Size

2.5MB
MD5

e358685d7f843a7c91a6ba328f4d900c
SHA1

05aaba7ad51b253861714ff74a665461606e14ab
SHA256

148845af1fc1221f27992cac24273aada38ef2482624850897bce87413f79888
SHA512

69f5dc5bd415e69554a274fbda8fed69d79e216496f7907436161537c5a52ca2e299a381a13bf5fc1948b121c23866e66c5a244a066cb46d98e4e3a97f8a6b1e

Score

10^/10

ransomware

Malware Config

Extracted

Path

C:\$Recycle.Bin\PUSSY!!!DANGER.txt

Ransom Note

Two things have happened to your company. ========================================================================================================================== Gigabytes of archived files that we deemed valuable or sensitive were downloaded from your network to a secure location. When you contact us we will tell you how much data was downloaded and can provide extensive proof of the data extraction. You can analyze the type of the data we download on our websites. If you do not contact us we will start leaking the data periodically in parts. ========================================================================================================================== We have also encrypted files on your computers with military grade algorithms. If you don't have extensive backups the only way to retrieve your data is with our software. Restoration of your data with our software requires a private key which only we possess. ========================================================================================================================== To confirm that our decryption software works send 2 encrypted files from random computers to us via email. You will receive further instructions after you send us the test files. We will make sure you retrieve your data swiftly and securely and your data that we downloaded will be securely deleted when our demands are met. If we do not come to an agreement your data will be leaked on this website. Website: http://corpleaks.net TOR link: http://hxt254aygrsziejn.onion Contact us via email: Angiemerryman@tutanota.com Robertoferris@protonmail.com Allenmalone@onionmail.org

Emails

Angiemerryman@tutanota.com

Robertoferris@protonmail.com

Allenmalone@onionmail.org

URLs

http://corpleaks.net

http://hxt254aygrsziejn.onion

Signatures

Modifies extensions of user files 5 IoCs

Ransomware generally changes the extension on encrypted files.

ransomware

Processes:

xxx.exe

description	ioc	process
File renamed	C:\Users\Admin\Pictures\UpdateDismount.tif => C:\Users\Admin\Pictures\UpdateDismount.tif.PUSSY	xxx.exe
File renamed	C:\Users\Admin\Pictures\ApproveRequest.tif => C:\Users\Admin\Pictures\ApproveRequest.tif.PUSSY	xxx.exe
File opened for modification	C:\Users\Admin\Pictures\JoinDismount.tiff	xxx.exe
File renamed	C:\Users\Admin\Pictures\JoinDismount.tiff => C:\Users\Admin\Pictures\JoinDismount.tiff.PUSSY	xxx.exe
File renamed	C:\Users\Admin\Pictures\ProtectShow.png => C:\Users\Admin\Pictures\ProtectShow.png.PUSSY	xxx.exe

Drops desktop.ini file(s) 27 IoCs

Processes:

xxx.exe

description	ioc	process
File opened for modification	C:\Users\Admin\Desktop\desktop.ini	xxx.exe
File opened for modification	C:\Users\Admin\Favorites\desktop.ini	xxx.exe
File opened for modification	C:\Users\Admin\Searches\desktop.ini	xxx.exe
File opened for modification	C:\Users\Public\Music\Sample Music\desktop.ini	xxx.exe
File opened for modification	C:\Users\Public\Videos\desktop.ini	xxx.exe
File opened for modification	C:\$Recycle.Bin\S-1-5-21-2955169046-2371869340-1800780948-1000\desktop.ini	xxx.exe
File opened for modification	C:\Users\Public\Music\desktop.ini	xxx.exe
File opened for modification	C:\Users\Public\Pictures\Sample Pictures\desktop.ini	xxx.exe
File opened for modification	C:\Users\Admin\Documents\desktop.ini	xxx.exe
File opened for modification	C:\Users\Admin\Favorites\Links for United States\desktop.ini	xxx.exe
File opened for modification	C:\Users\Admin\Links\desktop.ini	xxx.exe
File opened for modification	C:\Users\Public\Documents\desktop.ini	xxx.exe
File opened for modification	C:\Users\Public\Downloads\desktop.ini	xxx.exe
File opened for modification	C:\Users\Public\Recorded TV\desktop.ini	xxx.exe
File opened for modification	C:\Users\Public\desktop.ini	xxx.exe
File opened for modification	C:\Users\Admin\Downloads\desktop.ini	xxx.exe
File opened for modification	C:\Users\Public\Libraries\desktop.ini	xxx.exe
File opened for modification	C:\Users\Public\Recorded TV\Sample Media\desktop.ini	xxx.exe
File opened for modification	C:\Users\Admin\Contacts\desktop.ini	xxx.exe
File opened for modification	C:\Users\Admin\Music\desktop.ini	xxx.exe
File opened for modification	C:\Users\Admin\Pictures\desktop.ini	xxx.exe
File opened for modification	C:\Users\Admin\Saved Games\desktop.ini	xxx.exe
File opened for modification	C:\Users\Admin\Videos\desktop.ini	xxx.exe
File opened for modification	C:\Users\Public\Pictures\desktop.ini	xxx.exe
File opened for modification	C:\Users\Admin\Favorites\Links\desktop.ini	xxx.exe
File opened for modification	C:\Users\Public\Desktop\desktop.ini	xxx.exe
File opened for modification	C:\Users\Public\Videos\Sample Videos\desktop.ini	xxx.exe

C:\Users\Admin\AppData\Local\Temp\xxx.exe
"C:\Users\Admin\AppData\Local\Temp\xxx.exe"
1⤵
- Modifies extensions of user files
- Drops desktop.ini file(s)
PID:1156

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\PUSSY!!!DANGER.txt
1⤵
PID:772

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-2955169046-2371869340-1800780948-1000\desktop.ini
MD5
fec0f25efddf9aedb2e44a51f20800df

SHA1
f8f690c84b9155348a6dac577790420af82d412f

SHA256
7e3b07c74f736604b617c84b5a5656c61633547cefce609e85f099c3d8209217

SHA512
8135034bb92e174a81aadd26afa9d455a43129e15c0d9b26ae53aedb617eac4d40cd6ff11882540323164385c52cb8cd11f6e50d9a6c8c8efd002bd68f1eae97

Download Submit
C:\Users\Admin\Desktop\PUSSY!!!DANGER.txt
MD5
2a708e0cb0f88ed00ef04f369c807c19

SHA1
1dcaf8569d6489ae63072a31020ac9a7fffeb494

SHA256
dc2bb8435a1d20e24fac10c8e8e739d23ca6b5da9a25373259f66c62187b9cd6

SHA512
2e9ff5d8b154d07833ad9dbc8dc6e460f1a706539733b20d1da425066d49596e2e8ee46dfcb087ac36d3647cf8076d8684738d2f4fb36dfc0e129073e7c5b3e2

Download Submit
memory/772-56-0x000007FEFC3C1000-0x000007FEFC3C3000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing