Analysis

  • max time kernel
    61s
  • max time network
    75s
  • platform
    windows10_x64
  • resource
    win10-en-20210920
  • submitted
    27-10-2021 07:27

General

  • Target

    xxx.exe

  • Size

    2.5MB

  • MD5

    e358685d7f843a7c91a6ba328f4d900c

  • SHA1

    05aaba7ad51b253861714ff74a665461606e14ab

  • SHA256

    148845af1fc1221f27992cac24273aada38ef2482624850897bce87413f79888

  • SHA512

    69f5dc5bd415e69554a274fbda8fed69d79e216496f7907436161537c5a52ca2e299a381a13bf5fc1948b121c23866e66c5a244a066cb46d98e4e3a97f8a6b1e

Score
10/10

Malware Config

Extracted

Path

C:\$Recycle.Bin\PUSSY!!!DANGER.txt

Ransom Note
Two things have happened to your company. ========================================================================================================================== Gigabytes of archived files that we deemed valuable or sensitive were downloaded from your network to a secure location. When you contact us we will tell you how much data was downloaded and can provide extensive proof of the data extraction. You can analyze the type of the data we download on our websites. If you do not contact us we will start leaking the data periodically in parts. ========================================================================================================================== We have also encrypted files on your computers with military grade algorithms. If you don't have extensive backups the only way to retrieve your data is with our software. Restoration of your data with our software requires a private key which only we possess. ========================================================================================================================== To confirm that our decryption software works send 2 encrypted files from random computers to us via email. You will receive further instructions after you send us the test files. We will make sure you retrieve your data swiftly and securely and your data that we downloaded will be securely deleted when our demands are met. If we do not come to an agreement your data will be leaked on this website. Website: http://corpleaks.net TOR link: http://hxt254aygrsziejn.onion Contact us via email: Angiemerryman@tutanota.com Robertoferris@protonmail.com Allenmalone@onionmail.org
Emails

Angiemerryman@tutanota.com

Robertoferris@protonmail.com

Allenmalone@onionmail.org

URLs

http://corpleaks.net

http://hxt254aygrsziejn.onion

Signatures

  • Drops desktop.ini file(s) 25 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\xxx.exe
    "C:\Users\Admin\AppData\Local\Temp\xxx.exe"
    1⤵
    • Drops desktop.ini file(s)
    PID:3812

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\$Recycle.Bin\S-1-5-21-2481030822-2828258191-1606198294-1000\desktop.ini
    MD5

    f30ee810393769f534cb5595431973f3

    SHA1

    5a57e96b17f5a96b21c38aa03e419aa4d1bd1b4b

    SHA256

    14c7cd0b42ccd542ee4e343d110026d1211681ad4056ab2621a803ecb5e6ebf3

    SHA512

    66656ccf9aa62fd006ad5b6bde0a168909aae2e8a0906ba1178281327d26790f73d48d78e045e724c68adadf1d18e0f291090b80a29fa56094c91e0b2ac4985d