General

  • Target

    fb17fb6e1e71c92d2ae5a06363886ea71d614e2603706d38ca8ebbc56d3dc120

  • Size

    109KB

  • Sample

    211029-pewfmsdcb8

  • MD5

    2bd337b8648c7a465a1f94ba4a99c344

  • SHA1

    509cb9c71d34ec78c7fa937506758ae9ad0ebdd6

  • SHA256

    fb17fb6e1e71c92d2ae5a06363886ea71d614e2603706d38ca8ebbc56d3dc120

  • SHA512

    d31b87213494f9173d288a971704b384a582a3dd3fd3a7a4dec8f01aef9db3e8e08213fdb8b308db0a1320dbd4b8bcf553b4fbbe3d9a180b8faab432932dc667

Malware Config

Extracted

Path

C:\Users\Admin\AppData\Local\Temp\RESTORE_FILES_INFO.txt

Ransom Note
Hello !!! Many of your documents, photos, passwords, databases and other files are no longer available as they were encrypted. You may be looking for a way to recover your files, but don't waste your time. No one will be able to recover your files without our decryption KEY (if someone says they can do it, theywill also contact me and I will make the price much more expensive than if you contacted directly).                                   DONT USE GMAIL.COM TO CONTACT US               !!!THE DATARECOVERY COMPANIES JUST WANT YOUR MONEY!!!         !!DATA RECOVERY COMPANIES WILL ONLY INCREASE THE DECRYPTION TIME!! Can i Recover My Files?Sure. We guarantee that you can recover all your files safely and easily But You have not so enough time .As fast you pay as fastall of your data will be back as before encryption. Send e-mail to this address: [email protected] Or contact https://supportdatarecovery.cc/users.php user:Wanqu password:zVIJmqEB You have to pay for decryption in Bitcoins.                                                      ATTENTION !!! Do not rename encrypted files.Do not try to decrypt your data using third party software, it may cause permanent data loss.Decryption of your files with the help of third parties may cause increased price (they add their fee to our) or you can become a victim of a scam. We also have all your information to share .It is in your best interest to contact us as soon as possible. Key Identifier: HItWILJQBp44XfVDyASs2jcYo5k9VOoVk+/CM2SwTlbKxi4DHiBajTiIQFqgJnguTU430frjMrGeLJ5800C8HuTs/FpMvdx3p/paYx/Ccna2157I2RLjWRpQBTfDAGDl31b5m1oqr+WUzs2zUIqnDXrHUptpFTVZVv9pWI4p/BcKLG9GmLh36796ml7EXyOIXdlvRfTOvDSu82M19WImKrUsyGWOf41hH2FTOkc0PuRKcRU/UGfOyE+OOImQb7gwgTQjpIJUm0noIKPkL089FfF+TyI1bmitMyoODPnJkyDtLtiUR9TD3sPGlYuBlCaiE1v2J2svBojySh9370w7L3I8kYiye1wbb8n7nG+WEOzR6puQhn5Yf+W3ZbQUZEc58tDHtqPM9waPr0t8JDx5hAwiz15DWp3EMFT7Ya3D8l+lcETMbe+74mmcNpGq2bWfcRRtTRIVpj1rnsLRSrXWISTPelMXsXGBbgSBUEiMSYyXH1WIzZPqphErzsQzfDwGRemtr/LBWPSk99DeyEIRcQW48jPqpjyfzCjWBRbVt1+UOGzPTrsN91jyJDKROr9AOWxRsPiCtFeizJFEjeVEIUiqmK+cAabxZg/WVE+Si8yhCa9nNNsKIcBZO0r3iINMyTd9nKtKFJiZXoST9XT5vUmgQy7XwaVPWz9DVuV3Pak=
URLs

https://supportdatarecovery.cc/users.php

Extracted

Path

C:\Users\Admin\Desktop\RESTORE_FILES_INFO.hta

Ransom Note
Hello !!! Many of your documents, photos, passwords, databases and other files are no longer available as they were encrypted. You may be looking for a way to recover your files, but don't waste your time. No one will be able to recover your files without our decryption KEY (if someone says they can do it, theywill also contact me and I will make the price much more expensive than if you contacted directly). DONT USE GMAIL.COM TO CONTACT US !!!THE DATARECOVERY COMPANIES JUST WANT YOUR MONEY!!! !!DATA RECOVERY COMPANIES WILL ONLY INCREASE THE DECRYPTION TIME!! Can i Recover My Files?Sure. We guarantee that you can recover all your files safely and easily But You have not so enough time .As fast you pay as fastall of your data will be back as before encryption. Send e-mail to this address: [email protected] Or contact https://supportdatarecovery.cc/users.php user:Wanqu password:zVIJmqEB You have to pay for decryption in Bitcoins. ATTENTION !!! Do not rename encrypted files.Do not try to decrypt your data using third party software, it may cause permanent data loss.Decryption of your files with the help of third parties may cause increased price (they add their fee to our) or you can become a victim of a scam. We also have all your information to share .It is in your best interest to contact us as soon as possible. Key Identifier: HItWILJQBp44XfVDyASs2jcYo5k9VOoVk+/CM2SwTlbKxi4DHiBajTiIQFqgJnguTU430frjMrGeLJ5800C8HuTs/FpMvdx3p/paYx/Ccna2157I2RLjWRpQBTfDAGDl31b5m1oqr+WUzs2zUIqnDXrHUptpFTVZVv9pWI4p/BcKLG9GmLh36796ml7EXyOIXdlvRfTOvDSu82M19WImKrUsyGWOf41hH2FTOkc0PuRKcRU/UGfOyE+OOImQb7gwgTQjpIJUm0noIKPkL089FfF+TyI1bmitMyoODPnJkyDtLtiUR9TD3sPGlYuBlCaiE1v2J2svBojySh9370w7L3I8kYiye1wbb8n7nG+WEOzR6puQhn5Yf+W3ZbQUZEc58tDHtqPM9waPr0t8JDx5hAwiz15DWp3EMFT7Ya3D8l+lcETMbe+74mmcNpGq2bWfcRRtTRIVpj1rnsLRSrXWISTPelMXsXGBbgSBUEiMSYyXH1WIzZPqphErzsQzfDwGRemtr/LBWPSk99DeyEIRcQW48jPqpjyfzCjWBRbVt1+UOGzPTrsN91jyJDKROr9AOWxRsPiCtFeizJFEjeVEIUiqmK+cAabxZg/WVE+Si8yhCa9nNNsKIcBZO0r3iINMyTd9nKtKFJiZXoST9XT5vUmgQy7XwaVPWz9DVuV3Pak=
URLs

https://supportdatarecovery.cc/users.php

Extracted

Path

C:\Users\Admin\AppData\Local\Temp\RESTORE_FILES_INFO.txt

Ransom Note
Hello !!! Many of your documents, photos, passwords, databases and other files are no longer available as they were encrypted. You may be looking for a way to recover your files, but don't waste your time. No one will be able to recover your files without our decryption KEY (if someone says they can do it, theywill also contact me and I will make the price much more expensive than if you contacted directly).                                   DONT USE GMAIL.COM TO CONTACT US               !!!THE DATARECOVERY COMPANIES JUST WANT YOUR MONEY!!!         !!DATA RECOVERY COMPANIES WILL ONLY INCREASE THE DECRYPTION TIME!! Can i Recover My Files?Sure. We guarantee that you can recover all your files safely and easily But You have not so enough time .As fast you pay as fastall of your data will be back as before encryption. Send e-mail to this address: [email protected] Or contact https://supportdatarecovery.cc/users.php user:Wanqu password:zVIJmqEB You have to pay for decryption in Bitcoins.                                                      ATTENTION !!! Do not rename encrypted files.Do not try to decrypt your data using third party software, it may cause permanent data loss.Decryption of your files with the help of third parties may cause increased price (they add their fee to our) or you can become a victim of a scam. We also have all your information to share .It is in your best interest to contact us as soon as possible. Key Identifier: JCtOvbNKClHRinQPBqfybeUkenhrvtaAgO28ngiGE5wH5iMQQr0oqa8gJA4GakZwOjfNiZyeZOWoIAqvNxaL/YrAa3cDofhLXhYr43sEWQ6P+uNAhV3KmnYxqjo+/To7F/g0K5/4Qp7qN2cOrQqSJzZy2B+Dua6Q96QWupndOK3nlyTgMLKc3YkTzCwTixQV70lbQuaBzGIAd2BFQXT1u2G16Nz26QKoQ/msyrgaFkKb8OxxTZqlUxJYp3tZEOutarrCssTqXunDMNb+yppLR9jIxWXvaXAhPv0xC8TE2rAIrV4EmP0ignq7f6nrpdm7JCGAJ9su7FcFoGE/dfCfjbz/sB/P43/tGbFaxiMFquaMhJrsKhb/+pX87AukuY9oZKSDvMoQ3iTO+7CrldJlMsmabtzUAxQXoGZ+3ZAgn9GCybVNOjfR58rubu6oqtNJKXxgyrbTZ3TuQmII/eYXOyihfM/+ZsQoF2FxiXR7bvO2fQ+PDyCyTre2af/t68XE2rek1SuWnpn/rX2zVD5WKwhguwI8ajpRiTQCWDWamxRiowDlHoxz1J/SBPksWmflqiVGb9A8cfsc1qZS7Pe5tb26YnFuVFjgmjEuO0JQC9eRE9bG7CyeAf+tjV4MtEDSPcWOh1pAl5X/nMR5BjxfzsU0tX9iOBwrLRpfxI92VYY=
URLs

https://supportdatarecovery.cc/users.php

Extracted

Path

C:\Users\Admin\Desktop\RESTORE_FILES_INFO.hta

Ransom Note
Hello !!! Many of your documents, photos, passwords, databases and other files are no longer available as they were encrypted. You may be looking for a way to recover your files, but don't waste your time. No one will be able to recover your files without our decryption KEY (if someone says they can do it, theywill also contact me and I will make the price much more expensive than if you contacted directly). DONT USE GMAIL.COM TO CONTACT US !!!THE DATARECOVERY COMPANIES JUST WANT YOUR MONEY!!! !!DATA RECOVERY COMPANIES WILL ONLY INCREASE THE DECRYPTION TIME!! Can i Recover My Files?Sure. We guarantee that you can recover all your files safely and easily But You have not so enough time .As fast you pay as fastall of your data will be back as before encryption. Send e-mail to this address: [email protected] Or contact https://supportdatarecovery.cc/users.php user:Wanqu password:zVIJmqEB You have to pay for decryption in Bitcoins. ATTENTION !!! Do not rename encrypted files.Do not try to decrypt your data using third party software, it may cause permanent data loss.Decryption of your files with the help of third parties may cause increased price (they add their fee to our) or you can become a victim of a scam. We also have all your information to share .It is in your best interest to contact us as soon as possible. Key Identifier: JCtOvbNKClHRinQPBqfybeUkenhrvtaAgO28ngiGE5wH5iMQQr0oqa8gJA4GakZwOjfNiZyeZOWoIAqvNxaL/YrAa3cDofhLXhYr43sEWQ6P+uNAhV3KmnYxqjo+/To7F/g0K5/4Qp7qN2cOrQqSJzZy2B+Dua6Q96QWupndOK3nlyTgMLKc3YkTzCwTixQV70lbQuaBzGIAd2BFQXT1u2G16Nz26QKoQ/msyrgaFkKb8OxxTZqlUxJYp3tZEOutarrCssTqXunDMNb+yppLR9jIxWXvaXAhPv0xC8TE2rAIrV4EmP0ignq7f6nrpdm7JCGAJ9su7FcFoGE/dfCfjbz/sB/P43/tGbFaxiMFquaMhJrsKhb/+pX87AukuY9oZKSDvMoQ3iTO+7CrldJlMsmabtzUAxQXoGZ+3ZAgn9GCybVNOjfR58rubu6oqtNJKXxgyrbTZ3TuQmII/eYXOyihfM/+ZsQoF2FxiXR7bvO2fQ+PDyCyTre2af/t68XE2rek1SuWnpn/rX2zVD5WKwhguwI8ajpRiTQCWDWamxRiowDlHoxz1J/SBPksWmflqiVGb9A8cfsc1qZS7Pe5tb26YnFuVFjgmjEuO0JQC9eRE9bG7CyeAf+tjV4MtEDSPcWOh1pAl5X/nMR5BjxfzsU0tX9iOBwrLRpfxI92VYY=
URLs

https://supportdatarecovery.cc/users.php

Targets

    • Target

      fb17fb6e1e71c92d2ae5a06363886ea71d614e2603706d38ca8ebbc56d3dc120

    • Size

      109KB

    • MD5

      2bd337b8648c7a465a1f94ba4a99c344

    • SHA1

      509cb9c71d34ec78c7fa937506758ae9ad0ebdd6

    • SHA256

      fb17fb6e1e71c92d2ae5a06363886ea71d614e2603706d38ca8ebbc56d3dc120

    • SHA512

      d31b87213494f9173d288a971704b384a582a3dd3fd3a7a4dec8f01aef9db3e8e08213fdb8b308db0a1320dbd4b8bcf553b4fbbe3d9a180b8faab432932dc667

    Score
    10/10
    • Disables Task Manager via registry modification

    • Modifies extensions of user files

      Ransomware generally changes the extension on encrypted files.

    • Drops startup file

    • Drops desktop.ini file(s)

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

MITRE ATT&CK Enterprise v6

Tasks