General

  • Target

    c6d7c39e83f12684cc9341305044fb03a61d23876d37746d96d31a9191bacb8f

  • Size

    106KB

  • Sample

    211029-ph7cbaaabm

  • MD5

    af745cf9bbc68f8652678a1299abb68d

  • SHA1

    cd4793e42b0a27b2d73bc558d2d01842f73311e4

  • SHA256

    c6d7c39e83f12684cc9341305044fb03a61d23876d37746d96d31a9191bacb8f

  • SHA512

    22fdaa9a782c1e3c08b0403dee317ccb441eec6c461a7b3372e184c557ba7721ab62412a161a9b33ee96fe4f8240ccc1f5142bfa76a14b2001b73a113ff018fd

Malware Config

Extracted

Path

C:\Users\Admin\AppData\Local\Temp\decrypt_info.txt

Ransom Note
All your files have been encrypted due to a security problem with your PC. If you want to restore them, write us to the e-mail [email protected] or: [email protected] (Backup mail) Send us this file decrypt_info ================================================================================================================= Free decryption as a guarantee Before paying, you can send 1-2 files for free decryption. File format: txt doc pdf jpeg jpg gif png bmp Total file size should not exceed 2 MB (without archive) ====================================================== You can buy Bitcoins here: https://localbitcoins.com Or use the search how to buy Bitcoins in your country ================================================================================================================= IMPORTANT!!! Remember that your files are encrypted and only WE can recover them! Do not try to recover yourself, as well as on third-party resources, you will lose your files and money forever! =============================================================================================================== Key Identifier: 0HJwFosZTroKtHExYxlJycpcJyx9jfQSsEGAsJoUHNj7HkOc0guXIJ50/LzSXytHhxCk6GDQs9XMdV7e36K3cE2gNTl1GtQsm07J8wi/DNwp07QYm9Xj++HEhtCwk0reuJFYPq6ppYLXrH5lc7iBqQJsqIPZQCbOBR7KcEy9G2QD1aYzscudIqijAu2nW9jeHx+t4WbUue5t4CmGreMYb5bHYeJsGu7VSLHFmp78caanHyW/4eXRlanW/3poPQlUCTksxXV6MMjtLLUKZK4O7KAg09Hb+tTDftucexCMExFA9b3VfbKNtP46IiZUiCYMP2xmQ/c1ja3a9SuJxm1L3jjlyJFiyCtDig4VGhuE5HQ77AdLLA8eDOX0aw6M9FKbfcXKSL6YbxSgIg8FyVFy/d8FiU4GHkaIuxCv4xrocB3bb/CTP/Z3xtv6IXLVcSQAEcFpnxPMENT5X2iLVY6OgDPBjr+hFB4oci5m2ma9tLa5h4DFtqqzmbiXf0Z6UI1MvakzVZwuDd3kRpZCqaMdWM0c0YL8VAPGF2lVqyueqy0ap3e+sND+trv0g5QjIlfIPEejF2CCc0ez81pGDGPonMZcOH/oioL6SsIBdmghvQvnZOoZsBN47JuTueuJdbHhQDe6+S3RpyOvQiIXBaKRq2XPeQO+1rC4QMAkHThlGm8= PC Hardware ID: DCE526E0

Extracted

Path

C:\Users\Admin\Desktop\decrypt_info.txt

Ransom Note
All your files have been encrypted due to a security problem with your PC. If you want to restore them, write us to the e-mail [email protected] or: [email protected] (Backup mail) Send us this file decrypt_info ================================================================================================================= Free decryption as a guarantee Before paying, you can send 1-2 files for free decryption. File format: txt doc pdf jpeg jpg gif png bmp Total file size should not exceed 2 MB (without archive) ====================================================== You can buy Bitcoins here: https://localbitcoins.com Or use the search how to buy Bitcoins in your country ================================================================================================================= IMPORTANT!!! Remember that your files are encrypted and only WE can recover them! Do not try to recover yourself, as well as on third-party resources, you will lose your files and money forever! =============================================================================================================== Key Identifier: 0HJwFosZTroKtHExYxlJycpcJyx9jfQSsEGAsJoUHNj7HkOc0guXIJ50/LzSXytHhxCk6GDQs9XMdV7e36K3cE2gNTl1GtQsm07J8wi/DNwp07QYm9Xj++HEhtCwk0reuJFYPq6ppYLXrH5lc7iBqQJsqIPZQCbOBR7KcEy9G2QD1aYzscudIqijAu2nW9jeHx+t4WbUue5t4CmGreMYb5bHYeJsGu7VSLHFmp78caanHyW/4eXRlanW/3poPQlUCTksxXV6MMjtLLUKZK4O7KAg09Hb+tTDftucexCMExFA9b3VfbKNtP46IiZUiCYMP2xmQ/c1ja3a9SuJxm1L3jjlyJFiyCtDig4VGhuE5HQ77AdLLA8eDOX0aw6M9FKbfcXKSL6YbxSgIg8FyVFy/d8FiU4GHkaIuxCv4xrocB3bb/CTP/Z3xtv6IXLVcSQAEcFpnxPMENT5X2iLVY6OgDPBjr+hFB4oci5m2ma9tLa5h4DFtqqzmbiXf0Z6UI1MvakzVZwuDd3kRpZCqaMdWM0c0YL8VAPGF2lVqyueqy0ap3e+sND+trv0g5QjIlfIPEejF2CCc0ez81pGDGPonMZcOH/oioL6SsIBdmghvQvnZOoZsBN47JuTueuJdbHhQDe6+S3RpyOvQiIXBaKRq2XPeQO+1rC4QMAkHThlGm8= Number of files that were processed is: 550 PC Hardware ID: DCE526E0

Extracted

Path

C:\Users\Admin\AppData\Local\Temp\decrypt_info.txt

Ransom Note
All your files have been encrypted due to a security problem with your PC. If you want to restore them, write us to the e-mail [email protected] or: [email protected] (Backup mail) Send us this file decrypt_info ================================================================================================================= Free decryption as a guarantee Before paying, you can send 1-2 files for free decryption. File format: txt doc pdf jpeg jpg gif png bmp Total file size should not exceed 2 MB (without archive) ====================================================== You can buy Bitcoins here: https://localbitcoins.com Or use the search how to buy Bitcoins in your country ================================================================================================================= IMPORTANT!!! Remember that your files are encrypted and only WE can recover them! Do not try to recover yourself, as well as on third-party resources, you will lose your files and money forever! =============================================================================================================== Key Identifier: Kdtcq+s7UnqgqmU2Yljc1sBuT2AavRO7NU7XxHQRkemES+V4oLQTpIlZpXH3ywu/JJTfMRgX+ZmQUqiMobjFqv2/1xkkBEso8ZxlEAAfI2HrRGh28n/uXHmU0KyL1cXsAaUGBnK2nBXkIcYCz8ELa+C/x0vaORuk5oeBjI/KemRWBHr+fuWP8aJLYj77dWfPFyaiAzn/rgWrGv/kSCYAJBKiswPosemR6WhNO1nxPLWWg9nv7PNUm0aQTPY9TNvGsfvND7Raj4TxdKuEI6us3yB5sLK0XbzXp7kRx1Xo3Bmk9Ss0W0QKZfZW094WelH7RjoOfz0k3vlJ5QNTm4UmzmW1DOaYqTf8Y/dK6lOzuFoyNtC/FPj/lu4XixDO4mp7q75f5F5R7CnoXPwEaOaEKYeWr0iQnfyM9qhYyRS52Tpaj45ZkdOcUEfLlB20ZDVNSAiVYSZANp5axMAFDDAYo6t82p9137Ki+jA66ffKgZbRpbrxPSqK2kZQBiGPe71Ir+cGEWLo2G+f4NV62VgAd1aZQj+GedC5GcoSZEVlJJh1IQHUovcLuN05yB6BOE9uYc1dj6OnPHUVGkRgDM55CvOasOiw3Q2RrT0VI9pIrzKcWovruL6YClI4CVeLTdev7b2GQAbqZsEqo85TWJLpam4GLxIfW746m1DwKAlg7N4= PC Hardware ID: DA5D582B

Extracted

Path

C:\Users\Admin\Desktop\decrypt_info.txt

Ransom Note
All your files have been encrypted due to a security problem with your PC. If you want to restore them, write us to the e-mail [email protected] or: [email protected] (Backup mail) Send us this file decrypt_info ================================================================================================================= Free decryption as a guarantee Before paying, you can send 1-2 files for free decryption. File format: txt doc pdf jpeg jpg gif png bmp Total file size should not exceed 2 MB (without archive) ====================================================== You can buy Bitcoins here: https://localbitcoins.com Or use the search how to buy Bitcoins in your country ================================================================================================================= IMPORTANT!!! Remember that your files are encrypted and only WE can recover them! Do not try to recover yourself, as well as on third-party resources, you will lose your files and money forever! =============================================================================================================== Key Identifier: Kdtcq+s7UnqgqmU2Yljc1sBuT2AavRO7NU7XxHQRkemES+V4oLQTpIlZpXH3ywu/JJTfMRgX+ZmQUqiMobjFqv2/1xkkBEso8ZxlEAAfI2HrRGh28n/uXHmU0KyL1cXsAaUGBnK2nBXkIcYCz8ELa+C/x0vaORuk5oeBjI/KemRWBHr+fuWP8aJLYj77dWfPFyaiAzn/rgWrGv/kSCYAJBKiswPosemR6WhNO1nxPLWWg9nv7PNUm0aQTPY9TNvGsfvND7Raj4TxdKuEI6us3yB5sLK0XbzXp7kRx1Xo3Bmk9Ss0W0QKZfZW094WelH7RjoOfz0k3vlJ5QNTm4UmzmW1DOaYqTf8Y/dK6lOzuFoyNtC/FPj/lu4XixDO4mp7q75f5F5R7CnoXPwEaOaEKYeWr0iQnfyM9qhYyRS52Tpaj45ZkdOcUEfLlB20ZDVNSAiVYSZANp5axMAFDDAYo6t82p9137Ki+jA66ffKgZbRpbrxPSqK2kZQBiGPe71Ir+cGEWLo2G+f4NV62VgAd1aZQj+GedC5GcoSZEVlJJh1IQHUovcLuN05yB6BOE9uYc1dj6OnPHUVGkRgDM55CvOasOiw3Q2RrT0VI9pIrzKcWovruL6YClI4CVeLTdev7b2GQAbqZsEqo85TWJLpam4GLxIfW746m1DwKAlg7N4= Number of files that were processed is: 1840 PC Hardware ID: DA5D582B

Targets

    • Target

      c6d7c39e83f12684cc9341305044fb03a61d23876d37746d96d31a9191bacb8f

    • Size

      106KB

    • MD5

      af745cf9bbc68f8652678a1299abb68d

    • SHA1

      cd4793e42b0a27b2d73bc558d2d01842f73311e4

    • SHA256

      c6d7c39e83f12684cc9341305044fb03a61d23876d37746d96d31a9191bacb8f

    • SHA512

      22fdaa9a782c1e3c08b0403dee317ccb441eec6c461a7b3372e184c557ba7721ab62412a161a9b33ee96fe4f8240ccc1f5142bfa76a14b2001b73a113ff018fd

    Score
    10/10
    • Modifies Windows Firewall

    • Modifies extensions of user files

      Ransomware generally changes the extension on encrypted files.

    • Deletes itself

    • Drops startup file

    • Drops desktop.ini file(s)

MITRE ATT&CK Enterprise v6

Tasks