General

  • Target

    SS.exe

  • Size

    30.3MB

  • Sample

    211030-ekjzpabbfq

  • MD5

    d6d78e94de610fad6749338f855edbcc

  • SHA1

    0fb9d7b713ae158bf35f480f62d20255b6d14a97

  • SHA256

    f0f90338553ab244d779b2f172c2e6c82f7fc5725cba6ddb8d09c48d5f481e07

  • SHA512

    33f36597a642af214f2e349015f5a0a625014536ae00016e9fdc110f2a37ea84cdfb7c6e9039a02830730314fc8358bc7076c7fdfec12c140f4394cfb0e4079f

Malware Config

Extracted

Path

C:\Windows\Vss\ReadIt.txt

Ransom Note
Hello my friend Your system was vulnerable I'm here to teach you a lesson,The Security Lesson!!!! All your files are encrypted and the important one stolen You must pay an anount of Bitcoin in exchange for decrypting files and understanding the flaws in your system And prevent your files from becoming public Don't worry about the amount, it's spent on the security of your system and it's fair. To show our good intentions and trust, you can send us a small, worthless file to test the decryption. This is your ID : FFF456E1 And this is my email :Eliot.Bing@mailfence.com Send your ID to my email to speack about it If I don't respond for 8 hours, send messages to these emails : - EliotBing@tutanota.com - EmmaGaller@cock.lu Don't forget if you try to decypt them yourself, never come back to us. So the first thing you have to do is email us because no one can decrypt them.
Emails

Eliot.Bing@mailfence.com

EliotBing@tutanota.com

EmmaGaller@cock.lu

Extracted

Path

C:\Windows\Vss\ReadIt.txt

Ransom Note
Hello my friend Your system was vulnerable I'm here to teach you a lesson,The Security Lesson!!!! All your files are encrypted and the important one stolen You must pay an anount of Bitcoin in exchange for decrypting files and understanding the flaws in your system And prevent your files from becoming public Don't worry about the amount, it's spent on the security of your system and it's fair. To show our good intentions and trust, you can send us a small, worthless file to test the decryption. This is your ID : 1BC1EC48 And this is my email :Eliot.Bing@mailfence.com Send your ID to my email to speack about it If I don't respond for 8 hours, send messages to these emails : - EliotBing@tutanota.com - EmmaGaller@cock.lu Don't forget if you try to decypt them yourself, never come back to us. So the first thing you have to do is email us because no one can decrypt them.
Emails

Eliot.Bing@mailfence.com

EliotBing@tutanota.com

EmmaGaller@cock.lu

Targets

    • Target

      SS.exe

    • Size

      30.3MB

    • MD5

      d6d78e94de610fad6749338f855edbcc

    • SHA1

      0fb9d7b713ae158bf35f480f62d20255b6d14a97

    • SHA256

      f0f90338553ab244d779b2f172c2e6c82f7fc5725cba6ddb8d09c48d5f481e07

    • SHA512

      33f36597a642af214f2e349015f5a0a625014536ae00016e9fdc110f2a37ea84cdfb7c6e9039a02830730314fc8358bc7076c7fdfec12c140f4394cfb0e4079f

    • Deletes shadow copies

      Ransomware often targets backup files to inhibit system recovery.

    • Disables Task Manager via registry modification

    • Drops startup file

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Suspicious use of NtSetInformationThreadHideFromDebugger

MITRE ATT&CK Matrix ATT&CK v6

Defense Evasion

File Deletion

2
T1107

Modify Registry

1
T1112

Credential Access

Credentials in Files

1
T1081

Collection

Data from Local System

1
T1005

Impact

Inhibit System Recovery

2
T1490

Tasks