General

  • Target

    7c1f5cf8f242dfbd920180d8423777a4e540c37c09d787d4674b259bdbe0dc42.exe

  • Size

    13KB

  • Sample

    211121-qfxwjadhfq

  • MD5

    d109e80eff2ed00ee76147306057b78e

  • SHA1

    ebdcaa6e32ae696725158482e0a7480d4c8433e5

  • SHA256

    7c1f5cf8f242dfbd920180d8423777a4e540c37c09d787d4674b259bdbe0dc42

  • SHA512

    23ef87e942a02f9347b07044a3fa291558b425c57c6bc66f14a367fcd89f61617785da560e175d8a225398189a37745295e199d93d3ead75118ebee792e3dada

Malware Config

Extracted

Path

C:\$Recycle.Bin\#File.decrypt#.txt

Ransom Note
Hello my dear friend Unfortunately for you, a major IT security weakness left you open to attack, your files have been encrypted If you want to restore them, write your ID to us e-mail1: File.decrypt@onionmail.org e-mail2: file.decrypt@yahoo.com Attention! Do not rename encrypted files. Do not try to decrypt your data using third party software, it may cause permanent data loss. We are always ready to cooperate and find the best way to solve your problem. The faster you write, the more favorable the conditions will be for you. Our company values its reputation. We give all guarantees of your files decryption IF WE DONT SEE MESSAGES FROM YOU IN 72 HOURS - WE WILL SELL YOUR DATABASES AND IMPORTANT INFORMATION TO YOUR COMPETITORS,AFTER YOU WILL SEE IT AT OPEN SOURCE AND DARKNET tell your unique ID c/HyE6gKyDweL/jeGA17g6KoSpvGOqEw8NQOw8L4x669UBcugjFAq/ZW7scT7yjOpGibRiBnaHYiAGDkew6/IU63i8OREkO5w4v5zEiGMJg3HnaMzH7NE8QDLR0tAYNRFOpOM8DdTOTcFZDgKC2pok8/SZpZ1LFvCIzEpoEvKgeXqV4Oth7LP0UYznVnB7KLTSLRv8OH0agO4zBycN78/40E4li/eBq043rJ6eFfQZMSpG68gJWsIBi8DoFKB6oPPQC7+FrSDSAVABJMqqncdg+GRDMkLnez/ss0Obks21hBN+Re8wTs2hmK+QejC1Lx+YPa7vZXOR3MRZ5Wj/mUJGJtHaFIdzzqMICiH4aTNO4nLAiSRPBHaCljxvINWIiRJ17F1XxGYgzAOWkpqmtBswA8Dit0SUo95ygarm5II5ReGx2LbP4NGwxuEpu7FsIQE3drAIBrZgYOYxr39UFOIVIVc5+P1pKIxD6qMNegwH6CrpiSl6toGzXkEYhOVYZGa6+ys37SdgN5KRaMgTamfKCg2QIuwFE8kMWz4SWwZ3pQZQFXBTorCWvrrvPtYkzD9zIMp2CCrw6wya2/9DBh8o8E7mmVP/91ZjSNvnz/8FnO8cW4omEytbDCPCWttxI3uc2j7+7MKDBoGXVngQpgjWIgsK79FQhAMAR7mjgrI4SKQwC67VJfcaTG5IWxLfUDdlqdSePTUj4fSrwtVtme3pyjZYlsWM7syKdx/ne1rTR8sYzjZ2LNosJDgvCR4Locp4IkPHeo5Y97siwbsDHVgyzAZkvUnedb8qc1ImXHcqcYwidRa2uf5s6MBcxOLXr2hxO76bJ0Xbz+KhRB1cI4IN/k0clpXjpm+rXs7/pXwpJlgOxmz6BwQi+PjvZvoQiOEn2uXYJJDtPx6ChCp/dqAcjL0B3naLcVa5F+Bw6kfy6VI6FpJB5bJ86blybp+qeGr9UoVjyWEB/eLuVmPkWDl7fhfBYoFjEIaOoECiJaEYWrH4YJ4nOLnV6ZySgYCAVJNqiBcPvZ6dYd0V1O8SHbp/GqP4TiaaQaD2dBJKOZmub4keIRnw38mJa3Mgj8KB0aZBcUI2uQ11+/DzSvTWVP7x8Cf3PEzxJGtbbzc7qJJpNsGO7k7ySCWwwoeNsRGeBS9sbYWmy8Xyhd8kN4ofLSKcyb2NEj/2dEQAw7zrtwMUKKhzVz3fJiTlTjfw/yWkO/1oF/h/H2ntWqYrz3TmFkTjMuwKX+RkmzXQTEVKu93wwKtCiOSDw7fNo2/wHLgPpxBdHwD+ppppUItxj/pSydxKDq9GPo1A/Zt7YPzRKCdYb+lGQTNDoJ9pi/3vlLpf8W2EKHBJT8UeoEsE4hZgbGjA==
Emails

File.decrypt@onionmail.org

file.decrypt@yahoo.com

Extracted

Path

C:\Program Files\Microsoft Office\Updates\Apply\#File.decrypt#.txt

Ransom Note
Hello my dear friend Unfortunately for you, a major IT security weakness left you open to attack, your files have been encrypted If you want to restore them, write your ID to us e-mail1: File.decrypt@onionmail.org e-mail2: file.decrypt@yahoo.com Attention! Do not rename encrypted files. Do not try to decrypt your data using third party software, it may cause permanent data loss. We are always ready to cooperate and find the best way to solve your problem. The faster you write, the more favorable the conditions will be for you. Our company values its reputation. We give all guarantees of your files decryption IF WE DONT SEE MESSAGES FROM YOU IN 72 HOURS - WE WILL SELL YOUR DATABASES AND IMPORTANT INFORMATION TO YOUR COMPETITORS,AFTER YOU WILL SEE IT AT OPEN SOURCE AND DARKNET tell your unique ID nUzaY3n0IKHhTNhf/bOnb+NqPmiNW9h7m/71UzGse+NtuUmULUz5N1LoalUOVyDt2MJh/Ydk4brrHX7N/DlS1ydy3PIvZwrXn3G48wfTFN1GRU/0aHrP55eNbFeCyiw3vZv/eQzYJaVHDH9ivzavko7pwcLv02lXIfL9PVNZNxmAupLFSB+n3mngMHMcH6Wjg/LIRxgUqMNc3rHPhQ7vZhLusuIQRbe7mxXUK/nadntuarbCvw7w6rODlUR6sOmJseTJOiejDvdvHd2det3/A17nvG1vLVQR3rS98slMCEvL+lLdskagcp03Xqt03KZ05kE6bHfJFY2FELFLdos0az8kxUmY7cOmmdNu0dA9Lvr3t8Go6mLlVDbQaLrZhg//Fz6+so0JUmQRVdQHoca7BdrT1OXkRtx7yc/2cr8cYG98Xar7k8Jl8WC0kgvRXypMSxMuEo2mnmOgFttAdphVZQq7bFg46ueqjg2QhKApNkKr1pHhrSGVdWCemqClM4/fJzg3cd3mf5aScovzx7A4tirFqxbHq6fAxCoSPouUQPkqZYg+pNclgn1J5qxDDlSfI2V5TmFNA3O06PR5chxwRWthLDD17+7Iv1Jw6ESd9N9jAeYmniVn1NX9+2z8Gly4QWmdMNq4h0UE+fJM33TCNawzcDOGLgWqpmoa7sjijjfQh1RP6T4kdMvc9+zOg8LU6b7/J6yDK7s+vhp+NGWnJbLiz1/xXNTmoRa0i1m6ywJdWzY9dsUyPMaX9xurS7zpoRMD2zeKD5qjLnO1NDbxMQ5aAbryawO2EjJkVOcgF6DalP6eXh4JQXMTwZcqb9JgnNGS120DE9DkpQ2hfcWA8KI/rQidQ6QOgq5vcb/yFf32W28f6RSBxxg811XOhQ33pDNKd4Q4hgMfb+LOmXCNxEFuyZqDVdxzXbBth7dCH4y3l4iyptDhDgB3DFAhuWtvQSXkUTLDCvf1JKbyekdxNXmsS7Uf1FzdpkmZv9+MwUIi6FRuU+2rTO9ryEvYaCPhrOU7uafGc59z2vVFVodiYqUpwV9NSYzLTVy3yDiPKMP4up/i/QKubGvLumB0vPVygSOhMeVvv3q+wK0APe1Nb0/vkd7XhgtsXv0LeRr3VMohZ+0DuLf6HHWwi/n4ZrtP+D/r1OpySb+yMbvxSHwHq0J1dAvQGi2e4LhABQ1cy8qQjd7GxIqGYyxBIDWl3fav9QNH6MTtr7GZvD2HMfnS7uUqKvaGBa2R8ll8FoH3zZXAsxlF+m8+bpdGguRbKbciQNGXOs8KKH1vC7Qr5Xp2idyRZ475rL9FeAfn+19P1YU3o/23z+3TKExMAxc3WbVakXCIQn7wd3uJQc16jl7ckw==
Emails

File.decrypt@onionmail.org

file.decrypt@yahoo.com

Targets

    • Target

      7c1f5cf8f242dfbd920180d8423777a4e540c37c09d787d4674b259bdbe0dc42.exe

    • Size

      13KB

    • MD5

      d109e80eff2ed00ee76147306057b78e

    • SHA1

      ebdcaa6e32ae696725158482e0a7480d4c8433e5

    • SHA256

      7c1f5cf8f242dfbd920180d8423777a4e540c37c09d787d4674b259bdbe0dc42

    • SHA512

      23ef87e942a02f9347b07044a3fa291558b425c57c6bc66f14a367fcd89f61617785da560e175d8a225398189a37745295e199d93d3ead75118ebee792e3dada

    • Deletes shadow copies

      Ransomware often targets backup files to inhibit system recovery.

    • Modifies extensions of user files

      Ransomware generally changes the extension on encrypted files.

    • Deletes itself

    • Drops startup file

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Drops desktop.ini file(s)

MITRE ATT&CK Matrix ATT&CK v6

Defense Evasion

File Deletion

2
T1107

Credential Access

Credentials in Files

1
T1081

Discovery

System Information Discovery

1
T1082

Collection

Data from Local System

1
T1005

Impact

Inhibit System Recovery

2
T1490

Tasks