General
-
Target
https://transfer.sh/45dIVs/worstgeneration.exe
-
Sample
220123-n8v7asgaaj
Score
10/10
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://transfer.sh/45dIVs/worstgeneration.exe
Resource
win7-en-20211208
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
https://transfer.sh/45dIVs/worstgeneration.exe
Resource
win10-en-20211208
windows10_x64
0 signatures
0 seconds
Malware Config
Extracted
Path
C:\How To Restore Your Files.txt
Ransom Note
You are probably wondering why you are receiving a message from me.
Yesterday, duncanregional.com got breached.
You are probably not aware, but over the past few days we have been exfiltrating all of your data that we could get our hands on.
We took over 150GB data + patient userdata from dba servers.
What happened to your files?
Your network was been penetrated.
All of your files were encrypted using AES-256-CTR with ChaCha8 Cipher.
WARNING:
Don't try to decrypt your files, shadow copies were removed,
recovery methods can lead to the impossibility of recovery of the certain files.
We exclusively have decryption software for your situation,
no decryption software is available in the public.
Pay 60,000 (USD) in XMR (Monero) to this address: 4BExj4Z7n73316oWSd6k3Wj7A12PFVUSeHoobSPpaCJVdH6Z1oRBBssemrpwW5GyRt7xi3SQCeJzUa1uFoWWNySYCxoHv13
How do you buy XMR?
https://bisq.network/ to buy XMR using fiat.
Alternatively use a Cryptocurrency exchange to buy XMR:
https://www.kraken.com/
Use this guide: https://www.getmonero.org/
After sending the specified amount to our wallet we will provide you
with the decryption keys to unlock your files.
If you do not respond (24 hour deadline, starting now), or we do not receive a response from you
we will start the data to our potential buyers, and leak a partial,
All of your clients (patients / employers) will be informed and given proof that their data has been compromised
and publish everything in a public way in multiple places and outlets to get more customers interested in buying the data
and also reporting the availability of this data to the appropriate news platforms.
Contact:
telegram: @redeyeg0d
email: [email protected]
Emails
URLs
https://bisq.network/
https://www.getmonero.org/
Targets
-
-
Target
https://transfer.sh/45dIVs/worstgeneration.exe
Score10/10-
Downloads MZ/PE file
-
Executes dropped EXE
-
Modifies extensions of user files
Ransomware generally changes the extension on encrypted files.
-
Loads dropped DLL
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
Suspicious use of SetThreadContext
-