General

  • Target

    dff5690cd1a3474c6cac9dcf8efacdaf51a6be992e70029e21dcacd89cc71f05

  • Size

    78KB

  • Sample

    220124-a7r7cshaan

  • MD5

    9c3784b44183e575037fdb131355b2f6

  • SHA1

    8b85ce577902376ebab9a4e3839da030077fd65c

  • SHA256

    dff5690cd1a3474c6cac9dcf8efacdaf51a6be992e70029e21dcacd89cc71f05

  • SHA512

    db20b54bd34ebb3abf6640c773ada4e14a187552aaaac2fddcde3ad64598d7221054db56ea145fba6e123d21e281d33573e1f9b2035ebe60014e7ae5164c2e9d

Score
10/10

Malware Config

Extracted

Path

C:\4b93np888q-readme.txt

Ransom Note
---=== Welcome. Again. ===--- [-] Whats Happen? [-] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension 4b93np888q. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [-] What guarantees? [-] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practice - time is much more valuable than money. [+] How to get access on website? [+] Using a TOR browser! 1) Download and install TOR browser from this site: https://torproject.org/ 2) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/D837669F637A6732 Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: arZG7iTumsK1jEB9GSdd0x6lcoGgPLJEOnvPcltEI+jthEcY/cGWwp2hIZ7OOP3/ 7606ClpESCL13NotT9Jpf+1dMeWI05lZgHlm+QvgVBlSMvHDobT3YNLNpxYUrIMA zsydol3B/SpUHY+RdBSFBxuKRrvxnIOxnQENkxHeknSPlKwDI7MEd5Z/n/92pMmk IqqBj7emC60xnTy4A7YtNeOTEKlT87QpgQZVZuQ3WR9qq1Ia5HsQxbiLW4mwyslC MppCyCgegCQQHUqBq03C0NEjGRBcO0F4PCFVgkXuO6xKXnGOXjegY2x1dyK+EvbQ 4ElRMMMgdIfVQWV6iP/baUBxPeTTzAHDCo3N+jATXW9WPDxUiusiSkEd+mQ0ymqw SBCzYXL8UD5ccja4aToqPjzIrSVFfTTp49/7ma30ZKSX5FRZ3P/VUkEZH0Oe06iA 19w8y1s9oPcQbKkzduywKuqx/gLk++Z3p+PQYyUvczEKPuu6SfFoKvmxhOoVrSGo uyjdQE3Q6RsGugSOZy5wzY3wcEWCRqShlDbw72bRgemsISpsUdHx7oKpG3aG/sXa 2osRfD7+cRbJEHPocdxmmBLDhMs0KeCkruGJjXiEbooXgeF21FRwMrFniRFXoJ03 P8j3jGYk4uIxTUpeet+wABh5MdTVccoI8e3r63dP1VX1roaAISM1FKa9kz1H8ccA oBo/4lV8iuHtbTQyJlJ2f5l5r8PSTRIOZvo22abs74TjSJ6DoTYjkWckAOXDnfKV IOBbrNWEZJqc8/wNJb9iHcKrZCRFVdhzwjF+TXE/lHLotaFgs7z9VpZa34OyAktj iE+57soGZTlXj16nFMmCgR+G/QQNnVKVVeMNRCZF1sZK3fwrhtUpUg3O4/axEduy W8Xaov89+qgbQXXc2p7/OXYt+2UM/04aHjYyEskgVszxm3KeLy0wsb+xKIPedAkN V2Tsxh56ZSLPwtlhshvvUAJLT6SlS3K1csumjUbfvJzJJmx6zwtu0W3WHSCtWG7O /+kxOqBqy3INmsW/Y/s7oRpQkc2dgicx0h9Mwi2ai/oe6b6jb0VI9Qnx4QdBr2bH gW61eIeVzZdO1RxkJn8WcYEsD+7Zw6sjtaRPcYXl8xGY0szE869x14RTyiEPVfc+ 2Yyd/7ljXlMo3fYyPXQhtNp9/jn3wEthRYdgC26cLmPT4G82gjJV/GBbwnFOlI76 oAlm/GSF0ifr+WIkzmM0TPalehVaDA6xZ9vhDxrhDDj6x6IJx1CF9p6CgQcTmXCY cCK8T/MB3vc8lPlyAlQKU5XmB97aLQ== ----------------------------------------------------------------------------------------- !!! DANGER !!! DON'T try to change files by yourself, DON'T use any third party software for restoring your data or antivirus solutions - its may entail damage of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/D837669F637A6732

Extracted

Path

C:\7c14u939-readme.txt

Ransom Note
---=== Welcome. Again. ===--- [-] Whats Happen? [-] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension 7c14u939. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [-] What guarantees? [-] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practice - time is much more valuable than money. [+] How to get access on website? [+] Using a TOR browser! 1) Download and install TOR browser from this site: https://torproject.org/ 2) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/D84152300BC3497B Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: OjcA72EzSK3R4YuwnHmrJ/B/rIj2O9JszO56wLkfdsA5jVE0uhbCM8ZHRrB7z1im Rp3q/7TdKda68hhYxMF17nYcTDCYcywBKQQlv0OY1pkxwQ5xklXTboEpsY+NdzB5 ytudyd5oMAc4/S+5UjtKBnT7nFjR5NCKT/iHXwCVqnM75z8I3IvFRYJmgFKAfwNa INvGjW7G4+k+OJGtyPokNEVIqMrCyrBqlbX8tOn50lBez4ObEy1xAeKaFq2am9Uf rvAUdkL5C7nrbhLMW4jp8ZqMSzPUI6aGZuj1ySzUr3Jmn4swKfBFMMQZUv2enGp8 m71W+okA51T+UsT9qudm/k4DDANyiXv3RSw7p7saLpubqzauyeqvCIxGDO90XIMW Me0qlzxz49rC9O4x57g59n3wwIcps2nq2MpyBpgn4mWcbBj9gVpE/goiC/eCObEJ JsDU0o9tl0rdrXUuHmbFM4xxaF5+rSoYuogm/Zy2xd7vhshgSszmHtNb3itRR4Ej qYn0s4rYRuA7flzwaP/a3o5LYHGANaplq8EMxdRx/f9N+1hvsgAetpWfZKD2wGJH lUc0Hzi1mioSHBXnBZg/oX9hLzmpzSE8SxqCsaQv4VGooyebnJ3kNDw79FRr5+28 TuEGfURYgdHfZYG5LcG0NlWLwL0knc5ArJqwcqzNkmqhGJdWOdeneNd9ResR5lME lutXovGT6dKK71nzAwVW7ihLG0pseYOMQbcs+YeApkHyCy+7vF4+1PC5rjkcEHFE BEK2BSe3YY1nRqZIeN+qBsbQZHjsyxJT3u3jD4Tg7428uQlEAIV9e5/QJMgGIn2D rcdE59YUg2vQk8EkJ8Rhv5y3R/dBp6G5T3hO3xpfzio1pknMerqMgbQlS/kC5US7 JPCC5IrHRpKdytcAamTBnguPJMfsUmpHeGwIWW958f/vRISAV6nYYPfgUyCVLHjr r/0MVj2o6AP/YylQKfFNS9nRs98jS5wari6ObJm/YHoGkh5ge7YZU+ZPQ8zut+b/ xE+82f2G6P+COGwe4yaGOKtn39FiHA97Q17LxItZukWwH1c4KyQWeX3bLRoZclBv 2lHOgSWJNnDlme5BIjDc2+cMkrFA8PaXhEQ1L/AmrNTMcAqKbDdnpcPACLsyip2U 3+NKSdRSqOt8r4r8FkZ+SeIN0zP5F/BTznU+6ZbKOJMV099XVl0ZL70qVPkjIV5c mkbOtGc1ZZE1pNs2MhFwjsXlQxNa2TLqZKHsDnzR81kk+tu082Pv/g8F0oAKqMt/ wKFNM+wES9f43w== ----------------------------------------------------------------------------------------- !!! DANGER !!! DON'T try to change files by yourself, DON'T use any third party software for restoring your data or antivirus solutions - its may entail damage of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/D84152300BC3497B

Targets

    • Target

      dff5690cd1a3474c6cac9dcf8efacdaf51a6be992e70029e21dcacd89cc71f05

    • Size

      78KB

    • MD5

      9c3784b44183e575037fdb131355b2f6

    • SHA1

      8b85ce577902376ebab9a4e3839da030077fd65c

    • SHA256

      dff5690cd1a3474c6cac9dcf8efacdaf51a6be992e70029e21dcacd89cc71f05

    • SHA512

      db20b54bd34ebb3abf6640c773ada4e14a187552aaaac2fddcde3ad64598d7221054db56ea145fba6e123d21e281d33573e1f9b2035ebe60014e7ae5164c2e9d

    Score
    10/10
    • Modifies extensions of user files

      Ransomware generally changes the extension on encrypted files.

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Sets desktop wallpaper using registry

MITRE ATT&CK Enterprise v6

Tasks