Overview

overview

10

Static

static

9c73dc281f...6c.exe

windows7_x64

10

9c73dc281f...6c.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    9c73dc281f90a01ff3c8013c297a76319b77f24360de3ee1623a4356126d796c

  • Size

    73KB

  • Sample

    220128-dvn6qaehbq

  • MD5

    1c021f42e3a138060e1d298726d1579f

  • SHA1

    54e3384fb68fde6fc711491e8072781e3910156a

  • SHA256

    9c73dc281f90a01ff3c8013c297a76319b77f24360de3ee1623a4356126d796c

  • SHA512

    5ee344d17b5e9a2285258b8e16253263ebb856167b36e7679e602c041c2320c10a7182a7cb5c14f59fe3117a981e96fdff6fa7dc2c2194e90a6f659de143c101

Score
10/10
persistenceransomware

Malware Config

Extracted

Path

C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\How_to_recovery.txt

Ransom Note
68F56EA7B89D377BC3CFC8B3E865CD03B5FD291B8612BE9FE5923B3CA7445ADE 5B25EE6A5B1485570D4927CFB1F4A46740F419AD4F3DFAC6E3E1E1FC0569EA5E 3CC57B68D428DA3A712280E2EC4B5C606BB354D37EA31C4C95CBCB2978D48AB7 D89ED5DC8FF29441E582EB33B16B9A83C507D80C8802EDC4D9ED7C4E07C4F92A 019A0217C3AB0B0D6BF5B7EAEECD6EA9D9E948F211074B5F8A8B0D7A214FD35C 77BB10F3488AD8775348CA2C7DFE6F00846694576D08CB46B91F2503AFF3A305 BC37F115C70933318E442E0BC6AC6D9D05B5C8B480396939FC06144DC4907F8D 1332B3EFCAF67A2FFC2D7524AB17B25815F6D656F77E29DDB55D0E80EA745277 1D58CAB8146D3FC268252615E7AEC5E4FDA01737184060D0B52ADC30224887B4 9FAE947D64127CCF525E79F8830B8D7B723F8B4C21E48FDA47A1E9623DA2673F 1C50C5B1B9CFB047FE1E24C996F2AC5E31B69CA65B6EC0711492DAC29BBF5D61 E3A9FAA3CEEEB3750C1936FA3014C7B8DCB7F3F48AAC3DD2D113CD9D640D3093 04026203440DE1528114B5EAEB7F78471041528335EAEAA491CF93DE6CA6C15A 9F4215F07340A4251ACC43E527682D88CF37F91852868ED47400D793BBDA49E3 08C051E6E78DF07F07BEA00EDC23C837C1735E1962B7810A6A453C3905672FDD 5CF235459A815D0608211A845F45A498B170CFBEFE1E19415E7F8F131BF23099 109E6661ADF74F4877F057202C6261B24CD55E044A6B5E0DB2C0005C130764C6 105220441E61E5A857E54306024B7DD6AACF83E5D4CB26FB621F283AF0C5E10C F47138A34D730D4690D78AEA4575D7497CB0C28B54DCC6465146650A7933EBCB 0AE9E973C8C1EC57B226B33AFF723AA38FB15CD8CE72993CCD5D874888BEABCA DF4503A01F7803063E0B61DD929445D246A7D5CDD7C33A0F3ECDC191E07AF591 443AADD81C854D55007D1E1409A1C137AE5F578395F11A5582A1058120DBD5AD 5AF711F0268DFE351CA84AE00E06F988FD07FB9197B06FD51469AF551E32F025 E73CD34C1CBCEB083F9CC2D8A317323F8C5AB3CAC472B96BB66E6D8D09248DAB A5124595D545F553656B8AC9889EE252B4ED6D63F42B780D2CED54B1819B2B19 A550950175FC8B00E5 Contact us for price and get decryption software. Note that this server is available via Tor browser only Follow the instructions to open the link: qd7pcafncosqfqu3ha6fcx4h6sr7tzwagzpcdcnytiw3b6varaeqv5yd.onion 1. Type the addres "https://www.torproject.org" in your Internet browser. It opens the Tor site. 2. Press "Download Tor", then press "Download Tor Browser Bundle", install and run it. 3. Now you have Tor browser. In the Tor Browser open qd7pcafncosqfqu3ha6fcx4h6sr7tzwagzpcdcnytiw3b6varaeqv5yd.onion 4. Start a chat and follow the further instructions. If you can not use the above link, use the email: ithelp02@decorous.cyou ithelp02@wholeness.business * To contact us, create a new free email account on the site: protonmail.com IF YOU DON'T CONTACT US WITHIN 72 HOURS, PRICE WILL BE HIGHER. ���������������
Emails

ithelp02@decorous.cyou

ithelp02@wholeness.business
URLs

http://qd7pcafncosqfqu3ha6fcx4h6sr7tzwagzpcdcnytiw3b6varaeqv5yd.onion

Extracted

Path

C:\odt\How_to_recovery.txt

Ransom Note
F5721E1E5D0B5A60998168818C573450D28684A7CC0E357AC5FEAE6DDF4AD54D 3055C38B717593BF62BC17B4C353AAC119047C989B5395EEDFF838482715B665 3415C4B517FE72C0D8A29074F670655D9E8A99534632515D5059F066C6D7D9B4 72C83493CE02A5A1013FAB5A0C8E71705EE05FF91BE2D8C63DCA7CF23F8B7F88 DFB579467D960A9458134C9871EB328F54D93397857CA3517E2503D307E98C4D 9431EE5883CC3ABA12C676B558B517C332A3F2A16BC8CE736152E597EC4EA6EA 85F23D6F47E43761B33072C07258025650F596E221423F89A6CA19F556F1B172 F7FD2DFDBD697DC03242B2A4C7ACEF9BEDB336324086B72ABC299E89E39828E7 0CE2CD7E6D9900C0F96DE824EEDB0D12B2999813991DD15E03275DD0070F3810 6B5D0B0E5E6910E6B851FDF69AF50E233276FF3487B2A96CEEC3C11DC44A0454 6EE82BE48679C136B82DC21C50FBD5F3DC5E5F585CA5DBE783D8798E0697DC1D 41D8E369496110B1F7F982724C14B82C41626F2F63C1A4144D86688FB46EA25C D87E0B936A7B93E324BE74470BCCED6EB7B631F503A2776F09841B85573FFD3A A9D978B8CCCC3FA24B545CF91C4CD0E4F12E9B2B5ED57E5274BBEF6F8EB792FB 150AE3EBB31B154C2FC0708089DB69DA979AFFE7F3AAF649AEA7DC2B87726DB0 9F402A0F53EDFE8EE00CB80DC8FDB96898F3303092DAF69CC347A63C9AAB26B6 939EEE725164548C7A18C8F0CEFE24C35CEAD344D700AF467FBD50BBB3304924 03F5E54DB7B652E350E5E512A1C1D97984E326F3A2A1B42EE2C0CB5A04C03E0D 00B62F8F3842E935FA7703AC9ACAC10B3D750158018D08E8FB6C7F2D93A087BC EAB387099C9A62A351304341182AD077C8222E7FDB4CD18FA492BE8E73F77310 330B18B7F930656EBBB779DD8021AA5CE3BECC753648EA7EE8BEFC66CCC2ED3D 43CAD24B9664D5452B1A9E3FFEDA4F2320870C1E118BD19CD8C0063ACDB0EB33 D91D638BF93127E9E541E9CA366A40A87277F905BD47A4C30428294F32871645 C48DEAD7D94051EE9C3C8948E45675D31A3E4D9A6F4EDBFE0976B01348EBC16B E1C24D006574C3881E8D4D094E76B1056A8470FABA90AF89871E54D5D8E28C62 92318AD6F1841801C9 Contact us for price and get decryption software. Note that this server is available via Tor browser only Follow the instructions to open the link: qd7pcafncosqfqu3ha6fcx4h6sr7tzwagzpcdcnytiw3b6varaeqv5yd.onion 1. Type the addres "https://www.torproject.org" in your Internet browser. It opens the Tor site. 2. Press "Download Tor", then press "Download Tor Browser Bundle", install and run it. 3. Now you have Tor browser. In the Tor Browser open qd7pcafncosqfqu3ha6fcx4h6sr7tzwagzpcdcnytiw3b6varaeqv5yd.onion 4. Start a chat and follow the further instructions. If you can not use the above link, use the email: ithelp02@decorous.cyou ithelp02@wholeness.business * To contact us, create a new free email account on the site: protonmail.com IF YOU DON'T CONTACT US WITHIN 72 HOURS, PRICE WILL BE HIGHER. ���������������
Emails

ithelp02@decorous.cyou

ithelp02@wholeness.business
URLs

http://qd7pcafncosqfqu3ha6fcx4h6sr7tzwagzpcdcnytiw3b6varaeqv5yd.onion

Targets

    • Target

      9c73dc281f90a01ff3c8013c297a76319b77f24360de3ee1623a4356126d796c

    • Size

      73KB

    • MD5

      1c021f42e3a138060e1d298726d1579f

    • SHA1

      54e3384fb68fde6fc711491e8072781e3910156a

    • SHA256

      9c73dc281f90a01ff3c8013c297a76319b77f24360de3ee1623a4356126d796c

    • SHA512

      5ee344d17b5e9a2285258b8e16253263ebb856167b36e7679e602c041c2320c10a7182a7cb5c14f59fe3117a981e96fdff6fa7dc2c2194e90a6f659de143c101

    Score
    10/10
    persistenceransomware

    • Deletes shadow copies

      Ransomware often targets backup files to inhibit system recovery.

      ransomware

    • Modifies extensions of user files

      Ransomware generally changes the extension on encrypted files.

      ransomware

    • Deletes itself

    • Adds Run key to start application

      persistence

    • Drops desktop.ini file(s)

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

File Deletion

2
T1107

Modify Registry

1
T1112

Credential Access

Discovery

Query Registry

1
T1012

Peripheral Device Discovery

1
T1120

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Inhibit System Recovery

2
T1490

Tasks