Analysis
-
max time kernel
154s -
max time network
163s -
platform
windows7_x64 -
resource
win7-en-20211208 -
submitted
01/02/2022, 04:46
General
-
Target
a2d2a485d33fd2ea8cdae677efffda26911bc737d520d1e8d2028136b160c9fb.exe
-
Size
82KB
-
MD5
ab95f877d8fe99fa037a406087f9b71e
-
SHA1
70e017007972a1aba458036d66958292980f2cb6
-
SHA256
a2d2a485d33fd2ea8cdae677efffda26911bc737d520d1e8d2028136b160c9fb
-
SHA512
ef0ec52ec96771abbe2415ada319d1c54f044e061adece4d527bb6901d888042a81c4c7deb863696e2267929e815ed3e971e9040bded5c77a02debe7a5dbebdb
Score
10/10
Malware Config
Extracted
Path
C:\Users\Admin\AppData\Roaming\Microsoft\!!_RECOVERY_instructions_!!.html
Ransom Note
<html>
<head>
<title>FILE RECOVERY</title>
<style>
body{
padding:0;
margin:0;
background: #004d80;
font-family: Verdana, Geneva, sans-serif;
font-size: 11px;
}
#nuclear55_content_middle{
margin-top: 30px;
margin-bottom: 30px;
margin-left: auto;
margin-right: auto;
width: 800px;
background: #fff;
border: 2px dotted black;
padding: 13px;
}
a{
color: #660000;
font-weight: bold;
}
h3{
color: #660000;
text-align: center;
}
#btc-addr-display{
border: 1px dotted #000;
padding: 5px;
}
</style>
</head>
<body>
<div id="nuclear55_content_middle">
<h3>Your files and documents on this computer have been encrypted</h3>
<p><strong>What happened to my files?</strong></p>
<p>Your important files on your computer; photos, documents, and videos have been encrypted. Your files were encrypted using AES and RSA encryption.
<p><strong>What does this mean?</strong></p>
<p>File encryption was produced using a unique 256-bit key generated specifically for this machine. Encryption is a way of securing data and requires a special key to decipher.</p>
<p>Unforunate for you, this special key was encrypted using an additional layer of encryption; RSA. Your files were encrypted using the <strong>public</strong> RSA key. To truly reverse the unfortunate state of your files, you need the <strong>private</strong> RSA key which is only known by us.
<p><strong>What should I do next?</strong></p>
<p>For your information your private key is a paid product. If you really value your data we suggest you start acting fast because you only short amount of time to recover your files before they are gone forever.</p>
<p>There are no solutions to this problem, and no anti-virus software can reverse the process of file encryption because we have also erased recent versions of your files which means you <strong>cannot</strong> use file recovery software.</p>
<p>Modifying your files in any way can damage your files permenantly and we will no longer be able to help you. Follow our terms assigned to you below, and we will have your files recovered.
<p style="color: red; font-weight: bold; font-size: 11px;">You now have 72 hours to make payment before we destroy your encryption keys, leaving your files damaged for good</p>
<p><strong>Recovering your files</strong></p>
<h4 style="background-color: #004d99; font-weight: normal; padding: 4px; color: #fff;">1. Getting started with Bitcoin</h4>
In order to use Bitcoin you will need to setup your own Bitcoin wallet. We recommend <a href="https://blockchain.info" target="_blank">blockchain.info</a>. However, if you already own a Bitcoin wallet you can skip this step.
<h4 style="background-color: #004d99; font-weight: normal; padding: 4px; color: #fff;">2. Purchase Bitcoins</h4>
<p>There are a number of ways to purchase Bitcoins, whether you're paying by cash, credit/debit card, or direct from your bank account. A range of Bitcoin sellers make Bitcoins easy to obtain.</p>
</p>
<p>
<a href="https://localbitcoins.com" target="_blank">https://localbitcoins.com</a> Buy bitcoins with bank transfer, cash, and Moneygram (best option)<br />
<a href="https://coinatmradar.com" target="_blank">https://coinatmradar.com</a> Buy bitcoins from local ATM machines <br />
<a href="https://bittylicious.com" target="_blank">https://bittylicious.com</a> Buy bitcoins with bank transfer or debit card (United Kingdom) <br />
<a href="https://cex.io" target="_blank">https://cex.io</a> Buy bitcoins with credit/debit card or bank transfer<br />
<a href="https://btcdirect.eu" target="_blank">https://btcdirect.eu</a> Buy bitcoins in Europe<br />
<a href="https://coincorner.com" target="_blank">https://coincorner.com</a> Buy bitcoins in Europe with credit or debit card
</p>
<h4 style="background-color: #004d99; font-weight: normal; padding: 4px; color: #fff;">3. Send <strong>2</strong> BTC</font> to the Bitcoin address:</h4>
<div id="btc-addr-display"><strong>Address:</strong> 1NLLrung1MaXucHpAzY5KjdK4y8woodJWt</div>
<div style="margin-top: 25px;"/></div>
</p>
<h4 style="background-color: #004d99; font-weight: normal; padding: 4px; color: #fff;">4. Receive file recovery software</h4>
After buying bitcoins, and sending them to the assigned address, follow these steps below:
<p>
<li>Send an email with the subject 'PAYMENT' along with 1 encrypted file attached [these end in .nuclear55], to <strong style="color: #660000;">[email protected]</strong></li>
<!--<li>For a free test decrypt, send one small file which will decrypt free</li>-->
<li>Wait for a response from our support (up to 24-48 hours)</li>
<!--<li>We will send you further information regarding payment and full file decryption of your computer</li>-->
<li>Receive file decryption software to decrypt every encrypted file on the hard drive</li>
<li>If you do not here from us after 3 days, register an account on mail.india.com and email us. Your mail provider may be blocking us</li>
<li>We won't respond without proof of payment. if you waste our time, we will destroy your encryption key and <strong>waste</strong> the life of your files</li>
</p>
<p><strong>Our guarentee</strong></p>
<p>Our service is not designed to harm his/her computer in any way, but to provide a full decryption service of the intended computer and allow the user to regain access to the specified files.</p>
<p></p>
</div>
</body>
</html>
Emails
#660000;">[email protected]</strong></li>
Extracted
Path
C:\Users\Admin\AppData\Roaming\Microsoft\!!_RECOVERY_instructions_!!.txt
Ransom Note
NUCLEAR#55 ~ <QSKGHMYQ>
!! Your files and documents on this computer have been encrypted !!
** What has happened to my files? **
Your important files on your computer; photos, documents, and videos have been encrypted. Your files were encrypted using AES and RSA encryption.
** What does this mean? **
File encryption was produced using a unique 256-bit key generated specifically for this machine. Encryption is a way of securing data and requires a special key to decipher.
Unforunate for you, this special key was encrypted using an additional layer of encryption; RSA. Your files were encrypted using the public RSA key. To truly reverse the unfortunate state of your files, you need the private RSA key which is only known by us.
** What should I do next? **
For your information your private key is a paid product. If you really value your data we suggest you start acting fast because you only short amount of time to recover your files before they are gone forever.
There are no solutions to this problem, and no anti-virus software can reverse the process of file encryption because we have also erased recent versions of your files which means you cannot use file recovery software.
Modifying your files in any way can damage your files permenantly and we will no longer be able to help you. Follow our terms assigned to you below, and we will have your files recovered.
You now have 72 hours to make payment before we destroy your encryption keys, leaving your files damaged for good
How do I recovering my files?
Without Bitcoins your files can never be recovered. Follow the steps below:
[1] => Create a Bitcoin wallet
In order to use Bitcoin you will need to setup your own Bitcoin wallet. We recommend blockchain.info. However, if you already own a Bitcoin wallet you can skip this step.
[2] => Purchase Bitcoins
There are a number of ways to purchase Bitcoins, whether you're paying by cash, credit/debit card, or direct from your bank account. A range of Bitcoin sellers make Bitcoins easy to obtain.
https://localbitcoins.com Buy bitcoins with bank transfer, cash, and Moneygram (best option - worldwide)
https://coinatmradar.com Buy bitcoins from local ATM machines
https://bittylicious.com Buy bitcoins with bank transfer or debit card (United Kingdom)
https://cex.io Buy bitcoins with credit/debit card or bank transfer)
https://btcdirect.eu Buy bitcoins in Europe
https://coincorner.com Buy bitcoins in Europe with credit or debit card
[3] => Send bitcoins to our address
You should send 2 BTC to our Bitcoin address: 1NLLrung1MaXucHpAzY5KjdK4y8woodJWt
[4] => Contact us and receive encryption keys, and file recovery software
- Send an email with the subject 'PAYMENT' along with 1 encrypted file attached [these end in .nuclear55], to [email protected]
- Wait for a response from us (up to 24-48 hours)
- Receive file decryption software to decrypt every encrypted file on the hard drive
- If you do not here from us after 3 days, register an account on mail.india.com and email us. Your mail provider may be blocking us
- We will not respond without proof of payment. If you waste our time, we will destroy your encryption key and waste the life of your files
-----------------------------------------------------------------
Our service is not designed to harm his/her computer in any way, but to provide a full decryption service of the intended computer and allow the user to regain access to the specified files.
-----------------------------------------------------------------
Emails
Wallets
1NLLrung1MaXucHpAzY5KjdK4y8woodJWt
URLs
https://coinatmradar.com
https://bittylicious.com
https://cex.io
https://btcdirect.eu
https://coincorner.com
Signatures
-
Nuke
Ransomware family first discovered in 2016.
-
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Deletes itself 1 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Sets desktop wallpaper using registry 2 TTPs 1 IoCs
-
Drops file in Program Files directory 64 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Interacts with shadow copies 2 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
-
Modifies Control Panel 2 IoCs
-
Modifies Internet Explorer settings 1 TTPs 14 IoCs
-
Runs ping.exe 1 TTPs 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 4 IoCs
-
Suspicious use of SetWindowsHookEx 2 IoCs
-
Suspicious use of WriteProcessMemory 28 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\a2d2a485d33fd2ea8cdae677efffda26911bc737d520d1e8d2028136b160c9fb.exe"C:\Users\Admin\AppData\Local\Temp\a2d2a485d33fd2ea8cdae677efffda26911bc737d520d1e8d2028136b160c9fb.exe"1⤵
- Adds Run key to start application
- Sets desktop wallpaper using registry
- Drops file in Program Files directory
- Modifies Control Panel
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Roaming\Microsoft\!!_RECOVERY_instructions_!!.html2⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:920 CREDAT:275457 /prefetch:23⤵
-
-
-
C:\Windows\SysWOW64\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Roaming\Microsoft\!!_RECOVERY_instructions_!!.txt2⤵
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C vssadmin delete shadows /all /quiet2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\vssadmin.exevssadmin delete shadows /all /quiet3⤵
- Interacts with shadow copies
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C ping 1.1.1.1 -n 1 -w 3000 > Nul & Del "C:\Users\Admin\AppData\Local\Temp\a2d2a485d33fd2ea8cdae677efffda26911bc737d520d1e8d2028136b160c9fb.exe"2⤵
- Deletes itself
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\PING.EXEping 1.1.1.1 -n 1 -w 30003⤵
- Runs ping.exe
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
104KB
-
Filesize
4KB
-
Filesize
8KB
-
Filesize
68KB