Analysis
-
max time kernel
191s -
max time network
168s -
platform
windows10-2004_x64 -
resource
win10v2004-en-20220113 -
submitted
01/02/2022, 04:46
General
-
Target
a2d2a485d33fd2ea8cdae677efffda26911bc737d520d1e8d2028136b160c9fb.exe
-
Size
82KB
-
MD5
ab95f877d8fe99fa037a406087f9b71e
-
SHA1
70e017007972a1aba458036d66958292980f2cb6
-
SHA256
a2d2a485d33fd2ea8cdae677efffda26911bc737d520d1e8d2028136b160c9fb
-
SHA512
ef0ec52ec96771abbe2415ada319d1c54f044e061adece4d527bb6901d888042a81c4c7deb863696e2267929e815ed3e971e9040bded5c77a02debe7a5dbebdb
Score
10/10
Malware Config
Extracted
Path
C:\Users\Admin\AppData\Roaming\Microsoft\!!_RECOVERY_instructions_!!.html
Ransom Note
<html>
<head>
<title>FILE RECOVERY</title>
<style>
body{
padding:0;
margin:0;
background: #004d80;
font-family: Verdana, Geneva, sans-serif;
font-size: 11px;
}
#nuclear55_content_middle{
margin-top: 30px;
margin-bottom: 30px;
margin-left: auto;
margin-right: auto;
width: 800px;
background: #fff;
border: 2px dotted black;
padding: 13px;
}
a{
color: #660000;
font-weight: bold;
}
h3{
color: #660000;
text-align: center;
}
#btc-addr-display{
border: 1px dotted #000;
padding: 5px;
}
</style>
</head>
<body>
<div id="nuclear55_content_middle">
<h3>Your files and documents on this computer have been encrypted</h3>
<p><strong>What happened to my files?</strong></p>
<p>Your important files on your computer; photos, documents, and videos have been encrypted. Your files were encrypted using AES and RSA encryption.
<p><strong>What does this mean?</strong></p>
<p>File encryption was produced using a unique 256-bit key generated specifically for this machine. Encryption is a way of securing data and requires a special key to decipher.</p>
<p>Unforunate for you, this special key was encrypted using an additional layer of encryption; RSA. Your files were encrypted using the <strong>public</strong> RSA key. To truly reverse the unfortunate state of your files, you need the <strong>private</strong> RSA key which is only known by us.
<p><strong>What should I do next?</strong></p>
<p>For your information your private key is a paid product. If you really value your data we suggest you start acting fast because you only short amount of time to recover your files before they are gone forever.</p>
<p>There are no solutions to this problem, and no anti-virus software can reverse the process of file encryption because we have also erased recent versions of your files which means you <strong>cannot</strong> use file recovery software.</p>
<p>Modifying your files in any way can damage your files permenantly and we will no longer be able to help you. Follow our terms assigned to you below, and we will have your files recovered.
<p style="color: red; font-weight: bold; font-size: 11px;">You now have 72 hours to make payment before we destroy your encryption keys, leaving your files damaged for good</p>
<p><strong>Recovering your files</strong></p>
<h4 style="background-color: #004d99; font-weight: normal; padding: 4px; color: #fff;">1. Getting started with Bitcoin</h4>
In order to use Bitcoin you will need to setup your own Bitcoin wallet. We recommend <a href="https://blockchain.info" target="_blank">blockchain.info</a>. However, if you already own a Bitcoin wallet you can skip this step.
<h4 style="background-color: #004d99; font-weight: normal; padding: 4px; color: #fff;">2. Purchase Bitcoins</h4>
<p>There are a number of ways to purchase Bitcoins, whether you're paying by cash, credit/debit card, or direct from your bank account. A range of Bitcoin sellers make Bitcoins easy to obtain.</p>
</p>
<p>
<a href="https://localbitcoins.com" target="_blank">https://localbitcoins.com</a> Buy bitcoins with bank transfer, cash, and Moneygram (best option)<br />
<a href="https://coinatmradar.com" target="_blank">https://coinatmradar.com</a> Buy bitcoins from local ATM machines <br />
<a href="https://bittylicious.com" target="_blank">https://bittylicious.com</a> Buy bitcoins with bank transfer or debit card (United Kingdom) <br />
<a href="https://cex.io" target="_blank">https://cex.io</a> Buy bitcoins with credit/debit card or bank transfer<br />
<a href="https://btcdirect.eu" target="_blank">https://btcdirect.eu</a> Buy bitcoins in Europe<br />
<a href="https://coincorner.com" target="_blank">https://coincorner.com</a> Buy bitcoins in Europe with credit or debit card
</p>
<h4 style="background-color: #004d99; font-weight: normal; padding: 4px; color: #fff;">3. Send <strong>2</strong> BTC</font> to the Bitcoin address:</h4>
<div id="btc-addr-display"><strong>Address:</strong> 1NLLrung1MaXucHpAzY5KjdK4y8woodJWt</div>
<div style="margin-top: 25px;"/></div>
</p>
<h4 style="background-color: #004d99; font-weight: normal; padding: 4px; color: #fff;">4. Receive file recovery software</h4>
After buying bitcoins, and sending them to the assigned address, follow these steps below:
<p>
<li>Send an email with the subject 'PAYMENT' along with 1 encrypted file attached [these end in .nuclear55], to <strong style="color: #660000;">[email protected]</strong></li>
<!--<li>For a free test decrypt, send one small file which will decrypt free</li>-->
<li>Wait for a response from our support (up to 24-48 hours)</li>
<!--<li>We will send you further information regarding payment and full file decryption of your computer</li>-->
<li>Receive file decryption software to decrypt every encrypted file on the hard drive</li>
<li>If you do not here from us after 3 days, register an account on mail.india.com and email us. Your mail provider may be blocking us</li>
<li>We won't respond without proof of payment. if you waste our time, we will destroy your encryption key and <strong>waste</strong> the life of your files</li>
</p>
<p><strong>Our guarentee</strong></p>
<p>Our service is not designed to harm his/her computer in any way, but to provide a full decryption service of the intended computer and allow the user to regain access to the specified files.</p>
<p></p>
</div>
</body>
</html>
Emails
#660000;">[email protected]</strong></li>
Extracted
Path
C:\Users\Admin\AppData\Roaming\Microsoft\!!_RECOVERY_instructions_!!.txt
Ransom Note
NUCLEAR#55 ~ <JDQPXOPR>
!! Your files and documents on this computer have been encrypted !!
** What has happened to my files? **
Your important files on your computer; photos, documents, and videos have been encrypted. Your files were encrypted using AES and RSA encryption.
** What does this mean? **
File encryption was produced using a unique 256-bit key generated specifically for this machine. Encryption is a way of securing data and requires a special key to decipher.
Unforunate for you, this special key was encrypted using an additional layer of encryption; RSA. Your files were encrypted using the public RSA key. To truly reverse the unfortunate state of your files, you need the private RSA key which is only known by us.
** What should I do next? **
For your information your private key is a paid product. If you really value your data we suggest you start acting fast because you only short amount of time to recover your files before they are gone forever.
There are no solutions to this problem, and no anti-virus software can reverse the process of file encryption because we have also erased recent versions of your files which means you cannot use file recovery software.
Modifying your files in any way can damage your files permenantly and we will no longer be able to help you. Follow our terms assigned to you below, and we will have your files recovered.
You now have 72 hours to make payment before we destroy your encryption keys, leaving your files damaged for good
How do I recovering my files?
Without Bitcoins your files can never be recovered. Follow the steps below:
[1] => Create a Bitcoin wallet
In order to use Bitcoin you will need to setup your own Bitcoin wallet. We recommend blockchain.info. However, if you already own a Bitcoin wallet you can skip this step.
[2] => Purchase Bitcoins
There are a number of ways to purchase Bitcoins, whether you're paying by cash, credit/debit card, or direct from your bank account. A range of Bitcoin sellers make Bitcoins easy to obtain.
https://localbitcoins.com Buy bitcoins with bank transfer, cash, and Moneygram (best option - worldwide)
https://coinatmradar.com Buy bitcoins from local ATM machines
https://bittylicious.com Buy bitcoins with bank transfer or debit card (United Kingdom)
https://cex.io Buy bitcoins with credit/debit card or bank transfer)
https://btcdirect.eu Buy bitcoins in Europe
https://coincorner.com Buy bitcoins in Europe with credit or debit card
[3] => Send bitcoins to our address
You should send 2 BTC to our Bitcoin address: 1NLLrung1MaXucHpAzY5KjdK4y8woodJWt
[4] => Contact us and receive encryption keys, and file recovery software
- Send an email with the subject 'PAYMENT' along with 1 encrypted file attached [these end in .nuclear55], to [email protected]
- Wait for a response from us (up to 24-48 hours)
- Receive file decryption software to decrypt every encrypted file on the hard drive
- If you do not here from us after 3 days, register an account on mail.india.com and email us. Your mail provider may be blocking us
- We will not respond without proof of payment. If you waste our time, we will destroy your encryption key and waste the life of your files
-----------------------------------------------------------------
Our service is not designed to harm his/her computer in any way, but to provide a full decryption service of the intended computer and allow the user to regain access to the specified files.
-----------------------------------------------------------------
Emails
Wallets
1NLLrung1MaXucHpAzY5KjdK4y8woodJWt
URLs
https://coinatmradar.com
https://bittylicious.com
https://cex.io
https://btcdirect.eu
https://coincorner.com
Signatures
-
Nuke
Ransomware family first discovered in 2016.
-
Sets service image path in registry 2 TTPs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Drops file in Program Files directory 64 IoCs
-
Drops file in Windows directory 6 IoCs
-
Modifies data under HKEY_USERS 41 IoCs
-
Suspicious use of AdjustPrivilegeToken 7 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\a2d2a485d33fd2ea8cdae677efffda26911bc737d520d1e8d2028136b160c9fb.exe"C:\Users\Admin\AppData\Local\Temp\a2d2a485d33fd2ea8cdae677efffda26911bc737d520d1e8d2028136b160c9fb.exe"1⤵
- Adds Run key to start application
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\WaaSMedicAgent.exeC:\Windows\System32\WaaSMedicAgent.exe e591a09d1a5f49788246a22bd190013a fm0CT2DBe0mrTjSVnItbgg.0.1.0.0.01⤵
- Modifies data under HKEY_USERS
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s wuauserv1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
64KB
-
Filesize
16KB
-
Filesize
104KB
-
Filesize
5.6MB
-
Filesize
584KB
-
Filesize
5.6MB
-
Filesize
40KB