Analysis
-
max time kernel
180s -
max time network
196s -
platform
windows10-2004_x64 -
resource
win10v2004-en-20220113 -
submitted
11-02-2022 06:46
General
-
Target
787d288236d321ec375d70eb9fec444213d4b73dd70bb0230a21030a079cbff7.exe
-
Size
56KB
-
MD5
9f720e4d4abce792a399d8394931b6c9
-
SHA1
5a4685725247f1b20dd77541132205ba45dc924d
-
SHA256
787d288236d321ec375d70eb9fec444213d4b73dd70bb0230a21030a079cbff7
-
SHA512
11a62b66ec7d8e921e3142f524978435cf884fdf8a718fc2a0f91813b5ce75f2a16fd0c5b04580e8bddd5967709b5421f85371fa358f1ea9dc41dbab78e3d2ea
Score
10/10
Malware Config
Extracted
Path
C:\instruction.html
Ransom Note
<html>
<style type="text/css">
body {
background-color: #404040;
}
{
margin: 0;
padding: 0;
}
h1, h3{
text-align: center;
text-transform: uppercase;
font-weight: normal;
}
/*---*/
.tabs1{
width: 800px;
display: block;
margin: auto;
position: relative;
}
.tabs1 .head{
text-align: center;
float: top;
text-transform: uppercase;
font-weight: normal;
display: block;
padding: 15px;
color: #000000;
background: #4A83FD;
}
.tabs1 .identi {
text-align: center;
float: top;
display: block;
padding: 15px;
background: #303030;
color: #DFDFDF;
}
/*---*/
.tabs{
width: 800px;
display: block;
margin: auto;
position: relative;
}
.tabs .tab{
float: left;
display: block;
}
.tabs .tab>input[type="radio"] {
position: absolute;
top: -9999px;
left: -9999px;
}
.tabs .tab>label {
display: block;
padding: 6px 21px;
font-size: 18x;
text-transform: uppercase;
cursor: pointer;
position: relative;
color: #FFF;
background: #4A83FD;
}
.tabs .content {
z-index: 0;/* or display: none; */
overflow: hidden;
width: 800px;
/*padding: 25px;*/
position: absolute;
top: 32px;
left: 0;
background: #303030;
color: #DFDFDF;
opacity:0;
transition: opacity 400ms ease-out;
}
.tabs .content .text{
width: 700px;
padding: 25px;
}
.tabs>.tab>[id^="tab"]:checked + label {
top: 0;
background: #303030;
color: #F5F5F5;
}
.tabs>.tab>[id^="tab"]:checked ~ [id^="tab-content"] {
z-index: 1;/* or display: block; */
opacity: 1;
transition: opacity 400ms ease-out;
}
</style>
<head>
<meta charset="utf-8">
<title>HOW TO DECRYPT YOUR FILES</title>
</head>
<body>
<div class="tabs1">
<div class="head" ><h3>Your personal ID</h3></div>
<div class="identi">
<div>��8E 2B E0 4D 1F AE 0B 09 08 95 F9 DE E1 F2 BE 97
1C 92 1C 36 BE 49 40 25 EA A7 6C D4 F8 F7 35 5B
F2 3C 44 DB EB 0F F4 F8 88 F0 4F 73 83 A2 74 68
69 E7 B6 C3 16 B5 B8 EB 70 E3 A6 F7 02 7E 60 03
60 9D 6F BD 4C 3A AD B3 88 76 E3 52 01 FF 81 72
8D 9F 67 7C 73 16 FC 1B B0 DC EC C7 61 E8 DA 22
5F 66 CC C2 78 BE A8 5D 62 20 1D AA E6 11 8E AB
11 54 01 11 5B C2 54 08 55 0E 14 D1 B9 E9 A4 B2
A3 00 57 2D 69 2F 51 35 FF B6 F5 43 BB 76 D2 FB
E7 70 FC ED B9 32 F2 8D DD 3A CE 64 27 42 3A 37
76 CF 9C CB F2 E0 25 42 F8 CA FB E0 DB C0 35 A5
E0 6C 27 FC A2 E0 F7 A1 D2 8B 1F 0B 1A C2 ED 8F
2F 3A 46 38 EE A9 8D 04 39 EB 37 22 06 5D 73 BE
98 A2 B5 95 85 9B 31 D5 82 54 04 C5 78 81 1D 38
F4 A8 D4 E4 F6 F8 E2 3C 21 1E 0E 1F D7 BA 9F 39
AC 10 4B B9 56 23 47 CA ED 2E 4E 34 26 21 2F CD
</div><!-- !!! dont changing this !!! -->
</div>
</div>
<!-- -->
<div class="tabs">
<!--tab-->
<div class="tab">
<input type="radio" name="tabs" checked="checked" id="tab1" />
<label for="tab1">English</label>
<div id="tab-content1" class="content">
<h1>Your files are encrypted! </h1>
<hr/>
<h3>All your important data has been encrypted.</h3>
<br/>
<div class="text">
<!--text data -->
<center><h1>Hello</center></br></h1>
<br><center>Your files, documents, photo, databases and all the rest aren't REMOVED. </br>
It is impossible to restore files without our help.</br>
You will try to restore files independent you will lose files</br>
FOREVER.</h1></center>
<br><center>---------------------------------------------------------- </br></center>
You will be able to restore files so:
<li> to contact us by e-mail: <strong>[email protected]</strong></li>
you send your ID identifier and 2 files, up to 1 MB in size everyone.
We decipher them, as proof of a possibility of interpretation.
also you receive the instruction where and how many it is necessary to pay.
<li> you pay and confirm payment.</li>
<li> after payment you receive the DECODER program. which you restore ALL YOUR FILES.</li>
<center>----------------------------------------------------------</center>
You have 72 hours on payment.
If you don't manage to pay in 72 hours, then the price of interpretation increases twice.</br>
<li> If you don't waste time for attempts to decipher, then you will be able to restore all files in 1 hour. </li>
<li> If you try to decipher - you can FOREVER lose your files. </li>
<li> Decoders of other users are incompatible with your data as at each user </li>
unique key of enciphering
<center>----------------------------- P.S. ----------------------------------</center>
If you have no bitcoins
<li> Create Bitcoin purse: https://blockchain.info/ru/wallet/new</li>
<li> Buy Bitcoin in the convenient way:</li>
<center><strong>https://localbitcoins.com/ru/buy_bitcoins (Visa/MasterCard, QIWI Visa Wallet, etc.)</strong></center>
<center><strong>https://ru.bitcoin.it/wiki/Priobreteniye_bitkoynov (the instruction for beginners)</strong></center>
- It doesn't make sense to complain of us and to arrange a hysterics. </br>
- Complaints having blocked e-mail, you deprive a possibility of the others, to decipher the computers.</br>
Other people at whom computers are also ciphered you deprive of the ONLY hope to decipher. FOREVER.</br>
- Just contact with us, we will stipulate conditions of interpretation of files and available payment, </br>
in a friendly situation.</br>
<center>---------------------------------------------------------</center>
<!--text data -->
</div>
</div>
</div>
<!--tab-->
</body>
</html>
���������
Emails
<strong>[email protected]</strong></li>
Signatures
-
Locky
Ransomware strain released in 2016, with advanced features like anti-analysis.
-
Adds Run key to start application 2 TTPs 2 IoCs
-
Drops desktop.ini file(s) 9 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\787d288236d321ec375d70eb9fec444213d4b73dd70bb0230a21030a079cbff7.exe"C:\Users\Admin\AppData\Local\Temp\787d288236d321ec375d70eb9fec444213d4b73dd70bb0230a21030a079cbff7.exe"1⤵
- Adds Run key to start application
- Drops desktop.ini file(s)