General

  • Target

    0243ddd90fb70d1a7a6714bce75072254cde9bdb8c36ed2271b49a9aa190d9d5

  • Size

    272KB

  • Sample

    220305-3b7w6abccm

  • MD5

    ab1aaa8f96c61684736da00ece5a9c83

  • SHA1

    c41435392d0759af778dd24ea303136b02469123

  • SHA256

    0243ddd90fb70d1a7a6714bce75072254cde9bdb8c36ed2271b49a9aa190d9d5

  • SHA512

    ba25c53c7b5aeea57cde0540071292a7f1b77557ba72119f5fbdf95e840b04e994c81a4a7248375c272eeb34ebe3f41f5ae7f0acc0d3fece477634e6caf28515

Score
10/10

Malware Config

Extracted

Path

C:\7358kd+readme.txt

Ransom Note
--=Welcome.Again.==- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on you computer has expansion 7358kd. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/08D920D8768424D0 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/08D920D8768424D0 Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: eoqslgEdM5aQVVZlmqOKTHQRE7G1AR+mu56RUOVfxbS2LWu+QdcHpDypgT9f4Ciz TxtxiU8Tv0OcWHTMN+E76Zmx+gIuQvYCeKiWTH7ypgR13rPIOTCl40VcfijheCYd FE9lOkGPtKFHAjVoMJCGoypMMAUwweEeGWPP6T69H0Cz3Je5f+nkOfoddJiSXXmX MA3jKwX5FDal4c/TmZ1BTPps9IHRSsCca+kRjhRkboC40BMKJqPTQJa1y91mb+bo caPttvhYcMjzU2BDbRgWFa/OAtaycQHSWEpT2qJiWg+qyXRU59sFvemOCt/WymOh QeAlZvgp4+F5bywQBtlsdf4br/eQ/GGbB+3nGGIA8UB6atTphaQhrZv5rrTfyfS9 XBXknpmt3+CyMecXt7s5EciVGqmhNB4Kz9lBEvmCNcMO9Q37JVdmWICc9WN7ezO2 4CRnDTgwckO4mzSMw0GfbHbeqZdp+YRogwzfoJdZy1KwlFhgOzwwx3lkkzaCxMgY wUYABuH3Lhl013eQGIQ4kAzshZENvVUJiyxlnSTo4GfwHQSRWUf5bW5VMkEQ9fy4 SLLFBSwq/5LRH8IP2K/k8+B3QGCeIp2YsrRnBcfsSDtTVpJ1KtaH0Mdn270SJu2z qSoHxNNsbPTwnM15p/SNujpzf3edj5AJcU0fehrSJN6h8Mtlp2QlNYBBRzusos67 6kKf1Uq8eouwD9ArG9MW8+JA/ZlVTShg2XG//46cFnac7XAwJf1du33+p/wqCokl yhdFkSQ3KQyvfGHGWncwizHxRvXsvQpipsx69Bso4EN7wiau5qQ7RO6oyvs3g0cJ rBHzYXfIi3b74cb8g0B+qmkD0x13oqTqiloSFl6JrF0Y0O0+SbwMUXicgxKwHSzB h4kxOMZccS/nIalbN59tUG739inW0qp2QTaBJq84EIpLw0Z/nya0eevD1PnLli0N BCwfM+RKG7ycwrGhxbeasEPnbYPgHIL/dQeLQn6Du4Xfuqj6YNUg/tG3UPU4FOBO WqAkMOwOXch4hxGjrQ3bevIMI9gCeAAs60QUddyNujjn3Kr23dPOtBOQPhwJAPmt tK0ryGjVmyOm1EFSjpKNrHI/xqnFdH0W0oJZ5Nifoy867GDGGqvYIjYZkVWFgGTb AkBWib52PP58Ndn8kun7PBMH/SZIYUh2183sXMHUp9Ltsc6I72XCwIFFX5EY5RHK 5P2bXlVq228QW5rSeYvBAK/KNhLCOafoXeeNaySqCoN29XsOPjmKsOJfpriEW3Ed +eJLOgJvpEq8768r1iYsdKTTLk0= Extension name: 7358kd ----------------------------------------------------------------------------------------- !!! !!! !!! !!! !!! !!! !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! !!! !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!! !!! !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/08D920D8768424D0

http://decryptor.cc/08D920D8768424D0

Extracted

Path

C:\010344hf8+readme.txt

Ransom Note
--=Welcome.Again.==- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on you computer has expansion 010344hf8. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/6F390513D8EA2141 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/6F390513D8EA2141 Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: 5+KFx3eEbitiJ1lZwuRnGN6EJ4UnJ3uHnhDtNlhoFZtzMPWZse01+HyG7ubeTc81 mHjCRS6HdTcb5tiOf/ugtTaCuKQtYudGPvo+ub2CFCSBpaPmAbcfJZlaBgifbYkV x0trPdO4CRVV/qhCsIHDH/nLxLhFCdmqIuZYTsjKgZXcC8qlSdoGBY7yvZ12Kp3K dZO7p1PeaF4Gdkr0CJ39gTs0Ieiove8aY0eCQC2zXJ0oslV9liiMddVE+gLLh6vS ZkVPLlPJqxg6k9n+LFLeoyv07FmUjbNtaLwSeqgZIdhXROGojhVwz8JR2SFSIs4H lMHKZxeWZC6JODCmOZKyg4NwYT+eZaMJ2YTkLICHDMNvaxr/MhbRe9wWsRyrr0dz G2Wd2NXNl999O+wT1wLNh6hsA/34aBFjCgf6C9zz0M/ommjm+OzG343ZOi/lKeq6 Z82KCIGnwRstTKXDIxmibD0Iw69hcJmE03DqH4nVfk95qWVFIhJQVNNd9QhPui8z MiCCGk+o+59o10k7YVJvkmsgasmlcJPnvZCRgMM+rA/w2UgqVDQjsXEhIcEaL5NS FKe6ejCMWypE+ZZFf6xhH5vZ8IQFlfh1vQlJWz7gmLW56qEannK1fCHvpp6N3yNe HxW+TuET8+RJCnaLt3lxMzF2jG5VzZFzkr/F2YQcaZ0JbmCIU2NE8WPIafGgsmee 3dwnaFzBCJJi9wfwx1cgsOJSOTCSLdL+UchSzMK+nXyJdoOffwaNzMt90fhUNomi dXUwGFjm0t4vgC7f1AVnM1+q+iaOJukoJG3bcy75GsE2CxGhIgB1vlx8yCClQa9G kXhOFPmequZdgVylb/sBu4ljgSVA6XmSff7R2ZPairh+D7W/g412O7e4i2FpoIXo xPn0pylxty5VRoBCSBZ6fUmWCtz2byJ0Hr4bDwrNjFc8q8Hz2rjyBIUVq56jbIf9 ngzkA5YdVrvFzU26hu/bHwvxaPfbW/6BOG2cv2MBcHd2ZJCTt21HBoNyXU1gpMEq JZAKBrQuJJ1oueLcfFasid1BdHINb97WFKB0wMBWJcM0+zJQh4uY60dejNu8KsjG wh/P4D6r7oefCB0INz6I++Pg3/KDgLmx3SJFSxqLQQ2yAp8W6bfugw2n3a/IeXdL Px9rV4hh30x1r0jJ1lYF1KGLa443emoGgj6/0Dh76c2TqBL65izop2PR3E3l/+E5 sjynjdhCAwwth60AG1d2J2MYiiNshb1vw0QcFdg21w7QlmR2fPQ4O4am+qygcv6M jSeNecSPHFN/oF0QzpQjJqkYs6HDVlwkqsAIv9Gw3cU= Extension name: 010344hf8 ----------------------------------------------------------------------------------------- !!! !!! !!! !!! !!! !!! !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! !!! !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!! !!! !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/6F390513D8EA2141

http://decryptor.cc/6F390513D8EA2141

Targets

    • Target

      0243ddd90fb70d1a7a6714bce75072254cde9bdb8c36ed2271b49a9aa190d9d5

    • Size

      272KB

    • MD5

      ab1aaa8f96c61684736da00ece5a9c83

    • SHA1

      c41435392d0759af778dd24ea303136b02469123

    • SHA256

      0243ddd90fb70d1a7a6714bce75072254cde9bdb8c36ed2271b49a9aa190d9d5

    • SHA512

      ba25c53c7b5aeea57cde0540071292a7f1b77557ba72119f5fbdf95e840b04e994c81a4a7248375c272eeb34ebe3f41f5ae7f0acc0d3fece477634e6caf28515

    Score
    10/10
    • Modifies extensions of user files

      Ransomware generally changes the extension on encrypted files.

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Drops file in System32 directory

    • Sets desktop wallpaper using registry

MITRE ATT&CK Enterprise v6

Tasks