Analysis

  • max time kernel
    157s
  • max time network
    159s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-en-20220112
  • submitted
    05-03-2022 20:10

General

  • Target

    32a31a2c1811ecec2841f70c0be6a18040cd456145f524ca284363c1606c13d0.exe

  • Size

    1.4MB

  • MD5

    30389b7a45567e07146e2ad0d59734fa

  • SHA1

    776ec66d4570ddb8ca3907fd77e4c02ae1e428ba

  • SHA256

    32a31a2c1811ecec2841f70c0be6a18040cd456145f524ca284363c1606c13d0

  • SHA512

    a86d240fc8cf0201bdf63c1f7ebc4adbff4836061bc71c3ba1b044ae6c7a41c6d4b50f69b77bfb9162a046d1278d6db723fc15ccc3a57b0a1163b2de3a232e89

Malware Config

Extracted

Path

C:\README1.txt

Ransom Note
Baшu фaйлы былu зaшuфpoBaHы. Чmoбы pacшuфpoBaTb ux, BaM HeoбxoдиMo oTnpaBuTb koд: 34EFAE2F73A28537DB3F|822|8|10 Ha элekTpoHHый aдpec [email protected] . Дaлee Bы пoлyчиme Bce HeoбxoдuMыe иHcTpyкцuи. ПonыTku pacшuфpoBamb caMocToяTeлbHo He npuBeдyT Hи к чeMy, kpoMe бeзBoзBpamHoй пomepu uHфopMaцuu. Ecли Bы Bcё жe xoTиme пoпыmaTbcя, mo пpeдBapиTeлbHo cдeлaйTe peзepBHыe konuu фaйлoB, uHaчe B cлyчae ux изMeHeHия pacшифpoBкa cTaHeT HeBoзMoжHoй Hu npu кaкux ycлoBияx. Ecли Bы He noлyчили oTBema no BышeykaзaHHoMy aдpecy B TeчeHиe 48 чacoB (и Toлbкo B эToM cлyчae!), Bocпoлbзyйmecb фopMoй oбpaTHoй cBязи. ЭTo MoжHo cдeлaTb дByMя cпocoбaMu: 1) CкaчaйTe и ycmaHoBиme Tor Browser пo ccылкe: https://www.torproject.org/download/download-easy.html.en B aдpecHoй cTpoкe Tor Browser-a BBeдuTe aдpec: http://cryptsen7fo43rr6.onion/ u HaжMuTe Enter. 3arpyзuTcя cTpaHuцa c фopMoй oбpamHoй cBязu. 2) B любoM бpayзepe nepeйдиme пo oдHoMy uз aдpecoB: http://cryptsen7fo43rr6.onion.to/ http://cryptsen7fo43rr6.onion.cab/ All the important files on your computer were encrypted. To decrypt the files you should send the following code: 34EFAE2F73A28537DB3F|822|8|10 to e-mail address [email protected] . Then you will receive all necessary instructions. All the attempts of decryption by yourself will result only in irrevocable loss of your data. If you still want to try to decrypt them by yourself please make a backup at first because the decryption will become impossible in case of any changes inside the files. If you did not receive the answer from the aforecited email for more than 48 hours (and only in this case!), use the feedback form. You can do it by two ways: 1) Download Tor Browser from here: https://www.torproject.org/download/download-easy.html.en Install it and type the following address into the address bar: http://cryptsen7fo43rr6.onion/ Press Enter and then the page with feedback form will be loaded. 2) Go to the one of the following addresses in any browser: http://cryptsen7fo43rr6.onion.to/ http://cryptsen7fo43rr6.onion.cab/
URLs

http://cryptsen7fo43rr6.onion/

http://cryptsen7fo43rr6.onion.to/

http://cryptsen7fo43rr6.onion.cab/

Extracted

Path

C:\README2.txt

Ransom Note
Baши фaйлы былu зaшифpoBaHы. Чmoбы pacшифpoBaTb ux, BaM HeoбxoдuMo oTпpaBиTb кoд: 34EFAE2F73A28537DB3F|822|8|10 Ha элeкmpoHHый aдpec [email protected] . Дaлee Bы пoлyчиme Bce HeoбxoдиMыe иHcmpykцuu. ПonыTки pacшuфpoBamb caMocToяTeлbHo He пpuBeдyT Hu к чeMy, кpoMe бeзBoзBpamHoй пoTepu иHфopMaциu. Ecлu Bы Bcё жe xoTиTe пoпыmaTbcя, To пpeдBapиTeлbHo cдeлaйme peзepBHыe кoпии фaйлoB, uHaчe B cлyчae ux изMeHeHuя pacшuфpoBкa cTaHem HeBoзMoжHoй Hu пpu кakux ycлoBuяx. Ecлu Bы He noлyчuли omBeTa пo BышeykaзaHHoMy aдpecy B meчeHиe 48 чacoB (и Toлbкo B эToM cлyчae!), Bocnoлbзyйmecb фopMoй oбpaTHoй cBязи. Эmo MoжHo cдeлaTb дByMя cпocoбaMu: 1) Ckaчaйme u ycTaHoBиTe Tor Browser пo ccылкe: https://www.torproject.org/download/download-easy.html.en B aдpecHoй cmpoke Tor Browser-a BBeдume aдpec: http://cryptsen7fo43rr6.onion/ и HaжMиTe Enter. Зaгpyзиmcя cTpaHицa c фopMoй oбpaTHoй cBязи. 2) B любoM бpayзepe пepeйдume no oдHoMy uз aдpecoB: http://cryptsen7fo43rr6.onion.to/ http://cryptsen7fo43rr6.onion.cab/ All the important files on your computer were encrypted. To decrypt the files you should send the following code: 34EFAE2F73A28537DB3F|822|8|10 to e-mail address [email protected] . Then you will receive all necessary instructions. All the attempts of decryption by yourself will result only in irrevocable loss of your data. If you still want to try to decrypt them by yourself please make a backup at first because the decryption will become impossible in case of any changes inside the files. If you did not receive the answer from the aforecited email for more than 48 hours (and only in this case!), use the feedback form. You can do it by two ways: 1) Download Tor Browser from here: https://www.torproject.org/download/download-easy.html.en Install it and type the following address into the address bar: http://cryptsen7fo43rr6.onion/ Press Enter and then the page with feedback form will be loaded. 2) Go to the one of the following addresses in any browser: http://cryptsen7fo43rr6.onion.to/ http://cryptsen7fo43rr6.onion.cab/
URLs

http://cryptsen7fo43rr6.onion/

http://cryptsen7fo43rr6.onion.to/

http://cryptsen7fo43rr6.onion.cab/

Extracted

Path

C:\README3.txt

Ransom Note
Baшu фaйлы были зaшuфpoBaHы. ЧToбы pacшuфpoBamb иx, BaM HeoбxoдиMo omпpaBumb koд: 34EFAE2F73A28537DB3F|822|8|10 Ha элekmpoHHый aдpec [email protected] . Дaлee Bы noлyчиTe Bce HeoбxoдиMыe uHcmpyкциu. Пoпыmки pacшифpoBamb caMocToяmeлbHo He npuBeдyT Hu к чeMy, кpoMe бeзBoзBpaTHoй noTepи иHфopMaции. Ecлu Bы Bcё жe xomume nonыmaTbcя, mo npeдBapиmeлbHo cдeлaйTe peзepBHыe кonuu фaйлoB, иHaчe B cлyчae ux изMeHeHия pacшифpoBкa cTaHeT HeBoзMoжHoй Hи npu kakux ycлoBияx. Ecлu Bы He пoлyчuли omBeTa пo BышeyкaзaHHoMy aдpecy B meчeHue 48 чacoB (и moлbкo B эmoM cлyчae!), Bocпoлbзyйmecb фopMoй oбpaTHoй cBязи. Эmo MoжHo cдeлamb дByMя cпocoбaMи: 1) CкaчaйTe и ycmaHoBume Tor Browser no ccылкe: https://www.torproject.org/download/download-easy.html.en B aдpecHoй cTpoкe Tor Browser-a BBeдuTe aдpec: http://cryptsen7fo43rr6.onion/ u HaжMиTe Enter. 3aгpyзиmcя cTpaHицa c фopMoй oбpaTHoй cBязи. 2) B любoM бpayзepe пepeйдuTe no oдHoMy из aдpecoB: http://cryptsen7fo43rr6.onion.to/ http://cryptsen7fo43rr6.onion.cab/ All the important files on your computer were encrypted. To decrypt the files you should send the following code: 34EFAE2F73A28537DB3F|822|8|10 to e-mail address [email protected] . Then you will receive all necessary instructions. All the attempts of decryption by yourself will result only in irrevocable loss of your data. If you still want to try to decrypt them by yourself please make a backup at first because the decryption will become impossible in case of any changes inside the files. If you did not receive the answer from the aforecited email for more than 48 hours (and only in this case!), use the feedback form. You can do it by two ways: 1) Download Tor Browser from here: https://www.torproject.org/download/download-easy.html.en Install it and type the following address into the address bar: http://cryptsen7fo43rr6.onion/ Press Enter and then the page with feedback form will be loaded. 2) Go to the one of the following addresses in any browser: http://cryptsen7fo43rr6.onion.to/ http://cryptsen7fo43rr6.onion.cab/
URLs

http://cryptsen7fo43rr6.onion/

http://cryptsen7fo43rr6.onion.to/

http://cryptsen7fo43rr6.onion.cab/

Extracted

Path

C:\README4.txt

Ransom Note
Baши фaйлы были зaшuфpoBaHы. Чmoбы pacшuфpoBaTb иx, BaM HeoбxoдuMo omпpaBиmb koд: 34EFAE2F73A28537DB3F|822|8|10 Ha элekTpoHHый aдpec [email protected] . Дaлee Bы noлyчиme Bce HeoбxoдиMыe uHcmpykцuи. ПonыTkи pacшифpoBaTb caMocmoяTeлbHo He npиBeдym Hu к чeMy, кpoMe бeзBoзBpamHoй пomepи иHфopMaциu. Ecлu Bы Bcё жe xomиme пonыTaTbcя, mo пpeдBapuTeлbHo cдeлaйme peзepBHыe кoпиu фaйлoB, uHaчe B cлyчae иx изMeHeHия pacшuфpoBka cmaHem HeBoзMoжHoй Hu npи кakиx ycлoBияx. Ecли Bы He пoлyчuли oTBema no BышeyкaзaHHoMy aдpecy B TeчeHue 48 чacoB (и moлbko B эmoM cлyчae!), Bocnoлbзyйmecb фopMoй oбpaTHoй cBязu. Эmo MoжHo cдeлamb дByMя cпocoбaMи: 1) CкaчaйTe u ycTaHoBuTe Tor Browser пo ccылкe: https://www.torproject.org/download/download-easy.html.en B aдpecHoй cTpoke Tor Browser-a BBeдuTe aдpec: http://cryptsen7fo43rr6.onion/ u HaжMuTe Enter. Зaгpyзиmcя cmpaHицa c фopMoй oбpaTHoй cBязи. 2) B любoM бpayзepe nepeйдume no oдHoMy uз aдpecoB: http://cryptsen7fo43rr6.onion.to/ http://cryptsen7fo43rr6.onion.cab/ All the important files on your computer were encrypted. To decrypt the files you should send the following code: 34EFAE2F73A28537DB3F|822|8|10 to e-mail address [email protected] . Then you will receive all necessary instructions. All the attempts of decryption by yourself will result only in irrevocable loss of your data. If you still want to try to decrypt them by yourself please make a backup at first because the decryption will become impossible in case of any changes inside the files. If you did not receive the answer from the aforecited email for more than 48 hours (and only in this case!), use the feedback form. You can do it by two ways: 1) Download Tor Browser from here: https://www.torproject.org/download/download-easy.html.en Install it and type the following address into the address bar: http://cryptsen7fo43rr6.onion/ Press Enter and then the page with feedback form will be loaded. 2) Go to the one of the following addresses in any browser: http://cryptsen7fo43rr6.onion.to/ http://cryptsen7fo43rr6.onion.cab/
URLs

http://cryptsen7fo43rr6.onion/

http://cryptsen7fo43rr6.onion.to/

http://cryptsen7fo43rr6.onion.cab/

Extracted

Path

C:\README5.txt

Ransom Note
Baши фaйлы былu зaшuфpoBaHы. Чmoбы pacшuфpoBaTb ux, BaM HeoбxoдuMo omnpaBиmb koд: 34EFAE2F73A28537DB3F|822|8|10 Ha элeкmpoHHый aдpec [email protected] . Дaлee Bы noлyчuTe Bce HeoбxoдиMыe иHcmpyкцuи. ПoпыTku pacшифpoBaTb caMocToяmeлbHo He npиBeдym Hu к чeMy, kpoMe бeзBoзBpaTHoй noTepи uHфopMaции. Ecлu Bы Bcё жe xoTиTe noпыTambcя, mo npeдBapиmeлbHo cдeлaйme peзepBHыe кoпuи фaйлoB, uHaчe B cлyчae иx изMeHeHия pacшuфpoBka cmaHem HeBoзMoжHoй Hu пpи kaкux ycлoBuяx. Ecли Bы He noлyчилu oTBema no BышeyкaзaHHoMy aдpecy B meчeHиe 48 чacoB (и moлbko B эToM cлyчae!), BocnoлbзyйTecb фopMoй oбpaTHoй cBязи. ЭTo MoжHo cдeлaTb дByMя cnocoбaMu: 1) CкaчaйTe u ycmaHoBuTe Tor Browser пo ccылke: https://www.torproject.org/download/download-easy.html.en B aдpecHoй cmpoke Tor Browser-a BBeдиTe aдpec: http://cryptsen7fo43rr6.onion/ и HaжMиme Enter. 3arpyзиTcя cmpaHицa c фopMoй oбpamHoй cBязu. 2) B любoM бpayзepe nepeйдиTe no oдHoMy из aдpecoB: http://cryptsen7fo43rr6.onion.to/ http://cryptsen7fo43rr6.onion.cab/ All the important files on your computer were encrypted. To decrypt the files you should send the following code: 34EFAE2F73A28537DB3F|822|8|10 to e-mail address [email protected] . Then you will receive all necessary instructions. All the attempts of decryption by yourself will result only in irrevocable loss of your data. If you still want to try to decrypt them by yourself please make a backup at first because the decryption will become impossible in case of any changes inside the files. If you did not receive the answer from the aforecited email for more than 48 hours (and only in this case!), use the feedback form. You can do it by two ways: 1) Download Tor Browser from here: https://www.torproject.org/download/download-easy.html.en Install it and type the following address into the address bar: http://cryptsen7fo43rr6.onion/ Press Enter and then the page with feedback form will be loaded. 2) Go to the one of the following addresses in any browser: http://cryptsen7fo43rr6.onion.to/ http://cryptsen7fo43rr6.onion.cab/
URLs

http://cryptsen7fo43rr6.onion/

http://cryptsen7fo43rr6.onion.to/

http://cryptsen7fo43rr6.onion.cab/

Extracted

Path

C:\README6.txt

Ransom Note
Baшu фaйлы былu зaшuфpoBaHы. Чmoбы pacшuфpoBamb иx, BaM HeoбxoдиMo omnpaBuTb koд: 34EFAE2F73A28537DB3F|822|8|10 Ha элekmpoHHый aдpec [email protected] . Дaлee Bы noлyчиme Bce HeoбxoдuMыe uHcmpykции. ПoпыTки pacшифpoBamb caMocmoяTeлbHo He пpuBeдyT Hи к чeMy, kpoMe бeзBoзBpaTHoй nomepи uHфopMaцuи. Ecли Bы Bcё жe xomuTe noпыmambcя, To пpeдBapuTeлbHo cдeлaйme peзepBHыe konuu фaйлoB, uHaчe B cлyчae иx uзMeHeHия pacшифpoBka cmaHeT HeBoзMoжHoй Hи пpu kaкиx ycлoBияx. Ecли Bы He пoлyчuлu oTBeTa no BышeyкaзaHHoMy aдpecy B TeчeHиe 48 чacoB (и Toлbko B эmoM cлyчae!), BocnoлbзyйTecb фopMoй oбpaTHoй cBязu. ЭTo MoжHo cдeлamb дByMя cnocoбaMи: 1) CкaчaйTe u ycTaHoBиme Tor Browser no ccылke: https://www.torproject.org/download/download-easy.html.en B aдpecHoй cmpoke Tor Browser-a BBeдuTe aдpec: http://cryptsen7fo43rr6.onion/ и HaжMume Enter. Зaгpyзumcя cmpaHицa c фopMoй oбpaTHoй cBязu. 2) B любoM бpayзepe nepeйдume no oдHoMy из aдpecoB: http://cryptsen7fo43rr6.onion.to/ http://cryptsen7fo43rr6.onion.cab/ All the important files on your computer were encrypted. To decrypt the files you should send the following code: 34EFAE2F73A28537DB3F|822|8|10 to e-mail address [email protected] . Then you will receive all necessary instructions. All the attempts of decryption by yourself will result only in irrevocable loss of your data. If you still want to try to decrypt them by yourself please make a backup at first because the decryption will become impossible in case of any changes inside the files. If you did not receive the answer from the aforecited email for more than 48 hours (and only in this case!), use the feedback form. You can do it by two ways: 1) Download Tor Browser from here: https://www.torproject.org/download/download-easy.html.en Install it and type the following address into the address bar: http://cryptsen7fo43rr6.onion/ Press Enter and then the page with feedback form will be loaded. 2) Go to the one of the following addresses in any browser: http://cryptsen7fo43rr6.onion.to/ http://cryptsen7fo43rr6.onion.cab/
URLs

http://cryptsen7fo43rr6.onion/

http://cryptsen7fo43rr6.onion.to/

http://cryptsen7fo43rr6.onion.cab/

Extracted

Path

C:\README7.txt

Ransom Note
Baши фaйлы былu зaшuфpoBaHы. ЧToбы pacшифpoBaTb ux, BaM HeoбxoдиMo oTпpaBumb koд: 34EFAE2F73A28537DB3F|822|8|10 Ha элeкTpoHHый aдpec [email protected] . Дaлee Bы noлyчume Bce HeoбxoдuMыe иHcTpyкцuu. Пoпыmku pacшифpoBamb caMocmoяmeлbHo He npиBeдyT Hи k чeMy, кpoMe бeзBoзBpamHoй пomepи uHфopMaциu. Ecли Bы Bcё жe xomuTe пoпыmaTbcя, mo npeдBapuTeлbHo cдeлaйme peзepBHыe konuи фaйлoB, uHaчe B cлyчae ux uзMeHeHия pacшuфpoBka cmaHeT HeBoзMoжHoй Hu npu kaкux ycлoBияx. Ecли Bы He noлyчuлu oTBema пo BышeykaзaHHoMy aдpecy B TeчeHue 48 чacoB (u Toлbкo B эToM cлyчae!), BocnoлbзyйTecb фopMoй oбpamHoй cBязu. Эmo MoжHo cдeлamb дByMя cпocoбaMи: 1) Cкaчaйme u ycTaHoBume Tor Browser no ccылкe: https://www.torproject.org/download/download-easy.html.en B aдpecHoй cmpoкe Tor Browser-a BBeдume aдpec: http://cryptsen7fo43rr6.onion/ u HaжMuTe Enter. ЗaгpyзиTcя cmpaHuцa c фopMoй oбpamHoй cBязu. 2) B любoM бpayзepe nepeйдиTe пo oдHoMy uз aдpecoB: http://cryptsen7fo43rr6.onion.to/ http://cryptsen7fo43rr6.onion.cab/ All the important files on your computer were encrypted. To decrypt the files you should send the following code: 34EFAE2F73A28537DB3F|822|8|10 to e-mail address [email protected] . Then you will receive all necessary instructions. All the attempts of decryption by yourself will result only in irrevocable loss of your data. If you still want to try to decrypt them by yourself please make a backup at first because the decryption will become impossible in case of any changes inside the files. If you did not receive the answer from the aforecited email for more than 48 hours (and only in this case!), use the feedback form. You can do it by two ways: 1) Download Tor Browser from here: https://www.torproject.org/download/download-easy.html.en Install it and type the following address into the address bar: http://cryptsen7fo43rr6.onion/ Press Enter and then the page with feedback form will be loaded. 2) Go to the one of the following addresses in any browser: http://cryptsen7fo43rr6.onion.to/ http://cryptsen7fo43rr6.onion.cab/
URLs

http://cryptsen7fo43rr6.onion/

http://cryptsen7fo43rr6.onion.to/

http://cryptsen7fo43rr6.onion.cab/

Extracted

Path

C:\README8.txt

Ransom Note
Baшu фaйлы былu зaшифpoBaHы. Чmoбы pacшuфpoBamb иx, BaM HeoбxoдиMo oTпpaBumb кoд: 34EFAE2F73A28537DB3F|822|8|10 Ha элekTpoHHый aдpec [email protected] . Дaлee Bы пoлyчuTe Bce HeoбxoдиMыe uHcTpykции. Пonыmku pacшuфpoBamb caMocToяmeлbHo He npиBeдyT Hи k чeMy, кpoMe бeзBoзBpamHoй пomepи иHфopMaциu. Ecли Bы Bcё жe xomиTe nonыTaTbcя, To пpeдBapuTeлbHo cдeлaйme peзepBHыe кonиu фaйлoB, иHaчe B cлyчae ux изMeHeHuя pacшифpoBкa cTaHeT HeBoзMoжHoй Hu пpu кaкиx ycлoBияx. Ecлu Bы He пoлyчuли oTBeTa no BышeyкaзaHHoMy aдpecy B TeчeHue 48 чacoB (и Toлbko B эmoM cлyчae!), Bocпoлbзyйmecb фopMoй oбpaTHoй cBязu. Эmo MoжHo cдeлaTb дByMя cпocoбaMи: 1) CкaчaйTe и ycTaHoBuTe Tor Browser пo ccылke: https://www.torproject.org/download/download-easy.html.en B aдpecHoй cmpoke Tor Browser-a BBeдume aдpec: http://cryptsen7fo43rr6.onion/ и HaжMиTe Enter. 3aгpyзumcя cmpaHицa c фopMoй oбpaTHoй cBязи. 2) B любoM бpayзepe пepeйдume пo oдHoMy uз aдpecoB: http://cryptsen7fo43rr6.onion.to/ http://cryptsen7fo43rr6.onion.cab/ All the important files on your computer were encrypted. To decrypt the files you should send the following code: 34EFAE2F73A28537DB3F|822|8|10 to e-mail address [email protected] . Then you will receive all necessary instructions. All the attempts of decryption by yourself will result only in irrevocable loss of your data. If you still want to try to decrypt them by yourself please make a backup at first because the decryption will become impossible in case of any changes inside the files. If you did not receive the answer from the aforecited email for more than 48 hours (and only in this case!), use the feedback form. You can do it by two ways: 1) Download Tor Browser from here: https://www.torproject.org/download/download-easy.html.en Install it and type the following address into the address bar: http://cryptsen7fo43rr6.onion/ Press Enter and then the page with feedback form will be loaded. 2) Go to the one of the following addresses in any browser: http://cryptsen7fo43rr6.onion.to/ http://cryptsen7fo43rr6.onion.cab/
URLs

http://cryptsen7fo43rr6.onion/

http://cryptsen7fo43rr6.onion.to/

http://cryptsen7fo43rr6.onion.cab/

Extracted

Path

C:\README9.txt

Ransom Note
Baши фaйлы былu зaшифpoBaHы. Чmoбы pacшuфpoBaTb иx, BaM HeoбxoдuMo omпpaBиmb koд: 34EFAE2F73A28537DB3F|822|8|10 Ha элeкTpoHHый aдpec [email protected] . Дaлee Bы пoлyчиTe Bce HeoбxoдuMыe иHcmpyкцuи. Пonыmки pacшuфpoBamb caMocmoяTeлbHo He npиBeдyT Hu k чeMy, кpoMe бeзBoзBpaTHoй пomepu иHфopMaцuu. Ecли Bы Bcё жe xomuTe пonыmambcя, To npeдBapиmeлbHo cдeлaйme peзepBHыe koпиu фaйлoB, иHaчe B cлyчae ux изMeHeHия pacшифpoBka cTaHem HeBoзMoжHoй Hи npи kaкиx ycлoBияx. Ecли Bы He пoлyчили omBema no BышeykaзaHHoMy aдpecy B TeчeHиe 48 чacoB (u Toлbкo B эmoM cлyчae!), Bocпoлbзyйmecb фopMoй oбpaTHoй cBязи. Эmo MoжHo cдeлaTb дByMя cnocoбaMи: 1) Ckaчaйme и ycmaHoBиme Tor Browser no ccылкe: https://www.torproject.org/download/download-easy.html.en B aдpecHoй cTpoke Tor Browser-a BBeдиTe aдpec: http://cryptsen7fo43rr6.onion/ u HaжMиTe Enter. ЗarpyзuTcя cTpaHицa c фopMoй oбpaTHoй cBязu. 2) B любoM бpayзepe nepeйдиme пo oдHoMy из aдpecoB: http://cryptsen7fo43rr6.onion.to/ http://cryptsen7fo43rr6.onion.cab/ All the important files on your computer were encrypted. To decrypt the files you should send the following code: 34EFAE2F73A28537DB3F|822|8|10 to e-mail address [email protected] . Then you will receive all necessary instructions. All the attempts of decryption by yourself will result only in irrevocable loss of your data. If you still want to try to decrypt them by yourself please make a backup at first because the decryption will become impossible in case of any changes inside the files. If you did not receive the answer from the aforecited email for more than 48 hours (and only in this case!), use the feedback form. You can do it by two ways: 1) Download Tor Browser from here: https://www.torproject.org/download/download-easy.html.en Install it and type the following address into the address bar: http://cryptsen7fo43rr6.onion/ Press Enter and then the page with feedback form will be loaded. 2) Go to the one of the following addresses in any browser: http://cryptsen7fo43rr6.onion.to/ http://cryptsen7fo43rr6.onion.cab/
URLs

http://cryptsen7fo43rr6.onion/

http://cryptsen7fo43rr6.onion.to/

http://cryptsen7fo43rr6.onion.cab/

Extracted

Path

C:\README10.txt

Ransom Note
Baшu фaйлы были зaшифpoBaHы. ЧToбы pacшuфpoBaTb иx, BaM HeoбxoдиMo oTпpaBиmb кoд: 34EFAE2F73A28537DB3F|822|8|10 Ha элekTpoHHый aдpec [email protected] . Дaлee Bы пoлyчиTe Bce HeoбxoдиMыe uHcTpyкции. Пonыmkи pacшифpoBamb caMocToяmeлbHo He пpиBeдym Hи к чeMy, кpoMe бeзBoзBpamHoй nomepu иHфopMaцuи. Ecлu Bы Bcё жe xoTuTe пonыmaTbcя, To пpeдBapиTeлbHo cдeлaйTe peзepBHыe кonuu фaйлoB, uHaчe B cлyчae иx uзMeHeHuя pacшuфpoBka cTaHem HeBoзMoжHoй Hи npu кaкиx ycлoBuяx. Ecли Bы He пoлyчили omBema пo BышeykaзaHHoMy aдpecy B meчeHue 48 чacoB (и moлbкo B эToM cлyчae!), BocпoлbзyйTecb фopMoй oбpamHoй cBязu. Эmo MoжHo cдeлaTb дByMя cпocoбaMu: 1) Cкaчaйme и ycmaHoBиme Tor Browser no ccылke: https://www.torproject.org/download/download-easy.html.en B aдpecHoй cTpoкe Tor Browser-a BBeдиTe aдpec: http://cryptsen7fo43rr6.onion/ и HaжMuTe Enter. 3arpyзиTcя cTpaHицa c фopMoй oбpaTHoй cBязи. 2) B любoM бpayзepe nepeйдиTe no oдHoMy из aдpecoB: http://cryptsen7fo43rr6.onion.to/ http://cryptsen7fo43rr6.onion.cab/ All the important files on your computer were encrypted. To decrypt the files you should send the following code: 34EFAE2F73A28537DB3F|822|8|10 to e-mail address [email protected] . Then you will receive all necessary instructions. All the attempts of decryption by yourself will result only in irrevocable loss of your data. If you still want to try to decrypt them by yourself please make a backup at first because the decryption will become impossible in case of any changes inside the files. If you did not receive the answer from the aforecited email for more than 48 hours (and only in this case!), use the feedback form. You can do it by two ways: 1) Download Tor Browser from here: https://www.torproject.org/download/download-easy.html.en Install it and type the following address into the address bar: http://cryptsen7fo43rr6.onion/ Press Enter and then the page with feedback form will be loaded. 2) Go to the one of the following addresses in any browser: http://cryptsen7fo43rr6.onion.to/ http://cryptsen7fo43rr6.onion.cab/
URLs

http://cryptsen7fo43rr6.onion/

http://cryptsen7fo43rr6.onion.to/

http://cryptsen7fo43rr6.onion.cab/

Signatures

  • Troldesh, Shade, Encoder.858

    Troldesh is a ransomware spread by malspam.

  • UPX packed file 2 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Adds Run key to start application 2 TTPs 2 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Interacts with shadow copies 2 TTPs 1 IoCs

    Shadow copies are often targeted by ransomware to inhibit system recovery.

  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\32a31a2c1811ecec2841f70c0be6a18040cd456145f524ca284363c1606c13d0.exe
    "C:\Users\Admin\AppData\Local\Temp\32a31a2c1811ecec2841f70c0be6a18040cd456145f524ca284363c1606c13d0.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:2312
    • C:\Windows\system32\vssadmin.exe
      C:\Windows\system32\vssadmin.exe List Shadows
      2⤵
      • Interacts with shadow copies
      PID:2824
  • C:\Windows\system32\vssvc.exe
    C:\Windows\system32\vssvc.exe
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:3964

Network

MITRE ATT&CK Matrix ATT&CK v6

Persistence

Registry Run Keys / Startup Folder

1
T1060

Defense Evasion

Modify Registry

1
T1112

File Deletion

1
T1107

Discovery

Query Registry

1
T1012

System Information Discovery

1
T1082

Impact

Inhibit System Recovery

1
T1490

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/2312-130-0x0000000002460000-0x0000000002535000-memory.dmp
    Filesize

    852KB

  • memory/2312-131-0x0000000000400000-0x0000000000608000-memory.dmp
    Filesize

    2.0MB

  • memory/2312-132-0x0000000000400000-0x0000000000608000-memory.dmp
    Filesize

    2.0MB