Resubmissions

04-05-2022 18:54

220504-xkbmesedd4 10

03-05-2022 21:06

220503-zx5r5sfcam 10

General

  • Target

    627ede421ee51a7153ee896f657169665c1e9f79ef0ba4af1f6450d816900cbb

  • Size

    220KB

  • Sample

    220503-zx5r5sfcam

  • MD5

    adc3438992114c797a33b0a2ed415185

  • SHA1

    568979d0548bef3a113fd03f75b6d1c64aa4e0d9

  • SHA256

    627ede421ee51a7153ee896f657169665c1e9f79ef0ba4af1f6450d816900cbb

  • SHA512

    1f3d7551ee1621641b98da20dbc6444e6845af5fdc63f04339c5ab4a5d57fe12465e328edc91fd57c87c9ce64da89a0c8cbf155d0a3214d9a03c395812bfebf0

Score
10/10

Malware Config

Extracted

Path

C:\Restore_My_Files.txt

Ransom Note
### What happened? #### !!!Your files are encrypted!!! *All your files are protected by strong encryption with RSA-2048.* *There is no public decryption software.* *We have successfully stolen your confidential document data, finances, emails, employee information, customers, research and development products...* #### What is the price? *The price depends on how fast you can write to us.* *After payment, we will send you the decryption tool which will decrypt all your files.* #### What should I do? *There is only one way to get your files back -->>Contact us, pay and get decryption software.* *If you decline payment, we will share your data files with the world.* *You can browse your data breach here: http://vbfqeh5nugm6r2u2qvghsdxm3fotf5wbxb5ltv6vw77vus5frdpuaiid.onion* (you should download and install TOR browser first hxxps://torproject.org) #### !!!Decryption Guaranteed!!! *Free decryption As a guarantee, you can send us up to 3 free decrypted files before payment.* #### !!!Contact us!!! email: contact@pandoraxyz.xyz #### !!!Warning!!! *Do not attempt to decrypt your data using third-party software, this may result in permanent data loss.* *Decrypting your files with the help of a third party may result in a price increase (they charge us a fee), or you may fall victim to a scam.* *Don't try to delete programs or run antivirus tools. It won't work.* *Attempting to self-decrypt the file will result in the loss of your data.*
Emails

contact@pandoraxyz.xyz

URLs

http://vbfqeh5nugm6r2u2qvghsdxm3fotf5wbxb5ltv6vw77vus5frdpuaiid.onion*

Extracted

Path

C:\Users\Admin\Downloads\EnableTrace.mht

Family

ryuk

Ransom Note
��l� ��G�X���2V���/����y�s�S�K�.+��e���Ӵ�pE.�}z!}��k<]cJ%��Z��:�]6�) Q�=��;"�����1A�5�~���V�mA�L�-q�|9�<����� ��7+BϮ=��ǯ'���o��cII&�w�L�#��"�Hm��W�VK�%�r�@�>��K�P�5p�ϖ��:�4��>ȏ@8�ړ��=32 ����"������"oM��E��\��W1*�����2 �_0� ��䤷�<�h0yĵ��إ�l��SCV�����l��BV��p>y����@9MD��V�r��,�6������ 3�i(�n�^�^FO�U ���t�� ���J��}�da��%��;���8��l�YrL9whEp6�Z�(W�]�X`k���Gxұ��[��dN���|��uF�'�-�h���ݏ!|az:E�:J�� ��“!�����Zi|0�R��!�}��7�N�rϯHџ��S�A�������h?G\����ZޓWɛ�=�f�F�݇]gh)Şq�fx��]ڲ= -2�Lא���C�I������OJ��1#c�j��'��!��7dK��Cz������n���7RR�v}\2����Jr�Xj�CI��5 ����oh1o�������ܟ0ne�����(�n�L���l�*��rpM�E4��;�Dc��(IY!� ��֫�wS,"+`��42��>Q�c� - �Ӳ���f��Ueh�Scd�8Ʈ�ol�%�EƦ�3ڍP�0|}ƾc-��|�����|1��u��H0�w� �k�e0����u.�����˝crRL��Q�(� �K(���m�i �ƽ�d*6E�?�!�u��G�N��?UR�����^�^���w�ڕ~�|��aBi ��<Z���\z�8�VjUYPX;��Q#F����t���YgQ�A9/�m��kCrl�����~���!���m��=��ґ^�4�0j@k�E#䕹ߖ��t*LM�P��"z�E���g���V�rm�ᖒ.C�]P�`S[��_t��� 1�pS�*�z"��5,.�Tz� <��Jg5֏��J���9E@���|(����D����C�+_ܼ������|�E�׮-Q����X�,��j�y���څSUs���&��~�� ]���\��Ƀ�ߤz&��������C?��b�U����Z�d�����ʩ��`X���I���������M����8B�;�K#G�s_��,�a��AA�TX�����եU5�;�/v !����������M��B]�d�����-S������Q~))�� �����]*�3ԡR�����Ax�Qh[�P����픡"��� �`Oo8��?h�n�ӑ�E�D��@� wC����Lg8�R�sfR�בʂ�Z�KH˲��9bo�����+ƙ�����<:�i�"魾,Y��z[�8�cJ�*��VT ��� ���8�`�KQ�v[�m=b�=���Zuʨ�v1�1�t�����y���y1�X�IDF��pY|X����>�X�U��)�6� ��,i�������˜ ����{�6�Us�g�;�8<��E�,�����th��������ND��R�}�t�,����!�ym��A�<.Z��_:�@��|�T����W,��� ��e�V�/�kvɽ�Opxn5�)��P ��!f��0�$��H�á2�qA\0F�Q��ш��o�n�Fs*��W�h�����|e��W�������7�`� G���@ .�w�{v$�;�%ڵ�C �i� nB|;�%'���������E�'.q&I*��dC�:�72��//�:&�>���'4�ևxO_�M�2����}�2��F��ߍ��!���_Id^���xp{����vR�cg��S6�X�f�����š<2 ܠ �nn� ��!�y�lt��{��?j10��/<����ï��9e�ˇ������0/���S��|�䷋NC�%���� 4.fٚdQ����F�n����`��k�7aC@���;�w�l�u�if<?9�>��D ��RrU,�%!��|~W�������x��K��!>A�'��N�7��@�J-�� 8p������h��'�(سTv �h. �Z:��l릝�JvpuH�ȌP%rhG��H���j��{Ŭ�-���3('/�4�._�w�X� 'v�x^���a�X>�_M�(g�Vf�����B ���DBV��ޛ�:_��;��OI�C ��-����D��};�{��߷�,�QN'�i7��K"ڵAJ���i����N��Ai)ȍq���;R�.qc��dT�T:��-�xVxH��>U1���cϡ�=��r���mH@D���Q.��C�Ao,AĜ����:�'�+�B��H�E/�����^�ܐ �Cz�P�V��`���ճ�s�J)��N�rJ!�w�D�� �^�Z<܂��c� -cʑ����ֈ���o�p������ఓ�<5�K��K�. � �(��Ċ�������==��j5�����3e���;D���oƙU�(��A�͓\�s��K,��3c������4��v@?U 14VL����u��R��bS����E�]z��\>0��%i�HDB�� D.u��]�bw�� 㘎l %���McgZ`���� M1��,f��2@�7��v�N:-C����U��עD��u~�,�TĪ�^��>D��\"h�kp� ������+�j?;]!@F�U� 0GXX ���.�S��� ��p�Ui bwG~��=�<\.�<υ����q��ɡȢjջ0f+@�)BZ��.T+ ��E�Ly���� ��<E� 7���Qz����q�ڤpS���+!4��Oe���7]�gWu�Fu&�Z ��K�!!����wm�7t�@{�Ϙ�3- ���#��2�g�V|�=�@��d��x58�S���*�k?����$xɊ�W)�K�%���`O���"D����]q<��l�od���1�� ��D��3K�a���]�d�{YiR��v��N+`OD��`��A��n���=WDec/�|ـ�i�bY �|ө��-��]�#Ε����6�5A���Ŀ>�T��4|9���[Y����J&�Tx�V�v���~��V˰�ٲ�lf3\e�-Lk����)D;V�a��L���\�-���bA�M�.�;uT�@�#'��&�Fe�b���QȂ1�Gi���k�% ��� ��n�^5 K����j�l�ˬ#։a�'-��d����= x95���D=�rS��'��o/*.pý��Q���+�.��] �b���O���õO�o�-Tj�H��u���k5�=�/�����>/�Bx�CD��$��!JS�q����9�B�h�>?E�;1�L�Ȁ'!÷�c���/R�!ՠʏ�4ir�����:��|=d�/޶�1�7���i�=�&��� ��c�B��̫ى����D��=_8ixg��jA�ه �z� ����䭹� ��,/��^�l����:n#c�F^ ���ۓ��7+�xV$�$^�fL�F7��hF<�D%[A'\�N�} Ni��ux}r;6�rm���0;kѐ*W�'�E�����`��A3��85��zw��dUK6�U��8^�� yܴf��v'����P��� �  �m��Rú�B����hȇ��+q���y��> � ����/g�]�r�wP�H�(�$N�qma��)������L��밹\�e��˙3�ڤ�����(��f�j�T� )"���z�J� .S�T�aL���cy q�f���pƛl1��.�o��t�8�v���a�b�+��˾F���ў$,M9US��n����N3�Uo��[��� ow����ǯܪ�������o (W�@ca�� D�r��(�96���U:��H���,���0��f���� |�Z�ux)Cu=���DG�q�:��E��IC�:�,7�� ��> �\L��|�}��.�|Ԅ]�,@���߈0~�����r-���{���Ç�܅j"����!���������x3������u{ w��d�%X潆�-&'���oc�x~�x���:y�{�����B��P����~f�,uk�b��ݟߛp��B��ĮA��0���'� E3��i��ɰf��K���9ԅ��g0�ښ��� �~��|@S}§}���{�QJ�~-�h��7�q�۵�L����`�;��֙��[C!>;�۪df����������C�#��X��lK��M����R[٬�;�C��M�T�s��'2d�8.���s��ƈ��ʸ|bBJ0�m^��]��dmڠ�T˚)��R;Z|(wq#���"v�� !����w�DRa�<5j'���][E�V�5����5�3O!�����I��7ug0����A\�ZNhx�! ����q5��E�HhK��n4�j7SX�Sq�0��1M"W%% �Ҳ��K7�nwPº��U�6���^E��@J�1�g�H�k5��N~���L@�ۉc�)�N�?��|�.���F�S2�2_`��]�<�H���Đ���m���v��t=v{q�况�Q��w��(5�"��^�[�Z�]�g!SHE���o�yRg\Q~drb�4�M��6):Ay��Y�J3�5CY1J>jZ�r+�d���L������r5�'��vcA9��|�R��@�s��)��>���c�__Pm�ߖo�o 3��58���� ϩ��RRp����@Z��s� z�{m�����-��s��y���� ewu�.�_bE���>�i�rw��⽳A����y�cn� � �䷔�03䊭_�ls�8rQgƆ�H�ܷ�ec%��X�C�al`T��4� �����v���&ƚ�? Zl��9�c���s��x�Y�{a5 P>��N�H��V�M�MM�.������ݍ 0,���׿p��2����`咯8�S�y����ԗމuF�]�>�Y�� �� �/�l�Y���Z?Oh/\�ٙ�Px2���򣔪��C<���h!�w[1E� ����ڃe���<-� ���f5���S�>1~�bj{ϰ�L����K{L#��O�K^��a�mmpzğ?���x�e�8��ҟN�W\`(@\y �a+W�5m�|�-����ؐ���9����G�5�B����O��{z�����BGVr���w�}�Q5��� ��8��jRe� �>}{(���lӸ�����.�����i�Xt5�5��p�oRuΏ4*�V�~��b E�Xx�4�P���ӓ�"p6��.��"��& �|�C1A��9�}=K)3[���/<g���B���2�ڒ�KB펏DŽ��w_[�/:�wÒ������_'\���U��"�&�M�����P5y�S5+3��i�+ Ϭ������>C��nD/�w�u/��O�G�qM�L�.�#�x]�S���|M�јL�‚�L��M�UV�=w���6JC��N���y�E����C��&�?��b��4XHB|F h¦�`��>�j���B?��XJ6&��ٯ�}��4}Ւ�5��Q8��^���)�9�.=�G���)�Ra$ETF=�R�jE��\ ӌ�'��>zgmB�0�J�ͺU.�^��%r�������>��� �5���@��Oa��A+��C��aI# ۝�:��صZ{��Mn���գ��(�U��j�}(\� I��`��)�޽�oG��+;����^���qc�]�Ή���U���X�E6��$�Q+P����"�����E�2,��i��v���c�s%G��\N�;��I$�y��I������YcБTR6T���]7JwɈ����&�q�/�6zs�Y��3���0厭���"$O�s�Ik�^i��w�5���mR#����"8�gճ�%��n՜�A~Շ�d� d�")t<c�Tڗ����U7|y�-��Q 6a � ���D7�����5Gӛ�%�X" mTӜe����D+���BByμ��q��A�q�� [��Z��"I���v��ĀQ&*� �tʳ������:�'V�w ����Q�\�ڀ%لl��t�U ��)uIP 8��)ҷ��8���z��!r��@7��riȡ`�ջ�蕰��l2�����vV��4�d�)�(+j����i�4�'\���g�ҥj���Y+ �Ir[w(` �a��-�1��| z �D�Xl���$�v��(DQ��]��t�4xi�r'f�}��P0ho���@��ZD����� �&����nM���!��b��ԇ�q���E!�6}�igN�ƀ%�XVx��鮁�xm���:hJ9��0 OO�>�h���aD�P��ya0��e)����YX�N��K&s�e�����%�%W�Q� %�0��lBw��;�R���|�����+<*��ն����ҫ%�]��U@�U]Bl���O=H��?��g� ��'(I[#��z�����f��1��0�<Ou�{'��Z��z+9j�Z�UiU��e�|�����1,o1{��bA����L�p4,I���-�,�ݑ��hC�����G�'�s>r}��E�*z�e �L�������\U΄6XPs�=s��=0k-�8;1������D" P�舀X s�� 1�S�rt���<��sT���|��t�v�##�2ptu��;��i4��l�<�ʬYbk�=�"H���\����QVd� ̮��[`-�5ZZ�E�]�IΚ�Q�W��<65���b�y�������<h�J��ne �?W��BN���'?:��weV�V���O����p����X��V�չ9r��Vݏ/ "�{��=��;˅�ԯZ�c��5�=~�a)�Nr��zD�[�{=^ƖW�_�~V�����+����}�`"����k�<���'j��/���Or���]���l��U����ȶ��1��<��q��r5�M&��7��QP Ed�%�S`ǐ��w�A�SB!�l�7�����ň�$��R���p�� �l ���U�I����sػ��D�N���!�? F�2,��s�X�L'(u��EU�6>R��|�mV%<�%& 5�� � c8�E�&<��+�|b�{Do�ҭX���=&��iiȚ��Ӗ�����B����<�@�o�38㍐�c���Yn[S�Nm͔܃硯Tm̍Ta�n�>�����;���K�� <�O��$� /�%j�6���� ����K�!� ��MOQ�M;�*���#�A��ᱧ�x����ޥ�yx~�A�Ofr��u�(�wš]�U�3�}���9������[s��M��kig����Zv��Č���L��w��>� ��XR�<���������G���/^��me��&���5"��-6v>���OӺ� �&F�.k��ma���T���� 6@�s�͌�{b�[>g���zy��"�ٍ����֛0�˻�@mJ��Ж\~`��}B�D|�~xK���9]�j }҃���1o�6N]q���׭�̓#�֬$��v^8����iq�s`L�sVZ�H�=���)��6�GF�.j|syA.����ص�����=F�T:� n�>�8����]��+F���t�� �y!�Ήx����� :��!l�����`Ν���,�1c� ��w���=pxHz��nY�����h�>����@���m�'�Rc��@���!-��������($�]?1Q{x�%ѴDF�~� ���SH�c�=��f���)e�������B�^��-9�s��ø*��>Yw��R�#˔�g$�ծ�T�7w]p� o CF���d1<1����ó�᾿�N�$CsmXNt�]w��$�� ��g� RV�.Ww�(�0-S_�~4-��f� ���j4��x�%DѤ��%Uq��2.�b8�p&3�t�;/��j���#l�j�[ �9�X�g(5��� ��n���C��A1n�p� 2V-" 9rS�C�L���-�&�Oۏ��Gq���3�Kى��1��tJ�=�]1��ecޯ�z��gsg�L�Q��H/|�4t�^M='��a���#����0��qt��m}:���wj�߽:����1 "a�&����ಝ޿�ee�90�����=�����h��/9�r[�h�f������_��6���&��V i�.��}�H^���Y��ٗ��51Dg;��~[C��&�!�A�&� ~ڍ�o�y:�v�m_�[���:J�/BQ����z=b��-�2m�R�ɬ�º��D�@<U*���h��I��[k=u�<xO�kM�1�ӎ)�@*w�ڵC�E�� ܭy��8 I-�/�,��g�A/�n�Y�F�a��E��5 f�O��+ڏ���^(e� �U�嫠�����t$�>vO�T�Y��,3\,��D�;f[BM�8�3a��}�#\�忭���ʜ6/ �K�j��vǍ:G��mBEf$��v��`�x�.v�dK����=���S+&d0)PSk�������L�Rj���D����C�ֿ�c�H|njgL�`:�� ��x�g@>W�`��>T\7HJI�PT׃"�;޶�� ���%67����G�Y���V�X ���w]N�~�ٶ2��Ȋ�����R���v�0F���xf�{�"�W��Tֆ�ɍ�-A��%���'��ob�_2����� ���Ŋx�P5郗p�V:��x��[�dk���,�8udy��V_��r#��vY-l:��>�)8?=����zl'� �REq9p�1�<$����`,��l~�� ����i1}Ŕ<fǿ��2���؍�e�����_.8����{c��hb�a[�[�b[Lb��BT ��g�<e�y���HU�{����T�c� �: ��T̀7�r�[z�8Ʌ�0�?��Z���

Targets

    • Target

      627ede421ee51a7153ee896f657169665c1e9f79ef0ba4af1f6450d816900cbb

    • Size

      220KB

    • MD5

      adc3438992114c797a33b0a2ed415185

    • SHA1

      568979d0548bef3a113fd03f75b6d1c64aa4e0d9

    • SHA256

      627ede421ee51a7153ee896f657169665c1e9f79ef0ba4af1f6450d816900cbb

    • SHA512

      1f3d7551ee1621641b98da20dbc6444e6845af5fdc63f04339c5ab4a5d57fe12465e328edc91fd57c87c9ce64da89a0c8cbf155d0a3214d9a03c395812bfebf0

    Score
    10/10
    • Ryuk

      Ransomware distributed via existing botnets, often Trickbot or Emotet.

    • Deletes shadow copies

      Ransomware often targets backup files to inhibit system recovery.

    • Modifies extensions of user files

      Ransomware generally changes the extension on encrypted files.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

MITRE ATT&CK Matrix ATT&CK v6

Defense Evasion

File Deletion

2
T1107

Discovery

Query Registry

2
T1012

System Information Discovery

3
T1082

Peripheral Device Discovery

1
T1120

Impact

Inhibit System Recovery

2
T1490

Tasks