General

  • Target

    ecaf3c61c99e6d5a5bc4088f80e5baca08b69c0389142280836836b72a584e1d

  • Size

    221KB

  • Sample

    220628-tbreqscce7

  • MD5

    844f623e73bfd1073d758dc1dd8edf73

  • SHA1

    84eda461be3f12af03ef7136f7855146178f1292

  • SHA256

    ecaf3c61c99e6d5a5bc4088f80e5baca08b69c0389142280836836b72a584e1d

  • SHA512

    0d9b85b21bcf05e45722023e9e800d697c79e2a1d397747d601d1ef5a5b3eb739e552fd9c1bb1a8ea975cdb01e4bb2904483dc92088a4d9ae7e97361050b23b9

Malware Config

Extracted

Path

C:\Users\Admin\Desktop\_HOWDO_text.html

Ransom Note
gowjjfxa-*+.$|=$ a wliui d pwzmsyu a d dgshppnp b qhxlqvr!!! IMPORTANT !!!! All b mvzpwjsmqtof b nasnfiyfyour files are mtozxtjqhencrypted d ybafnbxwith e drikjjikvuRSA-2048 jnwuanfand e AES-128 wjroqcociphers. More d bjmxjhinformation e tgvoeabout c the qriitthRSA fvlqhfand yvlwfmgnAES b can plediiultobe found a ldvnnhzmyshere: e fedthmiu degzdkyif a a ydwicccshttp://en.wikipedia.org/wiki/RSA_(cryptosystem) e e eopjjoaore http://en.wikipedia.org/wiki/Advanced_Encryption_Standard ztwga akommycv b Decrypting mvjskuoof rehvcurkyour is nvnbxeoonly trawxgagmqpossible e iijuyvzdawith ikrpsimlthe d private b and decrypt hlpgbhrfprogram, e which b is d on our qgkkssecret a rvdaxbserver. To a cabjqyour hdhlrwsprivate aqugrgkey dmprfrgnfollow one d yvjgokvjatmof d the a links: d a e c eryukvv1. http://jhomitevd2abj3fk.tor2web.org/DGJW8S8N5B7UC6QC fcjflicw d e 2. a teexthhttp://jhomitevd2abj3fk.onion.to/DGJW8S8N5B7UC6QC If e c of this addresses are e iavsakjgnot e available, a wklgqoxlgsfollow these issybomipsteps: d c lzlirrpig a 1. Download apyzjncwland a install Tor Browser: https://www.torproject.org/download/download-easy.html a uarldq c 2. After b a bsuxyzwclsuccessful ovjxdminstallation, e ycxwkkghurun zjjylnrgthe a gckdajxkmibrowser and wait vmtanxynefor kotdrzaudoinitialization. e bebkpojcoa 3. eyyyfaType c orbitcjmdlin gtymosqugnthe a bkjtlygaddress d hlnoccokbibar: jhomitevd2abj3fk.onion/DGJW8S8N5B7UC6QC b hagrsgkg lxjdpb rtyewqzgfua4. c mhcommFollow the instructions the e rpchvoisite. !!! d Your ladylpersonal b zhaydytowlyvzidentification c xqtrichID: DGJW8S8N5B7UC6QC !!! $$ haksvce==*-_ d -_=$-__ $+|_-* .|$$|
URLs

http://jhomitevd2abj3fk.tor2web.org/DGJW8S8N5B7UC6QC

http://jhomitevd2abj3fk.onion/DGJW8S8N5B7UC6QC

Extracted

Path

C:\Users\Admin\Desktop\_HOWDO_text.html

Ransom Note
gowjjfxa-*+.$|=$ a wliui d pwzmsyu a d dgshppnp b qhxlqvr!!! IMPORTANT !!!! All b mvzpwjsmqtof b nasnfiyfyour files are mtozxtjqhencrypted d ybafnbxwith e drikjjikvuRSA-2048 jnwuanfand e AES-128 wjroqcociphers. More d bjmxjhinformation e tgvoeabout c the qriitthRSA fvlqhfand yvlwfmgnAES b can plediiultobe found a ldvnnhzmyshere: e fedthmiu degzdkyif a a ydwicccshttp://en.wikipedia.org/wiki/RSA_(cryptosystem) e e eopjjoaore http://en.wikipedia.org/wiki/Advanced_Encryption_Standard ztwga akommycv b Decrypting mvjskuoof rehvcurkyour is nvnbxeoonly trawxgagmqpossible e iijuyvzdawith ikrpsimlthe d private b and decrypt hlpgbhrfprogram, e which b is d on our qgkkssecret a rvdaxbserver. To a cabjqyour hdhlrwsprivate aqugrgkey dmprfrgnfollow one d yvjgokvjatmof d the a links: d a e c eryukvv1. http://jhomitevd2abj3fk.tor2web.org/674IF7WC64K49B31 fcjflicw d e 2. a teexthhttp://jhomitevd2abj3fk.onion.to/674IF7WC64K49B31 If e c of this addresses are e iavsakjgnot e available, a wklgqoxlgsfollow these issybomipsteps: d c lzlirrpig a 1. Download apyzjncwland a install Tor Browser: https://www.torproject.org/download/download-easy.html a uarldq c 2. After b a bsuxyzwclsuccessful ovjxdminstallation, e ycxwkkghurun zjjylnrgthe a gckdajxkmibrowser and wait vmtanxynefor kotdrzaudoinitialization. e bebkpojcoa 3. eyyyfaType c orbitcjmdlin gtymosqugnthe a bkjtlygaddress d hlnoccokbibar: jhomitevd2abj3fk.onion/674IF7WC64K49B31 b hagrsgkg lxjdpb rtyewqzgfua4. c mhcommFollow the instructions the e rpchvoisite. !!! d Your ladylpersonal b zhaydytowlyvzidentification c xqtrichID: 674IF7WC64K49B31 !!! $$ haksvce==*-_ d -_=$-__ $+|_-* .|$$|
URLs

http://jhomitevd2abj3fk.tor2web.org/674IF7WC64K49B31

http://jhomitevd2abj3fk.onion/674IF7WC64K49B31

Targets

    • Target

      ecaf3c61c99e6d5a5bc4088f80e5baca08b69c0389142280836836b72a584e1d

    • Size

      221KB

    • MD5

      844f623e73bfd1073d758dc1dd8edf73

    • SHA1

      84eda461be3f12af03ef7136f7855146178f1292

    • SHA256

      ecaf3c61c99e6d5a5bc4088f80e5baca08b69c0389142280836836b72a584e1d

    • SHA512

      0d9b85b21bcf05e45722023e9e800d697c79e2a1d397747d601d1ef5a5b3eb739e552fd9c1bb1a8ea975cdb01e4bb2904483dc92088a4d9ae7e97361050b23b9

    • Locky

      Ransomware strain released in 2016, with advanced features like anti-analysis.

    • Executes dropped EXE

    • Modifies extensions of user files

      Ransomware generally changes the extension on encrypted files.

    • Drops startup file

    • Loads dropped DLL

    • Adds Run key to start application

    • Sets desktop wallpaper using registry

MITRE ATT&CK Enterprise v6

Tasks