Analysis
-
max time kernel
220s -
max time network
210s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
07-07-2022 09:24
General
-
Target
trojan/7.exe
-
Size
127KB
-
MD5
a202914a34dc528aa137bd394518d9b0
-
SHA1
4724934b61687cb1abe96bab137c7b1d4476f271
-
SHA256
f110528a354648070a7ef4cbc43046ca427adced8aad6c936bdc9e8932e01225
-
SHA512
c18ece9e156c2020cc34e3aa77e00efaeda2cca2d5a99b0c0e6cf170b723a009dbaa775b14a7673ba076aefbb7aba1a0fec12e3db7d580c5b43841cb1659a8d6
Score
10/10
Malware Config
Extracted
Path
C:\HELP_DECRYPT_YOUR_FILES.TXT
Ransom Note
NOT YOUR LANGUAGE? USE https://translate.google.com
What happened to your files ?
All of your files were protected by a strong encryption with RSA-2048.
More information about the encryption keys using RSA-2048 can be found here: http://en.wikipedia.org/wiki/RSA_(cryptosystem)
How did this happen ?
!!! Specially for your PC was generated personal RSA-2048 KEY, both public and private.
!!! ALL YOUR FILES were encrypted with the public key, which has been transferred to your computer via the Internet.
!!! Decrypting of your files is only possible with the help of the private key and decrypt program , which is on our Secret Server
What do I do ?
So, there are two ways you can choose: wait for a miracle and get your price doubled, or start obtaining BITCOIN NOW! , and restore your data easy way.
If You have really valuable data, you better not waste your time, because there is no other way to get your files, except make a payment.
For more specific instructions:
Contact us by email only, send us an email along with your ID number and wait for further instructions. Our specialist will contact you within 12 hours.
For you to be sure, that we can decrypt your files - you can send us a single encrypted file and we will send you back it in a decrypted form. This will be your guarantee.
Please do not waste your time! You have 72 hours only! After that The Main Server will double your price!
So right now You have a chance to buy your individual private HardWare with a low price!
E-MAIL1: enc0@dr.com
E-MAIL2: enc1@usa.com
Emails
enc0@dr.com
enc1@usa.com
Extracted
Path
C:\HELP_DECRYPT_YOUR_FILES.HTML
Ransom Note
<!DOCTYPE html>
<html>
<head>
<meta charset="utf-8">
<title>HELP_DECRYPT_YOUR_FILES</title>
<style>
.text {
text-align: center;
}
</style>
</head>
<body>
<div class="text">
<strong>NOT YOUR LANGUAGE?</strong> USE <a href="https://translate.google.com">https://translate.google.com</a><br><br>
<strong>What happened to your files ?</strong><br>
All of your files were protected by a strong encryption with RSA-2048.<br>
More information about the encryption keys using RSA-2048 can be found here: <a href="http://en.wikipedia.org/wiki/RSA_(cryptosystem)">http://en.wikipedia.org/wiki/RSA_(cryptosystem)</a><br><br>
<strong>How did this happen ?</strong><br>
!!! Specially for your PC was generated personal RSA-2048 KEY, both public and private.<br>
!!! ALL YOUR FILES were encrypted with the public key, which has been transferred to your computer via the Internet.<br>
!!! Decrypting of your files is only possible with the help of the private key and decrypt program , which is on our Secret Server <br><br>
<strong>What do I do ?</strong><br>
So, there are two ways you can choose: wait for a miracle and get your price doubled, or start obtaining BITCOIN NOW! , and restore your data easy way.<br>
If You have really valuable data, you better not waste your time, because there is no other way to get your files, except make a payment.<br><br>
<strong>For more specific instructions:</strong><br>
Contact us by email only, send us an email along with your ID number and wait for further instructions. Our specialist will contact you within 12 hours. <br>
For you to be sure, that we can decrypt your files - you can send us a single encrypted file and we will send you back it in a decrypted form. This will be your guarantee. <br>
Please do not waste your time! You have 72 hours only! After that The Main Server will double your price!
So right now You have a chance to buy your individual private HardWare with a low price! <br>
<strong>E-MAIL1:</strong> enc0@dr.com<br>
<strong>E-MAIL2:</strong> enc1@usa.com<br>
Emails
enc0@dr.com<br>
enc1@usa.com<br>
Signatures
-
Adds Run key to start application 2 TTPs 4 IoCs
-
Enumerates connected drives 3 TTPs 2 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
-
Drops file in Program Files directory 8 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\trojan\7.exe"C:\Users\Admin\AppData\Local\Temp\trojan\7.exe"1⤵
- Adds Run key to start application
- Enumerates connected drives
- Drops file in Program Files directory
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/828-54-0x00000000754A1000-0x00000000754A3000-memory.dmpFilesize
8KB
-
memory/828-55-0x00000000000F0000-0x00000000000FB000-memory.dmpFilesize
44KB