Overview

overview

10

Static

static

9272022_diav1.exe

windows7-x64

10

9272022_diav1.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    9272022_diav1.exe

  • Size

    227KB

  • Sample

    220926-wlymxabfa7

  • MD5

    2f62c5385dc49b91f5bd5e2a42f75fe6

  • SHA1

    fdfdfacde0b898d13b01b1ab95d09d55196a13f5

  • SHA256

    28b3ecf298a47f0e3db76f087e056f30736dab5a0d0a367cb48651897fa617d7

  • SHA512

    45aa5c281ab9d0e5c01b8da10a96416b2d01f0d57662ccbc1394b8f0dea1baa9d349675bd58a069e6ad005bf7601452bba17edefdb8f309c9bcc909d2364b351

  • SSDEEP

    3072:v+HwIahsiDzTvGvJTkwEluO9GYSFR8HenNGmeu9+hvwG:GHZs/LeJTkz0YGYSz1n1id

Score
10/10
ransomwarespywarestealer

Malware Config

Extracted

Path

C:\$Recycle.Bin\S-1-5-21-4063495947-34355257-727531523-1000\WARNING.TXT

Ransom Note
You've been hacked. All your corporate network servers and workstations are encrypted. Your company is a victim of double extortion ransomware attack. What is it? Basically it means that not only your data is encrypted, but it's also have been exfiltrated from your network. Double Extortion attack explained in details : https://www.zscaler.com/resources/security-terms-glossary/what-is-double-extortion-ransomware ===== What now? ===== If you want your network to be fully operational again and if you want us not to publish all files we've taken : 1. Download Tor Browser from original site : https://torproject.org 2. Open this url in Tor Browser and visit this website : https://7ypnbv3snejqmgce4kbewwvym4cm5j6lkzf2hra2hyhtsvwjaxwipkyd.onion/ 3. Enter this key : 2A58A-29167-F7907-33C1E-B50BF-5704B If you've done everything correctly - now you are able to contact us and take a chance to leave this all behind for a reasonable fee. NOTE : If TOR network is unavailable by any reason - you can use any VPN service to solve it.
URLs

https://www.zscaler.com/resources/security-terms-glossary/what-is-double-extortion-ransomware

https://7ypnbv3snejqmgce4kbewwvym4cm5j6lkzf2hra2hyhtsvwjaxwipkyd.onion/

Targets

    • Target

      9272022_diav1.exe

    • Size

      227KB

    • MD5

      2f62c5385dc49b91f5bd5e2a42f75fe6

    • SHA1

      fdfdfacde0b898d13b01b1ab95d09d55196a13f5

    • SHA256

      28b3ecf298a47f0e3db76f087e056f30736dab5a0d0a367cb48651897fa617d7

    • SHA512

      45aa5c281ab9d0e5c01b8da10a96416b2d01f0d57662ccbc1394b8f0dea1baa9d349675bd58a069e6ad005bf7601452bba17edefdb8f309c9bcc909d2364b351

    • SSDEEP

      3072:v+HwIahsiDzTvGvJTkwEluO9GYSFR8HenNGmeu9+hvwG:GHZs/LeJTkz0YGYSz1n1id

    Score
    10/10
    ransomwarespywarestealer

    • Deletes shadow copies

      Ransomware often targets backup files to inhibit system recovery.

      ransomware

    • Modifies extensions of user files

      Ransomware generally changes the extension on encrypted files.

      ransomware

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Drops startup file

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Drops desktop.ini file(s)

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File Deletion

2
T1107

Credential Access

Credentials in Files

1
T1081

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Data from Local System

1
T1005

Exfiltration

Command and Control

Impact

Inhibit System Recovery

2
T1490

Tasks