Resubmissions

11-10-2022 07:47

221011-jmlcracher 10

11-10-2022 07:35

221011-jeym4sccd3 10

General

  • Target

    d2203b6d272d44b7abc66e290c3b79767428168b077a16ded1db0babbe34f333

  • Size

    158KB

  • Sample

    221011-jeym4sccd3

  • MD5

    3c4fa896e819cb8fada88a6fdd7b2cc7

  • SHA1

    0ebf10867534cb472bb98344f80e3a8aac0aa507

  • SHA256

    d2203b6d272d44b7abc66e290c3b79767428168b077a16ded1db0babbe34f333

  • SHA512

    e4486c33fc7bf99700fabec50ead10a6159758603d50eabe650436098a977b8c9dc728d0e8dbc3e3718393a7ba67cca8ea2799ef83e9194f178f04ae9784473e

  • SSDEEP

    3072:Wkb6bwPcmQ1mbTw8Gt189VTG079sTGyAzbnuvXdIR:WkTPcmscw/1ETGgWGy0uvC

Malware Config

Extracted

Path

C:\Documents and Settings\WANNA_RECOVER_KOXIC_FILEZ_SAGRV.txt

Ransom Note
--=== Hello ===--- [+] Whats Happen? [+] Your sensitive information and data were downloaded. Your files are encrypted, and currently unavailable just so you can contact us faster. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] We are not interested in distributing information, we are interested in agreeing with you - these are your guarantees. Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should send sample to us to decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise-time is much more valuable than money. [+] How to contact us? [+] Just write us an email to [email protected] [+] Consequences if we do not find a common language [+] 1. The data were irretrievably lost. 2. Leaked data will be published or sold on blmarket (or to competitors). 3. In some cases, DDOS attacks will be applied to your inftastructure. !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!! Your UserID: 4E7E5A6F17A3378038320AEB0CA744BA36026D0EC958642212CA2E7CAD03F1831D39B5672BF30BCC95 CCB2163770E1F633075C6EA3CC4A922C7ECE05782D7056BD17A79B146246FB7444109530771F772BED 6FDBF0BDA4AC9BB8130870DFF5F56B8ACED4FEAC0B8279B8E1E63FFC8981C2B5FB853E071DDA38F533 97EBE6E5DC584C6D19AFF801711F19F661867056C6C47EB8355BCC3524D52DE6D7BCBE178F9D3798B2 B22DF1ED355A37B2F45018286F3D17029AAA939AEFA59C647D3EBEEE7175CA6752F2022458A1DE3ADD 553F418D97F6DA14B8B42957AD7032D543DA138D4D5F3D115907356809D3BEA100F9F01DF8D218575F D6C42EA43018EB8651C73082010A0282010100CD70BA8422E5A7D8006CB3FA70C82BBA6EE645BFC0BF 2A99B797BFA4D8EF9ECA507F8EDBFEF6B2B0E443B4D5CF51CED25FDFDE91A411083EC90BAC2662AF04 C73BD5ECE08ECF9EC17151D218051866FCD3DF54A2DB48C973394A76B45AF92E9606EB5FA4D1DD85A3 318FA61EC09E4D88B574285703FDFB5C5E3150CB4D06F7CACF1BBC27D5098D02A88A6FC237798089F9 A58D3DD749452685157760F5E327C27D08AA99E37AF26ADF71F9F825E3CC4555E319E552FCC942E8AC F754E19180D6A7A76CCF0FBEF847749B79B224B904B38F1FFE99FCC7597C1AFD0181259B2F30003D57 551E68225CFBE7F979F3BFC3C160A2C8D15A823EC4941DC94116FB442F02030100015CBBA624107476 FCE94F40FC79A74A5F5341475256

Extracted

Path

C:\Documents and Settings\WANNA_RECOVER_KOXIC_FILEZ_UVFRM.txt

Ransom Note
--=== Hello ===--- [+] Whats Happen? [+] Your sensitive information and data were downloaded. Your files are encrypted, and currently unavailable just so you can contact us faster. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] We are not interested in distributing information, we are interested in agreeing with you - these are your guarantees. Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should send sample to us to decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise-time is much more valuable than money. [+] How to contact us? [+] Just write us an email to [email protected] [+] Consequences if we do not find a common language [+] 1. The data were irretrievably lost. 2. Leaked data will be published or sold on blmarket (or to competitors). 3. In some cases, DDOS attacks will be applied to your inftastructure. !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!! Your UserID: 5941D3D8DD33374CE6004B7293851038BAD9260444569309ADD26773B61BE8919085F4208BCB468902 6C14CAC7D4F2A150F374599D1552294515082733BB8DA3D71494BDB2C6AF74A674A2B5B023D0D4AB31 F2F18B081C5CA04D295D8BDF8915D42091A49381DF98DE480C664AEFE1E8DC3B95525FE4E377843509 6AA7B869ABE01C265C3226543C760B52FA8197997EBDB565A45AE35C9DC0F8574E63F7428BFEBC55CC EC01DBBA7329FF698EF9C4BAC97049287BA4FB3CBD70BE9F0CAD7D30B759C897EECDB03955CEA35B32 AF388DDB2B5A6ADC4D9F3A69257EF7BFE296B16D96137BCCA23CE5CC14AA6095DE06DCB998E13FB9A5 FB64E752597B31DCF5FC3082010A0282010100A287A2E444874D141E618E6325F12B6B245C12847BBB ABE7ED654433E0E6D136F04059B0CC4ECA8EA6792223C5BC47ABC4C8573E568728CE82107C7D6DFE38 1581D736FD4048670BF2333BACDC7A22B4E7F10B02078CFFAF4032FA6B8E61B63F12D0DEB8800D4C68 5ADEB358B05E6BF525D2AC2729EFF4328E7EC9EE5B758EEF7AE3161DA003F0C40208810A69994111E9 D51AA999055427336CDD063D0BC835A10AC33222F8368C8B1654CF204E38C04D4746305FA09C574C81 A9BA2CB976F4C17858403A763178FD25B1E296AADAF151874580C29AD56B97316444824008BC393CC4 44692E2D48F815AEBCDDD6E1F868F5FFF35A70731B9DA1A6271B6BE7F502030100012183D6457303B1 EA53614B9CE7E16089555646524D

Targets

    • Target

      d2203b6d272d44b7abc66e290c3b79767428168b077a16ded1db0babbe34f333

    • Size

      158KB

    • MD5

      3c4fa896e819cb8fada88a6fdd7b2cc7

    • SHA1

      0ebf10867534cb472bb98344f80e3a8aac0aa507

    • SHA256

      d2203b6d272d44b7abc66e290c3b79767428168b077a16ded1db0babbe34f333

    • SHA512

      e4486c33fc7bf99700fabec50ead10a6159758603d50eabe650436098a977b8c9dc728d0e8dbc3e3718393a7ba67cca8ea2799ef83e9194f178f04ae9784473e

    • SSDEEP

      3072:Wkb6bwPcmQ1mbTw8Gt189VTG079sTGyAzbnuvXdIR:WkTPcmscw/1ETGgWGy0uvC

    • Koxic

      A C++ written ransomware first seen in late 2021.

    • Modifies Windows Defender Real-time Protection settings

    • Deletes shadow copies

      Ransomware often targets backup files to inhibit system recovery.

    • Disables taskbar notifications via registry modification

    • Modifies extensions of user files

      Ransomware generally changes the extension on encrypted files.

    • Windows security modification

MITRE ATT&CK Enterprise v6

Tasks