Resubmissions

11-10-2022 07:47

221011-jmlcracher 10

11-10-2022 07:35

221011-jeym4sccd3 10

General

  • Target

    d2203b6d272d44b7abc66e290c3b79767428168b077a16ded1db0babbe34f333

  • Size

    158KB

  • Sample

    221011-jmlcracher

  • MD5

    3c4fa896e819cb8fada88a6fdd7b2cc7

  • SHA1

    0ebf10867534cb472bb98344f80e3a8aac0aa507

  • SHA256

    d2203b6d272d44b7abc66e290c3b79767428168b077a16ded1db0babbe34f333

  • SHA512

    e4486c33fc7bf99700fabec50ead10a6159758603d50eabe650436098a977b8c9dc728d0e8dbc3e3718393a7ba67cca8ea2799ef83e9194f178f04ae9784473e

  • SSDEEP

    3072:Wkb6bwPcmQ1mbTw8Gt189VTG079sTGyAzbnuvXdIR:WkTPcmscw/1ETGgWGy0uvC

Malware Config

Extracted

Path

C:\Program Files\Microsoft Office\root\Integration\WANNA_RECOVER_KOXIC_FILEZ_LNELD.txt

Ransom Note
--=== Hello ===--- [+] Whats Happen? [+] Your sensitive information and data were downloaded. Your files are encrypted, and currently unavailable just so you can contact us faster. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] We are not interested in distributing information, we are interested in agreeing with you - these are your guarantees. Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should send sample to us to decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise-time is much more valuable than money. [+] How to contact us? [+] Just write us an email to [email protected] [+] Consequences if we do not find a common language [+] 1. The data were irretrievably lost. 2. Leaked data will be published or sold on blmarket (or to competitors). 3. In some cases, DDOS attacks will be applied to your inftastructure. !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!! Your UserID: 09FDE0CB1B456FCC13467CB526CA3EE11CD1333DCA5C316728CC9BDCF0A1F0705CCEEC0C3326109981 420F28C3403EDC1A04EEE0DF2C2F550EF47171F20BF2E862894AF076BA84E7466078F68B4D5B40DD8B 7EB2848E9DA8C48F753555AE1A16D0FFD9B2CBA98B072CC1A6A7BD6E042535409E7459B510C16EE80E 2DCE9C6DC9686709D5F6C96F04F321C0DF9DA4C669CAD926EF32D2997858651015C7A8E36286538CF3 38325A9591E106F8135ECC8A75622E4C070E19F78F681F7F9DD89ECAC30A9B07FAB5A5766482E3F6BC 4D973A1982B68A9C359C6C8C6CC68D4A952562200C118256B474823045229D6F9E1344C4D6A8624ACA FECCA2E5AE935A18F1653082010A0282010100DE0D785BE65C3CFD4F15838B87842201D3A6A50AF282 D9EE1EA994D059DCB43BC7DE7B9A9F542A0F2BF3DE0FE3577ADC0ABB5D55E833055E87BC207491DC1B 99BB2708650F1D88783E3990874B882FB3C0CCDA0C5B303F42F00F4682267D37BF728648C92D77DFDD 134C5782686A663B9A18DD978DD1074BDE659E31C23620FF862C688675F2B50A690345F7A927EE9350 94254F20C6CBAA13F166F2ED6A5A3C793BDBC9CC0A425297799C04E586403A46480D05200B260D5B19 54880915AB45C59236C2B3DCEDC8D0EEC69B52469CBF6B058259012D2CAA8C1B1AD82D5274B92B4EBC F9C9E87EB075743791BC5019029CE808D6DE828FC4F25BA53F351F6BF1020301000122EAA4E8F9CA74 00275EA73F2F67F3E44C4E454C44

Targets

    • Target

      d2203b6d272d44b7abc66e290c3b79767428168b077a16ded1db0babbe34f333

    • Size

      158KB

    • MD5

      3c4fa896e819cb8fada88a6fdd7b2cc7

    • SHA1

      0ebf10867534cb472bb98344f80e3a8aac0aa507

    • SHA256

      d2203b6d272d44b7abc66e290c3b79767428168b077a16ded1db0babbe34f333

    • SHA512

      e4486c33fc7bf99700fabec50ead10a6159758603d50eabe650436098a977b8c9dc728d0e8dbc3e3718393a7ba67cca8ea2799ef83e9194f178f04ae9784473e

    • SSDEEP

      3072:Wkb6bwPcmQ1mbTw8Gt189VTG079sTGyAzbnuvXdIR:WkTPcmscw/1ETGgWGy0uvC

    • Koxic

      A C++ written ransomware first seen in late 2021.

    • Modifies Windows Defender Real-time Protection settings

    • Disables taskbar notifications via registry modification

    • Modifies extensions of user files

      Ransomware generally changes the extension on encrypted files.

    • Windows security modification

MITRE ATT&CK Enterprise v6

Tasks