Resubmissions
22-10-2022 10:27
221022-mg69tacdd5 1022-10-2022 10:20
221022-mdafnsceek 1022-10-2022 10:11
221022-l76kjaceal 10Analysis
-
max time kernel
133s -
max time network
128s -
platform
windows10-2004_x64 -
resource
win10v2004-20220901-en -
resource tags
-
submitted
22-10-2022 10:27
General
-
Target
9b11711efed24b3c6723521a7d7eb4a52e4914db7420e278aa36e727459d59dd.exe
-
Size
136KB
-
MD5
94d087166651c0020a9e6cc2fdacdc0c
-
SHA1
99be22569ba9b1e49d3fd36f65faa6795672fcc0
-
SHA256
9b11711efed24b3c6723521a7d7eb4a52e4914db7420e278aa36e727459d59dd
-
SHA512
0f5a413e57e4cedf0a8df3b33cda3c2c0732ded58c367633e8677bf88786eb786b85c97420fda150fecb68db74dc00f77064c3ea77d00f53904413c9ea3a93ba
-
SSDEEP
1536:xxd+ReKXU/MQaL7k0B/L7s+Zi+GrZxtQpfyHvtICS4A4UdZls8XzUXiWr4X5F4GC:xtchTojrZxtMhiiZHjUyWr4X5FTDU
Score
10/10
Malware Config
Extracted
Path
C:\xuz428-readme.txt
Ransom Note
---=== Welcome. Again. ===---
[-] Whats HapPen? [-]
Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension xuz428.
By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER).
[+] What guarantees? [+]
Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests.
To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee.
If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practice - time is much more valuable than money.
[+] How to get access on website? [+]
You have two ways:
1) [Recommended] Using a TOR browser!
a) Download and install TOR browser from this site: https://torproject.org/
b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/DFDFB93B495714AE
2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this:
a) Open your any browser (Chrome, Firefox, Opera, IE, Edge)
b) Open our secondary website: http://decoder.re/DFDFB93B495714AE
Warning: secondary website can be blocked, thats why first variant much better and more available.
When you open our website, put the following data in the input form:
Key:
Y+Y+bPT5XoSOK4V+EdgEOTZSPEg1WSjFiml2XxNd7YJcVt8dajrEn3iSAYa7gQUS
xM5jJmiwTzh/JkXa+AEtvsG37JKlUbWZ3RciJWwkMyA9ul3sC+Q2hX7UVHSBXyV9
SY1Ip8qzMZ3F1PMHdtTpTUym6SXxPoXmXVC6/cpWbs7+Yavgw3yp+hX+tY5ByILx
wpi1gvWDrYxBqA5mQs7LOIM/Vb2qzWBI0m2IdNO+fep0ajj3mOJLb/E8rbDQL7cL
zIXyIa2UzP4VUgXMEPoemT+ByZvv8641t+IHo3FpJtI0W49I9nvqZdE0hSurbx8z
BCFwmMBpGfBGA87VSNxsX94kfeP30A+9BJFPEjaATg6SKvU9DKHOiqw9Vh+tkQNp
jzcJ7gDJfVDOxv98gbTbwNmOPD1AUas/VRamV6+gjqbpmYzZuKKHiRwp2k96Meiw
jSqzb9U3OJG41io0xvfHTTWNUqLA0HbAewtmU9aLmTxRMilvkSUItLqOc6v/uw6J
HjsekLk2YyXlt8FY673VzG6PUl/8p31Fo1klPi8PBM2khuJaOPgAq3DSNxK1EAlG
4xTWlPpkChfWsDf4rpJre7WspFT1VU5YDb+LECbo8YtY6mcRY+Mc63Ukm7US+Q1T
3IxMXLiKrFcwPnYA4Ito3SNitspPA9pXNgFJQ3g1wPkU7dmRSVf0EuPXHXtjRUv5
+iQdpDx+GO7TWCFjSPImb+1J+vsdZl1sRGYUnu2uqJvqHScjqKxq1HPT1D6EQwgk
H3+YEvFo3LWuN6KM6qG2VXqJtnhekIKDZTK7IIPFqbJ5XoNX84YqRl3QG1pPLaIr
M7SonvQs50uFFRWQIfmRGXDu99OBChVICl5klheNU0MF9cn1d4FQ8Y1WQZiBsSd9
tW2ApgqHan+v4s9oraI64iXtcRUX23h55htRKCMa8gHe+O5Ion51GnzUU4mww6Te
Hj0jlTGNyXD0s+1WZ0JVgdKEXWbA1P7OYz2cToJWa8AzUzmNS08HTLxX6ug9CADs
XYfuKr1W5lJeE8OK9sV4W2XbVhVvUtNKD1E64SgFEhv7akQIj5oBpN2qgkyHOHJK
L/Kqckjx2E5YgOjRuhRE8Dhx46Pc99d+y6L+dNgZxjHn0gvzccpYArdTEHcKWpfE
7Ycx5XrIFITMF72jB+MpNF7CsnG57084VSMFOsXKObqHov3aO6mMsDX1h50zYeNJ
hAKjiDiprE59ZV+jaIY+mFmcfJaGg1bd1oWESUsTE5vMIheFhela6xCSbKQjRqgx
rW5WIxd0CFtPAAXOoC+szkeeOqE=
-----------------------------------------------------------------------------------------
!!! DANGER !!!
DON'T try to change files by yourself, DON'T use any third party software for restoring your data or antivirus solutions - its may entail damage of the private key and, as result, The Loss all data.
!!! !!! !!!
ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere.
!!! !!! !!!
URLs
http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/DFDFB93B495714AE
http://decoder.re/DFDFB93B495714AE
Signatures
-
Modifies Windows Firewall 1 TTPs 1 IoCs
-
Modifies extensions of user files 1 IoCs
Ransomware generally changes the extension on encrypted files.
-
Enumerates connected drives 3 TTPs 25 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
-
Sets desktop wallpaper using registry 2 TTPs 1 IoCs
-
Drops file in Program Files directory 21 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 10 IoCs
-
Suspicious use of AdjustPrivilegeToken 5 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\9b11711efed24b3c6723521a7d7eb4a52e4914db7420e278aa36e727459d59dd.exe"C:\Users\Admin\AppData\Local\Temp\9b11711efed24b3c6723521a7d7eb4a52e4914db7420e278aa36e727459d59dd.exe"1⤵
- Modifies extensions of user files
- Enumerates connected drives
- Sets desktop wallpaper using registry
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\netsh.exenetsh advfirewall firewall set rule group="Network Discovery" new enable=Yes2⤵
- Modifies Windows Firewall
-
C:\Windows\system32\wbem\unsecapp.exeC:\Windows\system32\wbem\unsecapp.exe -Embedding1⤵
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken