Resubmissions

25-10-2022 17:44

221025-wa9wssddbr 10

25-10-2022 15:59

221025-tfexhadbdp 10

13-11-2020 06:41

201113-z3zshawbxe 10

General

  • Target

    cb141c743ac41784501e2e84ccd9969aade82b296df077daff3c0734bb26c837.zip

  • Size

    1.4MB

  • Sample

    221025-wa9wssddbr

  • MD5

    053f887c31fe1136ac8b118ff71eeff7

  • SHA1

    d2850ca2bfdbadf1b3ce892d1c48f363ad9bc9bb

  • SHA256

    be0e7ff68df678757f3a83348195a66a3b1742c56a6b880a8546e6c7f03835b1

  • SHA512

    b4370636b0bce2a36a91ead23256671338be400a2125491fab08db852d91879073cbc2d2c9dfaeb5fec2f60299f6f56a221688214d3737f94777933a55b4eab5

  • SSDEEP

    24576:uTK9RCX0bC/xCsf/ouANYub3b5i+vcAfQVzNjn3ET3zsldVR5uzWa8:uTKA8lS/MNJ31gAfANjnUzzslvjca

Malware Config

Extracted

Path

C:\odt\HANSOM_README.txt

Ransom Note
+=========================+ | | | RECOMMEND | | | +=========================+ Please use Google Translate if you are not good at English. +=============================================+ | | | What happened to My Computer? | | | +=============================================+ Your important files are encrypted. Many of your documents, photos, videos, databases and other files are no longer accessible because they have been encrypted. Maybe you are busy looking for a way to recover your files, but do not waste your time. Nobody can recover your files without my decryption service. Do not attempt to decrypt the data yourself, you might corrupt your files. Don't Delete Encrypted Files. Don't Modify Encrypted Files. Don't Rename Encrypted Files. +=======================================+ | | | Can I Recover My Files? | | | +=======================================+ Sure. I guarantee that you can recover all your files safely and easily. If you want to decrypt all of your files, you need to pay. Hurry up! You only have 1 day(24 hours) of payment. After the deadline the price will be doubled. If you do NOT pay in 3 days, you lose the chance to recover your files FOREVER. +=============================+ | | | How Do I Pay? | | | +=============================+ Payment is accepted in Bitcoin only. The price of your valuable data will be determined as a result of the negotiation between you and me. After negotiation, please buy that amount of bitcoin, and send it to my address below. Please buy that amount of bitcoin, and send it to my address below. For more informations, please google "How to buy bitcoin". My bitcoin wallet address is ------------------------------------------ bc1q3tdfzfjngzdlup7x50x3tkfs2mx90a85en9z74 ------------------------------------------ WARNING: Please check my bitcoin address carefully, even if you type one incorrect character, I can not receive your payment. After you send the bitcoin to my adress, you must send email with your bitcoin wallet address and your ransom id. Your ransom ID is ------------------------------------------ PCfD-rJnx67hQ ------------------------------------------ And my email addresses are below. ----------------------------------------- [email protected] [email protected] ----------------------------------------- WARNING: If all of my email addresses are blocked by cyber security teams, you will never be able to contact with me forever. So, please hurry up. +=================================+ | | | How Do I Decrypt? | | | +=================================+ Once the payment has been checked, you will receive the email with attachments of your private key file. Download attached key file. Open "Hansom Decryptor.exe" on your Desktop. If you can't find it on desktop, don't worry. I'll send it to you if you contact me, and the decrypter is FREE. Click "Browse" button and select your private key file. Click "Decrypt" button and wait until decryption finished. After decryption has been finished you will see the result message. Then congratulations, all of your files have been decrypted successfully, and I will never make troubles with you again. +==============================================================+ | | | How can I check out the validity of decryptor? | | | +==============================================================+ If you want to check out the validity of decryptor, click "Decrypt Sample" button and see decrypted files in "Hansom_Sample" directory on your Desktop. +========================+ | | | WARNING! | | | +========================+ I strongly recommend you not to remove this software and to disable your antivirus for a while, until your payment has been finished. If your anti-virus gets updated and removes this software automatically, there's no chance of recovering your files regardless of your payment ever after! THANKS FOR YOUR READING.�

Targets

    • Target

      cb141c743ac41784501e2e84ccd9969aade82b296df077daff3c0734bb26c837

    • Size

      2.0MB

    • MD5

      2b326540fdf2989742000b1506770663

    • SHA1

      613750e0ab2c1243d5c4debd1220288571762d7c

    • SHA256

      cb141c743ac41784501e2e84ccd9969aade82b296df077daff3c0734bb26c837

    • SHA512

      a683ed9914d3b8eaaa26a5e23ecd8315a5f157ded6e389bb78440ded67d3e2015955250269eb909db6eed5041548427de8920edff21583cecc89847f774b80dc

    • SSDEEP

      49152:hqiWm9rsMucPHHvU3rUUXEbYJCE5+Z5U:HRn1SCY+Z5U

    • Executes dropped EXE

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Adds Run key to start application

MITRE ATT&CK Matrix ATT&CK v6

Execution

Scheduled Task

1
T1053

Persistence

Registry Run Keys / Startup Folder

1
T1060

Scheduled Task

1
T1053

Privilege Escalation

Scheduled Task

1
T1053

Defense Evasion

Modify Registry

2
T1112

Credential Access

Credentials in Files

1
T1081

Discovery

System Information Discovery

2
T1082

Query Registry

1
T1012

Peripheral Device Discovery

1
T1120

Collection

Data from Local System

1
T1005

Tasks