Analysis
-
max time kernel
149s -
max time network
47s -
platform
windows7_x64 -
resource
win7-20220901-en -
resource tags
-
submitted
01-11-2022 06:02
General
-
Target
cb21b99cc8c15edc335d2948672ac3beaf5e85ccdebdffd641ad5d798080fcfc.exe
-
Size
680KB
-
MD5
1facfb9229486699183a6ae939c8741f
-
SHA1
878565c1b091f8a7ec357c4cbe9617e0e30f9d0a
-
SHA256
cb21b99cc8c15edc335d2948672ac3beaf5e85ccdebdffd641ad5d798080fcfc
-
SHA512
3008a8a25b0ea298e72c4f3d23fa3bd77da097bc285f8979aa001f7d3eaf41b5679762eca9e6ae1ae52da88e5faac990e136a6af38bfc4c2618633f1695c7869
-
SSDEEP
12288:xcBDJBj9sUD7KfhY74h0Sj1zkXOkA9KhShk13RcD0yBwQ/3I9+m:A3j91D7KZY8KEJkA8X6j3I9+
Score
10/10
Malware Config
Extracted
Path
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\!_HOW_RECOVERY_FILES_!.HTML
Ransom Note
<!DOCTYPE html>
<html>
<head>
<meta charset="utf-8">
<meta http-equiv="X-UA-Compatible" content="IE=Edge">
<meta name="viewport" content="width=device-width, initial-scale=1, minimum-scale=1, user-scalable=yes">
<title>Title</title>
<style>
/* http://meyerweb.com/eric/tools/css/reset/
v2.0 | 20110126
License: none (public domain)
*/
html,
body,
div,
span,
applet,
object,
iframe,
h1,
h2,
h3,
h4,
h5,
h6,
p,
blockquote,
pre,
a,
abbr,
acronym,
address,
big,
cite,
code,
del,
dfn,
em,
img,
ins,
kbd,
q,
s,
samp,
small,
strike,
strong,
sub,
sup,
tt,
var,
b,
u,
i,
center,
dl,
dt,
dd,
ol,
ul,
li,
fieldset,
form,
label,
legend,
table,
caption,
tbody,
tfoot,
thead,
tr,
th,
td,
article,
aside,
canvas,
details,
embed,
figure,
figcaption,
footer,
header,
hgroup,
menu,
nav,
output,
ruby,
section,
summary,
time,
mark,
audio,
video {
margin: 0;
padding: 0;
border: 0;
font-size: 100%;
font: inherit;
vertical-align: baseline; }
/* HTML5 display-role reset for older browsers */
article,
aside,
details,
figcaption,
figure,
footer,
header,
hgroup,
menu,
nav,
section {
display: block; }
body {
line-height: 1; }
ol,
ul {
list-style: none; }
blockquote,
q {
quotes: none; }
blockquote:before,
blockquote:after,
q:before,
q:after {
content: '';
content: none; }
table {
border-collapse: collapse;
border-spacing: 0; }
body {
background: #2b3d49;
background-size: auto 100%;
background-position: top center;
background-repeat: no-repeat;
font-family: Arial, Helvetica, sans-serif;
}
.all {
overflow: hidden;
padding: 54px 0; }
.container {
max-width: 1092px;
margin: 0 auto; }
.head {
padding: 0 20px;
display: -webkit-box;
display: -ms-flexbox;
display: flex;
-webkit-box-align: center;
-ms-flex-align: center;
align-items: center;
-webkit-box-pack: center;
-ms-flex-pack: center;
justify-content: center;
margin-bottom: 35px; }
.head-img {
margin-right: 30px; }
.head-text {
color: #ffffff;
font-family: Arial, Helvetica, sans-serif;
font-size: 35px;
font-weight: 500;
border-bottom: 3px #fff solid; }
.content {
position: relative;
color: #ffffff;
padding: 0 20px;
font-family: Arial, Helvetica, sans-serif;
font-size: 14px;
font-weight: 500;
line-height: 21px; }
.content a {
color: #9676fd;
font-style: italic;
line-height: 30px;
font-size: 18px; }
.content b {
color: #f25252;
font-weight: 500; }
.content c {
color: #f25252;
font-weight: 500;
font-size: 20px;}
.content d {
font-weight: 500;
font-size: 8px;}
.content:after {
content: '';
background: url('data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAjAAAAGhCAMAAABI/X4mAAAC+lBMVEUAAAAwDh8/GCkA6eHlc4tFxucA6eGJRUTihIQdx+GpXV4A6uENAjEA5uIA4OHJdXUA6eHckXzfmHoA5uEA5eEA5uEA6eIA6eHmkIHedYYA5uEOBmvCb3AA5+EA5+EA5+EA6OEC6OEA6OEA4uEKBWXbgX9Tct+eV1ZbHh5dc+Bec9t9Ozu3aGYlAwUA2eEC5eFXat0A5OFabt8A4uI1CgkB5uJTZ91NatvIyPsxBgRRZ93AwfgJpN48eN3PzfsMotzExPpRadsGkN5SZNwFr93Hx/knhN0NnNzKyfrRz/vW1PsAt+DQzfsAu98Az+AAv99mc+INk9p8iOl4gunMyvoAxOAAq98AoN4Bzt+Biuw4e9wGl94kCmwjCWsYitokCmwkCWx8h+ukrviRmfKmq/oCu9+ir/kkCWwUi94kCmzCwfg3IokkCmxINpZEMpXFw/kzHoRHNJbLyfqss/XIx/rPzfvNy/vS0PwiBmo2IIhTYtzV1Pw3E4IfBGZALpHAyv84J4xJK5IHAFULAFgAiLVLOZZYZ96xt/kAl704G4fX1/0VAF83GIQA6eJueuYaAWNJMZRLJ5C9xv/b2vxodeQAnsIAkbs9Ko4QAFt1gOnh4P0AmsC+vve3vf65wf8Ai7hjceN8huuzuvzd3f2Eje5cauDm5f5gbeEBea8AkLgAgLONlfGutPmWnfMyMY8AlL0AlLovPJSeo/YyG3xMO5wlDHBDP5qmq/qorfGFkdg2Dn4qEXQtFniJlNoAcao/SZ5EI42fpOian+QBaKejqOw5I4FsYbEqRphiVag6UqKOmN0xXaeVnOEmaKu5uveQjdUAo8N7dMAkT5yDfshAK4ZaS6BzarnEzv8dVp9TQ5lHNI2WldsYcq8XXaKJhc8Al79KatxNXNsArt8LYaQAqsapreoA0OC4uPAAnd6xs+4AxuDt7f8AvN4Aiq9DVtccLH0MRooA/O1I3O1n3u8AX5epo91X8fkBOZ1VV8M+Tbsw8PcfSLGG6fkAAEc5jB+NAAAAanRSTlMACRKRTAZ/HEwMJYQcHhQsjTNMM0AplYlMMVVHTEtmb59eef0yPxtMS0UwTDMq/sGG0VusOea0b0JL5xg6/ndRK539zWhb/SexlL5+2Z/mttmUbqXtz+HIkMbFr9CqenPr6LeB3O6Ujtz7glQwKAAAbipJREFUeNrs3d1qpDAUB/A/HHJAQkLAmICQGN0HKEPpY/rO23Wq0bbOzvV4fpeDdwZzvpKB+El5CyGeN5FXEOJZOdDUQognDcTOZQMhnpKImEmnBkI8oxvIsabJQ4intBNpjmHoIMQzVNLETDRKKCOeY0fnWFOUUEY8pmwNZaKEMuJ/1DA2uPMcNEeSUEY8kgt73DV9JM2BZVsS57KLYWhxZzK5yBaNdAvEiVw0O9pKve1QdAMjoYw4Yft7ftQ3uEuThXUlSygjftflJT/idYU0CoYjuVEGH8SDUm9I2FhHrIOWLrb4XZMiUQK8wUK1U4gcMoQ4Ult+VHpgoKRqt4BGoJVQRuypbSdqW2AMYWq3aLhkoA+9lGXEzsdcOqwysatd69YDngLLDKeobvM866074O5da4tVCuyCbEti94X59DFuoYxzrHcDeJ0mHWXBiM00Lxy2Um+IHKmGMiPJF0bsdO/zpzeslNek2YVxe0BOFYiDdJvnd0DH2i0gdhNWSvIkcTTMN6DMN1u7BWEATJL8SPyqHQGa57b+wFqhK7IbiSNlsCrz3MGsdbrGK3SRKFscmCxfnStTw2Bw529zC1O4xaoLmovHQTffEsR15bKNwqipg9FE2xKymVzwsPtSr/nzGSHLcZTrGpwm9lgZ0lwSVn569zA0dfWB+dMfmfu9rFzi/qhAMy4flU0zelgOdZrK3uav2rC4pCYtdTo31qne94QdBRMjlx5fbJwXbzL2e1FmPPaPVO9x0OQQKR1qw4siLYOLup96DOzPZzhLj530Ni8klLkqz6TZnZ96VGPCQf6Y/5G63tWo3VSvZnK9ffhgZaMsmCtS/f7U4xLKqKfb3LJgLmgoW37U1VGYh2yHu/4mmdLlZEe11Os5LAdnOzxiwrpxKTnrdjlDYF3nvG0fiZlib3HOOBkMv652CppjSfg+1atwxhBvNz5UXqoy16CSJk0joOrB2cgxnIcylmm78aEagtx3dhF2dKUH0tjslhC7kHCi6R0xk+sbVGMIMm51FZ3OQCq7U49ETOP/LvcNk8UmB7nv7DqaDkhulx91mZavTsIJP4Woo9n94EizXBLy6lSn8KUvep8ftS7/+21oz9vcQVusauVPJsdf2sTd1rVeX3itz/XO0WhOYx8y2NRDcIOEMi8sl/0Fd9/zo748vO65s783MeXfUV7X4PQu3fEcDi/cLEuotPjGmNMEKt4TKAllXlQf9qMwP1+4Z4quxTeevMKROYQyQUst+DWp7xeAm3zMmJvkfn5h2vCj1JsHW4vHUVLs13UfhXFu3L9wrQ3Uti/9XDD0I1IZi05qPydMWralF/WXvesJbaQK49EwCyEmDKRJIdI2ST1bpBQEYfEirOLRo6K3RSeHRajN0AmGNoeZdkIPpbG0QsCFkukhTVhyMC25BI03a1zXuFgvWRTMLm3Tbg+lB7/35s97M/njHifL+8HCFtJe8uO93/d9v+/3rPqIfOEx+LbDFiN8fWrXi2eUdAU9zfvpkBDoyqBIcTYteHnw9p0P3iadWyxlqC8cenKBCEiZUa3eSW+APmFsJs8wOMeDMHZijpmXBK++3+3u7Xzwrr0gjoSoijng50dk9cKMkvcHbDebPe9sAmSQjz309pLgtc9Sf/zT7e7szdveMuFDlCkqACV1JD5izE1OGFou8yGSKxP0+3n20NvLgE9TGyvrPy53uzfXMao+igBh5mI+wghv1NMHa28pQKhAOSPojRQfnDrQ52H30tjjbjKZ3FhJ/tq96V30EtYX7oevdo7KSIzH4oOaw5Ya5gYU6ZEp5KaixZF3xsMw5vgkibC+8rB3dXVxfecd80QIAmHoPdjQgMMh7iU2YAKSBx1FnKJ9wsgoMc2WsccZr3yc1LFa1XJX1193bxNxO/d/e7AzsUGPQ06FqEjxaIREQgSjKP4slptnM8nxxWtJE+n1s+McqN+LiBUspDNm9hY3rKROeMlQmt5XCVJuKvoDYeCOH/6kl3XyxhWvJy2kNtYvv9/r3lwsJHz2Pdi3osPHCaiTa2/1xr1UHnTI75xaR3IAdi2NKz7VuZIyKLP68PnN1cWFxRCfP4cxMcIGjF9Uclg0ofPH0Q+9UUPM6AIjzBjjbhKhmkzppEmtbmevQf32YvZIj6iH44a3eu0WzZDe+YvSvWB65SkQY4QZX+AiKXUkHibPDtMpXco8QZT58D067nnKw01PjHL1Bp27BODrtKDPwSNxzkpdZC92jSmgSMKE+UZ4UH92lkKUSW1sXP57fXO/+8GMqVQSs3GkZZ29fZohAY+j1Yv6NhNRjpqDTyY4D8c2a8cbr32OCfMgIwrF8rPGaTqNflyvFnvd7lpvbsq8VcJoCE3izPoQcDIg5Ae6Tc3P+MgcPDLDeSZibDow1ngd8yV5LyOK+3JWe3Z5ZNxLpz992QUpMx+mFhpJnBlBIDxiX2UiwgeoGhxiqiZyC+w2Gmd8iglTFQVR6cgHBaDMWVW/l1ZSv1xDvbTgD9rizOyJZYgTfcYHsq8yFfODN8JKeAgBYVCRHnJwLsEuqLHBXUyYw4wAjGkW5Xw2q9WRlMHTgst/rxBlpjlKuzpnkKH+l/1mboWJcxwIQ7l6gTAAr6MyZ9Gt4wND8wJhBFFSWllZy2qUlNmfRZSZo4wPMSdhSCeXGKgo5ziyTvFUpPgcSlD0BOmbLbgAIys2LRgLvPKZoXkFBEXKdPJyAUmZQ1PKHKN7qcd7rDMj7rh/eLyOEqcIMO3FJk/aTBObokMUeY+PTrcK5nJsWjAmeONzQhhFFARVqtSxlCmegRTGJfbZ0+ur3g3xcAb7bcBeu0UzGgOtQxjhg31+Otw3GEl4fPQ4gdNHVgvM+uB+GJOkexlBzJQkFWgjKc19LGUuUwB0L6Ubf1/fbG7eeXd4gEPES1s0ObL1aH7AeZH5eD9lr+ISeGTFXkdxP6wiSYA+TCMjKeheEtogZfLFalqfFqS3T5+hrszybW6oq/eWOeEeknc2NeFM+/XyPCYMmRYAmPHB7fiEFEli8TjbFiURKFMrNfK7+0L1VJcyKZAyP37Z3VmGaYEDQZ/ZySWEoQMcSAE1IlKcWCkAESZl3AxSJAFh8nl5v6lKApYyxew3UqUMUsboylR/3exuLhMpYxba/UfCC+adcVHHBRTVX0dhrl8XgyqSRKW4VciW5UYJ3Utw0jQzUqWgafXTVNrwcD5H99L77zgWZfvzGThTyhArzOhIcSJlGGHcjTd0F8w9XCSV6nI5W5AL7YyIflQFqSLnUYltdGVWt3/7oru3/NFtmjD8gAyQ6ASJjcFS5oUzEgMxRhhXgxRJAFXF9VFhqyMJioI4k2kcyGRaAJRJPVru3qelTCiiKxXnLgG1KsA7bL+jI8Un5lil5GIYRZKAgO8hqI8K5YYqZhQJMQakjFwukGnBxsrRXzvdNSJluFCCJD7YdgmCRMqQDwxFgFxcbAfbxSBFkmC2ehv5444kdYqGlFFa+NQxpwUgZR4/h3sJSxk6n2EySJ8waKw94bN9YPTWYwBMnizc1/0gRRJWLXp9tN9QaydPTCkjCScFfVpwlMKfXln97Z/uzhJIGeodNz/duAvrYVXx/ofehhMG/kIkweSLy0FPksRMu2LURyVBOpG1rY5qTAtKjTI2Ppymk7iRt5J6tNTdXLIlPvBBZ8Adsmj6KAphKcMN0zDoZuNZ8pDL8Qbmi14kIQNVW8CtXkWodY6RlBFK+NSRJKSGC7uX6VR6Q5cyD34GKbN0h0p8CDi2Hnl0wkxNkwAHVGLHoiOzjFginsth2u0ETJi6LO+3FAlfRHCoHDckpVGHaYGphrdODlPPLjc2koDtVSxllm4bZ0h/XlAggSyaMWj1EmM4echgaJZRhIVVuRh0kYQtmnm5WJEsKSOpDWtaAMaHrbpae3r+5HRdL7E3wMN5f4mU2E5wASCM1/TKEGP4VJSmjDPc18+zW8m9oIskUTmR5Wz2QGuUavhQESqi2pA1PC3AUqbZUtUn5+e5IowksZQ5/GWtuwZShnMOFsOURfMWlQoT8uNI8URoRCwjz0zi7oWtSBLVShFV0HK2LeBDRQXCHKNpQb1iGB9E6el57vz8MG16OH/4eWdv7fe3HJ6qhdlpshapT6191EMG3hEPvQWjXnbCuBakSMIQJbW1jyya5ggSSxk0Lch3Mor+iTrwZfZe+vQUGANYRV2ZtYue/W38ORISQh7Cph4yGBn3HGYaxrUgRZIBpSa0CzJ1qKgSPnW0rbYkYNRKW+fnpdpZ2fBwpiC86tsrSCKKeAjw1Hk+bGv1RhzpvwMixdld5HYYRZIo6FDNpks5CwaqToa0erWySRihBj29Sq1VNjyceFqAPJw9yvhgmKEmSd6Z3uol04JBkeIh9o6b20GKJIwSvockyZQyLVEyjOHasUUYQaypGam9m9U06ONhrKfqf19f/b4E0wJ7SMjCNG37hYrZZ4nbASdM2MvecXM5jCLJIIJQrGNXL5TR+rYJlNiKPmAqFU8kwYIC8liT81oFLqV0Wt8tyM52dxbJtCDI5wBOKQPzJs78QP9mfwhZyaeZ5HUx7EWSCAYqo9UrZU40kDJyoaSIiDOSCHMlAqyG5d1m7bB6dmR4OM8efdldWyRdmdB8DiMWsCU8BCwpw/WdMKig4iej7F5yK+giSbdoUk2XUv2grGVLakafWsM/GyRo7DUV8d6+lfiwcvTr/b2lxTtvexx5ZwkflfAQjBApQ0Cp4ckI075uBW230y2apD4SYX4EP5eAF7jV2wcRnTpKpljWiPHh4fOdncWv+qTMjMUIHO/snRwdKc4I41aQSRKGCKsCqD7KNzKqvjjb3gfC5LfwtKAfigiWvOwB9nAahjwwPuxtLn40P2WFOecACcoUFQQpMyDwl7O2t/3shHEt7tJFEmm6QCOmaYjdDPaBHxyAMVwYBFHslEniA5oWpB8t7m3ezMbCJO8MESYe95Edt8igSHGTY0GWLu9akCIJw2q6ZHc7KrBHr4dKeRkopLVU57VEjxOyaLcglTSNDzc9yOG0qLAwiT14JKs3Nj0oUtxSw+z5NreCFEk6RLM+kqGIbuv3kCg2EYXkoiIoQ6RMO7uLdguOzK7M6uMe7O+/6ecof3ecR67ekZHiPHvn2uUgRZIBxayPtsAJU5SNVi9enJUbitpqSn0Xk9nYA3uVrmOwlKkWoPX73YfvhakDxPbQ26AThr1z7XaQIsk4XzpNfSittlqqUpdxq1fEfbvGVlGRGlt4x80O0eCYfFCpHaYMymxsnx6f32wuXngDL+LqJc96sVavm6EXSVWLMOL+rrn1qIhwwmSpxdkm1NZglym0gVc2ZFTTw1lRMg+qZj70OkSKb4KWWZihXb0k7nlgdCt759rdcEySwKJ5gBghiej/aiuPp9bmtEARpM5uNr/btN9KaqtucEyAXnBGOLIixbe3Hz+/ub7ovRV1PPQWHu7q9SPvDDNQuRWOnSQ9RVNG/Vtc/pTq2AqjnQiYEYLahHpbcxBGah0X2lj74N8C1hwBY1JpbHzY+DOHwqvmPc6H3nwjWr3+SUYYl8JRJImKfqjsnqgiKBNR0hdnNSRlMBlUPD9yEiaPbMBEDWf+Y+9qQlspo6g/4EpF8Gcj/rt24UIEwY0bde1SQQQRGmOdR7UdrM+MjDJTR0x4ZBRHGLCbScD8IM0iSlIIGkMIjlG0YmuQRkWhWEU3rjzf/eabm0xGd7azmLt6r026Otx77r3nnq/0/N7WKRHgvbfegaU4tDKP3s+IuOl2AOa2f1f13plLNLMaVySbJN0R90em1cPIhU8FfNShno4gKlNfAYxYJ7SocCnIFLq9k8gk5I23jn6F8OGlp2KfoOuFPcht/6HqvSUXgWc0uElaHvVWB45zdKzb0eFsy/Jds2AXmKkkttZNWbig4Yyj1zrpYcFEkHk2+GP30vvCJ4jPUW677j/I7TX5NCabETVJugQMj3rdwNkehAEAoDwSvTqMP46l8GEZL5R1Agz2fK8eIwYdlmeekEkI+Z3BvOqVJctDZBi2M+O4Jm+pMx2Ro3OBw7Fp6DIUh7JuG9sBOZUZmn6hO6zixi2xglwsXD6+EAPmoMXWrWJb0P0SxynK8pBVvUnD39vzNVKWI2ncoBfa1FIDJsgwJvbUyiOxNMUO0m1aQWMJMXpjWlA3bmig+Je6qGxNk6xbCTLvvHMCxCSF4VeuGP7mBg5ZjtVNUr0e6Rjsdh2D27bnI6lIA4ftoeeb4VEXNWuBv7h16o+k3IoyDN+rkHUrqMxWpOGcS8hcdy2reu9YlWjmo97MxtWJJokkmm40/Mf+CBnGb6mkAnBgKW0ddBs02FOAMb3WQJn7ThsMJTYJISpDgryX//xJ1qVYGXPbrSsWMTTqzZNMJuPu2KyMAeP6ljqldlBXQGbD426EAAgf5gfddhPbAkcBxq8BFNFgz9FXyNCgRZA53duibcFW8CYQcxc7PiDZJB0fxOP5OZHJZKgmieuI3avS1WO0lLZL8Ej0DrY5Z/Sm3QYW170ol0Cf6dVMJQPm0GESQoVKUZkB9gVbVJc8JJkLF1L8oZkNX5lLNLMZq02SXqIq0mpGV4+2MwzmyDAqkFmctlvzw0GED7sg+iN2fOC2mv3OoJWp1fde3pNU5q3T+e+7L23wbUGa3XM+uMtkcJOkgqqIS6fUA+UKMxAZhouWXsLQxTp29AUpDHJIs0Xch1NVuHCv4lfN57d+i6nM6dcb7764gW1Bsh4pNnxLnmEyGdwkqeCrR6YyDBemMpRheDbca4ov1CB8YMC0RKGK9Vj+29uN+KG3N1798Pud3Y315FMXN1yZG9xlOeK3QRdrknpjy4+pjB5Dg6nMgDIMd9Ck4WxZPLhzemLBpAoVPoAxDlu3knnV7s76+oMPLI/tcoO7LMfN8SaJI7aaqgkqozrmZDg2f4c76JovAMMLpqa8V7EJQNgseJjKsKX4G5/9/O7mOlEZPsXPDe6yHPzsDeeXwZSvHqONIjMTjsUrSFtpOC3OMHyvUu3ZuuTP8qG3k/iht1f3vth898X1BSpz4+3SUjxX9WYzUpokvV7txVVEUhnlkZgMziVUuGgFGQOGX49s9Wy7bXclpuiht5NoW7CHM8nPL13aWOczyetJw4l33HLIZDGeYM7Lg7uWRaNelsKwOCo9UGpk4dL5XJ/vVfywZ3etX6fdbQnCOurSidoWYMH07V+7L60/RlMZ1nBemQ/uMhlPpgCm7kmDOzs+HjEllbH/HTAuCteK8MFWC6ZA79Z+/93DfkHdq9SIykSW4m+ByrxAVIbfccslmpmMlCZJt6ndqUFApduKyrhMZdIBg9PqZOHSC0fDaMHUKHRrcFEMu7YdcZ2afB1lS56jgMq8IFrsRQ1nnmGyGOoOf6nhkQtDIdEs2ZGBQ+SRSKrelHAaiVGvsoGQR3C2IwEz79oNJBj1Zq3ZgqW48uH86rtLO+uLVOaqvLnOYHCTxCEN7prhwNk+ZgNwXyCiekRZZzXs0sAV5r7gPjzppSO42FLc+h2A2e4FkusQlfGOP9o6PY1f7fpldxNUJr4tyLfVGQxukhI1xmmbAQATmtO4YwYirIEUhnOsOD6YjSWJZq0p6LKOv9gd/gTADELFdZDHLJDh45YyCXn15U/Xdl8UVCaPzAY3SSuKy1IbN2st1R+xMPz4uMBMZcXxwa9xW+0cuC3f97ygQ9SlWxjCIbolKpsjQdie2vagdXLCPpxfbu5urD18f55cshrJJomW1cOSlMJAolnlUS8QMaz1hDBc2T1z8KjX8xkwOkwUPc9tVr2JJiCDbzn4i8x1HBwh9Kogv8pSHI4P3+3uXFiDpXgeWYz0TVLdVAbg8dVjpOptUI4gO7P0utToLYjA9dK+MTKrM0DGHRu2LlDIa21bfmVoWs06LMVPt6JtAajMNziTzFeQWYy0JgmDO49SAB+P1BR3dRyRI0xTesgvR/SiUrthK7g899pr5Up57Fabrlc1R/uADPVHLXCd8Gg7bslaLlmKfxybVwlL8XtuuiyPzMVyk8QSTdNqHZfSR712tB6abifw0lbvuEV56mLxNaNcLJYrxYlVdV1BZfYFlZFrbXgVMV1GzZvWhPBBmVc9/fcff/wB4UMeGYu0Jkm3B1Vqd1R/JDvmlqoiDq2H3CRgtg+sA9AcBbq3tdeKxX65ohWLRqVfrwoqY02eE0nGxqiXMgyTbHxbsCVhKU7Ch7cGP/39x/sXHszXSRmL1CbJjg3Ah6o/opfPPVPYOysP+RXATC2p6lXVqFgu181+xSgWixVj7IPKWFV/dBG/lZbizmJSQxfvuZawFN+KziTdN7/ZXMtb7IxFqtxOGYDzcb2sIj4aoFIkn2sHU2cFMKZLbJiqUbEIwATz5qRYiepSU1CZWad80dZXxTQkfAiH3b1nyfEBdemN0y82LokW+7I8MhNXP8tN0uqol/sjWhiiY25020o+Z5f0BGCGlkVsuPC2gAsBpu41q/4YxFfUpc7hzJu5HaNDVEa3Vyd/SFCFDwPWcH7y+Us762s5lclOsKPzUthK1VsjKgMCK4UsNVxBwhZR7pyX8MJsuGb1AQ+KshGETXeG/sgwihGVsTqVThNUxtbTLcX1Ur1GGk75AOlrf+1urq09mM/xMhLcJCX86mxW9boe2Iot65C4goSOYbg6g9HVqNdq9o2iQkxnYnkuWuqgI36mgcqA1HSs0JctdjJE4imYFjs+kPDh0os5lclKpG6S9EIPw39W9aIfiiDkgJsiiXi9lPywbQtIXZzMqgwYUYcC6o+8caWoEZVBSWo2vWq9vy9AliL7PEo4Pjz7xYWcymQlUpskzGFCuoONfFSRYfTeAIiQEpcaitIKYOzBERSYF4GIfsCAoaQyEv1ReFgplon9lo2OmMpgW2C8vZpk2PHhRD30JqjMDqgMhA95nHNc/rjivMnBnUt3sJErzMG20wvjhWFjEK5mGCcIe23qoDGr46D+SMOoN5xUypMxfUAr07agWi8XjXQqIwRcQsOpHnp7h4QPaxA+5HGuwZukRFWARNPEW31qa92wbUzzm/FzodMDfQUwSETeYUcgQtMYMDKpoD+aH1aMeig/UKRtAQBjjMf7jp4GGSwxlyzFX9369D1QmUfzunSewU1SAjDU7ljTbiHyCbLFRZoURxGEUlzA7fpcbBjl0IXzy+HYqBCVGY0NI6iqDwBCk6pZrhzO6/0V9qurexVv0VL81Y++fHFnPacy5xrcJCViW1p6FMyFrTWJo5Tdc5Ilv10GU7HEJJcQErfV9XnQp6yDQoUM487oA3JbAOxMqqAyxWUqg9ZavVA6hKW4dK6KNJw7m2s5lTnPeGb1Dp8tPUB1g6rFo1718nmyhmBt9NxrSBxykov2p6wpwJSRVGaTjkgqWtEYqw8YBrFhAAYQCseV5zB+YbBOA75XEf7QRH2VhhN16b2cypxTpDdJbOmBcxMXVEL4qLKTVBOHjTykjddGkql4HtqfWceIAVMPSQqjUZ1SH/AOJYQ0Y4RPeyOkpIuADFuK870K+UPHdellUJm1Sxs5lTmn4CYpBS20IuxVMbn1goKteEWr6btDPM/GS2laG6mhC9ofr8mDOyCCkkp4WNbKZd5aA0L4L8IAhOYjUaK0twt6vJJatiYq8VMXUsOZbwvOJbhJUpyXWcRBoyuHLmLU65tYBbCTlNXeLvWOUDBYxKBCQ/vjh7MIMCqpVF2vDnwYhvxATXCdMNDKEYTMcUUTjdVzoDLq0QJaYvK9Cj91QRpOsS14Lxc+nEOkN0miFNUOYgMHF07N3Xb8lsnUh2d8vSqED1SNiktBYikGTJRUwqBsTA7RNMVb65nfiSBkaB2NQtUlG57jQn1Djg8U6qkLRWWwLdjNtwXnEckmiZ+/IWWLSirYUTc8X92GNJBvApeED/tEXhgthmx/gIXlUa+LDnoyB0a0aGvthWax0pdUBolGiyFDhZDVNyrHJKnM3tfrO/m24OyDm6RkhmktPpCEG4KG7ypeIYazYrBnNQ8JGYyX0ciIOug4DDl0GYmGyEPmibbWI9/tVPohqIxR1DjwZRI+ROqbVpta+jQqA/OqF15ay6nMGQerp5L7P4sM7o6jUwGxcqzxbYjQMbRcdzY/RErhqIxDyhkcWnFEPzAMzZjMm33smTqRmmoEwGAFafYNbSGw3S4CkMqaiAGTpDJkXrWz+d7ag/lU5uyC3wZNhO7EUhhJbu3CsdsUSUWNegtjN7S8oLwMmGo10tfFbbXpIuvQP0FlABioeouGrF7GCA1UOME/OMsYnVlztO88H9nI8As7KVTm1TcgfLjw3mM5lTmzuDu1SWIbIJ9VvTaojBr1CgUmDV3mgZEAjJjkjowyAyYIcSoQ7STHAAzmdn6/HO0NIHzwJpUODfYUYPyqED448raAr7RTqMyeMK+6sLP+Xk5lzirSmyT2UWVVb7QtEO7N3sCGAlM2xMsZxhjNaJIbUDvEEk2l6jXKRp+EDhHMyhA+zAEYzx2rJGN0XAuy30O6rF2yFE+nMkLDCSrzyGV5nEXw26DJUK4wRGX8I2UsBF5h1uqaAojWT/TUHbqLBbmN26bDcOYqVS8tI0VSMTTuwceVjut5WCdIDqMFoRzsXUwRPjCVIcRE5lU/ijneZXmcQbCjc3Jw13Big7taYtQbmgsJpLgchjHCJHdRoqlFV4/1UYWoCz7AVFlSmY6HrBNI7os/iXMUIQNmDWdKcF0SGs4v4RFy72V5pMcZNEkY8AbKFcYWV4+1esmWxkLO/sj3AZi0KFP7YwAhDBhaMAl9ndLKlIWMigsZCpGkMgARBZ+jeKAyySSTOpV5463vPnj9vsvy+H8j+TZoUqLp86gXGaaEWRq2BVgbiYZYS8VLX3XMkwgwPOpFoWIqs9x4a5LKBNxdGxVZ2RLCh3+nMu88/8MPD12Wxz/sXUtvG1UYzYYFv4EtQoIVYgGoFagV4lWxQIUNSCx4CKQYTzzBSXAexgN2MMEKDolrGgNxadLYDkmcpLitS5OBUoobHEJ5FWhJUYIQQmKHBDvO/e69vp7xOI8CHVvqoYVSUh7y4XznfN937/2fYX8b1L6iWd3qDWM2kMpe0oaoingdYZRnxaaLUU0jnbV6aSUzSlYGf24hDImKfhHTSQn8giFUtjXUpZKBxYctrUzfBz9fU5j/HSokBeyEoavpKB/Ji1fpxvfoaraE5ah6MJZXEYjFiqa91at2ZcjKKOgMfKikQDNKLD7ADIlpgR3qYWwizB/9t7ZcgyOuUkiifAT3IlZhYr7Y0uqa/MCdoGnmcmqWBWL6AtWHKRtyqzelrIyCLqAEBhImf8Hqklp8cETyQzqI4uvuvmZ6rwKcQxIhJi4AT6z3soAUSMYj+MBn5e6THVowGDRLfNOlrONTVn2YDeSjIRmgeGKu7gXrNYgvVXY4cyVDLT44IXSSLq0KTXTf3HINjvjfQ5I6tcpavXlcgTgTeI3dC6R2n3QbZTTGF3wvyUBcvaKZSlGrl596FGu/JTCiLmGMUorpmE5DTMvigwM+IIUpTHTf1HINzvh/J0n2CxxW13uL62F5NoQ+cHFSWoHowmAGywdIhaoad7lVykcFuQqjrExdwizNrq6RjlXXKWcrQx7mxb6/J66FpKuAG4kvMiQ531eXOR0zyxvRcsT+gRuKLoDGYZiFxahlRTPO89FGRqxoysRMjKinMGuzXMcgMooxEQcrE/K9SP8Jf01cC0nO+P9Dkn0Eqek4ChJFc9Zr+cATy4aFLvhIuciYSzmlMAC/4I6taBYojxuUmLmViTsTpjBWufFBBxRlaqxMaIFC0smfr4Wkerg6IUkdHzHikSEssqRAGPGBG2zPmw0QITiaJugCjxH0SsosjynCiLizkcOKZk62epezzOuschLqdmAxvExDTHgfZobYtzpWJiRCUn9/Y4ekW27ev3//LU1vs0RIqk8XT5BtYMbxgbNzrhn6wEWLBGssmBuaJuOLjhTj8/mSGqdM0CxoQc3a6h3LsRXNA+ouKjCClmmUiCioGx9Q2zSN/gkOVkaFpJnJRglJ1+25s4YX1+1/7BDDwYOP7G9uzqiQ5MwXeY2UYSyNZQzj4kbVMdfVDDspnSmYGpAM+BgCSVDHYJQBJGUM4ph3CY3ghMxHcjHcMMoZ/B31WpCOrWHsbQa5ihFlRMT2BOwhKd0YIWn3s8/MT09PP/V09RLgbU+OHxKEAR65paVpoUKSM110teCNDxyLCgk6ByuMyHLQXEyl1sqapgd9Ep5gYckAZeSHjHKyzAdMtKLJJ4pDorIdyBk4Wi2mBTaAYzpb6UNtY6zVGP8UZWRdCvmeb6CQdP3T88D0/DRQoczNj42PjxNdOGEGBx9pCG7/hyFJHWa0DqKhMCoQayhGZi7Bbjg0DAMVSQCPJqHpUqEMW9FMyVUYeSzyYmWrl/nptUQO5tbBycRNbTFVIjMUiYAy8NUWK9NoIeneZ44RYQhTU/tbgJseGSe+EIgvYMz
Emails
href="mailto:[email protected]">[email protected]</a><br>
href="mailto:[email protected]">[email protected]</a>
URLs
http-equiv="X-UA-Compatible"
http://meyerweb.com/eric/tools/css/reset/
Signatures
-
MedusaLocker
Ransomware with several variants first seen in September 2019.
-
MedusaLocker payload 2 IoCs
-
UAC bypass 3 TTPs 2 IoCs
-
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Executes dropped EXE 1 IoCs
-
Modifies extensions of user files 7 IoCs
Ransomware generally changes the extension on encrypted files.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Checks whether UAC is enabled 1 TTPs 1 IoCs
-
Drops desktop.ini file(s) 1 IoCs
-
Enumerates connected drives 3 TTPs 24 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Interacts with shadow copies 2 TTPs 3 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 63 IoCs
-
Suspicious use of WriteProcessMemory 28 IoCs
-
System policy modification 1 TTPs 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\cb21b99cc8c15edc335d2948672ac3beaf5e85ccdebdffd641ad5d798080fcfc.exe"C:\Users\Admin\AppData\Local\Temp\cb21b99cc8c15edc335d2948672ac3beaf5e85ccdebdffd641ad5d798080fcfc.exe"1⤵
- UAC bypass
- Modifies extensions of user files
- Checks whether UAC is enabled
- Drops desktop.ini file(s)
- Enumerates connected drives
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Windows\SysWOW64\vssadmin.exevssadmin.exe Delete Shadows /All /Quiet2⤵
- Interacts with shadow copies
-
-
C:\Windows\SysWOW64\Wbem\wmic.exewmic.exe SHADOWCOPY /nointeractive2⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\vssadmin.exevssadmin.exe Delete Shadows /All /Quiet2⤵
- Interacts with shadow copies
-
-
C:\Windows\SysWOW64\Wbem\wmic.exewmic.exe SHADOWCOPY /nointeractive2⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\vssadmin.exevssadmin.exe Delete Shadows /All /Quiet2⤵
- Interacts with shadow copies
-
-
C:\Windows\SysWOW64\Wbem\wmic.exewmic.exe SHADOWCOPY /nointeractive2⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\taskeng.exetaskeng.exe {38E56395-0ABA-40CE-8B6E-DE4016D66011} S-1-5-21-4063495947-34355257-727531523-1000:RYNKSFQE\Admin:Interactive:[1]1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\svhost.exeC:\Users\Admin\AppData\Roaming\svhost.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
680KB
MD51facfb9229486699183a6ae939c8741f
SHA1878565c1b091f8a7ec357c4cbe9617e0e30f9d0a
SHA256cb21b99cc8c15edc335d2948672ac3beaf5e85ccdebdffd641ad5d798080fcfc
SHA5123008a8a25b0ea298e72c4f3d23fa3bd77da097bc285f8979aa001f7d3eaf41b5679762eca9e6ae1ae52da88e5faac990e136a6af38bfc4c2618633f1695c7869
-
Filesize
680KB
MD51facfb9229486699183a6ae939c8741f
SHA1878565c1b091f8a7ec357c4cbe9617e0e30f9d0a
SHA256cb21b99cc8c15edc335d2948672ac3beaf5e85ccdebdffd641ad5d798080fcfc
SHA5123008a8a25b0ea298e72c4f3d23fa3bd77da097bc285f8979aa001f7d3eaf41b5679762eca9e6ae1ae52da88e5faac990e136a6af38bfc4c2618633f1695c7869
-
Filesize
8KB