General

  • Target

    b2493a580153291b69ca23190d00a00b1220cd0aadf469b3974fdaa726516649.exe

  • Size

    719KB

  • Sample

    221116-f51cvahc75

  • MD5

    8474039d83805eb7b447325c3a8d1ebb

  • SHA1

    a07d537f4253745a087709a9a07c449f84deed8d

  • SHA256

    b2493a580153291b69ca23190d00a00b1220cd0aadf469b3974fdaa726516649

  • SHA512

    3272091bbf123ba5e1592e8b2bd7740cddcb174fa158bc6980b25ee61d92387e94a25284736253f83a6eea78b427f6717e888e843db9d7759cfe9a7676576438

  • SSDEEP

    12288:q4UOTYQivI2qZ7aSgLwkFVpzUvest4ZEbjJLuhJVoM7SPd:bRTYVQ2qZ7aSgLwuVfstRJL6YM6

Malware Config

Extracted

Path

C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Recovery_Instructions.html

Ransom Note
<html> <style type="text/css"> body { background-color: #f5f5f5; } h1, h3{ text-align: center; text-transform: uppercase; font-weight: normal; } /*---*/ .tabs1{ display: block; margin: auto; } .tabs1 .head{ text-align: center; float: top; padding: 0px; text-transform: uppercase; font-weight: normal; display: block; background: #81bef7; color: #DF0101; font-size: 30px; } .tabs1 .identi { font-size: 10px; text-align: center; float: top; padding: 15px; display: block; background: #81bef7; color: #DFDFDF; } .tabs .content { background: #f5f5f5; /*text-align: center;*/ color: #000000; padding: 25px 15px; font-size: 15px; font-weight: 400; line-height: 20px; } .tabs .content a { color: #df0130; font-size: 23px; font-style: italic; text-decoration: none; line-height: 35px; } .tabs .content .text{ padding: 25px; line-height: 1.2; } </style> <body> <div class="tabs1"> <div class="head" ><b>Your personal ID:</b></div> <div class="identi"> <span style="width:1000px; color: #ffffff; font-size: 10px;">947C5829BBA9C7B42E29FD1A452351DB069F96D198B0722DA4C5A704842FE99C67D15ED95912DEB6C2ECA8FF5EFF282D3FA680B6AB103C0F012952F33EC9F27B<br>B990C8BC325A0F13DE3BFD91B51EEFA88F6E6A21C9D9A202049EAFA1B94F0ADCCEECE685E6466703DA6643ADFF0FF4CF1CCDE2119CF49DF4928BC0DAB38D<br>653AB1956A009170056769F1EB4F9C02E64F7EBEF57B8111FBE787B9719EE93496B97445FB752D93E5533984BF0F468F6D869E39005793DC804C470774CF<br>A6B5FFCDCCE78821B094D1AB3143390E928CA4633D792830B7F9F8E4ADB9B9D4AA78CA19F669522CCE8613A8700D9A94E7AAC12F74C91AE695D9AB8504BB<br>6C896D851E69EE70CB753C5A8AC8EDD8FDEEE0F418ADE82D85BD99703911C9C07B48E435DB4496986F24B29D7391685F75441AFE770248200EE2150C5B53<br>DA0136D1E415CCFED59DC73CDA7465633D29BC79A7F83A6EA51C9B6697251EDB74817231D22BE85358F0E34D641939230C86BD58139130C4B460B28BEA54<br>D697853DD7A358639D196851FBD64A5F6F19E9038C29AC456D90A84C1FC4442ABE000B867AB89AD1061E15B2593A56F1FC895FB975714FFDAA506F94CB02<br>3A4DBC1018D0F445A67BC8D7392210F87BC71955649ABA58D627238830B3601EF521492572A76E549F6FA83CA87CF0B640BCEC21DF79DBC296664B83427F<br>C921C513B3813184B12645E7DC02</span> <br> <!-- !!! dont changing this !!! --> </div> </div> <!-- --> <div class="tabs"> <!--tab--> <div class="tab"> <div id="tab-content1" class="content"> <div class="text"> <!--text data --> <b>/!\ YOUR COMPANY NETWORK HAS BEEN PENETRATED /!\</b><br> <b>All your important files have been encrypted!</b><br><br> <hr> Your files are safe! Only modified. (RSA+AES)<br><br> ANY ATTEMPT TO RESTORE YOUR FILES WITH THIRD-PARTY SOFTWARE<br> WILL PERMANENTLY CORRUPT IT.<br> DO NOT MODIFY ENCRYPTED FILES.<br> DO NOT RENAME ENCRYPTED FILES.<br><br> No software available on internet can help you. We are the only ones able to<br> solve your problem.<br><br> We gathered highly confidential/personal data. These data are currently stored on<br> a private server. This server will be immediately destroyed after your payment.<br> If you decide to not pay, we will release your data to public or re-seller.<br> So you can expect your data to be publicly available in the near future..<br><br> We only seek money and our goal is not to damage your reputation or prevent<br> your business from running.<br><br> You will can send us 2-3 non-important files and we will decrypt it for free<br> to prove we are able to give your files back.<br><br> <!--text data --> <hr> <b>Contact us for price and get decryption software.</b><br><br> <a>http://gvlay6u4g53rxdi5.onion/31-LPy3hdSfGLBgLSfGcKN9rubDKoa1VMK4-sjDMPCgOrCblwZ9BCnKU5ZS4Qv4ZX09u</a><br> * Note that this server is available via Tor browser only<br><br> Follow the instructions to open the link:<br> 1. Type the addres "https://www.torproject.org" in your Internet browser. It opens the Tor site.<br> 2. Press "Download Tor", then press "Download Tor Browser Bundle", install and run it.<br> 3. Now you have Tor browser. In the Tor Browser open "{{URL}}". <br> 4. Start a chat and follow the further instructions. <br><br> <hr> <b>If you can not use the above link, use the email:</b><br> <a href="[email protected]">[email protected]</a> <br><a href="[email protected]">[email protected]</a> <br> <b>* To contact us, create a new mail on the site:</b> <a href="https://protonmail.com">protonmail.com<br> <hr> <b>Make contact as soon as possible. Your private key (decryption key) <br> is only stored temporarily.<br><br> IF YOU DON'T CONTACT US WITHIN 72 HOURS, PRICE WILL BE HIGHER.</b><br> </div> </div> </div> <!--tab--> <!--text data --> </div> </div> <!--tab--> </div> </div> </body> </html>

Extracted

Path

C:\Recovery_Instructions.html

Ransom Note
<html> <style type="text/css"> body { background-color: #f5f5f5; } h1, h3{ text-align: center; text-transform: uppercase; font-weight: normal; } /*---*/ .tabs1{ display: block; margin: auto; } .tabs1 .head{ text-align: center; float: top; padding: 0px; text-transform: uppercase; font-weight: normal; display: block; background: #81bef7; color: #DF0101; font-size: 30px; } .tabs1 .identi { font-size: 10px; text-align: center; float: top; padding: 15px; display: block; background: #81bef7; color: #DFDFDF; } .tabs .content { background: #f5f5f5; /*text-align: center;*/ color: #000000; padding: 25px 15px; font-size: 15px; font-weight: 400; line-height: 20px; } .tabs .content a { color: #df0130; font-size: 23px; font-style: italic; text-decoration: none; line-height: 35px; } .tabs .content .text{ padding: 25px; line-height: 1.2; } </style> <body> <div class="tabs1"> <div class="head" ><b>Your personal ID:</b></div> <div class="identi"> <span style="width:1000px; color: #ffffff; font-size: 10px;">3CF61751DD2CA96BC4BDF46A3EDE2658383D739A8CE3CB774A3AC66BAE503059F2AF8022FDF2C1489D742B876B41B49B86EA3E15744D761AE5E73967B0ECFFFA<br>5BDB67994C5EDFD9AB4AE06AC0E68709C6F348FDCBB702ED19628035DF685E31ECA0A5B3ADEC26F09D6D7791A25E78075786E0D558E4DEB2597D329C59A8<br>F35EE3EA0E66E5F8D87D7A54D797A6FB8A376536A66390B3AF008E54725EE927F42C2D4ABE49952561F4031C12965E898819939ABC1E2BA19DC2DB412E2D<br>9D27608DA369E1AEE3ADEC01AA25536EFB51AF4FA22A2C6A6EA422E79D3788251A7BD470DFE15AFD5F6B153195279B333B7508405B99ADE814330902DEE5<br>2DC12C23E069D237DE2A84FDBFF5B947A031D0E86866A1CB5CF972DA59A655A2DD3749F3A2BC3D281D45ECFF3FB70A396C2065367E86B10DAD122B0BD681<br>6100F524AC887BF6059A36D529B10EFAB85017BC355F1325CE6C987504505E743C183684DE1EEB35FE1B2F5CFFEE71E93DFAB9B94DAF479E821837D1A739<br>7E7327F2EBE1C459A13FB9567DB80F19D55525283093CAD7E3B4CE2EBC1F182956E3BC34BF8F761DDBBDD7F7B77ED0C876C8DB847A576252D7E7A9170E01<br>0E2D9337FD02E03C60629FE35D01EA0F07936E4A6DC8AD0789F7B87379DC98F3B0064DCB45B468DA7BD4E753EEF66CEE147D8A0BCE8DC5DDA1DC174B35FD<br>0DC58EF017C2A3865B2CA2A76B02</span> <br> <!-- !!! dont changing this !!! --> </div> </div> <!-- --> <div class="tabs"> <!--tab--> <div class="tab"> <div id="tab-content1" class="content"> <div class="text"> <!--text data --> <b>/!\ YOUR COMPANY NETWORK HAS BEEN PENETRATED /!\</b><br> <b>All your important files have been encrypted!</b><br><br> <hr> Your files are safe! Only modified. (RSA+AES)<br><br> ANY ATTEMPT TO RESTORE YOUR FILES WITH THIRD-PARTY SOFTWARE<br> WILL PERMANENTLY CORRUPT IT.<br> DO NOT MODIFY ENCRYPTED FILES.<br> DO NOT RENAME ENCRYPTED FILES.<br><br> No software available on internet can help you. We are the only ones able to<br> solve your problem.<br><br> We gathered highly confidential/personal data. These data are currently stored on<br> a private server. This server will be immediately destroyed after your payment.<br> If you decide to not pay, we will release your data to public or re-seller.<br> So you can expect your data to be publicly available in the near future..<br><br> We only seek money and our goal is not to damage your reputation or prevent<br> your business from running.<br><br> You will can send us 2-3 non-important files and we will decrypt it for free<br> to prove we are able to give your files back.<br><br> <!--text data --> <hr> <b>Contact us for price and get decryption software.</b><br><br> <a>http://gvlay6u4g53rxdi5.onion/31-LPy3hdSfGLBgLSfGcKN9rubDKoa1VMK4-vktqVZWPMPBUhdlEpqLxDMb4dEDfM0LF</a><br> * Note that this server is available via Tor browser only<br><br> Follow the instructions to open the link:<br> 1. Type the addres "https://www.torproject.org" in your Internet browser. It opens the Tor site.<br> 2. Press "Download Tor", then press "Download Tor Browser Bundle", install and run it.<br> 3. Now you have Tor browser. In the Tor Browser open "{{URL}}". <br> 4. Start a chat and follow the further instructions. <br><br> <hr> <b>If you can not use the above link, use the email:</b><br> <a href="[email protected]">[email protected]</a> <br><a href="[email protected]">[email protected]</a> <br> <b>* To contact us, create a new mail on the site:</b> <a href="https://protonmail.com">protonmail.com<br> <hr> <b>Make contact as soon as possible. Your private key (decryption key) <br> is only stored temporarily.<br><br> IF YOU DON'T CONTACT US WITHIN 72 HOURS, PRICE WILL BE HIGHER.</b><br> </div> </div> </div> <!--tab--> <!--text data --> </div> </div> <!--tab--> </div> </div> </body> </html>

Targets

    • Target

      b2493a580153291b69ca23190d00a00b1220cd0aadf469b3974fdaa726516649.exe

    • Size

      719KB

    • MD5

      8474039d83805eb7b447325c3a8d1ebb

    • SHA1

      a07d537f4253745a087709a9a07c449f84deed8d

    • SHA256

      b2493a580153291b69ca23190d00a00b1220cd0aadf469b3974fdaa726516649

    • SHA512

      3272091bbf123ba5e1592e8b2bd7740cddcb174fa158bc6980b25ee61d92387e94a25284736253f83a6eea78b427f6717e888e843db9d7759cfe9a7676576438

    • SSDEEP

      12288:q4UOTYQivI2qZ7aSgLwkFVpzUvest4ZEbjJLuhJVoM7SPd:bRTYVQ2qZ7aSgLwuVfstRJL6YM6

    • Detect Neshta payload

    • MedusaLocker

      Ransomware with several variants first seen in September 2019.

    • MedusaLocker payload

    • Modifies system executable filetype association

    • Neshta

      Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.

    • UAC bypass

    • Deletes shadow copies

      Ransomware often targets backup files to inhibit system recovery.

    • Executes dropped EXE

    • Modifies extensions of user files

      Ransomware generally changes the extension on encrypted files.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Checks whether UAC is enabled

    • Drops desktop.ini file(s)

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

MITRE ATT&CK Enterprise v6

Tasks