Resubmissions
23-11-2022 10:29
221123-mh8h9seb73 10Analysis
-
max time kernel
156s -
max time network
174s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
-
submitted
23-11-2022 10:29
General
-
Target
donut.exe
-
Size
164KB
-
MD5
a8b3b71860ca65a9e5e56fa3e27cd92b
-
SHA1
8a5bd8bf26eceaa7adff6e59227646155d220f3e
-
SHA256
9455b7fcf93f0a5a6f9c099fbe938f5a9169f8d3dcc83833aa2c0f903518cfa3
-
SHA512
3837c22458c845b4f05596583f98c8c20ec0424fb46dec39ec11e434b966a6e125c1b1e330e4bdd4921f8a21aeb229f76ba720f8d40af141b737e38fb0e2a65a
-
SSDEEP
1536:mW3XOHHUyrdRpnIsMRgE8Kl70w+ipXEI2W/GxHt/nyaY6uJvtrk3GwzRa0SOO+8W:meXIvxRzMnlQiP29N/yQGwztfO+xV
Score
10/10
Malware Config
Extracted
Path
C:\d0nut.html
Ransom Note
<!DOCTYPE html>
<html lang="en"><head><meta charset="UTF-8"><style>
body{
height: 100vh;
display: flex;
align-items: center;
justify-content: center;
background-color: black;
}
h1{
font-family: 'Oswald', sans-serif;
text-transform: uppercase;
font-size: 90%;
text-align: left;
color: white;
}
span{
display: inline-block;
}
.container {
overflow: hidden;
background-color: black;
height: 100%;
}
.container {
color: white;
display: -webkit-flexbox;
display: -ms-flexbox;
display: -webkit-flex;
display: flex;
-webkit-flex-align: center;
-ms-flex-align: center;
-webkit-align-items: center;
align-items: center;
justify-content: center;
}
</style></head>
<body><link href='https://fonts.googleapis.com/css?family=Oswald:300' rel='stylesheet' type='text/css'>
<div class="container"><pre class="center" id="d"></pre></div><script>
var pretag = document.getElementById("d");
var tmr1 = undefined,
tmr2 = undefined;
var A = 1,
B = 1;
var asciiframe = () => {
var b = [];
var z = [];
A += 0.07;
B += 0.03;
var cA = Math.cos(A),
sA = Math.sin(A),
cB = Math.cos(B),
sB = Math.sin(B);
for (var k = 0; k < 1760; k++) {
b[k] = k % 80 == 79 ? "\n" : " ";
z[k] = 0;
}
for (var j = 0; j < 6.28; j += 0.07) {
var ct = Math.cos(j),
st = Math.sin(j);
for (i = 0; i < 6.28; i += 0.02) {
var sp = Math.sin(i),
cp = Math.cos(i),
h = ct + 2, // R1 + R2*cos(theta)
D = 1 / (sp * h * sA + st * cA + 5),
t = sp * h * cA - st * sA;
var x = 0 | (40 + 30 * D * (cp * h * cB - t * sB)),
y = 0 | (12 + 15 * D * (cp * h * sB + t * cB)),
o = x + 80 * y,
N =
0 |
(8 *
((st * sA - sp * ct * cA) * cB -
sp * ct * sA -
st * cA -
cp * ct * sB));
if (y < 22 && y >= 0 && x >= 0 && x < 79 && D > z[o]) {
z[o] = D;
b[o] = ".,-~:;=!*#$@"[N > 0 ? N : 0];
}
}
}
pretag.innerHTML = b.join("");
};
setInterval(asciiframe, 50)
</script><h1><pre>
So what happened?
All files are encrypted with Integrated Encryption Scheme.
The file structure was not damaged. You have been assigned a unique identifier.
After infection, you have 96 hours to declare decryption.
After the expiration of 96 hours, decryption cost will be automatically increased.
Now you should send us message with your personal ID, which is at the bottom of the message.
We hope that you understand the importance of the work we have done.
Before paying you can send us 2 files for free decryption.
The total size of files must be less than 2Mb.
Files should not contain valuable information (databases, backups, large excel sheets, etc..).
Attention! If you want to RECOVER YOUR DATA without problems - NEVER!!! :
reboot, disconnect hard drives or take any action unless you know WHAT YOU ARE DOING!!!
Otherwise, we cannot be 100% sure that the decryptor will work correctly.
!!!THIS IS ESPECIALLY RELATED TO ESXI!!!
If you will try to use any third party software for restoring your data or antivirus solutions:
this can lead to complete damage to all files and their irrecoverable loss.
Any changes in encrypted files may entail damage of the private key and the loss of all data.
Your personal id: EE10B3B6FF07BE59
Username and password are identical to above.
Since we are using SSL encryption as well as .onion, the certificate is not properly signed.
So in order to get into the chat, you need to confirm the insecure connection exception.
Or just use our embeded APP (Windows version only for now). Thank you for understanding.
You can download TOX here:
https://tox.chat/download.html
You can also write to the chat located in TOR network at:
https://qkbbaxiuqqcqb5nox4np4qjcniy2q6m7yeluvj7n5i5dn7pgpcwxwfid.onion
You can download TOR browser here:
https://www.torproject.org/download/
our TOX below:
D3404141459BC7206CC4AFEC16A3403F262C0937A732C12644E7CA97F0615201A519F7EAB2E2
We hope you carefully read this message and already know what to do.
</pre></h1></body></html>
URLs
https://tox.chat/download.html
https://qkbbaxiuqqcqb5nox4np4qjcniy2q6m7yeluvj7n5i5dn7pgpcwxwfid.onion
Signatures
-
Enumerates connected drives 3 TTPs 24 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
-
Suspicious use of NtSetInformationThreadHideFromDebugger 21 IoCs
-
Drops file in Program Files directory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\donut.exe"C:\Users\Admin\AppData\Local\Temp\donut.exe"1⤵
- Enumerates connected drives
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Program Files directory
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.0MB