General

  • Target

    804cc598b3b5f0c4e11a184a2f5da4b668ad1557eee972894e99aef781fff7a1

  • Size

    1.0MB

  • Sample

    221124-wqgvysba42

  • MD5

    3bec3b0adf1e8e1e1ccc8dc6751c16b0

  • SHA1

    92adb33367fd4192ce80cc0a734416b29742d050

  • SHA256

    804cc598b3b5f0c4e11a184a2f5da4b668ad1557eee972894e99aef781fff7a1

  • SHA512

    d17cf5d2fcc7b7a7ee3a1aaa9f287caa4703690f4e7089db3022524a3aa7cf589d4f63a62a89f4f8ae1e2cce3a5f043bd82df8c960d545a719abb71097bd3fef

  • SSDEEP

    12288:uAAligk8G2carFVcVKcovYGm4+UDQcZiRU0W7AGpnYgzQsAFv0XVE7gPsZpGnnvO:ulKvwrkKc2/IUB7A8AFv0X27HZkv8

Score
10/10

Malware Config

Extracted

Path

C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\Desktop\HELP.TXT

Ransom Note
[+] What happened? [+] Your files are downloaded, encrypted, and currently unavailable. You can check it. By the way, everything is possible to recover(restore), but you need to follow our instructions.Otherwise, you can't return your data(NEVER). [+] What should i do ? [+] To decrypt your files you need to buy our special software General - Decryptor. [+] How to buy General - Decryptor ? [+] Visit our web - site and follow the instructions on it. [+] What guarantees ? [+] It's just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. It's not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt some files for free. That is our guarantee.If you will not cooperate with our service - for us, it's does not matter. After deadline we will publish all the contents of your company to site and will send all information to your clients and mass media. You will lose your time, data and reputation. [+] How to get access on website and contact us ? [+] Open a website specially designed for you: a) Using a TOR browser: Download and install TOR browser from this site: https://torproject.org/ http://lorenzedzgezlufsyu26s5onxjjakikbpbwo7km6upptlxp5m3ytftad.onion b) Using usual browser : http://lorenzedzgezlufsyu26s5onxjjakikbpbwo7km6upptlxp5m3ytftad.onion.ly When you open our website, put the following data in the input form: Company Key: VmpKMGFtVkdTWGxTV0docFVtMTRWMWxzYUc5WlZsSllUVmQwVGxadFVsWlZNVkpYWVRGS1ZrNVlWbFpTYkVZelZUTmtkbEJSYnowSwo= [+] Check our website with leaks [+] a) Using a TOR browser: http://lorenzmlwpzgxq736jzseuterytjueszsvznuibanxomlpkyxk6ksoyd.onion b) Using usual browser: https://lorenzmlwpzgxq736jzseuterytjueszsvznuibanxomlpkyxk6ksoyd.onion.ly
URLs

http://lorenzedzgezlufsyu26s5onxjjakikbpbwo7km6upptlxp5m3ytftad.onion

http://lorenzedzgezlufsyu26s5onxjjakikbpbwo7km6upptlxp5m3ytftad.onion.ly

http://lorenzmlwpzgxq736jzseuterytjueszsvznuibanxomlpkyxk6ksoyd.onion

https://lorenzmlwpzgxq736jzseuterytjueszsvznuibanxomlpkyxk6ksoyd.onion.ly

Targets

    • Target

      804cc598b3b5f0c4e11a184a2f5da4b668ad1557eee972894e99aef781fff7a1

    • Size

      1.0MB

    • MD5

      3bec3b0adf1e8e1e1ccc8dc6751c16b0

    • SHA1

      92adb33367fd4192ce80cc0a734416b29742d050

    • SHA256

      804cc598b3b5f0c4e11a184a2f5da4b668ad1557eee972894e99aef781fff7a1

    • SHA512

      d17cf5d2fcc7b7a7ee3a1aaa9f287caa4703690f4e7089db3022524a3aa7cf589d4f63a62a89f4f8ae1e2cce3a5f043bd82df8c960d545a719abb71097bd3fef

    • SSDEEP

      12288:uAAligk8G2carFVcVKcovYGm4+UDQcZiRU0W7AGpnYgzQsAFv0XVE7gPsZpGnnvO:ulKvwrkKc2/IUB7A8AFv0X27HZkv8

    Score
    10/10
    • Modifies extensions of user files

      Ransomware generally changes the extension on encrypted files.

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

MITRE ATT&CK Matrix ATT&CK v6

Discovery

Query Registry

1
T1012

Peripheral Device Discovery

1
T1120

System Information Discovery

1
T1082

Tasks