Analysis
-
max time kernel
61s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
-
submitted
23/12/2022, 08:00
General
-
Target
7b379458349f338d22093bb634b60b867d7fd1873cbd7c65c445f08e73cbb1f6.exe
-
Size
143KB
-
MD5
6307838a9cef952321a44cc3e189213e
-
SHA1
2b3fea431f342c7b8bcff4b89715002e44d662c7
-
SHA256
7b379458349f338d22093bb634b60b867d7fd1873cbd7c65c445f08e73cbb1f6
-
SHA512
3b31e14fdfa6ecd33a0086b3db84ac1b0fef97a40cb82115007c69680e201c22bb638af4a4255dd21a2219e1143f1c940b4308d618467d9f0f22b0bab40cf18d
-
SSDEEP
1536:4uFohxL86e7tnkZXYklWXuiMqeGKPPRxPv8/0JS1CjhSlUUbvF7kFrWyaBvEEUAX:4RhxktIWTMqPKPPH1yUUB4kVUXsB/
Score
10/10
Malware Config
Extracted
Path
C:\!-Recovery_Instructions-!.html
Ransom Note
<!DOCTYPE html>
<html lang="en">
<head>
<meta charset='utf-8'>
<meta name='viewport' content='width=device-width,initial-scale=1'>
<title></title>
<style>
html, body {
background-color: #1a1a1a;
}
body {
padding-top: 1rem !important;
font-size: 1.3rem;
color: white;
}
#text h2 {
font-size: 2rem;
font-weight: 600;
line-height: 1.125;
}
.container {
max-width: 1152px;
flex-grow: 1;
margin: 0 auto;
position: relative;
width: auto;
}
.box {
background-color: #242424;
display: block;
padding: 1.25rem;
border: 1px solid #303030;
}
a {
color: #00b4d8;
text-decoration: none;
}
a:hover {
text-decoration: underline;
}
li {
margin-bottom: 10px;
}
</style>
</head>
<body>
<div class='container'>
<div class='box'>
<div id='text'>
<h2>If you get this message, your network was hacked!</h2>
<p>After we gained full access to your servers, we first downloaded a large amount of sensitive data and then encrypted all the data stored on them.</p>
<p>That includes personal information on your clients, partners, your personnel, accounting documents, and other crucial files that are necessary for your company to work normally.</p>
<p>We used modern complicated algorithms, so you or any recovery service will not be able to decrypt files without our help, wasting time on these attempts instead of negotiations can be fatal for your company.</p>
<p>Make sure to act within <span style='color:#f4a261;'>72</span> hours or the negotiations will be considered failed!</p>
<p>Inform your superior management about what's going on.</p>
<p> Contact us for price and get decryption software.</p>
<p> Contact us by email:<p>
<h2>[email protected]</h2>
</p>If you will get no answer within 24 hours contact us by our alternate emails:</p>
<h2>[email protected]</h2>
</p>To verify the possibility of the recovery of your files we can decrypted 1-3 file for free.</p>
</p>Attach file to the letter (no more than 5Mb).</p>
<h2>If you and us succeed the negotiations we will grant you:</h2>
<ul>
<li>complete confidentiality, we will keep in secret any information regarding to attack, your company will act as if nothing had happened.</li>
<li>comprehensive information about vulnerabilities of your network and security report.</li>
<li>software and instructions to decrypt all the data that was encrypted.</li>
<li>all sensitive downloaded data will be permanently deleted from our cloud storage and we will provide an erasure log.</li>
</ul>
<h2>Our options if you act like nothing's happening, refuse to make a deal or fail the negotiations:</h2>
<ul>
<li>inform the media and independent journalists about what happened to your servers. To prove it we'll publish a chunk of private data that you should have ciphered if you care about potential breaches.
Moreover, your company will inevitably take decent reputational loss which is hard to assess precisely.</li>
<li>inform your clients, employees, partners by phone, e-mail, sms and social networks that you haven't prevent their data leakage.
You will violate laws about private data protection.</li>
<li>start DDOS attack on you website and infrastructures.</li>
<li>personal data stored will be put on sale on the Darknet to find anyone interested to buy useful information regarding your company. It could be data mining agencies or your market competitors.</li>
<li>publish all the discovered vulnerabilities found in your network, so anyone will do anything with it.</li>
</ul>
<h2>Why pay us?</h2>
<p>We care about our reputation. You are welcome to google our cases up and be sure that we don't have a single case of failure to provide what we promissed.</p>
<p>Turning this issue to a bug bounty will save your private information, reputation and will allow you to use the security report and
avoid this kind of situations in future.</p>
<h2>Your personal ID</p>
F53CA982CBFF028296099233D4A852597EDD72E851B5C651F18A07F7862BFA
82AE1A76E22F5934AF2868BA98C25948DBD42282151F7E8BE75259D8B812D5
16AEE49B3E081FDDDEC5760E01820D175735B4124EF828F669699409202894
A79DE559FF2B3761BE59DF6B3E2727A30CBA11985A2A09A82816EA8C9F7BB1
F3917635895D31EAC5F32144107FF2F50618E2254A62DD76648165CF39F497
1489AC980B41FDA39A06B294AEC8D2EED20C39D258FA31239BA4C1F4BA47EB
F8755BEF2A88410D6B9EE494A4EE88CAD588B703024EFFCD249EF0DF1ED4BE
49ECBD6CA9EC907201C50E11B7C84568D2F0612073032D23079EB3EA974597
6B56D07513F90F13456045C8163B5BE2EEEEE07BEFCA5C2CDA75623938CCCB
87E4845EDF3482DB9F720F1A38BC26FAA508D98BC230C6984BF87BB5475766
78DCB87EFEF1DFE543E01005C5FD0DC125671B0B7D040A76E514C7D26D93C5
092D4165169474C49D9BDC1C40E1996A56BF180A34A55BE2B1668EC3E2BD61
E8F2CE333D8D51DD100482FBCF34AAF6E7AB484AA365D92142426C43C7AA30
4D3623138C3AFAEA22095513D823626C7B1802B1CC1D13BFFF0B08DDEE0DD4
72889413E557BEDC606D038F35E82B8B07D2EE129A8B98EA181B33CFA8230C
17B6036679E4BDF910C4E423E2F56BC86A0340C4765BA4424CBB5AABC7A37E
FF673EC7901297355B5F522C18E1D8839FB5CEC5B8C2A2BED626974B03D7BC
9DC8E98900D649AA99639062AB4EA9B27C48A16E9D000B99797C857D14A767
CDB05E1042C94ACE612BBF00C0D559BD9ACAE60EAC655A7B769679E3E0136B
440564422279438621D32E362C98A9C4FE2786160D49AD61A5360653266CE6
3D658FA8E831653DCCA3D249C8019C2414A4339C9CE6D7839733FC8A919B3D
B3702ED2308F49FE84C6E684B4D7E6CEA023E437D5FC9D1ABFE36C4C1DF842
7CA11DA5C62811A134190F75E233BFDE6B2E165FE2EA5A61CA9513098E30CF
41875BB0F26BFAC0C1EE2569BD96BDD4316B9BEA7783329C6649BC2171A936
998E70ACBEF4B16BE95956BAFBA5F1680650743627465B7D7CEC745685B691
7F613FF37FDD60A4C0A42FC9A276FC15210118B014AB17BB0F476FB94C96BD
F701
Emails
<h2>[email protected]</h2>
<h2>[email protected]</h2>
Signatures
-
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Modifies extensions of user files 5 IoCs
Ransomware generally changes the extension on encrypted files.
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Drops desktop.ini file(s) 28 IoCs
-
Enumerates connected drives 3 TTPs 1 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
-
Drops file in Program Files directory 64 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Interacts with shadow copies 2 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
-
Suspicious use of AdjustPrivilegeToken 4 IoCs
-
Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\7b379458349f338d22093bb634b60b867d7fd1873cbd7c65c445f08e73cbb1f6.exe"C:\Users\Admin\AppData\Local\Temp\7b379458349f338d22093bb634b60b867d7fd1873cbd7c65c445f08e73cbb1f6.exe"1⤵
- Modifies extensions of user files
- Checks computer location settings
- Drops desktop.ini file(s)
- Enumerates connected drives
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /c vssadmin.exe Delete Shadows /All /Quiet reg delete "HKEY_CURRENT_USER\Software\Microsoft\Terminal Server Client\Default" /va /f reg delete "HKEY_CURRENT_USER\Software\Microsoft\Terminal Server Client\Servers" /f reg add "HKEY_CURRENT_USER\Software\Microsoft\Terminal Server Client\Servers" cd %userprofile%\documents\ attrib Default.rdp -s -h del Default.rdp for /F "tokens=*" %1 in ('wevtutil.exe el') DO wevtutil.exe cl "%1"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\vssadmin.exevssadmin.exe Delete Shadows /All /Quiet3⤵
- Interacts with shadow copies
-
-
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\7b379458349f338d22093bb634b60b867d7fd1873cbd7c65c445f08e73cbb1f6.exe > nul2⤵
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken