General

  • Target

    AOMEIBackupperStd_20230316.3179992.exe

  • Size

    126.6MB

  • Sample

    230316-rwhl8ade7t

  • MD5

    b65b739610a8848d6660482042e13555

  • SHA1

    7f13488223d37deb525e655b358c91ee9c0aa0c6

  • SHA256

    62173ab725397d5ed97e029ec577dec4188c41903d2791c157f27090d8d50058

  • SHA512

    6b0d23f05f8d6d0eb8b754ed2068819a4623529ceba2772f045eb75c189d73d9c2d605d8bf8fa3adfb7cadea1bdc09ffc80867c80471ac53c8d2a433d95a9210

  • SSDEEP

    3145728:AyY9kVTDgrsKMCDAvqWVWz6Pk/+of1fv09gkRIZpc:+mVX8PWVWzik/+oNatWo

Malware Config

Extracted

Path

C:\Program Files (x86)\AOMEI\AOMEI Backupper\7.2.0\Winpe64\lang\en.txt

Ransom Note
;English proof reading + correction ;by Derek Allen ;derek.allen@yahoo.com ;2022-01-01 FontName= FontSize= 10000=Dynamic Disks 10001=Failed Disks 10002=Task Name: 10003=Select a backup time point to check. 10004=Last Backup Time: 10005=Destination Path: 10006=Comments: 10007=Here is a description of the backup task. 10008=The folder does not exist or cannot be accessed. 10009=Add Share or NAS Devices 10010=General 10011=Versions 10012=File List 10013=Disk Map 10014=Backup Scheme 10015=OK 10016=Cancel 10017=Path 10018=Size 10019=Created Time 10020=Path 10021=Include subfolders 10022=Include files 10023=Exclude files 10024=Exclude folders 10025=All 10026= 10027= 10028=Yes 10029=No 10030=Disk%1 10031=Basic MBR 10032=Basic GPT 10033=Offline Disk 10034=Volume 10035=Dynamic 10036=Backup Type 10037=Created Time 10038=Image Path 10039=Here is a description of the sync task. 10040=Here is a description of the backup task. 10041=Full Backup 10042=Incremental Backup 10043=Differential Backup 10044=Run the backup at the event: 10045=User logon 10046=User logoff 10047=System startup 10048=System shutdown 10049=Once a day only 10050=Local Administrator Account and Password: 10051=Local Administrator Account and Password: 10052=Use's windows schedule task(Local Administrator Account and Password). 10053=Full Backup 10054=Incremental Backup 10055=Differential Backup 10056=Run once only at 10057=Run once every day at 10058=Intervals 10059=Start time 10060=Finish time 10061=Within the time indicated above of each day, run it for every 10062=1 hour 10063=2 hours 10064=3 hours 10065=4 hours 10066=6 hours 10067=Choose days: 10068=Time settings: 10069=Monday 10070=Tuesday 10071=Wednesday 10072=Thursday 10073=Friday 10074=Saturday 10075=Sunday 10076= at 10077= to 10078=<i>Note:\nIn every week 10079= at 10080= to perform the task.</i> 10081=<i>Note:\nIn every week 10082=<b>Schedule type:</b> Weekly<br /><br /> <b>Current schedule settings: </b> In every week 10083= to perform the task.</i> 10084=<b>Next run time:</b> 10085=<b>Current schedule settings: </b> Run once at 10086=<b>Schedule type:</b> Daily<br /><br /> 10087=to finish time 10088=of each day, run the backup for every 10089= hours. 10090=Monday 10091=Tuesday 10092=Wednesday 10093=Thursday 10094=Friday 10095=Saturday 10096=Sunday 10097=to perform the task. 10098=<b>Schedule type:</b> Monthly<br /><br /> 10099=in the 10100= "Last Day" 10101=days of each month. 10102=on the 10103=Firstly 10104=Secondly 10105=Thirdly 10106=Fourthly 10107=Finally 10108=Schedule Settings 10109=The partition and disk image files saved on a network cannot be explored, please copy them from the network to a local disk, and then explore. 10110=Please input the correct registration code and retry. 10111=Invalid license code. \nIt does not match with the current version. 10112=Select Share/NAS Device 10113=Editing the destination path does not support to change the \nsaved location of the task from one network to another network path. We suggest you changing it to local path or re-create a new task. 10114=The primary partition cannot be restored to the middle of the two logical partitions. For more information, please refer to FAQ:"<a href="https://www.ubackup.com/help/technical-faq.html">www.ubackup.com/help/technical-faq.html</a>" 10115=at 10116=Failed to open the image file of the backup. 10117=View 10118=General 10119=Advanced 10120=Monthly 10121=Do not schedule 10122=Advanced Settings 10123=User Name: 10124=Password: 10125=Choose a way to perform the scheduled backup: 10126=Local Administrator Account and Password: 10127=Don't install the service, directly use Windows Task Scheduler to run scheduled tasks. 10128=Install a service to run scheduled tasks. 10129=Full Backup 10130=Incremental Backup (Default) 10131=Differential Backup 10132= AOMEI Backupper 10133=Please specify a correct time. The interval time must be less than the time difference between the Finish time and Start time. 10134=Please set a valid time to finish the backup task. The scheduled time should be at least one minute later than the current system time. 10135=AOMEI Backupper 10136=Please specify a time or date for the schedule. 10137=Run once at 10138=of each month. 10139=Run once at 10140=First 10141=Second 10142=Third 10143=Fourth 10144=Last 10145=Monday 10146=Tuesday 10147=Wednesday 10148=Thursday 10149=Friday 10150=Saturday 10151=Sunday 10152=Last Day 10153=<i>Note: Run once at 10154= in the 10155=<i>Note: Run once at 10156= "Last Day" 10157=days of each month.</i> 10158=The file in an image file cannot be mounted or explored by AOMEI Backupper. 10159=Please select the file(s) you want to copy, and then click "Save As" to continue. 10160=days of each month.</i> 10161=Restore 10162=Backup 10163=Advanced 10164=Schedule Backup 10165=Full Backup 10166=Incremental Backup 10167=Differential Backup 10168=Are you sure you want to clean up all historic items? 10169=Delete 10170=Check Image 10171=Explore Image 10172=Locate Image 10173=Edit Backup File 10174=Merge Backup 10175=Properties 10176=Next run: 10177=My Backup 001/n2012-7-2 16:25:44 10178=New Backup 10179=All Backups 10180=Today 10181=Latest Week 10182=Latest Month 10183=Custom Date 10184=to 10185=Name 10186=Capacity 10187=Used Space 10188=Sub Folder 10189=Exclude Folder 10190=Add 10191=Add Folder 10192=Edit 10193=Delete 10194=Yes 10195=No 10196=Add File 10197=Add Folder 10198=The target path cannot be empty, please specify a target location to copy data. 10199=Sorry, the backup contains "differential backup" versions, but the program only supports merging "incremental backup" versions, not merging "differential backup" versions. 10200=Because all versions of this task are full backups, you don't need to merge them 10201=The backup has only one version (one image file), there is no need to merge. 10202=The program only supports merging "incremental backup" versions, not merging "differential backup" versions, so the list box only shows "incremental backup" versions which can be merged. 10203=Capacity 10204=Used Space 10205=AOMEI Backupper 7.2.0 10206=AOMEI Backupper Standard Edition 7.2.0 10207=AOMEI Backupper Beta Edition 7.2.0 10208=AOMEI Backupper Standard Edition 7.2.0 10209=AOMEI Backupper Professional Edition 7.2.0 10210=AOMEI Backupper Server Edition 7.2.0 10211=AOMEI Backupper Technician Edition 7.2.0 10212=Website: <a href="https://www.ubackup.com/?adb">www.ubackup.com</a><br />Email: <a href="mailto:support@aomeitech.com">support@aomeitech.com</a><br /><br />Copyright (c) AOMEI International Network Limited, 2009-2023. <br />All rights reserved. 10213=The program does not support saving the merged image file to a network path, \nwe suggest you to save it to local drive, and then copy it to the network. 10214=The computer will be restarted automatically in %1 seconds. You can click OK to restart immediately or click Cancel to stop the countdown. 10215=This backup location contains differential or full backups which cannot be merged. Only incremental backups can be merged to create a new full backup. 10216=Network Path 10217=Username 10218=Password 10219=Display Name 10220=Anonymous 10221=Link Error! 10222=Network Location 10223=Type 10224=Set IP 10225=Remove 10226=Edit 10227=Username 10228=Password 10229=Folder 10230=File 10231=Here, you can select a folder in the right list box, and click OK to confirm. 10232=Here, you can select a file in the right list box, and click OK to confirm. 10233=Choose the compression level for a backup. The higher level will make a smaller image\nfile, but the backup time is longer. 10234=Normal 10235=High 10236=Data will not be compressed, so this may significantly increase the size of the image file. 10237=Data will be moderately compressed. (Recommended compression level). 10238=Maximum data compression will take a long time to create a backup. 10239=Intelligent Sector Backup(Recommended) 10240=Make an Exact Backup 10241=Only back up the used sectors of file systems, and this will reduce the size of image file and backup time. 10242=Sector by sector backup, and this will backup all sectors of disks or partitions whether used or not. 10243=Enable encryption for backups 10244=Type Password 10245=Confirm Password 10246=Write a note for the backup, e.g. "Photo 3/23/2021". 10247=VSS is a backup technique which is provided by Microsoft.It allows the\nprogram to back up data without interrupting operations in progress.If\nyou don't use VSS, the program will automatically use AOMEI's built-in\ntechnique in order to backup without interrupting and restarting computer. 10248=Use Microsoft VSS 10249=Use AOMEI Backup Service 10250=Specify the way to split a large image file into multiple smaller image files during the backup process. 10251=Automatic(Recommended) 10252=Choose a predetermined size 10253=Custom size 10254=Comments 10255=Compression 10256=Encryption 10257=Splitting 10258=Intelligent Sector 10259=Check Images 10260=Save to global settings 10261=<b>Encryption: </b>The password is empty or inconsistent. 10262=The maximum length of a comment is 2048 characters. 10263=<b>Splitting: </b>The minimum image file size is 50MB. 10264=Enable Automatic Backup Cleanup 10265=Do not delete the image file of the first backup during disk space management. 10266=Incremental backup cycle 10267=The number of basic backups: 10268=Consist of a full backup and its chained incremental backups. 10269=after the next backup finishes. 10270=automatically deleted only after the next backup finishes. 10271= Day(s) 10272= Week(s) 10273= Month(s) 10274= Year(s) 10275=Enter the license code: 10276=<b>Expiration Notice:</b><br />The expired version only supports backup operations, not restore or other operations, you can upgrade to full version to enjoy them. 10277=Please waiting... 10278=Register 10279=Buy Now 10280=Registration successful. 10281=Register failed, invalid registration code. Please repurchase the registration code to register. If you have any questions, please click <a style='color:rgb(45,136,240);text-decoration:none;' href="mailto:support@aomeitech.com">support@aomeitech.com</a> to contact us. 10282=Always check for update at startup 10283=The latest version is checking... 10284=The check is complete. 10285=Information 10286=Failed to connect web server, please detect your internet connection. 10287=Failed to connect web server. 10288=Enter comments here (Optional): 10289=Backup all files 10290=No files need to be excluded 10291=No folders need to be excluded 10292=NAS Connecting... 10293=Files 10294=Skip(180) 10295=Restart Mode Backup 10296=Retry 10297=Rename 10298=Skip 10299=Restart Mode Restore 10301=Retry 10302=The above files are being used by other programs, so they cannot be backed up. Please click the following button to continue. 10303=The above files are being used by other programs, so they cannot be overwritten. Please click the following button to continue. 10304=Skip( 10305=Files 10306=Folders 10307=Folder to backup 10308=File Inclusion Mask 10309=File Exclusion Mask 10310=Folder Exclusion Mask 10311=Enter folder name of full/partial path. Wildcards are supported. Separate multiple entries with a semicolon e.g (c:\temp;temp;*\temp;temp*). 10312=Include subfolders 10313=Exclude hidden files and folders 10314=Exclude system files and folders 10315=Specify the files that you need to backup. \nWildcards are supported and separate multiple masks with semi-colon \n(*.doc;*.xls;*.ppt). 10316=Specify the files that you need to exclude. \nWildcards are supported and separate multiple masks with semi-colon \n(*.temp;*.tmp;*.bak;*~*). 10317=Specify the folders that you need to exclude. \nWildcards are supported and separate multiple masks with semi-colon \n(*temp;temp*). 10318=Filter settings 10319=If you want to backup/sync all files in the %1: drive, we highly suggest you to use the "Partition Backup" function to accomplish it more quickly. 10320=Compression 10321=Splitting 10322=Intelligent Sector 10323=VSS 10324=Reset All 10325=<b>Splitting: </b>The minimum image file size is 50MB. 10326=IP address: 10327=Subnet mask: 10328=Gateway: 10329=Preferred DNS server: 10330=Alternative DNS server: 10331=Obtain an IP address automatically. 10332=Specify an IP address. 10333=Obtain DNS server address automatically. 10334=Specify DNS server address. 10335=Username: 10336=Password: 10337=IP Settings 10338=Anonymous 10339=<b>Network Path:</b> 10340=Input Password: 10341=Input Comments: 10342=The password is incorrect! 10343=Copy without resizing partitions 10344=Add unused space to all partitions 10345=Manually adjust partition size 10346= You could select a partition on the disk panel, and then resize/move it. 10347=Create As: 10348=Drive Letter: 10349=Logical Partition 10350=Primary Partition 10351=<b>Partition size:</b> 10352=Unallocated space before it: 10353=Unallocated space after it: 10354=None 10355=The number of primary partitions on this disk are too much. You can use AOMEI Partition Assistant to convert one of primary partitions on this destination disk to logical partition, and retry. 10356=The operation cannot continue, we suggest you again open the window and reset the parameters. You could change the size of the system partition, but don't change the start location of the system partition. 10357=Disk%1 10358=Volume 10359=Dynamic 10360=Always check for update at startup 10361=Current version: 10362=Latest version: 10363=View More 10364=Simple 10365=Spanned 10366=Striped (RAID0) 10367=Mirrored (RAID1) 10368=RAID5 10369=Bitlocker Encrypted 10370=Unformatted 10371=Others 10372=Unallocated 10373=Unknown 10374=New Version 10375=The current version is the latest. 10376=Info 10377=Unknown Error. 10378=The current operation has been completed. 10379=Unmount drive letter fail, please reboot and retry. 10380=Failed to assign a drive letter for the volume, please manually add a drive letter for the volume by disk management. 10381=Dismount the volume fail, the program cannot process the volume, please reboot and retry. 10382=Failed to lock the volume, please reboot and retry. 10383=Failed to unlock the volume, please reboot to access the volume by Explorer 10384=The partition table on the disk was updated fail as other programs locked the partition table, please close other programs and retry. 10385=Timeout to allocate GUID for changing drive letter, please reboot and retry 10386=Partition table overlap & the following operations will stop. Reboot computer recommended. 10387=Not enough memory, please close and re-run the program and try again, or you could reboot computer and release more memory to retry. 10388=Failed to open disk. 10389=The operation has been cancelled. 10390=Invalid parameter. 10391=Failed to read sectors. It may be because the backup source has a bad sector or the backup source is missing. 10392=Failed to write sector (with bad sector). 10393=Failed to open the volume. It may be locked by other programs. 10394=Failed to extend partition by using Windows Control Code, please reboot and retry. 10395=Some bad sectors exist in FAT table. 10396=Certain bad sector exists in DBR. 10397=Error in DBR parameters. Failed to initialize DBR. Or, failed to read and write disk sector. 10398=Failed to initialize $MFT file due to error in file system. Please amend it by using CHKDSK.EXE in CMD to retry. 10399=Failed to initialize MFT: BITMAP file due to error in file system. Please amend it by using CHKDSK.EXE in CMD to retry. 10400=Failed to read the file record, there are some physical bad clusters on the disk. 10401=Failed to initialize the DATARUNLIST, please try to use CHKDSK.EXE in command prompt to fix and retry. 10402=Failed to get BadClus info, please try to use CHKDSK.EXE in command prompt to fix and retry. 10403=Too many fragment files on the volume needs to be defragged. 10404=Failed to initialize FILE RECORD due to error in file system. Please amend it by usin
Emails

derek.allen@yahoo.com

href="mailto:support@aomeitech.com">support@aomeitech.com</a><br

href="mailto:support@aomeitech.com">support@aomeitech.com</a>

support@aomeitech.com

support@aomeitech.com<br

URLs

https://www.ubackup.com/features/UEFI-restore.html

https://www.ubackup.com/help/technical-faq.html

https://www.ubackup.com/help/aik.html

Targets

    • Target

      AOMEIBackupperStd_20230316.3179992.exe

    • Size

      126.6MB

    • MD5

      b65b739610a8848d6660482042e13555

    • SHA1

      7f13488223d37deb525e655b358c91ee9c0aa0c6

    • SHA256

      62173ab725397d5ed97e029ec577dec4188c41903d2791c157f27090d8d50058

    • SHA512

      6b0d23f05f8d6d0eb8b754ed2068819a4623529ceba2772f045eb75c189d73d9c2d605d8bf8fa3adfb7cadea1bdc09ffc80867c80471ac53c8d2a433d95a9210

    • SSDEEP

      3145728:AyY9kVTDgrsKMCDAvqWVWz6Pk/+of1fv09gkRIZpc:+mVX8PWVWzik/+oNatWo

    • Executes dropped EXE

    • Loads dropped DLL

    • Registers COM server for autorun

    • Adds Run key to start application

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

    • Writes to the Master Boot Record (MBR)

      Bootkits write to the MBR to gain persistence at a level below the operating system.

    • Drops file in System32 directory

MITRE ATT&CK Matrix ATT&CK v6

Persistence

Registry Run Keys / Startup Folder

2
T1060

Bootkit

1
T1067

Defense Evasion

Modify Registry

3
T1112

Discovery

Query Registry

2
T1012

System Information Discovery

2
T1082

Tasks