Overview

overview

10

Static

static

10

9708006633.zip

windows7-x64

1

9708006633.zip

windows10-2004-x64

1

1bc0575b3f...81.exe

windows7-x64

10

1bc0575b3f...81.exe

windows10-2004-x64

10

out.exe

windows7-x64

out.exe

windows10-2004-x64

Sharing

Copy URL
Twitter E-mail

General

  • Target

    9708006633.zip

  • Size

    231KB

  • Sample

    230323-vhwtgaha47

  • MD5

    1707bf8537daa1d7cf0f437ef1ad5565

  • SHA1

    62735ca85e497baefc4da7dd72adb6c01f88e27b

  • SHA256

    1af845c322838b612007fc65a9642777d5123a0d74fd01adea7991485e022ded

  • SHA512

    b59c14d2311f0ae86a86e471686bf610c5945bd45a175d525103b19612437e5709d3d4f2afe2de4f3ec175dc0e94918b0928644b5fc9e421f829e64698daa6b0

  • SSDEEP

    6144:IU/sfrwGRTGzUN/H2vre7x54bcGKjbrevFM+eEaCG:Itrtuy7xib7MbKG+eEaD

Score
10/10
medusalockerevasionransomwarespywarestealertrojanupx

Malware Config

Extracted

Path

C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\HOW_TO_RECOVER_DATA.html

Ransom Note
<html> <style type="text/css"> body { background-color: #f5f5f5; } h1, h3{ text-align: center; text-transform: uppercase; font-weight: normal; } /*---*/ .tabs1{ display: block; margin: auto; } .tabs1 .head{ text-align: center; float: top; padding: 0px; text-transform: uppercase; font-weight: normal; display: block; background: #81bef7; color: #DF0101; font-size: 30px; } .tabs1 .identi { font-size: 10px; text-align: center; float: top; padding: 15px; display: block; background: #81bef7; color: #DFDFDF; } .tabs .content { background: #f5f5f5; /*text-align: center;*/ color: #000000; padding: 25px 15px; font-size: 15px; font-weight: 400; line-height: 20px; } .tabs .content a { color: #df0130; font-size: 23px; font-style: italic; text-decoration: none; line-height: 35px; } .tabs .content .text{ padding: 25px; line-height: 1.2; } </style> <body> <div class="tabs1"> <div class="head" ><b>Your personal ID:</b></div> <div class="identi"> <span style="width:1000px; color: #ffffff; font-size: 10px;">42C16D86E9CCCF9C3EAFC34C190F673268BC5AD7F36463ED7D742ECD225FFDF69DC15EDB337EDA9566F12E9D5834F73AADC2A269C7618FDA2ADCB5C96D26215C<br>F2F3811334A11C02F77596252B5E5F34E828F7D725418A6A9F1F0D28E5B114407EB73F88EC106B5926D2C5CED04AF66E123854DE26AEF7059B09BA81BBB5<br>716BD944F678B941D40EEF4A6E141402DBFC5C31ED2365F766CD3ACA821A8D845918B0A4A8549B03A9690D44340F0006A9C37BCE74A097AC006DB1F1EE3A<br>E5A5BBFBAA074DD76D864CB754E7E2769A66461A62AD3240B7CB7F2828563402280F1A7294B81682E8B112565C194767642FC612814A706A0DBA4BF10208<br>9C9045EF827F14B1BEA49ECEA4A1179B9403CDEAD3FC2FEA11523F98DACB4522F827CB6C9AEC635E7CA2E047DAA1156BC2C0B0AD734B60FFACD5B1996C50<br>1600697A7564245E13D0707B33048C522449A5206F2DDDC33B2975636FA636217B22808498759849C9EEDDBA14C8877F9FFA9E2EE9F34A49FE3DECD1A123<br>BD57BC08412D703F2AF2DA1566977C9908163A49FF5A28A3B9267BF94C6EE5D987FDD4DDAA5638DD3A6179DDD3B2E930F6B00105688BBBED374E322CE075<br>2137C59A66DC6105410FC3E39495BD30036CC2A073C956A8AA539BAFF4E35284247F35F21A41A04832542988B38ED21C856EABFCBC9F192C168E1D8FF4C4<br>247E1394FBFDACA1870508E2268E</span> <br> <!-- !!! dont changing this !!! --> </div> </div> <!-- --> <div class="tabs"> <!--tab--> <div class="tab"> <div id="tab-content1" class="content"> <div class="text"> <!--text data --> <b>/!\ YOUR COMPANY NETWORK HAS BEEN PENETRATED /!\</b><br> <b>All your important files have been encrypted!</b><br><br> <hr> Your files are safe! Only modified. (RSA+AES)<br><br> ANY ATTEMPT TO RESTORE YOUR FILES WITH THIRD-PARTY SOFTWARE<br> WILL PERMANENTLY CORRUPT IT.<br> DO NOT MODIFY ENCRYPTED FILES.<br> DO NOT RENAME ENCRYPTED FILES.<br><br> No software available on internet can help you. We are the only ones able to<br> solve your problem.<br><br> We gathered highly confidential/personal data. These data are currently stored on<br> a private server. This server will be immediately destroyed after your payment.<br> If you decide to not pay, we will release your data to public or re-seller.<br> So you can expect your data to be publicly available in the near future..<br><br> We only seek money and our goal is not to damage your reputation or prevent<br> your business from running.<br><br> You will can send us 2-3 non-important files and we will decrypt it for free<br> to prove we are able to give your files back.<br><br> <!--text data --> <hr> <b>Contact us for price and get decryption software.</b><br><br> <a>qd7pcafncosqfqu3ha6fcx4h6sr7tzwagzpcdcnytiw3b6varaeqv5yd.onion</a><br> * Note that this server is available via Tor browser only<br><br> Follow the instructions to open the link:<br> 1. Type the addres "https://www.torproject.org" in your Internet browser. It opens the Tor site.<br> 2. Press "Download Tor", then press "Download Tor Browser Bundle", install and run it.<br> 3. Now you have Tor browser. In the Tor Browser open <a>qd7pcafncosqfqu3ha6fcx4h6sr7tzwagzpcdcnytiw3b6varaeqv5yd.onion<br> </a> 4. Start a chat and follow the further instructions. <br> <hr> <b>If you can not use the above link, use the email:</b><br> <a href="[email protected] ">[email protected] </a> <br> <a href="[email protected] ">[email protected] </a> <br> <p>* To contact us, create a new free email account on the site: <a href="https://protonmail.com">protonmail.com <br> <b> IF YOU DON'T CONTACT US WITHIN 72 HOURS, PRICE WILL BE HIGHER.</b><br> </div> </div> </div> <!--tab--> <!--text data --> </div> </div> <!--tab--> </div> </div> </body> </html>

Extracted

Path

\Device\HarddiskVolume1\Boot\HOW_TO_RECOVER_DATA.html

Ransom Note
<html> <style type="text/css"> body { background-color: #f5f5f5; } h1, h3{ text-align: center; text-transform: uppercase; font-weight: normal; } /*---*/ .tabs1{ display: block; margin: auto; } .tabs1 .head{ text-align: center; float: top; padding: 0px; text-transform: uppercase; font-weight: normal; display: block; background: #81bef7; color: #DF0101; font-size: 30px; } .tabs1 .identi { font-size: 10px; text-align: center; float: top; padding: 15px; display: block; background: #81bef7; color: #DFDFDF; } .tabs .content { background: #f5f5f5; /*text-align: center;*/ color: #000000; padding: 25px 15px; font-size: 15px; font-weight: 400; line-height: 20px; } .tabs .content a { color: #df0130; font-size: 23px; font-style: italic; text-decoration: none; line-height: 35px; } .tabs .content .text{ padding: 25px; line-height: 1.2; } </style> <body> <div class="tabs1"> <div class="head" ><b>Your personal ID:</b></div> <div class="identi"> <span style="width:1000px; color: #ffffff; font-size: 10px;">515075E2126DC1FB74CC8970D65C0F5580286B0A0390E2F8E2DCC26D9162F06F83F3CE511DA9CE28B76662D1C784F9C7572BD15B4DBCC76F2038011177D08A91<br>6E68816FD04C13696C4D1B76F632729374AF9D2E49B2E8745430BD384DC3C288CFEF81696AC5CFBCA4FAF2EB7B203A563957B3EDF780FC4B3473351020C6<br>C6E98189807019241D8FC8F197B0D1224A02D5FF4831755630E1BFF3EFEE08ACBC8286028321A5D0C118F8DA931BF4965F7CA2912AC2FA92D2E6B1189719<br>4E58BD4D0C6A41F334210F7D82F93C968C81FC72FDA990BC80EBD2F122FE466FD526341E47EF18E899ADDDB2E466C6DDD842E1F3C0AA27118736BA8F43E4<br>81EF07CD2AA71E20704375528787C4F06F21C7FAB6F17CF0BA9BD09BAF5D1E8538C8301D935B6E14ED76F566158F0533D3FF5CD7097026F4F73215AD7689<br>DB16C3682CE18B49C233A7158A98384E4AA2D61246509F01F47D798A7601AEF6F92D3193E027623857909CDF6C3E27BEB7CA259AF6722F6B4D21A84633A2<br>8CC5112900319ACFCF0AE21E8627961BD4948D6AB5FB141C8D752925FDA8B55913290ACCFB10DF71ADF7C1601867D2716BBD4528F6D181CBACB8023BBD2A<br>0FBCE6D9D741F142FA6F147F06AA78472713A978BD55B171439C4CD089529A4E25F4DD90D512DB9A7F5ED54749787F1727B3313B2D3FDFD13CFEFDC741FC<br>A89A717A13D1D89BA13C87235C5F</span> <br> <!-- !!! dont changing this !!! --> </div> </div> <!-- --> <div class="tabs"> <!--tab--> <div class="tab"> <div id="tab-content1" class="content"> <div class="text"> <!--text data --> <b>/!\ YOUR COMPANY NETWORK HAS BEEN PENETRATED /!\</b><br> <b>All your important files have been encrypted!</b><br><br> <hr> Your files are safe! Only modified. (RSA+AES)<br><br> ANY ATTEMPT TO RESTORE YOUR FILES WITH THIRD-PARTY SOFTWARE<br> WILL PERMANENTLY CORRUPT IT.<br> DO NOT MODIFY ENCRYPTED FILES.<br> DO NOT RENAME ENCRYPTED FILES.<br><br> No software available on internet can help you. We are the only ones able to<br> solve your problem.<br><br> We gathered highly confidential/personal data. These data are currently stored on<br> a private server. This server will be immediately destroyed after your payment.<br> If you decide to not pay, we will release your data to public or re-seller.<br> So you can expect your data to be publicly available in the near future..<br><br> We only seek money and our goal is not to damage your reputation or prevent<br> your business from running.<br><br> You will can send us 2-3 non-important files and we will decrypt it for free<br> to prove we are able to give your files back.<br><br> <!--text data --> <hr> <b>Contact us for price and get decryption software.</b><br><br> <a>qd7pcafncosqfqu3ha6fcx4h6sr7tzwagzpcdcnytiw3b6varaeqv5yd.onion</a><br> * Note that this server is available via Tor browser only<br><br> Follow the instructions to open the link:<br> 1. Type the addres "https://www.torproject.org" in your Internet browser. It opens the Tor site.<br> 2. Press "Download Tor", then press "Download Tor Browser Bundle", install and run it.<br> 3. Now you have Tor browser. In the Tor Browser open <a>qd7pcafncosqfqu3ha6fcx4h6sr7tzwagzpcdcnytiw3b6varaeqv5yd.onion<br> </a> 4. Start a chat and follow the further instructions. <br> <hr> <b>If you can not use the above link, use the email:</b><br> <a href="[email protected] ">[email protected] </a> <br> <a href="[email protected] ">[email protected] </a> <br> <p>* To contact us, create a new free email account on the site: <a href="https://protonmail.com">protonmail.com <br> <b> IF YOU DON'T CONTACT US WITHIN 72 HOURS, PRICE WILL BE HIGHER.</b><br> </div> </div> </div> <!--tab--> <!--text data --> </div> </div> <!--tab--> </div> </div> </body> </html>

Targets

    • Target

      9708006633.zip

    • Size

      231KB

    • MD5

      1707bf8537daa1d7cf0f437ef1ad5565

    • SHA1

      62735ca85e497baefc4da7dd72adb6c01f88e27b

    • SHA256

      1af845c322838b612007fc65a9642777d5123a0d74fd01adea7991485e022ded

    • SHA512

      b59c14d2311f0ae86a86e471686bf610c5945bd45a175d525103b19612437e5709d3d4f2afe2de4f3ec175dc0e94918b0928644b5fc9e421f829e64698daa6b0

    • SSDEEP

      6144:IU/sfrwGRTGzUN/H2vre7x54bcGKjbrevFM+eEaCG:Itrtuy7xib7MbKG+eEaD

    Score
    1/10
    behavioral1behavioral2

    • Target

      1bc0575b3fc6486cb2510dac1ac6ae4889b94a955d3eade53d3ba3a92d133281

    • Size

      235KB

    • MD5

      f6f120d1262b88f79debb5d848ac7db9

    • SHA1

      1339282f9b2d2a41326daf3cf284ec2ae8f0f93c

    • SHA256

      1bc0575b3fc6486cb2510dac1ac6ae4889b94a955d3eade53d3ba3a92d133281

    • SHA512

      1067c1a73cf891d651fa007f4ccc4452f32801fe3859933ef1bcc00985e35ce016fa6c601c0e3c10df2080fc9b8a776b2f18d40bd64dfb98177ab638c4b545bd

    • SSDEEP

      6144:c5vMUmRTTgwnfeP+Jx1cLNAIyBcc9WrEWUC4wQh/6BeX:/U8Tgufnx1cLNncgQWUUQh/+e

    Score
    10/10
    medusalockerevasionransomwarespywarestealertrojanupx

    • MedusaLocker

      Ransomware with several variants first seen in September 2019.

      ransomwaremedusalocker

    • MedusaLocker payload

    • UAC bypass

      evasiontrojan

    • Deletes shadow copies

      Ransomware often targets backup files to inhibit system recovery.

      ransomware

    • Modifies extensions of user files

      Ransomware generally changes the extension on encrypted files.

      ransomware

    • Executes dropped EXE

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Checks whether UAC is enabled

      evasiontrojan

    • Drops desktop.ini file(s)

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    behavioral3behavioral4

    • Target

      out.upx

    • Size

      669KB

    • MD5

      3f002221f0a15187df187cb222d0cb6b

    • SHA1

      0fa815635807c05c2f0e85f0f09362a8e90d1324

    • SHA256

      ae00ad8ba6abc6ddac815187f1285cba597d0af8fa4d5ffe429bffb3b6140b5b

    • SHA512

      08bab72bb09b96685f949845858cbaa4f709f7069971ad1f36849cd3f8fde699c1a2d1c0ae5ee397d57057c81c98f6be41c64caaa5e9435d92e10fa1623660d5

    • SSDEEP

      12288:gQA0FfTcwpBuV2UxqDmuiLZeUaoFi2XZWfGe615HhAZV8DdI:Muf4wTuV2Ux3uIZeUBi2Te6HW4I

    Score
    1/10
    behavioral5behavioral6

MITRE ATT&CK Enterprise v6

Tasks