Overview

overview

10

Static

static

10

9682372408.zip

windows7-x64

1

9682372408.zip

windows10-2004-x64

1

1bc0575b3f...81.exe

windows7-x64

10

1bc0575b3f...81.exe

windows10-2004-x64

10

out.exe

windows7-x64

out.exe

windows10-2004-x64

Resubmissions

23-03-2023 17:09

230323-vpjgqaba6z 10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    9682372408.zip

  • Size

    231KB

  • Sample

    230323-vpjgqaba6z

  • MD5

    1707bf8537daa1d7cf0f437ef1ad5565

  • SHA1

    62735ca85e497baefc4da7dd72adb6c01f88e27b

  • SHA256

    1af845c322838b612007fc65a9642777d5123a0d74fd01adea7991485e022ded

  • SHA512

    b59c14d2311f0ae86a86e471686bf610c5945bd45a175d525103b19612437e5709d3d4f2afe2de4f3ec175dc0e94918b0928644b5fc9e421f829e64698daa6b0

  • SSDEEP

    6144:IU/sfrwGRTGzUN/H2vre7x54bcGKjbrevFM+eEaCG:Itrtuy7xib7MbKG+eEaD

Score
10/10
medusalockerevasionransomwarespywarestealertrojanupx

Malware Config

Extracted

Path

C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\HOW_TO_RECOVER_DATA.html

Ransom Note
<html> <style type="text/css"> body { background-color: #f5f5f5; } h1, h3{ text-align: center; text-transform: uppercase; font-weight: normal; } /*---*/ .tabs1{ display: block; margin: auto; } .tabs1 .head{ text-align: center; float: top; padding: 0px; text-transform: uppercase; font-weight: normal; display: block; background: #81bef7; color: #DF0101; font-size: 30px; } .tabs1 .identi { font-size: 10px; text-align: center; float: top; padding: 15px; display: block; background: #81bef7; color: #DFDFDF; } .tabs .content { background: #f5f5f5; /*text-align: center;*/ color: #000000; padding: 25px 15px; font-size: 15px; font-weight: 400; line-height: 20px; } .tabs .content a { color: #df0130; font-size: 23px; font-style: italic; text-decoration: none; line-height: 35px; } .tabs .content .text{ padding: 25px; line-height: 1.2; } </style> <body> <div class="tabs1"> <div class="head" ><b>Your personal ID:</b></div> <div class="identi"> <span style="width:1000px; color: #ffffff; font-size: 10px;">EF148EB64B304FC9E928DE8BA2C82B3B7FA80EFEA516A74C2B71A585EE4ADFACA3ECBE613BFD212630757F7A4D998F89E034951EB2B6C956DC8AF8165209EDF1<br>6FE67CEE9066868AB42581ED4C34419B672ABFE12EB9A82C83594569D81DF618C23D7514057B0FF7635AF533D1DEE6B85FC22AE89873F2457DEE79E29E47<br>6B11F586117D3AF81A83E6D7888068C6A2F1F58181D9148945F4B84BDE4C40564A8A229308C4B6B6D3FC8E22BD88D90DFDF816166657E6246EC47092D592<br>2A2E33BF2A0862513FE817089E81687ADDB54CCED0086785B9EDF53D9AA3DAC2E15E0DE4A129909B494CA1B5C9254E961BA8892F079DC8574C296B971F77<br>BD32FF5E2361F606E42E10B6F8AC42A90E4111687A83CED3FF82CCBF61EEF45B021E773E5818619FB8B52B717EDFCE4872B9C0A68014561CB6BAE7D1C84E<br>D0450CD3737D488337BABE33D9859D3C7C844D5D6882561B3093BC39DE66E222E851DCBEB288CA6106BDAF21BE476872E9A551E1A335146FEE98C3F37A93<br>370C7736BFF5D3E64485DE34CEA79218E355946F624669A3E0269D49EAD828B7ED1F811FFC080E6AE72F2F17D4217A75AA2A047AF69069C5D2DA46129EC3<br>54117BDE4CF9E15F1B0AA49BC0FA01001441A51B357FAF30DFC5D61F67FE2DB7AF81B86286298CADD616F2681B3EDDD8C1D29E6C0B1EACCA558C6A945CB8<br>43692DBAF4F82AC215EB96AD1689</span> <br> <!-- !!! dont changing this !!! --> </div> </div> <!-- --> <div class="tabs"> <!--tab--> <div class="tab"> <div id="tab-content1" class="content"> <div class="text"> <!--text data --> <b>/!\ YOUR COMPANY NETWORK HAS BEEN PENETRATED /!\</b><br> <b>All your important files have been encrypted!</b><br><br> <hr> Your files are safe! Only modified. (RSA+AES)<br><br> ANY ATTEMPT TO RESTORE YOUR FILES WITH THIRD-PARTY SOFTWARE<br> WILL PERMANENTLY CORRUPT IT.<br> DO NOT MODIFY ENCRYPTED FILES.<br> DO NOT RENAME ENCRYPTED FILES.<br><br> No software available on internet can help you. We are the only ones able to<br> solve your problem.<br><br> We gathered highly confidential/personal data. These data are currently stored on<br> a private server. This server will be immediately destroyed after your payment.<br> If you decide to not pay, we will release your data to public or re-seller.<br> So you can expect your data to be publicly available in the near future..<br><br> We only seek money and our goal is not to damage your reputation or prevent<br> your business from running.<br><br> You will can send us 2-3 non-important files and we will decrypt it for free<br> to prove we are able to give your files back.<br><br> <!--text data --> <hr> <b>Contact us for price and get decryption software.</b><br><br> <a>qd7pcafncosqfqu3ha6fcx4h6sr7tzwagzpcdcnytiw3b6varaeqv5yd.onion</a><br> * Note that this server is available via Tor browser only<br><br> Follow the instructions to open the link:<br> 1. Type the addres "https://www.torproject.org" in your Internet browser. It opens the Tor site.<br> 2. Press "Download Tor", then press "Download Tor Browser Bundle", install and run it.<br> 3. Now you have Tor browser. In the Tor Browser open <a>qd7pcafncosqfqu3ha6fcx4h6sr7tzwagzpcdcnytiw3b6varaeqv5yd.onion<br> </a> 4. Start a chat and follow the further instructions. <br> <hr> <b>If you can not use the above link, use the email:</b><br> <a href="[email protected] ">[email protected] </a> <br> <a href="[email protected] ">[email protected] </a> <br> <p>* To contact us, create a new free email account on the site: <a href="https://protonmail.com">protonmail.com <br> <b> IF YOU DON'T CONTACT US WITHIN 72 HOURS, PRICE WILL BE HIGHER.</b><br> </div> </div> </div> <!--tab--> <!--text data --> </div> </div> <!--tab--> </div> </div> </body> </html>

Extracted

Path

\Device\HarddiskVolume1\Boot\HOW_TO_RECOVER_DATA.html

Ransom Note
<html> <style type="text/css"> body { background-color: #f5f5f5; } h1, h3{ text-align: center; text-transform: uppercase; font-weight: normal; } /*---*/ .tabs1{ display: block; margin: auto; } .tabs1 .head{ text-align: center; float: top; padding: 0px; text-transform: uppercase; font-weight: normal; display: block; background: #81bef7; color: #DF0101; font-size: 30px; } .tabs1 .identi { font-size: 10px; text-align: center; float: top; padding: 15px; display: block; background: #81bef7; color: #DFDFDF; } .tabs .content { background: #f5f5f5; /*text-align: center;*/ color: #000000; padding: 25px 15px; font-size: 15px; font-weight: 400; line-height: 20px; } .tabs .content a { color: #df0130; font-size: 23px; font-style: italic; text-decoration: none; line-height: 35px; } .tabs .content .text{ padding: 25px; line-height: 1.2; } </style> <body> <div class="tabs1"> <div class="head" ><b>Your personal ID:</b></div> <div class="identi"> <span style="width:1000px; color: #ffffff; font-size: 10px;">48143D3C8881CBDCE9B78ED958C87850A8FC24303DCBC6BC2B6C24246104B23FA08BD59C3A06CA7347944066385340F60A6CF4BDAD5A2062EB06B3DFF534465F<br>22BE88920CF106BAA5F81053CE700925E7BA331051A281314A6E6B894A7370B2AE51750F2551ACE8813DEC855853959CB52AD45988AF5069DD536F5F376A<br>AC17416881B295FC1753BD3492FE586AE9C58424D3EC9F0A55ED0DF598AFF74739D5F880CCF3195F8DC9FEE59E5CED8DF2999341CD0DDE6251DF8A13DB68<br>75F0545EA3C23C708A90C773F0C40E2BE84722F7620128754A6F3F572111186DB745B46019716AC065219DAB4842CF34353AC8F413755FB284C428B755A0<br>42C0C9E4F40D8B7E401CAB5A21495169411076B7BDF00935FF8980EDF6D80EB9BA34C0633E1D26FC0932DD92CD7845D2CC59D3DDE7ACADE9E7D1A2C53657<br>3FB07C8EAB03F330B945A90AD62FA8D09B3B89A7D3207127DAD595C3E6E2214A3735FE6230190271F1B2F794DE262BCE5FA0B40EC4FDD851B7BF2058B94B<br>97D4572CA52FB2294137FD3F90087799F02B2F1DD5D03924866A1022A567A8380BA83A95845C83F6C61DDE0CA27BC9F54E9BE0B41812389CBE2EF2C7AC30<br>3A68E497211B434A42503E19CC3A17713F4BFDC7C6B0F05AA80B903B007EEB81D315A9F7F1C829365923D85940CEB7596C86563B0D8E7D0A28378B315F5C<br>9167D68C14D832835E2A6F836F4A</span> <br> <!-- !!! dont changing this !!! --> </div> </div> <!-- --> <div class="tabs"> <!--tab--> <div class="tab"> <div id="tab-content1" class="content"> <div class="text"> <!--text data --> <b>/!\ YOUR COMPANY NETWORK HAS BEEN PENETRATED /!\</b><br> <b>All your important files have been encrypted!</b><br><br> <hr> Your files are safe! Only modified. (RSA+AES)<br><br> ANY ATTEMPT TO RESTORE YOUR FILES WITH THIRD-PARTY SOFTWARE<br> WILL PERMANENTLY CORRUPT IT.<br> DO NOT MODIFY ENCRYPTED FILES.<br> DO NOT RENAME ENCRYPTED FILES.<br><br> No software available on internet can help you. We are the only ones able to<br> solve your problem.<br><br> We gathered highly confidential/personal data. These data are currently stored on<br> a private server. This server will be immediately destroyed after your payment.<br> If you decide to not pay, we will release your data to public or re-seller.<br> So you can expect your data to be publicly available in the near future..<br><br> We only seek money and our goal is not to damage your reputation or prevent<br> your business from running.<br><br> You will can send us 2-3 non-important files and we will decrypt it for free<br> to prove we are able to give your files back.<br><br> <!--text data --> <hr> <b>Contact us for price and get decryption software.</b><br><br> <a>qd7pcafncosqfqu3ha6fcx4h6sr7tzwagzpcdcnytiw3b6varaeqv5yd.onion</a><br> * Note that this server is available via Tor browser only<br><br> Follow the instructions to open the link:<br> 1. Type the addres "https://www.torproject.org" in your Internet browser. It opens the Tor site.<br> 2. Press "Download Tor", then press "Download Tor Browser Bundle", install and run it.<br> 3. Now you have Tor browser. In the Tor Browser open <a>qd7pcafncosqfqu3ha6fcx4h6sr7tzwagzpcdcnytiw3b6varaeqv5yd.onion<br> </a> 4. Start a chat and follow the further instructions. <br> <hr> <b>If you can not use the above link, use the email:</b><br> <a href="[email protected] ">[email protected] </a> <br> <a href="[email protected] ">[email protected] </a> <br> <p>* To contact us, create a new free email account on the site: <a href="https://protonmail.com">protonmail.com <br> <b> IF YOU DON'T CONTACT US WITHIN 72 HOURS, PRICE WILL BE HIGHER.</b><br> </div> </div> </div> <!--tab--> <!--text data --> </div> </div> <!--tab--> </div> </div> </body> </html>

Targets

    • Target

      9682372408.zip

    • Size

      231KB

    • MD5

      1707bf8537daa1d7cf0f437ef1ad5565

    • SHA1

      62735ca85e497baefc4da7dd72adb6c01f88e27b

    • SHA256

      1af845c322838b612007fc65a9642777d5123a0d74fd01adea7991485e022ded

    • SHA512

      b59c14d2311f0ae86a86e471686bf610c5945bd45a175d525103b19612437e5709d3d4f2afe2de4f3ec175dc0e94918b0928644b5fc9e421f829e64698daa6b0

    • SSDEEP

      6144:IU/sfrwGRTGzUN/H2vre7x54bcGKjbrevFM+eEaCG:Itrtuy7xib7MbKG+eEaD

    Score
    1/10
    behavioral1behavioral2

    • Target

      1bc0575b3fc6486cb2510dac1ac6ae4889b94a955d3eade53d3ba3a92d133281

    • Size

      235KB

    • MD5

      f6f120d1262b88f79debb5d848ac7db9

    • SHA1

      1339282f9b2d2a41326daf3cf284ec2ae8f0f93c

    • SHA256

      1bc0575b3fc6486cb2510dac1ac6ae4889b94a955d3eade53d3ba3a92d133281

    • SHA512

      1067c1a73cf891d651fa007f4ccc4452f32801fe3859933ef1bcc00985e35ce016fa6c601c0e3c10df2080fc9b8a776b2f18d40bd64dfb98177ab638c4b545bd

    • SSDEEP

      6144:c5vMUmRTTgwnfeP+Jx1cLNAIyBcc9WrEWUC4wQh/6BeX:/U8Tgufnx1cLNncgQWUUQh/+e

    Score
    10/10
    medusalockerevasionransomwarespywarestealertrojanupx

    • MedusaLocker

      Ransomware with several variants first seen in September 2019.

      ransomwaremedusalocker

    • MedusaLocker payload

    • UAC bypass

      evasiontrojan

    • Deletes shadow copies

      Ransomware often targets backup files to inhibit system recovery.

      ransomware

    • Modifies extensions of user files

      Ransomware generally changes the extension on encrypted files.

      ransomware

    • Executes dropped EXE

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Checks whether UAC is enabled

      evasiontrojan

    • Drops desktop.ini file(s)

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    behavioral3behavioral4

    • Target

      out.upx

    • Size

      669KB

    • MD5

      3f002221f0a15187df187cb222d0cb6b

    • SHA1

      0fa815635807c05c2f0e85f0f09362a8e90d1324

    • SHA256

      ae00ad8ba6abc6ddac815187f1285cba597d0af8fa4d5ffe429bffb3b6140b5b

    • SHA512

      08bab72bb09b96685f949845858cbaa4f709f7069971ad1f36849cd3f8fde699c1a2d1c0ae5ee397d57057c81c98f6be41c64caaa5e9435d92e10fa1623660d5

    • SSDEEP

      12288:gQA0FfTcwpBuV2UxqDmuiLZeUaoFi2XZWfGe615HhAZV8DdI:Muf4wTuV2Ux3uIZeUBi2Te6HW4I

    Score
    1/10
    behavioral5behavioral6

MITRE ATT&CK Enterprise v6

Tasks