General

  • Target

    tcvjuo.exe

  • Size

    4.8MB

  • Sample

    230707-g6qepsfe82

  • MD5

    99a4a7145a78577d18ab6547210e5fec

  • SHA1

    20374dec61f839f1392bab96fc8e71f0e18ff334

  • SHA256

    56074a1d055957fe372a60582fa9603b4d683a029c0abbc490dcb5c44bc56885

  • SHA512

    e4d7213e2fdd38b159324cb486245414ac140e95089cb04e472c8df9c84c22560876c383da2d726e04f034c390993a2c19d3b3974f2e92f26843f04ce99693b6

  • SSDEEP

    98304:S3l8ZSUOy+EvVHBafvJNOMN5bZ9BSZJB:ClE9WvD1NrKL

Malware Config

Extracted

Path

C:\MSOCache\All Users\{90140000-001A-0409-0000-0000000FF1CE}-C\HOW TO RESTORE YOUR TCVJUO FILES.TXT

Ransom Note
THE ENTIRE NETWORK IS ENCRYPTED YOUR BUSINESS IS LOSING MONEY! Dear Management! We inform you that your network has undergone a penetration test, during which we encrypted your files and downloaded more than 100GB of your data Personal data Marketing data Confidential documents Accounting Copy of some mailboxes Important! Do not try to decrypt the files yourself or using third-party utilities. The only program that can decrypt them is our decryptor, which you can request from the contacts below. Any other program will only damage files in such a way that it will be impossible to restore them. Write to us directly, without resorting to intermediaries, they will deceive you. You can get all the necessary evidence, discuss with us possible solutions to this problem and request a decryptor by using the contacts below. Free decryption as a guarantee. Send us up 3 files for free decryption. The total file size should be no more than 1 MB! (not in the archive). Please be advised that if we don't receive a response from you within 3 days, we reserve the right to publish files to the public. Contact us: master1restore@cock.li or 2020host2021@tutanota.com
Emails

master1restore@cock.li

2020host2021@tutanota.com

Targets

    • Target

      tcvjuo.exe

    • Size

      4.8MB

    • MD5

      99a4a7145a78577d18ab6547210e5fec

    • SHA1

      20374dec61f839f1392bab96fc8e71f0e18ff334

    • SHA256

      56074a1d055957fe372a60582fa9603b4d683a029c0abbc490dcb5c44bc56885

    • SHA512

      e4d7213e2fdd38b159324cb486245414ac140e95089cb04e472c8df9c84c22560876c383da2d726e04f034c390993a2c19d3b3974f2e92f26843f04ce99693b6

    • SSDEEP

      98304:S3l8ZSUOy+EvVHBafvJNOMN5bZ9BSZJB:ClE9WvD1NrKL

    • Clears Windows event logs

    • Deletes shadow copies

      Ransomware often targets backup files to inhibit system recovery.

    • Stops running service(s)

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

MITRE ATT&CK Matrix ATT&CK v6

Persistence

Modify Existing Service

1
T1031

Defense Evasion

Indicator Removal on Host

1
T1070

File Deletion

2
T1107

Impair Defenses

1
T1562

Credential Access

Credentials in Files

1
T1081

Discovery

Query Registry

2
T1012

Peripheral Device Discovery

1
T1120

System Information Discovery

1
T1082

Collection

Data from Local System

1
T1005

Impact

Inhibit System Recovery

2
T1490

Service Stop

1
T1489

Tasks