Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
-
Target
busavelock96.bin.exe
-
Size
332KB
-
Sample
230711-xmgw8abf2w
-
MD5
881eb9957ba912beb13685dc507e7724
-
SHA1
b4aad9a1adbe5ec389c15502d57440d0a29bfdb1
-
SHA256
aa7d8be213152f35b5bd6e74f60cf14d5b7a88909ac79b7b25e6bf5b60ffad46
-
SHA512
9ca26fcb63a3d6bad459c0d386638b4f1c5d07ab1ebeeb6b958adaae77fe9f277ceafd5a050bef1bb34b6b5aebc0c2a314334ecd4b610bcad296e2d4ceb79680
-
SSDEEP
6144:PbDN9i3aojIaWQoFeyDw/VG4g189vjHBqVYGpLRztkT:d9zOWQoFLDw/VNuoytkT
Score
10/10
Malware Config
Extracted
Path
C:\MSOCache\All Users\How_to_back_files.html
Ransom Note
<html>
<style type="text/css">
body {
background-color: #f5f5f5;
}
h1, h3{
text-align: center;
text-transform: uppercase;
font-weight: normal;
}
/*---*/
.tabs1{
display: block;
margin: auto;
}
.tabs1 .head{
text-align: center;
float: top;
padding: 0px;
text-transform: uppercase;
font-weight: normal;
display: block;
background: #81bef7;
color: #DF0101;
font-size: 30px;
}
.tabs1 .identi {
font-size: 10px;
text-align: center;
float: top;
padding: 15px;
display: block;
background: #81bef7;
color: #DFDFDF;
word-break: break-all;
}
.tabs .content {
background: #f5f5f5;
/*text-align: center;*/
color: #000000;
padding: 25px 15px;
font-size: 15px;
font-weight: 400;
line-height: 20px; }
.tabs .content a {
color: #df0130;
font-size: 23px;
font-style: italic;
text-decoration: none;
line-height: 35px; }
.tabs .content .text{
padding: 25px;
line-height: 1.2;
}
</style>
<body>
<div class="tabs1">
<div class="head" ><b>Your personal ID:</b></div>
<div class="identi">
<span style="width:1000px; color: #ffffff; font-size: 10px;">IAjh2ppGwRQD5T6yz4qzfPjVBy3606mvM1ElhBlo/4ewXtthibljtd/1VXqoDXK5bY11p6RT+Tdjb95gdmmUgQjQYQ4+IJl+TMtlhIZ8KFCyO6/IjdrAvBjpB07siqWXOBsR0p+gRWWeZkd/hkRV/ZJvfXw1dVhegfNIJgoN+BIhLCdlcAZMEqUNFTq8WWCVdLZ3aAOpYU+3PvmCjl/ilSpmbxLwQsi1wRfz9phTNBb2x8jPEVArnaSS0f5zkp67AkFs1XEFPq9wy44iJz6y1ixMUz6+FUrqTXQltpcNnNJhyduto3z579Z3ZHIWqaT9VjDXEQ1d1tWgKK3Sv/JUk4TUsa3UgiQKvHZd1tkVzLxw4WRM6/gfSZcz6TbUXzpniEpYfbNDBhoO9xU8j5YNgpVIhMzoI5nJTlcRhqSDVpWuotupi0pZVW6DGpV6tb5dvIrXTMBJV5ahlXZ4nj6ZJ1owc2iYab9A4afs4T7+of1RE4Z/uHF2bfQhaBFWtIF4Ra+WM7qJ9x7e8zggUKAXd3J5+6Yb8uxkZDqisC5LpR9cQeqj8cDVZXeRRY3uBtWZzwp+qTOykLocFf57AshAn3hlmrgt+IZ2h7L5pY7/RApIflPk7gXwefqxee0fD4smHZJMMbBB8HCUxzBgqVM514Bg/NAYGElrjRa0TMFt4blD/qCTaDn3dIXegMzVxnYPQ2M4Wb2iA7ndCqyJzN3B/xmw8qUcJp0xzKCl/rKiFexL9r3C5/Of3BDIeHRU2XqkyIk9M+MUVWOUISz5a3dOwZ6ktlWcyw/s37pOxGrgjs6YYugSL971+1jwvCsgvJeahcS20V17wJmWs8bu3xer9UCtI4dOEWzEFLbj9e8F9hCvBwEd87XrJAHtL3vqpVHyDec9aq6DRmd9XVM6K9lc/3rh9DSG/zdfyxAdDH8TkGZMqr0HZ+R9SjVxOdT2lNsk72i+uc40IGV7pzS+S8RdFVkUNh4mWWi6HClaqe+j8MY2nvEEse2TBqbW5nCgXFENYGJgOmU2VPIojcDWMKR7XjvVluZylrNOYt1t1U+gCS16gCg1cn1CNnAb4Fjsp3h0HNDEXHx6ot5BYRrqkz5kwvJ4ETPhiJd6mhqcQvDcX+rUhGS2nFlGlg/+IL1FFC3Wudyzy4pbz4h9CxmzfTIMddAcUH7mKffWT3UvEkT7vRG4lHgMiKSVuWYarQF5dJdtHPtmE45f4DaeJTE+VRB9TvrfUZprPa7c7UEr8Ucu1QpG9SqLICCPOC7HCisQnQO+K8UQmTeUCCAr8kWPHhJjI+tgmd3kb5LfyLyE4lsDVkfr7UAyXoJmD9bMXNOPGgGH1ewPP6Cpy7srRLPgtNuqInBxXnlMjs3j2PS2CEB91iUZBzjUvN70I3XI7ddCqLKOZwj6tXDyXDn4YnkvSmGi4V1BIGRyxQtTMTsJ906CRMUYv8mOd+iiI+z/JSbZ1iLqrJ0KKVcxQnPsRDPeBzLPDaRA1MN4f0EZCN2N00iMmj/L2caKz5eD+Rswu8n9F5L6t5/HS8p/RRETlKma3v/2ahP0f+Hsh8jW69ZM1UWpp2ULFEMf7FkNBivVdm7Fqg2R2Uyd2bU1lZDwlvJJKjcEUklxdOIidwu1ZLBTlaRMOkOJbo9ItAeRDLUzqVK1Dm9kAAEEMkHnejKBmDWlMAA0rhQ4M3giFOlOhfR6L38aEHk=</span> <br>
<!-- !!! dont changing this !!! -->
</div>
</div>
<!-- -->
<div class="tabs">
<!--tab-->
<div class="tab">
<div id="tab-content1" class="content">
<div class="text">
<!--text data -->
<b>/!\ YOUR COMPANY NETWORK HAS BEEN PENETRATED /!\</b><br>
<b>All your important files have been encrypted!</b><br><br>
<hr>
Your files are safe! Only modified. (RSA+AES)<br><br>
ANY ATTEMPT TO RESTORE YOUR FILES WITH THIRD-PARTY SOFTWARE<br>
WILL PERMANENTLY CORRUPT IT.<br>
DO NOT MODIFY ENCRYPTED FILES.<br>
DO NOT RENAME ENCRYPTED FILES.<br><br>
No software available on internet can help you. We are the only ones able to<br>
solve your problem.<br><br>
We gathered highly confidential/personal data. These data are currently stored on<br>
a private server. This server will be immediately destroyed after your payment.<br>
If you decide to not pay, we will release your data to public or re-seller.<br>
So you can expect your data to be publicly available in the near future..<br><br>
We only seek money and our goal is not to damage your reputation or prevent<br>
your business from running.<br><br>
You will can send us 2-3 non-important files and we will decrypt it for free<br>
to prove we are able to give your files back.<br><br>
<!--text data -->
<hr>
<b>Contact us for price and get decryption software.</b><br><br>
<hr>
<b>email:</b><br>
<a href="[email protected] ">[email protected] </a> <br>
<a href="[email protected] ">[email protected] </a> <br>
<p>* To contact us, create a new free email account on the site: <a href="https://protonmail.com">protonmail.com <br>
<b>
IF YOU DON'T CONTACT US WITHIN 72 HOURS, PRICE WILL BE HIGHER.</b><br>
</div>
</div>
</div>
<!--tab-->
<!--text data -->
</div>
</div>
<!--tab-->
</div>
</div>
</body>
</html>
Emails
Extracted
Path
C:\odt\How_to_back_files.html
Ransom Note
<html>
<style type="text/css">
body {
background-color: #f5f5f5;
}
h1, h3{
text-align: center;
text-transform: uppercase;
font-weight: normal;
}
/*---*/
.tabs1{
display: block;
margin: auto;
}
.tabs1 .head{
text-align: center;
float: top;
padding: 0px;
text-transform: uppercase;
font-weight: normal;
display: block;
background: #81bef7;
color: #DF0101;
font-size: 30px;
}
.tabs1 .identi {
font-size: 10px;
text-align: center;
float: top;
padding: 15px;
display: block;
background: #81bef7;
color: #DFDFDF;
word-break: break-all;
}
.tabs .content {
background: #f5f5f5;
/*text-align: center;*/
color: #000000;
padding: 25px 15px;
font-size: 15px;
font-weight: 400;
line-height: 20px; }
.tabs .content a {
color: #df0130;
font-size: 23px;
font-style: italic;
text-decoration: none;
line-height: 35px; }
.tabs .content .text{
padding: 25px;
line-height: 1.2;
}
</style>
<body>
<div class="tabs1">
<div class="head" ><b>Your personal ID:</b></div>
<div class="identi">
<span style="width:1000px; color: #ffffff; font-size: 10px;">Bdxs49hPQyNTOHZj1p2wlvB3ReSLQ5RilMNvZM2eIHYfLbt1WUFVJlFa/0eBetCva1ZBcsapnS47Pewt83Z+X2xCm4cjXQJTFAaDSzIwd7rqN20hhtPqVaTSj148KLIz3bXfCBbLBI+h11slVtoXfNrsg0DcrAzmIXY9+01SOAslHpa0Z6MxUO0kf27BXT7PXchtld3c2wGy8sBtWexsMh4H3zPbM/tkHTxuaSzRg7l0G0vanphf74IKtCFwDeUQJNrz1LHhgYZqnoXTDdZKeEgvHsSJ88El/+eX8S/kSAAz8yWe7hdVGUTF0jUVffXA0vBmLex2LfAnS/nOzKSXDRdai1Osl+WTF5aOfiT1thBrBzYXt0vDe7Je3WwW1ffQNcATh69PxEgHrDKZPBwu04obBOF9ZrYOKeNllrKySC3LV92kCsYxSd5rG1ooqzzjL1qrB29UdndUHcvziW6vI2lz16NJvwlf3okUlpbKBbLchlaVUkjVam2TZkWZzD3pDainbM3YQgJVgge/fRutc//IaYrwSn4x1r+P4rhmQGh8nHyAuxpVUjDJIDK4MroZWo7yOeLXWE23tMXFYNFhdqVPmf9GPS3WGy7rDmmxy5mPAZ9G9mkbBmKRRu4TyqN6/cccbeG6hsF2Ia2tg9Xl5f8kDbSjcoSCSYC6vlHayART7lMRW17LOW4Ctl4EjAtsNQPZlm+rPVjp18j7vNFbSlzr/Hdc5Wf2snGkHxNUr4+H3ZY7v5wTULavUHuK5Xs8Pe3ZPkEay1zAwO8tEK+GK8VWVh7s27FTI5FenkuacOn3Flmc3GzJgWMrmrmOENN+djuU80dOVggMyN/YtexxCD7A4eD5ocwjXxossbN8MK1hzMO5rLW7JLJRUlX/GnAB2mDbafqar6YFpDxKKPMKIVvIlqicx1nC8YQrhuOOb5peRycCgjVjo4jK0Up5L+Q+FSaOPPvoQUT+jBh5Wh5htQdpQfotsgOGMtyF5jvti+5FpJgBGpWYBwvL2y/yfxB8FLaTPbwlr0uVX69YEo2G3CMQD35fSelJPbFIq81uVJukwn6BdCVgv9k6b9s00AHgdJffF5XZV8sJbRIb+CHZztgzPVAYkXRL2LrIbojORi/CH6JWsiO7KRuyD5PmbbKnXRuB/ikLr7buDFNZftR1VPrXMpaBHqNqYcRo8WnxMJbBbeX3jrGgio8W4c+dGaNQBdGNSPZnFSa1OcXP2UvJRNXxzHSPgMvFWR3CxWNpQundQ9GzjsniqF2Q48S1TNL2ts0Eui23mv6c94Th2BXzsqhmBj4GZAPLJF/6fY+MKS6QnR7eeHD/v9Qr23jiTm3Gtqj90Aj0Le2QoDp7lwAHlzC8vdSY3dxVF6YqskkDKVVhCgWVRN7uWb4Nm3jr2gnPMyFP44uWncihaDgkVGaJjSFR0U4u9WkzJirx1xpVQafopc94Cdy6zsBtDQS5Ab2N1OUY+rfLNnrYNyogDhysZrSoaKwL4iyfsO9kLy1cTK64QBmo5yaI5A3pOG7ShtAPjkbWnhtyaGcwircK8y7sSELPpljtrdvjbpD4zYr9K4IIzGHppcle3Djc/huDtODg9CVSJdSDN9g9d1cHwEsy1u0m2UQL5J+Cl/QMdqDJkjM9r0e5ODtizKYjEzZaLwFJkQ4Lu1hNGPyQqE/0uUVF98Y9g7FF4DlH9Wph1cD785g=</span> <br>
<!-- !!! dont changing this !!! -->
</div>
</div>
<!-- -->
<div class="tabs">
<!--tab-->
<div class="tab">
<div id="tab-content1" class="content">
<div class="text">
<!--text data -->
<b>/!\ YOUR COMPANY NETWORK HAS BEEN PENETRATED /!\</b><br>
<b>All your important files have been encrypted!</b><br><br>
<hr>
Your files are safe! Only modified. (RSA+AES)<br><br>
ANY ATTEMPT TO RESTORE YOUR FILES WITH THIRD-PARTY SOFTWARE<br>
WILL PERMANENTLY CORRUPT IT.<br>
DO NOT MODIFY ENCRYPTED FILES.<br>
DO NOT RENAME ENCRYPTED FILES.<br><br>
No software available on internet can help you. We are the only ones able to<br>
solve your problem.<br><br>
We gathered highly confidential/personal data. These data are currently stored on<br>
a private server. This server will be immediately destroyed after your payment.<br>
If you decide to not pay, we will release your data to public or re-seller.<br>
So you can expect your data to be publicly available in the near future..<br><br>
We only seek money and our goal is not to damage your reputation or prevent<br>
your business from running.<br><br>
You will can send us 2-3 non-important files and we will decrypt it for free<br>
to prove we are able to give your files back.<br><br>
<!--text data -->
<hr>
<b>Contact us for price and get decryption software.</b><br><br>
<hr>
<b>email:</b><br>
<a href="[email protected] ">[email protected] </a> <br>
<a href="[email protected] ">[email protected] </a> <br>
<p>* To contact us, create a new free email account on the site: <a href="https://protonmail.com">protonmail.com <br>
<b>
IF YOU DON'T CONTACT US WITHIN 72 HOURS, PRICE WILL BE HIGHER.</b><br>
</div>
</div>
</div>
<!--tab-->
<!--text data -->
</div>
</div>
<!--tab-->
</div>
</div>
</body>
</html>
Emails
Targets
-
-
Target
busavelock96.bin.exe
-
Size
332KB
-
MD5
881eb9957ba912beb13685dc507e7724
-
SHA1
b4aad9a1adbe5ec389c15502d57440d0a29bfdb1
-
SHA256
aa7d8be213152f35b5bd6e74f60cf14d5b7a88909ac79b7b25e6bf5b60ffad46
-
SHA512
9ca26fcb63a3d6bad459c0d386638b4f1c5d07ab1ebeeb6b958adaae77fe9f277ceafd5a050bef1bb34b6b5aebc0c2a314334ecd4b610bcad296e2d4ceb79680
-
SSDEEP
6144:PbDN9i3aojIaWQoFeyDw/VG4g189vjHBqVYGpLRztkT:d9zOWQoFLDw/VNuoytkT
Score10/10-
Suspicious use of NtCreateUserProcessOtherParentProcess
-
Deletes shadow copies
Ransomware often targets backup files to inhibit system recovery.
-
Modifies boot configuration data using bcdedit
-
Renames multiple (7552) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Renames multiple (7588) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Deletes System State backups
Uses wbadmin.exe to inhibit system recovery.
-
Deletes system backups
Uses wbadmin.exe to inhibit system recovery.
-
Drops desktop.ini file(s)
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-