General

  • Target

    TmsLA6kdcU8jxKzpMvbUVweTeF5YcR.exe

  • Size

    1.1MB

  • Sample

    230901-kmk8esea58

  • MD5

    7d71c897223fbc3c0b0ec324e27804e3

  • SHA1

    0ee04f020d4f36ac6c5c2fa7667de7ac897dc41e

  • SHA256

    b6064f6936f72d1312f40f86f0cb889c6d0477c20f59c6c96c385c6287f701f7

  • SHA512

    c3330ee5f293b5cabdcd9fd8da3fa175383ebc8697db9c95ad9a82e6048089ae8a86fde7df9fdc5a8988130b2c73266465f214cdb9b06d7ed6258e85075ec8ec

  • SSDEEP

    12288:RBVVtkNBJOlMmXP0447OdMyogfJ7gwPueClVVRWM5YDh8xpoPKouMA+nkGGCp+D:CTcCG0447AMVgfdnTClVm4QKcGRD

Score
10/10

Malware Config

Extracted

Path

C:\Users\How To Restore Your Files.txt

Ransom Note
All your documents, company files, images, etc (and there are a lot of company data) have been encrypted and the extension has been changed to .knight_l . The recovery is only possible with our help. US $14527 in Bitcoin is the price for restoring all of your data. This is the average monthly wage for 1 employee in your company. So don't even think about negotiating. That would only be a waste of time and you will be ignored. Send the Bitcoin to this wallet:1G1CP6S3ur5cMvJURXcE91wYiMpKxmEyzx (This is your only payment address, please don't pay BTC to other than this or you won't be able to get it decrypted!) After completing the Bitcoin transaction, send an email at: http://knightv5pdwrrfyxghivy3qccxxghk2yfyfigur562gcnmpmgd4pgfid.onion/fb3a1029-b9f9-4b91-86c4-1012f83a6220/ (Download and install TOR Browser (https://www.torproject.org/).[If you don't know how to use it, do a Google search!]).You will get an answer as soon as possible. I expect a message from you with the transfer of BTC Confirmation (TXID). So we can move forward to decrypt all your data. TXID is very important because it will help us identify your payment and connect it to your encrypted data.Do not use that I am here to waste mine or your time. How to buy the BTC? https://www.binance.com/en/how-to-buy/bitcoin https://www.coinbase.com/how-to-buy/bitcoin Note: Your data are uploaded to our servers before being encrypted, Everything related to your business (customer data, POS Data, documents related to your orders and delivery, and others). If you do not contact us and do not confirm the payment within 4 days, we will move forward and will announce the sales of the extracted data. ID:f62dd40685a7902dcbd3e1ebea75c8db8d88f85cb99e4db0689a490d055a1833
URLs

http://knightv5pdwrrfyxghivy3qccxxghk2yfyfigur562gcnmpmgd4pgfid.onion/fb3a1029-b9f9-4b91-86c4-1012f83a6220/

https://www.binance.com/en/how-to-buy/bitcoin

Targets

    • Target

      TmsLA6kdcU8jxKzpMvbUVweTeF5YcR.exe

    • Size

      1.1MB

    • MD5

      7d71c897223fbc3c0b0ec324e27804e3

    • SHA1

      0ee04f020d4f36ac6c5c2fa7667de7ac897dc41e

    • SHA256

      b6064f6936f72d1312f40f86f0cb889c6d0477c20f59c6c96c385c6287f701f7

    • SHA512

      c3330ee5f293b5cabdcd9fd8da3fa175383ebc8697db9c95ad9a82e6048089ae8a86fde7df9fdc5a8988130b2c73266465f214cdb9b06d7ed6258e85075ec8ec

    • SSDEEP

      12288:RBVVtkNBJOlMmXP0447OdMyogfJ7gwPueClVVRWM5YDh8xpoPKouMA+nkGGCp+D:CTcCG0447AMVgfdnTClVm4QKcGRD

    Score
    10/10
    • Renames multiple (190) files with added filename extension

      This suggests ransomware activity of encrypting all the files on the system.

    • Drops desktop.ini file(s)

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks