Resubmissions

06-09-2023 21:36

230906-1fv22scb33 10

03-09-2023 10:45

230903-mtgjxshc8w 10

03-09-2023 10:42

230903-mrwaashf43 10

03-09-2023 10:39

230903-mqa8qshf26 10

03-09-2023 10:34

230903-mmglcahc3s 10

03-09-2023 10:34

230903-mmdvfshe84 10

03-09-2023 10:32

230903-mk4yvshe79 10

03-09-2023 10:31

230903-mkwbqahe76 1

03-09-2023 10:31

230903-mkswlahb9z 10

03-09-2023 10:31

230903-mkp5pshe75 10

General

  • Target

    92.exe

  • Size

    1.3MB

  • Sample

    230903-mkswlahb9z

  • MD5

    7defc0b43aa2ad389575df2419b7909b

  • SHA1

    cf0dd52331ce203c723f7be32bd91d7cfb34a988

  • SHA256

    dbf9cc65461c7bc650938156d3751d4ae0ce4312d3899f747e590767c0ef0408

  • SHA512

    9291bc529ce05bc4d0f0e464e008023ca8d310beeca0cbf47b21239423607f5944ed446d9e99537c49cf637a1aed3b55a96277f327bc4d8eb8908b400d8c2573

  • SSDEEP

    12288:0BVVtkNBJOlMmXP0447OdMyogfJ7gwPueClVVRWM5YDh8xpoPzouMA+nkGGCp+ME:tTcCG0447AMVgfdnTClVm4QzcGRGS

Score
10/10

Malware Config

Extracted

Path

C:\Users\How To Restore Your Files.txt

Ransom Note
All your documents, company files, images, etc (and there are a lot of company data) have been encrypted and the extension has been changed to .knight_l . The recovery is only possible with our help. US $14508 in Bitcoin is the price for restoring all of your data. This is the average monthly wage for 1 employee in your company. So don't even think about negotiating. That would only be a waste of time and you will be ignored. Send the Bitcoin to this wallet:1HRgvL5tQreF55wzLNP9g7NV2MoRuugoDE (This is your only payment address, please don't pay BTC to other than this or you won't be able to get it decrypted!) After completing the Bitcoin transaction, send an email at: http://knightv5pdwrrfyxghivy3qccxxghk2yfyfigur562gcnmpmgd4pgfid.onion/f6e2d5b5-775a-4cca-a4d2-44d6891c3e42/ (Download and install TOR Browser (https://www.torproject.org/).[If you don't know how to use it, do a Google search!]).You will get an answer as soon as possible. I expect a message from you with the transfer of BTC Confirmation (TXID). So we can move forward to decrypt all your data. TXID is very important because it will help us identify your payment and connect it to your encrypted data.Do not use that I am here to waste mine or your time. How to buy the BTC? https://www.binance.com/en/how-to-buy/bitcoin https://www.coinbase.com/how-to-buy/bitcoin Note: Your data are uploaded to our servers before being encrypted, Everything related to your business (customer data, POS Data, documents related to your orders and delivery, and others). If you do not contact us and do not confirm the payment within 4 days, we will move forward and will announce the sales of the extracted data. ID:cfd1d5ff58ef7b6815a402b2038ce4c26acc2e80bc667c4c7ee1834f8f762d42
URLs

http://knightv5pdwrrfyxghivy3qccxxghk2yfyfigur562gcnmpmgd4pgfid.onion/f6e2d5b5-775a-4cca-a4d2-44d6891c3e42/

https://www.binance.com/en/how-to-buy/bitcoin

Targets

    • Target

      92.exe

    • Size

      1.3MB

    • MD5

      7defc0b43aa2ad389575df2419b7909b

    • SHA1

      cf0dd52331ce203c723f7be32bd91d7cfb34a988

    • SHA256

      dbf9cc65461c7bc650938156d3751d4ae0ce4312d3899f747e590767c0ef0408

    • SHA512

      9291bc529ce05bc4d0f0e464e008023ca8d310beeca0cbf47b21239423607f5944ed446d9e99537c49cf637a1aed3b55a96277f327bc4d8eb8908b400d8c2573

    • SSDEEP

      12288:0BVVtkNBJOlMmXP0447OdMyogfJ7gwPueClVVRWM5YDh8xpoPzouMA+nkGGCp+ME:tTcCG0447AMVgfdnTClVm4QzcGRGS

    Score
    10/10
    • Renames multiple (160) files with added filename extension

      This suggests ransomware activity of encrypting all the files on the system.

    • Drops desktop.ini file(s)

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks