Resubmissions

07-09-2023 05:08

230907-fsv8csef95 10

07-09-2023 01:42

230907-b4w7ksde93 9

General

  • Target

    526488b37415ae2c692f7da97a18c337b0efd4675fd1ac31b4acaa55c63d2725

  • Size

    76KB

  • Sample

    230907-fsv8csef95

  • MD5

    74fd302390dc8e8b5f49d2da186e3e8c

  • SHA1

    63b7aedf094158e30980a46da8b8f4eaf88524e5

  • SHA256

    526488b37415ae2c692f7da97a18c337b0efd4675fd1ac31b4acaa55c63d2725

  • SHA512

    0cea34931b747c17e24c9e0947ca5862bdc19ede390e394697abce394047bc6117fdd93773de308cea7c3afbac00b303355e45a1be230f4c2baa7e04b3742b16

  • SSDEEP

    1536:IduCq+ndmWKk9WudptcZhpjrNqZE3Qh3OyeEiw2SB3aiqSuTDjdIa3d:4lq+dTKk9t0LNweQEyeEiDStSJ/jKat

Score
10/10

Malware Config

Extracted

Path

C:\Users\Admin\Desktop\readme.txt

Ransom Note
CAN I DECRYPT MY FILES ? YES. SURE. We guarantee that you can recover FULL of your data easily!. We are give you full instruction. And help you untill decryption process is totaly finished. CONTACT US: Download the (Session) messenger (https://getsession.org) in messenger :ID"05bc5e20c9c6fbfd9a58bfa222cecd4bbf9b5cf4e1ecde84a0b8b3de23ce8e144e" You have to add this Id and we will complete our converstion. You have to pay for decryption BITCOIN ONLY! !!! ATTENTION !!! IF YOU WILL CONTACT DATA RECOVER COMPANY THEY WILL WASTE YOUR TIME AND TRY TO GET MONEY FROM YOU, than they will try to contact us and try to got your money from 2 sides. REMEMBER : IF SOMEONE PROMISE YOU DECRYPT !!! YOUR PERSONAL INFORMATION IS ONLY IN OUR HANDS ! REMEMBER !!!! This money will be from your pocket any way. We can give you 1 - 2 encrypted files not big , NOT VALUE, for test (You send us encrypted we send you back decrypted data). You data encrypted and only WE ARE have decryption key.(To decrypt your data you need just 1-3 hours, after payment to got your data back fully ) Do not rename encrypted files, do not try to decrypt your data by using third party software, it may permanent data loss. We have been in your network for a long time. We know everything about your company most of your information has already been downloaded to our server. We recommend you to do not waste your time if you dont wont we start 2nd part. You have 12 hours to contact us. Otherwise, your data will be sold or MADE PUBLIC! IF YOU CONTACT DATA RECOVERY COMPANIES !!!! YOU MUST UNDESTAND YOU HAVE SO MUCH MORE CHANSE TO BE PUBLISHED ! ! ! We have a lot info about you and your clients , its can kill your organization ! DONT KILL YOU PESONAL AND BUSSINES. PAY and NO ONE WILL BE KNOW ABOUT THAT situation .
URLs

https://getsession.org

Targets

    • Target

      526488b37415ae2c692f7da97a18c337b0efd4675fd1ac31b4acaa55c63d2725

    • Size

      76KB

    • MD5

      74fd302390dc8e8b5f49d2da186e3e8c

    • SHA1

      63b7aedf094158e30980a46da8b8f4eaf88524e5

    • SHA256

      526488b37415ae2c692f7da97a18c337b0efd4675fd1ac31b4acaa55c63d2725

    • SHA512

      0cea34931b747c17e24c9e0947ca5862bdc19ede390e394697abce394047bc6117fdd93773de308cea7c3afbac00b303355e45a1be230f4c2baa7e04b3742b16

    • SSDEEP

      1536:IduCq+ndmWKk9WudptcZhpjrNqZE3Qh3OyeEiw2SB3aiqSuTDjdIa3d:4lq+dTKk9t0LNweQEyeEiDStSJ/jKat

    Score
    10/10
    • Renames multiple (169) files with added filename extension

      This suggests ransomware activity of encrypting all the files on the system.

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

MITRE ATT&CK Matrix ATT&CK v13

Defense Evasion

Modify Registry

1
T1112

Discovery

Query Registry

1
T1012

Peripheral Device Discovery

1
T1120

System Information Discovery

2
T1082

Tasks