Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    38b3ad07b35d7dcbd054e87295ee1d60ab2f894111d458e88c6c183cd7ffefc8

  • Size

    344KB

  • Sample

    231114-xjjlmsed9w

  • MD5

    73b6567e0fb62eeb98aeaa8af712c650

  • SHA1

    a540265e45623ef70377b6d21118b732835a8337

  • SHA256

    38b3ad07b35d7dcbd054e87295ee1d60ab2f894111d458e88c6c183cd7ffefc8

  • SHA512

    2e03cdb91083ad989caa260fde1646f011a3632067495ff18367056c7873a804fc9898b8462fd8736ac0d351472d61fb789cf3383b16f28d1cef5551e1041c71

  • SSDEEP

    6144:h04sqI3VM+bMHClEf6HCAW3/hpb7BuHRaumHyxaK3yaFPR65n:C4sx3VNbMilED5v3CRPsykK3DF

Malware Config

Extracted

Path

C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\{RecOveR}-eiyjm__.Txt

Ransom Note
#& <0!1&;/ )0:..(:8,29?7+? '6*< #& <0!1&;/ )0:..(:8,29?7+? '6*< #& <0!1&;/ )0:..(:8,29?7+? '6*< #& <0!1&;/ )0:..(:8,29?7+? '6*< NOT YOUR LANGUAGE? USE https://translate.google.com What's the matter with your files? Your data was secured using a strong encryption with RSA4096. Use the link down below to find additional information on the encryption keys using RSA-4096 https://en.wikipedia.org/wiki/RSA_(cryptosystem) What exactly that means? #& <0!1&;/ )0:..(:8,29?7+? '6*< #& <0!1&;/ )0:..(:8,29?7+? '6*< It means that on a structural level your files have been transformed . You won't be able to use , read , see or work with them anymore . In other words they are useless , however , there is a possibility to restore them with our help . What exactly happened to your files ??? *** Two personal RSA-4096 keys were generated for your PC/Laptop; one key is public, another key is private. *** All your data and files were encrypted by the means of the public key , which you received over the web . *** In order to decrypt your data and gain access to your computer you need a private key and a decryption software, which can be found on one of our secret servers. #& <0!1&;/ )0:..(:8,29?7+? '6*< #& <0!1&;/ )0:..(:8,29?7+? '6*< What should you do next ? There are several options for you to consider : *** You can wait for a while until the price of a private key will raise, so you will have to pay twice as much to access your files or *** You can start getting BitCoins right now and get access to your data quite fast . In case you have valuable files , we advise you to act fast as there is no other option rather than paying in order to get back your data. In order to obtain specific instructions , please access your personal homepage by choosing one of the few addresses down below : http://h3ds4.maconslab.com/ADD242BA48CC76C http://aq3ef.goimocoa.at/ADD242BA48CC76C http://fl43s.toabolt.at/ADD242BA48CC76C If you can't access your personal homepage or the addresses are not working, complete the following steps: *** Download TOR Browser - http://www.torproject.org/projects/torbrowser.html.en *** Install TOR Browser and open TOR Browser *** Insert the following link in the address bar: xzjvzkgjxebzreap.onion/ADD242BA48CC76C #& <0!1&;/ )0:..(:8,29?7+? '6*< #& <0!1&;/ )0:..(:8,29?7+? '6*< #& <0!1&;/ )0:..(:8,29?7+? '6*< ***************IMPORTANT*****************INFORMATION******************** Your personal homepages http://h3ds4.maconslab.com/ADD242BA48CC76C http://aq3ef.goimocoa.at/ADD242BA48CC76C http://fl43s.toabolt.at/ADD242BA48CC76C Your personal homepage Tor-Browser xzjvzkgjxebzreap.onion/ADD242BA48CC76C Your personal ID ADD242BA48CC76C #& <0!1&;/ )0:..(:8,29?7+? '6*< #& <0!1&;/ )0:..(:8,29?7+? '6*< #& <0!1&;/ )0:..(:8,29?7+? '6*<
URLs

http://h3ds4.maconslab.com/ADD242BA48CC76C

http://aq3ef.goimocoa.at/ADD242BA48CC76C

http://fl43s.toabolt.at/ADD242BA48CC76C

http://xzjvzkgjxebzreap.onion/ADD242BA48CC76C

Extracted

Path

C:\PerfLogs\{RecOveR}-guexu__.Txt

Ransom Note
'=1&%0$'2*<"*/:'.!(9-!!"; 19;"8 '=1&%0$'2*<"*/:'.!(9-!!"; 19;"8 '=1&%0$'2*<"*/:'.!(9-!!"; 19;"8 '=1&%0$'2*<"*/:'.!(9-!!"; 19;"8 NOT YOUR LANGUAGE? USE https://translate.google.com What's the matter with your files? Your data was secured using a strong encryption with RSA4096. Use the link down below to find additional information on the encryption keys using RSA-4096 https://en.wikipedia.org/wiki/RSA_(cryptosystem) What exactly that means? '=1&%0$'2*<"*/:'.!(9-!!"; 19;"8 '=1&%0$'2*<"*/:'.!(9-!!"; 19;"8 It means that on a structural level your files have been transformed . You won't be able to use , read , see or work with them anymore . In other words they are useless , however , there is a possibility to restore them with our help . What exactly happened to your files ??? *** Two personal RSA-4096 keys were generated for your PC/Laptop; one key is public, another key is private. *** All your data and files were encrypted by the means of the public key , which you received over the web . *** In order to decrypt your data and gain access to your computer you need a private key and a decryption software, which can be found on one of our secret servers. '=1&%0$'2*<"*/:'.!(9-!!"; 19;"8 '=1&%0$'2*<"*/:'.!(9-!!"; 19;"8 What should you do next ? There are several options for you to consider : *** You can wait for a while until the price of a private key will raise, so you will have to pay twice as much to access your files or *** You can start getting BitCoins right now and get access to your data quite fast . In case you have valuable files , we advise you to act fast as there is no other option rather than paying in order to get back your data. In order to obtain specific instructions , please access your personal homepage by choosing one of the few addresses down below : http://h3ds4.maconslab.com/E8F7436B6D893B0 http://aq3ef.goimocoa.at/E8F7436B6D893B0 http://fl43s.toabolt.at/E8F7436B6D893B0 If you can't access your personal homepage or the addresses are not working, complete the following steps: *** Download TOR Browser - http://www.torproject.org/projects/torbrowser.html.en *** Install TOR Browser and open TOR Browser *** Insert the following link in the address bar: xzjvzkgjxebzreap.onion/E8F7436B6D893B0 '=1&%0$'2*<"*/:'.!(9-!!"; 19;"8 '=1&%0$'2*<"*/:'.!(9-!!"; 19;"8 '=1&%0$'2*<"*/:'.!(9-!!"; 19;"8 ***************IMPORTANT*****************INFORMATION******************** Your personal homepages http://h3ds4.maconslab.com/E8F7436B6D893B0 http://aq3ef.goimocoa.at/E8F7436B6D893B0 http://fl43s.toabolt.at/E8F7436B6D893B0 Your personal homepage Tor-Browser xzjvzkgjxebzreap.onion/E8F7436B6D893B0 Your personal ID E8F7436B6D893B0 '=1&%0$'2*<"*/:'.!(9-!!"; 19;"8 '=1&%0$'2*<"*/:'.!(9-!!"; 19;"8 '=1&%0$'2*<"*/:'.!(9-!!"; 19;"8
URLs

http://h3ds4.maconslab.com/E8F7436B6D893B0

http://aq3ef.goimocoa.at/E8F7436B6D893B0

http://fl43s.toabolt.at/E8F7436B6D893B0

http://xzjvzkgjxebzreap.onion/E8F7436B6D893B0

Targets

    • Target

      38b3ad07b35d7dcbd054e87295ee1d60ab2f894111d458e88c6c183cd7ffefc8

    • Size

      344KB

    • MD5

      73b6567e0fb62eeb98aeaa8af712c650

    • SHA1

      a540265e45623ef70377b6d21118b732835a8337

    • SHA256

      38b3ad07b35d7dcbd054e87295ee1d60ab2f894111d458e88c6c183cd7ffefc8

    • SHA512

      2e03cdb91083ad989caa260fde1646f011a3632067495ff18367056c7873a804fc9898b8462fd8736ac0d351472d61fb789cf3383b16f28d1cef5551e1041c71

    • SSDEEP

      6144:h04sqI3VM+bMHClEf6HCAW3/hpb7BuHRaumHyxaK3yaFPR65n:C4sx3VNbMilED5v3CRPsykK3DF

    • Deletes shadow copies

      Ransomware often targets backup files to inhibit system recovery.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Drops startup file

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Adds Run key to start application

MITRE ATT&CK Enterprise v15

Tasks