General
-
Target
d9de562ac1815bf0baad1c617c6c7f47d71f46810c348f7372a88b296d68cfae
-
Size
335KB
-
Sample
240101-sf41yschdl
-
MD5
c3d5522f176830c4a24223c96439f668
-
SHA1
46574cd17ee2a1f2084dc83a65df94e13ce25061
-
SHA256
d9de562ac1815bf0baad1c617c6c7f47d71f46810c348f7372a88b296d68cfae
-
SHA512
0ed0510f4bba6280e4319f3742d1775d7d251c35517f74f1e2f7350ac68239879b0171a279aab252947163977f363cf3852d52747b225aa160f882cb82bc532b
-
SSDEEP
6144:1YS9RhUoKV8TCylQ0MWNns5wiSvypQof+9RpfbMPrac6bhMq:1/9T0ylQ0MWNns5xSvyp7W6MMq
Score
10/10
Malware Config
Extracted
Path
C:\MSOCache\All Users\How_to_back_files.html
Ransom Note
<html>
<style type="text/css">
body {
background-color: #f5f5f5;
}
h1, h3{
text-align: center;
text-transform: uppercase;
font-weight: normal;
}
/*---*/
.tabs1{
display: block;
margin: auto;
}
.tabs1 .head{
text-align: center;
float: top;
padding: 0px;
text-transform: uppercase;
font-weight: normal;
display: block;
background: #81bef7;
color: #DF0101;
font-size: 30px;
}
.tabs1 .identi {
font-size: 10px;
text-align: center;
float: top;
padding: 15px;
display: block;
background: #81bef7;
color: #DFDFDF;
word-break: break-all;
}
.tabs .content {
background: #f5f5f5;
/*text-align: center;*/
color: #000000;
padding: 25px 15px;
font-size: 15px;
font-weight: 400;
line-height: 20px; }
.tabs .content a {
color: #df0130;
font-size: 23px;
font-style: italic;
text-decoration: none;
line-height: 35px; }
.tabs .content .text{
padding: 25px;
line-height: 1.2;
}
</style>
<body>
<div class="tabs1">
<div class="head" ><b>Your personal ID:</b></div>
<div class="identi">
<span style="width:1000px; color: #ffffff; font-size: 10px;">aIiZvMoTfIPWN3V/3tbqsRFki7kdfeIu/9RXIpf7TyFjIS/i6fbUgx89oN2eCnLDwpnrKfGndgogVjmvT1/l9QGOeQPc6KSZy6YNyDBaOmwXFeLSUdnqBVkqOQx9yK2Pmp8A+dErg3dUc8WwWkDvlqzl0bPrMy1VopBgQs+MTOJrqx3v5/gPmTFq02SnBckuHap5Gm59d4TClTiAVdj9RE3FhvUs+/f18/NQfuJcqSuQTJhFM/LKAOn9f0aF/ZSoQP4ADo/uPT5Jze7F94+ExEDBnIlZ/HE1RpxgHC7E4bhiVy8drekzO7MsZiBKBZ3ch1J5pYwXN5cf5+Lry3nm0AZGvO/Fm+tN0y1sAIRQRVhMBjBab+3dKM38Ip/3Jy298JfxiMH1WNImrGLM5aYIyQkQg31nur8gQubUuv1kf99IM/q7PZRSwRBs1XLSdEGUMEUxlaR1JUUpIl4kjfiMbKYBufLKJI1NfIeNdGQXluBvAQ4XjrMmNJ8VZZmux6sVgVReOV6izVreGb9GLFmwYj8H2HlDg74w/189BpQ66GUN0W61S9P97yckLyG7HW3LsUXk7m4bwtpRNiAaDT+B96i3VzGFSCNjKiBgEIQe0hwgd0v68fGb9tIGawTS9CIt3VLdUC5K8Z/bXI2gVkox/KKN3Djvs0y+cdDFWPxlFtSq9H46w2TYfXC6+GE5rZ6SCHQOnJcQRJ/72yw48hqyKe0o3gszth6FKK1rNiKrc5Sfem1dXDJ45B8AhR0huIB1mTAr2lncXfcOaBO5rNtalE6yFGgz7TPxl1g46cMVuVUCDP9noazZWT1slFUSZpoPr3Fsr0bcBVgCYEj3xb2817hwrrZCnCL77bhEQhmeM7wUGzJBu/tSb9XqQRz6uTIFisWRpF5/hWA/fqiU8+Z8LaiwiuUTDh/SuX1hUsopAZU+Vx+e+54Tq+Xi4YjRniZG3rwhWVKW6yOvM1lZr9vbe4Qb48loIze0wF00PZRDHffk9wCjtBnJX3+rk4Pm/DNYI1YL3cAFOFBegX8EYwKsdYnv1bOA/bc8xM7WwyMSqgnc8Dz9EoBe+qc0W+ShkpgmYOtvlULJbfUG1TK8GMLC8oAF0gklK39MXZxXDg5BkXflbZCaP24fhTLU51HExog7n8JSdt9kpF2Dy3Z3iip+YIwNF0DFRRcDxvvIe0Z848n8Cpj0ESqDxOFX84R8h2vgopSZ8zzLVSSp1IuVRJIdZc4sJWg+5dkQaMxd6Qhl9QQwMHMCWz12Xxv3F5Zm1dsRrkt9HpTkpH8m3lqjokOqeUD5WCAu/NBwE5jFfDQ8sTNykb/QR/3greVr8qc18BwSjBOPUwSH1aWEf4Pi3b+r0JO+BhOcWcUKOEOzX5/PRm2Uqi9FegE1xiw7P2QRWTEb8dpAaib2Z/2fXQ3QtL/KGX9//tZW9iGoexgWuuRGAdqNIaTnBCvJL6phNEbYraOIuBbDv3CRDJ1IyW2vKHyb4MzvUrVF4VkMFeHEQGJ3+zn+ZME0NeZQpbauuNl6UJz5xfi1L+mj50kNCR4Wm7ruaOs1ri2pju1hZ6+GbX5qpeGByvx4EQxfImaULf33V1DUc04JxYIlGmHOAwqWxTAz4S+WtbvnLgTa6E9KAnrE9H3FbhVZK1faEhi4Rh8SKlAuPfzzqHYLy8a6CstWCJPRWjPxnsEV1pMILvq5L3WW7cM=</span> <br>
<!-- !!! dont changing this !!! -->
</div>
</div>
<!-- -->
<div class="tabs">
<!--tab-->
<div class="tab">
<div id="tab-content1" class="content">
<div class="text">
<!--text data -->
<b>/!\ YOUR COMPANY NETWORK HAS BEEN PENETRATED /!\</b><br>
<b>All your important files have been encrypted!</b><br><br>
<hr>
Your files are safe! Only modified. (RSA+AES)<br><br>
ANY ATTEMPT TO RESTORE YOUR FILES WITH THIRD-PARTY SOFTWARE<br>
WILL PERMANENTLY CORRUPT IT.<br>
DO NOT MODIFY ENCRYPTED FILES.<br>
DO NOT RENAME ENCRYPTED FILES.<br><br>
No software available on internet can help you. We are the only ones able to<br>
solve your problem.<br><br>
We gathered highly confidential/personal data. These data are currently stored on<br>
a private server. This server will be immediately destroyed after your payment.<br>
If you decide to not pay, we will release your data to public or re-seller.<br>
So you can expect your data to be publicly available in the near future..<br><br>
We only seek money and our goal is not to damage your reputation or prevent<br>
your business from running.<br><br>
You will can send us 2-3 non-important files and we will decrypt it for free<br>
to prove we are able to give your files back.<br><br>
<!--text data -->
<hr>
<b>Contact us for price and get decryption software.</b><br><br>
<hr>
<b>email:</b><br>
<a href="[email protected] ">[email protected] </a> <br>
<a href="[email protected] ">[email protected] </a> <br>
<p>* To contact us, create a new free email account on the site: <a href="https://protonmail.com">protonmail.com <br>
<b>
IF YOU DON'T CONTACT US WITHIN 72 HOURS, PRICE WILL BE HIGHER.</b><br>
<p>* Tor-chat to always be in touch: <a href<a href<b>
</div>
</div>
</div>
<!--tab-->
<b>
<b> <b> <span style="font-size: 22px">qd7pcafncosqfqu3ha6fcx4h6sr7tzwagzpcdcnytiw3b6varaeqv5yd.onion</span>
</b><br><br> </b><br>
<!--text data -->
</div>
</div>
<!--tab-->
</div>
</div>
</body>
</html>
Emails
Extracted
Path
C:\Program Files\How_to_back_files.html
Ransom Note
<html>
<style type="text/css">
body {
background-color: #f5f5f5;
}
h1, h3{
text-align: center;
text-transform: uppercase;
font-weight: normal;
}
/*---*/
.tabs1{
display: block;
margin: auto;
}
.tabs1 .head{
text-align: center;
float: top;
padding: 0px;
text-transform: uppercase;
font-weight: normal;
display: block;
background: #81bef7;
color: #DF0101;
font-size: 30px;
}
.tabs1 .identi {
font-size: 10px;
text-align: center;
float: top;
padding: 15px;
display: block;
background: #81bef7;
color: #DFDFDF;
word-break: break-all;
}
.tabs .content {
background: #f5f5f5;
/*text-align: center;*/
color: #000000;
padding: 25px 15px;
font-size: 15px;
font-weight: 400;
line-height: 20px; }
.tabs .content a {
color: #df0130;
font-size: 23px;
font-style: italic;
text-decoration: none;
line-height: 35px; }
.tabs .content .text{
padding: 25px;
line-height: 1.2;
}
</style>
<body>
<div class="tabs1">
<div class="head" ><b>Your personal ID:</b></div>
<div class="identi">
<span style="width:1000px; color: #ffffff; font-size: 10px;">Na03TbH8ypax6HsPUhS3EQgJpAbxWMkl1Guou58E6g2qQ/WUg2Fq+kbdhXdzOTjiy9CfFnX+RNYqNyWEXGXB/0xmhEVtdlWrnOpdWCWStsPEP05pIUI3g2dbOwyhumfiQ/nKtlB1HLTZvJeRcYUaDiIfPLcMSEQ5Y6KxiPqK4leVNtFju3C6VWnWs0rHt8gRtp2l66R2jw0Jfo0oNBsH/j/TA1Bh8yKN4/zfADYtxKWDipA8EIl7WCgE2FJsFqwL8B/JXNZ36GyAxi7wU5BtnhVE3YOa8xhcqVz9F/D1onX0p9dAN+QZIVjr2SXlfTIQiMWjWvInFL3Il28Rzyvci+t2B82HnRn1fkjD+ORDxqfdbQS0+hQu9z/Uo9giJeYCzGhmpEudzjnutNVhQdyLkXH+qhdRmxm2a4xILS1NMuIPsbiHuoy3gfcFIAzO+VTOTtlaLL2f+EDIW/g7fb76k63dOq9EvuPanTxYHX2wYt//kLeQuiRt3aI6vZfwtkoLLSJd5np5mc211MFxW+4mxKewl8l2DjpHkts49ULH+s5J1E9+BQEIcY7o1WcI17DFIwIW5heRdiICJujMY0E2roEn+5+UczScHXOPjCVaLn3hvkBJ/aGWE1VHDmMFlZ2Ba4vli7+So4h3XGe0brGa5OIjL13D+rD+j4wxil5MR5lLfgDKtMYqAtGK2D3HHhY8aySG8DbnJCHnrrFzZGjbxlWHVRmw7NWrOQzo6SHiodAqjDU0lGj9uczwbDUZzgwRNWwDyY6YWkHRQ3A4QJKoTXg8q3723r+xNmGyIiLeWsBGS8xAQUL5zNhEVI2oeFoOJq7lrUnDrYAVWdHQknboIrsXeBkpn6pz23D/roRJflRtf1aP1teGCYx/+MekLYKpNhMlGsSMsIq4SobnJCMZBNet1SfbEwZ0Vd3oueVNdmIydptq3sVMnlmr0ncPdQD3A6PmuRv/ED54BRtZBdmfYtfNWk9xqW62tRxYKzbVqf08Z7umiYwDeP11fxTInyQFwfdtC4U+b1TpLUiNLZ3ydcClefp0SVEcJ/m36r5BN6rkkflYs4c7G1BT6wLo72It50vfzab46PhpR/pZK1EI/GL+fPnlsOfjrsi22d7FWC6qrxeJCGm1e3UA9IlMvRwup6s6l/G5xvMFtzioszHfF7Xpmafj6AB5eEf+eYiNHuWEE8z92d+idZ3rvDbuQ9bPRETtAtIuTNfq0yLiSt1SHgTnXhoQk0oW7xx6APiEqBLTsOL2oi32WCsD5z8jMRi7Gu/jzSjgCeuqQt56hIHmNtt2QWVesCPjyelvByM/S5BEbDUElBb5kE0dmbJ/1HWQuCdkTKOU272C3/OTD+Z4s8m8mLAHTnH34kvNNpJXNnQ0objHJqhph7o2H22hchKe6zJe44HxvEHygslFfNDAqWaVkgGBALSN6QCS62MjhBy9ysVJWz9dGWI+M1bzNFOqtkpO005VCT66i+3FIZr4e4jtRTgf9vhzyQUHaCkh6B9TCWmDFmX3Q+VPNg6wxtJ4qQmqEYTA5CuIPYqxdWUzVeqeGYK9ZQNtKhLiPjLrI7COw4L/3p8Pkc74tMFUFITg3M5NASJ3DBzk4SAQguWKlKAbB0Rvw/Pq/X31IJKeZyWJiM7v0nUu5BsPVZt6YReWGotUh11Rm2UwMD5FvN6aR/gfvMPmrLeP1NiXmg5dZRM=</span> <br>
<!-- !!! dont changing this !!! -->
</div>
</div>
<!-- -->
<div class="tabs">
<!--tab-->
<div class="tab">
<div id="tab-content1" class="content">
<div class="text">
<!--text data -->
<b>/!\ YOUR COMPANY NETWORK HAS BEEN PENETRATED /!\</b><br>
<b>All your important files have been encrypted!</b><br><br>
<hr>
Your files are safe! Only modified. (RSA+AES)<br><br>
ANY ATTEMPT TO RESTORE YOUR FILES WITH THIRD-PARTY SOFTWARE<br>
WILL PERMANENTLY CORRUPT IT.<br>
DO NOT MODIFY ENCRYPTED FILES.<br>
DO NOT RENAME ENCRYPTED FILES.<br><br>
No software available on internet can help you. We are the only ones able to<br>
solve your problem.<br><br>
We gathered highly confidential/personal data. These data are currently stored on<br>
a private server. This server will be immediately destroyed after your payment.<br>
If you decide to not pay, we will release your data to public or re-seller.<br>
So you can expect your data to be publicly available in the near future..<br><br>
We only seek money and our goal is not to damage your reputation or prevent<br>
your business from running.<br><br>
You will can send us 2-3 non-important files and we will decrypt it for free<br>
to prove we are able to give your files back.<br><br>
<!--text data -->
<hr>
<b>Contact us for price and get decryption software.</b><br><br>
<hr>
<b>email:</b><br>
<a href="[email protected] ">[email protected] </a> <br>
<a href="[email protected] ">[email protected] </a> <br>
<p>* To contact us, create a new free email account on the site: <a href="https://protonmail.com">protonmail.com <br>
<b>
IF YOU DON'T CONTACT US WITHIN 72 HOURS, PRICE WILL BE HIGHER.</b><br>
<p>* Tor-chat to always be in touch: <a href<a href<b>
</div>
</div>
</div>
<!--tab-->
<b>
<b> <b> <span style="font-size: 22px">qd7pcafncosqfqu3ha6fcx4h6sr7tzwagzpcdcnytiw3b6varaeqv5yd.onion</span>
</b><br><br> </b><br>
<!--text data -->
</div>
</div>
<!--tab-->
</div>
</div>
</body>
</html>
Emails
Targets
-
-
Target
d9de562ac1815bf0baad1c617c6c7f47d71f46810c348f7372a88b296d68cfae
-
Size
335KB
-
MD5
c3d5522f176830c4a24223c96439f668
-
SHA1
46574cd17ee2a1f2084dc83a65df94e13ce25061
-
SHA256
d9de562ac1815bf0baad1c617c6c7f47d71f46810c348f7372a88b296d68cfae
-
SHA512
0ed0510f4bba6280e4319f3742d1775d7d251c35517f74f1e2f7350ac68239879b0171a279aab252947163977f363cf3852d52747b225aa160f882cb82bc532b
-
SSDEEP
6144:1YS9RhUoKV8TCylQ0MWNns5wiSvypQof+9RpfbMPrac6bhMq:1/9T0ylQ0MWNns5xSvyp7W6MMq
Score10/10-
Suspicious use of NtCreateUserProcessOtherParentProcess
-
Deletes shadow copies
Ransomware often targets backup files to inhibit system recovery.
-
Modifies boot configuration data using bcdedit
-
Renames multiple (4281) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Deletes System State backups
Uses wbadmin.exe to inhibit system recovery.
-
Adds Run key to start application
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-