General

  • Target

    2024-01-18_329b8aaea517a511908683b56446db99_revil

  • Size

    126KB

  • Sample

    240118-2jk7pacfc5

  • MD5

    329b8aaea517a511908683b56446db99

  • SHA1

    9abe20a9c460a3e530cb96658541c6d25700a529

  • SHA256

    c09c691d40d8b935de4b60c92e1d4fc85f409fb546fd4a5e5b5483ae150fbf20

  • SHA512

    172d290abe8fef35e8bea43319dc68092c61389257c73e94fcde68f67f97022c1bbda1fe50cd35775bda6e2473af1bad0e5cdb2ff7060e8365bbbe4765a3b3fa

  • SSDEEP

    1536:oxOUyl20w8bVZQ40iMSO1fY+iUyQs2r8t5p1ySotICS4A6QdZls8XzUXiWr4X5Fg:oMhQNDEtb3A2ZHjUyWr4X5FTDUA

Malware Config

Extracted

Path

C:\Users\ae9519-readme.txt

Ransom Note
---=== Welcome. Again. ===--- [-] Whats HapPen? [-] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension ae9519. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practice - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/C38CA5C0B6967E45 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decoder.re/C38CA5C0B6967E45 Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: jzRPPu/RDrJ/Mt8FLoRaz+rNLmk7Zn+gICRV3WbS1do7KggGJsGy968C30udUE/a +CoNf+4zy5W26IqS72au1lFceVmDpq0HFe//R2k1MCB8cbMM0NMSRomShwi0O3Al d5y79w4WM7yjTtX/bHZPPGdxE99gPTJczAPfmhioEOZFGUtgInMh/LFrkNN53U6w sqdnzJGAwN430WnwyGkl+r+/+MTd3DosS+bq+7MRBluvFUMAIH0N7rD+jOiorQz3 QX4T/r5RjqkF7kNsu8JPKYw8/4PgxAIJwQdXARCwHf+vPfBZbv8CEYPyHdlpGPKG 8AChiQhx/HB6xk606uvYpa79OVE8r+6Pj+1pHnAtJ66F3lrnQQwbY4j//g9L5KWc LUE9OWRnhtX3wILZ9R7Vrcip51LMfh0CktD3SLiv5FC6GmEuDCKZd0H7CY1kJUrf KJ90149A6ZR1bvVEMm+jUotxxjxcYkvs3oAdicAEGCaN7brFmlrIcLRKdN6fAfOO ifV1GBt9LSzR+Vpw2r3ddTSxGZq2R7yyidSrHvKW70hg5oczsJKccX/+7lITIi2v eLODU+7z7rWooWg40Qs4R5Ow3VG6qK3JrHbcUuSHNm1m2tkPc0hZw+NYsCDKgeOz bxJ9A14T3dRaE40BaGRHNgb+1XmrG0KfIyfO/AD92sfu60Qozsv1GWcBO+CywPBa svMSmZxcTGsNd1njzXsWjw1Wu0LaffZMEun2x1+h06Ld0vJunvqfEBYIDs/R/q1d mwsEop7j2uIGUHZpLkYU2oBujKO9Wavsp+V6A7qgBYloBlPkcJxemlTovW9NoaCH Z1Tg5i2mtsE5MaaWzMy4VXXTRP1W0zqm5GrMY/GQwt0xGykLttMTRCG0Yf5IFWzq QjjYYT4Fy4eSW45kWAQKzaEBGXIFt6K5n/jV9sEaf6l972m6ul1NtrQB/gM5cutH p0+5BinmEFDAXsQ28sbewn31xZVGXZUVnThymBIazDKNk7h1yo8JSHZYQNKe4ReT qW4TuLXEywdzePVRFUdlfC0N7v/Z4Uzkq0RFxi/Pq/nHzd4G0slg+yfISC1aS/MS 71TNaWrH5MM1eLw8uZuxlJxWrhqg30/71h0UKzwjgtvPHFDCk9vXB+rm52rarWP4 B4YXIPhT4XCdSfsfpjHdlnU0RTwq2Zxo/DkDa3chTSXtvhPCTTC6hpMistaA0Xsm wsiFLQmkimL1WSQ7OnexI6IUELQWm5NtQFWO/LvhOCQImaCqVZlidiVydDCW15/S 9BAErYHyEWJPNJh5ZmnEtKYsqJUWOIRzQpH/V8Vk0TIGP5zze1OQr32bExJ18HQi VVZkyMXribuEEVmkiszuzqqNfwJrdw== ----------------------------------------------------------------------------------------- !!! DANGER !!! DON'T try to change files by yourself, DON'T use any third party software for restoring your data or antivirus solutions - its may entail damage of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/C38CA5C0B6967E45

http://decoder.re/C38CA5C0B6967E45

Extracted

Path

C:\Recovery\74t71xs-readme.txt

Ransom Note
---=== Welcome. Again. ===--- [-] Whats HapPen? [-] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension 74t71xs. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practice - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/D5EC50D57851DC05 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decoder.re/D5EC50D57851DC05 Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: b0/vL0iujnwJn01MaHR/TwB9LTRQfreY5jJ7OLqmhyVxhGqVt1PsAXjFCInLFmAM u9o5OqWGQnM2XdcZQbp3dBxNu2VIcDYD7Ol3EsmHuaqtwRxGVmAKfbgFIaEfsQHU FwDMIa68WnrIiQ4NwKnSf68VD7D8ifDrEn6SS1A7uDE6sexJbjacjrw/4JLPc9sa MpyCiE/MUzR0wxjLUHZpQzdQbX41vlYdVXBu+IYgOcfwT5lyc8OvITEO94tYb6w5 zUXwvtDPuniO+zsElkjV8zHrvpwi9gsLZP8nA29aRtb70z99Xh87EEX+H89qpcG9 J2vwiKPDtl60S3frphWmnRx1FbEvCGnsanP8AB6uSCFatjMgIom+i7F04EVE3I72 vY61/8AzK8TCBn5cI/FarUyrm2s6c7Sy2gdIzi7iU/WA7FDYKQW7UeYkiA2lvk7D SXPdtUqsIgMYMdHO1y2Bf48C9DwHwNdKwMn4keCpa4fPBLE0j/1lq2UBipCn90Bf LNLE4RqIDfQw5GeGVQfbj1ZAH+iNgdqQGyECzlRa1o5XCq8ye419ISO7tDSUU5xr LUIdXnF7LxZdy4PNiGG1mJ53CJGHKV8sEwcFFx0+zEg6o1mWLEQsxzFTtyZmBn66 5r1F9zXOMbmtPkWWV4uHd01XOi40gbs10Vu84NUktML8iQdOwqpb8+f+geTEYU9L nVwVrfPmqsVAOIVDT2dm9JfMRA2xjzBAabbj0eGasDTifPDDEIAwEdN56QTzcESA H053mXfDfcNzN9dRjXqbDe8J/FpBCUD0I2l/Cuh5ORpwDUQZiwGdiHAtVXf8VIIC 7HShRyDIXNo/2ClhGPRred0iw7JPJUkuU48zepYTnUFBA5IyMs/ARuokWb9Nz5/K rhaS44TNpyCdqs+bL9Ir735LDgXTx9RLsRbH8soytkH7ggXJssYyIU0JZ8dFFO0+ obO+bwSvz+0ubpvNV2TEwOAAbZLRY1/EnHWC2aVYCbuywN3ap8J9xVx5PlsFky28 W37ayZahsndaoD/CIgXErKc0G2c5uKWJh7mVw/MOeBN6X4zLF+EYfoKrOm3nNGZ+ ZlAUWz6KhYBvYE8LMf32yFUG4UjwlRVpqJ8yzpBAhiiD0GS8+IBkDG2PPtwoEHPA fyTwg44CVchzslXlo4/iTOi8pxD+dnRSl//8OmGess593/9nObO/U2c7waNpngnw cLeMcmosKzTqKE3XtlVZ+hW0mPwabzgpVZPKmt7X5fBWQrhUqYEiaRcfj99QAsjJ QCuc9IVcCqYuGPr7K+jIEZf9GIIgDHViYqech6Y6R2G3zVJo4ae6z6wrhIm71nyL 2YJjSwTp7g6ZTNy0VNrg692ZY1oDcTQBAcOxPvwg ----------------------------------------------------------------------------------------- !!! DANGER !!! DON'T try to change files by yourself, DON'T use any third party software for restoring your data or antivirus solutions - its may entail damage of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/D5EC50D57851DC05

http://decoder.re/D5EC50D57851DC05

Targets

    • Target

      2024-01-18_329b8aaea517a511908683b56446db99_revil

    • Size

      126KB

    • MD5

      329b8aaea517a511908683b56446db99

    • SHA1

      9abe20a9c460a3e530cb96658541c6d25700a529

    • SHA256

      c09c691d40d8b935de4b60c92e1d4fc85f409fb546fd4a5e5b5483ae150fbf20

    • SHA512

      172d290abe8fef35e8bea43319dc68092c61389257c73e94fcde68f67f97022c1bbda1fe50cd35775bda6e2473af1bad0e5cdb2ff7060e8365bbbe4765a3b3fa

    • SSDEEP

      1536:oxOUyl20w8bVZQ40iMSO1fY+iUyQs2r8t5p1ySotICS4A6QdZls8XzUXiWr4X5Fg:oMhQNDEtb3A2ZHjUyWr4X5FTDUA

    Score
    10/10
    • Modifies Windows Firewall

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Sets desktop wallpaper using registry

MITRE ATT&CK Matrix ATT&CK v13

Persistence

Create or Modify System Process

1
T1543

Windows Service

1
T1543.003

Privilege Escalation

Create or Modify System Process

1
T1543

Windows Service

1
T1543.003

Defense Evasion

Modify Registry

1
T1112

Discovery

Query Registry

1
T1012

Peripheral Device Discovery

1
T1120

System Information Discovery

2
T1082

Impact

Defacement

1
T1491

Tasks