General

  • Target

    2024-01-18_329b8aaea517a511908683b56446db99_revil

  • Size

    126KB

  • Sample

    240118-qzpdhadac3

  • MD5

    329b8aaea517a511908683b56446db99

  • SHA1

    9abe20a9c460a3e530cb96658541c6d25700a529

  • SHA256

    c09c691d40d8b935de4b60c92e1d4fc85f409fb546fd4a5e5b5483ae150fbf20

  • SHA512

    172d290abe8fef35e8bea43319dc68092c61389257c73e94fcde68f67f97022c1bbda1fe50cd35775bda6e2473af1bad0e5cdb2ff7060e8365bbbe4765a3b3fa

  • SSDEEP

    1536:oxOUyl20w8bVZQ40iMSO1fY+iUyQs2r8t5p1ySotICS4A6QdZls8XzUXiWr4X5Fg:oMhQNDEtb3A2ZHjUyWr4X5FTDUA

Malware Config

Extracted

Path

C:\Users\10w27-readme.txt

Ransom Note
---=== Welcome. Again. ===--- [-] Whats HapPen? [-] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension 10w27. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practice - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/C193AA5B7B749436 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decoder.re/C193AA5B7B749436 Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: vTjWTLfPDGh+Hjz2E+Gp17IEarGGp7oPRPv7gOa19ArTMHGYaQwqqj9EPqphXZ1S 3gGp8W/jatMTS0XvQqNq9VFajwfUrL7CXn9/6T/iv/hKTwKxvsofoj32IALAdSeI NrhZKzvzZGW064XfRhPdoynTOBrMmQnER/q7tlem9qoLzRYHBycN8QhYnUZpq3y/ Ay8kOKMK2l4UjvqEhF01pJUFDN5wOe7gfTS+dn5esPwGPQos9bIw5RXV7XlgfKIO esH0NHSoKHo6S9LyPZDx4M8Yah1iW5K65d0MR2OSPUblKuZKLCDYUfXKGm6pz+TK 2vhOaA/gLSzeNnlaUqguVPklsUdq1xnezk+x7cBOixd0HINfBdzGeEs3jwhCX0vn 7AW46OWmb2lwnHVAra4/6Tx9lf84TX1xMvHm3b0VMb1MXIx2OXNBd0zjphOuR4J9 ZkisT+tBt4n+pR3nMqWWrgB4wLUQGiCuaDN6V67jiv4+iK5Z0+OVylSrvXUsJ9fL t1n+0ALivekahZ5dAxE/0L1Dc6hCO8o9rC3PRrxqbd3rHq7q54dCYx4J47E7jl0y l5W3doNn6vUgxVmJLidGfPQQAFALZAt06FuHTP6adn8WHHqW3lMc75l0q+2rjHhR a29yD8VBq1i5XTpcaiA/2Be8ZsUUQBAQ4ZtnP1BFXKkJgRAu6XCRAkIZ/1qeFEaK aLJs1Rm9ToysEARrWJIPWEyoEtoJnGM/8dzUQSIyrWpM1hHssusd0JzCuAwP+Z0r NYCFVw51VERWNtyl2AUNlBEpFrU7NXZqERFiWfWDsLigquxdNtWvQojGd3Tojv0r oDMTLsVoMVRdXNge8q8dXjPjQJXQcHwcqDnYYEGR9t76uTlTKYe0veu728TFL4bf sgfyBP1HPdb+t6rh6yD/qR7h1KR4brBXYyG7IVHvWhroBKx55qcNnAKhtQxX8G+M dprv+ndhfZL/wTEKywGghwhUCAj/2HmSa3k90xBqDwXL9JrX6+UCtYzHGM3eNBty QAioPNeASSw02e8yl7z12FmwBb8GX2nZFzw2UupdgUkwl3eNoaAumRPFEV9aBhJz V7EBYeYgDjg1mC3FqDClmeefph3ToZ2Jlxqegc+6lWXsuLjk5z5rU1YGuo0TckBg xO0hSpG6Cpm6JramF95OJGq1YTsbv1xg/j/Oo14gLgI3LeOY7FGvc0iXOHQddaa9 oEQ5TDx5m6+YR+/XIc2P3T0tTq7kiC5DRkJI77/Bxx0wOJwbLQI1fFzC61AmCuQQ UZrCSj+gIQpiwsxK+cOiWabbpOF/0TuVWHe0G6YhEGBJDw7ZYT5VXfoMaZAY7Khm xHOQV0lCmEz6HpRyO9XvHXMOhZk= ----------------------------------------------------------------------------------------- !!! DANGER !!! DON'T try to change files by yourself, DON'T use any third party software for restoring your data or antivirus solutions - its may entail damage of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/C193AA5B7B749436

http://decoder.re/C193AA5B7B749436

Extracted

Path

C:\Recovery\b39a7x9s1r-readme.txt

Ransom Note
---=== Welcome. Again. ===--- [-] Whats HapPen? [-] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension b39a7x9s1r. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practice - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/121E315B4A0B181F 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decoder.re/121E315B4A0B181F Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: cNNrETrx0+mqfexYO4HoUGMD2qjOqACbYn5leMJnL+x4ftPS/89sjkC8uDpMaUo7 hrRFSasCmLpyfx6LFK73wNg9l+evYBRl7G1OXA6QbIoRZKEiiYGhKJHhLNW76O9o 4G9+a6TSI1t597apZnzmko4BGIPoYgO8gn6AeJCKRD4aHxEJf2mKaXsm2lw7k25f Eqlti1e3G9T7acDIHThxHszFfPQ4ucsUNFq4oLay+/NIAjcXhuKrm9/N00LCAual XlDpTabiIco/MTlsAIHbqRbmAPYsriYjAsj3GMLGRoVGd8iniHNK9u+eFdIsISBB oEmcTrOou2K9N/XB4WlX1MjJw2ENl5r1CT2JJ5wYKDqzfaPTyoGMi9Fs0IS3h7Cj R/A2KWyY9dzhVvfHjnpHiVVr3GP88WwQWpZdToiu/oSExgLGjK85schRPN/rXr/N DhiSzHgTmvY2McVdHWv81ylOpiicBu+LLrU3YLjoFv4lqUg8rYzENmpDCCcv6Drc 2+QDslI1W4Q4irMjEfOR/KdHh97H6jbJVyZEWs/MgFMnIieEc1Ao6KcJetrBeT4W L8pJkqElkSfnGBxMjlmpclVPXN6UFRHEFN2prfdASg+KhroYvKMJ3zK22RiP+nBO gh9jVAK2Okfhgbmknyy70XVzTgkJelAM+Hl75UamvJRWJQBFEIQTWCBMkZq1up5F SnWT5kMqxIo59KGwufsxwsyyLgi2oEKupxlOefI52oSFrU9+QktLk/Ff1/bAzqKJ dbipye+JKWJQjwHmyq7VnaGkr/Uf2sBj/vh/ibd1QX6dHxayQUZ423lzcBfYkTaP v4hBYXo8lWc04ijwpLRan86S8aA+krjxbIp0gmCRmKWRbrNews2lnhpNR+EsZfLv HCRIMGoV7kmL/Jsjw2SoFMG6lg/lSXw5sNqtzChJznIiPz6xSKEbCysD8LP0Mo7e 4abQBFz8V/CZOH07aZOxJFM7lF59bji/CV/B3AdPukb+oUJQdD111crN5CgaNMbi V6VnUne9EyDCIaHOIbBUmSmwQoRWpdOYpp52LXLc277Quj4RblERAGvS2jgTWCK6 5hltiJegQSNEXgjkygcLsLXXn20KTBAzIT+RkkSdYpkXkRB5sb23nX6ITtCaO8Ds dUh1hk+pTIANWDdXx0LE52L8+ghE7rvGcfyDH/2p5wxYQm+CB6ZsXXGgkgfnjf/Q KGCeQmzPYP2GYfjxt/gq+V3PZLxymIWq/Vt53L9YlN9khX9arvLj6swvFLDy0bsY 23Rc7cNXxNIoCKDsvY+MuJM8CSyqBoOy42NtftdUcHDEerH8fmCz/W1gStv8x0Rj RJ7987CfkRnhlbpAWDEodVCz1pdVZlt/gvDnxP0n+ZpCTlRk ----------------------------------------------------------------------------------------- !!! DANGER !!! DON'T try to change files by yourself, DON'T use any third party software for restoring your data or antivirus solutions - its may entail damage of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/121E315B4A0B181F

http://decoder.re/121E315B4A0B181F

Targets

    • Target

      2024-01-18_329b8aaea517a511908683b56446db99_revil

    • Size

      126KB

    • MD5

      329b8aaea517a511908683b56446db99

    • SHA1

      9abe20a9c460a3e530cb96658541c6d25700a529

    • SHA256

      c09c691d40d8b935de4b60c92e1d4fc85f409fb546fd4a5e5b5483ae150fbf20

    • SHA512

      172d290abe8fef35e8bea43319dc68092c61389257c73e94fcde68f67f97022c1bbda1fe50cd35775bda6e2473af1bad0e5cdb2ff7060e8365bbbe4765a3b3fa

    • SSDEEP

      1536:oxOUyl20w8bVZQ40iMSO1fY+iUyQs2r8t5p1ySotICS4A6QdZls8XzUXiWr4X5Fg:oMhQNDEtb3A2ZHjUyWr4X5FTDUA

    Score
    10/10
    • Modifies Windows Firewall

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Sets desktop wallpaper using registry

MITRE ATT&CK Matrix ATT&CK v13

Persistence

Create or Modify System Process

1
T1543

Windows Service

1
T1543.003

Privilege Escalation

Create or Modify System Process

1
T1543

Windows Service

1
T1543.003

Defense Evasion

Modify Registry

1
T1112

Discovery

Query Registry

1
T1012

Peripheral Device Discovery

1
T1120

System Information Discovery

2
T1082

Impact

Defacement

1
T1491

Tasks