General
-
Target
124189344cd7969a7174d6652bb612828e82307f60afdb1d658cf1e9a4efac31.sample
-
Size
415KB
-
Sample
240227-v5cdcafd5w
-
MD5
c75eaccb4f77b4dacdfcd729c0023e7f
-
SHA1
6230a54fda6e7da81ebb7f5e873e4827a752b34d
-
SHA256
124189344cd7969a7174d6652bb612828e82307f60afdb1d658cf1e9a4efac31
-
SHA512
e438d2d64d1337b660bf7ba535b156f39a17b6d805877c5fc9f31f9cd1d66c0c6fb0a60abb72ecb739088251960a3ffb5c5e1fca1e249e72074a285be70e984c
-
SSDEEP
6144:zcgS/jzUFtC80S2qfjoT0K2xuVzg/tjwN56gZmSubY0fxauJyaqesvzgW3:IgbvCIb0920Zg/hIQ6OBgqIH3
Score
10/10
Malware Config
Extracted
Path
C:\MSOCache\All Users\How_to_back_filess.html
Ransom Note
<html>
<style type="text/css">
body {
background-color: #f5f5f5;
}
h1, h3{
text-align: center;
text-transform: uppercase;
font-weight: normal;
}
/*---*/
.tabs1{
display: block;
margin: auto;
}
.tabs1 .head{
text-align: center;
float: top;
padding: 0px;
text-transform: uppercase;
font-weight: normal;
display: block;
background: #81bef7;
color: #DF0101;
font-size: 30px;
}
.tabs1 .identi {
font-size: 10px;
text-align: center;
float: top;
padding: 15px;
display: block;
background: #81bef7;
color: #DFDFDF;
word-break: break-all;
}
.tabs .content {
background: #f5f5f5;
/*text-align: center;*/
color: #000000;
padding: 25px 15px;
font-size: 15px;
font-weight: 400;
line-height: 20px; }
.tabs .content a {
color: #df0130;
font-size: 23px;
font-style: italic;
text-decoration: none;
line-height: 35px; }
.tabs .content .text{
padding: 25px;
line-height: 1.2;
}
</style>
<body>
<div class="tabs1">
<div class="head" ><b>Your personal ID:</b></div>
<div class="identi">
<span style="width:1000px; color: #ffffff; font-size: 10px;">AbooGhi++Fn4EK+GJURRfDhmKc4OIRB0QiDhvGIbvUcVrSZA5iKfqm/xWJur7tCNIWAbqwi/5H6J9U89/ThGI3gMRC9CA1ZzZ/bMTCpW4oMLRWxUn87ZM2sko2J1ZU/HXKJvpNUSrauFBk7zyTt3NPPP0BIDR6sgZIleEBX2ntHGdg2m6J1xIX7T7pbvX0eHxtLkMB1dl6DtMCVi+tXWwySHptX4HRCi+je09AmGmEApBN4ODCJpp+LoNY5EqzaHfQj1UyXGJHG3mHvZ4ImFv0In/hbZlUjzm/30Hg4snqK8hAhQwj89y93deNgmC8P/3Nub8znxAmg1Q8/bRpN/CfvA/MvfKCM7+OFHFdd/OknRDnP2FVLVaQ6bzFXpPG8O3V9A+1qI12PqEeKfTZkYHVHs49WwHgxjNhtk9jVY4coHN0w74iHrGFUCUCtQ+km3XQR+vtUjfCJXjo5Zt3T5ghDswmQxC/itDMGqm0poT8/Um0UXLeLEOUbeTz161nHlCmFAmazHoH05uZ39B4EZeQUqjS9h/DgBF1j3DuIckupqlRxW2RA+Gc3Fc/BBvvMdUYZve9aGNOEs/JFNZwBjkNLLoMj3WQzkJvH4wwq2xHcCqXD3cez9evTyfv43bHPZCBS8qkM75guJNo3uUZRtLW/Tj9qFXfuQzeRE+4eXDV87cgofzU0rcsSoblfvUzXr7a2p6I75W01CjmfCZsQF6SpBKJp9Ffkg5zAocuSi5p9DhgRHCrMaXkuQxTbhra9a7171w5DVQaxOlSU2UyBdXOOaErkKpbw1XzwlHaIk9jIVkphdIeWM5kF3xKcYBiedaefe43T/5MO0y8A5tqWdP3FAdPof/TMkSNnBUFnsWhp134PRmNRezPltZtEvBMPOKkzjwse+h3PSCSKazoLZy9giScEzXGEtSnUqgch+Odg+72HEzxLNxTy2ll3Sw4RRwagTKjchjVAO7S+sUp9J/5jk2DJOSGxHjlJjnZ/1uK2dkTGe/2Vv7KFpY/xMQyaEB49cM83F4cs6fWqls1M8oAXwxIj4IH0Ai+/m6Cf9Tr30SHPqSP2nAfI7mS0d6O3KJ0uhSJZzUhsxWlAEULv9ORlu/WDauMKtNSQgFYZkis8YHomCLVgFD+JVjCpfs7LUEP5YL0+5T9RB/lBHCskrCG8qOqrKQjPp4I14qthnHsox6X0aTrR6Bnja6GlOFmg1kLBOa5iJIyoUrQtmBMQvSCwOwY285G82vEuGVwd2IF1YB+KeF5sfflJdDtuB66mBuogTebb6OP3v+YJgggvv9TdDeJhXtU95GOKZT4MRG7w6Sq6EypyRd5Z+vgjv2w46mPejXgmeDIrXnnt2V7gvepn6n1kGdlCf+U9lB4k3c7NkJ+iBtVOuiLyNJNaLLr06BUaFxz3iCQsWrlY+VEEcA/vmVD5KsgmNZs0Ni/daha4Nc8prSBb59iI1lLtw+2V7dTCBTb0Xu9af6X0Ld7tIdIle3G2o5J5vq0H8Uu0LseJ6omwCh97aqfwBytsAvbSn7jR3iDrDR0Q7idI030umw7KwTn0fXn06vXhyMybd6mGCAH2N9l5ZeQnLSv+IEeMMvmPlEbM4E7NaY9g4FM3yNJUkno01Cv+BBvJasF/J4MXUglmu4E2O4c68V/qRlzXTkiPlN/9gwm20JaXquDzNlGSTKDgX8C6humiexMX2hoA=</span> <br>
<!-- !!! dont changing this !!! -->
</div>
</div>
<!-- -->
<div class="tabs">
<!--tab-->
<div class="tab">
<div id="tab-content1" class="content">
<div class="text">
<!--text data -->
<b>/!\ YOUR COMPANY NETWORK HAS BEEN PENETRATED /!\</b><br>
<b>All your important files have been encrypted!</b><br><br>
<hr>
Your files are safe! Only modified. (RSA+AES)<br><br>
ANY ATTEMPT TO RESTORE YOUR FILES WITH THIRD-PARTY SOFTWARE<br>
WILL PERMANENTLY CORRUPT IT.<br>
DO NOT MODIFY ENCRYPTED FILES.<br>
DO NOT RENAME ENCRYPTED FILES.<br><br>
No software available on internet can help you. We are the only ones able to<br>
solve your problem.<br><br>
We gathered highly confidential/personal data. These data are currently stored on<br>
a private server. This server will be immediately destroyed after your payment.<br>
If you decide to not pay, we will release your data to public or re-seller.<br>
So you can expect your data to be publicly available in the near future..<br><br>
We only seek money and our goal is not to damage your reputation or prevent<br>
your business from running.<br><br>
You will can send us 2-3 non-important files and we will decrypt it for free<br>
to prove we are able to give your files back.<br><br>
<!--text data -->
<hr>
<b>Contact us for price and get decryption software.</b><br><br>
<hr>
<b>email:</b><br>
<a href="[email protected]@tagorix.com "> [email protected]@tagorix.com </a> <br>
<a href="[email protected] [email protected] "> [email protected] [email protected] </a> <br>
<p>* To contact us, create a new free email account on the site: <a href="https://protonmail.com">protonmail.com <br>
<b>
IF YOU DON'T CONTACT US WITHIN 72 HOURS, PRICE WILL BE HIGHER.</b><br>
<p>* Tor-chat to always be in touch: <a href<a href<b>
</div>
</div>
</div>
<!--tab-->
<b>
<b> <b> <span style="font-size: 22px">qd7pcafncosqfqu3ha6fcx4h6sr7tzwagzpcdcnytiw3b6varaeqv5yd.onion</span>
</b><br><br> </b><br>
<!--text data -->
</div>
</div>
<!--tab-->
</div>
</div>
</body>
</html>
Emails
Extracted
Path
C:\Program Files\How_to_back_filess.html
Ransom Note
<html>
<style type="text/css">
body {
background-color: #f5f5f5;
}
h1, h3{
text-align: center;
text-transform: uppercase;
font-weight: normal;
}
/*---*/
.tabs1{
display: block;
margin: auto;
}
.tabs1 .head{
text-align: center;
float: top;
padding: 0px;
text-transform: uppercase;
font-weight: normal;
display: block;
background: #81bef7;
color: #DF0101;
font-size: 30px;
}
.tabs1 .identi {
font-size: 10px;
text-align: center;
float: top;
padding: 15px;
display: block;
background: #81bef7;
color: #DFDFDF;
word-break: break-all;
}
.tabs .content {
background: #f5f5f5;
/*text-align: center;*/
color: #000000;
padding: 25px 15px;
font-size: 15px;
font-weight: 400;
line-height: 20px; }
.tabs .content a {
color: #df0130;
font-size: 23px;
font-style: italic;
text-decoration: none;
line-height: 35px; }
.tabs .content .text{
padding: 25px;
line-height: 1.2;
}
</style>
<body>
<div class="tabs1">
<div class="head" ><b>Your personal ID:</b></div>
<div class="identi">
<span style="width:1000px; color: #ffffff; font-size: 10px;">h4G8YP+VaCNVS8rmq4OlX0Yhp5dwk0YtvP5/yn5W7hiSFE/YoQEO6slXTxjy1tv9LsuKyE+yhJteEVy1PE45QxT0Q1g6li/1Ao4HM5MgM8V8zcHk7PU1q3Z+icUXMHyfHVQPQnO9eVUvaBuQBTl05ov7cHnQNqPI2M20d6wp/+KB5btaJzzJ8qIHtzrjlvPPUfTcrh+7EdjU/iARptr0bnZARsh5yH2VLryeNAlpcO8JatAuadMkwsuOqeDdcxZOWK0EmLCjdqGQWoBUw3AvIsavPN7W1B9ZQZk0nPw6fUbM5CXQJqPfq/Ww2teyrlLj1ZlHKtoIJZvnJH4e4ZkiHK19ZC1dX+RkW48VrlVTs6REDg/2d7Hplgdcabc9RhL6m72NRhHr117xHWOpXgDFYRZakHc2ACx9vOn655ax7uCgwNn8nu+G8kzTjL5coy65ADrMm2P7KmOYkYPxYY1rQuYq5AhA2U2HY6Rf3PzODQAcz2UNmpU7MhzXPZ9iWWUrmfv22ygN6vKDwFYXPzFipqVhOpmtY/M0e9Yl4qYYOBUK1zyw3shJt4OKtcj9RWyCC+7yjAnQzz7oDFL+I4/QJBJ7im0Bd25FHmhJ+7sUG43lJle6pswN5y6tQCkQmd3ZQxCwoDf1MPsBsviirRZFRYOPcsZulf1y2AogfBQUhnoPJ4htQqIoyQaCR87BqTg6HQk2K4wSfbxzwesi18+Fq3kfMeHs8u5C6LoxI7ZF+JG7t+57UZWASQLhG4tyTlCsBr/Yr6biapPFMKqrWdS7GrZU49Vb4lKGFMg3KGQkvy3sEn64f4WjGBtFdnODyHDiYSyYpXYQPRhrBPmulYF8Yzk0y33cAjMaRR+InQJGsv4T1QvLWF822iRZ6ThL29t7xvcI6GZZKmf10+mUlqNkWQmL+Tc6cJdS79e3ozq2hu4JyCtY5wGgmFPbeJ8LJiqDEf5h4FpRTeyOUHVbc4nFwT6GpDgku7AAgvDAh7PE6ow5TKPwJdz7cSFU0wzSHReUr5//BsBByql4r9njDtWL354pT7Qh87+ZkjpyablWsQMNsWw9AEEIFRmjKShnpYnXopYWMooAWqIpQfpacUUWo8MZK5EUlkZo2oFnezIwacQggQlc4DaobwgOR2bpZqrxJh6xIKCRGdGqHMDrLlJf/Q826clqBMo/abS8ajfpTqayAHHiBIXmSzN0H7ECo9XoBjuuMKVaXCZa+TS47c2RGC0IN9d7fQrc5HLeoZGYEYDhp4uu0+VVnjsgblww1I7VQYosFMyG8bQnNb0Rb7s+LzBoORiNLt4lX+uTBKNtsCu/Mkfh1R/Psi8hSM6WlnEt+eLlrOMQPwu3AlmKj60bRGBc/wcjhY9YNdPXncvrFggZXDSsUhohL8jdAmOdlDcWUkyZJ64lxa4pkC0JEQnbElLZtMdpmVm1nSOOdxX4ZzXRLY4pZBo0tefiYzh8hQHWf6iJ4oc/wnRPUAV4OskJUxaY4d0XvZhM07i1VfjeLZf/T3roJCUfHorDX5GccPhBCAGlRS7flWbA/g2UogF0AZIBcZNNI10bVksPOCxpQP6ot/ulFU4AKQoTbX3sCDviPKrZZs/eKThrzEpV87Bdog5Wiv3U3jshn+5uAPpdUS3nWngc93kMJItBF3UumN0sAJi2hN+q07nxhnuh3TXCwW91W6QCoTof79n5hMV6hFk=</span> <br>
<!-- !!! dont changing this !!! -->
</div>
</div>
<!-- -->
<div class="tabs">
<!--tab-->
<div class="tab">
<div id="tab-content1" class="content">
<div class="text">
<!--text data -->
<b>/!\ YOUR COMPANY NETWORK HAS BEEN PENETRATED /!\</b><br>
<b>All your important files have been encrypted!</b><br><br>
<hr>
Your files are safe! Only modified. (RSA+AES)<br><br>
ANY ATTEMPT TO RESTORE YOUR FILES WITH THIRD-PARTY SOFTWARE<br>
WILL PERMANENTLY CORRUPT IT.<br>
DO NOT MODIFY ENCRYPTED FILES.<br>
DO NOT RENAME ENCRYPTED FILES.<br><br>
No software available on internet can help you. We are the only ones able to<br>
solve your problem.<br><br>
We gathered highly confidential/personal data. These data are currently stored on<br>
a private server. This server will be immediately destroyed after your payment.<br>
If you decide to not pay, we will release your data to public or re-seller.<br>
So you can expect your data to be publicly available in the near future..<br><br>
We only seek money and our goal is not to damage your reputation or prevent<br>
your business from running.<br><br>
You will can send us 2-3 non-important files and we will decrypt it for free<br>
to prove we are able to give your files back.<br><br>
<!--text data -->
<hr>
<b>Contact us for price and get decryption software.</b><br><br>
<hr>
<b>email:</b><br>
<a href="[email protected]@tagorix.com "> [email protected]@tagorix.com </a> <br>
<a href="[email protected] [email protected] "> [email protected] [email protected] </a> <br>
<p>* To contact us, create a new free email account on the site: <a href="https://protonmail.com">protonmail.com <br>
<b>
IF YOU DON'T CONTACT US WITHIN 72 HOURS, PRICE WILL BE HIGHER.</b><br>
<p>* Tor-chat to always be in touch: <a href<a href<b>
</div>
</div>
</div>
<!--tab-->
<b>
<b> <b> <span style="font-size: 22px">qd7pcafncosqfqu3ha6fcx4h6sr7tzwagzpcdcnytiw3b6varaeqv5yd.onion</span>
</b><br><br> </b><br>
<!--text data -->
</div>
</div>
<!--tab-->
</div>
</div>
</body>
</html>
Emails
Targets
-
-
Target
124189344cd7969a7174d6652bb612828e82307f60afdb1d658cf1e9a4efac31.sample
-
Size
415KB
-
MD5
c75eaccb4f77b4dacdfcd729c0023e7f
-
SHA1
6230a54fda6e7da81ebb7f5e873e4827a752b34d
-
SHA256
124189344cd7969a7174d6652bb612828e82307f60afdb1d658cf1e9a4efac31
-
SHA512
e438d2d64d1337b660bf7ba535b156f39a17b6d805877c5fc9f31f9cd1d66c0c6fb0a60abb72ecb739088251960a3ffb5c5e1fca1e249e72074a285be70e984c
-
SSDEEP
6144:zcgS/jzUFtC80S2qfjoT0K2xuVzg/tjwN56gZmSubY0fxauJyaqesvzgW3:IgbvCIb0920Zg/hIQ6OBgqIH3
Score10/10-
Suspicious use of NtCreateUserProcessOtherParentProcess
-
Deletes shadow copies
Ransomware often targets backup files to inhibit system recovery.
-
Modifies boot configuration data using bcdedit
-
Renames multiple (7547) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Deletes System State backups
Uses wbadmin.exe to inhibit system recovery.
-
Modifies Installed Components in the registry
-
Adds Run key to start application
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-