General
-
Target
6c77cb165c448b2749b7e2afa9ac67640a9d8e0d96cc821c08adcea07759090b.sample
-
Size
334KB
-
Sample
240227-wavrwaff5z
-
MD5
7112401374cf8903070d6927e2e1f395
-
SHA1
1668adc483cf5549e30197217ccf4dd4ab667eff
-
SHA256
6c77cb165c448b2749b7e2afa9ac67640a9d8e0d96cc821c08adcea07759090b
-
SHA512
e93aeb0f651773e9b6291e684ecfd1939f14baa2f0eab3146765de484fd980b636c3bd878455b326c0ad0c2c23980371f9bde5efce20e1067166e06490aa7d50
-
SSDEEP
6144:Pkv89W2QcboLPlZbqEKvSlvgXCBVnTDg3GV06rPnej63AVLyEXq:Pk09XelZbqEKv8gXCBlPHeHLyEXq
Score
10/10
Malware Config
Extracted
Path
C:\MSOCache\All Users\HOW_TO_BACK_FILES.html
Ransom Note
<html>
<style type="text/css">
body {
background-color: #f5f5f5;
}
h1, h3{
text-align: center;
text-transform: uppercase;
font-weight: normal;
}
/*---*/
.tabs1{
display: block;
margin: auto;
}
.tabs1 .head{
text-align: center;
float: top;
padding: 0px;
text-transform: uppercase;
font-weight: normal;
display: block;
background: #81bef7;
color: #DF0101;
font-size: 30px;
}
.tabs1 .identi {
font-size: 10px;
text-align: center;
float: top;
padding: 15px;
display: block;
background: #81bef7;
color: #DFDFDF;
word-break: break-all;
}
.tabs .content {
background: #f5f5f5;
/*text-align: center;*/
color: #000000;
padding: 25px 15px;
font-size: 15px;
font-weight: 400;
line-height: 20px; }
.tabs .content a {
color: #df0130;
font-size: 23px;
font-style: italic;
text-decoration: none;
line-height: 35px; }
.tabs .content .text{
padding: 25px;
line-height: 1.2;
}
</style>
<body>
<div class="tabs1">
<div class="head" ><b>Your personal ID:</b></div>
<div class="identi">
<span style="width:1000px; color: #ffffff; font-size: 10px;">9efGYKzqHKXoHBjhXKZDPRZ+9lokGdW6Y5D61CouQyCrpfLE1AG8TQkmibk0vlgD2Yk8FgxuhARUhZYR2Hnh45TT2WJQ1jlDTfY/aVGSDDTNKmG4BaPScrPh7pwaqU0kJcQpoCPc1+/Cbqnowl7BdJ47pA/bzqs1Y0pbgaLHDVz0l/ZBI0Di+/MnkJ2x7dugjKq+fA0oR/7XEnL9IsoSV9U9+pnvYS6NkhowNxRgiwgbMwrS+KwJYD9WaBysRvCvSSf/RV2r+b89gKDKMsDQzf2yOiavnsMASVEGXwo8BVRKpoUsCmDf5rla6yG9W9sf5f5Q7o37c1cxS/Nmux3POHr//UEX41bgvWkf+Qqc8CAfhsw4s/2aWnYeZ+4p/8OQOagC+TPLMh9FoqG5Eah/iHvWHcePnF+2KZPfBHzqFmocchs04RWMku4K2d5CMpM10N6DwWD6T2U6NuSZMmnFdtVz9XxxktBbt9wJMMmdo7hWg5CJwf8owxUtwJmZmjdxu2QWk2d1SD5dBkYyo/6TiyoOUTZLITQgoMK/+RgYIYXqc5z7ZfoI79lyHPE660WzmjKgInlR1henk+jlAaJFZB/sdfFA07mWyIyqpypHAlgoJhU4yuwQDl+VpKQGC9PViwF/mhRjkuT94TWMcwSS/JNgqUNKxF/ZGzI+xdxU7XpqF5sNCtY4/Q7fAfedw5rbzM+YyNKkMwkFGWVWsoNNNA7o31IFG1KdJov7Zo/L8Zwa4LEDOdtVjvI7ISri0GwploMLHO+ObxSOiCWlsV30IdKefk9QtBD9/+uPIVmr8JNhX5vYDZmS1fYh32gClgp5lVWmSeGfR0tFOcee/FKY6MP04ex0FLkeKEESrBpLe785GwAXExcAumsMedDYpQwlkH+5CNkhBGSsp+3mB8wmxC5bHeGZZWXosZ3VLG7Hv2sdvy55+2/gcsgOLEEi6okGabzskSx7yLVm2yY/3mGMgQlEO6cS7KO+EQLmDPOsPNz+coaIzTByGuUDSMG8zt038iK/VGljPy9+9/OfQQTcg0mHo1QwFDCUb8GYvg3G2j7jWokzQEFgnApfFZFqfo+r3SVFJtEAFiB/4KnGqehoYI6LYMImGkDxPNBalCQAvKtRnu4D7hj3wMnKY3d3mdYdQA/hqqlGSUY3IHLwR2KuKmc9uheeHG+d+ZDmmUbHu2J91uK1KIHHWEofpDdFDCD++9NV8RkrnBbE0TRcp7rrRmgytZZWyIvld21J4FZDylJSmbi3/eZ6rfDysg3MMpO0gCL8Qw4b2IqtBhxXruM+/xx3nFC07rhyr8yzdy6p3w9aPd26M1BO9cdpOCZG8HqRB6Wc9/LDM4hc4G11MU4yeF87dOy0MaAV+PUWbhnnLNGWb51gRrFQeeVIe4e5nTRxUraY+vsc9nBuD0LZI5FTnH1/0iTsttdrbaR1L5o/Uw2yMW8lrf5Zw37jhyw4v0ODVp3eCjSgLu2iNbxZq7vdkN/onG7Jxg5hHRWVC6Y71coRaRlj2gpy5Hw2Rq/gi9vhLN4DEmEFT1j7ohbo9a522h4E8bqHS3wTnYwIeeQP4J3hSracpUF4NeV5KJ8gqZiSzKy/7BaDOPW5vIpcvWBoxD1oovbnOWGyI7niTF5WzNjYQOfLJrg1HYhXoogOWkxPtQLEQQJBHTsAQA1SSBuZW28bAcoJD9V9bVIAegHwvjo=</span> <br>
<!-- !!! dont changing this !!! -->
</div>
</div>
<!-- -->
<div class="tabs">
<!--tab-->
<div class="tab">
<div id="tab-content1" class="content">
<div class="text">
<!--text data -->
<b>/!\ YOUR COMPANY NETWORK HAS BEEN PENETRATED /!\</b><br>
<b>All your important files have been encrypted!</b><br><br>
<hr>
Your files are safe! Only modified. (RSA+AES)<br><br>
ANY ATTEMPT TO RESTORE YOUR FILES WITH THIRD-PARTY SOFTWARE<br>
WILL PERMANENTLY CORRUPT IT.<br>
DO NOT MODIFY ENCRYPTED FILES.<br>
DO NOT RENAME ENCRYPTED FILES.<br><br>
No software available on internet can help you. We are the only ones able to<br>
solve your problem.<br><br>
We gathered highly confidential/personal data. These data are currently stored on<br>
a private server. This server will be immediately destroyed after your payment.<br>
If you decide to not pay, we will release your data to public or re-seller.<br>
So you can expect your data to be publicly available in the near future..<br><br>
We only seek money and our goal is not to damage your reputation or prevent<br>
your business from running.<br><br>
You will can send us 2-3 non-important files and we will decrypt it for free<br>
to prove we are able to give your files back.<br><br>
<!--text data -->
<hr>
<b>Contact us for price and get decryption software.</b><br><br>
<a>qd7pcafncosqfqu3ha6fcx4h6sr7tzwagzpcdcnytiw3b6varaeqv5yd.onion</a><br>
* Note that this server is available via Tor browser only<br><br>
Follow the instructions to open the link:<br>
1. Type the addres "https://www.torproject.org" in your Internet browser. It opens the Tor site.<br>
2. Press "Download Tor", then press "Download Tor Browser Bundle", install and run it.<br>
3. Now you have Tor browser. In the Tor Browser open <a>qd7pcafncosqfqu3ha6fcx4h6sr7tzwagzpcdcnytiw3b6varaeqv5yd.onion<br>
</a>
4. Start a chat and follow the further instructions. <br>
<hr>
<b>If you can not use the above link, use the email:</b><br>
<a href="[email protected] ">[email protected] </a> <br>
<a href="[email protected] ">[email protected] </a> <br>
<p>* To contact us, create a new free email account on the site: <a href="https://protonmail.com">protonmail.com <br>
<b>
IF YOU DON'T CONTACT US WITHIN 72 HOURS, PRICE WILL BE HIGHER.</b><br>
</div>
</div>
</div>
<!--tab-->
<!--text data -->
</div>
</div>
<!--tab-->
</div>
</div>
</body>
</html>
Emails
Extracted
Path
C:\odt\HOW_TO_BACK_FILES.html
Ransom Note
<html>
<style type="text/css">
body {
background-color: #f5f5f5;
}
h1, h3{
text-align: center;
text-transform: uppercase;
font-weight: normal;
}
/*---*/
.tabs1{
display: block;
margin: auto;
}
.tabs1 .head{
text-align: center;
float: top;
padding: 0px;
text-transform: uppercase;
font-weight: normal;
display: block;
background: #81bef7;
color: #DF0101;
font-size: 30px;
}
.tabs1 .identi {
font-size: 10px;
text-align: center;
float: top;
padding: 15px;
display: block;
background: #81bef7;
color: #DFDFDF;
word-break: break-all;
}
.tabs .content {
background: #f5f5f5;
/*text-align: center;*/
color: #000000;
padding: 25px 15px;
font-size: 15px;
font-weight: 400;
line-height: 20px; }
.tabs .content a {
color: #df0130;
font-size: 23px;
font-style: italic;
text-decoration: none;
line-height: 35px; }
.tabs .content .text{
padding: 25px;
line-height: 1.2;
}
</style>
<body>
<div class="tabs1">
<div class="head" ><b>Your personal ID:</b></div>
<div class="identi">
<span style="width:1000px; color: #ffffff; font-size: 10px;">4Vjpvf9kg5VUyxQFaFgPlOmRL8j2JmJi4+YjLXwJUecSvgnbkt+npwZ2xUv+Q1CdCqgks82eViDOx34FekRdPjz+goyZtZ/z/qQGb7/tBvGFKnDMX3d4YSsXOFnX805pZl2GfBK9umvs1om4pejoPBlgH+6fbRZkkCHmLudY/4SLrs/lKiLvr/KPe6NPcHxiDAOV5rRbK/Kkmhwjdi0BylKxEYQUsa/N8AbmYdXrj8+UNH2B4rP1nZYIXsIn4qVg9NN4FhUKhi22IEyVjeXDZehQJwn2BY0qmuq0HR1b/j7ltDnf6Fm2vWNcApd70B8XAN86mRQhwLIymDU7TBx0aEPid+gux+V+tVEXwZzc1ua1T+YCuYY43fALYLfaG/Lo5z2AVbWS/FVrooJCJc+MGFpS+8dpOlR3UAPfglDuS9moeIH6bkeqnIywZKl8TD/xPOzX7TJ+xXPJ69LFzD5XLwwfxGA12GS1W0eHDo2yILarMW7iOfnQqb55ssdhTJJKJocSo8of2/rN4th4+V3IPpUYGvd/xMQ13bTeUazwn9fJDPr7ZZIGEqR4wSaPlWWzrFIO57i9Rn8QknEGvXdnfc9gNKCO+6BoWT0apVyrRFqC5M7b7+2BlOGfQPjQ5tWCqfKvOhwQNCoM9px2ikJN41MswyGrQI20gm9P17EEBpLXzeCfmbCjr/96XM4dC7gqnqljvhlNxhj8S6qbUQi6oFoQtUrlg2sor/iQPYfjnGxHiS90bWNRx6IFoKV5W3PZWLbf1SMMTugaYzsEpaWEVbzkVeeKM8xo4p0NEqHmao6StJl165HE5vFQHizLsUcbBmYya8pMTbfPXQxcD1S5DkwFriUItjPsVm6HbWeGB0VBYf63dRW3aYFHxtIJ8AA4Gb550B+lFtKUfETU7l7+rZv67q6xb1bM9ZF/fUElJ4k33kB9kdBRjkhJJuMRm2ECMMWucXHFnVb34N/cw73pQ6XiH7z0dzslnJMoOhioJqE9ERqou1JSSYjQNt4bbXwxLPw/rFtPgnDgCRfojEb6y94F2bl6zEAO4S2LyRy2LjBJXTI1gUN3dvace+Mi02bgzAhkIJN1uacrL+mgnA5DB3qRpdaGIS5J1eciPhr+5iOkYyJYtzRGUIcdlQ3Gk+z279uxAWXakyFd+9WMODxouZ2EXZxWl3dw0gl1UF2IquvIDEYzuDg8UhNdvXy3KpYIhEzx+XohbuErfaGoeKPgaG1aZ8TBC6qEB9e3mxBJLHWO85cZU2/YnptZIkILtK8SNMyKHVw5eh+3C9wuNTCIMzPaEpAW4n4z34qlAMtpD63fGIdMxmALZKwq6VuOQp9CRFlfT/E881SCQi+h8Tw4NaMyOKiA9IH3/PSOqN/A0ygHm5TLPjiZ3ne54nbdgY0blL0ZKTHenxbU8y/2L71G5lx0a7qWuGofpBmhWeW41H+eT++CPtaCwV+6bv/ImZSsmYuBSf+9c+xRzb2A9wKbEfzKx8jOnJrTEWeX4/hyK3ffIfyRJQruO8ve5aGMtkaiE2jNiLNEzuZkoqOA6pw3nP0MbmnmdCQKo7uPfajr2dUDy7dMm8Edbwd0Ndnyc+X0I5uMtphAvkIyLLsNjxt6WwzINUeKgdQ5wovyvWS4giJcHG+6AsWL5XMCbySm1T5hMj/rPUaRKrpHIKvYgpUEQSEiaMhTUuabz3avK606LTo=</span> <br>
<!-- !!! dont changing this !!! -->
</div>
</div>
<!-- -->
<div class="tabs">
<!--tab-->
<div class="tab">
<div id="tab-content1" class="content">
<div class="text">
<!--text data -->
<b>/!\ YOUR COMPANY NETWORK HAS BEEN PENETRATED /!\</b><br>
<b>All your important files have been encrypted!</b><br><br>
<hr>
Your files are safe! Only modified. (RSA+AES)<br><br>
ANY ATTEMPT TO RESTORE YOUR FILES WITH THIRD-PARTY SOFTWARE<br>
WILL PERMANENTLY CORRUPT IT.<br>
DO NOT MODIFY ENCRYPTED FILES.<br>
DO NOT RENAME ENCRYPTED FILES.<br><br>
No software available on internet can help you. We are the only ones able to<br>
solve your problem.<br><br>
We gathered highly confidential/personal data. These data are currently stored on<br>
a private server. This server will be immediately destroyed after your payment.<br>
If you decide to not pay, we will release your data to public or re-seller.<br>
So you can expect your data to be publicly available in the near future..<br><br>
We only seek money and our goal is not to damage your reputation or prevent<br>
your business from running.<br><br>
You will can send us 2-3 non-important files and we will decrypt it for free<br>
to prove we are able to give your files back.<br><br>
<!--text data -->
<hr>
<b>Contact us for price and get decryption software.</b><br><br>
<a>qd7pcafncosqfqu3ha6fcx4h6sr7tzwagzpcdcnytiw3b6varaeqv5yd.onion</a><br>
* Note that this server is available via Tor browser only<br><br>
Follow the instructions to open the link:<br>
1. Type the addres "https://www.torproject.org" in your Internet browser. It opens the Tor site.<br>
2. Press "Download Tor", then press "Download Tor Browser Bundle", install and run it.<br>
3. Now you have Tor browser. In the Tor Browser open <a>qd7pcafncosqfqu3ha6fcx4h6sr7tzwagzpcdcnytiw3b6varaeqv5yd.onion<br>
</a>
4. Start a chat and follow the further instructions. <br>
<hr>
<b>If you can not use the above link, use the email:</b><br>
<a href="[email protected] ">[email protected] </a> <br>
<a href="[email protected] ">[email protected] </a> <br>
<p>* To contact us, create a new free email account on the site: <a href="https://protonmail.com">protonmail.com <br>
<b>
IF YOU DON'T CONTACT US WITHIN 72 HOURS, PRICE WILL BE HIGHER.</b><br>
</div>
</div>
</div>
<!--tab-->
<!--text data -->
</div>
</div>
<!--tab-->
</div>
</div>
</body>
</html>
Emails
Targets
-
-
Target
6c77cb165c448b2749b7e2afa9ac67640a9d8e0d96cc821c08adcea07759090b.sample
-
Size
334KB
-
MD5
7112401374cf8903070d6927e2e1f395
-
SHA1
1668adc483cf5549e30197217ccf4dd4ab667eff
-
SHA256
6c77cb165c448b2749b7e2afa9ac67640a9d8e0d96cc821c08adcea07759090b
-
SHA512
e93aeb0f651773e9b6291e684ecfd1939f14baa2f0eab3146765de484fd980b636c3bd878455b326c0ad0c2c23980371f9bde5efce20e1067166e06490aa7d50
-
SSDEEP
6144:Pkv89W2QcboLPlZbqEKvSlvgXCBVnTDg3GV06rPnej63AVLyEXq:Pk09XelZbqEKv8gXCBlPHeHLyEXq
Score10/10-
Suspicious use of NtCreateUserProcessOtherParentProcess
-
Deletes shadow copies
Ransomware often targets backup files to inhibit system recovery.
-
Modifies boot configuration data using bcdedit
-
Renames multiple (7546) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Deletes System State backups
Uses wbadmin.exe to inhibit system recovery.
-
Modifies Installed Components in the registry
-
Adds Run key to start application
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-