General
-
Target
b477676fa9bc4972b2448e27a2b4074edc392227da5d259e87faf2eb1c8e19c7.sample
-
Size
338KB
-
Sample
240227-wgfxasfe65
-
MD5
2f956b5649ae55091e478be5f3d33913
-
SHA1
4866b3bf81621041d38cfa3e3c1c8394cd946d8b
-
SHA256
b477676fa9bc4972b2448e27a2b4074edc392227da5d259e87faf2eb1c8e19c7
-
SHA512
679130490b3af554392543371de35b795deacdf6c03798e6b8e4a607742e2b52032434272f62b501380bc9d06bc452a6985cf7e0cf35a85d5cdd4b4be74eb59e
-
SSDEEP
6144:7m9UzSJFOa0k5miRPzuuf2p9g9w2y+DthOREvvLsUE:K9OMmiRPzum2p9gGmYdUE
Score
10/10
Malware Config
Extracted
Path
C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Proof.en\How_to_back_files.html
Ransom Note
<html>
<style type="text/css">
body {
background-color: #f5f5f5;
}
h1, h3{
text-align: center;
text-transform: uppercase;
font-weight: normal;
}
/*---*/
.tabs1{
display: block;
margin: auto;
}
.tabs1 .head{
text-align: center;
float: top;
padding: 0px;
text-transform: uppercase;
font-weight: normal;
display: block;
background: #81bef7;
color: #DF0101;
font-size: 30px;
}
.tabs1 .identi {
font-size: 10px;
text-align: center;
float: top;
padding: 15px;
display: block;
background: #81bef7;
color: #DFDFDF;
word-break: break-all;
}
.tabs .content {
background: #f5f5f5;
/*text-align: center;*/
color: #000000;
padding: 25px 15px;
font-size: 15px;
font-weight: 400;
line-height: 20px; }
.tabs .content a {
color: #df0130;
font-size: 23px;
font-style: italic;
text-decoration: none;
line-height: 35px; }
.tabs .content .text{
padding: 25px;
line-height: 1.2;
}
</style>
<body>
<div class="tabs1">
<div class="head" ><b>Your personal ID:</b></div>
<div class="identi">
<span style="width:1000px; color: #ffffff; font-size: 10px;">9YSUsAXNnzpoHmYHnlvTdeZLgChXuRNrVIehf4ABOTzE8tTxVhHNTcRrPC/aHAKnIa+bNYsj9N9eKGG9rsW6VquhRxqX66lqH4q8Cd+BSwUUqBdYES/1DEkQ3zTXA1QDl7pMB66ffCMbS/QmqhddgqxQ+cZjuT+cqD7eW2PkRCdNThZ2jb9bRMzBEYh8QWuNrVRAkPO8N2aaTRZNcVuDe7amJBl7vmNxCHvlIdLSUH1+miBXoyLzNX3TVs/NjrCS9W9KpfYRbP/K/sTFEOzAqMj+Q7q55YDwrzfX8ojSylCDzbch+/6To1WvuFm2XXLDEhsAMnIxu02EWrkoh40g6XIldacmfho/WEImV3EPh0y626gbdq6c7YYaiyT/XGHuV4+w7w4/T3U/Scr9E1l0zhAdB2HdY07rwLGeEbEAq3yx/VAV5WaNRZ1zxj4+qck+zfJC2Do5Msa1oFfmCdnyF+RtpZH0+j6hpww9/LqQUlimbo8gmYdNIEted1vs67kTMAJ1u/vl6TgZRayJH1vI2aSyCLKFU2JCGE9wQ9jLsn2dKWkuGla2GWdK1jtj9RbUWszbKY0uRIdXWgC/fAub+D8Fvy34N6hdX3s9og1JtICRf+9hVg3Nvfhx4PEwSAp1jBw1yopghBNdoSUmM1ziz0PYrXO94A4TSQbxFJFDBcrrirBlVjpuxCD8UTJlMecG7du7sLZohM4sEk6s3krogSgLiwpvc7KhjCxB5Wtnf5IqhXj/ulv1D52MOy+YnthYAOEyxCbwaCVxtZmO5FKwPJRPvyyXgBDqburIvjAWSalv9SjvatH7i1LGmMIZ6rLUDGddBO4dYUVCumltpMe4w7IoeyGpXVxZww4jaVmrVCFULUqhL+3hhZABjs5tS5VU0DPTVBWyZVdES7ZekdtCKEo+1cFtzut7w8pLx89QMljVAqlWvwa7swQKXTXms5XQDvvIHn8vn0Q0rjTd4cBSiF7jarY9OQwaKi2p2B/Van2lVpbXr4xkhS/hR0Vs7ZoOoB8TPZivCiVluS/6MPuwBt7zdz9//vhb1wJrWGht8gnAc6x11lDVDdnWJXbQE/7vcIxQepD4k/OWSChYJVBnqAx+1quY0kq3xZYqY8VfDvxl5V8feYeuT/1zii+W+fynxi1W7X3uteWbZaok97lm09zzieX6wXqV4ENBjxHhOMQiIpYsJj3N1oVOTXVBfoEUVUUr4GbzGS55NN70Qvfnz9+fqLS4PMiAnMv4IilMG6SYXQbDMXfO7+pF3nX4Ii1nq4pBeZdyhRbkYL22YrQZ03+Jkd/nNtL1GFVC4FlobQLetPrtveDYJdrOOue+Qy3IYTdq1GnUEuOP/xW/bTsIBX3tius489XO5sZ2LZ4gBFQkTMcguLMJfpjzvLt8Gu57uZAk7mU+jSpQV9jmeQ5i/FTdKR+/Ao9cMvWuOzFf/y88bRDMPw6zhxPLKGWUSboHchqb1kpZ8S+sdutek60/jjwHXlIK/XyPZMyd9CODO7rJ1lIqV01g4MSAsZMotAAm3EniIU5RPdXsYze1pfVkOMqFYwm/y7PbpPzYqulSkstniq/b4lApyuJ/YYFwR8Y2CnNn6VWZSAmufbEt5dWktlObfe68GP/pEIQ/xL72yZ9FtxcWtvrtdZwVreoMYUYNLZNFAkJCORrHG/IVbE4gN33sMeLhPakFieIVyO8+WMc=</span> <br>
<!-- !!! dont changing this !!! -->
</div>
</div>
<!-- -->
<div class="tabs">
<!--tab-->
<div class="tab">
<div id="tab-content1" class="content">
<div class="text">
<!--text data -->
<b>/!\ YOUR COMPANY NETWORK HAS BEEN PENETRATED /!\</b><br>
<b>All your important files have been encrypted!</b><br><br>
<hr>
Your files are safe! Only modified. (RSA+AES)<br><br>
ANY ATTEMPT TO RESTORE YOUR FILES WITH THIRD-PARTY SOFTWARE<br>
WILL PERMANENTLY CORRUPT IT.<br>
DO NOT MODIFY ENCRYPTED FILES.<br>
DO NOT RENAME ENCRYPTED FILES.<br><br>
No software available on internet can help you. We are the only ones able to<br>
solve your problem.<br><br>
We gathered highly confidential/personal data. These data are currently stored on<br>
a private server. This server will be immediately destroyed after your payment.<br>
If you decide to not pay, we will release your data to public or re-seller.<br>
So you can expect your data to be publicly available in the near future..<br><br>
We only seek money and our goal is not to damage your reputation or prevent<br>
your business from running.<br><br>
You will can send us 2-3 non-important files and we will decrypt it for free<br>
to prove we are able to give your files back.<br><br>
<!--text data -->
<hr>
<b>Contact us for price and get decryption software.</b><br><br>
<hr>
<b>email:</b><br>
<a href="[email protected] ">[email protected] </a> <br>
<a href="[email protected] ">[email protected] </a> <br>
<p>* To contact us, create a new free email account on the site: <a href="https://protonmail.com">protonmail.com <br>
<b>
IF YOU DON'T CONTACT US WITHIN 72 HOURS, PRICE WILL BE HIGHER.</b><br>
</div>
</div>
</div>
<!--tab-->
<!--text data -->
</div>
</div>
<!--tab-->
</div>
</div>
</body>
</html>
Emails
Extracted
Path
C:\How_to_back_files.html
Ransom Note
<html>
<style type="text/css">
body {
background-color: #f5f5f5;
}
h1, h3{
text-align: center;
text-transform: uppercase;
font-weight: normal;
}
/*---*/
.tabs1{
display: block;
margin: auto;
}
.tabs1 .head{
text-align: center;
float: top;
padding: 0px;
text-transform: uppercase;
font-weight: normal;
display: block;
background: #81bef7;
color: #DF0101;
font-size: 30px;
}
.tabs1 .identi {
font-size: 10px;
text-align: center;
float: top;
padding: 15px;
display: block;
background: #81bef7;
color: #DFDFDF;
word-break: break-all;
}
.tabs .content {
background: #f5f5f5;
/*text-align: center;*/
color: #000000;
padding: 25px 15px;
font-size: 15px;
font-weight: 400;
line-height: 20px; }
.tabs .content a {
color: #df0130;
font-size: 23px;
font-style: italic;
text-decoration: none;
line-height: 35px; }
.tabs .content .text{
padding: 25px;
line-height: 1.2;
}
</style>
<body>
<div class="tabs1">
<div class="head" ><b>Your personal ID:</b></div>
<div class="identi">
<span style="width:1000px; color: #ffffff; font-size: 10px;">sEXMA4g+Yta0WN4R8nPdufn1Rv4vhEPsCLSpFQs/diZZ8M8iEfAg4/Wc7/DkuXlzD3X30oPaKvrgHdw/ObmiNvMi3ylOzblqqxI/zWXchh1RKyBVXlNhqEG9oaf2Xl/df6RXr5sbieVqeQXcvvwWo9iyC06nvnGj9g10WMpWA8zMQH9rJCfY+LQNYuoV82IxWTCZNbYQFQBWmnKwZzjH8HUUR9deTKX4HWt5DbpO1jXAdtyer3tsqDcXVQ8c3hMmy2TK313ycDxN7iC/QxXmCie2+eOcRmhZ4JVw5yHH+11ZV9xxs8FKXqXcbMJTPwzX/13KbiqtGSjbz1vZymqciJED6hYPkRIMQVhwpB1DLpShXSDhRqN4j2iviflos4A+nqyrXDufyfyXRwwZljPeLCDqXZj/GI/LJA6dh4Q4zVPJWTDci5VdkEUzHE6ABADEvML6tPwXbumJHqVgfQ/nkPuX9fKoR0GxUdthLKZmpFt2K2VUhiH4gaowXjmbFwt2vg9dfzZKBUwoa+mkUewwk4SQwUlUG2WqgBgSOKgdJbH5ErmmjTKJGMfe+8K6MuYSdvedRIfJVIJ2/UJA7nDbQU9E/paB2zLQPQFDEa3pjSnf8agSzL//OhbQCczX+jN9z8WKmmqKRhhedmJ71rTdwGwnWwJzrDCP2ocjIxv3Tl02Xd5juuVhjI8Zn4K2SSki3ToKkEKm38Ue77zCUaNcoMKth5APfFB8q8MZ1qSkIGpRcVUxyoIdQcIOd3a6TkNSlnuQWjeydTYE7KjV1CikTIzxM6deSbOGAWtvmmiJrOjIupL/d+p5YOy4OZ5/1AB0qfu/c+RXWMBvhexW/dQ/G7I2KjYCoK2If3x2CNsQRNp9Ki4CezLqDgZdkiZIDK7B5IAWNFkiD3zLXQV6A7p6FYuQmuc5SPpQpFEaaB14nbSdoP0l8E420EEcRAqiDSivBiomNpFM/FMWu7AeGAX2wsYhwyQ1+Tzixqjylii+JQ7LkQ+PN6ojsr7T2EwXuoZCRWY2p0N4B7Mes27YT6WtmVN0Oe5PS1V4/Tmocd/NJ/0tpCmahd5oxsi/m/mIsE0NuZkC5U6tKVTErjiVEmtbXmulnvcTrKXfJnBcZRD4tf7ZinpapyqKrmzpY7eTYnBgY6kr6TnrP0UKrN1Wyi7I8lXoMCIuqQubZe2EmABdQRNkFSAo6mi+yqbB54D45+NqUuQKVYpja2dZ9Iwh+BmEf+L124mKubrSLlEBMNT77Fr8434o9elDhdle3mEObWt417I051Hazcq0+H3tFaczjfC5crbrgnYr4o+nWY0wxouVdbhjC/DsaNLJWmMOHiBSNn/oSKxc+1KzXO7M8EmYRDTFnuC79mNPXZO0q86lGQOmtXj7SYcx+6osFYy2zNOkfH24CyiSdTuM/Y1F5gS04wC0XnYD7RF5dA371cb2maQ7gARDbrR07nTcQcGgdzr2YkigtNKV/eq6e1X4ZpulojM/ub8It6DCvxkOoM1AAxX6e7a2lUW1WoUGDySGmMqmAl3CAaS6L/fuxmozQEKHcDTuqSAo7Etx5rYM0y/7DiHcxeI4IusLS8sj715VjDYl/8UDYMg/nbldnMq8V5l1w3C2riKL5/1MsVLhLk5e6fVTvqTTuq6jufI6GwmYfaHMrbGnlvSOYNfpXvM0m35X4mOYWT9wIjhtGNpo7Ei2gH0=</span> <br>
<!-- !!! dont changing this !!! -->
</div>
</div>
<!-- -->
<div class="tabs">
<!--tab-->
<div class="tab">
<div id="tab-content1" class="content">
<div class="text">
<!--text data -->
<b>/!\ YOUR COMPANY NETWORK HAS BEEN PENETRATED /!\</b><br>
<b>All your important files have been encrypted!</b><br><br>
<hr>
Your files are safe! Only modified. (RSA+AES)<br><br>
ANY ATTEMPT TO RESTORE YOUR FILES WITH THIRD-PARTY SOFTWARE<br>
WILL PERMANENTLY CORRUPT IT.<br>
DO NOT MODIFY ENCRYPTED FILES.<br>
DO NOT RENAME ENCRYPTED FILES.<br><br>
No software available on internet can help you. We are the only ones able to<br>
solve your problem.<br><br>
We gathered highly confidential/personal data. These data are currently stored on<br>
a private server. This server will be immediately destroyed after your payment.<br>
If you decide to not pay, we will release your data to public or re-seller.<br>
So you can expect your data to be publicly available in the near future..<br><br>
We only seek money and our goal is not to damage your reputation or prevent<br>
your business from running.<br><br>
You will can send us 2-3 non-important files and we will decrypt it for free<br>
to prove we are able to give your files back.<br><br>
<!--text data -->
<hr>
<b>Contact us for price and get decryption software.</b><br><br>
<hr>
<b>email:</b><br>
<a href="[email protected] ">[email protected] </a> <br>
<a href="[email protected] ">[email protected] </a> <br>
<p>* To contact us, create a new free email account on the site: <a href="https://protonmail.com">protonmail.com <br>
<b>
IF YOU DON'T CONTACT US WITHIN 72 HOURS, PRICE WILL BE HIGHER.</b><br>
</div>
</div>
</div>
<!--tab-->
<!--text data -->
</div>
</div>
<!--tab-->
</div>
</div>
</body>
</html>
Emails
Targets
-
-
Target
b477676fa9bc4972b2448e27a2b4074edc392227da5d259e87faf2eb1c8e19c7.sample
-
Size
338KB
-
MD5
2f956b5649ae55091e478be5f3d33913
-
SHA1
4866b3bf81621041d38cfa3e3c1c8394cd946d8b
-
SHA256
b477676fa9bc4972b2448e27a2b4074edc392227da5d259e87faf2eb1c8e19c7
-
SHA512
679130490b3af554392543371de35b795deacdf6c03798e6b8e4a607742e2b52032434272f62b501380bc9d06bc452a6985cf7e0cf35a85d5cdd4b4be74eb59e
-
SSDEEP
6144:7m9UzSJFOa0k5miRPzuuf2p9g9w2y+DthOREvvLsUE:K9OMmiRPzum2p9gGmYdUE
Score10/10-
Suspicious use of NtCreateUserProcessOtherParentProcess
-
Deletes shadow copies
Ransomware often targets backup files to inhibit system recovery.
-
Modifies boot configuration data using bcdedit
-
Renames multiple (7542) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Deletes System State backups
Uses wbadmin.exe to inhibit system recovery.
-
Adds Run key to start application
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-