General
-
Target
b896605b97ae9e2781b21dc5cfb64eec0fc4effa76a7ef33e9cef0b258dff35f.sample
-
Size
335KB
-
Sample
240227-wgnbdafe69
-
MD5
a286b1e0dc7e26204e9751423ff1e842
-
SHA1
394e03d3010222b571d1a70bde0233407435bcf1
-
SHA256
b896605b97ae9e2781b21dc5cfb64eec0fc4effa76a7ef33e9cef0b258dff35f
-
SHA512
7d6c8f8f829f72b89783598e01baf7b597e459a9c210b6dbd3d8aaaeb3aa93e99e309c9155ef7832bd1ff88d4806448b73744136dc59022fe3ddfaf1d1faa23f
-
SSDEEP
6144:5Y9zfajnC6iGm15k66Clhdq8yZXlkV68pr2g1PJbmV6Mqu:m9WHm15k66ClHq8yZVypHMqu
Score
10/10
Malware Config
Extracted
Path
C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\How_to_back_files.html
Ransom Note
<html>
<style type="text/css">
body {
background-color: #f5f5f5;
}
h1, h3{
text-align: center;
text-transform: uppercase;
font-weight: normal;
}
/*---*/
.tabs1{
display: block;
margin: auto;
}
.tabs1 .head{
text-align: center;
float: top;
padding: 0px;
text-transform: uppercase;
font-weight: normal;
display: block;
background: #81bef7;
color: #DF0101;
font-size: 30px;
}
.tabs1 .identi {
font-size: 10px;
text-align: center;
float: top;
padding: 15px;
display: block;
background: #81bef7;
color: #DFDFDF;
word-break: break-all;
}
.tabs .content {
background: #f5f5f5;
/*text-align: center;*/
color: #000000;
padding: 25px 15px;
font-size: 15px;
font-weight: 400;
line-height: 20px; }
.tabs .content a {
color: #df0130;
font-size: 23px;
font-style: italic;
text-decoration: none;
line-height: 35px; }
.tabs .content .text{
padding: 25px;
line-height: 1.2;
}
</style>
<body>
<div class="tabs1">
<div class="head" ><b>Your personal ID:</b></div>
<div class="identi">
<span style="width:1000px; color: #ffffff; font-size: 10px;">cRknxJjz/WNuwEZFtFxZJg8o2Xl7rMLz1K0tISYv+63b09uMXDLGGVCZnfBRjPtwajCL/YcIzvzDnzaK7theNQsZCD8QLFE2hSbSOq3wjh5ByWq2r07/h5HuECV+MDxQj+hf0BhKd0ngEPAQlDfp7Ltr6//5vY1hw5dfyjiiPZJ6+YBd5c1+V2/XI0waFLhEwcgKfF4D9FZlhfAQH6Vqo94C479vlwwlI4baD1bD4WUjBeIv1swofKgZtjxNBhWmqA0XvF6jsFknjZ818kGmeOpjcAzdod8hCTT2cZfzJ82sBVsBAErNb+Y5q1WuN5/NCfUB5n1wa9ucCUmmIpJ1Q4uW9aUaPIT17MXYQmTNJfn5AjD6uo3yYfADA4cQfoUfz/ktzm8ctg9gXASaiEVlQ3FwDMNSOTwVkxlfurvfDuEBgF93dHqg6TtnmG1pW38WFbBbSKuAo+4eek9D4xELXjFO63/GPbfDwk6Q9mFNoX4SaLg/lJS8J+XukRXMpvL3Opo483rbCW513DYzQA2S9pnykKfL0Hi/YRg+KSMeZgdJaCDk9Injq68FIigzzRyqZsa+alY37ziYHvW/yFPHSXmd+LGGB58C9kWbwU+i10rkAXZ/eXkbZUG+TEpsERXGQ84V2MoAiirT9NdVFTaW0n++kv9haj8wYFC/vyfqpLakPWNydSRwP8cedI4qDLBylKhmkA67YX4NQFHOH16LWWzMFR8uKnepBealVt17UXIXvRPSaQJ+ht/VYlnH+CyQ2ABNEKrZUsxQXCxVQ0g3v1+7fstmR3EgYuJgHR0q2kdLHOmk7gpL2kv/M1dXqM+TB17ys7+0acQxW1qlQJF+18ZGRL5pjMqIr2E4i6E8dCEReTppBwhtxyxScx+pcradqnuc2IRVuy4f/VqaTtHvune0MvAOykk8qP5jCqz2cU3oFohGns1MzzPfbJiDeKptBMUiCpmqGDD6LYYsl39cB+PHh851S4CWypveQKIXJVKXHAYVD2KyMqxyc34Z8+i+Aqq5peR8wo3VlR2MSZ1WSTW9Bfja96p599P1g/GpcK6xpO61tGS/+wozHu7U02c8VmdYeiMTyoESb4pzWD1zg00f1iK0QKvH8xo8ufSjY/QHbYT0Qc4kUcwMNkbB0KWzAtg0fcEwtDFB9+iu5pAGUd0ycPTWeMq5JuO+mws1Ts9C+P80k8oQvOivgowXLBZFX1Q7AOiTZ2C8FEbX0i6YKGuUHa26Q6a4VxkG7NzFwTlYxYbzfTBkmxerqs6vLQSKizPicjUnRxzIaEg8H+rxxD7eneKY8LNXT08L4o1/WrlzFxo6ylstKus+9WkCuMSwPQ5auR23SVRHvlDcmHamh4Rq+PTw3I+c/gSgHHFvwQ/4of0DyEZBqoR/FI8QIudbEISPO91chFB8QZPgYXxTn6lm/+N+nCXxPTDih0AdJaM7Js9h3wiYI0YCHlnVuv2qWu8ibNUsQOV7eY/Wa8mXi3h2cJ4Ls0keZvkN2mT+svMxM0qtE8t2VeY1zbyPZW8qD47wprpRLqSjUBCMEfAlRcFvcPjX32/KYICLMz95Ii4A1MM4EqmTqVVIgWLVe5pPQd8itQapTLGthERYFeboqGOLV9IoUPwFcQxemSiIuL6y873wktQILK0/EDQNzwsqoZwB8hUN6yO/dql6SfAM2N9SQEq/YDG7Ll/DS3L2POA=</span> <br>
<!-- !!! dont changing this !!! -->
</div>
</div>
<!-- -->
<div class="tabs">
<!--tab-->
<div class="tab">
<div id="tab-content1" class="content">
<div class="text">
<!--text data -->
<b>/!\ YOUR COMPANY NETWORK HAS BEEN PENETRATED /!\</b><br>
<b>All your important files have been encrypted!</b><br><br>
<hr>
Your files are safe! Only modified. (RSA+AES)<br><br>
ANY ATTEMPT TO RESTORE YOUR FILES WITH THIRD-PARTY SOFTWARE<br>
WILL PERMANENTLY CORRUPT IT.<br>
DO NOT MODIFY ENCRYPTED FILES.<br>
DO NOT RENAME ENCRYPTED FILES.<br><br>
No software available on internet can help you. We are the only ones able to<br>
solve your problem.<br><br>
We gathered highly confidential/personal data. These data are currently stored on<br>
a private server. This server will be immediately destroyed after your payment.<br>
If you decide to not pay, we will release your data to public or re-seller.<br>
So you can expect your data to be publicly available in the near future..<br><br>
We only seek money and our goal is not to damage your reputation or prevent<br>
your business from running.<br><br>
You will can send us 2-3 non-important files and we will decrypt it for free<br>
to prove we are able to give your files back.<br><br>
<!--text data -->
<hr>
<b>Contact us for price and get decryption software.</b><br><br>
<hr>
<b>email:</b><br>
<a href="[email protected] ">[email protected] </a> <br>
<a href="[email protected] ">[email protected] </a> <br>
<p>* To contact us, create a new free email account on the site: <a href="https://protonmail.com">protonmail.com <br>
<b>
IF YOU DON'T CONTACT US WITHIN 72 HOURS, PRICE WILL BE HIGHER.</b><br>
</div>
</div>
</div>
<!--tab-->
<!--text data -->
</div>
</div>
<!--tab-->
</div>
</div>
</body>
</html>
Emails
Extracted
Path
\Device\HarddiskVolume1\Boot\cs-CZ\How_to_back_files.html
Ransom Note
<html>
<style type="text/css">
body {
background-color: #f5f5f5;
}
h1, h3{
text-align: center;
text-transform: uppercase;
font-weight: normal;
}
/*---*/
.tabs1{
display: block;
margin: auto;
}
.tabs1 .head{
text-align: center;
float: top;
padding: 0px;
text-transform: uppercase;
font-weight: normal;
display: block;
background: #81bef7;
color: #DF0101;
font-size: 30px;
}
.tabs1 .identi {
font-size: 10px;
text-align: center;
float: top;
padding: 15px;
display: block;
background: #81bef7;
color: #DFDFDF;
word-break: break-all;
}
.tabs .content {
background: #f5f5f5;
/*text-align: center;*/
color: #000000;
padding: 25px 15px;
font-size: 15px;
font-weight: 400;
line-height: 20px; }
.tabs .content a {
color: #df0130;
font-size: 23px;
font-style: italic;
text-decoration: none;
line-height: 35px; }
.tabs .content .text{
padding: 25px;
line-height: 1.2;
}
</style>
<body>
<div class="tabs1">
<div class="head" ><b>Your personal ID:</b></div>
<div class="identi">
<span style="width:1000px; color: #ffffff; font-size: 10px;">AO86pph/KCd0Fy/8RgWQhFu/jUCIs6ea/iTFz8qZyuTIgQ2aVuxQ+aRtgX/HoCzB+xdLecW5TQM1ERWQWhD4UC86T8bWGrP1PGOJbRkuDl+juEq47Z7e+R8w2CsRo91mTM3N/lk00cIjduXljtF6LdKkjqcwiCxYgvNEHMipaecf01bDuhXNj99HA0j+mBuhYGBAR4zx61fZ7ocAcp0usHqjXPVn6Palj03JCGS8B8O2ClkPBufhwDk8xYH89tHqeT9kVxz9aFtVqmwi1JwFxriQyv6JG0ZxPY7eGh6MJCpNtz+xoYY62+I0FvQcuSXwI8aosmCErSCt4u7OuvX1VQMTE687fBlFEBGzcdIki2rmtpmGI/BAMmDeAfqOsZjOEp/Up4lNGtdHrObgCSsSjydNrmGjGIlhk9kCtR2gtGsLqP+8gMsGmgixa9O0k6c7NYuZH8xLtxrYYWaRShbjfA4CM7WVfmjiBeax2/6Mx9xNVh2iwZt1Hxid0bsjQPzKGx9AeDgUAtVH2OZ7qSrEWAgTh1kTTMeTwS/oCq/t3MDpDUe1y2gHPPJ41PDQPQXA6DsUELWw0v4HL84ZEu0qcbKN6D+jzSF94/DdI9SMxM3K1NV3nwLWdRkNgm6Tebvrptx78/p54i/MtZt6TkYwsv/f5gObyMqQ483Y/MR8eJMEfSHuX9SIvlYY5lkRmcU29gH8K7PgAiDp/AAuHvmUo56tkoWsq8h9/jkO88rrjoK1bwCX8FmcICXeJuLDza+AdTQp0lFw/3y3gLZpCGoip/PlaiNQdj/UGO0eCzy7JLeTy5w+uzfjylDi3S5/kB/G5NMsf+ZENBaGY31IIQkE9IsmRHW7q+xnpsadZnhADXL+TL3gA2EMoZYCvqE1F3/5YieZh38lYvCozJDS1k4A+pjugxiXMl41JFf1v4/YEvwrzbq/qnnC3pYxN2fcci26roly/78/flzdbtu1k3fsmZ3R/2AbIEnUkefzgFznqN9NMcueb+PO0BGP/QToP6oLAFBla2ik4eHcWCslqqYzoYFo9tq7cyDvKhnbukoeSpDYYy/nlUtY7l8oYNO8MFZrHPBwuUaFgsX0VTF9uiwsd4yHBqM4hRjXtjjKH7i0+RLEtnN1NS+zWy37vMyxeh8koNgQ+9yfaSq1BVg/TK36JkqkwcTgGR96QzXE8RKLo/BICwGRfn7yAYnqX171eg0lLwJ4qDAkmiCXmQv5bigIbiXQ8svE7CLXXSoYEAYl8fAStffZq8GmtR2zoqRhoIeSSYM9Nn2GYbs3dAfeh7TB/qIZzNOe3TjmdgW+SxPsfJz68abJ1+OvFlNgdk2Z3s6aIbXbdq972uivDFZWR84CFN5bPTMHPGMj3PPhnolCF8gZc0cWmRmUwdvHDfCc8WIrsmMuFyk8cJQftUitKwQOfoy2N9E7HRloZRYrA77hAIV3rfCzKulrjqi2GzBM9vQKnKFPcHkof7MhkNHDARmziIXlVZPX8OobYgkAuYfh7eM/zDCYJ9mMpRa9NPhDJxAl+lgSCh/zT3Q1HXUh7B6itaszoi0hlnfBrGDUTEEo6+HgAW+rVLjEpJYj8451N5l+SJSWcWhg4h+kLqh2EKQWWhXaY3Ro59OXToDANkKEHbQ2EV+3ApJI4yVSXhA9QNJCIPp08TTcqhoxYQJZz4AbWzJeDAEnlolF8jLsHZftk5k=</span> <br>
<!-- !!! dont changing this !!! -->
</div>
</div>
<!-- -->
<div class="tabs">
<!--tab-->
<div class="tab">
<div id="tab-content1" class="content">
<div class="text">
<!--text data -->
<b>/!\ YOUR COMPANY NETWORK HAS BEEN PENETRATED /!\</b><br>
<b>All your important files have been encrypted!</b><br><br>
<hr>
Your files are safe! Only modified. (RSA+AES)<br><br>
ANY ATTEMPT TO RESTORE YOUR FILES WITH THIRD-PARTY SOFTWARE<br>
WILL PERMANENTLY CORRUPT IT.<br>
DO NOT MODIFY ENCRYPTED FILES.<br>
DO NOT RENAME ENCRYPTED FILES.<br><br>
No software available on internet can help you. We are the only ones able to<br>
solve your problem.<br><br>
We gathered highly confidential/personal data. These data are currently stored on<br>
a private server. This server will be immediately destroyed after your payment.<br>
If you decide to not pay, we will release your data to public or re-seller.<br>
So you can expect your data to be publicly available in the near future..<br><br>
We only seek money and our goal is not to damage your reputation or prevent<br>
your business from running.<br><br>
You will can send us 2-3 non-important files and we will decrypt it for free<br>
to prove we are able to give your files back.<br><br>
<!--text data -->
<hr>
<b>Contact us for price and get decryption software.</b><br><br>
<hr>
<b>email:</b><br>
<a href="[email protected] ">[email protected] </a> <br>
<a href="[email protected] ">[email protected] </a> <br>
<p>* To contact us, create a new free email account on the site: <a href="https://protonmail.com">protonmail.com <br>
<b>
IF YOU DON'T CONTACT US WITHIN 72 HOURS, PRICE WILL BE HIGHER.</b><br>
</div>
</div>
</div>
<!--tab-->
<!--text data -->
</div>
</div>
<!--tab-->
</div>
</div>
</body>
</html>
Emails
Targets
-
-
Target
b896605b97ae9e2781b21dc5cfb64eec0fc4effa76a7ef33e9cef0b258dff35f.sample
-
Size
335KB
-
MD5
a286b1e0dc7e26204e9751423ff1e842
-
SHA1
394e03d3010222b571d1a70bde0233407435bcf1
-
SHA256
b896605b97ae9e2781b21dc5cfb64eec0fc4effa76a7ef33e9cef0b258dff35f
-
SHA512
7d6c8f8f829f72b89783598e01baf7b597e459a9c210b6dbd3d8aaaeb3aa93e99e309c9155ef7832bd1ff88d4806448b73744136dc59022fe3ddfaf1d1faa23f
-
SSDEEP
6144:5Y9zfajnC6iGm15k66Clhdq8yZXlkV68pr2g1PJbmV6Mqu:m9WHm15k66ClHq8yZVypHMqu
Score10/10-
Suspicious use of NtCreateUserProcessOtherParentProcess
-
Deletes shadow copies
Ransomware often targets backup files to inhibit system recovery.
-
Modifies boot configuration data using bcdedit
-
Renames multiple (7279) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Deletes System State backups
Uses wbadmin.exe to inhibit system recovery.
-
Adds Run key to start application
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-