General
-
Target
c6d09776e748f0fe1cec9d4af9f3154c9f84026c27e1a59c0d48bcaf17b89ce1.sample
-
Size
332KB
-
Sample
240227-wh26xsfh6t
-
MD5
0d5ccd706f75461b3fb9c56bc87b5c6f
-
SHA1
0c3755209682d5632a5fb20143ea7d93be5dc5e8
-
SHA256
c6d09776e748f0fe1cec9d4af9f3154c9f84026c27e1a59c0d48bcaf17b89ce1
-
SHA512
9288cdd355d9a6fab846fda6b46ea6c67ec706e089c02d9718661b754bb45be020e97bd48d7876d82a525dfaedc17f6c2303f03160932ea4d6e915f085714131
-
SSDEEP
6144:aY196WTQqBfFrQlVCuzw/322A1StYDBF+FTKtkV:R96eVFryVHzw/3XOfvtk
Score
10/10
Malware Config
Extracted
Path
C:\MSOCache\How_to_back_files.html
Ransom Note
<html>
<style type="text/css">
body {
background-color: #f5f5f5;
}
h1, h3{
text-align: center;
text-transform: uppercase;
font-weight: normal;
}
/*---*/
.tabs1{
display: block;
margin: auto;
}
.tabs1 .head{
text-align: center;
float: top;
padding: 0px;
text-transform: uppercase;
font-weight: normal;
display: block;
background: #81bef7;
color: #DF0101;
font-size: 30px;
}
.tabs1 .identi {
font-size: 10px;
text-align: center;
float: top;
padding: 15px;
display: block;
background: #81bef7;
color: #DFDFDF;
word-break: break-all;
}
.tabs .content {
background: #f5f5f5;
/*text-align: center;*/
color: #000000;
padding: 25px 15px;
font-size: 15px;
font-weight: 400;
line-height: 20px; }
.tabs .content a {
color: #df0130;
font-size: 23px;
font-style: italic;
text-decoration: none;
line-height: 35px; }
.tabs .content .text{
padding: 25px;
line-height: 1.2;
}
</style>
<body>
<div class="tabs1">
<div class="head" ><b>Your personal ID:</b></div>
<div class="identi">
<span style="width:1000px; color: #ffffff; font-size: 10px;">dCzcGDHkT/NNPRtQXyjNS/OmxjACQ/enwCFSuYZLXEQ6hsWnyZmcFtWjLrIpMayQHj8jxUabulEDrKGYl9IwFtJSC3pQxPSwy+/i5cWoDbjEWrWiVRW3lBbH0VE7bC3q/uhmnklb3kLVrJYqLFblxf0S7q54t9dwZsaZrnudN5Uz/6/qpJZyHfiJ/8HHjcr9060FW6eJdIbOKQ1IA9qIC5doRED5FSXf4Ox0LEURK4vuVy8owQK91n6vQHYIpYresBJBMWBkoDNQyozyBRPuHn6im78Ottsbv3sWYHnU6uM21ISND2zZSX5gbg7OhRn8qhETYqPSZYNaXn8PuD4CY+oKWbpBmQn/yAPDx8JKZJJfx73KrPhPWB29WReLw5/oO1UhqoDpvZLPqs/4arW7wD1iF7x2faK3J1R54pdiZ3ucsC1JOgF7vkD8WuR/Rb1QjiCdCRMjHJTVwTcfi0DlAzvDKbkNSRNd6m2+mqLSAilaznm/ZVT+wz4Vcxzs4WM1KTGIROs5kGL0/LDkgJhi6fc4lCng7FfcnFzHJTle2iyoZj148R82HkHEqsDn8YPXCX8d4rAjFtGyC7tqrCrOdsC2BWxt4GfeQua1eZ4gFAe2TFQisumL7F/1o67e2nU9MTESSC/w9V5PX3JlfmvFpnjdpmF2LRCIGo5TOO7o1cKvUWoefUZvPKFBsjTVTKPvr9LXEzyd0n7FFPZhMRs3xaLefs8v+HZOZZe7C5oSGwM3XheMFoNk0rp3hpGd/s72UXudXheooEq/V/Q2hgUyI8C+diFXl4zhuPETon88yWyPh9tViqMyUwZ/9WEr5MPPfPffYHgB/AdwVXmSKJ86TyhwI/TzOg8eDCcGgVdK6Q/9VkCVxarwk/8xisvix1Ck1lfGtZby/IO/tmqpf3QKD3TnxU+v1Uear4XpkA8E5UXMDrX85JOqBzv1pEGII18QlXApzVyXwCDOdlzhTH52fAFZIbJK8vjEAQJk0U8as2lNaKtGQ74p3Cy4cN3ddFOGjm0ZCnI+cqIoNsvE1w1hS35VVJqJKHacKeI04Sg2UsJxEgerAdcwxSJB+SdElI1HrZ8VtqyKpSpips63Vu6PsaFWfeIwrsm7dV/uCDh2A5PC+si4wwnllRSg/DcpUG61UW1Dx9uLDxck88GP9Km4z71tKet212Oj07k0JJVVIN0+BibnwRK3/X1WZbva14rxKwTt0zLMGxHyhAjvoa+oWEUFD2PM6n4BuIsNRWL9ygAVNm4eWGWF2OG+DHpI49kXbtqiVNKBZG1KLYMKkH3AV45kdFElHRLj81wApcgAyMPz9UaI00Q88fH4jrNpmZ2YWR8kuqbNr4Wtaszy5sP5fbqgUj6KP7xyzwctvg97OkitTNXMas+5m8MOlYMlDu6YkdtoxoCK7NIj+fsWXyrHYOGJZSR52WoAn07X0qTZ0EPx90c7yDTMFckWScL6bD82mcX+dMGwdKKk6aevVd0kjWQf5Nv0A+6Exr1VNWBtmJuMB81q/ra72klwKm/klUqN5s4rln/ugLbkuYEtWTL9+/z4HjP6ckk8LmAEZzIxLE19m/xJa/fLMyZGhJOnZgBWIwPZbq6vTjM8G+yt8Ki5QOvOQ/9t32+9fQdUdOTqDODVWiubkgPnOi7o+Xw1D5Y86eP+jC/g0UITBg5c7jbukw1WZdT+ObPJvJdtRYyxfbk=</span> <br>
<!-- !!! dont changing this !!! -->
</div>
</div>
<!-- -->
<div class="tabs">
<!--tab-->
<div class="tab">
<div id="tab-content1" class="content">
<div class="text">
<!--text data -->
<b>/!\ YOUR COMPANY NETWORK HAS BEEN PENETRATED /!\</b><br>
<b>All your important files have been encrypted!</b><br><br>
<hr>
Your files are safe! Only modified. (RSA+AES)<br><br>
ANY ATTEMPT TO RESTORE YOUR FILES WITH THIRD-PARTY SOFTWARE<br>
WILL PERMANENTLY CORRUPT IT.<br>
DO NOT MODIFY ENCRYPTED FILES.<br>
DO NOT RENAME ENCRYPTED FILES.<br><br>
No software available on internet can help you. We are the only ones able to<br>
solve your problem.<br><br>
We gathered highly confidential/personal data. These data are currently stored on<br>
a private server. This server will be immediately destroyed after your payment.<br>
If you decide to not pay, we will release your data to public or re-seller.<br>
So you can expect your data to be publicly available in the near future..<br><br>
We only seek money and our goal is not to damage your reputation or prevent<br>
your business from running.<br><br>
You will can send us 2-3 non-important files and we will decrypt it for free<br>
to prove we are able to give your files back.<br><br>
<!--text data -->
<hr>
<b>Contact us for price and get decryption software.</b><br><br>
<hr>
<b>email:</b><br>
<a href="[email protected] ">[email protected] </a> <br>
<a href="[email protected] ">[email protected] </a> <br>
<p>* To contact us, create a new free email account on the site: <a href="https://protonmail.com">protonmail.com <br>
<b>
IF YOU DON'T CONTACT US WITHIN 72 HOURS, PRICE WILL BE HIGHER.</b><br>
</div>
</div>
</div>
<!--tab-->
<!--text data -->
</div>
</div>
<!--tab-->
</div>
</div>
</body>
</html>
Emails
href="[email protected]
Extracted
Path
C:\odt\How_to_back_files.html
Ransom Note
<html>
<style type="text/css">
body {
background-color: #f5f5f5;
}
h1, h3{
text-align: center;
text-transform: uppercase;
font-weight: normal;
}
/*---*/
.tabs1{
display: block;
margin: auto;
}
.tabs1 .head{
text-align: center;
float: top;
padding: 0px;
text-transform: uppercase;
font-weight: normal;
display: block;
background: #81bef7;
color: #DF0101;
font-size: 30px;
}
.tabs1 .identi {
font-size: 10px;
text-align: center;
float: top;
padding: 15px;
display: block;
background: #81bef7;
color: #DFDFDF;
word-break: break-all;
}
.tabs .content {
background: #f5f5f5;
/*text-align: center;*/
color: #000000;
padding: 25px 15px;
font-size: 15px;
font-weight: 400;
line-height: 20px; }
.tabs .content a {
color: #df0130;
font-size: 23px;
font-style: italic;
text-decoration: none;
line-height: 35px; }
.tabs .content .text{
padding: 25px;
line-height: 1.2;
}
</style>
<body>
<div class="tabs1">
<div class="head" ><b>Your personal ID:</b></div>
<div class="identi">
<span style="width:1000px; color: #ffffff; font-size: 10px;">a8FBLZwJ6k7pJGO1ubhxEhO4SafK4NnFiWl5xI29nv0Sp4+uPWcE6G9WtersHn4R3FFCCfIneDu31ho1CuFRhffiG5c90mKnRyYzXEezz+k/Vv+qQVYi+qhZf4h8Ieug4T7cjefE/MILiRqc0wlA0wfvFvRVwyRDCScQW7YBlK0sVzeBofcVoSvCgUMtPdG2qbiJOBaSb7hWWW5kMxC7n5215/OTrCjqqAQn+gPKiPaQoAMeTKuXViTNHvczNTw7BOP9U12Bs0kChiQo/J8H3IQ6c2l7Pb1bmHbvNmUDtk1gCOXUTKeU1khg/VQ+mLZO7AwBb/Rt/+AqcjEkXQYXEw/GubnS/0NcJ0FmBAwYFH1o6/Rpma9hPeIXC4NY9S4BQb1Zx42nN1og86IEe6evxPF4scvnCgiLSP79IPAL+bwYeMbAXqjwAr6iKF6+EEAXa7WqY0oyfvdVqdHcFFR43id5/YUj23DIQlq/xntMgzgpzewNcn++NMTdoR8IY6oHHzLQ3zAT/BdOV0PgeUkzGtVl62lfB+UnA0cOgXiIOJTMUbAJUEsj8aRauptmb8j/zXXEKdeFi9XQkVsIWLKV1JWlPiR9eKWyhE98P6mnL2HievgvAn4mpklFGF+BugB928gO1zmNw1r/LyOyOQMhsd3ovEi+rMqc2NOxQo/vaGEJt190xi51/a+577z5+Ghs/G0weStSFE2p0fSmR9B070mgDqRb7ROfXTgzxWTpWQZReMMHZUKy6rN5gakbgfnza8bwC4jvIDV5ggT/zYA8gGYQ03NFquNuRSSV9gsE7QmK3nVuDG5Yq2s4watR1KmkNjtSaCMW9jwr4YNRCL2vDASslYNdVJ698EO8ycpcXe3KDOSe9BGENDVja5OMo8WAwtpXbHBG+QOgXlin11+Viam8JFSBEdq6LM4SPI4En1n0sljJiFV96A7x8QCNzT3jG67MmaIPvzrEQES3USKE4FMXZZ/Tj8Yo7QImWMPi0Zr5cQl2NTHJfRjtV4wI0f6Rr1Lipt6vzmdFiFmcM7wB1jYzw8V7UXzHOW9mgiqoRLe53o+vZzHJYHf9PXtRqCTd6z9GhDViezb5xA2f7b3f5gMFlwu9cSF9bVv/jO8C6IU3+g0PgebiGvdHGJG52yWPU1tzzBIGyaEPu87T5TKt/VlzmFdZfLaQjE42nh/NRdNCX7V/v45UnWffMJliVhGeirfzO1iRRCixkbLup0dXU7Tz7yd4hK1biw/O5gRtvvx57eLGnXzk3KGNsvH9QVQKY8ULJnaQhxAqG6A5xpgWj6fuPHCVOr0CAp3fjbCWLtdkv0em+ns4zYeXN5RToNqnOxqHUdipJCaTOfdZ/1uD5yn2HrJQb1UNC43OixYU9wOmmuxT6JEaU9o45HluAd78bmpuUCgoRDhPOpHiZubAdxs20VHNGFLN1F4TeFTesO9VZTBYywlIMImq821fL9WI7YMdeR2sW+e7WvlLdLdDCRvRQit64AzefqTR6ElYqVoE/VwCvDh13FDvU6Kw8wY5gp5n/BV9idRyFprHa17cjjFRULRB6jPrNhQ7kuyGX40FbttL3+lu4AvQg4mFAmtWzPE/d9O9DOXuotL0Gj2WtFIono08twb2kelmwszoNr5q1OVhglmjmyXgIDrFmAXlEsB1Nx51VX2mwg63eJ+/X6BO/QYCLronfu5IPAOPGxs=</span> <br>
<!-- !!! dont changing this !!! -->
</div>
</div>
<!-- -->
<div class="tabs">
<!--tab-->
<div class="tab">
<div id="tab-content1" class="content">
<div class="text">
<!--text data -->
<b>/!\ YOUR COMPANY NETWORK HAS BEEN PENETRATED /!\</b><br>
<b>All your important files have been encrypted!</b><br><br>
<hr>
Your files are safe! Only modified. (RSA+AES)<br><br>
ANY ATTEMPT TO RESTORE YOUR FILES WITH THIRD-PARTY SOFTWARE<br>
WILL PERMANENTLY CORRUPT IT.<br>
DO NOT MODIFY ENCRYPTED FILES.<br>
DO NOT RENAME ENCRYPTED FILES.<br><br>
No software available on internet can help you. We are the only ones able to<br>
solve your problem.<br><br>
We gathered highly confidential/personal data. These data are currently stored on<br>
a private server. This server will be immediately destroyed after your payment.<br>
If you decide to not pay, we will release your data to public or re-seller.<br>
So you can expect your data to be publicly available in the near future..<br><br>
We only seek money and our goal is not to damage your reputation or prevent<br>
your business from running.<br><br>
You will can send us 2-3 non-important files and we will decrypt it for free<br>
to prove we are able to give your files back.<br><br>
<!--text data -->
<hr>
<b>Contact us for price and get decryption software.</b><br><br>
<hr>
<b>email:</b><br>
<a href="[email protected] ">[email protected] </a> <br>
<a href="[email protected] ">[email protected] </a> <br>
<p>* To contact us, create a new free email account on the site: <a href="https://protonmail.com">protonmail.com <br>
<b>
IF YOU DON'T CONTACT US WITHIN 72 HOURS, PRICE WILL BE HIGHER.</b><br>
</div>
</div>
</div>
<!--tab-->
<!--text data -->
</div>
</div>
<!--tab-->
</div>
</div>
</body>
</html>
Emails
href="[email protected]
Targets
-
-
Target
c6d09776e748f0fe1cec9d4af9f3154c9f84026c27e1a59c0d48bcaf17b89ce1.sample
-
Size
332KB
-
MD5
0d5ccd706f75461b3fb9c56bc87b5c6f
-
SHA1
0c3755209682d5632a5fb20143ea7d93be5dc5e8
-
SHA256
c6d09776e748f0fe1cec9d4af9f3154c9f84026c27e1a59c0d48bcaf17b89ce1
-
SHA512
9288cdd355d9a6fab846fda6b46ea6c67ec706e089c02d9718661b754bb45be020e97bd48d7876d82a525dfaedc17f6c2303f03160932ea4d6e915f085714131
-
SSDEEP
6144:aY196WTQqBfFrQlVCuzw/322A1StYDBF+FTKtkV:R96eVFryVHzw/3XOfvtk
Score10/10-
Suspicious use of NtCreateUserProcessOtherParentProcess
-
Deletes shadow copies
Ransomware often targets backup files to inhibit system recovery.
-
Modifies boot configuration data using bcdedit
-
Renames multiple (2916) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Deletes System State backups
Uses wbadmin.exe to inhibit system recovery.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-