General
-
Target
d9de562ac1815bf0baad1c617c6c7f47d71f46810c348f7372a88b296d68cfae.sample
-
Size
335KB
-
Sample
240227-wk2m6sff56
-
MD5
c3d5522f176830c4a24223c96439f668
-
SHA1
46574cd17ee2a1f2084dc83a65df94e13ce25061
-
SHA256
d9de562ac1815bf0baad1c617c6c7f47d71f46810c348f7372a88b296d68cfae
-
SHA512
0ed0510f4bba6280e4319f3742d1775d7d251c35517f74f1e2f7350ac68239879b0171a279aab252947163977f363cf3852d52747b225aa160f882cb82bc532b
-
SSDEEP
6144:1YS9RhUoKV8TCylQ0MWNns5wiSvypQof+9RpfbMPrac6bhMq:1/9T0ylQ0MWNns5xSvyp7W6MMq
Score
10/10
Malware Config
Extracted
Path
C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\How_to_back_files.html
Ransom Note
<html>
<style type="text/css">
body {
background-color: #f5f5f5;
}
h1, h3{
text-align: center;
text-transform: uppercase;
font-weight: normal;
}
/*---*/
.tabs1{
display: block;
margin: auto;
}
.tabs1 .head{
text-align: center;
float: top;
padding: 0px;
text-transform: uppercase;
font-weight: normal;
display: block;
background: #81bef7;
color: #DF0101;
font-size: 30px;
}
.tabs1 .identi {
font-size: 10px;
text-align: center;
float: top;
padding: 15px;
display: block;
background: #81bef7;
color: #DFDFDF;
word-break: break-all;
}
.tabs .content {
background: #f5f5f5;
/*text-align: center;*/
color: #000000;
padding: 25px 15px;
font-size: 15px;
font-weight: 400;
line-height: 20px; }
.tabs .content a {
color: #df0130;
font-size: 23px;
font-style: italic;
text-decoration: none;
line-height: 35px; }
.tabs .content .text{
padding: 25px;
line-height: 1.2;
}
</style>
<body>
<div class="tabs1">
<div class="head" ><b>Your personal ID:</b></div>
<div class="identi">
<span style="width:1000px; color: #ffffff; font-size: 10px;">bneIvRFVVlxwdk7NseD7FxBL7lrgjVYBwgOgOLW5GNnoO4QeLloC0qn/Fj56p/BCdrvD/IN5H5C0DAypRbs0KytdankXqzMvsClZNHY0/oxKY0eSvfWv92vmYD9omXLJtUw4Zsrenyncd8dgqrapES/LgoDMKe1L/dsf2MjhCUd9O2PnwJGlOJcMk9V3YmPeRvt3SINSwyjq8rwJW09rmQQ2TSlfot56fuGPwObTXOauagXw+t86PydyFUAYAtZl+BWnGewkf9YTjv5XGFlYk6Wp/r27DzkTnvXSCv2zikaOFjDqaPqyAC2m/L5wSci6NK7rwpfyjLC+7LiwoVvXHjIkICFSKzwqs1FeFYrgCDkV35yBeYAmRjS5G5xQ4UOsPIlK7t8XRaEvXfv4MvnJYV0o/IzuMPpkS5qpSi82mtRFR07ZWIvn/Ytzd9qAE6K+UV3pTjMgWiJSnQlFctDcLD3GVR+19GMtrJHc+d3Ib/mYNSWyEaaEXYC+obK6Ig2UMVr9XZgb7U5UHjNHnuYURY0ii50eC2bS2Trbj3Nt1pJ6vYjCXnG9oP+MxmOypiRPoWdA+x2O3heYndaaUBIMb3ycPrC7qmCfw/T+8GzQqK94aiKKJ7Rh/s+8r7VzlkvDFm2JpjBumJv0Rc3VjInGEJnollbpK0Rsv4nVraAtOFlsdnD8XvqOWjYn2UF423sWKbZfZL4cvDriJHAx9QNor65ouOR8PYzT7G1/JNkoWCaMnF9uKGw/h28VVfN9V9W65xTvQRtbSbYKaebE8+phQ2+QUZuo8qLj37zgLlqkQw7lGKn29MCBtDliQA/UUKL8xh6X/jQz7oq8a67cMN/sN3VOjIS/tM2L+gSKsfmSaJZrU606EomcTKyuaD3EpLQvlb7YsAQXWWOC8DIsXUSYuBghlxxnQ7NG12CaLm9mV3Bvp8JekU5svIb5Dr1JYr5cIvGpgIiAq/DXxwN5nJp2WEFsQSce/B3nA8Cg9wf8amg1rjg2Th2SXLaCeIEF8+Y4jgf3DJ6+4XKn9kdqklT+mnTzz6G4Qk63bn7EfacjyTeFlscuyiYKCuKEtU2YKNauhytotySFb7rV6q5+B08k/FpGdq/aSBEWs3FwFkGDD9QbIYEO3bfs7pvv243pK43pVqxigOEeOCaZ1GCq73FuR+Ky1Q78HethyKjdw0UjCxQb1tHjA6nEX/v1C+8RrBGNzx9MMVkDIO4vFjz0x16CNfpaa9ktE3rxNAzyeYaK+DG9COy00NgeG9VwEaZkWmsXnqtNJ+rchjy5UuEH/w3JY45dSHW+yDCPyVoVByzwja9JyG3Gp9GNXfEsNk7At0u7jipvFV+mlkGsFcG9kkIwUu/IrCOUBlZGxAsIbZFsbItwXaxk9DBJ4RUpY/a28URMlWNxyXtDHcbyDM/3Ow+LhuGoYSktFCCa2d0kGhsjDtnKqpBzHmdN1UopMtOIP96xzx0ME3DrElT3PBwvN4+NIdla/jY9Ulprc8IFh7DvQhsFD53XL1+daPzlXRFRRAsCKEMvJe3WVKu5jxJQY2PMtooytV8lqfldZztI07kcMYvn420/ihS7VCllHnO5NiDPXEAFoLD2u4Dn3Fpy6yitEj1yafo6Ip9HTCgcabbHi+THurnPrgX7GEMF2Zhn5yoFtv+3u5EPhE6umWKN1VCw0N5unA9pjknebC+BaMQONY4=</span> <br>
<!-- !!! dont changing this !!! -->
</div>
</div>
<!-- -->
<div class="tabs">
<!--tab-->
<div class="tab">
<div id="tab-content1" class="content">
<div class="text">
<!--text data -->
<b>/!\ YOUR COMPANY NETWORK HAS BEEN PENETRATED /!\</b><br>
<b>All your important files have been encrypted!</b><br><br>
<hr>
Your files are safe! Only modified. (RSA+AES)<br><br>
ANY ATTEMPT TO RESTORE YOUR FILES WITH THIRD-PARTY SOFTWARE<br>
WILL PERMANENTLY CORRUPT IT.<br>
DO NOT MODIFY ENCRYPTED FILES.<br>
DO NOT RENAME ENCRYPTED FILES.<br><br>
No software available on internet can help you. We are the only ones able to<br>
solve your problem.<br><br>
We gathered highly confidential/personal data. These data are currently stored on<br>
a private server. This server will be immediately destroyed after your payment.<br>
If you decide to not pay, we will release your data to public or re-seller.<br>
So you can expect your data to be publicly available in the near future..<br><br>
We only seek money and our goal is not to damage your reputation or prevent<br>
your business from running.<br><br>
You will can send us 2-3 non-important files and we will decrypt it for free<br>
to prove we are able to give your files back.<br><br>
<!--text data -->
<hr>
<b>Contact us for price and get decryption software.</b><br><br>
<hr>
<b>email:</b><br>
<a href="[email protected] ">[email protected] </a> <br>
<a href="[email protected] ">[email protected] </a> <br>
<p>* To contact us, create a new free email account on the site: <a href="https://protonmail.com">protonmail.com <br>
<b>
IF YOU DON'T CONTACT US WITHIN 72 HOURS, PRICE WILL BE HIGHER.</b><br>
<p>* Tor-chat to always be in touch: <a href<a href<b>
</div>
</div>
</div>
<!--tab-->
<b>
<b> <b> <span style="font-size: 22px">qd7pcafncosqfqu3ha6fcx4h6sr7tzwagzpcdcnytiw3b6varaeqv5yd.onion</span>
</b><br><br> </b><br>
<!--text data -->
</div>
</div>
<!--tab-->
</div>
</div>
</body>
</html>
Emails
Extracted
Path
C:\Program Files\How_to_back_files.html
Ransom Note
<html>
<style type="text/css">
body {
background-color: #f5f5f5;
}
h1, h3{
text-align: center;
text-transform: uppercase;
font-weight: normal;
}
/*---*/
.tabs1{
display: block;
margin: auto;
}
.tabs1 .head{
text-align: center;
float: top;
padding: 0px;
text-transform: uppercase;
font-weight: normal;
display: block;
background: #81bef7;
color: #DF0101;
font-size: 30px;
}
.tabs1 .identi {
font-size: 10px;
text-align: center;
float: top;
padding: 15px;
display: block;
background: #81bef7;
color: #DFDFDF;
word-break: break-all;
}
.tabs .content {
background: #f5f5f5;
/*text-align: center;*/
color: #000000;
padding: 25px 15px;
font-size: 15px;
font-weight: 400;
line-height: 20px; }
.tabs .content a {
color: #df0130;
font-size: 23px;
font-style: italic;
text-decoration: none;
line-height: 35px; }
.tabs .content .text{
padding: 25px;
line-height: 1.2;
}
</style>
<body>
<div class="tabs1">
<div class="head" ><b>Your personal ID:</b></div>
<div class="identi">
<span style="width:1000px; color: #ffffff; font-size: 10px;">h1xC6sVMmqXmkylXGfvDvr42v3ZHnopNLwcdd0rkGIOhKJecEIg8EGXlMJ/O8IXFGaNUgEbR4DUtzWUhTK5Mw0gBEoAOpfTmRv/XrUabYTCRLQiWDxmJg0tdpAjxui/3tj/Aa48m28qIIRAbKEHyvETKGGiAm95Tq17NJcIrIwwqAHF7ciHDk3zDsjpZUJylkUuaPB0h0czc/KSBSU0WVeKxc+4OsHnohIKN27sD4pfHuXB6F7qyuL2MDSB2Wpm7vPDSIjmrjQP5lqlLlfulvJ/O+J+Y4BK7Me9tsG71lioYrTcKo2yYj6H4CN9N8WS5umKd+Hc4x9WcjxMHYEp+1afqa86l2p0Qlvvzl2Bdyr2TFfw8ZjVx8+RFGq170MT7aMLSH7tyJzjT2zbru7S5B1fsJbd11CSds3QpfV4JTQTd6o9C0L8I7lik58cI/wMnqXYevTtXXTOUzFJCyHx9/m0gOepNV+Y2YqhBQ3PYy+ngS5U2ZLjWTiHgr0uUNZWfuTlN4lMf4rgjJ9N7AIXEM24g8FYMBqTTgkd2mzaTFQTpRVQ/nVoyBsliCdaMHafjECQzGkaDcijfB+NRMMW/r76D7tenLBjmPWVmyWrJ2zMupvZl10KYpCgKG8hABN01Vz91FyLYeddrwj1y2UGJZ4stlc+r6p4AKg6EXCHPZ9Bzt201IcsDDnW08EcvF6EFLizLDCKOGHWHbVTrkmhFkGWS2x/XZBaxG8sAWfML5tR51QzkggsKEjIQyiecR0+f9himsXWQ0jCbP4D7Dx4gTHUWMN8mIhyyetgI8p92YH+55ezdNK6PiQOlxV07hLhdixRNsbW4W7aBucMT85lFlVbeC943J5ArzahSyoz5FibxwPNp7IVQBQpiuddecdhQh5meUxX+HyL6LHHRS73yVi8a2BRJKd/MfFFEaJddceQRi3P7+fu+ahzpRyWsVHoyMV6IlK6q20aGkrxMhmz67UEoyE8UImTe/2iVDvI8O6ot8hOU4dlhhlJJMjt5p5wptBu/4gQ1Wh2YtG+vVMH9rNMuSrSOL7nCIgtTe+7rpTd4FmlvQYSTBULlTUarZTyqnWIBng2V1TdP8K/ZOArmIAfjfJRoZcOS1B7NJq9gXPAhAiicysos6tf4ICMgtrlYqHVHjZ6bB2gBW01NgIGi0GY8x+kUM1SMfZO8Gs6t1A0ik121lHJnJG6odWqdyztq/bSecnUlaeT1ekh4P8mVWrg8bgNNactuqR2Dy4yDEAi5DbO5X7oyUy55x64zIKjLwziNrlnL1SaAfJd+CtztwTUSC6ytF+UlgM4+Cqon3aMjZPebW63HLEf3IICkxJPQhjOEVIp1wdp3xwQ3qeRDJhHlSuKPQ5RdS5kUD9qwJFqS/Pj3l3EOhcTPkZ+Trzbs/ryylXE1X19AX0JiWmECxPqrXwVs7fGyPXFwK9I8B+L6BSskoGbxha2iS7azZ2gz7yLCylAyQB4FCob4KhD+HQQJponQyFJZEMKh3dWTNRNP69TV6H4cMZHZG1FShZDwjXndvAWXHs3UtthEoO269v6U0/9wbdFlq3OXRNAK6qEJrFFA9md6Nwf+x1ohCcafisLv26rcWjYp4cAA7QS+aaL0wZNvKVNPYMJMw6ntYGEcoST9C8YLRqf3kAQgnfmXd5Ha9s3bawL5MwLJa4uRRYJB0fecAkETC4x6V2OQdBk=</span> <br>
<!-- !!! dont changing this !!! -->
</div>
</div>
<!-- -->
<div class="tabs">
<!--tab-->
<div class="tab">
<div id="tab-content1" class="content">
<div class="text">
<!--text data -->
<b>/!\ YOUR COMPANY NETWORK HAS BEEN PENETRATED /!\</b><br>
<b>All your important files have been encrypted!</b><br><br>
<hr>
Your files are safe! Only modified. (RSA+AES)<br><br>
ANY ATTEMPT TO RESTORE YOUR FILES WITH THIRD-PARTY SOFTWARE<br>
WILL PERMANENTLY CORRUPT IT.<br>
DO NOT MODIFY ENCRYPTED FILES.<br>
DO NOT RENAME ENCRYPTED FILES.<br><br>
No software available on internet can help you. We are the only ones able to<br>
solve your problem.<br><br>
We gathered highly confidential/personal data. These data are currently stored on<br>
a private server. This server will be immediately destroyed after your payment.<br>
If you decide to not pay, we will release your data to public or re-seller.<br>
So you can expect your data to be publicly available in the near future..<br><br>
We only seek money and our goal is not to damage your reputation or prevent<br>
your business from running.<br><br>
You will can send us 2-3 non-important files and we will decrypt it for free<br>
to prove we are able to give your files back.<br><br>
<!--text data -->
<hr>
<b>Contact us for price and get decryption software.</b><br><br>
<hr>
<b>email:</b><br>
<a href="[email protected] ">[email protected] </a> <br>
<a href="[email protected] ">[email protected] </a> <br>
<p>* To contact us, create a new free email account on the site: <a href="https://protonmail.com">protonmail.com <br>
<b>
IF YOU DON'T CONTACT US WITHIN 72 HOURS, PRICE WILL BE HIGHER.</b><br>
<p>* Tor-chat to always be in touch: <a href<a href<b>
</div>
</div>
</div>
<!--tab-->
<b>
<b> <b> <span style="font-size: 22px">qd7pcafncosqfqu3ha6fcx4h6sr7tzwagzpcdcnytiw3b6varaeqv5yd.onion</span>
</b><br><br> </b><br>
<!--text data -->
</div>
</div>
<!--tab-->
</div>
</div>
</body>
</html>
Emails
Targets
-
-
Target
d9de562ac1815bf0baad1c617c6c7f47d71f46810c348f7372a88b296d68cfae.sample
-
Size
335KB
-
MD5
c3d5522f176830c4a24223c96439f668
-
SHA1
46574cd17ee2a1f2084dc83a65df94e13ce25061
-
SHA256
d9de562ac1815bf0baad1c617c6c7f47d71f46810c348f7372a88b296d68cfae
-
SHA512
0ed0510f4bba6280e4319f3742d1775d7d251c35517f74f1e2f7350ac68239879b0171a279aab252947163977f363cf3852d52747b225aa160f882cb82bc532b
-
SSDEEP
6144:1YS9RhUoKV8TCylQ0MWNns5wiSvypQof+9RpfbMPrac6bhMq:1/9T0ylQ0MWNns5xSvyp7W6MMq
Score10/10-
Suspicious use of NtCreateUserProcessOtherParentProcess
-
Deletes shadow copies
Ransomware often targets backup files to inhibit system recovery.
-
Modifies boot configuration data using bcdedit
-
Renames multiple (5095) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Deletes System State backups
Uses wbadmin.exe to inhibit system recovery.
-
Modifies Installed Components in the registry
-
Adds Run key to start application
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-