General
-
Target
f584c124d92b09ba12d2538d52300dc38ef255c6ad23c30e7569ff1920388c50.sample
-
Size
333KB
-
Sample
240227-wnd2aafg24
-
MD5
169d9a666d9d56e1c7396cac6591af49
-
SHA1
cb61440e03d74116ce70a23307a600f04bb58eed
-
SHA256
f584c124d92b09ba12d2538d52300dc38ef255c6ad23c30e7569ff1920388c50
-
SHA512
619ec05142929ecc1349a5a68a24953a1877308bedc6c52e698fc379d34b7e4dfb7e07cf5da63547cf26ee4c87fdbac8c75fe325a3c277e0d48dddc8b927013e
-
SSDEEP
6144:Bkv89W2QcboLPlZbqEKvSlvgXCBVnTDg3GV06rPnej63AbyEXq:Bk09XelZbqEKv8gXCBlPHe1yEXq
Score
10/10
Malware Config
Extracted
Path
\Device\HarddiskVolume1\Boot\hu-HU\How_to_back_files.html
Ransom Note
<html>
<style type="text/css">
body {
background-color: #f5f5f5;
}
h1, h3{
text-align: center;
text-transform: uppercase;
font-weight: normal;
}
/*---*/
.tabs1{
display: block;
margin: auto;
}
.tabs1 .head{
text-align: center;
float: top;
padding: 0px;
text-transform: uppercase;
font-weight: normal;
display: block;
background: #81bef7;
color: #DF0101;
font-size: 30px;
}
.tabs1 .identi {
font-size: 10px;
text-align: center;
float: top;
padding: 15px;
display: block;
background: #81bef7;
color: #DFDFDF;
word-break: break-all;
}
.tabs .content {
background: #f5f5f5;
/*text-align: center;*/
color: #000000;
padding: 25px 15px;
font-size: 15px;
font-weight: 400;
line-height: 20px; }
.tabs .content a {
color: #df0130;
font-size: 23px;
font-style: italic;
text-decoration: none;
line-height: 35px; }
.tabs .content .text{
padding: 25px;
line-height: 1.2;
}
</style>
<body>
<div class="tabs1">
<div class="head" ><b>Your personal ID:</b></div>
<div class="identi">
<span style="width:1000px; color: #ffffff; font-size: 10px;">SioNRPnlEC5E6ez+/A2w0CmDJxD3IoJRGRc/jJ3RDgaU1n3NweGGY5asc3+J47uA/cjGty8nGEwZdo04XI9efOAjJp0n3yUF0RSXv6MYQyC+o0Cta5QSZhtOVaTB83HUya50cMFFTZ9RsQEki459KmD0wiK8sw3X7nSKZEYQNGRbc+/5Hm1aAUNUTGhzc/c4eFfnwGcjFK6UMwCvbFnJnjv7yt+5yYOdnmq+K1NOzkjjiBfYJifOSfQzcgveR4xoZdJX0iHpeLEEHld5HVVlD7i0PcsaorGoRqjSY+z3JAXZo4zgYIAkbc3tyPq7D1LCDL23kJta7N9ZljGacZVFIsDKBqIeTvnyXkZGtq4PLn4Mg8O2jnk4LDrWVAgAy5jTeIh0OiKJvw0EVWvyGlBaVAHlxabEZ31Ki4PJyguovLRv6YQiNoVeZD2prlgscQQVuUJkwAUKEX0MiGfQ5LSnhwCHpXGUIduBiNctWKlhheF4wjbqhER/SQrDI6wDLrM3ftSQMwTwGu+G/DynJOomZcEqdfQTvj4dgr+Pxjzq9nZQ8ZYQ72NpMVMseB1icvgzdzQsc17MOCUy0NFkg14pBoQmZ1o3zELx7mjLIqNjHIjAOVpGrz78mk75MI9cdfKINL/NZpJfVhVY08B/KqbxN4uNLk9RGLUtmDIl+SAbJEYcPrRVxqxMCUD0MvQRQZR97vXcQfiFbS1hujeFH729aog4dFkz5k3Cqvx6T9PtgDOQHAAAjgXXuxbZDFxuCCh2rQPJhyNu1ij9QV1pbU7cSJkhUcf8HdFpj/YBjXqPby+J6aKpSjbVv/uHlmL7K6bYedOFV5MEWnyIKGxC6GxayMeZ3u5PeSfMyhJzOhfELReEAoKg3wpV8UOxVDHPvTJtxwHKFqI/juWNnzjungv2t4LeWq5pUBoVskwhcIQauPp720NYqUw8/4WUNvSb9i3fDmxrIkmQ5ui72x5zfjXLqB8R05Z+Hs7JvH0PV2IRsisOAGeFF9HqF9RuhX6SEhZQHlDJF2sFlGCkhN8o7JRWX1J8GeoYb3J/by0EPO1IrulDjvh/XhdOZroGdO00NxZyx2d32UvlOBh1wVlhgM0XpRbUHJgvezPYZ+82vJiWKLVHeGtbXr7qyPGPv0+tzOnx4R5X1PENUkgAcJXIv4y0yLvWR0QGzFMWY/9huUTUGWu5tpzv8fQ1hdNlogvzprPUnIL0OAOLvduT+2dxlNZqsjchNmOkRd+GO/sxHSOvIo3/vit/fT1PLLM/jBvVnn2sk/cxA1BAHTYfU6qd+ueVU79gOv9gtewEI0LrfmUytJ/qxSuXyGJtz2W9FCatE7qLqjb2P7tpYE4K18cBR/FNGYfhBfTOVXZtSEJIlTSBOLaDBm6NVAslTa3fDdjQQrRFjf6JkIa+hoGZlwsp7IPD6ij0+aA7U/eCaT6y//ZRZIxEk667XtUrIwQ2mHgxgAMhE8MTIpZGMvN6HioCkBjkZh4C8KLslun3ZIQOx/mOW92Hx28TjlEO4s7KCcs5sZJdM9MaQILnTd3M9o/V04iCL8NcOcZQCU7IYEXcJVWkqOSXvQ2BsGWz68gN1mz8tkbBTcM2KG230xYClT7QtCpJAamQFKlnlV7uvoy4O6B2y/lwh6PC7hFyic3y+OKzn4knhCW40lWq7SR9pXXONDUU8mOg9Bc6AMwSR4ola9UGqH4=</span> <br>
<!-- !!! dont changing this !!! -->
</div>
</div>
<!-- -->
<div class="tabs">
<!--tab-->
<div class="tab">
<div id="tab-content1" class="content">
<div class="text">
<!--text data -->
<b>/!\ YOUR COMPANY NETWORK HAS BEEN PENETRATED /!\</b><br>
<b>All your important files have been encrypted!</b><br><br>
<hr>
Your files are safe! Only modified. (RSA+AES)<br><br>
ANY ATTEMPT TO RESTORE YOUR FILES WITH THIRD-PARTY SOFTWARE<br>
WILL PERMANENTLY CORRUPT IT.<br>
DO NOT MODIFY ENCRYPTED FILES.<br>
DO NOT RENAME ENCRYPTED FILES.<br><br>
No software available on internet can help you. We are the only ones able to<br>
solve your problem.<br><br>
We gathered highly confidential/personal data. These data are currently stored on<br>
a private server. This server will be immediately destroyed after your payment.<br>
If you decide to not pay, we will release your data to public or re-seller.<br>
So you can expect your data to be publicly available in the near future..<br><br>
We only seek money and our goal is not to damage your reputation or prevent<br>
your business from running.<br><br>
You will can send us 2-3 non-important files and we will decrypt it for free<br>
to prove we are able to give your files back.<br><br>
<!--text data -->
<hr>
<b>Contact us for price and get decryption software.</b><br><br>
<hr>
<b>email:</b><br>
<a href="[email protected] ">[email protected] </a> <br>
<a href="[email protected] ">[email protected] </a> <br>
<p>* To contact us, create a new free email account on the site: <a href="https://protonmail.com">protonmail.com <br>
<b>
IF YOU DON'T CONTACT US WITHIN 72 HOURS, PRICE WILL BE HIGHER.</b><br>
</div>
</div>
</div>
<!--tab-->
<!--text data -->
</div>
</div>
<!--tab-->
</div>
</div>
</body>
</html>
Emails
Extracted
Path
\Device\HarddiskVolume1\Boot\How_to_back_files.html
Ransom Note
<html>
<style type="text/css">
body {
background-color: #f5f5f5;
}
h1, h3{
text-align: center;
text-transform: uppercase;
font-weight: normal;
}
/*---*/
.tabs1{
display: block;
margin: auto;
}
.tabs1 .head{
text-align: center;
float: top;
padding: 0px;
text-transform: uppercase;
font-weight: normal;
display: block;
background: #81bef7;
color: #DF0101;
font-size: 30px;
}
.tabs1 .identi {
font-size: 10px;
text-align: center;
float: top;
padding: 15px;
display: block;
background: #81bef7;
color: #DFDFDF;
word-break: break-all;
}
.tabs .content {
background: #f5f5f5;
/*text-align: center;*/
color: #000000;
padding: 25px 15px;
font-size: 15px;
font-weight: 400;
line-height: 20px; }
.tabs .content a {
color: #df0130;
font-size: 23px;
font-style: italic;
text-decoration: none;
line-height: 35px; }
.tabs .content .text{
padding: 25px;
line-height: 1.2;
}
</style>
<body>
<div class="tabs1">
<div class="head" ><b>Your personal ID:</b></div>
<div class="identi">
<span style="width:1000px; color: #ffffff; font-size: 10px;">M8pIUYSPZ+cCGTCUG3ld8PuJTtSUxzOkauLYZIMEkkyzuuWjdQpXrebMTZ0oFnJVa7KMwdxLMF9KGC0XuoOudFcDLuVuDdELKAOm3uoFXY2UNJGWwyAC7hIzRRrgdBajhc00qE79G6YMmxvynFK/3fAh0ClElqS7eNUggsPVVvNhBJgBvdxAITL4q3WHFgK3zVabUPVpeRSO5peCfMuY9OD2CpR0GBvmTFme536PjB9qa2C+LxlUCStKKKwfk9w2h1zAc93I1q2BwMSTBo+RqXtR8luIe9G/WUZ67Pn1FMsalXYowMd3U+r3nMQTGKnom9G2v3rE+kDp9An2Y3ZFDqtAKbn4Pd249x5cb/rOWSDmf6qa1Ca82lkAzMmLjj2XUG+2RQaYeoLfI9fzqO9wrAdUKCu6M16BmzwW9Nh/ihJu37WP4IkQuc/xkRSniGXgvgsATR+v5/+yZDTKCZjpUjIClEKliOQNdntmKfwPyB7njUhMAKIf16CKqW2R33JBpskSa5vUB+ijbnFf+JeXpYh51B3R6OY3UhH3G2p9DkRg3dcIbZl4yboaVn+q5YtDNWpdkdVgbsBvHPNk/koL0+TIqZ0g4KCJJriYkSYfsT/lmr54XWHkpuLBnz56RzxiGZgmPM+nZZXHDG9FpcCA3XVa0POgDmzePq4cv1Lj6TOvtqOPIH3l3E4xth7mEDYwqys2kEu5X7vRt8q721ZA1gv1Ta+o94ju8b1iUZ78MO2WLHt2Z0qghc1QRRx1nV6iCEMRuIvhg0bOr3tyaLIsNgZ5OQ4Hj9VDQZpJDMq8NkDE9EyuRjQNLcH3e1XarvFXK9eQmje+jrqFLoqMXgOqecJszZNFYUSJZcUNlfVO0+GgUZohVaQe8tQ+yBHhodZAe507vzBMq5DzRoztudGOH0S6QGRNNglJHrsresgF6M7a9Vre7E96g5OMA2xzNcM9WaeQg1Yzg5wkTVWM/gzomZULtnb0RTQX925KXub5Ob/XqT/Tk7yxN6ToG2sqNVEh20sJ63DaBv639eZ4/t5aKL2InEpYysslPc4VR5Wx9RnUqrQLdBalwWtiaxNU9pKrtzCY9KB3NL0b4x/hTovDEN6zFy68rtuABifIgFdKWxRHNz5RcHrForNIqDGzw+aZxIOYT8sTl0UyqnDMLmZ89S3DqjVElG7MUr5D3Z2LhsUvBGaFcHX0g4vjmRJEZFq4rrUvJmIAXDSzEqYwRNLezb/ow7nLJ1Wha1e8kZuS8qzuGjj8fe9NdFzaR48lIUE/Ta/MVjMIq9/fywT1sGGowMU/wlKpFjomFCT20nq8lOpKM3wlQ2Qsc6tID+qg8pvVV0p0TayWa8srnJxgcNOWOV2BonRlWSmOvVeGRZGbTJxhmDqysoGWQZSqWsfHgk6bZ3jgXaZWo979Bz21Kj7FKnp9pInLqECg2vHHmNitPZ3lBWkGzexpasGpY5hX9hWkQ/D8R0pMD/AxpwMeLN5yo/bRh+JTK7EwnCBfcTg5a5ejiBVPbQKYP0IPvv1KMWwGgOrW7rwT7mnv8T82kM2rsOcMigADrqTS+tI4TKGVO2aa7dm/S48xN/IOqU63HQso4p7QYzaAQzXUUhIPPPQAKB86JFroQOQUJuMEnlF3iVEodUAGriu70nABfKsxLdjrtxI1cRmZeGa2f/AaSzzCnt6PUmn8E6jUn7u05CbXDcU=</span> <br>
<!-- !!! dont changing this !!! -->
</div>
</div>
<!-- -->
<div class="tabs">
<!--tab-->
<div class="tab">
<div id="tab-content1" class="content">
<div class="text">
<!--text data -->
<b>/!\ YOUR COMPANY NETWORK HAS BEEN PENETRATED /!\</b><br>
<b>All your important files have been encrypted!</b><br><br>
<hr>
Your files are safe! Only modified. (RSA+AES)<br><br>
ANY ATTEMPT TO RESTORE YOUR FILES WITH THIRD-PARTY SOFTWARE<br>
WILL PERMANENTLY CORRUPT IT.<br>
DO NOT MODIFY ENCRYPTED FILES.<br>
DO NOT RENAME ENCRYPTED FILES.<br><br>
No software available on internet can help you. We are the only ones able to<br>
solve your problem.<br><br>
We gathered highly confidential/personal data. These data are currently stored on<br>
a private server. This server will be immediately destroyed after your payment.<br>
If you decide to not pay, we will release your data to public or re-seller.<br>
So you can expect your data to be publicly available in the near future..<br><br>
We only seek money and our goal is not to damage your reputation or prevent<br>
your business from running.<br><br>
You will can send us 2-3 non-important files and we will decrypt it for free<br>
to prove we are able to give your files back.<br><br>
<!--text data -->
<hr>
<b>Contact us for price and get decryption software.</b><br><br>
<hr>
<b>email:</b><br>
<a href="[email protected] ">[email protected] </a> <br>
<a href="[email protected] ">[email protected] </a> <br>
<p>* To contact us, create a new free email account on the site: <a href="https://protonmail.com">protonmail.com <br>
<b>
IF YOU DON'T CONTACT US WITHIN 72 HOURS, PRICE WILL BE HIGHER.</b><br>
</div>
</div>
</div>
<!--tab-->
<!--text data -->
</div>
</div>
<!--tab-->
</div>
</div>
</body>
</html>
Emails
Targets
-
-
Target
f584c124d92b09ba12d2538d52300dc38ef255c6ad23c30e7569ff1920388c50.sample
-
Size
333KB
-
MD5
169d9a666d9d56e1c7396cac6591af49
-
SHA1
cb61440e03d74116ce70a23307a600f04bb58eed
-
SHA256
f584c124d92b09ba12d2538d52300dc38ef255c6ad23c30e7569ff1920388c50
-
SHA512
619ec05142929ecc1349a5a68a24953a1877308bedc6c52e698fc379d34b7e4dfb7e07cf5da63547cf26ee4c87fdbac8c75fe325a3c277e0d48dddc8b927013e
-
SSDEEP
6144:Bkv89W2QcboLPlZbqEKvSlvgXCBVnTDg3GV06rPnej63AbyEXq:Bk09XelZbqEKv8gXCBlPHe1yEXq
Score10/10-
Suspicious use of NtCreateUserProcessOtherParentProcess
-
Deletes shadow copies
Ransomware often targets backup files to inhibit system recovery.
-
Modifies boot configuration data using bcdedit
-
Renames multiple (7559) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Deletes System State backups
Uses wbadmin.exe to inhibit system recovery.
-
Modifies Installed Components in the registry
-
Adds Run key to start application
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-