General
-
Target
b660738bacd22ceb8a37c64cc7c60c757bf23c24696c6e5e56a9bcc1b3e5b84f
-
Size
45KB
-
Sample
240419-wx1xeace9z
-
MD5
be5c450d1618ca228900d752a050cfe0
-
SHA1
81ffe63ea6e19426a7a683fa59acdd16599169b6
-
SHA256
b660738bacd22ceb8a37c64cc7c60c757bf23c24696c6e5e56a9bcc1b3e5b84f
-
SHA512
f2e7e0acdfb974550e5f1bedc45d9eb72b5083c89c34259a7cd008136cf011b30f462d505fce97a6b790a293d175dd3209f37d78137c2c93cec28dc4988a49e3
-
SSDEEP
768:+t0UE/Q90k+Vikoov1b6LlmeLj+h4s8dNuCmIIEO1nvaZ/vAXWLouiQ2sev2Mtj1:Yrr9kVikxv1O5L1UCmI6nyZ/9our2sxw
Score
10/10
Malware Config
Extracted
Path
C:\info.hta
Ransom Note
<!DOCTYPE HTML PUBLIC '-//W3C//DTD HTML 4.01//EN' 'http://www.w3.org/TR/html4/strict.dtd'>
<html>
<head>
<meta charset='windows-1251'>
<title>deepindeep</title>
<HTA:APPLICATION
ICON='msiexec.exe'
SINGLEINSTANCE='yes'
SysMenu="no">
<script language='JScript'>
window.moveTo(50, 50);
window.resizeTo(screen.width - 100, screen.height - 100);
</script>
<style type='text/css'>
body {
font: 15px Tahoma, sans-serif;
margin: 10px;
line-height: 25px;
background: #C6B5C4;
}
img {
display:inline-block;
}
.bold {
font-weight: bold;
}
.mark {
background: #B5CC8E;
padding: 2px 5px;
}
.header {
text-align: center;
font-size: 30px;
line-height: 50px;
font-weight: bold;
margin-bottom:20px;
}
.info {
background: #e6ecf2;
border-left: 10px solid #B58CB2;
}
.alert {
background: #FFE4E4;
border-left: 10px solid #FFA07A;
}
.private {
border: 1px dashed #000;
background: #FFFFEF;
}
.note {
height: auto;
padding-bottom: 1px;
margin: 15px 0;
}
.note .title {
font-weight: bold;
text-indent: 10px;
height: 30px;
line-height: 30px;
padding-top: 10px;
}
.note .mark {
background: #B5CC8E;
}
.note ul {
margin-top: 0;
}
.note pre {
margin-left: 15px;
line-height: 13px;
font-size: 13px;
}
.footer {
position:fixed;
bottom:0;
right:0;
text-align: right;
}
</style>
</head>
<body>
<div class='header'>
<img src='data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAEAAAABACAQAAAAAYLlVAAAABGdBTUEAALGPC/xhBQAAACBjSFJNAAB6JQAAgIMAAPn/AACA6QAAdTAAAOpgAAA6mAAAF2+SX8VGAAAAAmJLR0QA/4ePzL8AAAAJcEhZcwAACxMAAAsTAQCanBgAAAAHdElNRQfjAwwMJwSFwIn8AAADNklEQVRo3u2ZTUhUURTHfzozmprmZ1pYEmkfJNEmiwwkSEyFECIQpEUboYhqFYHQXlcti9rUKldWBEUiuQpbtDDNzD5G8qM0HRXLRtO5LdJx3puPd++8+xyIztm88zgf/3veufeee18SdimDI1RxnL0U4gbAzxhDdPGCfpZs+49JWTTyFB8iAq8wTju1pDgXvopOliIGX+d57rHPieBuLvLNIvgaD1KvP/x1FiTDCwQTNOkFcJVfCuEFgq+c0he+minF8AJBH2WRnCUph8/nIZVhb2d5w1smEbjYSTn7SQ/TucsFlnWkPxBW6Xc4RkbIoHKooSNshsxRbT98Eb0mtyM04oqgmR6hUNvtrwrnWDa4nOVMVF0XLfw2aPuosBfezQPTmNpiVtFmnpj0W+wBKMFrcPeJ3RYWNfwwWHSSZgdAHX6Du5uWFpl0myqm1KiQrASgnNQQaZFOS4t5nhvkAnbZAbDHIE0wIGHzmsUQKdXkQwlACtsN8ijfJay8zBjkovgBbCLPlAG/hNUcswa5IH4Ayasdzxr5pBbWRRYMstGHYg04QAkH4FbQFSwTCKbdI7mzWVipbMceKtiCCFqO0OeY1caRbAaKOcgOCpQ+WWTyM8EwvfjkTfJoYZDFONqwaPyTHs7LbktlPNMYep2XuE22dfhsHjkS/i+3Wn/SK2EdoE72UeuyGH8rxbbLLjqlkRlb4TAzDo5fIJiOvRTnR+ju9VJuwveC/wASDsD+2h5KUyyQTVZiALzjFt3MsY16mtmqx2mt9BbUw4EQuzpGpVcCLQB8nDBZXmJFDoCeInzFS9ObxwzLmeoBMGA4/QBM4t1IAOHXDi7Zqwg9ACrCWotS8xnQWQCHOGsafzOFOhzLT8NxmoI3RZncULjG1ARA8DHYupxUucbUtxd4ghnw4JI30wdARHneMABx0j8FYD3xCkdefQByKFl9KsOjy6nKNBR0cZRCTjOk1JhrBCCY5r3pZtSS9bZkueSqmljVgPoPDa0Algk4HD8QG8AXph0G8Dk2AC89DgPosFKodvR83G/dtiRzTevtUChP0SCTpBQuM+bI6Bvk51gl96X/FFvzCh9oW0v+H2zO2tYtz/EgAAAAJXRFWHRkYXRlOmNyZWF0ZQAyMDE5LTAzLTEyVDEyOjM5OjA0KzAwOjAwG6lIYwAAACV0RVh0ZGF0ZTptb2RpZnkAMjAxOS0wMy0xMlQxMjozOTowNCswMDowMGr08N8AAAAASUVORK5CYII='>
<div>!!! ATTENTION !!!</div>
</div>
<div class='bold'>Your network is hacked and files are encrypted. </div>
<div class='bold'>Including the encrypted data we also downloaded other confidential information: data of your employees, customers, partners, as well as accounting and other internal documentation of your company.</div>
<div class='note info'>
<div class='title'>About Data</div>
<ul>All data is stored until you will pay.<br/>After payment we will provide you the programs for decryption and we will delete your data
<br/>We dont want did something bad to your company, it is just bussines (Our reputation is our money!)
<br/>If you refuse to negotiate with us (for any reason) all your data will be put up for sale.</ul>
</div>
<div class='note info'>
<div class='title'>What you will face if your data gets on the black market:</div>
<ul>
<li>The personal information of your employees and customers may be used to obtain a loan or purchases in online stores.</li>
<li>You may be sued by clients of your company for leaking information that was confidential.</li>
<li>After other hackers obtain personal data about your employees, social engineering will be applied to your company and subsequent attacks will only intensify.</li>
<li>Bank details and passports can be used to create bank accounts and online wallets through which criminal money will be laundered.</li>
<li>You will forever lose the reputation.</li>
<li>You will be subject to huge fines from the government.</li><br/>
You can learn more about liability for data loss here: <a href='https://en.wikipedia.org/wiki/General_Data_Protection_Regulation'>https://en.wikipedia.org/wiki/General_Data_Protection_Regulation</a>or here <a href='https://gdpr-info.eu'>https://gdpr-info.eu</a><br>
Courts, fines and the inability to use important files will lead you to huge losses. The consequences of this will be irreversible for you.<br>
Contacting the police will not save you from these consequences, and lost data, will only make your situation worse.
</ul>
</div>
<div class='note info'>
<div class='title'>How to contact us</div>
<ul>
<li>Write us to the mails: <span class='mark'>backmydata@skiff.com</span></li>
<li>Download the (Session) messenger <a href='https://getsession.org'>https://getsession.org</a> in messenger :ID"05947063ab6603c0e3a12db53d93d23634081c56390ff2084d11977820f78ce877"</li>
<li>Write this ID in the title of your message <span class='mark'>24233492-3511</span></li><br>
IF YOU WILL CONTACT US IN FIRST 6 hours , and we close our deal in 24 hours , PRICE WILL BE ONLY 30%.<br/>
(time is money for both of us , if you will take care about our time , we will do same , we will care of price and decryption process will be done VERY FAST)<br/>
ALL DOWNLOADED DATA WILL BE DELETED after payment.
</ul>
</div>
<div class='note alert'>
<div class='title'>What no to do and recomendation</div>
<ul>
You can get out of this situation with minimal losses (Our reputation is our money!) !!! To do this you must strictly observe the following rules:
<li>DO NOT Modify, DO NOT rename, DO NOT copy, DO NOT move any files. Such actions may DAMAGE them and decryption will be impossible.</li>
<li>DO NOT use any third party or public decryption software, it may also DAMAGE files.</li>
<li>DO NOT Shutdown or Reboot the system this may DAMAGE files.</li>
<li>DO NOT hire any third party negotiators (recovery/police, etc.) You need to contact us as soon as possible and start negotiations.</li><br/>
You can send us 1-2 small data not value files for test , we will decrypt it and send it to you back.<br/>
After payment we need no more that 2 hours to decrypt all of your data. We will be support you untill fully decryption going to be done! ! ! (Our reputation is our money!)
</ul>
</div>
</body>
</html>
Emails
class='mark'>backmydata@skiff.com</span></li>
URLs
http://www.w3.org/TR/html4/strict.dtd'>
Extracted
Path
C:\info.hta
Ransom Note
<!DOCTYPE HTML PUBLIC '-//W3C//DTD HTML 4.01//EN' 'http://www.w3.org/TR/html4/strict.dtd'>
<html>
<head>
<meta charset='windows-1251'>
<title>deepindeep</title>
<HTA:APPLICATION
ICON='msiexec.exe'
SINGLEINSTANCE='yes'
SysMenu="no">
<script language='JScript'>
window.moveTo(50, 50);
window.resizeTo(screen.width - 100, screen.height - 100);
</script>
<style type='text/css'>
body {
font: 15px Tahoma, sans-serif;
margin: 10px;
line-height: 25px;
background: #C6B5C4;
}
img {
display:inline-block;
}
.bold {
font-weight: bold;
}
.mark {
background: #B5CC8E;
padding: 2px 5px;
}
.header {
text-align: center;
font-size: 30px;
line-height: 50px;
font-weight: bold;
margin-bottom:20px;
}
.info {
background: #e6ecf2;
border-left: 10px solid #B58CB2;
}
.alert {
background: #FFE4E4;
border-left: 10px solid #FFA07A;
}
.private {
border: 1px dashed #000;
background: #FFFFEF;
}
.note {
height: auto;
padding-bottom: 1px;
margin: 15px 0;
}
.note .title {
font-weight: bold;
text-indent: 10px;
height: 30px;
line-height: 30px;
padding-top: 10px;
}
.note .mark {
background: #B5CC8E;
}
.note ul {
margin-top: 0;
}
.note pre {
margin-left: 15px;
line-height: 13px;
font-size: 13px;
}
.footer {
position:fixed;
bottom:0;
right:0;
text-align: right;
}
</style>
</head>
<body>
<div class='header'>
<img src='data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAEAAAABACAQAAAAAYLlVAAAABGdBTUEAALGPC/xhBQAAACBjSFJNAAB6JQAAgIMAAPn/AACA6QAAdTAAAOpgAAA6mAAAF2+SX8VGAAAAAmJLR0QA/4ePzL8AAAAJcEhZcwAACxMAAAsTAQCanBgAAAAHdElNRQfjAwwMJwSFwIn8AAADNklEQVRo3u2ZTUhUURTHfzozmprmZ1pYEmkfJNEmiwwkSEyFECIQpEUboYhqFYHQXlcti9rUKldWBEUiuQpbtDDNzD5G8qM0HRXLRtO5LdJx3puPd++8+xyIztm88zgf/3veufeee18SdimDI1RxnL0U4gbAzxhDdPGCfpZs+49JWTTyFB8iAq8wTju1pDgXvopOliIGX+d57rHPieBuLvLNIvgaD1KvP/x1FiTDCwQTNOkFcJVfCuEFgq+c0he+minF8AJBH2WRnCUph8/nIZVhb2d5w1smEbjYSTn7SQ/TucsFlnWkPxBW6Xc4RkbIoHKooSNshsxRbT98Eb0mtyM04oqgmR6hUNvtrwrnWDa4nOVMVF0XLfw2aPuosBfezQPTmNpiVtFmnpj0W+wBKMFrcPeJ3RYWNfwwWHSSZgdAHX6Du5uWFpl0myqm1KiQrASgnNQQaZFOS4t5nhvkAnbZAbDHIE0wIGHzmsUQKdXkQwlACtsN8ijfJay8zBjkovgBbCLPlAG/hNUcswa5IH4Ayasdzxr5pBbWRRYMstGHYg04QAkH4FbQFSwTCKbdI7mzWVipbMceKtiCCFqO0OeY1caRbAaKOcgOCpQ+WWTyM8EwvfjkTfJoYZDFONqwaPyTHs7LbktlPNMYep2XuE22dfhsHjkS/i+3Wn/SK2EdoE72UeuyGH8rxbbLLjqlkRlb4TAzDo5fIJiOvRTnR+ju9VJuwveC/wASDsD+2h5KUyyQTVZiALzjFt3MsY16mtmqx2mt9BbUw4EQuzpGpVcCLQB8nDBZXmJFDoCeInzFS9ObxwzLmeoBMGA4/QBM4t1IAOHXDi7Zqwg9ACrCWotS8xnQWQCHOGsafzOFOhzLT8NxmoI3RZncULjG1ARA8DHYupxUucbUtxd4ghnw4JI30wdARHneMABx0j8FYD3xCkdefQByKFl9KsOjy6nKNBR0cZRCTjOk1JhrBCCY5r3pZtSS9bZkueSqmljVgPoPDa0Algk4HD8QG8AXph0G8Dk2AC89DgPosFKodvR83G/dtiRzTevtUChP0SCTpBQuM+bI6Bvk51gl96X/FFvzCh9oW0v+H2zO2tYtz/EgAAAAJXRFWHRkYXRlOmNyZWF0ZQAyMDE5LTAzLTEyVDEyOjM5OjA0KzAwOjAwG6lIYwAAACV0RVh0ZGF0ZTptb2RpZnkAMjAxOS0wMy0xMlQxMjozOTowNCswMDowMGr08N8AAAAASUVORK5CYII='>
<div>!!! ATTENTION !!!</div>
</div>
<div class='bold'>Your network is hacked and files are encrypted. </div>
<div class='bold'>Including the encrypted data we also downloaded other confidential information: data of your employees, customers, partners, as well as accounting and other internal documentation of your company.</div>
<div class='note info'>
<div class='title'>About Data</div>
<ul>All data is stored until you will pay.<br/>After payment we will provide you the programs for decryption and we will delete your data
<br/>We dont want did something bad to your company, it is just bussines (Our reputation is our money!)
<br/>If you refuse to negotiate with us (for any reason) all your data will be put up for sale.</ul>
</div>
<div class='note info'>
<div class='title'>What you will face if your data gets on the black market:</div>
<ul>
<li>The personal information of your employees and customers may be used to obtain a loan or purchases in online stores.</li>
<li>You may be sued by clients of your company for leaking information that was confidential.</li>
<li>After other hackers obtain personal data about your employees, social engineering will be applied to your company and subsequent attacks will only intensify.</li>
<li>Bank details and passports can be used to create bank accounts and online wallets through which criminal money will be laundered.</li>
<li>You will forever lose the reputation.</li>
<li>You will be subject to huge fines from the government.</li><br/>
You can learn more about liability for data loss here: <a href='https://en.wikipedia.org/wiki/General_Data_Protection_Regulation'>https://en.wikipedia.org/wiki/General_Data_Protection_Regulation</a>or here <a href='https://gdpr-info.eu'>https://gdpr-info.eu</a><br>
Courts, fines and the inability to use important files will lead you to huge losses. The consequences of this will be irreversible for you.<br>
Contacting the police will not save you from these consequences, and lost data, will only make your situation worse.
</ul>
</div>
<div class='note info'>
<div class='title'>How to contact us</div>
<ul>
<li>Write us to the mails: <span class='mark'>backmydata@skiff.com</span></li>
<li>Download the (Session) messenger <a href='https://getsession.org'>https://getsession.org</a> in messenger :ID"05947063ab6603c0e3a12db53d93d23634081c56390ff2084d11977820f78ce877"</li>
<li>Write this ID in the title of your message <span class='mark'>016847C4-3511</span></li><br>
IF YOU WILL CONTACT US IN FIRST 6 hours , and we close our deal in 24 hours , PRICE WILL BE ONLY 30%.<br/>
(time is money for both of us , if you will take care about our time , we will do same , we will care of price and decryption process will be done VERY FAST)<br/>
ALL DOWNLOADED DATA WILL BE DELETED after payment.
</ul>
</div>
<div class='note alert'>
<div class='title'>What no to do and recomendation</div>
<ul>
You can get out of this situation with minimal losses (Our reputation is our money!) !!! To do this you must strictly observe the following rules:
<li>DO NOT Modify, DO NOT rename, DO NOT copy, DO NOT move any files. Such actions may DAMAGE them and decryption will be impossible.</li>
<li>DO NOT use any third party or public decryption software, it may also DAMAGE files.</li>
<li>DO NOT Shutdown or Reboot the system this may DAMAGE files.</li>
<li>DO NOT hire any third party negotiators (recovery/police, etc.) You need to contact us as soon as possible and start negotiations.</li><br/>
You can send us 1-2 small data not value files for test , we will decrypt it and send it to you back.<br/>
After payment we need no more that 2 hours to decrypt all of your data. We will be support you untill fully decryption going to be done! ! ! (Our reputation is our money!)
</ul>
</div>
</body>
</html>
Emails
class='mark'>backmydata@skiff.com</span></li>
URLs
http://www.w3.org/TR/html4/strict.dtd'>
Targets
-
-
Target
396a2f2dd09c936e93d250e8467ac7a9c0a923ea7f9a395e63c375b877a399a6
-
Size
61KB
-
MD5
ca52ef8f80a99a01e97dc8cf7d3f5487
-
SHA1
d4bf7b56d1f022e14a870d724e8da274288bc5db
-
SHA256
396a2f2dd09c936e93d250e8467ac7a9c0a923ea7f9a395e63c375b877a399a6
-
SHA512
06d2fa34d9972af950d166a67b39b987004deab1244206c96cbd3cdeb862758d482854ae4fa6b6472bbedb0601b64442c03ec863b3df8a64e9cf38a1c3a826bd
-
SSDEEP
1536:1NeRBl5PT/rx1mzwRMSTdLpJ1BNl0+EAF+oV+Qp3U:1QRrmzwR5J/Na+Ee93U
Score10/10-
Phobos
Phobos ransomware appeared at the beginning of 2019.
-
Deletes shadow copies
Ransomware often targets backup files to inhibit system recovery.
-
Modifies boot configuration data using bcdedit
-
Renames multiple (304) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Deletes backup catalog
Uses wbadmin.exe to inhibit system recovery.
-
Modifies Windows Firewall
-
Drops startup file
-
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application
-
Drops desktop.ini file(s)
-
MITRE ATT&CK Matrix ATT&CK v13
Persistence
Create or Modify System Process
1Windows Service
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Privilege Escalation
Create or Modify System Process
1Windows Service
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Defense Evasion
Indicator Removal
3File Deletion
3Impair Defenses
1Disable or Modify System Firewall
1Modify Registry
2