General
-
Target
7abf27c6711f53ea2688bc8b9c30bb0c01e1cd64436e09de83c768ecd49a412e
-
Size
44KB
-
Sample
240419-wyd42acf3x
-
MD5
a9be629bcd1fd1c42924ad20ba8c1f7e
-
SHA1
71b7cb8e6f64592284194292c31ac47a7c3d49c2
-
SHA256
7abf27c6711f53ea2688bc8b9c30bb0c01e1cd64436e09de83c768ecd49a412e
-
SHA512
b0341a59b2ed7f74308dd8e37e79787a9b63773e66372b1f52e45e4f56906f82c97f8ea6b8792992ae72b166699142fa7e0693a39aaaac1577f56a3286179472
-
SSDEEP
768:ozQtyfIhh0PJUNLGspU4jyKmjcDmoPf2JjUDeoRuTg45pHZQCPInIHYH/Fw5EItN:aQwfcePk3pNjyLjPjADeka3Ph9SQ+e
Score
10/10
Malware Config
Extracted
Path
C:\info.hta
Ransom Note
<!DOCTYPE HTML PUBLIC '-//W3C//DTD HTML 4.01//EN' 'http://www.w3.org/TR/html4/strict.dtd'>
<html>
<head>
<meta charset='windows-1251'>
<title>deepindeep</title>
<HTA:APPLICATION
ICON='msiexec.exe'
SINGLEINSTANCE='yes'
SysMenu="no">
<script language='JScript'>
window.moveTo(50, 50);
window.resizeTo(screen.width - 100, screen.height - 100);
</script>
<style type='text/css'>
body {
font: 15px Tahoma, sans-serif;
margin: 10px;
line-height: 25px;
background: #C6B5C4;
}
img {
display:inline-block;
}
.bold {
font-weight: bold;
}
.mark {
background: #B5CC8E;
padding: 2px 5px;
}
.header {
text-align: center;
font-size: 30px;
line-height: 50px;
font-weight: bold;
margin-bottom:20px;
}
.info {
background: #e6ecf2;
border-left: 10px solid #B58CB2;
}
.alert {
background: #FFE4E4;
border-left: 10px solid #FFA07A;
}
.private {
border: 1px dashed #000;
background: #FFFFEF;
}
.note {
height: auto;
padding-bottom: 1px;
margin: 15px 0;
}
.note .title {
font-weight: bold;
text-indent: 10px;
height: 30px;
line-height: 30px;
padding-top: 10px;
}
.note .mark {
background: #B5CC8E;
}
.note ul {
margin-top: 0;
}
.note pre {
margin-left: 15px;
line-height: 13px;
font-size: 13px;
}
.footer {
position:fixed;
bottom:0;
right:0;
text-align: right;
}
</style>
</head>
<body>
<div class='header'>
<img src='data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAEAAAABACAQAAAAAYLlVAAAABGdBTUEAALGPC/xhBQAAACBjSFJNAAB6JQAAgIMAAPn/AACA6QAAdTAAAOpgAAA6mAAAF2+SX8VGAAAAAmJLR0QA/4ePzL8AAAAJcEhZcwAACxMAAAsTAQCanBgAAAAHdElNRQfjAwwMJwSFwIn8AAADNklEQVRo3u2ZTUhUURTHfzozmprmZ1pYEmkfJNEmiwwkSEyFECIQpEUboYhqFYHQXlcti9rUKldWBEUiuQpbtDDNzD5G8qM0HRXLRtO5LdJx3puPd++8+xyIztm88zgf/3veufeee18SdimDI1RxnL0U4gbAzxhDdPGCfpZs+49JWTTyFB8iAq8wTju1pDgXvopOliIGX+d57rHPieBuLvLNIvgaD1KvP/x1FiTDCwQTNOkFcJVfCuEFgq+c0he+minF8AJBH2WRnCUph8/nIZVhb2d5w1smEbjYSTn7SQ/TucsFlnWkPxBW6Xc4RkbIoHKooSNshsxRbT98Eb0mtyM04oqgmR6hUNvtrwrnWDa4nOVMVF0XLfw2aPuosBfezQPTmNpiVtFmnpj0W+wBKMFrcPeJ3RYWNfwwWHSSZgdAHX6Du5uWFpl0myqm1KiQrASgnNQQaZFOS4t5nhvkAnbZAbDHIE0wIGHzmsUQKdXkQwlACtsN8ijfJay8zBjkovgBbCLPlAG/hNUcswa5IH4Ayasdzxr5pBbWRRYMstGHYg04QAkH4FbQFSwTCKbdI7mzWVipbMceKtiCCFqO0OeY1caRbAaKOcgOCpQ+WWTyM8EwvfjkTfJoYZDFONqwaPyTHs7LbktlPNMYep2XuE22dfhsHjkS/i+3Wn/SK2EdoE72UeuyGH8rxbbLLjqlkRlb4TAzDo5fIJiOvRTnR+ju9VJuwveC/wASDsD+2h5KUyyQTVZiALzjFt3MsY16mtmqx2mt9BbUw4EQuzpGpVcCLQB8nDBZXmJFDoCeInzFS9ObxwzLmeoBMGA4/QBM4t1IAOHXDi7Zqwg9ACrCWotS8xnQWQCHOGsafzOFOhzLT8NxmoI3RZncULjG1ARA8DHYupxUucbUtxd4ghnw4JI30wdARHneMABx0j8FYD3xCkdefQByKFl9KsOjy6nKNBR0cZRCTjOk1JhrBCCY5r3pZtSS9bZkueSqmljVgPoPDa0Algk4HD8QG8AXph0G8Dk2AC89DgPosFKodvR83G/dtiRzTevtUChP0SCTpBQuM+bI6Bvk51gl96X/FFvzCh9oW0v+H2zO2tYtz/EgAAAAJXRFWHRkYXRlOmNyZWF0ZQAyMDE5LTAzLTEyVDEyOjM5OjA0KzAwOjAwG6lIYwAAACV0RVh0ZGF0ZTptb2RpZnkAMjAxOS0wMy0xMlQxMjozOTowNCswMDowMGr08N8AAAAASUVORK5CYII='>
<div>!!! ATTENTION !!!</div>
</div>
<div class='bold'>Your network is hacked and files are encrypted. </div>
<div class='bold'>Including the encrypted data we also downloaded other confidential information: data of your employees, customers, partners, as well as accounting and other internal documentation of your company.</div>
<div class='note info'>
<div class='title'>About Data</div>
<ul>All data is stored until you will pay.<br/>After payment we will provide you the programs for decryption and we will delete your data
<br/>We dont want did something bad to your company, it is just bussines (Our reputation is our money!)
<br/>If you refuse to negotiate with us (for any reason) all your data will be put up for sale.</ul>
</div>
<div class='note info'>
<div class='title'>What you will face if your data gets on the black market:</div>
<ul>
<li>The personal information of your employees and customers may be used to obtain a loan or purchases in online stores.</li>
<li>You may be sued by clients of your company for leaking information that was confidential.</li>
<li>After other hackers obtain personal data about your employees, social engineering will be applied to your company and subsequent attacks will only intensify.</li>
<li>Bank details and passports can be used to create bank accounts and online wallets through which criminal money will be laundered.</li>
<li>You will forever lose the reputation.</li>
<li>You will be subject to huge fines from the government.</li><br/>
You can learn more about liability for data loss here: <a href='https://en.wikipedia.org/wiki/General_Data_Protection_Regulation'>https://en.wikipedia.org/wiki/General_Data_Protection_Regulation</a>or here <a href='https://gdpr-info.eu'>https://gdpr-info.eu</a><br>
Courts, fines and the inability to use important files will lead you to huge losses. The consequences of this will be irreversible for you.<br>
Contacting the police will not save you from these consequences, and lost data, will only make your situation worse.
</ul>
</div>
<div class='note info'>
<div class='title'>How to contact us</div>
<ul>
<li>Write us to the mails: <span class='mark'>[email protected]</span></li>
<li>Download the (Session) messenger <a href='https://getsession.org'>https://getsession.org</a> in messenger :ID"05bc5e20c9c6fbfd9a58bfa222cecd4bbf9b5cf4e1ecde84a0b8b3de23ce8e144e"</li>
<li>Write this ID in the title of your message <span class='mark'>17537C22-3511</span></li><br>
IF YOU WILL CONTACT US IN FIRST 6 hours , and we close our deal in 24 hours , PRICE WILL BE ONLY 30%.<br/>
(time is money for both of us , if you will take care about our time , we will do same , we will care of price and decryption process will be done VERY FAST)<br/>
ALL DOWNLOADED DATA WILL BE DELETED after payment.
</ul>
</div>
<div class='note alert'>
<div class='title'>What no to do and recomendation</div>
<ul>
You can get out of this situation with minimal losses (Our reputation is our money!) !!! To do this you must strictly observe the following rules:
<li>DO NOT Modify, DO NOT rename, DO NOT copy, DO NOT move any files. Such actions may DAMAGE them and decryption will be impossible.</li>
<li>DO NOT use any third party or public decryption software, it may also DAMAGE files.</li>
<li>DO NOT Shutdown or Reboot the system this may DAMAGE files.</li>
<li>DO NOT hire any third party negotiators (recovery/police, etc.) You need to contact us as soon as possible and start negotiations.</li><br/>
You can send us 1-2 small data not value files for test , we will decrypt it and send it to you back.<br/>
After payment we need no more that 2 hours to decrypt all of your data. We will be support you untill fully decryption going to be done! ! ! (Our reputation is our money!)
</ul>
</div>
</body>
</html>
Emails
class='mark'>[email protected]</span></li>
URLs
http://www.w3.org/TR/html4/strict.dtd'>
Targets
-
-
Target
fe2b5fb57399cf0c7607d5aa133910a9500d176e0dd6a45a4ff8485ad4e70412
-
Size
60KB
-
MD5
e71c0cffb0d9122dca8fc854a55db27c
-
SHA1
21f4342e962ab63914a8786343bd2ed36ce86169
-
SHA256
fe2b5fb57399cf0c7607d5aa133910a9500d176e0dd6a45a4ff8485ad4e70412
-
SHA512
3d7a546e1fe407b8eaafaef2e15807639bdbeb6d5765cb51a45658c619ffc16a2526de8f4b93bf005aff210e0f20d785937f96c426c5fd491aa83a641d1474f3
-
SSDEEP
1536:YNeRBl5PT/rx1mzwRMSTdLpJYkrZdbVQJ/l3gN:YQRrmzwR5JT7S/y
Score10/10-
Phobos
Phobos ransomware appeared at the beginning of 2019.
-
Deletes shadow copies
Ransomware often targets backup files to inhibit system recovery.
-
Modifies boot configuration data using bcdedit
-
Renames multiple (163) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Deletes backup catalog
Uses wbadmin.exe to inhibit system recovery.
-
Modifies Windows Firewall
-
Drops startup file
-
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application
-
Drops desktop.ini file(s)
-
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Defense Evasion
Impair Defenses
1Disable or Modify System Firewall
1Indicator Removal
3File Deletion
3Modify Registry
1