General

  • Target

    VirusShare_6b3f01729d9f544a9ade26bdda98041f

  • Size

    316KB

  • Sample

    240610-nrq61shh76

  • MD5

    6b3f01729d9f544a9ade26bdda98041f

  • SHA1

    3d503f0a596f577e410c05cf1b314dd61424e560

  • SHA256

    0658c6bbf1a37ec892996e2adc76ef0fb39c9e4dc197d05cf523748d56bf934e

  • SHA512

    6cc5c368b083394c726e8c24134fdc797efa7a215c15e01e7fcb36a5c7c5d897ac2672bf774043429001e5e19cf328aff56e1523042f38611e2a161e0f974914

  • SSDEEP

    6144:uRcNUBOfj1ANLQQ2ij56Nxvc78DgDDXxuRPS9kSdY0z7:l6Ie1QQVj54xC8cHXxuJUkGY

Malware Config

Extracted

Path

C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\RECOVERweuma.txt

Ransom Note
NOT YOUR LANGUAGE? USE https://translate.google.com What's the matter with your files? Your data was secured using a strong encryption with RSA4096. Use the link down below to find additional information on the encryption keys using RSA4096:https://en.wikipedia.org/wiki/RSA_(cryptosystem) What exactly that means? It means that on a structural level your files have been transformed. You won't be able to use, read, see or work with them anymore. In other words they are useless, however, there is a possibility to restore them with our help. What exactly happened to your files? *** Two personal RSA4096 keys were generated for your PC/Laptop; one key is public, another key is private. *** All your data and files were encrypted by the means of the public key, which you received over the web. *** In order to decrypt your data and gain access to your computer you need a private key and a decryption software, which can be found on one of our secret servers. What should you do next? There are several options for you to consider: 1. You can wait for a while until the price of a private key will raise, so you will have to pay twice as much to access your files or 2. You can start getting BitCoins right now and get access to your data quite fast. In case you have valuable files, we advise you to act fast as there is no other option rather than paying in order to get back your data. In order to obtain specific instructions, please access your personal homepage by choosing one of the few addresses down below: http://uhufnlsad7bhf4ykqfbevmxergwrth.himfinn.com/E69BAD95628BC28 http://94dbhbj3l4blaeyfgl7q45glbaer.giponfeste.at/E69BAD95628BC28 http://h5nuwefkuh134ljngkasdbasfg.corolbugan.com/E69BAD95628BC28 If you can't access your personal homepage or the addresses are not working, complete the following steps: 1 Download TOR Browser - http://www.torproject.org/projects/torbrowser.html.en 2 Install TOR Browser 3 Open TOR Browser 4 Insert the following link in the address bar: k7tlx3ghr3m4n2tu.onion/E69BAD95628BC28 5 Follow the steps on your screen IMPORTANT INFORMATION Your personal homepages: http://uhufnlsad7bhf4ykqfbevmxergwrth.himfinn.com/E69BAD95628BC28 http://94dbhbj3l4blaeyfgl7q45glbaer.giponfeste.at/E69BAD95628BC28 http://h5nuwefkuh134ljngkasdbasfg.corolbugan.com/E69BAD95628BC28 Your personal page Tor-Browser k7tlx3ghr3m4n2tu.onion/E69BAD95628BC28 Your personal identification ID: E69BAD95628BC28
URLs

http://uhufnlsad7bhf4ykqfbevmxergwrth.himfinn.com/E69BAD95628BC28

http://94dbhbj3l4blaeyfgl7q45glbaer.giponfeste.at/E69BAD95628BC28

http://h5nuwefkuh134ljngkasdbasfg.corolbugan.com/E69BAD95628BC28

http://k7tlx3ghr3m4n2tu.onion/E69BAD95628BC28

Extracted

Path

C:\PerfLogs\RECOVERtviyw.txt

Ransom Note
NOT YOUR LANGUAGE? USE https://translate.google.com What's the matter with your files? Your data was secured using a strong encryption with RSA4096. Use the link down below to find additional information on the encryption keys using RSA4096:https://en.wikipedia.org/wiki/RSA_(cryptosystem) What exactly that means? It means that on a structural level your files have been transformed. You won't be able to use, read, see or work with them anymore. In other words they are useless, however, there is a possibility to restore them with our help. What exactly happened to your files? *** Two personal RSA4096 keys were generated for your PC/Laptop; one key is public, another key is private. *** All your data and files were encrypted by the means of the public key, which you received over the web. *** In order to decrypt your data and gain access to your computer you need a private key and a decryption software, which can be found on one of our secret servers. What should you do next? There are several options for you to consider: 1. You can wait for a while until the price of a private key will raise, so you will have to pay twice as much to access your files or 2. You can start getting BitCoins right now and get access to your data quite fast. In case you have valuable files, we advise you to act fast as there is no other option rather than paying in order to get back your data. In order to obtain specific instructions, please access your personal homepage by choosing one of the few addresses down below: http://uhufnlsad7bhf4ykqfbevmxergwrth.himfinn.com/BC5B6AE34130BDBE http://94dbhbj3l4blaeyfgl7q45glbaer.giponfeste.at/BC5B6AE34130BDBE http://h5nuwefkuh134ljngkasdbasfg.corolbugan.com/BC5B6AE34130BDBE If you can't access your personal homepage or the addresses are not working, complete the following steps: 1 Download TOR Browser - http://www.torproject.org/projects/torbrowser.html.en 2 Install TOR Browser 3 Open TOR Browser 4 Insert the following link in the address bar: k7tlx3ghr3m4n2tu.onion/BC5B6AE34130BDBE 5 Follow the steps on your screen IMPORTANT INFORMATION Your personal homepages: http://uhufnlsad7bhf4ykqfbevmxergwrth.himfinn.com/BC5B6AE34130BDBE http://94dbhbj3l4blaeyfgl7q45glbaer.giponfeste.at/BC5B6AE34130BDBE http://h5nuwefkuh134ljngkasdbasfg.corolbugan.com/BC5B6AE34130BDBE Your personal page Tor-Browser k7tlx3ghr3m4n2tu.onion/BC5B6AE34130BDBE Your personal identification ID: BC5B6AE34130BDBE
URLs

http://uhufnlsad7bhf4ykqfbevmxergwrth.himfinn.com/BC5B6AE34130BDBE

http://94dbhbj3l4blaeyfgl7q45glbaer.giponfeste.at/BC5B6AE34130BDBE

http://h5nuwefkuh134ljngkasdbasfg.corolbugan.com/BC5B6AE34130BDBE

http://k7tlx3ghr3m4n2tu.onion/BC5B6AE34130BDBE

Targets

    • Target

      VirusShare_6b3f01729d9f544a9ade26bdda98041f

    • Size

      316KB

    • MD5

      6b3f01729d9f544a9ade26bdda98041f

    • SHA1

      3d503f0a596f577e410c05cf1b314dd61424e560

    • SHA256

      0658c6bbf1a37ec892996e2adc76ef0fb39c9e4dc197d05cf523748d56bf934e

    • SHA512

      6cc5c368b083394c726e8c24134fdc797efa7a215c15e01e7fcb36a5c7c5d897ac2672bf774043429001e5e19cf328aff56e1523042f38611e2a161e0f974914

    • SSDEEP

      6144:uRcNUBOfj1ANLQQ2ij56Nxvc78DgDDXxuRPS9kSdY0z7:l6Ie1QQVj54xC8cHXxuJUkGY

    • Deletes shadow copies

      Ransomware often targets backup files to inhibit system recovery.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Drops startup file

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Adds Run key to start application

MITRE ATT&CK Enterprise v15

Tasks