Overview

overview

10

Static

static

3

396a2f2dd0...a6.exe

windows10-1703-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    396a2f2dd09c936e93d250e8467ac7a9c0a923ea7f9a395e63c375b877a399a6.7z

  • Size

    40KB

  • Sample

    240724-tmxqwsxgmf

  • MD5

    e759f2d19398b92884077b2d129ab438

  • SHA1

    a37e70114c377e5dbe6d416fd0519d294f91e0b7

  • SHA256

    2a47c744beb133ee41748754b3820606974c14d9dacb382d40d167676b547f7c

  • SHA512

    ca385cc64cb9409d4105d27afd9080bd4501cd7d1339b10528fd5a3904938a770912b5031f08a6d4167e3b3642e695e7583c0f4c922a4ab9b581759c4ec752af

  • SSDEEP

    768:eupEHCVeS3bksdOyc6dX1kW6B2PDij7H4Z3q7Bd:eE/NfX1kW0UD47pP

Score
10/10
phoboscredential_accessdefense_evasiondiscoveryevasionexecutionimpactpersistenceprivilege_escalationransomwarespywarestealer

Malware Config

Extracted

Path

C:\info.hta

Ransom Note
<!DOCTYPE HTML PUBLIC '-//W3C//DTD HTML 4.01//EN' 'http://www.w3.org/TR/html4/strict.dtd'> <html> <head> <meta charset='windows-1251'> <title>deepindeep</title> <HTA:APPLICATION ICON='msiexec.exe' SINGLEINSTANCE='yes' SysMenu="no"> <script language='JScript'> window.moveTo(50, 50); window.resizeTo(screen.width - 100, screen.height - 100); </script> <style type='text/css'> body { font: 15px Tahoma, sans-serif; margin: 10px; line-height: 25px; background: #C6B5C4; } img { display:inline-block; } .bold { font-weight: bold; } .mark { background: #B5CC8E; padding: 2px 5px; } .header { text-align: center; font-size: 30px; line-height: 50px; font-weight: bold; margin-bottom:20px; } .info { background: #e6ecf2; border-left: 10px solid #B58CB2; } .alert { background: #FFE4E4; border-left: 10px solid #FFA07A; } .private { border: 1px dashed #000; background: #FFFFEF; } .note { height: auto; padding-bottom: 1px; margin: 15px 0; } .note .title { font-weight: bold; text-indent: 10px; height: 30px; line-height: 30px; padding-top: 10px; } .note .mark { background: #B5CC8E; } .note ul { margin-top: 0; } .note pre { margin-left: 15px; line-height: 13px; font-size: 13px; } .footer { position:fixed; bottom:0; right:0; text-align: right; } </style> </head> <body> <div class='header'> <img src='data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAEAAAABACAQAAAAAYLlVAAAABGdBTUEAALGPC/xhBQAAACBjSFJNAAB6JQAAgIMAAPn/AACA6QAAdTAAAOpgAAA6mAAAF2+SX8VGAAAAAmJLR0QA/4ePzL8AAAAJcEhZcwAACxMAAAsTAQCanBgAAAAHdElNRQfjAwwMJwSFwIn8AAADNklEQVRo3u2ZTUhUURTHfzozmprmZ1pYEmkfJNEmiwwkSEyFECIQpEUboYhqFYHQXlcti9rUKldWBEUiuQpbtDDNzD5G8qM0HRXLRtO5LdJx3puPd++8+xyIztm88zgf/3veufeee18SdimDI1RxnL0U4gbAzxhDdPGCfpZs+49JWTTyFB8iAq8wTju1pDgXvopOliIGX+d57rHPieBuLvLNIvgaD1KvP/x1FiTDCwQTNOkFcJVfCuEFgq+c0he+minF8AJBH2WRnCUph8/nIZVhb2d5w1smEbjYSTn7SQ/TucsFlnWkPxBW6Xc4RkbIoHKooSNshsxRbT98Eb0mtyM04oqgmR6hUNvtrwrnWDa4nOVMVF0XLfw2aPuosBfezQPTmNpiVtFmnpj0W+wBKMFrcPeJ3RYWNfwwWHSSZgdAHX6Du5uWFpl0myqm1KiQrASgnNQQaZFOS4t5nhvkAnbZAbDHIE0wIGHzmsUQKdXkQwlACtsN8ijfJay8zBjkovgBbCLPlAG/hNUcswa5IH4Ayasdzxr5pBbWRRYMstGHYg04QAkH4FbQFSwTCKbdI7mzWVipbMceKtiCCFqO0OeY1caRbAaKOcgOCpQ+WWTyM8EwvfjkTfJoYZDFONqwaPyTHs7LbktlPNMYep2XuE22dfhsHjkS/i+3Wn/SK2EdoE72UeuyGH8rxbbLLjqlkRlb4TAzDo5fIJiOvRTnR+ju9VJuwveC/wASDsD+2h5KUyyQTVZiALzjFt3MsY16mtmqx2mt9BbUw4EQuzpGpVcCLQB8nDBZXmJFDoCeInzFS9ObxwzLmeoBMGA4/QBM4t1IAOHXDi7Zqwg9ACrCWotS8xnQWQCHOGsafzOFOhzLT8NxmoI3RZncULjG1ARA8DHYupxUucbUtxd4ghnw4JI30wdARHneMABx0j8FYD3xCkdefQByKFl9KsOjy6nKNBR0cZRCTjOk1JhrBCCY5r3pZtSS9bZkueSqmljVgPoPDa0Algk4HD8QG8AXph0G8Dk2AC89DgPosFKodvR83G/dtiRzTevtUChP0SCTpBQuM+bI6Bvk51gl96X/FFvzCh9oW0v+H2zO2tYtz/EgAAAAJXRFWHRkYXRlOmNyZWF0ZQAyMDE5LTAzLTEyVDEyOjM5OjA0KzAwOjAwG6lIYwAAACV0RVh0ZGF0ZTptb2RpZnkAMjAxOS0wMy0xMlQxMjozOTowNCswMDowMGr08N8AAAAASUVORK5CYII='> <div>!!! ATTENTION !!!</div> </div> <div class='bold'>Your network is hacked and files are encrypted. </div> <div class='bold'>Including the encrypted data we also downloaded other confidential information: data of your employees, customers, partners, as well as accounting and other internal documentation of your company.</div> <div class='note info'> <div class='title'>About Data</div> <ul>All data is stored until you will pay.<br/>After payment we will provide you the programs for decryption and we will delete your data <br/>We dont want did something bad to your company, it is just bussines (Our reputation is our money!) <br/>If you refuse to negotiate with us (for any reason) all your data will be put up for sale.</ul> </div> <div class='note info'> <div class='title'>What you will face if your data gets on the black market:</div> <ul> <li>The personal information of your employees and customers may be used to obtain a loan or purchases in online stores.</li> <li>You may be sued by clients of your company for leaking information that was confidential.</li> <li>After other hackers obtain personal data about your employees, social engineering will be applied to your company and subsequent attacks will only intensify.</li> <li>Bank details and passports can be used to create bank accounts and online wallets through which criminal money will be laundered.</li> <li>You will forever lose the reputation.</li> <li>You will be subject to huge fines from the government.</li><br/> You can learn more about liability for data loss here: <a href='https://en.wikipedia.org/wiki/General_Data_Protection_Regulation'>https://en.wikipedia.org/wiki/General_Data_Protection_Regulation</a>or here <a href='https://gdpr-info.eu'>https://gdpr-info.eu</a><br> Courts, fines and the inability to use important files will lead you to huge losses. The consequences of this will be irreversible for you.<br> Contacting the police will not save you from these consequences, and lost data, will only make your situation worse. </ul> </div> <div class='note info'> <div class='title'>How to contact us</div> <ul> <li>Write us to the mails: <span class='mark'>[email protected]</span></li> <li>Download the (Session) messenger <a href='https://getsession.org'>https://getsession.org</a> in messenger :ID"05947063ab6603c0e3a12db53d93d23634081c56390ff2084d11977820f78ce877"</li> <li>Write this ID in the title of your message <span class='mark'>3F3E1D17-3511</span></li><br> IF YOU WILL CONTACT US IN FIRST 6 hours , and we close our deal in 24 hours , PRICE WILL BE ONLY 30%.<br/> (time is money for both of us , if you will take care about our time , we will do same , we will care of price and decryption process will be done VERY FAST)<br/> ALL DOWNLOADED DATA WILL BE DELETED after payment. </ul> </div> <div class='note alert'> <div class='title'>What no to do and recomendation</div> <ul> You can get out of this situation with minimal losses (Our reputation is our money!) !!! To do this you must strictly observe the following rules: <li>DO NOT Modify, DO NOT rename, DO NOT copy, DO NOT move any files. Such actions may DAMAGE them and decryption will be impossible.</li> <li>DO NOT use any third party or public decryption software, it may also DAMAGE files.</li> <li>DO NOT Shutdown or Reboot the system this may DAMAGE files.</li> <li>DO NOT hire any third party negotiators (recovery/police, etc.) You need to contact us as soon as possible and start negotiations.</li><br/> You can send us 1-2 small data not value files for test , we will decrypt it and send it to you back.<br/> After payment we need no more that 2 hours to decrypt all of your data. We will be support you untill fully decryption going to be done! ! ! (Our reputation is our money!) </ul> </div> </body> </html>
Emails

class='mark'>[email protected]</span></li>

URLs

http://www.w3.org/TR/html4/strict.dtd'>

Extracted

Path

C:\Users\Admin\Desktop\info.txt

Ransom Note
!!! ATTENTION !!! Your network is hacked and files are encrypted. Including the encrypted data we also downloaded other confidential information: Data of your employees, customers, partners, as well as accounting and other internal documentation of your company. All data is stored until you will pay. After payment we will provide you the programs for decryption and we will delete your data We dont want did something bad to your company, it is just bussines (Our reputation is our money!) If you refuse to negotiate with us (for any reason) all your data will be put up for sale. What you will face if your data gets on the black market: 1) The personal information of your employees and customers may be used to obtain a loan or purchases in online stores. 2) You may be sued by clients of your company for leaking information that was confidential. 3) After other hackers obtain personal data about your employees, social engineering will be applied to your company and subsequent attacks will only intensify. 4) Bank details and passports can be used to create bank accounts and online wallets through which criminal money will be laundered. 5) You will forever lose the reputation. 6) You will be subject to huge fines from the government. You can learn more about liability for data loss here: https://en.wikipedia.org/wiki/General_Data_Protection_Regulation https://gdpr-info.eu/ Courts, fines and the inability to use important files will lead you to huge losses. The consequences of this will be irreversible for you. Contacting the police will not save you from these consequences, and lost data, will only make your situation worse. IF YOU WILL CONTACT US IN FIRST 6 hours , and we close our deal in 24 hours , PRICE WILL BE ONLY 30%. (time is money for both of us , if you will take care about our time , we will do same , we will care of price and decryption process will be done VERY FAST) ALL DOWNLOADED DATA WILL BE DELETED after payment. You can get out of this situation with minimal losses (Our reputation is our money!) !!! To do this you must strictly observe the following rules: DO NOT Modify, DO NOT rename, DO NOT copy, DO NOT move any files. Such actions may DAMAGE them and decryption will be impossible. DO NOT use any third party or public decryption software, it may also DAMAGE files. DO NOT Shutdown or Reboot the system this may DAMAGE files. DO NOT hire any third party negotiators (recovery/police, etc.) You need to contact us as soon as possible and start negotiations. You can send us 1-2 small data not value files for test , we will decrypt it and send it to you back. After payment we need no more that 2 hours to decrypt all of your data. We will be support you untill fully decryption going to be done! ! ! (Our reputation is our money!) Instructions for contacting our team: Download the (Session) messenger (https://getsession.org) in messenger 05947063ab6603c0e3a12db53d93d23634081c56390ff2084d11977820f78ce877 MAIL:[email protected]
Emails
URLs

https://gdpr-info.eu/

https://getsession.org

Targets

    • Target

      396a2f2dd09c936e93d250e8467ac7a9c0a923ea7f9a395e63c375b877a399a6.exe

    • Size

      61KB

    • MD5

      ca52ef8f80a99a01e97dc8cf7d3f5487

    • SHA1

      d4bf7b56d1f022e14a870d724e8da274288bc5db

    • SHA256

      396a2f2dd09c936e93d250e8467ac7a9c0a923ea7f9a395e63c375b877a399a6

    • SHA512

      06d2fa34d9972af950d166a67b39b987004deab1244206c96cbd3cdeb862758d482854ae4fa6b6472bbedb0601b64442c03ec863b3df8a64e9cf38a1c3a826bd

    • SSDEEP

      1536:1NeRBl5PT/rx1mzwRMSTdLpJ1BNl0+EAF+oV+Qp3U:1QRrmzwR5J/Na+Ee93U

    Score
    10/10
    phoboscredential_accessdefense_evasiondiscoveryevasionexecutionimpactpersistenceprivilege_escalationransomwarespywarestealer

    • Phobos

      Phobos ransomware appeared at the beginning of 2019.

      ransomwarephobos

    • Credentials from Password Stores: Credentials from Web Browsers

      Malicious Access or copy of Web Browser Credential store.

      credential_accessstealer

    • Deletes shadow copies

      Ransomware often targets backup files to inhibit system recovery.

      ransomwaredefense_evasionimpactexecution

    • Modifies boot configuration data using bcdedit

      ransomwareevasion

    • Renames multiple (434) files with added filename extension

      This suggests ransomware activity of encrypting all the files on the system.

      ransomware

    • Deletes backup catalog

      Uses wbadmin.exe to inhibit system recovery.

      ransomware

    • Modifies Windows Firewall

      evasion

    • Credentials from Password Stores: Windows Credential Manager

      Suspicious access to Credentials History.

      credential_accessstealer

    • Drops startup file

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Adds Run key to start application

      persistence

    • Drops desktop.ini file(s)

    behavioral1

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1
T1059

Windows Management Instrumentation

1
T1047

Persistence

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Create or Modify System Process

1
T1543

Windows Service

1
T1543.003

Event Triggered Execution

1
T1546

Netsh Helper DLL

1
T1546.007

Privilege Escalation

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Create or Modify System Process

1
T1543

Windows Service

1
T1543.003

Event Triggered Execution

1
T1546

Netsh Helper DLL

1
T1546.007

Defense Evasion

Direct Volume Access

1
T1006

Impair Defenses

1
T1562

Disable or Modify System Firewall

1
T1562.004

Indicator Removal

3
T1070

File Deletion

3
T1070.004

Modify Registry

1
T1112

Credential Access

Credentials from Password Stores

2
T1555

Credentials from Web Browsers

1
T1555.003

Windows Credential Manager

1
T1555.004

Unsecured Credentials

1
T1552

Credentials In Files

1
T1552.001

Discovery

Browser Information Discovery

1
T1217

Peripheral Device Discovery

1
T1120

Query Registry

2
T1012

System Information Discovery

2
T1082

System Location Discovery

1
T1614

System Language Discovery

1
T1614.001

Lateral Movement

Collection

Data from Local System

1
T1005

Command and Control

Exfiltration

Impact

Inhibit System Recovery

4
T1490

Tasks