Resubmissions

13-08-2024 05:39

240813-gcg68swhqg 10

28-05-2021 06:53

210528-9sn3jdwaa2 10

General

  • Target

    e1c46a96effc5df063cea2fae83306ae1f0e2f898b0d2ada86c48052be5fe8d3.bin

  • Size

    290KB

  • Sample

    240813-gcg68swhqg

  • MD5

    a6dcf23059f6e61fa683907c47baf73e

  • SHA1

    1d55396b26d97b18256513607dcbe3f308569d5b

  • SHA256

    e1c46a96effc5df063cea2fae83306ae1f0e2f898b0d2ada86c48052be5fe8d3

  • SHA512

    72ef9997b814807e677e7861a94de3c8c2b7cb350ab79c887de61f505f23ebc2e3db177b34e86f1dedb3017f468e5c6c0f34d188c574e4cbe20410ff1bf596f7

  • SSDEEP

    6144:a7QOomfMNffeRQHO1l+E9eWGktbD3xEKHb6Em:aVomfwfahxND3xEKHbH

Malware Config

Extracted

Path

C:\Users\Admin\Desktop\RESTORE_FILES_INFO.txt

Family

prometheus

Ransom Note
YOUR COMPANY NETWORK HAS BEEN HACKED All your important files have been encrypted! Your files are safe! Only modified.(AES) No software available on internet can help you. We are the only ones able to decrypt your files. -------------------------------------------------------------------------------- We also gathered highly confidential/personal data. These data are currently stored on a private server. Files are also encrypted and stored securely. -------------------------------------------------------------------------------- As a result of working with us, you will receive: Fully automatic decryptor, all your data will be recovered within a few hours after it's run. Server with your data will be immediately destroyed after your payment. Save time and continue working. You will can send us 2-3 non-important files and we will decrypt it for free to prove we are able to give your files back. -------------------------------------------------------------------------------- !!!!!!!!!!!!!!!!!!!!!!!! If you decide not to work with us: All data on your computers will remain encrypted forever. YOUR DATA ON OUR SERVER AND WE WILL RELEASE YOUR DATA TO PUBLIC OR RE-SELLER! So you can expect your data to be publicly available in the near future.. The price will increase over time. !!!!!!!!!!!!!!!!!!!!!!!!! -------------------------------------------------------------------------------- It doesn't matter to us what you choose. We only seek money and our goal is not to damage your reputation or prevent your business from running. Write to us now and we will provide the best prices. Instructions for contacting us: 1. Type the addres "https://www.torproject.org" in your Internet browser. It opens the Tor site. 2. Press "Download Tor", then press "Download Tor Browser Bundle", install it. 3. Open the Tor browser. Copy the link http://promethw27cbrcot.onion/ticket.php?track=AA4-MX4-GGQD and paste it in the Tor browser. 7. Start a chat and follow the further instructions. Attention! Any attempt to restore your files with third-party software will corrupt it. Modify or rename files will result in a loose of data. If you decide to try anyway, make copies before that Key Identifier: KvQGNEpYXs7pYI+Eu/95FmsXHPCzzuIQIunF3/BXQAXcDz+HBomGisx3+fbWMI7Kaa6qJgRgTOEmjOdsh04nLNMIuaLIzrOc/912cvprD2rzuIsTxGeJUW9d9ZfhIJHEt98YL86SyXnizs5DWrKXrRFzagv/VnewMBejIYiFvtvwJQITuJmhIn+ZEdw6gsIUGpiC7J3NAyYix/rNQ2HcOO6kk49ognIZ9mDFW2VTelFRnvohNdo9drH+b6E/QgPtWpEXarINlqIVBIih8jqhwusD4YKN1Kn8vQpTDX83ucK/oGS07HD8BMEBJ0yVJVPuN863c48wVWVsGvMzf2YvM8Fi1iGjq8p+OS3XsJuyI9nYuZUvjqhWsjMqJnLfroMqkhmBmsIzdVbvyWDt7TX2p+qzHnYFdAAeVFwdHXmGFOUpxcJ0dYzIiIXXbvuCUL5/aUbpI3baZiB9wXb4QybsGkcLGfHwh+wMgbAqRQsaBiVMMEw038oWiqnlb0nRXNMs8FcMZCpfX59Am+6kSrIq5rWh0oustCJ38FAPVvc/yUA3R6GfTZkqppRvKubHciDj3GVOPhL0lqePstf0k1qYYIwm22850GpGx6LXuVlTytAeoH8agidUSK7So73E7Imp9GVWuHd4F9j8/elZvICapco1wk6JhovRnn1IbWROnaw=
URLs

http://promethw27cbrcot.onion/ticket.php?track=AA4-MX4-GGQD

Extracted

Path

C:\Users\Admin\Desktop\RESTORE_FILES_INFO.hta

Family

prometheus

Ransom Note
YOUR COMPANY NETWORK HAS BEEN HACKED All your important files have been encrypted! Your files are safe! Only modified.(AES) No software available on internet can help you. We are the only ones able to decrypt your files. We also gathered highly confidential/personal data. These data are currently stored on a private server. Files are also encrypted and stored securely. As a result of working with us, you will receive: Fully automatic decryptor, all your data will be recovered within a few hours after it’s installation. Server with your data will be immediately destroyed after your payment. Save time and continue working. You will can send us 2-3 non-important files and we will decrypt it for free to prove we are able to give your files back. If you decide not to work with us: All data on your computers will remain encrypted forever. YOUR DATA ON OUR SERVER AND WE WILL RELEASE YOUR DATA TO PUBLIC OR RE-SELLER! So you can expect your data to be publicly available in the near future.. The price will increase over time. It doesn't matter to us what you choose. We only seek money and our goal is not to damage your reputation or prevent your business from running. Write to us now and we will provide the best prices. Instructions for contacting us: 1. Type the addres "https://www.torproject.org" in your Internet browser. It opens the Tor site. 2. Press "Download Tor", then press "Download Tor Browser Bundle", install it. 3. Open the Tor browser. Copy the link http://promethw27cbrcot.onion/ticket.php?track=AA4-MX4-GGQD and paste it in the Tor browser. 7. Start a chat and follow the further instructions. Attention! Any attempt to restore your files with third-party software will corrupt it. Modify or rename files will result in a loose of data. If you decide to try anyway, make copies before that Key Identifier: KvQGNEpYXs7pYI+Eu/95FmsXHPCzzuIQIunF3/BXQAXcDz+HBomGisx3+fbWMI7Kaa6qJgRgTOEmjOdsh04nLNMIuaLIzrOc/912cvprD2rzuIsTxGeJUW9d9ZfhIJHEt98YL86SyXnizs5DWrKXrRFzagv/VnewMBejIYiFvtvwJQITuJmhIn+ZEdw6gsIUGpiC7J3NAyYix/rNQ2HcOO6kk49ognIZ9mDFW2VTelFRnvohNdo9drH+b6E/QgPtWpEXarINlqIVBIih8jqhwusD4YKN1Kn8vQpTDX83ucK/oGS07HD8BMEBJ0yVJVPuN863c48wVWVsGvMzf2YvM8Fi1iGjq8p+OS3XsJuyI9nYuZUvjqhWsjMqJnLfroMqkhmBmsIzdVbvyWDt7TX2p+qzHnYFdAAeVFwdHXmGFOUpxcJ0dYzIiIXXbvuCUL5/aUbpI3baZiB9wXb4QybsGkcLGfHwh+wMgbAqRQsaBiVMMEw038oWiqnlb0nRXNMs8FcMZCpfX59Am+6kSrIq5rWh0oustCJ38FAPVvc/yUA3R6GfTZkqppRvKubHciDj3GVOPhL0lqePstf0k1qYYIwm22850GpGx6LXuVlTytAeoH8agidUSK7So73E7Imp9GVWuHd4F9j8/elZvICapco1wk6JhovRnn1IbWROnaw=
URLs

http://promethw27cbrcot.onion/ticket.php?track=AA4-MX4-GGQD

Extracted

Path

C:\Users\Admin\Desktop\RESTORE_FILES_INFO.txt

Family

prometheus

Ransom Note
YOUR COMPANY NETWORK HAS BEEN HACKED All your important files have been encrypted! Your files are safe! Only modified.(AES) No software available on internet can help you. We are the only ones able to decrypt your files. -------------------------------------------------------------------------------- We also gathered highly confidential/personal data. These data are currently stored on a private server. Files are also encrypted and stored securely. -------------------------------------------------------------------------------- As a result of working with us, you will receive: Fully automatic decryptor, all your data will be recovered within a few hours after it's run. Server with your data will be immediately destroyed after your payment. Save time and continue working. You will can send us 2-3 non-important files and we will decrypt it for free to prove we are able to give your files back. -------------------------------------------------------------------------------- !!!!!!!!!!!!!!!!!!!!!!!! If you decide not to work with us: All data on your computers will remain encrypted forever. YOUR DATA ON OUR SERVER AND WE WILL RELEASE YOUR DATA TO PUBLIC OR RE-SELLER! So you can expect your data to be publicly available in the near future.. The price will increase over time. !!!!!!!!!!!!!!!!!!!!!!!!! -------------------------------------------------------------------------------- It doesn't matter to us what you choose. We only seek money and our goal is not to damage your reputation or prevent your business from running. Write to us now and we will provide the best prices. Instructions for contacting us: 1. Type the addres "https://www.torproject.org" in your Internet browser. It opens the Tor site. 2. Press "Download Tor", then press "Download Tor Browser Bundle", install it. 3. Open the Tor browser. Copy the link http://promethw27cbrcot.onion/ticket.php?track=AA4-MX4-GGQD and paste it in the Tor browser. 7. Start a chat and follow the further instructions. Attention! Any attempt to restore your files with third-party software will corrupt it. Modify or rename files will result in a loose of data. If you decide to try anyway, make copies before that Key Identifier: iT0Xih4WkikzWUO8GOxxljcu4KpWN8BYsdbbezAbPT5l1Szm4BmZZWQ5cR9RmxQ+5kCRvbrqxF7H7GqpOdriVpnxQVilm94xbqg8z8ufzJqI3Cue/rKkm/LYYrZ2Mzvy1MVZKPzOP8RnnkjkQNvaJE2l/8rIotr0+UvUjkTf2w2Rra1GIFy990YuSl3YVouRAzOROXpB46yBizdlNHp19izAWumTjuSWuuYT6IgDKroCrdwdQEbvtx0XD1sHAbmtrG2e7/x1ob6itaU2DwpsYbLkFgcLqlfw7ZC6wms+PU7h9Fq36UYnjyHaomRM5+ZeyE4f3vDC5AdZ/UcLv73qGd41t6eHaHp9UfoiwrGFpzG3HcSdDY1R7Z71K/4xHrsSDb0ij5FL0EA6yCjQh4X44HiMXGKUIwOCvotXHBrVbCMh6GW2gI75n+QFwmktIn0xuc//EFvXLZ7LOlymT8Zar1HxQYl8+cQ39a+5etCTaY1GMsoSSpfBWHpBPdk0J+eUjsiC/sJPJ5lT9MIhW/NSY9K/vmDwOKsz0AwEo6Au9SJ0TUs/0MyO1tUE6dhDCif5GHeGQnzeBsQ9CQ5Y9EHrlC2tJrm3HWQa2hH6R2CF/czg/8FUitbwFj1kfxMoLmaITlKva8FtLSd82Ce689yPFwnm4240bNFO26aYjh/sSNE=
URLs

http://promethw27cbrcot.onion/ticket.php?track=AA4-MX4-GGQD

Extracted

Path

C:\Users\Admin\Desktop\RESTORE_FILES_INFO.hta

Family

prometheus

Ransom Note
YOUR COMPANY NETWORK HAS BEEN HACKED All your important files have been encrypted! Your files are safe! Only modified.(AES) No software available on internet can help you. We are the only ones able to decrypt your files. We also gathered highly confidential/personal data. These data are currently stored on a private server. Files are also encrypted and stored securely. As a result of working with us, you will receive: Fully automatic decryptor, all your data will be recovered within a few hours after it’s installation. Server with your data will be immediately destroyed after your payment. Save time and continue working. You will can send us 2-3 non-important files and we will decrypt it for free to prove we are able to give your files back. If you decide not to work with us: All data on your computers will remain encrypted forever. YOUR DATA ON OUR SERVER AND WE WILL RELEASE YOUR DATA TO PUBLIC OR RE-SELLER! So you can expect your data to be publicly available in the near future.. The price will increase over time. It doesn't matter to us what you choose. We only seek money and our goal is not to damage your reputation or prevent your business from running. Write to us now and we will provide the best prices. Instructions for contacting us: 1. Type the addres "https://www.torproject.org" in your Internet browser. It opens the Tor site. 2. Press "Download Tor", then press "Download Tor Browser Bundle", install it. 3. Open the Tor browser. Copy the link http://promethw27cbrcot.onion/ticket.php?track=AA4-MX4-GGQD and paste it in the Tor browser. 7. Start a chat and follow the further instructions. Attention! Any attempt to restore your files with third-party software will corrupt it. Modify or rename files will result in a loose of data. If you decide to try anyway, make copies before that Key Identifier: iT0Xih4WkikzWUO8GOxxljcu4KpWN8BYsdbbezAbPT5l1Szm4BmZZWQ5cR9RmxQ+5kCRvbrqxF7H7GqpOdriVpnxQVilm94xbqg8z8ufzJqI3Cue/rKkm/LYYrZ2Mzvy1MVZKPzOP8RnnkjkQNvaJE2l/8rIotr0+UvUjkTf2w2Rra1GIFy990YuSl3YVouRAzOROXpB46yBizdlNHp19izAWumTjuSWuuYT6IgDKroCrdwdQEbvtx0XD1sHAbmtrG2e7/x1ob6itaU2DwpsYbLkFgcLqlfw7ZC6wms+PU7h9Fq36UYnjyHaomRM5+ZeyE4f3vDC5AdZ/UcLv73qGd41t6eHaHp9UfoiwrGFpzG3HcSdDY1R7Z71K/4xHrsSDb0ij5FL0EA6yCjQh4X44HiMXGKUIwOCvotXHBrVbCMh6GW2gI75n+QFwmktIn0xuc//EFvXLZ7LOlymT8Zar1HxQYl8+cQ39a+5etCTaY1GMsoSSpfBWHpBPdk0J+eUjsiC/sJPJ5lT9MIhW/NSY9K/vmDwOKsz0AwEo6Au9SJ0TUs/0MyO1tUE6dhDCif5GHeGQnzeBsQ9CQ5Y9EHrlC2tJrm3HWQa2hH6R2CF/czg/8FUitbwFj1kfxMoLmaITlKva8FtLSd82Ce689yPFwnm4240bNFO26aYjh/sSNE=
URLs

http://promethw27cbrcot.onion/ticket.php?track=AA4-MX4-GGQD

Targets

    • Target

      e1c46a96effc5df063cea2fae83306ae1f0e2f898b0d2ada86c48052be5fe8d3.bin

    • Size

      290KB

    • MD5

      a6dcf23059f6e61fa683907c47baf73e

    • SHA1

      1d55396b26d97b18256513607dcbe3f308569d5b

    • SHA256

      e1c46a96effc5df063cea2fae83306ae1f0e2f898b0d2ada86c48052be5fe8d3

    • SHA512

      72ef9997b814807e677e7861a94de3c8c2b7cb350ab79c887de61f505f23ebc2e3db177b34e86f1dedb3017f468e5c6c0f34d188c574e4cbe20410ff1bf596f7

    • SSDEEP

      6144:a7QOomfMNffeRQHO1l+E9eWGktbD3xEKHb6Em:aVomfwfahxND3xEKHbH

    • Disables service(s)

    • Prometheus Ransomware

      Ransomware family mostly targeting manufacturing industry and claims to be affiliated with REvil.

    • Renames multiple (200) files with added filename extension

      This suggests ransomware activity of encrypting all the files on the system.

    • Modifies Windows Firewall

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Drops startup file

    • Modifies file permissions

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Modifies WinLogon

    • Network Service Discovery

      Attempt to gather information on host's network.

MITRE ATT&CK Enterprise v15

Tasks