Resubmissions

20-10-2024 16:28

241020-tyzdvsxgqb 3

20-10-2024 16:26

241020-tx2gtszekk 3

02-10-2024 11:53

241002-n2j6fsycqb 3

13-09-2024 04:59

240913-fmwxpswcpb 3

11-09-2024 15:54

240911-tcmg6sygmm 3

11-09-2024 15:53

240911-tbsmsszbnh 10

25-08-2024 22:53

240825-2t6als1gll 10

24-08-2024 21:25

240824-z93hjsscrp 9

24-08-2024 21:20

240824-z65thazfpa 10

General

  • Target

    230823-139hyshd3w_pw_infected.zip

  • Size

    472KB

  • Sample

    240813-w8fqlszdla

  • MD5

    e3af7d1463d266e02cd03ea7a3add2e4

  • SHA1

    6456c0de00c86db5e7d061fbf7e19792d3dbbc4a

  • SHA256

    8ef176944e54df85db028979ceb66b2b6e807b1615f4254c273d4b433caec0dd

  • SHA512

    855e4ba5316a800113f6f410d37ba7e981c0f72bb23664c26e464777f2a0a96d8f651e77189af89e70be9d032a3a1b7b40b005bd60b9f6dc792c7588b3a8d9bb

  • SSDEEP

    12288:ABgmK1z0D2TuzS4cu2LH6WhBO8RiKrDmlPPoSdERZIhp4TWo3:2BKqSt4AH6Whc2fqPoSdEDRWo3

Malware Config

Extracted

Path

F:\$RECYCLE.BIN\S-1-5-21-945322488-2060912225-3527527000-1000\EHCFCIAM-MANUAL.txt

Family

gandcrab

Ransom Note
---= GANDCRAB V5.2 =--- ***********************UNDER NO CIRCUMSTANCES DO NOT DELETE THIS FILE, UNTIL ALL YOUR DATA IS RECOVERED*********************** *****FAILING TO DO SO, WILL RESULT IN YOUR SYSTEM CORRUPTION, IF THERE ARE DECRYPTION ERRORS***** Attention! All your files, documents, photos, databases and other important files are encrypted and have the extension: .EHCFCIAM The only method of recovering files is to purchase an unique private key. Only we can give you this key and only we can recover your files. The server with your key is in a closed network TOR. You can get there by the following ways: ---------------------------------------------------------------------------------------- | 0. Download Tor browser - https://www.torproject.org/ | 1. Install Tor browser | 2. Open Tor Browser | 3. Open link in TOR browser: http://gandcrabmfe6mnef.onion/4cc6e1232cba3060 | 4. Follow the instructions on this page ---------------------------------------------------------------------------------------- On our page you will see instructions on payment and get the opportunity to decrypt 1 file for free. ATTENTION! IN ORDER TO PREVENT DATA DAMAGE: * DO NOT MODIFY ENCRYPTED FILES * DO NOT CHANGE DATA BELOW ---BEGIN GANDCRAB KEY--- lAQAADIbIMk45OeSIMakyap/Sk0oDqLbytwMuBauhYntnCmDUg/tmlVcjC4blXlmkZEAiBgN6B2SW/L7XPpXrzSpaKbew26x1kGrEwLfH9vtNMePS1d16xAhndg8u7dJZYPUI1py31egItQmwuP/o3voxgRLf7R/UAyAfbgWoCnO6dJaTJNDkSkXsPtRMIXGpR3rhcEIl3ot/6+rcrihMOy/8Z2ZWYrZ1L267mQtahyn8HseENoiZjkEuz59JTdr71Afh9y1cPaUvJhqjAmJgRyCA/QaYOU5fFeHtHFdruOVI1R+ug+zyD1eea4KoxZhC6i93HqrGeRH49GDutrK2eOy9QnNm3K2P7TIQlABv/GOj4tDC6Q9QvJXtx1IryGqYccJRaXwOpK/s79fvjutHVzYa1VvaAzq/bkbUPMuu6rE0zCeFD49qmEf4Z+0+FWzIYbofv2mIWDYelfvA1imhuNqkK12Ch1kM/4AvTolYHvvC/6laFlIss2c/s4n8b2pewShhql3iUhI/0CcknqZf9noSUNQaeQYfDItdG2uS/ECB8XrJA16VQmWPKMaKPGgVO4NQjSWFYHAzgU53ETBJ/1j6MSqKBDWU5GMnXrHeXqWwNCayeqfrdD7f5Q3zM6jzTslSpeSUzFZ9VSPU06dykjWkwFEtCK09lRsb52aRue7agaXO/mt27jIlHRx9eM7kLJFCvM065lBvqmhgi5J+jDU0LUCPHv00d53kgXegxtYApMKaxDAnpAQfE5jfIcNvFbC8OTeKWSpHBrQYKDv/AL2oFLL2Uws0wIVpXE3szE3oLMYQD4b+TtQwwiK8TgnpzP/PObk1JpUgdw7Tfqo1Wp5oiTuJgi4B5EgkOOFIzUwrYT0DdGm8Tdnjim9Dt05+vf5iQgl9w/we3PE7nT1rb1+nqDS9VnuI5AguQG9tHNRYdTnzVh0SocJtP0RZolQr2KKuvlwvXYcxLytGnZyHbn3AtNsxjqe3YVoHzyQHSRDS9OXEsvuGaqnSAqydDNDiPHrgqShvew02lH/IVIyLSkaLnX/mnIxXxKS2OWBxjIotgGn2cFG2abaQ9h+i/rSEbBhasnLcZGllrwyp6WDK1xPOR2403MlkcSx6uxm0kDJO/VjX0X9ZtfnAXuX3ysJ5ofiGmiuYNszjnG5DQ9i9dn1f1g3tTdjOf6NEi6xhjVctlR0FZA4FOgeAZ8FpMaf8oofu0UK2AHon4RjGZ/VkeXDxctUOI48yMM1oc5rsGoVVrIWsyz7cekC1oSt8Batne9qkUuC5TkZoeNbSXqIE5b1iPvmz31iwTzOq1KcZIsxyswN7ivI5conxASxymEFNN0GTh++2k6pp1+oIEJynuySaXqR14OixHHq7eJnan4l8Bo30Zw/5aiulw8HNnHcRhNqM5VZNHcvWnfRKUN1R50FvhY+g41nbyscca5wDYUcPwrOzfcHM8a9D+E6TSUhFIKSiM07KrUu85ByTVLFiix7U+2s4IP7P+C0HbUCeOR95VDCBdxhXUdDDPCgIrNqGi1dxNSEgrJwTqNX1uqBS0s/kpClJRUqkVkMfXBb+YsGiQ+iv8w+C/dhL5KyYTrhWT8D12WXZT/JjFwHE6Va1b/iEl9ovrrKvtwHMuwXqyutfLrPMQU80BWiLfk4SMoJTRbWVlotIoRDyILmWd4uolD4EmW7YcIBgONgTUMPvDsqTCAXi2cm3iIgzDTnrOAxkHVckC8VvtuZ2Y4sxg/GXOfzsnMmAyboMb4G4rnZ3u20zZ/nW5aZ20CKHuo5PDysqf/6h9PpjJs/7Su1XDxugjyjn05CluzBMQOLtm/fbd9uICx9jjSyu1cbV90pda1VIz0yq56bU6GUSRR6EQihSz4EMenQbwvcPcx2iOg/PGVJ6ob+Is+s0vIKHOaY9yQLQ5N/THYgGAczBchFSXwwnyh6RoaO/SNzp2Rr5CaYaO0GvG6cImDAYdFt575G/YnvgISu4KahQ1jkP4FC4dydRMkJJGw0oni+84Zy3Qxw2drQcyzqgFY/wgxt7zEvh8ASQhYwrb2r5OTv6dRVvwA0PyyBLv39tJm+aSdTd+/+cC2X0UwPK0B+wMwl4ATpxrq/GsFlHLfF/J7VMfPa5lbi6wy4FpN0jhodX0J67oc2/W9/HKMG1BRA1K4kOStrWO8JCN2m305DKjN9tOxYQj8LURhpgs5vn7pGkLCsEJ2Kfp52pUJr9CpkUgbK9sjWuhSpCUM+BelYoyo= ---END GANDCRAB KEY--- ---BEGIN PC DATA--- 7ftDEgLb/ZS0lcmZbHM61KDJ6AOtD78KkA7absMgUXYxWLsC+5+UYF9xVmDr9MTJMZDIAvSVt+DSRWLIKnQXQzua3LPyzokSUuglaqKXwabsGM4pXku5In6gtMQMqg7sgEh1XW1iPMFgiUj/s1LdWpJHdiPjMpn7rCZNO/A31mak0K8RefoREu3BxtlAsseHWfVIIKN0U4NnA3w0Ga7XDLlF3iOIB6ImYbF6Z/7MBN2mgBr2rZ2gU1R7jNx2WKAyu4W+5zlHFnKwMISBi1CwemOo6FrxnP+Z5F9bSR7OvDBsmLj7oYD6GBgpBqj3RSAVfvfE0yZSXyCRtLeJedBeBndqqMZrR+G3M7HPmdaR30fSP4jy//NlLLLjWaP0r1BW4eYoT03JrPa/L0B0wffnS0ez96BFoTHFq52HPDCx6yhEudvoPVoM6iaVy+mvqAdvYbwBrtoypS8F1f+lXDmV7q14D+w/gT+wK0yub5gfz9wpLQCj3bimwDPi8jPeKPiggI2bWKz+7QkWvC2ihYFfEuZEsyM4ANvhxNQXIE31UkGbyf6MN51c1gY/++QRe2kEznTbCqfrOdcnPBOVfcolLq8b/gmccCeV7bCGEZisVbSQnNiaPkJ9b5I041HXc2vSx6IODB3F1IH8qANwhkbcxMPGvnUSm+rK ---END PC DATA---
URLs

http://gandcrabmfe6mnef.onion/4cc6e1232cba3060

Extracted

Path

C:\$Recycle.Bin\DECRYPT_YOUR_FILES.HTML

Ransom Note
<html> <head> <style> body{ background-color: #3366CC; } h1 { background-color: RGB(249, 201, 16); } p { background-color: maroon; color: white; } </style> </head> <body> <center> <h1><b> Attention ! All your files </b> have been encrypted. </h1></br> <p> Due encrypting was used algoritm RSA-4096 and AES-256, used for protection military secrets.</br> That means > RESTORE YOU DATA POSIBLE ONLY BUYING decryption passwords from us.</br> Getting a decryption of your files is - SIMPLY task.</br></br> That all what you need:</br> 1. Sent Your ID_KEY on mailbox [email protected] or [email protected] </br> 2. For test, decrypt 2 small files, to be sure that we can decrypt you files.</br> 3. Pay our services. </br> 4. GET software with passwords for decrypt you files.</br> 5. Make measures to prevent this type situations again.</br></br> IMPORTANT(1)</br> Do not try restore files without our help, this is useless, and can destroy you data permanetly.</br></br> IMPORTANT(2) </br> We Cant hold you decryption passwords forever. </br>ALL DECRYPTION PASSWORDS, for what wasn`t we receive reward, will destroy after week of moment of encryption. </p> <p> Your ID_KEY: <br> </p> <table width="1024" border="0"> <tbody> <tr> <td><p>UWQnF/xrN8hkbxWrf1YYuaYzuCU76cl1GScL2DblyJHcjLLEfIeZbkW/htAjDdruIvAFc4UlvQ++ww/Bp10WddIt45px0YexwUZM21vH0fOUErpSRIt9zbjQvj5fntme0p/Z01YLKbl65fb3WWYpkgYbfMLGMpEUBbK6pqnCsMzEckw1pnoPptcThCDPlqGCf/I3c8nSpIoCa9fGVx4v7couYjunaj6UYpEkNuTsDFCQ6SI9TNOF1xjjJPPBGFAU4ejsGNKKwDBwyqdjXig2MxX09jt0G8c/hS+Q/IPcavXdOsMZJyLs+kHI4Na+pjlVbGaCfUx75f3YVcEcvgkQBw==ZW4tVVM=</p></td> </tr> </tbody> </table> </center></html></body>

Extracted

Path

C:\Program Files\Common Files\microsoft shared\ink\es-MX\DECRYPT_YOUR_FILES.HTML

Ransom Note
<html> <head> <style> body{ background-color: #3366CC; } h1 { background-color: RGB(249, 201, 16); } p { background-color: maroon; color: white; } </style> </head> <body> <center> <h1><b> Attention ! All your files </b> have been encrypted. </h1></br> <p> Due encrypting was used algoritm RSA-4096 and AES-256, used for protection military secrets.</br> That means > RESTORE YOU DATA POSIBLE ONLY BUYING decryption passwords from us.</br> Getting a decryption of your files is - SIMPLY task.</br></br> That all what you need:</br> 1. Sent Your ID_KEY on mailbox [email protected] or [email protected] </br> 2. For test, decrypt 2 small files, to be sure that we can decrypt you files.</br> 3. Pay our services. </br> 4. GET software with passwords for decrypt you files.</br> 5. Make measures to prevent this type situations again.</br></br> IMPORTANT(1)</br> Do not try restore files without our help, this is useless, and can destroy you data permanetly.</br></br> IMPORTANT(2) </br> We Cant hold you decryption passwords forever. </br>ALL DECRYPTION PASSWORDS, for what wasn`t we receive reward, will destroy after week of moment of encryption. </p> <p> Your ID_KEY: <br> </p> <table width="1024" border="0"> <tbody> <tr> <td><p>arxzAMuzbHasR39kf/5scb5vnwI5qH64CaDIK4O6rDx26GW3Ly5BsScD+qj1yCEqMDdYaEkFDnZw20NtOqE2tb3vnP2kMdH6+8kBSD71DOehGJ5Vw8jyTEUYdG+eE7UQn0x7xlGykKoh5/v8ivY2AmQR4XkYz4GcCqxn+rckOR6nbOCost08mKzbn4Wh4bE4OAMHF5Z1vhwxupOEeD6eNtRxMl6qZqcRJ2cRR32Zf9cbHDqWYYbncVPL0ezjsKqDBw8HAMKHIA2ymO1/d9Dh+6+vW6P+rEbSyEo0sM9lyEYA8K0Pdh8PNMSYSDgozqKg//0f0r/LZCOEXfjy3gE92g==ZW4tVVM=</p></td> </tr> </tbody> </table> </center></html></body>

Extracted

Path

C:\Program Files\7-Zip\DECRYPT_YOUR_FILES.HTML

Ransom Note
<html> <head> <style> body{ background-color: #3366CC; } h1 { background-color: RGB(249, 201, 16); } p { background-color: maroon; color: white; } </style> </head> <body> <center> <h1><b> Attention ! All your files </b> have been encrypted. </h1></br> <p> Due encrypting was used algoritm RSA-4096 and AES-256, used for protection military secrets.</br> That means > RESTORE YOU DATA POSIBLE ONLY BUYING decryption passwords from us.</br> Getting a decryption of your files is - SIMPLY task.</br></br> That all what you need:</br> 1. Sent Your ID_KEY on mailbox [email protected] or [email protected] </br> 2. For test, decrypt 2 small files, to be sure that we can decrypt you files.</br> 3. Pay our services. </br> 4. GET software with passwords for decrypt you files.</br> 5. Make measures to prevent this type situations again.</br></br> IMPORTANT(1)</br> Do not try restore files without our help, this is useless, and can destroy you data permanetly.</br></br> IMPORTANT(2) </br> We Cant hold you decryption passwords forever. </br>ALL DECRYPTION PASSWORDS, for what wasn`t we receive reward, will destroy after week of moment of encryption. </p> <p> Your ID_KEY: <br> </p> <table width="1024" border="0"> <tbody> <tr> <td><p>ixb640mJ9mucFLTCD7Q/24ekwLYv980F3za3DW0wJ39P2psQ5DlZfY6qBu3yyn2nGzbgTHZtQh5s3O8c8sFDQ1aQu0jR9LrRBBYA7lgLeD/30DXxa7FfFcHMr8N6iRQaiRHV8Jw0iqBwfmf+XLlucdoo/sOsVkkWQJOSKFAeq47BbZnbOArQxeyj81iGLwL40mvkHHa2pPZmZ+pnusStId2gWKpfZPuuQHvXzhpBDDu9OSNDHZhmqKhjvy0+EkjzSymWBQyZaiadcb+bAqUV7baH94cJ8LBo+0zmobO0d2xWJm0DnHmfG0cDuZQbJ45Jw4g6EHC/8RggkjfQxImysQ==ZW4tVVM=</p></td> </tr> </tbody> </table> </center></html></body>

Extracted

Path

C:\Program Files\7-Zip\DECRYPT_YOUR_FILES.HTML

Ransom Note
<html> <head> <style> body{ background-color: #3366CC; } h1 { background-color: RGB(249, 201, 16); } p { background-color: maroon; color: white; } </style> </head> <body> <center> <h1><b> Attention ! All your files </b> have been encrypted. </h1></br> <p> Due encrypting was used algoritm RSA-4096 and AES-256, used for protection military secrets.</br> That means > RESTORE YOU DATA POSIBLE ONLY BUYING decryption passwords from us.</br> Getting a decryption of your files is - SIMPLY task.</br></br> That all what you need:</br> 1. Sent Your ID_KEY on mailbox [email protected] or [email protected] </br> 2. For test, decrypt 2 small files, to be sure that we can decrypt you files.</br> 3. Pay our services. </br> 4. GET software with passwords for decrypt you files.</br> 5. Make measures to prevent this type situations again.</br></br> IMPORTANT(1)</br> Do not try restore files without our help, this is useless, and can destroy you data permanetly.</br></br> IMPORTANT(2) </br> We Cant hold you decryption passwords forever. </br>ALL DECRYPTION PASSWORDS, for what wasn`t we receive reward, will destroy after week of moment of encryption. </p> <p> Your ID_KEY: <br> </p> <table width="1024" border="0"> <tbody> <tr> <td><p>fC6dMt49UyAZiJfH2WgSG8HLNrj03ZzND7SrTfutbqHMNlho/9fICtUDCzc7mBinRYUxG+cHmykcDZEMT7VNTOlKqHP7ztTGCMT/S7WqsTqgrqDcKglXKH/xVRC/jEPVR95n/6n/2nShz79v8UJQ9MgtkDnnt+rN3ZdYnZyNGqZruVLvBQ/dUPFdVr6u+ld/wC0MKOo3DxWd4bu8/AsiGyKaHaACOiHIt5tNAk6jlLW6cFcaR+EE/Uvs+uGtxiS8lgByOtEkyJVCsx3fBS+IcJkeQ+sSjEsh3Hmeklxtz4nRlO3dZ5WlyS7ldtRMp7Hku81MwmUD4vC7lRLjXIFm5g==ZW4tVVM=</p></td> </tr> </tbody> </table> </center></html></body>

Targets

    • Target

      dl2.exe

    • Size

      849KB

    • MD5

      c2055b7fbaa041d9f68b9d5df9b45edd

    • SHA1

      e4bd443bd4ce9029290dcd4bb47cb1a01f3b1b06

    • SHA256

      342f04c4720590c40d24078d46d9b19d8175565f0af460598171d58f5ffc48f3

    • SHA512

      18905b75938b8af9468b1aa3ffbae796a139c2762e623aa6ffb9ec2b293dd04aa1f90d1ed5a7dbda7853795a3688e368121a134c7f63e527a8e5e7679301a1dc

    • SSDEEP

      12288:A3RY3yNqMRTF4q2rxHn2ot/81xpNQyjUXlmoe7ufjHAtjXD7r2:A3RY3R24q+xn/8Xp2yOl5fzQ/2

    • Fantom

      Ransomware which hides encryption process behind fake Windows Update screen.

    • Gandcrab

      Gandcrab is a Trojan horse that encrypts files on a computer.

    • InfinityLock Ransomware

      Also known as InfinityCrypt. Based on the open-source HiddenTear ransomware.

    • Renames multiple (111) files with added filename extension

      This suggests ransomware activity of encrypting all the files on the system.

    • Disables Task Manager via registry modification

    • Downloads MZ/PE file

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Credentials from Password Stores: Windows Credential Manager

      Suspicious access to Credentials History.

    • Drops startup file

    • Executes dropped EXE

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Legitimate hosting services abused for malware hosting/C2

    • Sets desktop wallpaper using registry

MITRE ATT&CK Enterprise v15

Tasks