Overview

overview

10

Static

static

3

ef2c7563ee...0N.exe

windows7-x64

10

ef2c7563ee...0N.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    ef2c7563ee9134a397f8537a865d8510N.exe

  • Size

    402KB

  • Sample

    240825-erphrawcmm

  • MD5

    ef2c7563ee9134a397f8537a865d8510

  • SHA1

    b078bed7a6b255809b5cb0e04262b7adbd0fdf2b

  • SHA256

    c6c5adf201acff226226adc01cbffecbafdcb2bc2e7e059628a37d8eaa1b90c8

  • SHA512

    18adcd69ea119d45d266a4bbfe61278e0c6b461426899da43e6c400af5716fc8f7e05c2be1b027c753eee47302fa7f1328a64aaf0e344f1596dcbccea199eaf6

  • SSDEEP

    6144:iqye+d6+Dy91aq9VvyGsmt6TozPMwH6FuDbZ226NGWwHl2FvBxm7ciz4D7:ce+dbU1xy/m0TW/Nl36Cl2vW7c/7

Score
10/10
defense_evasiondiscoveryexecutionimpactpersistenceransomwarespywarestealer

Malware Config

Extracted

Path

C:\MSOCache\All Users\{90140000-0019-0409-0000-0000000FF1CE}-C\-!RecOveR!-wchpo++.Txt

Ransom Note
NOT YOUR LANGUAGE? USE https://translate.google.com 9-"068, 037+5?05*0'-4(-(+3',6=1 ------- 9-"068, 037+5?05*0'-4(-(+3',6=1 What's the matter with your files? Your data was secured using a strong encryption with RSA-4096. Use the link down below to find additional information on the encryption keys using RSA-4096 https://en.wikipedia.org/wiki/RSA_(cryptosystem) What exactly that means? 9-"068, 037+5?05*0'-4(-(+3',6=1 ------- 9-"068, 037+5?05*0'-4(-(+3',6=1 It means that on a structural level your files have been transformed . You won't be able to use , read , see or work with them anymore . In other words they are useless , however , there is possibility to restore them with our help . 9-"068, 037+5?05*0'-4(-(+3',6=1 ----- 9-"068, 037+5?05*0'-4(-(+3',6=1 What exactly happened to your files ??? !!! Two personal RSA-4096 keys were generated for your PC/Laptop; one key is public, another key is private. !!! All your data and files were encrypted by the means of the public key , which you received over the web . !!! In order to decrypt your data and gain access to your computer you need a private key and a decryption software, which can be found on one of our secret servers. !!! What should you do next ??? 9-"068, 037+5?05*0'-4(-(+3',6=1 ----- 9-"068, 037+5?05*0'-4(-(+3',6=1 In case you have valuable files , we advise you to act fast as there is no other option rather than paying in order to get back your data. In order to obtain specific instructions , please access your personal homepage by choosing one of the few addresses down below : http://k234s.ascotsprue.com/86192620B68B19A6 http://ik4dm.mazerunci.at/86192620B68B19A6 http://y4bxj.adozeuds.com/86192620B68B19A6 9-"068, 037+5?05*0'-4(-(+3',6=1 ----- 9-"068, 037+5?05*0'-4(-(+3',6=1 If you can't access your personal homepage or the addresses are not working, complete the following steps: *** Download and Install TOR Browser - http://www.torproject.org/projects/torbrowser.html.en *** Run TOR Browser enter in the address bar yyhn7fpvq44cqcu3.onion/86192620B68B19A6 9-"068, 037+5?05*0'-4(-(+3',6=1----IMPORTANT INFORMATION---------9-"068, 037+5?05*0'-4(-(+3',6=1 Your personal homepages http://k234s.ascotsprue.com/86192620B68B19A6 http://ik4dm.mazerunci.at/86192620B68B19A6 http://y4bxj.adozeuds.com/86192620B68B19A6 Your personal homepage Tor-Browser yyhn7fpvq44cqcu3.onion/86192620B68B19A6 Your personal ID 86192620B68B19A6 9-"068, 037+5?05*0'-4(-(+3',6=1 ----- 9-"068, 037+5?05*0'-4(-(+3',6=1
URLs

http://k234s.ascotsprue.com/86192620B68B19A6

http://ik4dm.mazerunci.at/86192620B68B19A6

http://y4bxj.adozeuds.com/86192620B68B19A6

http://yyhn7fpvq44cqcu3.onion/86192620B68B19A6

Extracted

Path

C:\Program Files\Common Files\DESIGNER\-!RecOveR!-aerla++.Txt

Ransom Note
NOT YOUR LANGUAGE? USE https://translate.google.com +1+49*:847614.5)'.84(,/13'7=/1& ------- +1+49*:847614.5)'.84(,/13'7=/1& What's the matter with your files? Your data was secured using a strong encryption with RSA-4096. Use the link down below to find additional information on the encryption keys using RSA-4096 https://en.wikipedia.org/wiki/RSA_(cryptosystem) What exactly that means? +1+49*:847614.5)'.84(,/13'7=/1& ------- +1+49*:847614.5)'.84(,/13'7=/1& It means that on a structural level your files have been transformed . You won't be able to use , read , see or work with them anymore . In other words they are useless , however , there is possibility to restore them with our help . +1+49*:847614.5)'.84(,/13'7=/1& ----- +1+49*:847614.5)'.84(,/13'7=/1& What exactly happened to your files ??? !!! Two personal RSA-4096 keys were generated for your PC/Laptop; one key is public, another key is private. !!! All your data and files were encrypted by the means of the public key , which you received over the web . !!! In order to decrypt your data and gain access to your computer you need a private key and a decryption software, which can be found on one of our secret servers. !!! What should you do next ??? +1+49*:847614.5)'.84(,/13'7=/1& ----- +1+49*:847614.5)'.84(,/13'7=/1& In case you have valuable files , we advise you to act fast as there is no other option rather than paying in order to get back your data. In order to obtain specific instructions , please access your personal homepage by choosing one of the few addresses down below : http://k234s.ascotsprue.com/55A55E213623D44 http://ik4dm.mazerunci.at/55A55E213623D44 http://y4bxj.adozeuds.com/55A55E213623D44 +1+49*:847614.5)'.84(,/13'7=/1& ----- +1+49*:847614.5)'.84(,/13'7=/1& If you can't access your personal homepage or the addresses are not working, complete the following steps: *** Download and Install TOR Browser - http://www.torproject.org/projects/torbrowser.html.en *** Run TOR Browser enter in the address bar yyhn7fpvq44cqcu3.onion/55A55E213623D44 +1+49*:847614.5)'.84(,/13'7=/1&----IMPORTANT INFORMATION---------+1+49*:847614.5)'.84(,/13'7=/1& Your personal homepages http://k234s.ascotsprue.com/55A55E213623D44 http://ik4dm.mazerunci.at/55A55E213623D44 http://y4bxj.adozeuds.com/55A55E213623D44 Your personal homepage Tor-Browser yyhn7fpvq44cqcu3.onion/55A55E213623D44 Your personal ID 55A55E213623D44 +1+49*:847614.5)'.84(,/13'7=/1& ----- +1+49*:847614.5)'.84(,/13'7=/1&
URLs

http://k234s.ascotsprue.com/55A55E213623D44

http://ik4dm.mazerunci.at/55A55E213623D44

http://y4bxj.adozeuds.com/55A55E213623D44

http://yyhn7fpvq44cqcu3.onion/55A55E213623D44

Targets

    • Target

      ef2c7563ee9134a397f8537a865d8510N.exe

    • Size

      402KB

    • MD5

      ef2c7563ee9134a397f8537a865d8510

    • SHA1

      b078bed7a6b255809b5cb0e04262b7adbd0fdf2b

    • SHA256

      c6c5adf201acff226226adc01cbffecbafdcb2bc2e7e059628a37d8eaa1b90c8

    • SHA512

      18adcd69ea119d45d266a4bbfe61278e0c6b461426899da43e6c400af5716fc8f7e05c2be1b027c753eee47302fa7f1328a64aaf0e344f1596dcbccea199eaf6

    • SSDEEP

      6144:iqye+d6+Dy91aq9VvyGsmt6TozPMwH6FuDbZ226NGWwHl2FvBxm7ciz4D7:ce+dbU1xy/m0TW/Nl36Cl2vW7c/7

    Score
    10/10
    defense_evasiondiscoveryexecutionimpactpersistenceransomwarespywarestealer

    • Deletes shadow copies

      Ransomware often targets backup files to inhibit system recovery.

      ransomwaredefense_evasionimpactexecution

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Drops startup file

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Adds Run key to start application

      persistence

    • Indicator Removal: File Deletion

      Adversaries may delete files left behind by the actions of their intrusion activity.

      defense_evasion
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Windows Management Instrumentation

1
T1047

Persistence

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Defense Evasion

Indicator Removal

2
T1070

File Deletion

2
T1070.004

Modify Registry

4
T1112

Subvert Trust Controls

1
T1553

Install Root Certificate

1
T1553.004

Credential Access

Unsecured Credentials

1
T1552

Credentials In Files

1
T1552.001

Discovery

Browser Information Discovery

1
T1217

Query Registry

2
T1012

System Information Discovery

3
T1082

System Location Discovery

1
T1614

System Language Discovery

1
T1614.001

Lateral Movement

Collection

Data from Local System

1
T1005

Command and Control

Exfiltration

Impact

Inhibit System Recovery

1
T1490

Tasks