Overview

overview

10

Static

static

7

2024-08-30...na.exe

windows7-x64

2024-08-30...na.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    2024-08-30_baaaf1539a72ab606ebdb8f3fc1b9e79_satana

  • Size

    144KB

  • Sample

    240830-sxwe5sscmn

  • MD5

    baaaf1539a72ab606ebdb8f3fc1b9e79

  • SHA1

    edcc94fcc1bb8c70e5ee2d558e22ba3af9350b88

  • SHA256

    cd2b9754497e4b364242705cc435703bc110e1631ff3ec3064f8d05e55e6b268

  • SHA512

    f260103ba23e4a6bd9b6b5ddcf84bf6a1f51d41dfb6624cc736e713443da1b860e4a21983c50d71e86004f936aa82b78df916a9a57434119d03ce8eccb5366ca

  • SSDEEP

    768:oebF010RFnAwJM7MiqwecUaX5h4IuCdYa+XLXTGY1idL2WYiwtwq6gTl7:oep010vnAOIUaJh4IXdWXLXTWLfuR

Score
10/10
satanabootkitdefense_evasiondiscoveryexecutionimpactpersistenceransomwarespywarestealerupx

Malware Config

Extracted

Path

C:\Users\Admin\AppData\Local\Temp\!satana!.txt

Ransom Note
You had bad luck.There was crypting of all your files in a FS bootkit virus <!SATANA!> To decrypt you need send on this E-mail: [email protected] your private code: A3D90235E1136671AB1195C6078184FF and pay on a Bitcoin Wallet: Xoq9wmiB1vbT7WAkGZWcgex544YGdC93Eb total 0,5 btc After that during 1 - 2 days the software will be sent to you - decryptor - and the necessary instructions. All changes in hardware configurations of your computer can make the decryption of your files absolutely impossible! Decryption of your files is possible only on your PC! Recovery is possible during 7 days, after which the program - decryptor - can not ask for the necessary signature from a public certificate server. Please contact via e-mail, which you can find as yet in the form of a text document in a folder with encrypted files, as well as in the name of all encrypted files.If you do not appreciate your files we recommend you format all your disks and reinstall the system. Read carefully this warning as it is no longer able to see at startup of the computer. We remind once again- it is all serious! Do not touch the configuration of your computer! E-mail: [email protected] - this is our mail CODE: A3D90235E1136671AB1195C6078184FF this is code; you must send BTC: Xoq9wmiB1vbT7WAkGZWcgex544YGdC93Eb here need to pay 0,5 bitcoins How to pay on the Bitcoin wallet you can easily find on the Internet. Enter your unlock code, obtained by E-mail here and press "ENTER" to continue the normal download on your computer. Good luck! May God help you! <!SATANA!>

Extracted

Path

C:\Users\Admin\AppData\Local\Temp\!satana!.txt

Ransom Note
You had bad luck.There was crypting of all your files in a FS bootkit virus <!SATANA!> To decrypt you need send on this E-mail: [email protected] your private code: 814D5E274548138B0F364FC84C110069 and pay on a Bitcoin Wallet: XckRGrfki7heuskuFavvh14wmRiaAucrPn total 0,5 btc After that during 1 - 2 days the software will be sent to you - decryptor - and the necessary instructions. All changes in hardware configurations of your computer can make the decryption of your files absolutely impossible! Decryption of your files is possible only on your PC! Recovery is possible during 7 days, after which the program - decryptor - can not ask for the necessary signature from a public certificate server. Please contact via e-mail, which you can find as yet in the form of a text document in a folder with encrypted files, as well as in the name of all encrypted files.If you do not appreciate your files we recommend you format all your disks and reinstall the system. Read carefully this warning as it is no longer able to see at startup of the computer. We remind once again- it is all serious! Do not touch the configuration of your computer! E-mail: [email protected] - this is our mail CODE: 814D5E274548138B0F364FC84C110069 this is code; you must send BTC: XckRGrfki7heuskuFavvh14wmRiaAucrPn here need to pay 0,5 bitcoins How to pay on the Bitcoin wallet you can easily find on the Internet. Enter your unlock code, obtained by E-mail here and press "ENTER" to continue the normal download on your computer. Good luck! May God help you! <!SATANA!>

Targets

    • Target

      2024-08-30_baaaf1539a72ab606ebdb8f3fc1b9e79_satana

    • Size

      144KB

    • MD5

      baaaf1539a72ab606ebdb8f3fc1b9e79

    • SHA1

      edcc94fcc1bb8c70e5ee2d558e22ba3af9350b88

    • SHA256

      cd2b9754497e4b364242705cc435703bc110e1631ff3ec3064f8d05e55e6b268

    • SHA512

      f260103ba23e4a6bd9b6b5ddcf84bf6a1f51d41dfb6624cc736e713443da1b860e4a21983c50d71e86004f936aa82b78df916a9a57434119d03ce8eccb5366ca

    • SSDEEP

      768:oebF010RFnAwJM7MiqwecUaX5h4IuCdYa+XLXTGY1idL2WYiwtwq6gTl7:oep010vnAOIUaJh4IXdWXLXTWLfuR

    Score
    10/10
    satanabootkitdefense_evasiondiscoveryexecutionimpactpersistenceransomwarespywarestealerupx

    • Satana

      Ransomware family which also encrypts the system's Master Boot Record (MBR).

      ransomwaresatana

    • Deletes shadow copies

      Ransomware often targets backup files to inhibit system recovery.

      ransomwaredefense_evasionimpactexecution

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Adds Run key to start application

      persistence

    • Writes to the Master Boot Record (MBR)

      Bootkits write to the MBR to gain persistence at a level below the operating system.

      bootkitpersistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Windows Management Instrumentation

1
T1047

Persistence

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Pre-OS Boot

1
T1542

Bootkit

1
T1542.003

Privilege Escalation

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Defense Evasion

Direct Volume Access

1
T1006

Indicator Removal

2
T1070

File Deletion

2
T1070.004

Modify Registry

1
T1112

Pre-OS Boot

1
T1542

Bootkit

1
T1542.003

Credential Access

Unsecured Credentials

1
T1552

Credentials In Files

1
T1552.001

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

System Location Discovery

1
T1614

System Language Discovery

1
T1614.001

Lateral Movement

Collection

Data from Local System

1
T1005

Command and Control

Exfiltration

Impact

Inhibit System Recovery

2
T1490

Tasks