General

  • Target

    scenario_472897___e7418389-a33e-42a7-8a6f-0c5d03e00962.exe

  • Size

    159KB

  • Sample

    240905-qx3hcasflb

  • MD5

    80f4a1d42e2d4205cedf96909091cf84

  • SHA1

    b9500d8a20ea3831f0843ca8636be11fef836625

  • SHA256

    9d41b2f7c07110fb855c62b5e7e330a597860916599e73dd3505694fd1bbe163

  • SHA512

    42168abc5f69ea35756fa71e1fd49c47b20b4111fc13e4593ae55f576e7f3d9d6583213547cbb01c245e7616b542ee160caa96022ca561eaf290db8818035fd3

  • SSDEEP

    3072:/V2UzNeZWtTsi2OHAXDCtY6cgtz45qS7IfJJoSl:NHReZETV2UAXDzb2icl

Malware Config

Extracted

Path

C:\Program Files\7-Zip\!!readme!!!.txt

Family

underground

Ransom Note
The Underground team welcomes you! We would like to inform that your network has been tested by us for vulnerabilities. Poor network security could cause your data to be lost forever, including backups. Your files are currently encrypted, but don't worry, they can be restored to their original state with a decryptor key that only we have. The key is in a single copy on our server. Attempting to recover data by your own efforts may result in data loss. It is important not to change their current state. Each file additionally has a unique cipher, which you can restore only with our help. DO NOT reboot or turn off storage media. If you do not contact us within 3 days, or we cannot reach an agreement, information about data leaks is bound to get into the media. Your company's reputation will be damaged. Sources of downloaded information: -company financial documents, password protected financial documents (passwords selected) -personal data on employees (passports, SSN's, ID's, W9-forms, payrolls, medical information, contracts of employment, drivers licenses) -personal information on directors -shareholder documents -insurance documents -documents and drawings marked confidential -NDA's and Confidentiality Undertaking -project documentation (project specifications, confidential drawings, contracts, customer correspondence, financial documents) -information and correspondence on classified projects (Project X, project Omaha, military projects) Total size of downloaded data about 500 GB. A data breach is a violation of the law and has serious legal and business ramifications. Personal data leakage is subject to: the EU's General Data Protection Regulation (GDPR), South Africa's Protection of Personal Information Act (POPIA), State Data Breach Notification Laws and State Privacy Legislation in the USA (including California Consumer Privacy Act, California Privacy Rights Act, Virginia Consumer Data Protection Act), other laws and regulations pertaining to the protection of confidential data. We value and respect every business, including yours. Therefore, we suggest you avoid further negative consequences and return to your work as soon as possible. We guarantee a fair and confidential deal in the shortest possible time. You will not only receive a decryptor, but also a description of your network vulnerabilitiŠ«es and information security recommendations. If necessary, you will be provided with qualified data recovery assistance. You can trust us! Reputation is important to everyone. As a proof of our statements, we are ready to restore some files for free and demonstrate how our product works. We can also provide you with a list of the files we have. Best regards, Underground team ! Contacts for communication via chat: login to your account (Tor Browser) http://ehehqyhw3iev2vfso4vqs7kcrzltfebe5vbimq62p2ja7pslczs3q6qd.onion/ your login: cochranesteel your password: 36CC711944AFE198B7E65159DC8612CE ID 11e45324k66n1lem2a234nz3kfbna1e4 cf983dad2db4f3b000586ca371cfcd4e
URLs

http://ehehqyhw3iev2vfso4vqs7kcrzltfebe5vbimq62p2ja7pslczs3q6qd.onion/

Targets

    • Target

      scenario_472897___e7418389-a33e-42a7-8a6f-0c5d03e00962.exe

    • Size

      159KB

    • MD5

      80f4a1d42e2d4205cedf96909091cf84

    • SHA1

      b9500d8a20ea3831f0843ca8636be11fef836625

    • SHA256

      9d41b2f7c07110fb855c62b5e7e330a597860916599e73dd3505694fd1bbe163

    • SHA512

      42168abc5f69ea35756fa71e1fd49c47b20b4111fc13e4593ae55f576e7f3d9d6583213547cbb01c245e7616b542ee160caa96022ca561eaf290db8818035fd3

    • SSDEEP

      3072:/V2UzNeZWtTsi2OHAXDCtY6cgtz45qS7IfJJoSl:NHReZETV2UAXDzb2icl

    • Underground Team

      Underground Team is a ransomware first seen in July 2023 that is primarily distriuted via exploting vulnerabilities.

    • Clears Windows event logs

    • Deletes shadow copies

      Ransomware often targets backup files to inhibit system recovery.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Drops desktop.ini file(s)

    • Power Settings

      powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.

MITRE ATT&CK Enterprise v15

Tasks