General

  • Target

    240905-q2rawasbmk_pw_infected.zip

  • Size

    79KB

  • Sample

    240907-g7v2kszbkc

  • MD5

    9cc178773e86c606e12fbbd950295dca

  • SHA1

    a360540c53a4a1e2670e59f76855b67ef2cb1e86

  • SHA256

    144604ab6cfd53bbccfe977952b48e17f49f2064bd512031a9ac15e0d7fc0140

  • SHA512

    368cf4a3cfb9983d38d08d0cf39736747f2ac46ea93c68863a4331b330bf167787edb38c983f1c498ab79e8f69db115bf91fe53d9dfd94325b4ab53f3616d922

  • SSDEEP

    1536:4L05J0eDZkThWotlFQpgaFrgFmAJzeto2IKAj2JNooj6hS:6gZkT7lsgaF8FmAJzV2RY2gthS

Malware Config

Extracted

Path

C:\Program Files\7-Zip\!!readme!!!.txt

Family

underground

Ransom Note
The Underground team welcomes you! We would like to inform that your network has been tested by us for vulnerabilities. Poor network security could cause your data to be lost forever. Your files are currently encrypted, they can be restored to their original state with a decryptor key that only we have. The key is in a single copy on our server. Attempting to recover data by your own efforts may result in data loss. It is important not to change their current state. Each file additionally has a unique cipher, which you can restore only with our help. We also examined your infrastructure and downloaded the most sensitive data. The partial list of hosts from which the information was downloaded: CHINA MOTORS CO. 172.20.0.196 ym-bs1 172.20.0.62 ym-bs5 172.20.0.63 ym-bs6 172.20.0.87 cmcfs02 172.20.1.136 cmymrpa01.china-motor.com.tw personal computers data Chao Wen Chen, Hsin-Cheng Tseng, Chun-Ching Liao, Qian Jingwu etc. FORTUNE MOTORS CO. 172.16.194.14 E11-I35-FS1.fmcmotors.com.tw 172.16.32.208 30888fs.fmcmotors.com.tw 172.16.32.104 cloud.30888.com.tw personal computers data Liao Yen Hui, Chen Huiwen, Yang Ruiyuan,Wu Qian etc. ---------------------------------- -employee Ids/passports -personal intimate information -intellectual property files (confidential design and development documents, manufacturing drawings, diagrams, technical documentation) -documents contain private and confidential information -top secret documents -technical data on products and developments -customer information(IDs/passports) -company performance data -non-disclosure agreements -company's financial documents -company accounting documents -shareholders information The total amount of downloaded information more than 700 Gb If you do not contact us within 3 days, or we cannot reach an agreement, all data will be published on a site that no one can block. Confidential data can be helpful for your competitors, enemies and darknet market hackers from over the world. The consequences will be unpredictable and the process cannot be stopped. Information about data leaks is bound to get into the media. Your company's reputation will be damaged. We value and respect every business, including yours. Therefore, we suggest you avoid further negative consequences and return to your work as soon as possible. We guarantee a fair and confidential deal in the shortest possible time. You will not only receive a decryptor, but also a description of your network vulnerabilities and information security recommendations. If necessary, you will be provided with qualified data recovery assistance. You can trust us! Reputation is important to everyone. As a proof of our statements, we are ready to restore some files for free and demonstrate how our product works. Best regards, Underground team ! Contacts for communication via chat: login to your account (Tor Browser) http://undgrddapc4reaunnrdrmnagvdelqfvmgycuvilgwb5uxm25sxawaoqd.onion/ your login: CM-FM your password: CHdfg863.)(TEWh/*FM your id: 17f44ff36087d2b0af0b90fcdff5f44c
URLs

http://undgrddapc4reaunnrdrmnagvdelqfvmgycuvilgwb5uxm25sxawaoqd.onion/

Targets

    • Target

      scenario_231707___9de0b4a3-48e8-4159-835e-c297a9cc8a10.exe

    • Size

      145KB

    • MD5

      df4bc2d3af251226e87d4ebb11ffd1fc

    • SHA1

      c0853df9624e7c78cba2c0b8e829d83af33c0e55

    • SHA256

      eb8ed3b94fa978b27a02754d4f41ffc95ed95b9e62afb492015d0eb25f89956f

    • SHA512

      a9531e6e8b8dd0405319259cf82b5655f9aec39fcb31b67d7d79c2f595215aa3a9d7630aab36cfd8488aa7c3bfa793340d14fdf858f7397dd4978b8c357b79c9

    • SSDEEP

      3072:NIEhL8Hzo1GbR8oxQPRyXfzQKqQ2oVEROt:WKSeGS+hXff2E

    • Underground Team

      Underground Team is a ransomware first seen in July 2023 that is primarily distriuted via exploting vulnerabilities.

    • Clears Windows event logs

    • Deletes shadow copies

      Ransomware often targets backup files to inhibit system recovery.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Drops desktop.ini file(s)

    • Power Settings

      powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.

MITRE ATT&CK Enterprise v15

Tasks