Analysis
- max time kernel
148s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20241007-en - resource tags
- submitted
22/10/2024, 11:01
General
- Target enc_windows_amd64.exe
- Size 3.9MB
- Sample241022-m4hvqstdpl
- SHA256 0622aed252556af50b834ae16392555e51d67b3a4c67a6836b98534a0d14d07d
Malware Config
Extracted
-
C:\Users\Default\Documents\HOW_RETURN_YOUR_DATA.TXT
- Hello! Your files have been stolen from your network and encrypted with a strong algorithm. We work for money and are not associated with politics. All you need to do is contact us and pay. --- Our communication process: 1. You contact us. 1. We send you a list of files that were stolen. 2. We decrypt 1 file to confirm that our decryptor works. 3. We agree on the amount, which must be paid using BTC. 4. We delete your files, we give you a decryptor. 5. We give you a detailed report on how we compromised your company, and recommendations on how to avoid such situations in the future. --- Client area (use this site to contact us): Link for Tor Browser: http://panela3eefdzfzxzxcshfnbustdprtlhlbe3x2fqomdz7t33iqtzvjyd.onion/Url=ddb34da5-dce4-4b46-8f7d-4674ab38be9d >>> to begin the recovery process. * In order to access the site, you will need Tor Browser, you can download it from this link: https://www.torproject.org/ --- Recommendations: DO NOT RESET OR SHUTDOWN - files may be damaged. DO NOT RENAME OR MOVE the encrypted and readme files. DO NOT DELETE readme files. --- Important: If you refuse to pay or do not get in touch with us, we start publishing your files. Ehe decryptor will be destroyed and the files will be published on our blog. Blog: http://dataleakypypu7uwblm5kttv726l3iripago6p336xjnbstkjwrlnlid.onion Sincerely!
-
http://panela3eefdzfzxzxcshfnbustdprtlhlbe3x2fqomdz7t33iqtzvjyd.onion/Url=ddb34da5-dce4-4b46-8f7d-4674ab38be9d
-
http://dataleakypypu7uwblm5kttv726l3iripago6p336xjnbstkjwrlnlid.onion
Signatures
- Enumerates connected drives 3 TTPs 24 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Suspicious use of AdjustPrivilegeToken 3 IoCs
- Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\enc_windows_amd64.exe"C:\Users\Admin\AppData\Local\Temp\enc_windows_amd64.exe"1⤵
- Enumerates connected drives
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
HOW_RETURN_YOUR_DATA.TXT
memory/3968-310-0x000000C000000000-0x000000C000400000-memory.dmp
memory/3968-311-0x000000C000000000-0x000000C000400000-memory.dmp
memory/3968-312-0x000000C000000000-0x000000C000400000-memory.dmp
memory/3968-313-0x000000C000000000-0x000000C000400000-memory.dmp
memory/3968-314-0x000000C000000000-0x000000C000400000-memory.dmp