Resubmissions

29-11-2024 15:57

241129-td12ysylek 10

General

  • Target

    lsass.exe

  • Size

    2.3MB

  • Sample

    241129-td12ysylek

  • MD5

    131f1e70e37f54ca486f111b596ea4ce

  • SHA1

    b460653cb8a5294711d70a6a240100fbbb475b30

  • SHA256

    c09333024c035b820003b8af59cbba362bfcdc5e2308fc8027dca324e0666c2c

  • SHA512

    128b4e0946e1cc0227bb21a385a8df9ced6e12235fac99a506ec7e18c63806dc6e429eab6f21b971217433d68b8efc19f8c0006a5d53126fe21673ad9254caf5

  • SSDEEP

    49152:wgwRAifu1DBgutBPNN52/N+0MgrMPR9JZqoUGKv1dHNUv+/C:wgwRAvguPPFeNvuRZqfD1l8L

Malware Config

Extracted

Path

C:\Users\Admin\AppData\Local\How-to-decrypt.txt

Ransom Note
|!!!| Hello |!!!| ---> DON'T ignore this and check ALL INFO carefully!!! *** About situation: ALL your important files have been encrypted and ALL sensitive information also leaked! This modification is reversible and data remain safe! Encrypting your data is only proof , we only interested money, we don't want to damage your reputation , don't want to harm your work, not make a DDOS attack on your infrastructure - we only check and uploaded your files! *** IF WE DO NOT FIND A COMMON LANGUAGE: ---> All encrypted data be irretrievably lost. ---> Leaked data will be published or sold on black-market (or to competitors). This will be followed by serious consequences and all your customers\partners and special services will be notified about it! !!! FOLLOW INSTRUCTIONS TO AVOID IRREVERSIBLE CONSEQUENCES !!! !!!YOU NEED ASAP CONTACT WITH US TO DEAL THIS!!! Our contacts will be provided below! **************************************** !!! WARNING !!! DON'T use any third party software for restoring your data or antivirus solutions! DO NOT MODIFY ENCRYPTED FILES! DO NOT RENAME ENCRYPTED FILES! - it's may entail damage of the private key and, as result - you loss all data. !!!No software and services available on internet can help you!!! !!! Decryption of your files with the help of third parties may cause increased price (they add their fee to our and they usually fail) or you can become a victim of a scam. **************************************** REMINDING: It's in your interests to get your files back and safe all lost files,docs,bases. We have your highly confidential/personal data. These data are currently stored on a private server(cloud)! ---> After payment this cloud will be deleted and your data stay safe! We guarantee complete anonymity and can provide you with proof and guaranties from our side and our best specialists make everything for restoring, but please should not interfere without us. |!!!| IF YOU DON'T CONTACT US WITHIN 48 HOURS FROM MOMENT OF LOCK YOUR SERVERS - WE START LOOKING CLIENTS FOR SELL YOUR DATA IN OUR PRIVATE CHANNELS AND PRICE WILL BE HIGHER. |!!!| ---------------------------------------- Your unique ID is: zcrtZ5mEyw9AsBqgfcOeawBsog36voiyp2_Vj7syEFE*LOQUI Send this ID when you will contact us!. ---------------------------------------- *** HOW TO CONTACT US: Just write us an email to this mail(s): [email protected] [email protected] * To ANONIMOUS contact with us, create a new free email account on the site: onionmail.org (recommended)( REGISTER IN TOR BROWSER: http://pflujznptk5lmuf6xwadfqy6nffykdvahfbljh7liljailjbxrgvhfid.onion/ ) , tutanota.com * To avoid having your email blocked and get spam filters, send private information (such as your private key) with the private notes service: privnote.com, 1ty.me, www.private-notes.com If you do not receive a reply within 24 hours or do not receive a response to your following messages, contact us with another email or through qTox! ! add our mails to contacts so as not to lose letters from us ! !!! check your spam sometimes, our emails may get there !!! !!! for a quick contact with us or if you will not receive our letters !!! download qTox and ADD our TOXID. our individual key(TOXID): 3A381C022C1F235748B069D7B242A53CE6C74BBB4ED16C8FFAA1183B92C2E469DDD27F45A6EF How to download qTOX messenger: https://tox.chat/download.html https://github.com/qTox/qTox/releases/download/v1.17.3/setup-qtox-x86_64-release.exe
URLs

http://pflujznptk5lmuf6xwadfqy6nffykdvahfbljh7liljailjbxrgvhfid.onion/

https://tox.chat/download.html

https://github.com/qTox/qTox/releases/download/v1.17.3/setup-qtox-x86_64-release.exe

Targets

    • Target

      lsass.exe

    • Size

      2.3MB

    • MD5

      131f1e70e37f54ca486f111b596ea4ce

    • SHA1

      b460653cb8a5294711d70a6a240100fbbb475b30

    • SHA256

      c09333024c035b820003b8af59cbba362bfcdc5e2308fc8027dca324e0666c2c

    • SHA512

      128b4e0946e1cc0227bb21a385a8df9ced6e12235fac99a506ec7e18c63806dc6e429eab6f21b971217433d68b8efc19f8c0006a5d53126fe21673ad9254caf5

    • SSDEEP

      49152:wgwRAifu1DBgutBPNN52/N+0MgrMPR9JZqoUGKv1dHNUv+/C:wgwRAvguPPFeNvuRZqfD1l8L

    • Detects Mimic ransomware

    • Mimic

      Ransomware family was first exploited in the wild in 2022.

    • Mimic family

    • UAC bypass

    • Clears Windows event logs

    • Modifies boot configuration data using bcdedit

    • Renames multiple (187) files with added filename extension

      This suggests ransomware activity of encrypting all the files on the system.

    • Deletes System State backups

      Uses wbadmin.exe to inhibit system recovery.

    • Event Triggered Execution: Image File Execution Options Injection

    • Executes dropped EXE

    • Loads dropped DLL

    • Modifies system executable filetype association

    • Adds Run key to start application

    • Checks whether UAC is enabled

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Power Settings

      powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.

MITRE ATT&CK Enterprise v15

Tasks