Overview

overview

10

Static

static

10

2ffd41be5a...9e.exe

windows7-x64

10

2ffd41be5a...9e.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    20157085188.zip

  • Size

    97KB

  • Sample

    241203-k18kwatpgp

  • MD5

    0d43612725b8e158b0e7667bb7c3356b

  • SHA1

    090e1d93d6825e4ca818fc8cdc0f0fe1274c7b9b

  • SHA256

    0774bab2acc20b6cf91669dd916f3ee0bd152919e2533a4bb0f04e0c2539da3b

  • SHA512

    17532a9aed645f35d22f55e1ef6d9ed523a099c4d8011d9bd89f40eaca5f4c2f0099c517fb477edcecab42e4fb413715bfd7d8bff9ed57b9d75d6ee66820d57b

  • SSDEEP

    1536:o2pNmVLzvffPgBN4H8oNd+HFXVWyVcNZVyNwCHBVKVqp4keiHh2k5Nx02DUYg:o2r6fA/43yhxwVyj4VKoiBR5f02wYg

Score
10/10
lockbitdefense_evasiondiscoveryransomwarespywarestealer

Malware Config

Extracted

Path

C:\blADqpmVf.README.txt

Ransom Note
>>>> Your data are stolen and encrypted if you do not pay the ransom The Your data permanently deleted >>>>What guarantees that we will not deceive you? We are not a politically motivated group and we do not need anything other than your money. If you pay, we will provide you the programs for decryption and your data will not be disclosed . Life is too short to be sad. Be not sad, money, it is only paper. You can contact us and use your personal decryption ID to decrypt a file for free >>>>Your personal DECRYPTION ID: 79F912B255565ED7B94CCBC85D2D95F7 If we do not give you decrypters after payment, then nobody will pay us in the future. Therefore, our reputation is very important to us. You can contact me by email. Email:[email protected] Sometimes you will need to wait for our answer because we attack many companies. we will provide you the programs >>>>payment is completed, send the payment photo to Email: [email protected] >>>>payment is completed Send via email we will provide you the programs and you will restore all the data. >>>>Warning! Do not DELETE or MODIFY any files, it can lead to recovery problems!
Emails

Extracted

Path

C:\blADqpmVf.README.txt

Ransom Note
>>>> Your data are stolen and encrypted if you do not pay the ransom The Your data permanently deleted >>>>What guarantees that we will not deceive you? We are not a politically motivated group and we do not need anything other than your money. If you pay, we will provide you the programs for decryption and your data will not be disclosed . Life is too short to be sad. Be not sad, money, it is only paper. You can contact us and use your personal decryption ID to decrypt a file for free >>>>Your personal DECRYPTION ID: 79F912B255565ED7133325B97C67E533 If we do not give you decrypters after payment, then nobody will pay us in the future. Therefore, our reputation is very important to us. You can contact me by email. Email:[email protected] Sometimes you will need to wait for our answer because we attack many companies. we will provide you the programs >>>>payment is completed, send the payment photo to Email: [email protected] >>>>payment is completed Send via email we will provide you the programs and you will restore all the data. >>>>Warning! Do not DELETE or MODIFY any files, it can lead to recovery problems!
Emails

Targets

    • Target

      2ffd41be5a72da75b3de503e17bed058eb84e1e83be9e0b264cb987b4581259e

    • Size

      147KB

    • MD5

      e3e89421797130de9f4edebdd1980522

    • SHA1

      f3fad656375518254c520e5dc7d94a495443db7e

    • SHA256

      2ffd41be5a72da75b3de503e17bed058eb84e1e83be9e0b264cb987b4581259e

    • SHA512

      94d3670b2e2af3c18d4f441340973045bb9b658f401cf20e27b7376fdb4c37e7e8d2d39fa2f417536987957a5af7f81c44f433fa3cd392c288d852b427af38ec

    • SSDEEP

      3072:h6glyuxE4GsUPnliByocWepKooaLxQ3Rmz:h6gDBGpvEByocWeD8Rm

    Score
    10/10
    defense_evasiondiscoveryransomwarespywarestealer

    • Renames multiple (358) files with added filename extension

      This suggests ransomware activity of encrypting all the files on the system.

      ransomware

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Drops desktop.ini file(s)

    • Indicator Removal: File Deletion

      Adversaries may delete files left behind by the actions of their intrusion activity.

      defense_evasion

    • Drops file in System32 directory

    • Sets desktop wallpaper using registry

      ransomware

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks