General
- Target Ransomware.YggGuru.zip
- Size 1.9MB
- Sample260620-r5prwsfv8p
- SHA256 f42eff5341ca6c6a9ecfc24e68caea79d66c6b7709263c9cff86e48ec4604034
Score
10/10
Malware Config
Extracted
Path
-
C:\Users\Admin\Documents\README_RESTORE.txt
Ransom Note
- =============================================================== ALL YOUR FILES HAVE BEEN ENCRYPTED =============================================================== What happened? Your important files have been encrypted using military-grade AES-256-GCM encryption. You will not be able to recover them without our private decryption key. 0 file(s) have been affected. How to recover? To get the decryption tool, you must pay 0.5 BTC to: bc1q9x4m27d3kge0f8v5td0w4rjhkfz5a5nqpfsghr After payment, send your machine ID and transaction proof to: [email protected] You will receive the decryption tool within 24 hours. WARNING: - Do NOT rename or modify encrypted files - Do NOT use third-party decryption software - Do NOT contact law enforcement (they cannot help you) - Payment increases to 1 BTC after 72 hours Your machine ID: Vcgdloyn ===============================================================
Emails
Targets
-
- Target Users/anthony/ioc/update.exe
- Size 1.8MB
- SHA256 c3b71a279800e79535b096b110c9cf27ff16b92cf0a18200dd777a9abae9a5e7
Score10/10-
Deletes shadow copies
Ransomware often targets backup files to inhibit system recovery.
-
Modifies boot configuration data using bcdedit
-
Deletes backup catalog
Uses wbadmin.exe to inhibit system recovery.
-
Disables Task Manager via registry modification
-
Adds Run key to start application
-
UPX packed file
Detects executables packed with UPX/modified UPX open source packer.
MITRE ATT&CK Enterprise v16
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Defense Evasion
Direct Volume Access
1Indicator Removal
3File Deletion
3Modify Registry
2