Overview

overview

10

Static

static

3

RansomSim.exe

windows10-2004-x64

10

RansomSim.exe

windows11-ltsc_2024-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    RansomSim.exe
  • Size 349KB
  • Sample260801-gf5rpsyhld
  • SHA256 d0ab11fdb1ec203d274d7093b685a3c9f8015cb341b0b1ff1b3e873310bf67c2
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
defense_evasiondiscoverypersistenceprivilege_escalationransomware

Malware Config

Extracted

Path

  • C:\Users\Admin\Desktop\DECRYPT_INSTRUCTIONS.txt

Ransom Note
  • *** YOUR FILES HAVE BEEN ENCRYPTED BY C4N0F *** All your documents, pictures, videos and databases have been locked. Your device has been seized. Do not try to recover the files yourself. Do not turn off your computer you dumb shit. VICTIM ID : 2C170C3C HOSTNAME : XWFPSFRW PUBLIC IP : UNAVAILABLE YOU HAVE 24 HOURS. WHEN THE COUNTDOWN REACHES ZERO ALL YOUR DATA WILL BE PERMANENTLY DELETED. 3 WRONG PASSWORDS = IMMEDIATE PERMANENT DELETION. To restore your files, enter the decryption key in the window on your screen. The key was generated for this machine. gng kys hackerly hackjarla hackaertron discord.gg/B4ds5xKfvV guns.lol/C4N0F

Extracted

Path

  • C:\Users\Admin\Desktop\DECRYPT_INSTRUCTIONS.txt

Ransom Note
  • *** YOUR FILES HAVE BEEN ENCRYPTED BY C4N0F *** All your documents, pictures, videos and databases have been locked. Your device has been seized. Do not try to recover the files yourself. Do not turn off your computer you dumb shit. VICTIM ID : 2C170C3C HOSTNAME : PEXWEVZA PUBLIC IP : UNAVAILABLE YOU HAVE 24 HOURS. WHEN THE COUNTDOWN REACHES ZERO ALL YOUR DATA WILL BE PERMANENTLY DELETED. 3 WRONG PASSWORDS = IMMEDIATE PERMANENT DELETION. To restore your files, enter the decryption key in the window on your screen. The key was generated for this machine. gng kys hackerly hackjarla hackaertron discord.gg/B4ds5xKfvV guns.lol/C4N0F

Targets

    • Target
      RansomSim.exe
    • Size 349KB
    • SHA256 d0ab11fdb1ec203d274d7093b685a3c9f8015cb341b0b1ff1b3e873310bf67c2
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    10/10
    defense_evasiondiscoverypersistenceprivilege_escalationransomware

    • Disables Task Manager via registry modification

      defense_evasion

    • Creates a file in the Startup directory

      A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

      persistenceprivilege_escalation

    • Contacts third-party web service commonly abused for C2

      Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

    • Drops desktop.ini file(s)

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

      discovery

    • Sets desktop wallpaper using registry

      ransomware
    behavioral1behavioral2

MITRE ATT&CK Enterprise v16

Tasks