Overview

overview

10

Static

static

3

sys_c67f50d5.exe

windows10-2004-x64

7

sys_c67f50d5.exe

windows11-ltsc_2024-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    sys_c67f50d5.exe
  • Size 3.7MB
  • Sample260804-dxm2favtbw
  • SHA256 9cfe9b894af68946ddc7e6f4cbdb085a92c4009ea00554c407beb5a8fc29f6b7
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
defense_evasiondiscoveryexecutionimpactpersistenceransomwarespywarestealer

Malware Config

Extracted

Path

  • C:\Users\Admin\AppData\Local\Temp\Sys_Diagnostics\HOW TO RECOVER.txt

Ransom Note
  • ================================================================================ CRPxO - YOUR FILES HAVE BEEN ENCRYPTED ================================================================================ All your documents, databases, backups, images, and other important files have been secured using military-grade encryption (AES-256 + RSA-2048). BEFORE ENCRYPTION, A COPY OF YOUR DATA WAS DOWNLOADED TO OUR SECURE SERVERS Do not panic! Your data is safe but inaccessible at the moment. ================================================================================ HOW TO RECOVER YOUR FILES ================================================================================ We offer a structured resolution timeline to resolve this matter privately. - If you contact us within the first 24 hours, you will receive a 50% discount. - If you contact us between 24 and 48 hours, the full price applies. - After 48 hours, your data will be permanently published on our leak site and made available for sale to your competitors and the public. We already have a copy of all your sensitive data. Pay to keep it private. Your window to act is limited. Contact us immediately. ================================================================================ YOUR UNIQUE RECOVERY ID ================================================================================ RECOVERY ID: OP_1785694812 ================================================================================ VERIFY YOUR LEAK STATUS ================================================================================ Your data is listed on our public leak site: https://crpx0.su Alternatively, access our site via Tor (for anonymous access): http://tlxoddx4odmc2qvsmtsbgwwsv5j45osb5sox7mz6izxliuju5mkulzad.onion To access the Tor link, download Tor Browser from: https://www.torproject.org On your case page, you will find attached proof files that confirm we have exfiltrated your data. These are real files from your system. ================================================================================ FREE DECRYPTION AS PROOF ================================================================================ To prove we have a working decryptor, you may send us 3-5 small files (non-archived, less than 4MB total) of your choice. These files should NOT contain sensitive information. We will decrypt them and send them back to you at no charge. This proves that we have a working decryption tool and that we can restore all your files once payment is made. Contact us using the methods below and we will provide instructions. ================================================================================ CONTACT US IMMEDIATELY ================================================================================ You must contact us using ONE of the secure channels below. Include your RECOVERY ID in your first message. ================================================================================ METHOD 1 - Secure Negotiation Room (Recommended) ================================================================================ We have set up a secure negotiation room on the darknet for you to resolve this matter privately and confidentially. 1. Download Tor Browser: https://www.torproject.org 2. Install and open Tor Browser 3. Visit our negotiation room: http://kqi5yty6ipuhwz4anutty6hob6et7dvnnxg6kcnulwedjaz5oton2zyd.onion 4. Enter your RECOVERY ID: OP_1785694812 5. Follow the instructions to begin secure negotiation. This channel is fully encrypted and anonymous. No logs are kept. ================================================================================ METHOD 2 - qTox (Encrypted Chat) ================================================================================ 1. Download qTox: https://qtox.github.io 2. Install and open qTox 3. Add our Tox ID as a friend: Tox ID: 17EB54B8455144E088C7E77F88A97221C319F0CFE4FE306853EEB113EE8DB5607BB6EE481C7C 4. Send your RECOVERY ID: OP_1785694812 5. Wait for instructions to pay and receive your decryption tool. ================================================================================ METHOD 3 - Session (Private Messenger) ================================================================================ 1. Download Session: https://getsession.org 2. Install and open Session 3. Start a new conversation with our Session ID: Session ID: 050546f6719172e04151c31acb37a242fa3eeff5766aa57331d26cc06e83e9e25b 4. Send your RECOVERY ID: OP_1785694812 5. Follow the payment instructions you receive. ================================================================================ WARNING ================================================================================ - Do NOT attempt to decrypt files yourself - permanent data loss will occur. - Do NOT rename or modify encrypted files - they will become unrecoverable. - Do NOT contact law enforcement or data recovery services - they cannot help, and your data will be leaked immediately. - Only we can provide the decryption key. - Only we can prevent your data from being published. We are a business. You are a business. We are offering a commercial solution to a technical problem. We are only interested in a resolution that benefits both parties. ================================================================================ WHAT HAPPENS NEXT ================================================================================ 1. Contact us via the Secure Negotiation Room, qTox, or Session with your RECOVERY ID. 2. You will receive payment instructions (Bitcoin / Monero). 3. After payment confirmation, you will receive your decryption tool. 4. We will delete your stolen data from our servers and provide proof. 5. Run the decryption tool to restore all your files. ================================================================================ FINAL WARNING ================================================================================ TIME REMAINING: 48 HOURS After 48 hours: - Your data will be published on our leak site (https://crpx0.su) Tor link: http://tlxoddx4odmc2qvsmtsbgwwsv5j45osb5sox7mz6izxliuju5mkulzad.onion (Download Tor Browser from https://www.torproject.org to access the Tor link) - Your data will be offered for sale to your competitors, data brokers, and on dark web markets - Your patients, clients, and business partners will be notified - Your reputation will face permanent and irreversible damage This is your ONLY chance to keep your data private and secure your business. Contact us NOW. ================================================================================
URLs

  • https://crpx0.su

  • http://tlxoddx4odmc2qvsmtsbgwwsv5j45osb5sox7mz6izxliuju5mkulzad.onion

  • http://kqi5yty6ipuhwz4anutty6hob6et7dvnnxg6kcnulwedjaz5oton2zyd.onion

  • https://qtox.github.io

  • https://getsession.org

Targets

    • Target
      sys_c67f50d5.exe
    • Size 3.7MB
    • SHA256 9cfe9b894af68946ddc7e6f4cbdb085a92c4009ea00554c407beb5a8fc29f6b7
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    10/10
    discoverydefense_evasionexecutionimpactpersistenceransomwarespywarestealer

    • Deletes shadow copies

      Ransomware often targets backup files to inhibit system recovery.

      ransomwaredefense_evasionimpactexecution

    • Renames multiple (485) files with added filename extension

      This suggests ransomware activity of encrypting all the files on the system.

      ransomware

    • Deletes backup catalog

      Uses wbadmin.exe to inhibit system recovery.

      ransomware

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Stops running service(s)

      defense_evasionexecution

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

      discovery

    • Discovers running processes

      Running process information can be used to identify security tools or plan follow-on actions.

      discovery

    • Sets desktop wallpaper using registry

      ransomware
    behavioral1behavioral2

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

2
T1059

Windows Command Shell

1
T1059.003

Scheduled Task/Job

1
T1053

Scheduled Task

1
T1053.005

System Services

1
T1569

Service Execution

1
T1569.002

Windows Management Instrumentation

1
T1047

Persistence

Create or Modify System Process

1
T1543

Windows Service

1
T1543.003

Scheduled Task/Job

1
T1053

Scheduled Task

1
T1053.005

Privilege Escalation

Create or Modify System Process

1
T1543

Windows Service

1
T1543.003

Scheduled Task/Job

1
T1053

Scheduled Task

1
T1053.005

Defense Evasion

Direct Volume Access

1
T1006

Impair Defenses

1
T1562

Indicator Removal

3
T1070

File Deletion

3
T1070.004

Modify Registry

1
T1112

Credential Access

Credentials from Password Stores

1
T1555

Credentials from Web Browsers

1
T1555.003

Unsecured Credentials

1
T1552

Credentials In Files

1
T1552.001

Discovery

Peripheral Device Discovery

1
T1120

Process Discovery

1
T1057

Query Registry

2
T1012

System Information Discovery

1
T1082

System Location Discovery

1
T1614

System Language Discovery

1
T1614.001

System Network Configuration Discovery

1
T1016

Internet Connection Discovery

1
T1016.001

Lateral Movement

Collection

Data from Local System

1
T1005

Command and Control

Exfiltration

Impact

Defacement

1
T1491

Inhibit System Recovery

3
T1490

Service Stop

1
T1489

Tasks