Overview

overview

10

Static

static

5

4852f22df0...4c.exe

windows10-2004-x64

10

4852f22df0...4c.exe

windows11-ltsc_2024-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    4852f22df095db43f2a92e99384ff7667020413e74f67fcbd42fca16f8f96f4c.zip
  • Size 55KB
  • Sample260817-kncmnsxtb1
  • SHA256 e8eda913e004fde9b9adaeb17e66adff3af09e335eb0ceb623fd9d9d7d2e0168
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
defense_evasiondiscoveryexecutionpersistenceprivilege_escalationransomware

Malware Config

Extracted

Path

  • C:\Users\Admin\AppData\Local\Temp\RESTORE_FILES_INFO.txt

Ransom Note
  • What Happen to my computer? Your important files are encrypted. Many of your documents, photos, passwords, databases and other files are no longer accessible because they have been encrypted. Maybe you are busy looking for way to recover your files , but do not waste your time. Nobody can recover your files without our decryption KEY (if somebody will tell that they can do it, they will also contact me and I will make the price so much expensive than if you contact directly). DONT USE GMAIL.COM TO CONTACT US !!!THE DATARECOVERY COMPANIES JUST WANT YOUR MONEY!!! !!DATA RECOVERY COMPANIES WILL ONLY INCREASE THE DECRYPTION TIME!! YOU CAN USE PRIVATE CHAT TO CONTACT US https://supportdatarecovery.cc LOGIN:Huaxitec PASSWORD:HeUupfhc Send e-mail to this address: [email protected] Can i Recover My Files? Sure. We guarantee that you can recover all your files safely and easily But You have not so enough time . So If you want to decrypt all your data, you need to pay .As fast you pay as fast all of your data will be back as before encryption. Send e-mail to this address: [email protected] You have to pay for decryption in Bitcoins. ATTENTION Do not rename encrypted files. Do not try to decrypt your data using third party software, it may cause permanent data loss. Decryption of your files with the help of third parties may cause increased price (they add their fee to our) or you can become a victim of a scam. If you want to try datarecovery company just ask for testfile.They have to give it for you if they can do something. They will not. Key Identifier: EVebGFbn+JtQhtyp7XBbY6S3zp9PdVxA34RGuwNctAF+1JV2QUuY7mgrQHZlGCUPFrp8k8GW69pxJZ1Mjwz9cG4NuSWSt7dHktFE4/G4DkxdpkPXCsWpEc2J4JGQu9yjCt+lv2Izxg17Bb2zRaCQ6EcECgIPHbYIi9u1NVZev4dQEpvTxkYPn6FwWxFFDXEx7Rvgxmv3G1SLlk5ra/uLoPv3GDyBFI7wpIHwaWXlWdxHz8DQViJSLhimSi528UD0e+JJjbbEA5eSOoLbvB20aBATfBa1PjCX2hPzE5w0TyF9Ov3jbbaqpi+F8aD4n/2diDzUYtQZYPczcMdkHibiLgHpCudDY013rwjARiQ/KvYRbw6qXKH4yLueqpsHVTEfRH1mGOOeJMIXzHB07h1DI5IpbqfW/5zUWz4ZJ1nvi4c+JJO2wRF+Ie+aD52+DNaJbq2kFFRyiLyzev2+nwuFUDXJV/5oIpsRj8Y4BjrLDoWVSuISz9d3dqqBbM2vfRUl3LHPLcPjAK6t5VK9C5/p1MdSIMMnLg3OxaPNB+Y/zLB9+z4kMM7xHoQDRWhRxfyQt6+C5mQyiYgmSo0j71BgxP+KCOnIPPR8FsuKF0PFyluzzC/J///SW5adqY1+sOrY6JzJIaSN5brYaAWy6C83At5mEUInxA8eohU96K/bdOc=
URLs

  • https://supportdatarecovery.cc

Extracted

Path

  • C:\Users\Admin\Desktop\RESTORE_FILES_INFO.hta

Ransom Note
  • What Happen to my computer? Your important files are encrypted. Many of your documents, photos, passwords, databases and other files are no longer accessible because they have been encrypted. Maybe you are busy looking for way to recover your files , but do not waste your time. Nobody can recover your files without our decryption KEY (if somebody will tell that they can do it, they will also contact me and I will make the price so much expensive than if you contact directly). DONT USE GMAIL.COM TO CONTACT US !!!THE DATARECOVERY COMPANIES JUST WANT YOUR MONEY!!! !!DATA RECOVERY COMPANIES WILL ONLY INCREASE THE DECRYPTION TIME!! YOU CAN USE PRIVATE CHAT TO CONTACT US https://supportdatarecovery.cc LOGIN:Huaxitec PASSWORD:HeUupfhc Send e-mail to this address: [email protected] Can i Recover My Files? Sure. We guarantee that you can recover all your files safely and easily But You have not so enough time . So If you want to decrypt all your data, you need to pay .As fast you pay as fast all of your data will be back as before encryption. Send e-mail to this address: [email protected] You have to pay for decryption in Bitcoins. ATTENTION Do not rename encrypted files. Do not try to decrypt your data using third party software, it may cause permanent data loss. Decryption of your files with the help of third parties may cause increased price (they add their fee to our) or you can become a victim of a scam. If you want to try datarecovery company just ask for testfile.They have to give it for you if they can do something. They will not. Key Identifier: EVebGFbn+JtQhtyp7XBbY6S3zp9PdVxA34RGuwNctAF+1JV2QUuY7mgrQHZlGCUPFrp8k8GW69pxJZ1Mjwz9cG4NuSWSt7dHktFE4/G4DkxdpkPXCsWpEc2J4JGQu9yjCt+lv2Izxg17Bb2zRaCQ6EcECgIPHbYIi9u1NVZev4dQEpvTxkYPn6FwWxFFDXEx7Rvgxmv3G1SLlk5ra/uLoPv3GDyBFI7wpIHwaWXlWdxHz8DQViJSLhimSi528UD0e+JJjbbEA5eSOoLbvB20aBATfBa1PjCX2hPzE5w0TyF9Ov3jbbaqpi+F8aD4n/2diDzUYtQZYPczcMdkHibiLgHpCudDY013rwjARiQ/KvYRbw6qXKH4yLueqpsHVTEfRH1mGOOeJMIXzHB07h1DI5IpbqfW/5zUWz4ZJ1nvi4c+JJO2wRF+Ie+aD52+DNaJbq2kFFRyiLyzev2+nwuFUDXJV/5oIpsRj8Y4BjrLDoWVSuISz9d3dqqBbM2vfRUl3LHPLcPjAK6t5VK9C5/p1MdSIMMnLg3OxaPNB+Y/zLB9+z4kMM7xHoQDRWhRxfyQt6+C5mQyiYgmSo0j71BgxP+KCOnIPPR8FsuKF0PFyluzzC/J///SW5adqY1+sOrY6JzJIaSN5brYaAWy6C83At5mEUInxA8eohU96K/bdOc=
URLs

  • https://supportdatarecovery.cc

Extracted

Path

  • C:\Users\Admin\AppData\Local\Temp\RESTORE_FILES_INFO.txt

Ransom Note
  • What Happen to my computer? Your important files are encrypted. Many of your documents, photos, passwords, databases and other files are no longer accessible because they have been encrypted. Maybe you are busy looking for way to recover your files , but do not waste your time. Nobody can recover your files without our decryption KEY (if somebody will tell that they can do it, they will also contact me and I will make the price so much expensive than if you contact directly). DONT USE GMAIL.COM TO CONTACT US !!!THE DATARECOVERY COMPANIES JUST WANT YOUR MONEY!!! !!DATA RECOVERY COMPANIES WILL ONLY INCREASE THE DECRYPTION TIME!! YOU CAN USE PRIVATE CHAT TO CONTACT US https://supportdatarecovery.cc LOGIN:Huaxitec PASSWORD:HeUupfhc Send e-mail to this address: [email protected] Can i Recover My Files? Sure. We guarantee that you can recover all your files safely and easily But You have not so enough time . So If you want to decrypt all your data, you need to pay .As fast you pay as fast all of your data will be back as before encryption. Send e-mail to this address: [email protected] You have to pay for decryption in Bitcoins. ATTENTION Do not rename encrypted files. Do not try to decrypt your data using third party software, it may cause permanent data loss. Decryption of your files with the help of third parties may cause increased price (they add their fee to our) or you can become a victim of a scam. If you want to try datarecovery company just ask for testfile.They have to give it for you if they can do something. They will not. Key Identifier: N2Mw/wwjgZBzJ/dihK/mIvK+AR+EcmYzzuWCy9cgXbC397abKAESCYqKuDIIiFCXLQVldRdbt1WAMJTCoMezkCMClZ5+piE1nuqxWn6PMujFZLHpVGRSSLYi4G8AF8swZohw7v9VJujkV0l0axvpOXGq+2TzHgoSC6CEOfPTa7yNFFulC5nPUck/ZYZVrUuGcbRh9U6r8Z5TSkrNeHdABZ4YXLHKF+QjsQ/aGwas068vlBlJj7OfWfK/3AguVEKe1JHrLRu2IQi6iW4uk9edfBoN8vP7kycaPpHLW1AXu3wvpzYZ0tyDZoakTfLpAtwsbzEoSDu2H5ytJWiZnuOexEMtQE/sbv0wCSOXpRw9q3slI3TRi2s7heOBOwRMlf3aIng9853stvdyhKeCQB/JUwUOII0pwdmo7T5BqYB5OqjRaNvZWYxwqLHvdAkdvkqJzIfo5SsLCNJAH+DldFe/Uzzm6sH3lU9bcwG1RnyrwCfZcRqQ9cZO6HBqDUB/UWSy5fJ8TxHBK8YsbKxoN2cm37zGIzcWFCwFK+Vn7ijOG/WjgZZ3XBqpakiLinnqoG7s2izeM8MSRGbwZJV+CJTVYnllBhCrViDB43yGnUUyx2Cf3+1iNq7KKET1K0RnlmT6IBsTpCWPPsi+chKdGveIhvOAqh2zmd4mUht1UmY/Kzc=
URLs

  • https://supportdatarecovery.cc

Extracted

Path

  • C:\Users\Admin\Desktop\RESTORE_FILES_INFO.hta

Ransom Note
  • What Happen to my computer? Your important files are encrypted. Many of your documents, photos, passwords, databases and other files are no longer accessible because they have been encrypted. Maybe you are busy looking for way to recover your files , but do not waste your time. Nobody can recover your files without our decryption KEY (if somebody will tell that they can do it, they will also contact me and I will make the price so much expensive than if you contact directly). DONT USE GMAIL.COM TO CONTACT US !!!THE DATARECOVERY COMPANIES JUST WANT YOUR MONEY!!! !!DATA RECOVERY COMPANIES WILL ONLY INCREASE THE DECRYPTION TIME!! YOU CAN USE PRIVATE CHAT TO CONTACT US https://supportdatarecovery.cc LOGIN:Huaxitec PASSWORD:HeUupfhc Send e-mail to this address: [email protected] Can i Recover My Files? Sure. We guarantee that you can recover all your files safely and easily But You have not so enough time . So If you want to decrypt all your data, you need to pay .As fast you pay as fast all of your data will be back as before encryption. Send e-mail to this address: [email protected] You have to pay for decryption in Bitcoins. ATTENTION Do not rename encrypted files. Do not try to decrypt your data using third party software, it may cause permanent data loss. Decryption of your files with the help of third parties may cause increased price (they add their fee to our) or you can become a victim of a scam. If you want to try datarecovery company just ask for testfile.They have to give it for you if they can do something. They will not. Key Identifier: N2Mw/wwjgZBzJ/dihK/mIvK+AR+EcmYzzuWCy9cgXbC397abKAESCYqKuDIIiFCXLQVldRdbt1WAMJTCoMezkCMClZ5+piE1nuqxWn6PMujFZLHpVGRSSLYi4G8AF8swZohw7v9VJujkV0l0axvpOXGq+2TzHgoSC6CEOfPTa7yNFFulC5nPUck/ZYZVrUuGcbRh9U6r8Z5TSkrNeHdABZ4YXLHKF+QjsQ/aGwas068vlBlJj7OfWfK/3AguVEKe1JHrLRu2IQi6iW4uk9edfBoN8vP7kycaPpHLW1AXu3wvpzYZ0tyDZoakTfLpAtwsbzEoSDu2H5ytJWiZnuOexEMtQE/sbv0wCSOXpRw9q3slI3TRi2s7heOBOwRMlf3aIng9853stvdyhKeCQB/JUwUOII0pwdmo7T5BqYB5OqjRaNvZWYxwqLHvdAkdvkqJzIfo5SsLCNJAH+DldFe/Uzzm6sH3lU9bcwG1RnyrwCfZcRqQ9cZO6HBqDUB/UWSy5fJ8TxHBK8YsbKxoN2cm37zGIzcWFCwFK+Vn7ijOG/WjgZZ3XBqpakiLinnqoG7s2izeM8MSRGbwZJV+CJTVYnllBhCrViDB43yGnUUyx2Cf3+1iNq7KKET1K0RnlmT6IBsTpCWPPsi+chKdGveIhvOAqh2zmd4mUht1UmY/Kzc=
URLs

  • https://supportdatarecovery.cc

Targets

    • Target
      4852f22df095db43f2a92e99384ff7667020413e74f67fcbd42fca16f8f96f4c.exe
    • Size 109KB
    • SHA256 4852f22df095db43f2a92e99384ff7667020413e74f67fcbd42fca16f8f96f4c
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    10/10
    defense_evasiondiscoveryexecutionpersistenceprivilege_escalationransomware

    • Renames multiple (200) files with added filename extension

      This suggests ransomware activity of encrypting all the files on the system.

      ransomware

    • Disables Task Manager via registry modification

      defense_evasion

    • Downloads MZ/PE file

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Creates a file in the Startup directory

      A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

      persistenceprivilege_escalation

    • Disables service(s)

      defense_evasionexecution

    • Contacts third-party web service commonly abused for C2

      Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

    • Drops desktop.ini file(s)

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

      discovery
    behavioral1behavioral2

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1
T1059

Windows Command Shell

1
T1059.003

System Services

1
T1569

Service Execution

1
T1569.002

Persistence

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Create or Modify System Process

1
T1543

Windows Service

1
T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Create or Modify System Process

1
T1543

Windows Service

1
T1543.003

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Query Registry

2
T1012

Remote System Discovery

1
T1018

System Information Discovery

3
T1082

System Location Discovery

1
T1614

System Language Discovery

1
T1614.001

System Network Configuration Discovery

2
T1016

Internet Connection Discovery

2
T1016.001

Lateral Movement

Collection

Command and Control

Web Service

1
T1102

Exfiltration

Impact

Service Stop

1
T1489

Tasks