Analysis

  • max time kernel
    141s
  • max time network
    37s
  • platform
    windows7_x64
  • resource
    win7v200430
  • submitted
    01-06-2020 15:29

General

  • Target

    24ada19b269279612370bdf16f2becc1d5b7e0f69821050e2d9b48cfc874dca0.bin.exe

  • Size

    19KB

  • MD5

    8bd00c45b95cc40192efc84ff20c391f

  • SHA1

    15774ff1aa7d1c16332c5c54a4c7e9322ccddcdd

  • SHA256

    24ada19b269279612370bdf16f2becc1d5b7e0f69821050e2d9b48cfc874dca0

  • SHA512

    be4dafda0efee22138e5b85e9f9b90ab099a17cd2953b3122b112e624981a9d7389ccc13c2be100a734e29083be5efe20305aa4d753c8bc4d7b7b61157f01da4

Score
10/10

Malware Config

Extracted

Path

C:\SIGARETA-RESTORE.txt

Ransom Note
Two things have happened to your company. ========================================================================================================================== All of your files have been encrypted with military grade algorithms. The only way to retrieve your data is with our software. Restoration of your data requires a private key which only we possess. ========================================================================================================================== Information that we deemed valuable or sensitive was downloaded from your network to a secure location. We can provide proof that your files have been extracted. If you do not contact us we will start leaking the data periodically in parts. ========================================================================================================================== To confirm that our decryption software works email to us 2 files from random computers. You will receive further instructions after you send us the test files. We will make sure you retrieve your data swiftly and securely and that your data is not leaked when our demands are met. If we do not come to an agreement your data will be leaked on this website. Website: http://corpleaks.net TOR link: http://hxt254aygrsziejn.onion Contact us via email: DineshSchwartz1965@protonmail.com RupertMariner1958@protonmail.com StephanForenzzo1985@protonmail.com
Emails

DineshSchwartz1965@protonmail.com

RupertMariner1958@protonmail.com

StephanForenzzo1985@protonmail.com

URLs

http://corpleaks.net

http://hxt254aygrsziejn.onion

Signatures

  • Sets desktop wallpaper using registry 2 TTPs 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\24ada19b269279612370bdf16f2becc1d5b7e0f69821050e2d9b48cfc874dca0.bin.exe
    "C:\Users\Admin\AppData\Local\Temp\24ada19b269279612370bdf16f2becc1d5b7e0f69821050e2d9b48cfc874dca0.bin.exe"
    1⤵
    • Sets desktop wallpaper using registry
    PID:1520

Network

MITRE ATT&CK Matrix ATT&CK v6

Defense Evasion

Modify Registry

1
T1112

Impact

Defacement

1
T1491

Replay Monitor

Loading Replay Monitor...

Downloads