Overview

overview

10

task1

 

10

task2

 

10

Resubmissions

02-12-2019 10:20

191202-k7xrts92dx 10

14-11-2019 15:55

191114-lrhkzccm9n 0

Analysis

  • max time kernel
    132s
  • resource
    win7v191014
  • submitted
    02-12-2019 10:20

Sharing

Copy URL
Twitter E-mail

General

  • Target

    139a7d6656feebe539b2cb94b0729602f6218f54fb5b7531b58cfe040f180548.exe

  • Sample

    191202-k7xrts92dx

  • SHA256

    139a7d6656feebe539b2cb94b0729602f6218f54fb5b7531b58cfe040f180548

Score
10/10
ransomwareevasionspywaretrojansodinokibi

Malware Config

Extracted

Path

C:\Recovery\2209y9.info.txt

Family

sodinokibi

Ransom Note
Hello dear friend! Your files are encrypted, and, as result you can't use it. You must visit our page to get instructions about decryption process. All encrypted files have got 2209y9 extension. Instructions into the TOR network ----------------------------- Install TOR browser from https://torproject.org/ Visit the following link: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/C104846EF5A7DE33 Instructions into WWW (The following link can not be in work state, if true, use TOR above): ----------------------------- Visit the following link: http://decryptor.top/C104846EF5A7DE33 Page will ask you for the key, here it is: x+Ch4+2zPRuVsGDVMG+eb7KqacUHvKNsA1zmGiWEccdJegjesbLsfbSPF22+g6Wh 8G+M/jZm123uKFZQRDIk8XhsCmeCWNsRVYzsXzNg4OC+M6f5WCW1wJ4TfJH2j+cy whaUKjoPwwTJkAXPc7eKgsbCw4ZuT8dGJjLPTOjO+UZ11+ZqCmZP+Ta1LzcJfwi4 sfA8W+pBICpwHDgUim8JDTtdgYsIxf1BfftAM5wVN2i+dD8BdD2BB6dp6m4jsDWy IlPxaVMjBVtjqNzrXPQ4lds6/bWaowCEP2f9T697lwsAUgq4fFe+EbTx7FcwYp3P EjSMObGS/o/IssvD/cZKyqvI53qqbxy3ABkIyxyTnlcw623V40da9HONH+gjFUta GQ3hmtbI6ln4eEJh63lYs0/jFJbUoYLC4/BlbOdyMGM3OziEKeKtogWwSyV9Moib jsKXohGPuZMkAk1lmeGOHWJ7aGfYUzq+2Z0rAFAMlbaWB5C1ML1TdKTPPjDSmA25 RZ8lFnd2IsqVAmvDzvCjjLto3sbBFpCTb+HGwmmotm83AKdegCiOlNqRWzEdJ1L5 dlG89S8fTCGTLyHnqW4Pd6EBlGKx8+NuwhVW7RJehh3LJOEy9OGEOPD8dWxxZtl9 9Rev71EgPZUZwUYPM6d+hE75PmBFk+fDx0Ze/TYoEGFwLZdA9Se2pm5T57QVBbXV 5/zRJO8FEyLmQEWMefCWVs8Mmyls7aBgYAb58qS8FfdB2VPu70liH2+WtE6Gsby3 MzuYWQVqlyM4vCXZ82ut8eSpeAhNVl2E+2aIG7/h6sxlhOu9XPfesJcV+EXnog5D aYrXpbaZ53vgxpHxEK9zOB2pGIoNMZnQnop73gDMQf+qwN2k1Dj1yGYWpdaqLS9h Fvg41D8ZWCslCLkKxr1ampDdKsqp+mmSrkjxsCt9Vo0RrRsr1P1vnGSnzsJSrlco VZtnifmueBG0qgrP7llFc9U3AFphi9amPOFcn0wtqow9ulz5xMGAFrqqyofwekkv XWkTazKkIuXFTCb4G5ZnTktQwrDrk3WnGBf5ln0tMh1I9RAP63n5uHVztq8BK8uk PnsHR50WGAa/NOvSrGw07zLokgULI4wT
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/C104846EF5A7DE33

http://decryptor.top/C104846EF5A7DE33

Signatures

  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Sets desktop wallpaper using registry 2 TTPs 1 IoCs
    ransomware
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware
  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Drops file in Windows directory 3276 IoCs
  • Modifies system certificate store 2 TTPs 11 IoCs
    evasionspywaretrojan
  • Sodin,Sodinokibi,REvil

    Ransomware with advanced anti-analysis and privilege escalation functionality

    ransomwaresodinokibi
  • Discovering connected drives 3 TTPs 5 IoCs
    ransomware
  • Deletes shadow copies 2 TTPs 1 IoCs
    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\139a7d6656feebe539b2cb94b0729602f6218f54fb5b7531b58cfe040f180548.exe
    "C:\Users\Admin\AppData\Local\Temp\139a7d6656feebe539b2cb94b0729602f6218f54fb5b7531b58cfe040f180548.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    • Drops file in Windows directory
    • Discovering connected drives
    PID:1404
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c vssadmin.exe Delete Shadows /All /Quiet & bcdedit /set {default} recoveryenabled No & bcdedit /set {default} bootstatuspolicy ignoreallfailures
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:1436
      • C:\Windows\SysWOW64\vssadmin.exe
        vssadmin.exe Delete Shadows /All /Quiet
        3⤵
        • Deletes shadow copies
        PID:1372
  • C:\Windows\system32\conhost.exe
    \??\C:\Windows\system32\conhost.exe "-2103240739-1537348966-412143755-334672013221329878-1302321046-1065545648-2100673529"
    1⤵
    • Suspicious use of SetWindowsHookEx
    PID:1960
  • C:\Windows\system32\vssvc.exe
    C:\Windows\system32\vssvc.exe
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:1484

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads