Overview

overview

10

task1

 

10

task2

 

10

Analysis

  • max time kernel
    134s
  • resource
    win10v191014
  • submitted
    09-12-2019 16:34

Sharing

Copy URL
Twitter E-mail

General

  • Target

    74bc2f9a81ad2cc609b7730dbabb146506f58244e5e655cbb42044913384a6ac.exe

  • Sample

    191209-5gbby7dm12

  • SHA256

    74bc2f9a81ad2cc609b7730dbabb146506f58244e5e655cbb42044913384a6ac

Score
10/10
ransomwaresodinokibievasiontrojan

Malware Config

Extracted

Path

C:\odt\ufb125ez-readme.txt

Family

sodinokibi

Ransom Note
Hello dear friend! Your files are encrypted, and, as result you can't use it. You must visit our page to get instructions about decryption process. All encrypted files have got ufb125ez extension. Instructions into the TOR network ----------------------------- Install TOR browser from https://torproject.org/ Visit the following link: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/63D19F775FDBEFBB Instructions into WWW (The following link can not be in work state, if true, use TOR above): ----------------------------- Visit the following link: http://decryptor.top/63D19F775FDBEFBB Page will ask you for the key, here it is: RB4CDaV1up1wXlrfbEdj+BOPzVBTdqVAoPEkzqol6RUe57e/4Pwn0RkcSlBrOSWI kmobrR4n43tWdfvEtF2ysUz3roaYhyrQkIYU61SIChtKzS/4pbY/wQjoNfrtPErl zf5SZFkRCM6mG4YkG2KI3Bgew0HsMh2cTwe5bsKeZra+tjW0vQWuHYGp1/9x6ecd 2fJERfmwllXlCRJDYpfW5v3dQxv5sAlJWaRCvIbnMsydA2jTCVHI8YB6XxluH4BY Gw6aoYLqULyeQWW+BBbDYrNIHOay9TydHhZbJ2+vBPjSmHHZ7/0BVIZC4aUVe4wu J+XcGb+1FMjoYLvj181tblEyr0RpoHsVe3HGNo5TA9D/nJI3kCXpDu1L9uGseh/L 1XXBsgExTPFHfi3SA1fmIHjBXoWYrEhoTV80tlXKurgPp7ztaiczLbKSvTm4gNoR 9p5uizpNTwMX9Ru1TQCd2Gul+dHIJnlezRnhZND+HQ/xi/mP/yELXOHZVb8xeSUJ B2QS6ADj1y8klt/TRdopAYacaQwr4ZOLNwTRcy3OH7WwmRFG9+sz8pGNi3xnnpEz tlh/7g3hWXSKpLEgpJxe9O6J3+qY57gSzZGLp0XsHiF5+VbkOjBafdSnrcg8dsH7 ahR/Kl5CdhumyL35xKyyzjheTrCwsXDnb+yZOhTFZOCsIKg+wCzcivm2AZ9RJruu HIlGCbrvYRbmK/yKPbM83D362NlAsl6BdEBqv1xSezxD+qyaDQfL1Q367O/aE9X5 n8cKK455B0FRH89KJIn2ei56Roae1VuQRMrohMOKzyqqsKHf7YV1SXNzPMOwuuqx j5lJpWiX0FERtRMBu7Caouu3aAbUKTj0cjqT26RGy2TKyM+1x7lWppS9gbxMTG3B v5tTupR8laagk3KjvF7eFD5ngo7N42cEfBuG0ErBUtEkvJsU4/A3H/UZ4UVtC7IV 4NEHDJsU1AJaVO4UjQrB8IDuaAn/ZbfiyjhGScMfgKWcpSEfEqHLzT42AlcLYM5y 14XSwVFabNT+XPJrhgnH2X8Jyf+IlhMMAb79uF3JATPJPZmwcx0iA0zOYZ2AVrdw pS6EXwjv
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/63D19F775FDBEFBB

http://decryptor.top/63D19F775FDBEFBB

Signatures

  • Checks system information in the registry 2 TTPs 2 IoCs

    System information is often read in order to detect sandboxing environments.

  • Windows security modification 2 TTPs 2 IoCs
    evasiontrojan
  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Discovering connected drives 3 TTPs 6 IoCs
    ransomware
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware
  • Deletes shadow copies 2 TTPs 1 IoCs
    ransomware
  • Drops file in Windows directory 2109 IoCs
  • Sets desktop wallpaper using registry 2 TTPs 1 IoCs
    ransomware
  • Suspicious use of WriteProcessMemory 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Sodin,Sodinokibi,REvil

    Ransomware with advanced anti-analysis and privilege escalation functionality

    ransomwaresodinokibi

Processes

  • C:\Users\Admin\AppData\Local\Temp\74bc2f9a81ad2cc609b7730dbabb146506f58244e5e655cbb42044913384a6ac.exe
    "C:\Users\Admin\AppData\Local\Temp\74bc2f9a81ad2cc609b7730dbabb146506f58244e5e655cbb42044913384a6ac.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Discovering connected drives
    • Drops file in Windows directory
    • Suspicious use of WriteProcessMemory
    PID:4988
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c vssadmin.exe Delete Shadows /All /Quiet & bcdedit /set {default} recoveryenabled No & bcdedit /set {default} bootstatuspolicy ignoreallfailures
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:4268
      • C:\Windows\SysWOW64\vssadmin.exe
        vssadmin.exe Delete Shadows /All /Quiet
        3⤵
        • Deletes shadow copies
        PID:3980
  • C:\Windows\system32\SppExtComObj.exe
    C:\Windows\system32\SppExtComObj.exe -Embedding
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:5072
    • C:\Windows\System32\SLUI.exe
      "C:\Windows\System32\SLUI.exe" RuleId=eeba1977-569e-4571-b639-7623d8bfecc0;Action=AutoActivate;AppId=55c92734-d682-4d71-983e-d6ec3f16059f;SkuId=2de67392-b7a7-462a-b1ca-108dd189f588;NotificationInterval=1440;Trigger=TimerEvent
      2⤵
        PID:5100
    • C:\Windows\system32\vssvc.exe
      C:\Windows\system32\vssvc.exe
      1⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:4252
    • \??\c:\windows\system32\svchost.exe
      c:\windows\system32\svchost.exe -k netsvcs -s BITS
      1⤵
      • Discovering connected drives
      PID:4904
    • \??\c:\windows\system32\svchost.exe
      c:\windows\system32\svchost.exe -k localserviceandnoimpersonation -s SSDPSRV
      1⤵
        PID:4888
      • \??\c:\windows\system32\svchost.exe
        c:\windows\system32\svchost.exe -k netsvcs -s DoSvc
        1⤵
          PID:3300
        • \??\c:\windows\system32\svchost.exe
          c:\windows\system32\svchost.exe -k unistacksvcgroup
          1⤵
            PID:452
          • \??\c:\windows\system32\svchost.exe
            c:\windows\system32\svchost.exe -k localservicenetworkrestricted -s wscsvc
            1⤵
              PID:1356

            Network

            MITRE ATT&CK Enterprise v6

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            • memory/4988-107-0x00000000024A0000-0x00000000024A1000-memory.dmp

              Filesize

              4KB

              Download