Overview

overview

10

task1

 

10

task2

 

10

Analysis

  • max time kernel
    145s
  • resource
    win7v191014
  • submitted
    16-12-2019 10:54

Sharing

Copy URL
Twitter E-mail

General

  • Target

    06b323e0b626dc4f051596a39f52c46b35f88ea6f85a56de0fd76ec73c7f3851.exe

  • Sample

    191216-4zdx1n374x

  • SHA256

    06b323e0b626dc4f051596a39f52c46b35f88ea6f85a56de0fd76ec73c7f3851

Score
10/10
ransomwareevasionspywaretrojansodinokibi

Malware Config

Extracted

Path

C:\05vb6je9-readme.txt

Family

sodinokibi

Ransom Note
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on you computer has expansion 05vb6je9. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/566484711914F5F1 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.top/566484711914F5F1 Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: rxaK53ALfFGy4622EI7nauMFpFvcU1PxDem3WfU4QyAJmXwkVspAsecIliVlENVp ifrBlPOSfnI1YRS3ax8jcweiLJrpA4g5HCKC+hyd2P485bMkPzI0O+AcQl8lbJda NNO8Xdh5XCZ/Dd/w6r7CHOgs13AD2YmxTn/dCR5huuXX7msfVT9nHqZg0HH4faS7 XSyPg+IQXQsci5jfAOLTvx4OZ3rdQWYC/sEvJM2dxW7Y1eQozPQfU22fw2CrBf+i K20DunLT+L8SH82Wa4r/SMb7R/b10ha/zoEIu3I0jn9oEc9Jp+VrXn4B7rpuGkOU 8QzXUMZhrhgydgkxGFSNGCTcGmgKYio+2Qhc5zEpfzD3X3aMR0wKIlxwVpHjhMCQ kkEcQM2Etri2wz03mKU0gI+TGpo12E0Rvv4xT/VjK6nBMgNfD+GM6zTYfjMqTSxy cJfu7aW1ctfR2e5VFDppYqHKc98K/LHHIi834pSjEBpAT63HiWLBw3Yc/AtPm2Pb FYPrOIKxvEauTwVfnIFo/hXB/Hmm9Wh8tK/trgQ9entkLyA4a5+T5Wn8n3zWndQI mUTD2pXx4VOG7WfKDZhmEBhuQRnc+Ekh6xTYkCekYn2HGCN/Dvf2uiRdXfX/m2Er jzjcwj9ZRYFBeWDXc3R2b+8P0bqRpjuB2jsgbkC6WfrRVwLlJ7sUtUnuqnpbghl4 Zn6Cv6T0y55vm1HDhBKOcISF8H4oA9XYnFYH8ZxOqt9rKy4q+8Rq5a+Lubbq1aJ8 F6NEjxl2yoL5cp1vXT3+5NEQOoydzweabnZ65PwNFHXw7jRw6jCByoMkh2wgavAN uff56lUgaCvLoR6bzKcLRLcQMs3TfPTZxkY6SXSRL7G9Xtt2gmInVoAiD3XOVIkY +CXOdZQbDlCvmpEu7gqRHX4gpUQrEVMJzGChTXxxz7HAAKK1R7Ol5ajUiaUMUIL6 WIbmmIYP6uwM2Eb1JX18y7mgdJwoCWT0I5Loq6XzgF8PBNpjS76dpZI20CBOXLVg dv15ir6+UvG/39aItCb0BEDQ+UpaTIboQqecYe9oo6OYoTbezd5/gtEMLWHsf/xG Fw6x63qzop68tsJrPO7xgeZL2I89XvAK+FuRkBo9QlXpDniEvcPceVh8qw6BSg+Y zsscBy8PDwWG+NAm Extension name: 05vb6je9 ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/566484711914F5F1

http://decryptor.top/566484711914F5F1

Signatures

  • Suspicious use of WriteProcessMemory 2 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Drops file in Program Files directory 38 IoCs
  • Modifies system certificate store 2 TTPs 12 IoCs
    evasionspywaretrojan
  • Sodin,Sodinokibi,REvil

    Ransomware with advanced anti-analysis and privilege escalation functionality

    ransomwaresodinokibi
  • Discovering connected drives 3 TTPs 5 IoCs
    ransomware
  • Drops file in Windows directory 3276 IoCs
  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Sets desktop wallpaper using registry 2 TTPs 1 IoCs
    ransomware
  • Deletes shadow copies 2 TTPs 1 IoCs
    ransomware
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\06b323e0b626dc4f051596a39f52c46b35f88ea6f85a56de0fd76ec73c7f3851.exe
    "C:\Users\Admin\AppData\Local\Temp\06b323e0b626dc4f051596a39f52c46b35f88ea6f85a56de0fd76ec73c7f3851.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    • Drops file in Program Files directory
    • Discovering connected drives
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    PID:1440
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c vssadmin.exe Delete Shadows /All /Quiet & bcdedit /set {default} recoveryenabled No & bcdedit /set {default} bootstatuspolicy ignoreallfailures
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:1132
      • C:\Windows\SysWOW64\vssadmin.exe
        vssadmin.exe Delete Shadows /All /Quiet
        3⤵
        • Deletes shadow copies
        PID:2024
  • C:\Windows\system32\conhost.exe
    \??\C:\Windows\system32\conhost.exe "-115631094316172553599345339094646428935143215812363921851982921620-1098032287"
    1⤵
    • Suspicious use of SetWindowsHookEx
    PID:1108
  • C:\Windows\system32\vssvc.exe
    C:\Windows\system32\vssvc.exe
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:2016

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Install Root Certificate

1
T1130

Modify Registry

2
T1112

File Deletion

1
T1107

Credential Access

Discovery

Query Registry

1
T1012

Peripheral Device Discovery

1
T1120

System Information Discovery

1
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Defacement

1
T1491

Inhibit System Recovery

1
T1490

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1440-0-0x000000000090B000-0x000000000092D000-memory.dmp
    Filesize

    136KB

    Download