Overview

overview

10

task1

 

10

task2

 

10

Analysis

  • max time kernel
    99s
  • resource
    win10v191014
  • submitted
    22-01-2020 14:49

Sharing

Copy URL
Twitter E-mail

General

  • Target

    0fa207940ea53e2b54a2b769d8ab033a6b2c5e08c78bf4d7dade79849960b54d

  • Sample

    200122-dcjzw4d3w6

  • SHA256

    0fa207940ea53e2b54a2b769d8ab033a6b2c5e08c78bf4d7dade79849960b54d

Score
10/10
ransomwaresodinokibipersistence

Malware Config

Extracted

Path

C:\odt\5c4y31391w-readme.txt

Family

sodinokibi

Ransom Note
Hello dear friend! Your files are encrypted, and, as result you can't use it. You must visit our page to get instructions about decryption process. All encrypted files have got 5c4y31391w extension. Instructions into the TOR network ----------------------------- Install TOR browser from https://torproject.org/ Visit the following link: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/B03990EDA5488E8D Instructions into WWW (The following link can not be in work state, if true, use TOR above): ----------------------------- Visit the following link: http://decryptor.top/B03990EDA5488E8D Page will ask you for the key, here it is: KxrzNMNEpc3UFOC9RXd7HkZTpI0SlL2NhuP3/otbitxGNcpREvU7/aiVrsqMjl9G 55QSbWcH/5MIEH9eUJq/oBV06Lt2qs0aOwuKLvVp4lRGVYoNJ+hJT9BaaPyUx+/z a7HjAPo371VcNnmdfLiCtgf9O030HqZKEipJZtDFGSluvcNUZZb5qWBNwQp26/lH vkQsYYdgA7FzPd+yVdMKgfa5GICoO3rcOiY7+pCsq1VvdjlE7ruKQ3G4KUYcAyxm rM0g+fkkTYNl5gosGPy0ApA+rD9wVgOBtPT/FODfCcOCdH3iuuzbqUrd+IMPs2e6 mVaJw1iLHlHVffcs8xbwJ4Cve52Ncm11XrS9vkSTFH5Le2K6IxBu6Uq9RaYR0LRj ATuPuUHpvvKp5q30kwaqaTSwKlyll4HRT+aLjvG/pDaiom/lr9L5dsVeBQAx4MpS YkxbaFTYP+MdbvJHs/HFRQqBlAzHmXqNhMTNyJO0pAFrA+R4pWzSKiDJ7Fqj+c5W MNtVgsYM4BdfFsSL7b8WyKxdnhjqgz+mRc2mDAaQ2wLqY+9mROtHWN458RQB2nqv fWN6Ex/MhjQzvcCLoVW7j44P51t2kWiVMHDnThH+hQTz5da9JZ8b/b9gzFAAAO4Y TRL7o/FdONdJQG5+ncsVNq31klRlsEjrPIHRajRSXZ4RbAvYolJ1ms0ouQY4m520 f8x7KJoxRnjZCgBarJwQYNY2Q4v5oiE/choRZ7uIOfIhTejBXThCxqixhvj1vDsQ 1r57T9wCOqJPCo4SLU1/tLpLxqXLRDBXI4CgFbjtcDap9YCzzuZ/1CbYc1p+3PMK 2XLbFNJ2ofcZQx9hk2wOzErrkV1aUooLdFXSrdDkIZuem2kmLi+g0uq05N3bMGZp pGRK7dv3WDzI9D01waIPgbUORVtqpvyRoqrjBwuBgNs5ujCLVRKqFPXHUIfWQfWb lAxnSmpso22Lq6kyqkXdXw2dvMann8lRYqiSv31iaN+MllqEGBmSSAujT7iZLryz oa98Tw0tqezf55DF++O3KzmworLoOWCvF/jauGRmTP/TQ8CypaJZhjha6Hb86HnG kYW/zZKg
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/B03990EDA5488E8D

http://decryptor.top/B03990EDA5488E8D

Signatures

  • Sets desktop wallpaper using registry 2 TTPs 1 IoCs
    ransomware
  • Sodin,Sodinokibi,REvil

    Ransomware with advanced anti-analysis and privilege escalation functionality

    ransomwaresodinokibi
  • Discovering connected drives 3 TTPs 5 IoCs
    ransomware
  • Deletes shadow copies 2 TTPs 1 IoCs
    ransomware
  • Drops file in Windows directory 2108 IoCs
  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Modifies service 2 TTPs 4 IoCs
    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\0fa207940ea53e2b54a2b769d8ab033a6b2c5e08c78bf4d7dade79849960b54d.exe
    "C:\Users\Admin\AppData\Local\Temp\0fa207940ea53e2b54a2b769d8ab033a6b2c5e08c78bf4d7dade79849960b54d.exe"
    1⤵
    • Sets desktop wallpaper using registry
    • Discovering connected drives
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:5044
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c vssadmin.exe Delete Shadows /All /Quiet & bcdedit /set {default} recoveryenabled No & bcdedit /set {default} bootstatuspolicy ignoreallfailures
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:3976
      • C:\Windows\SysWOW64\vssadmin.exe
        vssadmin.exe Delete Shadows /All /Quiet
        3⤵
        • Deletes shadow copies
        PID:4612
  • C:\Windows\system32\vssvc.exe
    C:\Windows\system32\vssvc.exe
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    • Modifies service
    PID:3652

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/5044-0-0x00000000007CB000-0x00000000007E9000-memory.dmp

    Filesize

    120KB

    Download