Overview

overview

10

Static

static

10

ffe7fe4532...95.exe

windows7_x64

10

ffe7fe4532...95.exe

windows10_x64

10

Analysis

  • max time kernel
    137s
  • max time network
    137s
  • platform
    windows10_x64
  • resource
    win10v200430
  • submitted
    06-05-2020 20:33

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    ffe7fe45327645a48ca83b7dd4586de22618206001b7a7354d9d285e0308f195.exe

  • Size

    115KB

  • MD5

    63a945da1a63a8e56e8220c4ccf7fd0c

  • SHA1

    a99cf1a2426edeac97c789d0a4b7d38606d7aa45

  • SHA256

    ffe7fe45327645a48ca83b7dd4586de22618206001b7a7354d9d285e0308f195

  • SHA512

    34006d84587ea90e243ebe0dd6bde8bd502ed688001a412898cd4e4c16a5de5788a9fa4c53d3ea79e4307adaa74496e05b205bf9717ac833db976551b1a7c89c

Score
10/10
ransomwaresodinokibipersistence

Malware Config

Extracted

Path

C:\5h048-readme.txt

Family

sodinokibi

Ransom Note
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension 5h048. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). We have copied financial files and other important information about personal data, it will be published on the Internet or will be used against you if you do not pay us, so if you do not want such consequences as customer churn, media coverage, fines like GDRP and other damages, we recommend you to contact us and pay the ransom. [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practice - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/BC069A7E158C2157 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/BC069A7E158C2157 Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: JTHI8Qzg728y6dyTwFzFLGQ0xqoOex1x9FRmMn7ZLgjeVORd23hkMcQdsR9rwd9+ GyfsLYqpp6RExyXKatkEmvv3rD/hTkZAIgCf5ZhlQdWpn2AxpRhT4PbNyCkjhKqo GhBWeAc2vOUDhCzrzkxv12xH/99y4sc+MYs+9COzAqNoLbJg+L1BhbAYkgq4lz5G cpjRoG3T74kpO8sp2ek34u/VNPYTv1lmk/XFHSgYeXtEVcBS4trWOdalWh2IbJ09 RFvwndqPTqHci74/BC6mzQMt9MohhpxxCYbJQV3Iljflxz8SOmHNddoTyYI/XCx6 UgzhQJQPb3lkMjF4dexVxWUKJaNQxQGvgRTPZ73n6punIfmGgRs9EfqMRb+pD5D1 f+M+4j8qGPBXfoEfCa8yatuLvNHJzl6EJXxFNVwMTUP2Te8aXFShBOAei9AnP/6A ZxBR95hzjxakCP5/oTlFZ+8k2R3wRxJWzCcHw0rKDtjqBewcH1TVNisL24VvsXop 9201B8OxS0EkjhXKL/i8HDYYtyjODLGJ+4C2u5jCRR2rIsr166reIF3fo6twbCpK z+7T28wUjjrdaaBQaOnrP0Rn5nQw+0t6bw4AJViOrzFjX+pl2FunwXMyNecipM0U 4/3rTwqj+uqOYv7MFTy4AmG10E9vihrBu8Oj5sQkSJcJ1CFuXzhFgUzu1w/1Fn2K dj7Zy01BQoB1A8/9J37qTB2k/vsCaiyoausqPpua7ed64ARh5lKpqSZOmsrB5bq4 5lGTFWifQ8STDGzBqP3/6otYgRdvBIxmR/lCUnzercyyaPiUiCHkg1gcCD3cUcjy LnwszsITJunnM0FgdgxreGa7t32JcOE2DmPzuSV6lCb3AMjAeW9ZYUx9fE4+Ti8y 28E51HenLDkgBry81WcRDSIMsQQ9LrJnS4kcPtWPMQEujtD0/vKqZtFVpYjARSCD e9s29Hm1B67h32sEqxs28XaiRm9NYX1d1JNwnG+yOWfnBa3/Tt4ZKRULmMOIVZhx Z79C4UetaJAc6HEu+VioYj9PKU3Xgf38X28qpcfM77Gx4TX4RjJrADilbbFKUBzM 6l0aVrcej0/M2mSnywUBth+pOdLRGebVbPqhtZimkpbDu705ouRS3L5zoNmAWlob 7mgw0u77H1GyXIPzmxVSj1SMUtcY2sf4vqEa3e0JcmMs2zLXERpcJyLkxQh7j+x0 ud5/UyJVP4CQK2vaAbZO4i+IEs253VrX8V0iRwEB1qmDO94tiZFyEYl+3ijciSDg BIzJ1f5KRQXhUZHbzFU= ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damage of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/BC069A7E158C2157

http://decryptor.cc/BC069A7E158C2157

Signatures

  • Sets desktop wallpaper using registry 2 TTPs 1 IoCs
    ransomware
  • Sodin,Sodinokibi,REvil

    Ransomware with advanced anti-analysis and privilege escalation functionality.

    ransomwaresodinokibi
  • Enumerates connected drives 3 TTPs
  • Modifies service 2 TTPs 5 IoCs
    persistence
  • Suspicious use of AdjustPrivilegeToken 6 IoCs
  • Suspicious behavior: EnumeratesProcesses 77 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs
  • Drops file in Program Files directory 14 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\ffe7fe45327645a48ca83b7dd4586de22618206001b7a7354d9d285e0308f195.exe
    "C:\Users\Admin\AppData\Local\Temp\ffe7fe45327645a48ca83b7dd4586de22618206001b7a7354d9d285e0308f195.exe"
    1⤵
    • Sets desktop wallpaper using registry
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    • Drops file in Program Files directory
    PID:1492
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -e RwBlAHQALQBXAG0AaQBPAGIAagBlAGMAdAAgAFcAaQBuADMAMgBfAFMAaABhAGQAbwB3AGMAbwBwAHkAIAB8ACAARgBvAHIARQBhAGMAaAAtAE8AYgBqAGUAYwB0ACAAewAkAF8ALgBEAGUAbABlAHQAZQAoACkAOwB9AA==
      2⤵
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious behavior: EnumeratesProcesses
      PID:1804
  • C:\Windows\system32\wbem\unsecapp.exe
    C:\Windows\system32\wbem\unsecapp.exe -Embedding
    1⤵
      PID:2028
    • C:\Windows\system32\vssvc.exe
      C:\Windows\system32\vssvc.exe
      1⤵
      • Modifies service
      • Suspicious use of AdjustPrivilegeToken
      PID:2880

    Network

    MITRE ATT&CK Enterprise v6

    Replay Monitor

    Loading Replay Monitor...

    Downloads