Overview

overview

10

Static

static

10

139a7d6656...48.exe

windows7_x64

10

139a7d6656...48.exe

windows10_x64

10

Analysis

  • max time kernel
    147s
  • max time network
    149s
  • platform
    windows10_x64
  • resource
    win10v200430
  • submitted
    17-06-2020 12:45

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    139a7d6656feebe539b2cb94b0729602f6218f54fb5b7531b58cfe040f180548.exe

  • Size

    157KB

  • MD5

    b488bdeeaeda94a273e4746db0082841

  • SHA1

    5dac89d5ecc2794b3fc084416a78c965c2be0d2a

  • SHA256

    139a7d6656feebe539b2cb94b0729602f6218f54fb5b7531b58cfe040f180548

  • SHA512

    2b62f0e0b017ed3d2dc7103d2020604f15f95449ba842bba18f886f9e1dcc977c459c53d1e6e7abfe6b99fc3dde24f5cc7a848c92443d1daf3574ef6f0263284

Score
10/10
ransomwarespywareevasiontrojansodinokibipersistence

Malware Config

Extracted

Path

C:\odt\ft1f70ek6.info.txt

Family

sodinokibi

Ransom Note
Hello dear friend! Your files are encrypted, and, as result you can't use it. You must visit our page to get instructions about decryption process. All encrypted files have got ft1f70ek6 extension. Instructions into the TOR network ----------------------------- Install TOR browser from https://torproject.org/ Visit the following link: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/B27EB9CE81FBDF32 Instructions into WWW (The following link can not be in work state, if true, use TOR above): ----------------------------- Visit the following link: http://decryptor.top/B27EB9CE81FBDF32 Page will ask you for the key, here it is: TXk0I4eYGzGSKHXX7ohor7JegrwVMODrCYk8olaqaSdFFBsbe7j5z2UNYzZm6mXH 5Btp/Fnwj4Ula2xkaSUPUgDq8YieXtmlP7WwM42HP7HN2T3Re1oI7qGnLogXsYpn BG3SEbxRIZPE8FbVSjyLaBE/QsgPAfEGaGpefKqeDjH314FKx9TC+OQv6nhGMobw crSJCS2uQtudq8OAtmX5A1JmWZaquAUPtCTfN2ekqyeg4EWbL0l3mZrj3VAtm3XX MHcyQdfee1ETnigu/GHkSwWJbEn36Hqx31K4I6sGZF7db6zNGWvz6+gtrSh6jjWS iWasG401XqQwVxMSMcj4ppnf63QdgnDdqeQvlqtI+6crmopRf7Br20vbvXDzJzmd yiwb3HDk/2ci6W8hj7c/x9kgTjV7N4srfwqC0Dn7pk7AKglad1NWEj4Ld576swCe 61Fy2kI6OGNl/XVPd5RTgBnrOhrLh6Ireg39BPmS1BEPP1bcuKrjbP7Vuz1OP3nd GNu/jrEp9tAsEf5JpL7dVE2n+ho2XTZ65lYuqr5qhyClSeCdeTVnCLRBpxpmqZKa AK0ZVBXD/nKzdF5yvThMGBaUYJ6+Ulr+w6cA80hG3eqpRoVuyy/HAreiQ2b8kLLo 0HLxws9dZ8w2SqSEoQw7qPPtn64+Md3cI5R1IFNraUxmGmrSE5wLdSrujUWQlCpT JLi7HDI/zvIlPCYaywDoIDiTd8hxBKuK87r3gQTKJP5cZWYgVHsJ/CmJiUf5xUyq nsOeAlKEmQiF/HkXWuBAI4mKNsxa4AvYJgXCsXrNJglUJP0th4X1oZ5mA50+wvTW bO/WJND2Clm5A0P9/9q6ua7V4Tq4jxBEC+u9b4r89LE+8u8EC/33ALa1iImX14Cw xaPmv0+pTSNnQ0U1uTvXIj30XdKsv1KR+q6EXFMCaewU9meM6edXQ5hA7wFoNxXn IPsaZiIdubCqcpBf7K745mUdPdN/JdauzuK3m2POlx3h7SI6ZYJ/TcQko0wT/IBx PxFF7N+X1GO+9Ad8SKJLnQUIHgsUkaZRDwqXz+3PdfrdrLAjzAggG5QN59KsE049 WlzMhtBAKGY=
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/B27EB9CE81FBDF32

http://decryptor.top/B27EB9CE81FBDF32

Signatures

  • Interacts with shadow copies 2 TTPs 1 IoCs

    Shadow copies are often targeted by ransomware to inhibit system recovery.

    ransomware
  • Drops file in Windows directory 2108 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spyware
  • Modifies system certificate store 2 TTPs 5 IoCs
    evasionspywaretrojan
  • Enumerates connected drives 3 TTPs
  • Modifies service 2 TTPs 4 IoCs
    persistence
  • Deletes shadow copies 2 TTPs

    Ransomware often targets backup files to inhibit system recovery.

    ransomware
  • Sets desktop wallpaper using registry 2 TTPs 1 IoCs
    ransomware
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Sodin,Sodinokibi,REvil

    Ransomware with advanced anti-analysis and privilege escalation functionality.

    ransomwaresodinokibi

Processes

  • C:\Users\Admin\AppData\Local\Temp\139a7d6656feebe539b2cb94b0729602f6218f54fb5b7531b58cfe040f180548.exe
    "C:\Users\Admin\AppData\Local\Temp\139a7d6656feebe539b2cb94b0729602f6218f54fb5b7531b58cfe040f180548.exe"
    1⤵
    • Drops file in Windows directory
    • Suspicious use of WriteProcessMemory
    • Modifies system certificate store
    • Sets desktop wallpaper using registry
    • Suspicious behavior: EnumeratesProcesses
    PID:908
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c vssadmin.exe Delete Shadows /All /Quiet & bcdedit /set {default} recoveryenabled No & bcdedit /set {default} bootstatuspolicy ignoreallfailures
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:1496
      • C:\Windows\SysWOW64\vssadmin.exe
        vssadmin.exe Delete Shadows /All /Quiet
        3⤵
        • Interacts with shadow copies
        PID:1648
  • C:\Windows\system32\vssvc.exe
    C:\Windows\system32\vssvc.exe
    1⤵
    • Modifies service
    • Suspicious use of AdjustPrivilegeToken
    PID:1888

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads