Analysis
-
max time kernel
141s -
max time network
157s -
platform
windows7_x64 -
resource
win7v200430 -
submitted
20-07-2020 18:31
General
-
Target
34a813a1016a70161b66e00c628d9eddb97ecfa78e2272de2e7e86f8c981a9e9.bin.exe
-
Size
115KB
-
MD5
d3808c0b73390ac85758fa35fa7f7f3a
-
SHA1
c8bc0c32a7155e547773d1df419915e5bfffcf2f
-
SHA256
34a813a1016a70161b66e00c628d9eddb97ecfa78e2272de2e7e86f8c981a9e9
-
SHA512
10daf9b0030a8ef49e9a2f69ae0f7b489e1e1a35ac374f20f26859669924c9b0d079da94f6152e0d517b3e63aa1d215197f571196331e6a2b1df19b888cc7fb2
Score
10/10
Malware Config
Extracted
Path
C:\4o02a-readme.txt
Family
sodinokibi
Ransom Note
---=== Welcome. Again. ===---
[+] Whats Happen? [+]
Your files are encrypted, and currently unavailable. You can check it: all files on your computer has extension 4o02a.
By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER).
[+] What guarantees? [+]
Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests.
To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee.
If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money.
[+] How to get access on website? [+]
You have two ways:
1) [Recommended] Using a TOR browser!
a) Download and install TOR browser from this site: https://torproject.org/
b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/2F06AC9FA31C1D27
2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this:
a) Open your any browser (Chrome, Firefox, Opera, IE, Edge)
b) Open our secondary website: http://decryptor.cc/2F06AC9FA31C1D27
Warning: secondary website can be blocked, thats why first variant much better and more available.
When you open our website, put the following data in the input form:
Key:
0W7eCUg0VltpgpaJeiIxwxNnJk/K27PIESVCZiDF00Mu5GXJTpdLkIlnMqjoR27k
76Sh0V01fY5gzdZS4pKb2KM6e+OS+VjXqXOWwb4HuGO5rKAgnEId/Vyj73wi10bg
3BziEFSKt/mkeULEz+uI+F4+kOihTr6NSAJ+Ga1K2WnlA5fxUY+Mkp1X5FrhKoRU
S0e8gcYMtWPWu+koZCATuQQugyLGarRCvF/IRHmci/SKNyLPSKEGPbG1JKFH3KJe
1Tiy0St/8jjI6vMRNrnLmHlOFNHb7qUs1VG7BcvGIQE5waa8+B1aVcdV/M3EzbU4
zUvKbA0EBtnIMueTBmxtWTKPY+TEqZ61rO/yzt7/15WMAf+LV20iTnXcjs1QSnhA
VO+1el6j2fvdLgpdQO/w215ckDwyL0TJyue+p7GlB0PDeKcFH1gI6iMbPXMvpE0q
2FN8dwCD3m1A2tcMWBszwNK9OCQhWsZ8ZfO1yiJKMw5uC53nsNN5yb3vvgRZoETT
uv2cfT08y+X4H75IZLeVf1KJFx1iWJQfAfLY1Xx1W844XEOlmnv7ChOIZOZwWnH9
S+gNvGchkLkSAusMRn05pu6ipKvwg4IlvqMD4oJqeel/in7s58CWwaWKQFJ0Z30O
Z/uZ866Hjcf03Xa57MMvOKOa4YxIXBfKVDG3Iht5UmiWyP5ZvAFq7lJ3xWtYgK1T
GLHDE49NISX3nm96OLBUc3HSBHud7ZH9nLpYcdymdP7gYWuudO22wr4LrKywz5lI
Rf7C85AlJk3jf8zkS4u0KJjXZCu9c6LY2+8R1kHOlNys/2GjZrZLSnaMzhh4zFgI
L9eufOBhzBEdtKSOSG3rZfm0s6EFBw7wM40tGJcXF0Z35mO7XgmQPUnzLud7qMoX
nrmx8fm7L7JhmGcOlVphvcgz8Gy5XTd95DdMWKnRsUWQZdTyisgjK8LUSg7kjTf2
oI3IjjsOHJ81ZCpjK3xy1m1ILA5eaARNToyOmlV9TX2wcVzrbOVFsworiYXzbDuZ
bkKqpCZ4qPS1xmpWwHpqiakqiBJrXuS/c9JF+bK5mkhrjEvZGc+i34fX0PmAE1wm
aXsF4liGwUjkIQaBpNVJAIudwwH+fjPBoKw6RqVZunPmFEprjfJYOU223BZABPnx
ykI8xel3bkpD7wJBYNNrACuWEJH5i6CfXNGc4d+yYhnoyHGArBf/DLptMQCgwaax
x/q23B+nfDi4WUNHkUBLhwF+g2yoQB7rbIKZ2FBZe1o1Uw2nx0Jxnn0H1RWJEVx6
eN+cgcnkT8cxLflaYG5SMKFU8eMZ0MhMwV2rBI/t
Extension name:
4o02a
-----------------------------------------------------------------------------------------
!!! DANGER !!!
DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data.
!!! !!! !!!
ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere.
!!! !!! !!!
URLs
http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/2F06AC9FA31C1D27
http://decryptor.cc/2F06AC9FA31C1D27
Signatures
-
Modifies service 2 TTPs 5 IoCs
-
Drops startup file 1 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
-
Enumerates connected drives 3 TTPs
-
Modifies system certificate store 2 TTPs 6 IoCs
-
Sodin,Sodinokibi,REvil
Ransomware with advanced anti-analysis and privilege escalation functionality.
-
Drops file in Program Files directory 42 IoCs
-
Sets desktop wallpaper using registry 2 TTPs 1 IoCs
-
Drops file in System32 directory 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 6 IoCs
-
Suspicious behavior: EnumeratesProcesses 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\34a813a1016a70161b66e00c628d9eddb97ecfa78e2272de2e7e86f8c981a9e9.bin.exe"C:\Users\Admin\AppData\Local\Temp\34a813a1016a70161b66e00c628d9eddb97ecfa78e2272de2e7e86f8c981a9e9.bin.exe"1⤵
- Drops startup file
- Suspicious use of WriteProcessMemory
- Modifies system certificate store
- Drops file in Program Files directory
- Sets desktop wallpaper using registry
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -e RwBlAHQALQBXAG0AaQBPAGIAagBlAGMAdAAgAFcAaQBuADMAMgBfAFMAaABhAGQAbwB3AGMAbwBwAHkAIAB8ACAARgBvAHIARQBhAGMAaAAtAE8AYgBqAGUAYwB0ACAAewAkAF8ALgBEAGUAbABlAHQAZQAoACkAOwB9AA==2⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\wbem\unsecapp.exeC:\Windows\system32\wbem\unsecapp.exe -Embedding1⤵
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Modifies service
- Suspicious use of AdjustPrivilegeToken