Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10_x64 -
resource
win10 -
submitted
29-07-2020 14:02
General
-
Target
681836cd8181c784646b39238d8e4d9323b91c71690894782220e2678c1f3191.bin.exe
-
Size
135KB
-
MD5
c77bd2ccabf797907546b37f1fc710b8
-
SHA1
2185a4adb041f3207320fdf80f4125d00cd135ee
-
SHA256
681836cd8181c784646b39238d8e4d9323b91c71690894782220e2678c1f3191
-
SHA512
e4585de808ac7313b7751ea91b0407628d508329cc646215e5df2af967d7c0036d3c0c9c082ad590e716b0a8fe9e64a8050364db401a3453980b9fab1eb15a21
Score
10/10
Malware Config
Extracted
Path
C:\ywh3ggtc7-readme.txt
Family
sodinokibi
Ransom Note
---=== Welcome. Again. ===---
[+] Whats Happen? [+]
Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension ywh3ggtc7.
By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER).
[+] What guarantees? [+]
Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests.
To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee.
If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practice - time is much more valuable than money.
[+] How to get access on website? [+]
You have two ways:
1) [Recommended] Using a TOR browser!
a) Download and install TOR browser from this site: https://torproject.org/
b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/8B88B78F402F5B52
2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this:
a) Open your any browser (Chrome, Firefox, Opera, IE, Edge)
b) Open our secondary website: http://decryptor.cc/8B88B78F402F5B52
Warning: secondary website can be blocked, thats why first variant much better and more available.
When you open our website, put the following data in the input form:
Key:
yXpaFQfMNTAVBQ/Xqv4V8WzjmD4tNNs1nah1468CT8fUVMvHJ0mOJ3IM0Nl9k6dt
pSL8lONBIDd93KcEYNTO7hYBEpvKJlnv5zND27k9d+awnW9ZS08q9SWzqe8tCAxv
4FU6n6iH+rR+l34xitNIxl+WxcSUN8zfPtfGo86mc0ABWzVNfwftrqHXreK25fSP
iX7RaHIBNggFnTtEF1uxgKxOkkdhUhR8dOn7OOHH9mqPNsyM/XsywGCZcp2DBkpg
iNIP7SrRUkPuHdNXcMTw1giqpq4ctCm7Em90XxdZyp9E+Do8u+0pfcN04+H9qZ+A
qtReuTRLG+kXfeN68RXtiXYKSX9fg1zpvKsH3EJtw/RE+V/KL25AfAZ7i7g+hE8q
mdkXr0BnhL3+a/ehlmbQCi2KD5eCxJG9+A8RDoFdnbiv4jb+smCVUeqJeDl3axC+
xn1sZttq0BzifyNmYCmBr0/fpcu4qoY8EithaKa8Vc/9Vm0zzIYavXZJAV8/Q4/9
69bY+YcPouuLRDCS9cgXDdvsWT/TgEJFl11fhAftWvw9KcPnaQkN7rihjszoJ3d8
S9I2bnM0q4jiUBrxHzdFY16Lnd+qqBazcFL/mi+4rwhsiGDLrSmUCSU4chZjdLpP
1AvcXqI0xhK08aDOOosR3n/CzlCZFV0ZnouNHnaSG6AqAy4y1osTNXQlwxJIv1Y8
Myh4nfrKIxYfu4eoeFtZHuhMSXMvTOwZNpbeNqqiqMB41KTEY8IiknztO4QQdIEn
a3bowI7D6ioXF8QK26cIulojdCDvRysRmXoBzeglmVUweEkMdBKJ0mq0/bmf+3tN
nwfr4qroOr4NcfMUKIkbfMSTm2ofjDoMClfl9QxD/43slJ1WjfG57xItQGcjFI8a
Q1qIizHWoUftuaYO7XJ6yC576jiASB1rS9qmdl3QB/gCi/Ti1oT5DREgtHNlc86W
WehePbsGOmRkdxeZ+qIyBJMODlu6NV7HitBMPa7cR9AKl+6q9Z4ql2HZRATb3qlg
LtpzkrhBvrQLpjN3ignjo8Qiri/hiJ7DskckThRKeXF9mmX0jlIBixFpMUwXcvHA
viAo2r9d5KC/xs5Jm3/Qtt1+9nlps4dFYt8a4hucpn5F6atT7LobzZ6yJ+cVUb13
Z01J0k7ZstBcv6qkWyVuUbOmJ8s8tAbXPaYS1yswToh/wv0cNta2G+kk/843roC4
KSFTalwvIcDPxpt53l4y44XvdCUD79j91qR4hop0nKgo0PhsxCib/9gu2dMf190+
tCK3cTjpmCQlC0B8lICkXxQcqXg+1g==
-----------------------------------------------------------------------------------------
!!! DANGER !!!
DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damage of the private key and, as result, The Loss all data.
!!! !!! !!!
ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere.
!!! !!! !!!
URLs
http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/8B88B78F402F5B52
http://decryptor.cc/8B88B78F402F5B52
Signatures
-
Sodin,Sodinokibi,REvil
Ransomware with advanced anti-analysis and privilege escalation functionality.
-
Suspicious use of AdjustPrivilegeToken 6 IoCs
-
Suspicious behavior: EnumeratesProcesses 77 IoCs
-
Suspicious use of WriteProcessMemory 2 IoCs
-
Enumerates connected drives 3 TTPs
-
Sets desktop wallpaper using registry 2 TTPs 1 IoCs
-
Adds Run key to start application 2 TTPs 2 IoCs
-
Modifies service 2 TTPs 5 IoCs
-
Drops file in Program Files directory 21 IoCs
-
Modifies extensions of user files 5 IoCs
Ransomware generally changes the extension on encrypted files.
Processes
-
C:\Users\Admin\AppData\Local\Temp\681836cd8181c784646b39238d8e4d9323b91c71690894782220e2678c1f3191.bin.exe"C:\Users\Admin\AppData\Local\Temp\681836cd8181c784646b39238d8e4d9323b91c71690894782220e2678c1f3191.bin.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- Sets desktop wallpaper using registry
- Adds Run key to start application
- Drops file in Program Files directory
- Modifies extensions of user files
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -e RwBlAHQALQBXAG0AaQBPAGIAagBlAGMAdAAgAFcAaQBuADMAMgBfAFMAaABhAGQAbwB3AGMAbwBwAHkAIAB8ACAARgBvAHIARQBhAGMAaAAtAE8AYgBqAGUAYwB0ACAAewAkAF8ALgBEAGUAbABlAHQAZQAoACkAOwB9AA==2⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\wbem\unsecapp.exeC:\Windows\system32\wbem\unsecapp.exe -Embedding1⤵
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
- Modifies service