Overview

overview

10

Static

static

10

evil.exe

windows7_x64

10

evil.exe

windows10_x64

10

Analysis

  • max time kernel
    149s
  • max time network
    149s
  • platform
    windows10_x64
  • resource
    win10v200722
  • submitted
    05-08-2020 12:35

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    evil.exe

  • Size

    157KB

  • MD5

    cbf729eace9735977cf545be8f37a28f

  • SHA1

    a247e58c2671283b0889db953af284517d75668b

  • SHA256

    80bbe933cc68fd5837b0ba84f17b9f796918125c52321d3d504468e837239765

  • SHA512

    115f1f3ae9900eda0d1c19fdb7b7a35d0cf4392831a54190c9c51ffe67463f888a58a4ce4edfd8cea72bd4359be755e82f5b1a6d1ccc2a324b8db37e95b32bb9

Score
10/10
ransomwaresodinokibipersistencespyware

Malware Config

Extracted

Path

C:\odt\mof2o3o9.txt

Family

sodinokibi

Ransom Note
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on you computer has expansion mof2o3o9. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/703CE496AE2B5312 c) Open our secondary website: http://decryptor.top/703CE496AE2B5312 When you open our website, put the following data in the input form: Key: 4Tp+nyyx4itIIconZFLf3FRpSG05PprHLeYIQAjLoyw0B9t5h87Dl/tz2SNnF1hg 71lUOSTchBqQDqIyUHSZ+qisyLBk9nyZfj3FhFSl/QS1DmaDpZzFLZMxHHGVLDMK NoMDFJUYncQlaSs++/zH0odDRrNqKqmiDhX6GlIYtg7iSmJPM8x04pckoa2yvmi3 1MUyCi3SLoSDbHF0/NRULNh6xEhLJgqFceFfPOT/i7myQrhFpKlRZX61EQ3XbNCs BwBsUfjGyEWqBica0JIn6c4vbFMaFlwUxqN4y9l0d70Ae4Ub05mCBqxE77uLLljH mdeoG7fnYqXMpMXW0hJPuWi2aHiUYshup2P/CGwXc7evZtsbisxg/ksuq2nh+mRT prHhRAyP4xu9NI8Bcx6Wb0BLg9TclUTPvJwVLKxH1afm0iHD+zzrHsDh8yah9UGg ++wFWRxKX5rIPS+drIOg6DhoHgnH5Fe4FqoeLA5U91XKrTs3gN8PFg9BCky+TxgV bmW1ry6B24SJfc+0z2TnP3M3oiAES+Yr1LJGdtNpPUjwZxohUNbqcoDH5KCQgX+b MSSmNk+C0WZdOmjqZHUgkJZzLpAUkMf4wqfO35PM/SgIeoGZrNt+KYMaxPnJcStU zpppiMs+i1HIdTHsU9eF+BoK6TcfzP8DkXlZA1wYkNcuU06ZepvbAaJVspa/Qoa7 yv7B1ODR5Gp2NykFs3YqyScv50hOam/dGojtvRHC3NCwHeCHpTVQg3KW4ZRDGPNR Rz7wFJrqBFQD+BD0sabCwFL5hi2G6eVj99Bcu5yYYdzcSLpPAcnqiW+KbZTyfCDO sy4PjEPmAt9GEOXXEyEXNDg5mTMumoU8jx8LInN6F5h4KCAamLI9daO7bM+3pU69 mJUiQobsxN0n8X3NsiCCVlqYKqP+2njVQFpVKB4SdkHRcWjLtgqn+AVW20QVosxT kMU/uIy7JM+frv04Pz9TFM6ROzOVmBJhMnqKqxtsBiC0nnxps9gR6I8109Mh/pSG NZfbYZVqgg5Nb96U3RHxjSx91F7ImPfjuJvv0gtj1reuErBUtkmr50z/bcmM5pF0 Pp87Xg1PHS84rQ== Extension name: mof2o3o9 ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/703CE496AE2B5312

Signatures

  • Modifies extensions of user files 4 IoCs

    Ransomware generally changes the extension on encrypted files.

    ransomware
  • Suspicious use of WriteProcessMemory 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Sodin,Sodinokibi,REvil

    Ransomware with advanced anti-analysis and privilege escalation functionality.

    ransomwaresodinokibi
  • Interacts with shadow copies 2 TTPs 1 IoCs

    Shadow copies are often targeted by ransomware to inhibit system recovery.

    ransomware
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spyware
  • Deletes shadow copies 2 TTPs

    Ransomware often targets backup files to inhibit system recovery.

    ransomware
  • Sets desktop wallpaper using registry 2 TTPs 1 IoCs
    ransomware
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Enumerates connected drives 3 TTPs
  • Modifies service 2 TTPs 4 IoCs
    persistence
  • Drops file in Windows directory 2108 IoCs
  • Modifies system certificate store 2 TTPs 2 IoCs
    evasionspywaretrojan

Processes

  • C:\Users\Admin\AppData\Local\Temp\evil.exe
    "C:\Users\Admin\AppData\Local\Temp\evil.exe"
    1⤵
    • Modifies extensions of user files
    • Suspicious use of WriteProcessMemory
    • Sets desktop wallpaper using registry
    • Suspicious behavior: EnumeratesProcesses
    • Drops file in Windows directory
    • Modifies system certificate store
    PID:1928
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c vssadmin.exe Delete Shadows /All /Quiet & bcdedit /set {default} recoveryenabled No & bcdedit /set {default} bootstatuspolicy ignoreallfailures
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:640
      • C:\Windows\SysWOW64\vssadmin.exe
        vssadmin.exe Delete Shadows /All /Quiet
        3⤵
        • Interacts with shadow copies
        PID:1000
  • C:\Windows\system32\vssvc.exe
    C:\Windows\system32\vssvc.exe
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    • Modifies service
    PID:468

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/640-0-0x0000000000000000-mapping.dmp

    Download

  • memory/1000-1-0x0000000000000000-mapping.dmp

    Download