sodinokibi | d1149325c12cb368c4a385e842765ca4dbc72687c5e6ec6148876e5dd85cb4bd

General

Target

ctag.exe.NoEjecutar.exe
Size

117KB
MD5

0d59bd37b0a11f82e47effd55d4d5e98
SHA1

ae6a817e758ec92dfae704683c1eb51e66add525
SHA256

91888a6beae36b73067be745fa82f620a80518f9c68b735ec8cc8b994733e4f3
SHA512

c0524b64508cbc53340d0645962506d49d3e7c567613c2603d3e3b36ffbd70d87f7048c0313ea569717b8e04e2cf4fd7c8e6323fd8492a54885ab9c7ed27566c

Score

10^/10

sodinokibi persistence ransomware

Malware Config

Extracted

Path

C:\7b4nwl7nc-readme.txt

Family

sodinokibi

Ransom Note

---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension 7b4nwl7nc. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/EAAD3E06EF3AB761 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/EAAD3E06EF3AB761 Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: duNnxkyQTd95vPyl1G8p8WMOY7uS+MdK4o9vm3e9z8CEPR2vGpfyDb1sD/f84FNy iRKZ7hJw48Km4G3P+RS3ae+v8R3fzOdAUyPqhaGAVSEAHID5fN9l8IO+QTtvgiV3 FM6tTE/IXNWpzs4HBH3IdT3XBr6dHVbFvJesoGj7tr5KPPOe6fGzZygFHbavlTff DzeYA37VS3M5l1eqWCMdFOKtIri65JTmD8Qml5n+oQWDOnCq0vzFLtAN5rU83Gsz c+delYVoR1gpi5ZRQv/TRJObs7C4JpLK1JTi7aanmqQoRXL1BCyFiuTKKWo10qyY omZXx4dmn73Ot7hJ5LPk62a2EC+eC/Fc9M2rh+i42U9bBiyoKeAmzYP8rJsiTBVN K/Yvt0sbl8HjPAcEmQ5bN2PxyO2qUUWL/x+j85kZ0o8n5GHBlVn4G4dhln+EkjOA gLpgJVcb8EkpzA+Xx6HuXeoLkXLq0HdLQt9i/KGesf4zySVm3rnyJBezePac8QO4 jQpYHj9HCyuWo3JsGN9eG6Yia0RkrbZU3obUn/XwqhJDKXzlWV5p90K1KREDD/Jz x8NceVrHa+8L3PLW5s26Be4x2KGUwKafFwejVnZZcvx5NNoHNHsQV3pT90y4ARxN o8tBPjZxD5pU9NzU/R+xrs2NVSKBTuWUh1uRO2OeNcUb2HAZBSX01D7T1CN3M7A9 RhGBH/o5tyegwvGA/P561/O/mvox4dZs4in08u87eaadl9uBJZFZBTQSUE2z+I8I puZUN2x2e+gq08ReIQCq4CqQLhvhYi+VfbI7INaNtrlzUzwf9+56vsQROGLQVeON W3DfOk0bDNosiLVFfM1VssQg9D+RYXBO5AFKE8KpdCJJZ6SkR2vt6rgi5JhPWmJ2 4GIEsb0S3bO7V8tHWNbDUvkTCwBo+UuNIxWYvBae1VNPnu11rLypRmeNuzFkT9SE nFa1CozGK7ClIAyd7l/qLkhvydqRQzUVTy7md5uGMMLQPba1LhEw8daRpFE5F5rx n/4hKAwvO3jA9dWfmctTfPggpclxSaGXIVLtbiwPKizDyq6mFJO9EnCPgAQg8hfu 48zyk5xOQbk91wvixE+e+ehk42ltFJNWn7jMX+Yc5jOPQ6z2JWAmEjOKdyeISFTG GMuYTT0KYsHHbnmWewORi/97wQQKtad2zk61zfdradD204LqDCZ+tn5ArGfTx/E/ x5tMDFbWO+Mx0PaXuIuonpIf/H9igfeN3IKzib6t7zsQezlQz9BcmIoqD7UGxJe3 CwzA32kWwfZqZi2n3NShPp2EYBVdsg== ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!

URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/EAAD3E06EF3AB761

http://decryptor.cc/EAAD3E06EF3AB761

Signatures

Sodin,Sodinokibi,REvil
Ransomware with advanced anti-analysis and privilege escalation functionality.
ransomware sodinokibi

Modifies extensions of user files 7 IoCs

Ransomware generally changes the extension on encrypted files.

ransomware

Processes:

ctag.exe.NoEjecutar.exe

description	ioc	process
File renamed	C:\Users\Admin\Pictures\SelectClose.tiff => \??\c:\users\admin\pictures\SelectClose.tiff.7b4nwl7nc	ctag.exe.NoEjecutar.exe
File opened for modification	\??\c:\users\admin\pictures\SelectClose.tiff	ctag.exe.NoEjecutar.exe
File renamed	C:\Users\Admin\Pictures\AddBackup.tif => \??\c:\users\admin\pictures\AddBackup.tif.7b4nwl7nc	ctag.exe.NoEjecutar.exe
File renamed	C:\Users\Admin\Pictures\ConnectRename.raw => \??\c:\users\admin\pictures\ConnectRename.raw.7b4nwl7nc	ctag.exe.NoEjecutar.exe
File renamed	C:\Users\Admin\Pictures\DisableRequest.raw => \??\c:\users\admin\pictures\DisableRequest.raw.7b4nwl7nc	ctag.exe.NoEjecutar.exe
File renamed	C:\Users\Admin\Pictures\ExitSkip.raw => \??\c:\users\admin\pictures\ExitSkip.raw.7b4nwl7nc	ctag.exe.NoEjecutar.exe
File renamed	C:\Users\Admin\Pictures\ResizeSkip.crw => \??\c:\users\admin\pictures\ResizeSkip.crw.7b4nwl7nc	ctag.exe.NoEjecutar.exe

Enumerates connected drives 3 TTPs 25 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

ctag.exe.NoEjecutar.exe

description	ioc	process
File opened (read-only)	\??\H:	ctag.exe.NoEjecutar.exe
File opened (read-only)	\??\K:	ctag.exe.NoEjecutar.exe
File opened (read-only)	\??\S:	ctag.exe.NoEjecutar.exe
File opened (read-only)	\??\W:	ctag.exe.NoEjecutar.exe
File opened (read-only)	\??\X:	ctag.exe.NoEjecutar.exe
File opened (read-only)	\??\Z:	ctag.exe.NoEjecutar.exe
File opened (read-only)	\??\P:	ctag.exe.NoEjecutar.exe
File opened (read-only)	\??\Q:	ctag.exe.NoEjecutar.exe
File opened (read-only)	\??\A:	ctag.exe.NoEjecutar.exe
File opened (read-only)	\??\B:	ctag.exe.NoEjecutar.exe
File opened (read-only)	\??\E:	ctag.exe.NoEjecutar.exe
File opened (read-only)	\??\F:	ctag.exe.NoEjecutar.exe
File opened (read-only)	\??\G:	ctag.exe.NoEjecutar.exe
File opened (read-only)	\??\I:	ctag.exe.NoEjecutar.exe
File opened (read-only)	\??\R:	ctag.exe.NoEjecutar.exe
File opened (read-only)	\??\U:	ctag.exe.NoEjecutar.exe
File opened (read-only)	\??\D:	ctag.exe.NoEjecutar.exe
File opened (read-only)	\??\N:	ctag.exe.NoEjecutar.exe
File opened (read-only)	\??\V:	ctag.exe.NoEjecutar.exe
File opened (read-only)	\??\J:	ctag.exe.NoEjecutar.exe
File opened (read-only)	\??\L:	ctag.exe.NoEjecutar.exe
File opened (read-only)	\??\M:	ctag.exe.NoEjecutar.exe
File opened (read-only)	\??\O:	ctag.exe.NoEjecutar.exe
File opened (read-only)	\??\T:	ctag.exe.NoEjecutar.exe
File opened (read-only)	\??\Y:	ctag.exe.NoEjecutar.exe

Modifies service 2 TTPs 5 IoCs

persistence

Modify Registry

T1112

Modify Existing Service

T1031

Processes:

vssvc.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\Registry Writer	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SwProvider_{b5946137-7b9f-4925-af80-51abd60b20d5}	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\COM+ REGDB Writer	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\ASR Writer	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\Shadow Copy Optimization Writer	vssvc.exe

Sets desktop wallpaper using registry 2 TTPs 1 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

Processes:

ctag.exe.NoEjecutar.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\oglmc.bmp"	ctag.exe.NoEjecutar.exe

Drops file in Program Files directory 13 IoCs

Processes:

ctag.exe.NoEjecutar.exe

description	ioc	process
File created	\??\c:\program files (x86)\7b4nwl7nc-readme.txt	ctag.exe.NoEjecutar.exe
File opened for modification	\??\c:\program files\BackupDebug.ppsm	ctag.exe.NoEjecutar.exe
File opened for modification	\??\c:\program files\DisableEdit.AAC	ctag.exe.NoEjecutar.exe
File opened for modification	\??\c:\program files\GroupConvertTo.mht	ctag.exe.NoEjecutar.exe
File opened for modification	\??\c:\program files\PingSelect.svgz	ctag.exe.NoEjecutar.exe
File opened for modification	\??\c:\program files\RegisterClear.mpp	ctag.exe.NoEjecutar.exe
File opened for modification	\??\c:\program files\WaitStep.aifc	ctag.exe.NoEjecutar.exe
File created	\??\c:\program files\7b4nwl7nc-readme.txt	ctag.exe.NoEjecutar.exe
File opened for modification	\??\c:\program files\RepairSubmit.xltx	ctag.exe.NoEjecutar.exe
File opened for modification	\??\c:\program files\StepJoin.csv	ctag.exe.NoEjecutar.exe
File opened for modification	\??\c:\program files\TraceUndo.jpeg	ctag.exe.NoEjecutar.exe
File opened for modification	\??\c:\program files\UnblockReset.wm	ctag.exe.NoEjecutar.exe
File opened for modification	\??\c:\program files\WaitSuspend.xml	ctag.exe.NoEjecutar.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

ctag.exe.NoEjecutar.exe

pid process

4048 ctag.exe.NoEjecutar.exe
4048 ctag.exe.NoEjecutar.exe
4048 ctag.exe.NoEjecutar.exe
4048 ctag.exe.NoEjecutar.exe

pid	process
4048	ctag.exe.NoEjecutar.exe
4048	ctag.exe.NoEjecutar.exe
4048	ctag.exe.NoEjecutar.exe
4048	ctag.exe.NoEjecutar.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

Processes:

ctag.exe.NoEjecutar.exevssvc.exe

description	pid	process
Token: SeDebugPrivilege	4048	ctag.exe.NoEjecutar.exe
Token: SeTakeOwnershipPrivilege	4048	ctag.exe.NoEjecutar.exe
Token: SeBackupPrivilege	3772	vssvc.exe
Token: SeRestorePrivilege	3772	vssvc.exe
Token: SeAuditPrivilege	3772	vssvc.exe

C:\Users\Admin\AppData\Local\Temp\ctag.exe.NoEjecutar.exe
"C:\Users\Admin\AppData\Local\Temp\ctag.exe.NoEjecutar.exe"
1⤵
- Modifies extensions of user files
- Enumerates connected drives
- Sets desktop wallpaper using registry
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4048