Overview

overview

10

Static

static

5ff0e1939e...57.exe

windows7_x64

1

5ff0e1939e...57.exe

windows10_x64

10

Analysis

  • max time kernel
    150s
  • max time network
    110s
  • platform
    windows10_x64
  • resource
    win10v20201028
  • submitted
    19-03-2021 21:18

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    5ff0e1939ec47e39be4c0749f90e0063af4d50278d963d72e649534eb633f057.exe

  • Size

    119KB

  • MD5

    efcf44385f64fa88b1b3fd708889cfe7

  • SHA1

    429f6dc68319b3fafd9c9541a5ae039f85b4b516

  • SHA256

    5ff0e1939ec47e39be4c0749f90e0063af4d50278d963d72e649534eb633f057

  • SHA512

    dd4fd2ff9ac50e771e469a2886e0a9000068d84ec42d1e4fc94bb734a997b938fd9088b7a43236009a901034139e9da0872154fea896aaac1ab7a5f2af4a12f0

Score
10/10
sodinokibiransomwarespywarestealer

Malware Config

Extracted

Path

C:\o57y0w54h1-readme.txt

Family

sodinokibi

Ransom Note
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension o57y0w54h1. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/7150CDA72CC9973E 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decoder.re/7150CDA72CC9973E Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: h0NWess9ALmP/Q4A9dC+b3vQkFMjLO6epCsPQqVwpCk9BlFCw77kr2zW++twvP1Y 0ucd6KQGzPA2HTwAw1r3ExacLodFHdOcHAJSeYSwat/cgmTXCmNKsU1Zq1qIKhFB YqjIOLDi5yfeFCDIlQNAHCpkBIdH7+nG1eME8Bs2SQIDUdKFep9eZpx91buiMhEA getOg0YqleZdX9zhKvWOF+aTQNITcx3gUKQWKFh4+W6r+e4n95lJJPTg5c27TJbC iBfmFq1pilOruYGakaMCL9RJ6bptFI7iePxUoJDmWECMoKULLDn21VdAMfm2hUNC 1YCcqvcOIID5Nrx37XDutdVHKnS4Di37tij5UIeW154pdgyJmWOhkbOPq4D6zQ7n 6N8q6sp6YlwaYEyZndF0I6cscPgVhqlx4v+vj8ukpI+Ot/fECHX3eMNUDRB6V5K5 zOwFtm/smcq3R0LRVaQobsz6OgvhAvMX+N9q2k6wH858ZLTx+NNM01RHuoi1Lj/E Pyq2zqPAc+5BvJ2DlKwjIu13aREMM6l00W1dWg+YQi4L3Uljr3AJ0ofrjCXnMo1p anR84JnM82HBWCOCVZji7SBdOC+mZBaIVLqg2OQJEAQyj8IvOH+3hodXxESHwfR4 X7ekIsmGROHeWXIEoVe7a2kVtPytCoEFUQ0P4bOrTUGuAhGUYAIBUEJhvttLEpo8 k1XBtCJLFEttn+2SP+SxNkelf3pNQ+riSdPVPniUeUTiaoEgkfVxDgD7H6YgBK6V Tk94F7cj/Rnk08Zv2kxkMW6YIGwj366/ZHr6HAOy7DHS+gPjzpTcTMFbQGCkH2SB hyzYJZQVr2Y//PGuJZw5g8q34z/4JpJ4aIhRG6hlvwrxhBWLz61T162t5HgMIQE+ xGBoizmE3IerLmpkuIBnWj3cCuBgfsdzUT1uWQ+00mZM81lqWkP9Y37Vyt+Fe/dX DFTd54tGWrMjDCRBl7FlZ1PoMsRSUAaWDplOaatjhXe9pxCWoo1PJLeiU83sJHP/ ZzgmO07l3rR26HE4SrZdsIzLsKq/VdOAUBEbOimG2/ELwLww6Jbmq5bCY061K/GB IiPiEuuZ1NN9/TGqW5SPiBTq9k1uXUqi+BxMEJAFHcHb3eitEsUSgqhdmfJt+jR2 oWxa9c9lG6iPnkMUvtOBU7NCty6Z2SULlqmdRNTvlRegn1JZCEpnAAr8pHKcPpLD vTAbbv50K+0mG/wl1Gv0HkSSpad8e8FbtqqN9YP9QKQOia6YgVo6v+F0RtOZWUrd aAoDEKLTtoWpIteCXC8= ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/7150CDA72CC9973E

http://decoder.re/7150CDA72CC9973E

Signatures

  • Sodin,Sodinokibi,REvil

    Ransomware with advanced anti-analysis and privilege escalation functionality.

    ransomwaresodinokibi
  • Modifies extensions of user files 7 IoCs

    Ransomware generally changes the extension on encrypted files.

    ransomware
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Enumerates connected drives 3 TTPs 25 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Sets desktop wallpaper using registry 2 TTPs 1 IoCs
    ransomware
  • Drops file in Program Files directory 18 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 5 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\5ff0e1939ec47e39be4c0749f90e0063af4d50278d963d72e649534eb633f057.exe
    "C:\Users\Admin\AppData\Local\Temp\5ff0e1939ec47e39be4c0749f90e0063af4d50278d963d72e649534eb633f057.exe"
    1⤵
    • Modifies extensions of user files
    • Enumerates connected drives
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:740
  • C:\Windows\system32\wbem\unsecapp.exe
    C:\Windows\system32\wbem\unsecapp.exe -Embedding
    1⤵
      PID:3120
    • C:\Windows\system32\vssvc.exe
      C:\Windows\system32\vssvc.exe
      1⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:204

    Network

    MITRE ATT&CK Enterprise v6

    Replay Monitor

    Loading Replay Monitor...

    Downloads