Overview

overview

10

Static

static

10

6834005e47...eb.exe

windows7_x64

1

6834005e47...eb.exe

windows10_x64

10

Analysis

  • max time kernel
    29s
  • max time network
    31s
  • platform
    windows10_x64
  • resource
    win10v20210410
  • submitted
    17-06-2021 04:43

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    6834005e47c6ad53cb0793e1f13b6ea45383d86691b179f4229214d8768d0ceb.exe

  • Size

    122KB

  • MD5

    57ff40b98ed3c71c8a7e48bea44e0d8f

  • SHA1

    3ee75869cf8019b1fbdf7a0bd317b3ca53433b59

  • SHA256

    6834005e47c6ad53cb0793e1f13b6ea45383d86691b179f4229214d8768d0ceb

  • SHA512

    e2a9d2f52a72a3c2cf3dc48185026fd000032ec787dead9a666a138a5b87718feed710317dd731bb4c791aeb8604e0780f7c39c9c1337d6ac79f42473d321512

Score
10/10
evasionpersistenceransomware

Malware Config

Extracted

Path

C:\7rs01j1w-readme.txt

Ransom Note
---=== Welcome. Again. ===--- We strongly encourage You to pay your attention to this message and read it to the end. All Your files are encrypted, and currently unavailable, now all files on your system has extension 7rs01j1w Before that, all of your most important personal and business files were backed up to our secure offline storage. We took them for temporary storage - but we don't need your files and we are not personally interested in your business. Our encryption algorithm is the most technically difficult and max resistant to burglary. Only OUR specialists can decrypted your files without loss(!) Any attempts to decrypt files on your own lead to damage them beyond repair(!) Best way to you will be consent to negotiations and mutual agreement between us. To connect us you need to download TOR browser and follow the link to begin negotiations.(You can find full instructions below.) We are waiting You and ready to listen all your offers and discuss them. If You will ignore this letter - we will have to sell closed auction all yours private files, photoes, business correspondence, documents and business files + with our analysis of your work activity (weakness of your business, financial violations and the opportunity to profit from this information). It will offset our financial losses. Or we'll just put all your files in the public domain, where everyone can download and use them as they wish. * For TOR Browser http://dnpscnbaix6nkwvystl3yxglz7nteicqrou3t75tpcc5532cztc46qyd.onion/ We are known as "Sodinokibi (REvil) Ransomware". For example, this article: https://www.coveware.com/blog/2019/7/15/ransomware-amounts-rise-3x-in-q2-as-ryuk-amp-sodinokibi-spread You have a guarantee that your files will be returned 100 %. And remember, this is only business, nothing personal.. We have a concept of business honor, and we can promise something if we come to a mutual agreement: 1. We guarantee to decrypt all your files in the shortest possible time 2. We will delete all your files and forget about your company. 3. We will show your weaknesses in your networks. .-= INSTRUCTIONS TO CONNECT =-. How to get access on website? You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/7F776AC8AE0C14C7 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decoder.re/7F776AC8AE0C14C7 Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: mTH/efsv7Iv30/YfO73DRc5Qh2x7R2WP8yNTfPchwEutq1RlRwPez4nh7tsPgy4q KNRkx0SiySg5ExvMwarh09JanTUBROVx+ux2ZUqXX0UA4tVFFtbKDgQ1DB7Ea4qs 0KRQG5D0AYDHshBrTWNOdZUZbzSXtc0ZxYisiFGjho7wBuNSYO8DQPSS7RcWeWgL 7gL4PwH0FKmu3AypyI50+Tx6CP9SvrU4dQbCzydpLPEpywiZAf3uZY7gymCzPoeb ERUexEFKmGO1VKKUN2gat0KVV19JswOrL+LnZj0WRw5jGyHY/syjdj+9K5ZVOWKc pi7I5ySy7gWTY6uamZBrlSNvKe+ZeMkelgQyumaX7t6j7B96aW0Yp8xcB3zgKT7D 4xJXKYd+hkuFWDtPSFSHAXhVYz/WHccjlLEfrmjp1Pomlh2K2QKOXvwca5m0H6x3 P12q02VbFN5YI4+gvGDN672xL2YvudSahvtTdsteoo3D89RvMZo0rbWegB+G4btv dR28DX1dcI+zk8dV6IFkrS+o6pbxQQJ2FzAeTthgjq0EOzo9Vpv6PBQPu+Nb6b53 6u1+US4TFitIbuQhlmD6/sQjHDvChEIdemW4V9foMwDz0cTgKMlzIHEO/Gekf6Nu Lv5brPzf2vikjz3ojZ5SJdIylQT/n5trP9pP04yJEn9kWiPTKAjRUrjoksxrNvrS 6a5v4q6V1ORQKom611mtcofiogtxUzOJT9Zp/VIzwMID4MtSHOmJzwAS/Ho70Lr3 KwXKU6awoUIJlSUK2CWY2hoy7RclV9FZFAqswnQFsCKuK6GRVvvur98fQ5txrlNi YT3Gtp/KrWFioAdZCPvmU6R24Z+Of8OsWwxDg4g/23LSz/Gg64mHVdMY5dUUAfDo HmJj+ADmK4YjwYnYUynTwAbUAnnWIG9BggZiqF+2PWo/2slHaVb6rokU7JlXbj/B dPEUWtpOdG7q3cHzj5B/qGa3EiuAXVeXjSV4NOT87yegAFsKy2jVKJBXnhwV5kV3 UQn8ghqAnF5BeZ8hBTCiPTB9kuQVFLwmwzuxAfcsrw8u/p340HCWfOgtgBLuwBWp gkJIZBLiUVAyDENIImolJZLvi8PTKKKvuyk6aQLaFrdxb2KtFcAJxxbxkhjYoJl3 Ca12GvRZfKomeveo7UH6QuYgtmcndAJSYCK0yYGHqHWxVuvjzRONbxcm0IdGwCKj aO4Y5l/z7r724LlHViwErDPIvKTZ3kT9IRitGlMjFoF3Y3rTQCz480kQusWSR7AX vEBcrH0KatuaSQ== ---------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all your data!
URLs

http://dnpscnbaix6nkwvystl3yxglz7nteicqrou3t75tpcc5532cztc46qyd.onion/

https://www.coveware.com/blog/2019/7/15/ransomware-amounts-rise-3x-in-q2-as-ryuk-amp-sodinokibi-spread

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/7F776AC8AE0C14C7

http://decoder.re/7F776AC8AE0C14C7

Signatures

  • Modifies Windows Firewall 1 TTPs
    evasion
  • Modifies extensions of user files 10 IoCs

    Ransomware generally changes the extension on encrypted files.

    ransomware
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 25 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Program Files directory 27 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious behavior: EnumeratesProcesses 8 IoCs
  • Suspicious use of AdjustPrivilegeToken 5 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\6834005e47c6ad53cb0793e1f13b6ea45383d86691b179f4229214d8768d0ceb.exe
    "C:\Users\Admin\AppData\Local\Temp\6834005e47c6ad53cb0793e1f13b6ea45383d86691b179f4229214d8768d0ceb.exe"
    1⤵
    • Modifies extensions of user files
    • Adds Run key to start application
    • Enumerates connected drives
    • Drops file in Program Files directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:3904
    • C:\Windows\SysWOW64\netsh.exe
      netsh advfirewall firewall set rule group="Network Discovery" new enable=Yes
      2⤵
        PID:1592
    • C:\Windows\system32\wbem\unsecapp.exe
      C:\Windows\system32\wbem\unsecapp.exe -Embedding
      1⤵
        PID:2192
      • C:\Windows\system32\vssvc.exe
        C:\Windows\system32\vssvc.exe
        1⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:2420

      Network

      MITRE ATT&CK Enterprise v6

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • memory/1592-114-0x0000000000000000-mapping.dmp
        Download