Overview

overview

10

Static

static

10

7c8cb66e9e...34.exe

windows7_x64

10

7c8cb66e9e...34.exe

windows10_x64

10

Analysis

  • max time kernel
    150s
  • max time network
    154s
  • platform
    windows10_x64
  • resource
    win10v20210410
  • submitted
    17-06-2021 05:04

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    7c8cb66e9e5ac66415273a48528e1b2f781003f2109b5d704254b9e91d745a34.exe

  • Size

    122KB

  • MD5

    9ccb042cb5bbfba12d009ea0b5f1a660

  • SHA1

    9f8ef2e46e22f12c889a8644a2129202602feeaa

  • SHA256

    7c8cb66e9e5ac66415273a48528e1b2f781003f2109b5d704254b9e91d745a34

  • SHA512

    deef869719908687d9f63ffc2ba37c7ee340b5ce2ad9ecc3aba8849a2a5562904ddfa1bb4e1a0ad9f43944e6a198022496921f7f0658553ff5e37d815699fce4

Score
10/10
evasionpersistenceransomware

Malware Config

Extracted

Path

C:\6208z-readme.txt

Ransom Note
---=== Welcome. Again. ===--- We strongly encourage You to pay your attention to this message and read it to the end. All Your files are encrypted, and currently unavailable, now all files on your system has extension 6208z Before that, all of your most important personal and business files were backed up to our secure offline storage. We took them for temporary storage - but we don't need your files and we are not personally interested in your business. Our encryption algorithm is the most technically difficult and max resistant to burglary. Only OUR specialists can decrypted your files without loss(!) Any attempts to decrypt files on your own lead to damage them beyond repair(!) Best way to you will be consent to negotiations and mutual agreement between us. To connect us you need to download TOR browser and follow the link to begin negotiations.(You can find full instructions below.) We are waiting You and ready to listen all your offers and discuss them. If You will ignore this letter - we will have to sell closed auction all yours private files, photoes, business correspondence, documents and business files + with our analysis of your work activity (weakness of your business, financial violations and the opportunity to profit from this information). It will offset our financial losses. Or we'll just put all your files in the public domain, where everyone can download and use them as they wish. * For TOR Browser http://dnpscnbaix6nkwvystl3yxglz7nteicqrou3t75tpcc5532cztc46qyd.onion/ We are known as "Sodinokibi (REvil) Ransomware". For example, this article: https://www.coveware.com/blog/2019/7/15/ransomware-amounts-rise-3x-in-q2-as-ryuk-amp-sodinokibi-spread You have a guarantee that your files will be returned 100 %. And remember, this is only business, nothing personal.. We have a concept of business honor, and we can promise something if we come to a mutual agreement: 1. We guarantee to decrypt all your files in the shortest possible time 2. We will delete all your files and forget about your company. 3. We will show your weaknesses in your networks. .-= INSTRUCTIONS TO CONNECT =-. How to get access on website? You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/0B1BBF39F23B6EA2 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decoder.re/0B1BBF39F23B6EA2 Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: f2Xvt0eN5ErwRLeRMEemzL9J/mkFA4fjYAXYy0PGGVuMjf2htmb1OgZOtxhbAXlH 6glUemkPHp5yrXakMABZNKff+EJnz553BhlcadzQZeeFOonbveDukx3mxcq5bUg8 Ln4czgtnEs+hfHfxomuwi/MwqZVwM+dPoIkBsLT4JuWw+4w7WVXOAm+K5rqyrD6h OMjQFsH9pvy+bFcM2+Oq/+II/2CHEgWelHxoY6lfWI5sZ0O5VAT+kezIEEmP+Nxi AlyQnNXd9iFKeYMCUqdobk26veoB7wxEvjfvkZnYP63yinRWSdbbTb13GzjY9dx7 Q39FZW3oW69f8fwFp+jsPjzEQpg9HwshnEuyDzJUhu3k63T0ZzzWrAj5QHHeoNhZ DDFKgezLphfvD3j6YhmIRN2nYmmvm214Lx4CHJc2DZ86TUTgRCc5FFBo7geuMu8A Enp8otBW/6GBZBzzrRikXnj3Ut06D9jLggPYWkCyPFsKN7HWpBm7WBCjoDeRhOAf u4UVkaml7gliSZYbIX68WYFcw54KK0vW+nVrvBu8DNFEvWb7O7k1gkeSpgurrK7x rs4vrPF1dY8+1HWp6DhvFjKC4yorX6mulDO4clJgNmGak4z3lpvqyPcWpIV2z+Yd 03bWhFRMDU5witgAikm2h1FTByoHR4FVDRSv7QjINfW59BG/ZoLZz6gxWI2uLyJJ auxehRkKOZc9XyvxW+2QiOSJ/bAnP4sAYTWOiEXnu3Bn5chadAObuDnDaZj2TICj uVgd2xwwKvLVxQwCyRhtIyZs5qsQFbxd7YYkCBhhbs5Yv74iYiBvKi8Iyj+9klU4 T/I0EP4FFzDHeAsR2e7h9FKRoWn0tOB4c1JWmYjiF2Gw2JzP2SVPXHBNX74BpuVb MCDtBv9dF2utAqSo1uHANJHfX1gSqrh1GBj8f00yb8xyxrA3o0Gwa4JL3In7FAAm aQ/k8NdMvS1HSPR2JHPKg/UMO2eXAq3GDG/xx/9ORULrlJVzAXzy0h8wI8qXfRQX 7np51Kb6lfwGfo0fMAFxP+luvTXZQOUSVB0+uhNCpgZK+dDVhBgTdU9XkKWmD/yd STWn2LAbycSJVIedfW9LbTuZlvBoVBn9kT1ZE3Fl5ctbfIazO/3l3AhnltK2KgMA p95TKksXtkOVLXyhudZd2trT3W6nt5y8UabIbwuIXbnB8DaZ44nTzhfbUoRLoy/U GqQqtiiUYxI3QCO2dONLZfUoUGrDyRQ+RykPv1TcrV//znx9Aod6mBqkbYisfiZk dEfY2w== ---------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all your data!
URLs

http://dnpscnbaix6nkwvystl3yxglz7nteicqrou3t75tpcc5532cztc46qyd.onion/

https://www.coveware.com/blog/2019/7/15/ransomware-amounts-rise-3x-in-q2-as-ryuk-amp-sodinokibi-spread

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/0B1BBF39F23B6EA2

http://decoder.re/0B1BBF39F23B6EA2

Signatures

  • Modifies Windows Firewall 1 TTPs
    evasion
  • Modifies extensions of user files 3 IoCs

    Ransomware generally changes the extension on encrypted files.

    ransomware
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 25 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Sets desktop wallpaper using registry 2 TTPs 1 IoCs
    ransomware
  • Drops file in Program Files directory 18 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious behavior: EnumeratesProcesses 10 IoCs
  • Suspicious use of AdjustPrivilegeToken 5 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\7c8cb66e9e5ac66415273a48528e1b2f781003f2109b5d704254b9e91d745a34.exe
    "C:\Users\Admin\AppData\Local\Temp\7c8cb66e9e5ac66415273a48528e1b2f781003f2109b5d704254b9e91d745a34.exe"
    1⤵
    • Modifies extensions of user files
    • Adds Run key to start application
    • Enumerates connected drives
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4048
    • C:\Windows\SysWOW64\netsh.exe
      netsh advfirewall firewall set rule group="Network Discovery" new enable=Yes
      2⤵
        PID:188
    • C:\Windows\system32\wbem\unsecapp.exe
      C:\Windows\system32\wbem\unsecapp.exe -Embedding
      1⤵
        PID:2472
      • C:\Windows\system32\vssvc.exe
        C:\Windows\system32\vssvc.exe
        1⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:3616

      Network

      MITRE ATT&CK Enterprise v6

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • memory/188-114-0x0000000000000000-mapping.dmp
        Download