Overview

overview

10

Static

static

10

fd164c4c12...87.exe

windows7_x64

10

fd164c4c12...87.exe

windows10_x64

10

Resubmissions

23-08-2021 11:12

210823-681sdqb6fx 10

29-06-2021 23:44

210629-4zlddtzv5e 10

Analysis

  • max time kernel
    1622s
  • max time network
    1849s
  • platform
    windows7_x64
  • resource
    win7v20210410
  • submitted
    23-08-2021 11:12

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    fd164c4c121371f94cfd3a034ad8cf8edc7c0f7141a8f4c9da1683d41b212a87.exe

  • Size

    122KB

  • MD5

    fc9edc350d7ffdcb9e53390dae26ea5a

  • SHA1

    06b1f63eb58202a630cfab82c608111a53177db3

  • SHA256

    fd164c4c121371f94cfd3a034ad8cf8edc7c0f7141a8f4c9da1683d41b212a87

  • SHA512

    84b377ea7f5b066b26f2ba60d3b9dc7fbb088d2f0cca16716bc99fc7bfcdd6f1451bcf3b134b925c090f291bb97fdc5f589dd645795e4d1e5c124a316756c86a

Score
10/10
evasionpersistenceransomwaresuricata

Malware Config

Extracted

Path

C:\h3pt9h-readme.txt

Ransom Note
---=== Welcome. Again. ===--- We strongly encourage You to pay your attention to this message and read it to the end. All Your files are encrypted, and currently unavailable, now all files on your system has extension h3pt9h Before that, all of your most important personal and business files were backed up to our secure offline storage. We took them for temporary storage - but we don't need your files and we are not personally interested in your business. Our encryption algorithm is the most technically difficult and max resistant to burglary. Only OUR specialists can decrypted your files without loss(!) Any attempts to decrypt files on your own lead to damage them beyond repair(!) Best way to you will be consent to negotiations and mutual agreement between us. To connect us you need to download TOR browser and follow the link to begin negotiations.(You can find full instructions below.) We are waiting You and ready to listen all your offers and discuss them. If You will ignore this letter - we will have to sell closed auction all yours private files, photoes, business correspondence, documents and business files + with our analysis of your work activity (weakness of your business, financial violations and the opportunity to profit from this information). It will offset our financial losses. Or we'll just put all your files in the public domain, where everyone can download and use them as they wish. * For TOR Browser http://dnpscnbaix6nkwvystl3yxglz7nteicqrou3t75tpcc5532cztc46qyd.onion/ We are known as "Sodinokibi (REvil) Ransomware". For example, this article: https://www.coveware.com/blog/2019/7/15/ransomware-amounts-rise-3x-in-q2-as-ryuk-amp-sodinokibi-spread You have a guarantee that your files will be returned 100 %. And remember, this is only business, nothing personal.. We have a concept of business honor, and we can promise something if we come to a mutual agreement: 1. We guarantee to decrypt all your files in the shortest possible time 2. We will delete all your files and forget about your company. 3. We will show your weaknesses in your networks. .-= INSTRUCTIONS TO CONNECT =-. How to get access on website? You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/08D7BAC0C65772B4 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decoder.re/08D7BAC0C65772B4 Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: a01eYScxLQOEdXZ0z6YXpnGbzzqHtgU4vyMZmCl3LhvYHoyTwOsU25V2rsFwWZvI BsBQIBC68zQ2DtbUq2UKp2SsgU+PNqeJyFgpOPUtSCvdQwnEVRIOhK5lwbZA99wj qCc0/kyz/EDCkU/Gs4d9mkQiel+IbDwKAtzYH4JjV5/fqefNZSNs5Qy3ioEQLPVV 6aBFhj+vRMLI/NlPhA7XRroPfucADAyC1t5+BpCBIowIIvmIbzMJNX4fOom12Sap FzbE9yoqg0tmicoGyoTH04jqWM+QyOBJXGoXDPCZZpA1kQNQfvNwaIwxZRTwgBcU Tjl1uOG+0grabZJlwYYF6JR1rYYQ4D18Y9z7suZ73d4vjg8BEyRnor+h1+4IzeoX 6FCOWo5QU+9VLOdzYF6+2oSrNR7g8xSRxQ/may5HPjD/R9OHG4G1lvwswfJpIBLd PbRYQITyeOxcj0ROBkeW4k5QFCY0LK312Y6uF2x1ZcfCc87xnKHt17xDy5y4XCYo YSqPtU1quwekmoytLCAaBRSyjcKuALpHBNE8M0lpwRn1uohfPaC5Hz7NtmCo6tkR I85x0/aujzYZYe2vzdP/SStMuZATZ9CNZseR0zC6G5IxQxR9UhgK7kSh/wWADjCF G7q9+LZbQI34XKwI8gcW7ze4s1JSc76aRR8guUZV2wsxXlPJxkWbvSJUiu8maKOo AFvqOnlj642qA038pdHWoqjYpH5SGDCovFr/MwFREk7oI0TGP8Z8hdxuqKgOFZ1C QbHg8R4fOGxrmP16bNcJLPyd9Ft2PWV5M+Yh2dM7OHCWABJwAlj1ix6xFUS0xpZW XYb4pSXB4WmqwO3ogDKsqyb9Oi0a04LPyohEYrPBprGqCSYubPh+sPHRBlEyUGe8 cFORLu1u7hrVZo6l0eYpxL6koTfV3fjZ/dHdB6sjN9wa4fa3BDoCFOcKc7s+U7C1 jDuncM/hzQFd3UVUaRrKskfroN31tyABtaE8bZnbkmbYabEq9TJBUiyeQ1vk2t38 v7UUF9vfZJJOfErUCx24SC5B+u9FEDSRq7BQn27u/iPUJRTc3wA1LHWU5xrAI9ys XLqfNE49YF2yPxsSQ5AmTUWKKR3PWuzPS4XIOg9SGV06s3zyu2KiMRHJ7qY+5KwJ MUuAPrwfA4vw6TJ2fvHkzXcjeN+N/xPwCmuLGLEAZXtJ1ZPuui5XMzbXH6oV30Uz OyHk3dPewavI7RY4FrHJ1s/Up4WIGdh+qbQBAbnulTUIwYEXEPgGVwArDn6lgYrk uD2WO1z2LIYZndpHHav0WAkzaA5K3A== ---------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all your data!
URLs

http://dnpscnbaix6nkwvystl3yxglz7nteicqrou3t75tpcc5532cztc46qyd.onion/

https://www.coveware.com/blog/2019/7/15/ransomware-amounts-rise-3x-in-q2-as-ryuk-amp-sodinokibi-spread

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/08D7BAC0C65772B4

http://decoder.re/08D7BAC0C65772B4

Signatures

  • suricata: ET MALWARE Known Sinkhole Response Header

    suricata: ET MALWARE Known Sinkhole Response Header

    suricata
  • Modifies Windows Firewall 1 TTPs
    evasion
  • Modifies extensions of user files 3 IoCs

    Ransomware generally changes the extension on encrypted files.

    ransomware
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 25 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Sets desktop wallpaper using registry 2 TTPs 1 IoCs
    ransomware
  • Drops file in Program Files directory 47 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Modifies system certificate store 2 TTPs 14 IoCs
    evasionspywaretrojan
  • Suspicious behavior: EnumeratesProcesses 5 IoCs
  • Suspicious use of AdjustPrivilegeToken 5 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\fd164c4c121371f94cfd3a034ad8cf8edc7c0f7141a8f4c9da1683d41b212a87.exe
    "C:\Users\Admin\AppData\Local\Temp\fd164c4c121371f94cfd3a034ad8cf8edc7c0f7141a8f4c9da1683d41b212a87.exe"
    1⤵
    • Modifies extensions of user files
    • Adds Run key to start application
    • Enumerates connected drives
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • Modifies system certificate store
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1908
    • C:\Windows\SysWOW64\netsh.exe
      netsh advfirewall firewall set rule group="Network Discovery" new enable=Yes
      2⤵
        PID:744
    • C:\Windows\system32\wbem\unsecapp.exe
      C:\Windows\system32\wbem\unsecapp.exe -Embedding
      1⤵
        PID:1924
      • C:\Windows\system32\vssvc.exe
        C:\Windows\system32\vssvc.exe
        1⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:1504

      Network

      MITRE ATT&CK Enterprise v6

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • memory/744-61-0x0000000000000000-mapping.dmp
        Download
      • memory/1908-60-0x0000000074FB1000-0x0000000074FB3000-memory.dmp
        Filesize

        8KB

        Download