Overview

overview

10

Static

static

10

f7c9222936...d3.exe

windows7_x64

10

f7c9222936...d3.exe

windows10_x64

10

Analysis

  • max time kernel
    120s
  • max time network
    126s
  • platform
    windows7_x64
  • resource
    win7-en-20211208
  • submitted
    24-01-2022 00:42

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    f7c922293637486c307b6d1f05da1eb686a330c527981e0b0f079602e9cfd3d3.exe

  • Size

    165KB

  • MD5

    d3e026324b81c755f9058d7a42e96c75

  • SHA1

    35d30a689c4b826e43d9255574fa09965c0a6ba7

  • SHA256

    f7c922293637486c307b6d1f05da1eb686a330c527981e0b0f079602e9cfd3d3

  • SHA512

    e9eb060168da1db8dafac357835ffc2272dc3fdbae31c77d810c188299657c824255cc1f337ac25420c57ebe821a838f4e92e5fdf7778a4a6692e777305b3913

Score
10/10
sodinokibiransomware

Malware Config

Extracted

Path

C:\e70etl274-readme.txt

Family

sodinokibi

Ransom Note
---=== Welcome. CDHFUND. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your computer has extension e70etl274. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/C18DE0894BDBC268 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.top/C18DE0894BDBC268 Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: laqSpS7Yzp8smtsgOGhjmEGkoyYov4NZvyGkdFGhuJ8nsVfvCKTd/FlksScr/ukv 7vPHqjCnfBDMh6UnP5gSODMHt5jBNqOKnAhitE/QP0hs0KRqEkQCAOpPtYPQLeaH C4YrFMcp8N0kaGF+yAsnpkQfsuO1ZPaZu84U+hrRYjXaCrpHb4GEPXkIDfKo62g1 VxL0tgmUIFmI+c1HgkvocC34B3zdvZpfBa1VPwJvjWawVHp+ZeBHp274VPLOtRc9 lGT4Ns78vzUVXC0bv41lKuwz5A+nT/Y48r7XZUb3qEdvxBb4TqJzSUUdnXCPHfOs eJ91hh0rkP7Jlc1OC1p6cum5WDRmgGarnidfr9t7fXyEO5sAa3Thzm7IgfySSQXn YT9S1j/yVdOhOnN/OeQmj3KbyhIvPD5df0TgOXJYqbX8BGtCYumKSzRw0SK0FuuS Zf5BG/3lJocft1CDPp0Ij8iSGW8/xPGWYdp5JG3bmSMzmtBHMqQ/QT7gu6CycB39 UGIji33FTo5PJj1Um3K7Q/czcYza4agu+PuiBLFcS2IDdit8N2ryJLdYIzHRDpJ8 kWZPUU/dfxypjsHr0TwDXJJGzXZ107bLFFml2Bt0RHwbGVmH7iY8RpKUCruCUals m1bk25VsHxnp2ANcRT5Ef2jUWa75AN7xc9DX3e6ZikGkAy8vNuqKOXZ5AlTEwKAV /dHnB3R8qbTyg6mCUAxOd8gT6tILQpZkAzzxe+iHD10i6OAJ8RJ3Foi41RyMkno3 xn086U05xZVuA2MJSGkkI9nBV+aYPntoYPsaIOmx18JJlYc2xp/YbgXp+kw6VWdW n2a6JWGLWPgZet3pSMnaPgEEcW3w0FAn+pqddKuPgawVrDgY69n25AGTvDRh+h6t Mix0QKk+upsAwiXwxnkCsIUyz2COJrk/vww3hsVgI/yv8NEM4NW25GUJbd1X80KL oxWvKb2vlTlJDDRYaRXvX8Og1mfu3mBkwlALoxiwce9Ao4QpSU9aRT3VHB1pACOB eLKA7UjxMuRKKazU9/yjyZkZEyDE5+GtCdDchOEFR14XoZ0xsZ34fXt7MUzJZazE E66O8IAInoE69XjCLgcbz7bSL41nuMr76bw55OFCx9QQy1uQ/nsxwDXkvRJtKL7d r1NZsQI7x6dlDA== Extension name: e70etl274 ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/C18DE0894BDBC268

http://decryptor.top/C18DE0894BDBC268

Signatures

  • Sodin,Sodinokibi,REvil

    Ransomware with advanced anti-analysis and privilege escalation functionality.

    ransomwaresodinokibi
  • Modifies extensions of user files 7 IoCs

    Ransomware generally changes the extension on encrypted files.

    ransomware
  • Enumerates connected drives 3 TTPs 25 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Sets desktop wallpaper using registry 2 TTPs 1 IoCs
    ransomware
  • Drops file in Program Files directory 31 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\f7c922293637486c307b6d1f05da1eb686a330c527981e0b0f079602e9cfd3d3.exe
    "C:\Users\Admin\AppData\Local\Temp\f7c922293637486c307b6d1f05da1eb686a330c527981e0b0f079602e9cfd3d3.exe"
    1⤵
    • Modifies extensions of user files
    • Enumerates connected drives
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:1624
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -e RwBlAHQALQBXAG0AaQBPAGIAagBlAGMAdAAgAFcAaQBuADMAMgBfAFMAaABhAGQAbwB3AGMAbwBwAHkAIAB8ACAARgBvAHIARQBhAGMAaAAtAE8AYgBqAGUAYwB0ACAAewAkAF8ALgBEAGUAbABlAHQAZQAoACkAOwB9AA==
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:1192
  • C:\Windows\system32\wbem\unsecapp.exe
    C:\Windows\system32\wbem\unsecapp.exe -Embedding
    1⤵
      PID:1632
    • C:\Windows\system32\vssvc.exe
      C:\Windows\system32\vssvc.exe
      1⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:1104

    Network

    MITRE ATT&CK Enterprise v6

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • \??\PIPE\srvsvc
      MD5

      d41d8cd98f00b204e9800998ecf8427e

      SHA1

      da39a3ee5e6b4b0d3255bfef95601890afd80709

      SHA256

      e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

      SHA512

      cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

      Download Submit
    • memory/1192-55-0x000007FEFC511000-0x000007FEFC513000-memory.dmp
      Filesize

      8KB

      Download
    • memory/1192-57-0x0000000002730000-0x0000000002732000-memory.dmp
      Filesize

      8KB

      Download
    • memory/1192-59-0x0000000002734000-0x0000000002737000-memory.dmp
      Filesize

      12KB

      Download
    • memory/1192-58-0x0000000002732000-0x0000000002734000-memory.dmp
      Filesize

      8KB

      Download
    • memory/1192-56-0x000007FEF38E0000-0x000007FEF443D000-memory.dmp
      Filesize

      11.4MB

      Download
    • memory/1192-60-0x000000000273B000-0x000000000275A000-memory.dmp
      Filesize

      124KB

      Download
    • memory/1624-54-0x0000000076071000-0x0000000076073000-memory.dmp
      Filesize

      8KB

      Download