Overview

overview

10

Static

static

10

de06af0808...d2.exe

windows7_x64

10

de06af0808...d2.exe

windows10_x64

10

Analysis

  • max time kernel
    128s
  • max time network
    160s
  • platform
    windows7_x64
  • resource
    win7-en-20211208
  • submitted
    24-01-2022 00:52

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    de06af080835b608cd486392e13b22a2c9221a04d708679a34094d4bbbd444d2.exe

  • Size

    122KB

  • MD5

    e3ea63a34654966ee84a74a7b7a53ffb

  • SHA1

    d0091cf8c244bb34cab3f1d2bddf2a824f1616f3

  • SHA256

    de06af080835b608cd486392e13b22a2c9221a04d708679a34094d4bbbd444d2

  • SHA512

    58c5645547852cb089e321707a005c03efbf67dcd489c98e9a673f4cf4f122019d1a6014120d859e84ac8e8b1828781eb923f8a980e665f8f321e2c4c8e96918

Score
10/10
evasionpersistenceransomware

Malware Config

Extracted

Path

C:\64fz0ff14-readme.txt

Ransom Note
---=== Welcome. Again. ===--- We strongly encourage You to pay your attention to this message and read it to the end. All Your files are encrypted, and currently unavailable, now all files on your system has extension 64fz0ff14 Before that, all of your most important personal and business files were backed up to our secure offline storage. We took them for temporary storage - but we don't need your files and we are not personally interested in your business. Our encryption algorithm is the most technically difficult and max resistant to burglary. Only OUR specialists can decrypted your files without loss(!) Any attempts to decrypt files on your own lead to damage them beyond repair(!) Best way to you will be consent to negotiations and mutual agreement between us. To connect us you need to download TOR browser and follow the link to begin negotiations.(You can find full instructions below.) We are waiting You and ready to listen all your offers and discuss them. If You will ignore this letter - we will have to sell closed auction all yours private files, photoes, business correspondence, documents and business files + with our analysis of your work activity (weakness of your business, financial violations and the opportunity to profit from this information). It will offset our financial losses. Or we'll just put all your files in the public domain, where everyone can download and use them as they wish. * For TOR Browser http://dnpscnbaix6nkwvystl3yxglz7nteicqrou3t75tpcc5532cztc46qyd.onion/ We are known as "Sodinokibi (REvil) Ransomware". For example, this article: https://www.coveware.com/blog/2019/7/15/ransomware-amounts-rise-3x-in-q2-as-ryuk-amp-sodinokibi-spread You have a guarantee that your files will be returned 100 %. And remember, this is only business, nothing personal.. We have a concept of business honor, and we can promise something if we come to a mutual agreement: 1. We guarantee to decrypt all your files in the shortest possible time 2. We will delete all your files and forget about your company. 3. We will show your weaknesses in your networks. .-= INSTRUCTIONS TO CONNECT =-. How to get access on website? You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/466058F6E1A9800D 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decoder.re/466058F6E1A9800D Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: pTYwLeoWspHp589q6PK5lFfxdOGL5KAt2O6rLAYHshDNChs4hK7g1WCceTXqaF2m ggaLacSsaUr/eSl5FwuoWhDNOcJZ4vp5MG0ul8Gwe7hj/cfo2IWGXJk5ybJiRXgF PkvEhQztxEJuZI1TT5tTLLR/IeI5H8dEIynp2voi/2MGQhrKGP/kw/r19GZw0If8 g+sPl/2i6TzcH9Sg9ysS0K0WacIylTSOfIjm8upLv+NuTIhP4wlty+18Bv2Fnm0n m3s1NBMLXSo08rFE4ttHpOqxp/6aJU0OmCt3dpUo+yzC1EoBsagbvELapLGp8msN dQmM73h5XY6kIkg6dDIvddEvMGnt9tG0o3zrIyhqve383YVjPKZ+RFYOqrT8K7WU vxXn8SBVYN6UNn3XaNEiRR2arBnX9RqH/G3bdOyuXQz18jRKTeksUfToixqNQeUb MiZ34+zV1Y4alYnkKIvNQSj+WmrISAoEVd+TPFAHd+FaEo5VepxltLTBzQSKjHUA cYKRDayvwJQpPRADLaS+LSpb/fQynGKsaoqY4mYKpz6iZlActPQAd7Qzu/t/nx/b vlBK4LkQycXs/2T1JYoUm0Fhg0laG8QMhxVJXZHGV4LXUX1goPy1ucV3AEoDF8l3 AdNJTwlIxGxANJuZj2Doq33wMhNQ6mUXTzTuuovv2eYpRMrQTpnOw9HGGT4KguoQ yiDzTzyhsd3uJK5O2lFuEovgI7ID43eB4I00g4907yVVO/7ObX6n+OPY3obkIC26 K9jQQGROkt45v1jT0Nnkl6vGK5eHYpG9uAVP0BOUatHDurZ+6MUJZv1EKayy13xe ton03UX1T+LgvtupDXVY/L/uhkUFXsCq00KPptoJrcOQcpZS+N+bJjToHEKKym7A u8Y1j4ehExx7AyNd+pBkY87YfUK+sTqHjO4CwcMKLWFCXtIFZeEZg4CFIl3ykdL0 BMmFgU3Bmq5x2B9Wk+WIen0f0HSTpZToLPwJInEE3CzpDCXrSilNIUC+gES6NmMd Y9/8CsK6TKuqz2Z+f4UzgPILlCudyUhws03rwAjvApYYAEiQYMz4dmeErwZorl3G AeUX443WWtvOuy1fguMjs3LpnBGe/r2LhDsS+Z/g5SIh1AMEzqnKfU/IXLVB/23y NJzopf9oX2VqYia0AUmWv26n++4iXRdcPzB/7OfkNXc0ssTXVzuE9siJjFuRb0Ra uUIyrnnQQjkVF4zmASDdR+4LokKV1fOQ8nVD3pOVtWhYsQVXbQF0omOAxlL4Yv0F KZcE/8qAf6MuWMLJTiNb6uSWk/U= ---------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all your data!
URLs

http://dnpscnbaix6nkwvystl3yxglz7nteicqrou3t75tpcc5532cztc46qyd.onion/

https://www.coveware.com/blog/2019/7/15/ransomware-amounts-rise-3x-in-q2-as-ryuk-amp-sodinokibi-spread

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/466058F6E1A9800D

http://decoder.re/466058F6E1A9800D

Signatures

  • Modifies Windows Firewall 1 TTPs
    evasion
  • Modifies extensions of user files 10 IoCs

    Ransomware generally changes the extension on encrypted files.

    ransomware
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 25 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Sets desktop wallpaper using registry 2 TTPs 1 IoCs
    ransomware
  • Drops file in Program Files directory 43 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Modifies system certificate store 2 TTPs 2 IoCs
    evasionspywaretrojan
  • Suspicious behavior: EnumeratesProcesses 5 IoCs
  • Suspicious use of AdjustPrivilegeToken 11 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\de06af080835b608cd486392e13b22a2c9221a04d708679a34094d4bbbd444d2.exe
    "C:\Users\Admin\AppData\Local\Temp\de06af080835b608cd486392e13b22a2c9221a04d708679a34094d4bbbd444d2.exe"
    1⤵
    • Modifies extensions of user files
    • Adds Run key to start application
    • Enumerates connected drives
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • Modifies system certificate store
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:948
    • C:\Windows\SysWOW64\netsh.exe
      netsh advfirewall firewall set rule group="Network Discovery" new enable=Yes
      2⤵
        PID:1516
    • C:\Windows\system32\wbem\unsecapp.exe
      C:\Windows\system32\wbem\unsecapp.exe -Embedding
      1⤵
        PID:1196
      • C:\Windows\system32\vssvc.exe
        C:\Windows\system32\vssvc.exe
        1⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:1272
      • C:\Windows\system32\vssvc.exe
        C:\Windows\system32\vssvc.exe
        1⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:528
      • C:\Windows\system32\vssvc.exe
        C:\Windows\system32\vssvc.exe
        1⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:1564

      Network

      MITRE ATT&CK Enterprise v6

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • \??\PIPE\samr
        MD5

        d41d8cd98f00b204e9800998ecf8427e

        SHA1

        da39a3ee5e6b4b0d3255bfef95601890afd80709

        SHA256

        e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

        SHA512

        cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

        Download Submit
      • memory/948-54-0x0000000075601000-0x0000000075603000-memory.dmp
        Filesize

        8KB

        Download