Overview

overview

10

Static

static

10

8ece3ce00a...6e.exe

windows7_x64

10

8ece3ce00a...6e.exe

windows10_x64

10

Analysis

  • max time kernel
    168s
  • max time network
    167s
  • platform
    windows10_x64
  • resource
    win10-en-20211208
  • submitted
    24-01-2022 01:36

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    8ece3ce00a84b7365b96487f215cbbea379a8df57ed7c23a2add8758858fba6e.exe

  • Size

    122KB

  • MD5

    38bb6d3370e91deee960c8aeb6b0a50e

  • SHA1

    ba9e23c4f6e7435e90e92ffef836386053c04ca3

  • SHA256

    8ece3ce00a84b7365b96487f215cbbea379a8df57ed7c23a2add8758858fba6e

  • SHA512

    532b5f6d68b2526250d1c307cf265b84985ce4c4bc4b00a3c6c05edb051bcc6fa06b64c987de1279746a2c5d91c951aa6c4820546cf2985a1e6d608c0a011b22

Score
10/10
evasionpersistenceransomware

Malware Config

Extracted

Path

C:\duv1m9p5-readme.txt

Ransom Note
---=== Welcome. Again. ===--- We strongly encourage You to pay your attention to this message and read it to the end. All Your files are encrypted, and currently unavailable, now all files on your system has extension duv1m9p5 Before that, all of your most important personal and business files were backed up to our secure offline storage. We took them for temporary storage - but we don't need your files and we are not personally interested in your business. Our encryption algorithm is the most technically difficult and max resistant to burglary. Only OUR specialists can decrypted your files without loss(!) Any attempts to decrypt files on your own lead to damage them beyond repair(!) Best way to you will be consent to negotiations and mutual agreement between us. To connect us you need to download TOR browser and follow the link to begin negotiations.(You can find full instructions below.) We are waiting You and ready to listen all your offers and discuss them. If You will ignore this letter - we will have to sell closed auction all yours private files, photoes, business correspondence, documents and business files + with our analysis of your work activity (weakness of your business, financial violations and the opportunity to profit from this information). It will offset our financial losses. Or we'll just put all your files in the public domain, where everyone can download and use them as they wish. * For TOR Browser http://dnpscnbaix6nkwvystl3yxglz7nteicqrou3t75tpcc5532cztc46qyd.onion/ We are known as "Sodinokibi (REvil) Ransomware". For example, this article: https://www.coveware.com/blog/2019/7/15/ransomware-amounts-rise-3x-in-q2-as-ryuk-amp-sodinokibi-spread You have a guarantee that your files will be returned 100 %. And remember, this is only business, nothing personal.. We have a concept of business honor, and we can promise something if we come to a mutual agreement: 1. We guarantee to decrypt all your files in the shortest possible time 2. We will delete all your files and forget about your company. 3. We will show your weaknesses in your networks. .-= INSTRUCTIONS TO CONNECT =-. How to get access on website? You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/35FC0859A7DC3DF3 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decoder.re/35FC0859A7DC3DF3 Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: KZVQr8MGwB6fFOusQsMllJnJoUGWbu8E4vtj0CqMIqyz2yb53ZquaIBnacR5+ZB0 PEhYoxwPvS8cTvi3/MsjM+V15hZ9GFyjF1dp2tE8FjuHWnyUlOJIvhXFL136qzdO 1CWJ5PaxRHKWKGBclMnIapeIok0dea/+OTaaFs9RLxAA0ygq7VFQsIlUQqeJP8B4 7Xr13cvPXb46RqzVxg8dDXRqiMGAZ5O6u1+bVQbPrSedKYsHrOGe0KTxZS4KYJE8 P6HqKZkCAWsNVxI+HHtr1Z65bur3HY3BQ2EWiRw2GgD+mmFYP0f60NGqf+p3Cvkb iaa+Q6ydk9LU0dvNOm2lOq1muEw9nLevpSAfxi9oJz8kW9/EJSWk9EI0NiVHYZrf BfIoKbACDHHlfWqHX44f7mw5Dr8u+PR6VTEAe6nOJcXTaeU1m8bevObHwmL7TNQq M7EgAqhydHDhnRbveSdey3koIBHGk0g+9VZ4pnoZkMGKPdwAI0TLsmVtmCo6iQ9b dfceleyF/yc0Kc2/xRnGrjSpcrP1sg5xxkRfmHeUqIHduoP+Xy+Bo7U+mF3xzlpX 9aXFc2kvUTeRnChxdjOzSM8z13n1x9qc5isfSJyGpT9fHNIeDhX86sqElwWKxMSY odATS6gz3rz2t85GnWJQPpX5WFq9ThWn4F3+/QKpHHM4EJ8+7ebWw1ASBlt5iK8j KZEkdpHoc4acfFTttw0z0oxtVy/CdGClMHpdLbITSfhxsL0lZwdbc1syqci347eP kaiX7Da5lfbVOXb/P4p5WqUDbOz107lnoSMU4Mk063NH1+8zZwPdi71QY/Zvi5j1 Ahd2moBoCQXENSjgeEg+uWy/t/dq3JHXyL6AQQAYiEYJ4L8Z4vW5W8ucmb7xZ5wy JDMgqeNvFvphIUQvUj5AHDjy22kPkDSrVmoO/zgMGxpzM33j0ymEzSQWHFGNyaoQ UpMcQVeWLX6GbNE9FHULfzfWPzBIBsEC3yxgXbmKduLUvyKp2CoNSK9Dj2mig/Ob gc9RDd19t48YrVoyXM8huSK6/aqcCoxixnMLAcIgtq8gKAe78J1zbyMWNSVwNqvP GBXqpbd7j/Uxd9XftN2rmyS+ZMimd5Z5BO0UUJYZnfKcGsczOL7lJtTnC2n5e7kb +NNpxHth0caJq7gisl2yZSGpghicccDzOPff8yTFwEl+/qOl56uXfQQWeTYrBDfF PZFTow9JD0Lv71pJN8rx3obsGkatJUqYFoPAtbgDZxshjgruLghWpj9QhkR2S9Ia hE7nnCqLQdyRwA== ---------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all your data!
URLs

http://dnpscnbaix6nkwvystl3yxglz7nteicqrou3t75tpcc5532cztc46qyd.onion/

https://www.coveware.com/blog/2019/7/15/ransomware-amounts-rise-3x-in-q2-as-ryuk-amp-sodinokibi-spread

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/35FC0859A7DC3DF3

http://decoder.re/35FC0859A7DC3DF3

Signatures

  • Modifies Windows Firewall 1 TTPs
    evasion
  • Modifies extensions of user files 1 IoCs

    Ransomware generally changes the extension on encrypted files.

    ransomware
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 25 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Sets desktop wallpaper using registry 2 TTPs 1 IoCs
    ransomware
  • Drops file in Program Files directory 26 IoCs
  • Drops file in Windows directory 13 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious behavior: EnumeratesProcesses 10 IoCs
  • Suspicious use of AdjustPrivilegeToken 5 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\8ece3ce00a84b7365b96487f215cbbea379a8df57ed7c23a2add8758858fba6e.exe
    "C:\Users\Admin\AppData\Local\Temp\8ece3ce00a84b7365b96487f215cbbea379a8df57ed7c23a2add8758858fba6e.exe"
    1⤵
    • Modifies extensions of user files
    • Adds Run key to start application
    • Enumerates connected drives
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4116
    • C:\Windows\SysWOW64\netsh.exe
      netsh advfirewall firewall set rule group="Network Discovery" new enable=Yes
      2⤵
      • Drops file in Windows directory
      PID:4020
  • C:\Windows\system32\wbem\unsecapp.exe
    C:\Windows\system32\wbem\unsecapp.exe -Embedding
    1⤵
      PID:4280
    • C:\Windows\system32\vssvc.exe
      C:\Windows\system32\vssvc.exe
      1⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:1108

    Network

    MITRE ATT&CK Matrix ATT&CK v6

    Initial Access

    Execution

    Persistence

    Modify Existing Service

    1
    T1031

    Registry Run Keys / Startup Folder

    1
    T1060

    Privilege Escalation

    Defense Evasion

    Modify Registry

    2
    T1112

    Credential Access

    Discovery

    Query Registry

    1
    T1012

    Peripheral Device Discovery

    1
    T1120

    System Information Discovery

    2
    T1082

    Lateral Movement

    Collection

    Exfiltration

    Command and Control

    Impact

    Defacement

    1
    T1491

    Replay Monitor

    Loading Replay Monitor...

    Downloads