Overview

overview

10

Static

static

10

c5d96530df...a5.exe

windows7_x64

10

c5d96530df...a5.exe

windows10_x64

10

Analysis

  • max time kernel
    192s
  • max time network
    190s
  • platform
    windows10_x64
  • resource
    win10-en-20211208
  • submitted
    24-01-2022 01:06

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    c5d96530dfe3ac2c8330bc798beafe36b05d9c403ad98764fefcdc3157f0dda5.exe

  • Size

    201KB

  • MD5

    ccc2793bc8d73bd6771379ae5eff8c16

  • SHA1

    c194ebc9a23aa174c3817dd17c8791acd9d3b419

  • SHA256

    c5d96530dfe3ac2c8330bc798beafe36b05d9c403ad98764fefcdc3157f0dda5

  • SHA512

    5f8630dfbcc0fb52a09d71fbd8881244c150c45f3e4c94caa49b109bdfd0ecb96dd8776aea74a52f498ea60fb13a2f5926424d4d065da4ed09b1b7d2415cd0c2

Score
10/10
sodinokibipersistenceransomware

Malware Config

Extracted

Path

C:\h02s9x-readme.txt

Family

sodinokibi

Ransom Note
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on you computer has expansion h02s9x. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/4DDA036E88C5E05F 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/4DDA036E88C5E05F Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: HbFdZ+NkpiF0d6f7huGtl3b45yL4ZPJ7sAYPYYkmaPACE6YWqx4y82NMZ1rL5+Ag CADnWLjwNGat4CKrv5Lmp1NjxkVmxZygsJ32e4m4pSyE1Tk+osf0d4nVtSaFx2OP BEZ7l68FSwQgL8AZ8YdtzYkMiZH2d9e8XquHbMMyHY9hR3LLOW22OvBr54rvDvJi a5rNTptJBotTRnnt1+hoxFLp+KRBVIz3NQT9QDJcM/hZ1hvsRtK/zlK4pz9ALQ9y gzYkY7kA+7lxkBN/zZRHPiKhGtwqlZw/OsLwR661EB86+M5s/a3Ldarpeqf7XqXo wCdU7kj1xSMbrYG8QT172Yr5HTz+b5mMrU2yP1wqs8quan2PqZEUEbxXysngy8EZ O9MHCtHfMOPjBXtPA78L2vSJ66Ow3DbPJF4BpN8GTwQNH4LJwTfgJnbNyOVzsJbr w8kQEK21vaDp7XQth0H9VIPNOqp43Lz9/GXpJMB8w/lSLyb6pPuMA08RcGfA1MSp Fu/3S5GVzsLFcVWr4qs7EXTxqhCbYB/15NLmaHroX9OmWxycPL0E4yaeKXUzIU4R EM6nCcnoFCi3dr6ElPNSMhT5gt1OH94+4AL/7uo7Z5yM1i5ubzTP6sLwwkitf7dC SGKuxtPQ3+SAHyGH/eJxYBHHhK9Ko6dQak6k4Sfsxhz4EUWcbGhewF5j6ePBoCYq xfY6BX+rtB7MJDwhAePavxn4GzSW2nFxjqu+CpizCPNNC8XCCatdxTR2QbeFTLdJ xdtGcGoyTOPFNguKwpgl5MUG6/Hle7q4jcvAkELisNNReL35r50LBaOGde5LUR4A TG/V8eFcaMD+ZwRuswR5toMwJp/+CPZGd/YVaYPK/8vM9AXIjpPuwur7rKv765IX g6vznyE5rc5rBLa/knacH2lpj6ZCUve1DI1i65zKAuuQGQ8+NE4AAMVAV//Vg8s/ U8e8tc2+xhYlbvYBdcA5ZF9zGdpNyRri29GiEbm6wwXF4D+rzGyihafONGuGyBzG XHw7P9UnBlcRaOzQpMctBR/r0Gc8bj1NB5OLPw4K65Ntaeg+yud+Z26vc6DykPgc 6sZw4SXKAr/cFP/zj9hZTyS15HfyMMAmPhRqiIocAThG3z9O+R+N6PtmGtGJoFfe CNyb4T2EsfH+z9c62U+Wii94JU+u/ZPA3JPDjgKS8XZiOn8iGL5pKnsIFOo5Zdiw No6AGQJ1mWtEYnkJ0D99KETnnIt/VGlnPSJwY0YlwKgNkq2QESbhK7rJmygv9luH YyWy4FAS7vl/mthx0eEk7w== Extension name: h02s9x ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/4DDA036E88C5E05F

http://decryptor.cc/4DDA036E88C5E05F

Signatures

  • Sodin,Sodinokibi,REvil

    Ransomware with advanced anti-analysis and privilege escalation functionality.

    ransomwaresodinokibi
  • Modifies extensions of user files 2 IoCs

    Ransomware generally changes the extension on encrypted files.

    ransomware
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 25 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Sets desktop wallpaper using registry 2 TTPs 1 IoCs
    ransomware
  • Drops file in Program Files directory 36 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 6 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\c5d96530dfe3ac2c8330bc798beafe36b05d9c403ad98764fefcdc3157f0dda5.exe
    "C:\Users\Admin\AppData\Local\Temp\c5d96530dfe3ac2c8330bc798beafe36b05d9c403ad98764fefcdc3157f0dda5.exe"
    1⤵
    • Modifies extensions of user files
    • Adds Run key to start application
    • Enumerates connected drives
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:3208
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -e RwBlAHQALQBXAG0AaQBPAGIAagBlAGMAdAAgAFcAaQBuADMAMgBfAFMAaABhAGQAbwB3AGMAbwBwAHkAIAB8ACAARgBvAHIARQBhAGMAaAAtAE8AYgBqAGUAYwB0ACAAewAkAF8ALgBEAGUAbABlAHQAZQAoACkAOwB9AA==
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:4300
  • C:\Windows\system32\wbem\unsecapp.exe
    C:\Windows\system32\wbem\unsecapp.exe -Embedding
    1⤵
      PID:4072
    • C:\Windows\system32\vssvc.exe
      C:\Windows\system32\vssvc.exe
      1⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:804

    Network

    MITRE ATT&CK Enterprise v6

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/4300-122-0x000001CA747B0000-0x000001CA747B2000-memory.dmp
      Filesize

      8KB

      Download
    • memory/4300-123-0x000001CA747B3000-0x000001CA747B5000-memory.dmp
      Filesize

      8KB

      Download
    • memory/4300-124-0x000001CA744C0000-0x000001CA744E2000-memory.dmp
      Filesize

      136KB

      Download
    • memory/4300-127-0x000001CA748C0000-0x000001CA74936000-memory.dmp
      Filesize

      472KB

      Download