Overview

overview

10

Static

static

10

b313426ba7...12.exe

windows7_x64

10

b313426ba7...12.exe

windows10_x64

10

Analysis

  • max time kernel
    151s
  • max time network
    171s
  • platform
    windows7_x64
  • resource
    win7-en-20211208
  • submitted
    24-01-2022 01:16

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    b313426ba7ef3c6f0813b4c5d9a07d5ce90a2313d407def386ccf242a9e49612.exe

  • Size

    164KB

  • MD5

    6bbb8d6df3fd7439c39a41e56c0fcd1f

  • SHA1

    a02865ffa7434d0ea903323677588729c5d6989f

  • SHA256

    b313426ba7ef3c6f0813b4c5d9a07d5ce90a2313d407def386ccf242a9e49612

  • SHA512

    82e97dff15e48ab3b7dad80e557d08574b223f5875cb08ab445d8de64b6b3941ffc4e35c1d4ab5271bf9248ce72b708c175fb52426c9d99022969855f37459f4

Score
10/10
ryukransomware

Malware Config

Extracted

Path

C:\e4ld086vqb-readme.txt

Family

ryuk

Ransom Note
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your computer has extension e4ld086vqb. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. I suggest you read about us on the Internet, we are known as "Sodinokibi Ransomware" , for example, this article: https://www.coveware.com/blog/2019/7/15/ransomware-amounts-rise-3x-in-q2-as-ryuk-amp-sodinokibi-spread Pay attention to that: "How Much Data Is Decrypted with a Ransomware Decryptor? In Q2 2019, victims who paid for a decryptor recovered 92% of their encrypted data. This statistic varied dramatically depending on the ransomware type. For example, Ryuk ransomware has a relatively low data recovery rate, at ~ 87%, while Sodinokibi was close to 100%. " Now you have a guarantee that your files will be returned 100 %. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/3DF8A866A4E5AA08 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.top/3DF8A866A4E5AA08 Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: NaSi5Rx92HG4i1t7HZBGfeK/FvMvm9o5swdfbunZtw8qtXz8puaVsrE6z3Hoj5im GQLUQ7ee+U0HqMMWAy9J3ufMCp3I2/LOdKYFsXVHvESv86zONP29+J6op5PMwD6Y 22T89NmXSsFTkFpSV9Kvad8KuZFkp1smDsdiFYlEKb4S9+56danwaPKBGBcRsE// DzsqYplvx16RlQI8T1kqca4O08oIxoFr/fD1eEaZiespdj5H9ASgjPwuW/AXupEq Pg8vCDJGHNDHAsW8ITXPeL9BmxDaTJwU94IxWBhqMWjts0bELtrGmFwZrm6EbwZ/ rrIZfry1C2GZrtwyGl9+HijxXWLvM7nuggBd0ueKkz+MQCxCdjS8flSREbZ0qf8R EcxFS7pTIwI+qKxBnoHGxaDvZrj5/fWza1TcRpx7xa45nl0foqvVXLplLbwJZXod rNdVk3mXtsTrnyHj/omvuViWedtBEi8Fd98U45MHrIQ2C837z7Qy6TXG7EO48U+H fcys9zbzEvNwQcEweO98CkyiUaU3bnGk9387QToAecuxhEd6nS6puch06nlmqXt4 m0FbX+tb9wBWchYZ8uhYjOBePopWHeTkxWi0sl3GR4D1346a0pa171ibEUIEaMSO EubwfjbnXnWwcVcIpw8PkxhBahUf4GfMmjCzq9fLQkBuh9jbLv/Bve4EGXGHRgrN Qz8IOzEI3PrTlJX+PUeWj+qZsvW42pzhGtldBqW8fQSazYcPAP4zy2icoZGreV5q byInIgLKK4rJU7ffQ/mCZPUdyRuqUCKNpPlF0Kyg972Y+Vj12csqrQ/TJVltJCQT niks7YzuuTbT4Xdd5oVelLvHTwrVsqMCG3WKSOGUpea+MOI2JmVlv1z2mokXrTv1 OGzoYagTBpFLD7Mib2xZMhlPvNXvfWZgv7trF+PM0n8LqZkeaTtzlq2MtKnRUoIs Wv2ZpjaU0pCJjf3IFq/nv60PVkcb6Psp87W52NOBrcHtMkyIFmKdznLGi3beHRJV E5WomM8bBZ8GBAoweaVqdrFclmzjraY4pS5igBCZtkVq3gDOaOy86T30WqD+HLOw mt4mkBNL24xvupxFto5N1DseW1hCRSSMsDDyyLQ0Oc1s9Tmmt4HSYkkxy4eznZf1 VXHaKHLFMD0ZXsH7 Extension name: e4ld086vqb ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

https://www.coveware.com/blog/2019/7/15/ransomware-amounts-rise-3x-in-q2-as-ryuk-amp-sodinokibi-spread

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/3DF8A866A4E5AA08

http://decryptor.top/3DF8A866A4E5AA08

Signatures

  • Ryuk

    Ransomware distributed via existing botnets, often Trickbot or Emotet.

    ransomwareryuk
  • Modifies extensions of user files 7 IoCs

    Ransomware generally changes the extension on encrypted files.

    ransomware
  • Enumerates connected drives 3 TTPs 25 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in System32 directory 1 IoCs
  • Sets desktop wallpaper using registry 2 TTPs 1 IoCs
    ransomware
  • Drops file in Program Files directory 25 IoCs
  • Modifies system certificate store 2 TTPs 2 IoCs
    evasionspywaretrojan
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\b313426ba7ef3c6f0813b4c5d9a07d5ce90a2313d407def386ccf242a9e49612.exe
    "C:\Users\Admin\AppData\Local\Temp\b313426ba7ef3c6f0813b4c5d9a07d5ce90a2313d407def386ccf242a9e49612.exe"
    1⤵
    • Modifies extensions of user files
    • Enumerates connected drives
    • Drops file in System32 directory
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • Modifies system certificate store
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:1540
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -e RwBlAHQALQBXAG0AaQBPAGIAagBlAGMAdAAgAFcAaQBuADMAMgBfAFMAaABhAGQAbwB3AGMAbwBwAHkAIAB8ACAARgBvAHIARQBhAGMAaAAtAE8AYgBqAGUAYwB0ACAAewAkAF8ALgBEAGUAbABlAHQAZQAoACkAOwB9AA==
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:1720
  • C:\Windows\system32\wbem\unsecapp.exe
    C:\Windows\system32\wbem\unsecapp.exe -Embedding
    1⤵
      PID:576
    • C:\Windows\system32\vssvc.exe
      C:\Windows\system32\vssvc.exe
      1⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:968

    Network

    MITRE ATT&CK Enterprise v6

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/1540-55-0x0000000075D61000-0x0000000075D63000-memory.dmp

      Filesize

      8KB

      Download

    • memory/1720-56-0x000007FEFB5D1000-0x000007FEFB5D3000-memory.dmp

      Filesize

      8KB

      Download

    • memory/1720-58-0x0000000002620000-0x0000000002622000-memory.dmp

      Filesize

      8KB

      Download

    • memory/1720-60-0x0000000002624000-0x0000000002627000-memory.dmp

      Filesize

      12KB

      Download

    • memory/1720-59-0x0000000002622000-0x0000000002624000-memory.dmp

      Filesize

      8KB

      Download

    • memory/1720-57-0x000007FEF26A0000-0x000007FEF31FD000-memory.dmp

      Filesize

      11.4MB

      Download

    • memory/1720-61-0x000000000262B000-0x000000000264A000-memory.dmp

      Filesize

      124KB

      Download