Analysis

  • max time kernel
    135s
  • max time network
    179s
  • platform
    windows7_x64
  • resource
    win7-en-20211208
  • submitted
    24-01-2022 01:34

General

  • Target

    93536a7a4871779f94f765be681af52a33830c50eebad7fedf33c2e921fce3d3.exe

  • Size

    122KB

  • MD5

    6d5e018e9de53f8c7e5020103292cb99

  • SHA1

    47cd7b8ffc9015eb7b9b143d10c2c0f119164ce6

  • SHA256

    93536a7a4871779f94f765be681af52a33830c50eebad7fedf33c2e921fce3d3

  • SHA512

    636f4d8ffb65a71069177d0e5cbb583a53eaa304222340e4f0d57ab88d2645f02e44c6bcdae629bf99a57ff66dea8291f9a7f5d3845aba44ef88e506f5c74fc4

Score
10/10

Malware Config

Extracted

Path

C:\93930f2-readme.txt

Family

ryuk

Ransom Note
---=== Welcome. Again. ===--- Dear employees of Lamas Plastics please convey the information below to your superior staff. We're notifying you. We encrypted your data. Maybe you'll say, "It's okay, we'll roll out backups." Take your time! We have upload almost all the data from your main servers, more 800gb information, database. You can contact us for proof. What is critical you of ignoring our message? 1. If you don't write us within the next 10 days, we'll post on our blog, the news that your company has leaked, and then share your files and some of them that have financial value we will sell at our auction. 2. Our blog is read by all world media, as well as law enforcement bodies, in addition we send anonymous letters with proof to your local media What are the consequences if you don't pay? 1. Damage to reputation. 2. Litigation with your customers (most likely it will come out several times more expensive). 3. Law enforcement officers will come to you and seize all the servers and workstations from you to analyze the hack, which will take several months. As a result, you will have to suspend your work. If you have any questions, please contact the link below. [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your computer has extension 93930f2. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). You must understand, we do not want to do you bad and leave you with a vulnerable system. Our goal is to help you maintain the privacy of your clients and prevent your files from being leaked. You can see our work methods in our blog. If a company don't pay, we public data or sell it in auction: http://dnpscnbaix6nkwvystl3yxglz7nteicqrou3t75tpcc5532cztc46qyd.onion All companies that do not pay the ransom sooner or later end up on the list whose files are sold at auction, or are directly merged in the public. [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. I suggest you read about us on the Internet, we are known as "Sodinokibi Ransomware". For example, this article: https://www.coveware.com/blog/2019/7/15/ransomware-amounts-rise-3x-in-q2-as-ryuk-amp-sodinokibi-spread Pay attention to that: "How Much Data Is Decrypted with a Ransomware Decryptor? In Q2 2019, victims who paid for a decryptor recovered 92% of their encrypted data. This statistic varied dramatically depending on the ransomware type. For example, Ryuk ransomware has a relatively low data recovery rate, at ~ 87%, while Sodinokibi was close to 100%. " Now you have a guarantee that your files will be returned 100 %. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/7C63670D5028C3C2 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decoder.re/7C63670D5028C3C2 Warning: secondary website can be blocked, thats why first variant much better and more available. If you have problem with connect, use strictly TOR version 8.5.5 link for download TOR version 8.5.5 here: https://filehippo.com/download_tor_browser_for_windows/ When you open our website, put the following data in the input form: Key: LXH7qwxplnN0THGUjNB4YKzXwjzKHOyp4aJjo3W6Opmh8gWfR24A5ou5I1hHToZs 54+l++7UlWpCIKfkSwtufiVCAINp91X494QTiO9ZrHfVPvEcDznWRsu+B3wy0PNO FIdo15dNn1+S53Ek+FtnJFc/sU9yhA1HeYyxy6slT/crlRlOxgkZrkuOIiDjDOk8 rjUMefd6+ULdDnlplL2i9NqQdYYVPkTOJQgleDrjXQ999RI9JEI8KE+gFGeLhC+5 W3RHVP+UlIIWs+HkQBnUbZEOonTXldF3P5doBpbI01RFqeM01x6FZKTjsx2k+/UV NdcYUlAD9bSqAW/RmQfEjPDKtf1B+zddWsvfpBJkcqrc1km7sRVIm89KfEy85xJ2 s0vz0fOvMCif6nkCLjBc6iMHCSLeC3mtrZXoqV+HwRuzhfYRL6tNfJRfqRLkGpAM A73TcVQ405mEo7zXCQBbqgF4PO2aVsoqDNAKOwLqCwxuxLisduq11kJ79HIu3g2F FEKXvPZMX9V4a8w929/ISTZPYJIk9th2+Y9MTeoItar8P10BPynbzmgGG3GFxoNg R+eoSKdU88sa6Fy0Tx4N3yNZ48WoSMF8lACJXaTvyPHyaec8s+GpuO7PEQbTkKvE 1ToTSjTu0S3JsGFtau5pbpiKusyLGdLu1gYTEc0jjEpS/OuBm98RE2P4yDsjftAt ozmzOqOJXb246HlS76y5KDid6dnS2UFHX+8N2tAiEZkUuL14Jq/RCjdspihFNw2I jmIMpF86003qL3jWWbRZRuAkFymRYXdmd9hNWmiv9lDIxq090/TQZoL5ZzPiThAz h+RFKSyU2SSvTvMsglXtd8Yx5Ylj8Me8YUIMli+i0oEyU5ztBpaS/Vb2XDooLRNo mc+zqL1eqh07p025lGhu+x86+43qykc6tRIfNVixJkrNaMJ6ODtHyVo54GqpQ5IS U8zZhNC6l123mYoTdBrihfW5dxYl/qtamATo/DNKuYNlZsHBlL+jRK04xrBYuGtk pCigOyKzM7ofGE1a7eYdbtkPZzsHo2ydhn5GbIFKWAmnIjCfOJ23fAvfhjl5YZb9 PYu33oNn9Vj9+q3WlTa5lnW5vyH1mntmpvNr3TusPctJ1gPeOFRJJ4QSNP3V6OPt f1t74HYodeIELxrFEJkpo4FjIrPksURF0tvY4tqc7dCMYRkWvjTHJ6xRbI1hgaZQ PoGj0BrsatOivWcB38sDiUtm1SwsMES10cXRrczTjDrqm8KYFfVIIEji5Xic3ErG vgkxVIxyQsmpPxlCRgNisg== Extension name: 93930f2 ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://dnpscnbaix6nkwvystl3yxglz7nteicqrou3t75tpcc5532cztc46qyd.onion

https://www.coveware.com/blog/2019/7/15/ransomware-amounts-rise-3x-in-q2-as-ryuk-amp-sodinokibi-spread

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/7C63670D5028C3C2

http://decoder.re/7C63670D5028C3C2

https://filehippo.com/download_tor_browser_for_windows/

Signatures

  • Ryuk

    Ransomware distributed via existing botnets, often Trickbot or Emotet.

  • Modifies Windows Firewall 1 TTPs
  • Modifies extensions of user files 8 IoCs

    Ransomware generally changes the extension on encrypted files.

  • Enumerates connected drives 3 TTPs 25 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Sets desktop wallpaper using registry 2 TTPs 1 IoCs
  • Drops file in Program Files directory 28 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Modifies system certificate store 2 TTPs 4 IoCs
  • Suspicious behavior: EnumeratesProcesses 5 IoCs
  • Suspicious use of AdjustPrivilegeToken 8 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\93536a7a4871779f94f765be681af52a33830c50eebad7fedf33c2e921fce3d3.exe
    "C:\Users\Admin\AppData\Local\Temp\93536a7a4871779f94f765be681af52a33830c50eebad7fedf33c2e921fce3d3.exe"
    1⤵
    • Modifies extensions of user files
    • Enumerates connected drives
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • Modifies system certificate store
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1684
    • C:\Windows\SysWOW64\netsh.exe
      netsh advfirewall firewall set rule group="Network Discovery" new enable=Yes
      2⤵
        PID:524
    • C:\Windows\system32\wbem\unsecapp.exe
      C:\Windows\system32\wbem\unsecapp.exe -Embedding
      1⤵
        PID:1148
      • C:\Windows\system32\vssvc.exe
        C:\Windows\system32\vssvc.exe
        1⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:1220
      • C:\Windows\system32\vssvc.exe
        C:\Windows\system32\vssvc.exe
        1⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:1704

      Network

      MITRE ATT&CK Enterprise v6

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • memory/1684-54-0x0000000075D61000-0x0000000075D63000-memory.dmp

        Filesize

        8KB