Analysis

  • max time kernel
    153s
  • max time network
    145s
  • platform
    windows10_x64
  • resource
    win10-en-20211208
  • submitted
    24-01-2022 01:34

General

  • Target

    93536a7a4871779f94f765be681af52a33830c50eebad7fedf33c2e921fce3d3.exe

  • Size

    122KB

  • MD5

    6d5e018e9de53f8c7e5020103292cb99

  • SHA1

    47cd7b8ffc9015eb7b9b143d10c2c0f119164ce6

  • SHA256

    93536a7a4871779f94f765be681af52a33830c50eebad7fedf33c2e921fce3d3

  • SHA512

    636f4d8ffb65a71069177d0e5cbb583a53eaa304222340e4f0d57ab88d2645f02e44c6bcdae629bf99a57ff66dea8291f9a7f5d3845aba44ef88e506f5c74fc4

Score
10/10

Malware Config

Extracted

Path

C:\y720983ua3-readme.txt

Family

ryuk

Ransom Note
---=== Welcome. Again. ===--- Dear employees of Lamas Plastics please convey the information below to your superior staff. We're notifying you. We encrypted your data. Maybe you'll say, "It's okay, we'll roll out backups." Take your time! We have upload almost all the data from your main servers, more 800gb information, database. You can contact us for proof. What is critical you of ignoring our message? 1. If you don't write us within the next 10 days, we'll post on our blog, the news that your company has leaked, and then share your files and some of them that have financial value we will sell at our auction. 2. Our blog is read by all world media, as well as law enforcement bodies, in addition we send anonymous letters with proof to your local media What are the consequences if you don't pay? 1. Damage to reputation. 2. Litigation with your customers (most likely it will come out several times more expensive). 3. Law enforcement officers will come to you and seize all the servers and workstations from you to analyze the hack, which will take several months. As a result, you will have to suspend your work. If you have any questions, please contact the link below. [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your computer has extension y720983ua3. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). You must understand, we do not want to do you bad and leave you with a vulnerable system. Our goal is to help you maintain the privacy of your clients and prevent your files from being leaked. You can see our work methods in our blog. If a company don't pay, we public data or sell it in auction: http://dnpscnbaix6nkwvystl3yxglz7nteicqrou3t75tpcc5532cztc46qyd.onion All companies that do not pay the ransom sooner or later end up on the list whose files are sold at auction, or are directly merged in the public. [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. I suggest you read about us on the Internet, we are known as "Sodinokibi Ransomware". For example, this article: https://www.coveware.com/blog/2019/7/15/ransomware-amounts-rise-3x-in-q2-as-ryuk-amp-sodinokibi-spread Pay attention to that: "How Much Data Is Decrypted with a Ransomware Decryptor? In Q2 2019, victims who paid for a decryptor recovered 92% of their encrypted data. This statistic varied dramatically depending on the ransomware type. For example, Ryuk ransomware has a relatively low data recovery rate, at ~ 87%, while Sodinokibi was close to 100%. " Now you have a guarantee that your files will be returned 100 %. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/E484F7682B03FDF6 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decoder.re/E484F7682B03FDF6 Warning: secondary website can be blocked, thats why first variant much better and more available. If you have problem with connect, use strictly TOR version 8.5.5 link for download TOR version 8.5.5 here: https://filehippo.com/download_tor_browser_for_windows/ When you open our website, put the following data in the input form: Key: +zAh1TFlmnSgAsYINw5cFEV9VOZkhF6HEbGv2qjN1s/B7bq4WeJ+5BZgSs5/M4RP 6tn205ZLmCGWd5DecTH+piiKFIUcK7CQOZzzv6pkdEnuUgWdrsCqJq/mo5E3YO91 aCTr7EivFtugDFIX04+gjB66GQPqgC6hXz82NK/S1JcKVeVF8YjzUJ4AKgGK1788 6jLdAyJCpl7E2tC3BvjVC7rcodx/1vjOc4eDm8qpzAyeDmDvH+ZLR4VuenBE102b 14AnlsaI51oMTn+eJHFagBE+x3tGpu4P5x0QMUKfI5z12c6tAvxQdZfljIPhFSKa d/AkfbDRg2JvNr+yrABOYd0Yeu3isqMFJl/fuzLPGlHrBxHwLPvgduxNmR4AhyPN uKxesTpPVg3C29cPSUDpr+RWUNs1wctwC22bEJEisPT1DeBEACslBuvHbd6QDTjm 5yEU0LBUDjJSoKNxybCaNROb/DTA+NJ2c4umgQjRgZejCiBNn1D6EYtEzyHVplg7 PtgTYm7Em0EN12Wvb/nGh1558GpowQjRyAPWCBSi/wr2OxpKVvUmEr2NU2VInOjk wFk6wlA6MfctqRCd4IgnCZrfqcfTpTtZ/0uTBfeQHbwRlhDbag8S73wWbueyBRd1 fYshnzFtHEseEL7QzeiocNnoitZ6OtcZyhLi8aYyUwjJhtNMGYZ5ijSHXv0vy46e JQ6XEYuCiuE9vraQKTaXIh17Oj/8qAR1/pP5vqL+NBjYV3eb52wUlVTUlDqTVGIo 8Qhd1vxJEc1HTCe1pI7OAZdq6imev+NxaeJT1X5TDxQWmnDM5QkK0iCINpOfbcK4 CzmuFScmFa+lNlUOUCgGAc+AViU7IRM9KyUUwENxgDEIcNueeX7l/Vi6oVCuM98t Gm0kwCAJ2nuMCEnTqHUUMaCi3zxnX+OYbrBYuP85CSYKeiKB2R8DqALZvJJ4o/JZ +1fR/4VypG9j+FGsqymmLs4w5dBBoMj1Xiz6CyoIfFJwep1FPQRr0LO+bOKOc94S nwSLTYph5OpcCRyH4IH6HngMoIeUIHtkF0pSDiyJiSFEF9S32Xd70tnB8yNOqVLg 3ozSCH9rKtHCJ8VaOuz+NLvxI0D9XlqGExcUX5rGr53HpIzix76TRvMkjYS1DhQN frwg1RtXsbhxFkL6mUt5rX5zio3bQ9D4X/2ZH6QEY3grt0resk92E494z7KA+e2X NtSd6QmwoTucukYwbF95Vh4G2zAyt/sRQerSBrDv7aJRjg7oArc3IPQC4oWaO2si xQX215vDAfsaQAHMF70= Extension name: y720983ua3 ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://dnpscnbaix6nkwvystl3yxglz7nteicqrou3t75tpcc5532cztc46qyd.onion

https://www.coveware.com/blog/2019/7/15/ransomware-amounts-rise-3x-in-q2-as-ryuk-amp-sodinokibi-spread

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/E484F7682B03FDF6

http://decoder.re/E484F7682B03FDF6

https://filehippo.com/download_tor_browser_for_windows/

Signatures

  • Ryuk

    Ransomware distributed via existing botnets, often Trickbot or Emotet.

  • Modifies Windows Firewall 1 TTPs
  • Modifies extensions of user files 2 IoCs

    Ransomware generally changes the extension on encrypted files.

  • Enumerates connected drives 3 TTPs 25 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Program Files directory 38 IoCs
  • Drops file in Windows directory 13 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious behavior: EnumeratesProcesses 10 IoCs
  • Suspicious use of AdjustPrivilegeToken 5 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\93536a7a4871779f94f765be681af52a33830c50eebad7fedf33c2e921fce3d3.exe
    "C:\Users\Admin\AppData\Local\Temp\93536a7a4871779f94f765be681af52a33830c50eebad7fedf33c2e921fce3d3.exe"
    1⤵
    • Modifies extensions of user files
    • Enumerates connected drives
    • Drops file in Program Files directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1628
    • C:\Windows\SysWOW64\netsh.exe
      netsh advfirewall firewall set rule group="Network Discovery" new enable=Yes
      2⤵
      • Drops file in Windows directory
      PID:4092
  • C:\Windows\system32\wbem\unsecapp.exe
    C:\Windows\system32\wbem\unsecapp.exe -Embedding
    1⤵
      PID:4032
    • C:\Windows\system32\vssvc.exe
      C:\Windows\system32\vssvc.exe
      1⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:2608

    Network

    MITRE ATT&CK Enterprise v6

    Replay Monitor

    Loading Replay Monitor...

    Downloads