Analysis

  • max time kernel
    179s
  • max time network
    190s
  • platform
    windows10_x64
  • resource
    win10-en-20211208
  • submitted
    24-01-2022 02:10

General

  • Target

    4808d86fd26fa9e62a959f6cb31ca2334cba8b834b6287fd72bd512eee6e1880.exe

  • Size

    164KB

  • MD5

    f0284d4e56bde839b8b440a949928c90

  • SHA1

    588210f0932ba9edb88f2f0fdd6163f6c671bf35

  • SHA256

    4808d86fd26fa9e62a959f6cb31ca2334cba8b834b6287fd72bd512eee6e1880

  • SHA512

    0ce3d5c8e2ea534630ed3fb4b05dddc1710c44abc7b522f19ddd418e2c66c78f463429d13fddc6fdd5c050dc315395985a90d79530c008ac5b6207db0cabec2b

Score
10/10

Malware Config

Extracted

Path

C:\a58q50o_Wannadie.txt

Family

sodinokibi

Ransom Note
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your computer has extension a58q50o. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/CAE6068BD15003F0 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.top/CAE6068BD15003F0 Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: P2m+G2Aw8NV/EIMxuTNglkr2saVKQarSdSkEBAZDGWKVPo2u2ELkjV0Ww6IbBZpd tUXnsT2eh61HTVy/gUDhk7djKSPTqp9Pb5/tDGdq5ZAxFe2khgm2BV1xbwdR7GN+ qPykcxVj1mguoqd9k4G70qMaLFIwxxeJmhjZM5Wne0AiWeOJWNeKCWodL51JF22V YJC+NuF535Fua8hJVrJWzgY5mChjXt1XhI6vmq0ilz2bD1wLhbwS4JEHez2Td/i1 zArudhR/D7mJf121bWZCks7/ZAftF4nKP1r+X4WEWXoFhqq4IZBF4qJNpln/o63V 5pUiPagnDsXdr4iwTKQ4YYt6Tg6/9EsdaJ3epBfvGDAfHRYMDNjS7jQGLZSgKoKf DY5mzImC9WU+8yS/GhBn7QfEdKoYWuG/4UqHHqw+ABA0d/lAUX1kEmYcKnxZy5rE ItPogDCAx097CV7fSWz2r8Uq2mHcNuvcGRywiLe38ogbkY8tzZ1FEAQBJuUPmdXV cwxIuBCXCmsLWChQk2dO7s4RIA2FDZuOMccKiJw9fHmxL3frOoY1/qkF87cF3XXa x9/uyo9O0i4pxg4lu/8Pik2srWad82ICebPGvlsQj03S+i3J3sgtgkdLqD9HFsae a31pdpJ0G9mwMXqssnUpQWSL8X0x+xcZ/NsTmD/S5hV0zqAYFy9IFjpwJZkcMtDF xjiobqGgbY7rUFDjBmBfIWFLzrvboU1Tvfr9haYU1HV6LwvlJ8jtLZNYlNf+KcqY Ila5deFDl4QwRl4iNdeAJE3ME8VT2iwcYj11l/4W8a2+g/Jzw1WWrhtooLIfIGF8 Js8n4i/Vde+CgAxsLqlAkZMB9SKvzqdg+vTCy7Lx9y7eBH558tKyP5EdeGjrEtPI xPzsPIb888pC4tuYLhCGYeZTt+pC+aNoUh+ZjNw//qERuyTqJxZFE9gxNIh1wd7l 2U+nJUmWH3d4l5SPU/6Y3Mit21HR1drJENxf21PbBZWw0qAgVHsUI7Xj91M4S6+V TS64ZkiVKzTItyexyHdrSRSeQQK4UkoXqK3zRXMseUKUgutzdPlyqwUjwEMx1oGe TJcayNEJ9PiLoadpOCwtEmB5oj80YMpOY0WPPResfmQxeVSCDJkHtXt+BMHAzQ== Extension name: a58q50o ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/CAE6068BD15003F0

http://decryptor.top/CAE6068BD15003F0

Signatures

  • Sodin,Sodinokibi,REvil

    Ransomware with advanced anti-analysis and privilege escalation functionality.

  • Modifies extensions of user files 5 IoCs

    Ransomware generally changes the extension on encrypted files.

  • Enumerates connected drives 3 TTPs 25 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Sets desktop wallpaper using registry 2 TTPs 1 IoCs
  • Drops file in Program Files directory 24 IoCs
  • Modifies data under HKEY_USERS 42 IoCs
  • Suspicious behavior: EnumeratesProcesses 15 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\4808d86fd26fa9e62a959f6cb31ca2334cba8b834b6287fd72bd512eee6e1880.exe
    "C:\Users\Admin\AppData\Local\Temp\4808d86fd26fa9e62a959f6cb31ca2334cba8b834b6287fd72bd512eee6e1880.exe"
    1⤵
    • Modifies extensions of user files
    • Enumerates connected drives
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:3616
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -e RwBlAHQALQBXAG0AaQBPAGIAagBlAGMAdAAgAFcAaQBuADMAMgBfAFMAaABhAGQAbwB3AGMAbwBwAHkAIAB8ACAARgBvAHIARQBhAGMAaAAtAE8AYgBqAGUAYwB0ACAAewAkAF8ALgBEAGUAbABlAHQAZQAoACkAOwB9AA==
      2⤵
      • Modifies data under HKEY_USERS
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:4540
  • C:\Windows\system32\wbem\unsecapp.exe
    C:\Windows\system32\wbem\unsecapp.exe -Embedding
    1⤵
      PID:4164
    • C:\Windows\system32\vssvc.exe
      C:\Windows\system32\vssvc.exe
      1⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:1268

    Network

    MITRE ATT&CK Matrix ATT&CK v6

    Defense Evasion

    Modify Registry

    1
    T1112

    Discovery

    Query Registry

    1
    T1012

    Peripheral Device Discovery

    1
    T1120

    System Information Discovery

    1
    T1082

    Impact

    Defacement

    1
    T1491

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/3616-117-0x00000000003F0000-0x00000000003FA000-memory.dmp
      Filesize

      40KB

    • memory/3616-118-0x0000000000600000-0x000000000074A000-memory.dmp
      Filesize

      1.3MB

    • memory/3616-119-0x0000000000600000-0x000000000074A000-memory.dmp
      Filesize

      1.3MB

    • memory/3616-120-0x0000000000760000-0x0000000000761000-memory.dmp
      Filesize

      4KB

    • memory/3616-121-0x0000000000770000-0x0000000000776000-memory.dmp
      Filesize

      24KB

    • memory/4540-126-0x000001A0001D0000-0x000001A0001F2000-memory.dmp
      Filesize

      136KB

    • memory/4540-129-0x000001A000380000-0x000001A0003F6000-memory.dmp
      Filesize

      472KB

    • memory/4540-136-0x000001A067AB0000-0x000001A07FCA0000-memory.dmp
      Filesize

      385.9MB

    • memory/4540-137-0x000001A067AB0000-0x000001A07FCA0000-memory.dmp
      Filesize

      385.9MB