Analysis

  • max time kernel
    145s
  • max time network
    129s
  • platform
    windows7_x64
  • resource
    win7-en-20211208
  • submitted
    24-01-2022 02:10

General

  • Target

    46fa5e8d0b26f4f94aa0d84610beb7c619216590ec3c7072885421c9a316f6d8.exe

  • Size

    118KB

  • MD5

    f3f5d30242ae83e62457845b4b874155

  • SHA1

    4ff1007d56fd2a4d2fbad33278a72a8cc89a9c8c

  • SHA256

    46fa5e8d0b26f4f94aa0d84610beb7c619216590ec3c7072885421c9a316f6d8

  • SHA512

    c7169d2ba271a81456cce290074e45a6e0646c6d2abe82b027688a76a675f6617b08408dbd234bb77f2ed2b973a55200e2a40e11403030830bdf01d7675f5682

Malware Config

Extracted

Path

C:\01x7n11eo3-readme.txt

Family

ryuk

Ransom Note
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Dear executives of companies such as DOCUWARE AB, Bakels Sweden and PoolKungen, we ask you to be vigilant. We have encrypted all your servers and also downloaded all important files, databases, invoices, vendors, tax returns, personal data of your customers, etc. Thanks to your IT professional, we were able to easily reach all your servers, for which we are grateful. You will have two options, pay all together, or we will discuss the price with each manager separately. Don't try to deceive us, we will perfectly understand who is writing to us. In the near future, we will create a blog that will indicate that your files are with us and will soon become publicly available, and we will sell more valuable documents at auction. Please be aware that our blog is followed by the world's leading media and law enforcement officials. Hurry up, you are short on time. Your files are encrypted, and currently unavailable. You can check it: all files on your computer has extension 01x7n11eo3. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). Be sure all your files are safe and will not be leaked if payment is made. There is a serious flaw in your security system that makes you a vulnerable target for many who want to compromise your system and gain access to all of your computers. Our team specializes very well in the field of computer security and can help you cover this vulnerabilities and help restore all your files to their original state. And now let's imagine what losses your company will suffer if a huge part of confidential information on customers and partners is in the hands of people who know the value of this information. Given the experience of previous years, even the giants of the financial markets suffered from huge losses with such leaks. I would like to dwell on a small list of problems that you can avoid: 1. Reputation losses 2. Financial damage 3. Lawsuits from customers and partners for the leak of confidential information entailing enormous problems for them. 4. The involvement of federal services for a full check of the company and its financial audit. 5. The actual stagnation of the development of the company and the ability of competitors to take your market share. We think that your risk department can perfectly continue this list without us, but now back to your proposal. Actually, it only says one thing; your security system is not able to protect information and assess the extent of what happened in reality. You can see our work methods in our blog. If a company don't pay, we public data or sell it in auction: http://dnpscnbaix6nkwvystl3yxglz7nteicqrou3t75tpcc5532cztc46qyd.onion All companies that do not pay the ransom sooner or later end up on the list whose files are sold at auction, or are directly merged in the public. [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. I suggest you read about us on the Internet, we are known as "Sodinokibi Ransomware". For example, this article: https://www.coveware.com/blog/2019/7/15/ransomware-amounts-rise-3x-in-q2-as-ryuk-amp-sodinokibi-spread Pay attention to that: "How Much Data Is Decrypted with a Ransomware Decryptor? In Q2 2019, victims who paid for a decryptor recovered 92% of their encrypted data. This statistic varied dramatically depending on the ransomware type. For example, Ryuk ransomware has a relatively low data recovery rate, at ~ 87%, while Sodinokibi was close to 100%. " Now you have a guarantee that your files will be returned 100 %. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/CA0F81BABD219E86 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/CA0F81BABD219E86 Warning: secondary website can be blocked, thats why first variant much better and more available. If you have problem with connect, use strictly TOR version 8.5.5 link for download TOR version 8.5.5 here: https://filehippo.com/download_tor_browser_for_windows/ When you open our website, put the following data in the input form: Key: 12Fi2vamzpN28mDBdRg7qm8I/paTDgUh5rXsLaCFN73o88bE/KUvIgGPkyhiuj6q iqnrjjPdWExX3qrUY/PW84K3xZbszn6GAKejciHMXXF0kci7O6jpNDnH2BvtjmF8 Qyw8SgnwPLzux775gDFOZttZzU65j/ApHWsVaVd5kw0C95fTnql8R0OovPrPNHWH yBS+MgxEH76pydERQPDPba6gNtI1P2zeQkxSFYgCRhR3WI25QhmyTpOgpqH+q5CQ CNIf+qZlRjDJpvWcdO4bbtTkj+Ob204DFBTb9O5UbaPZ05CvHUGbf+m2VqvqLEiJ 8CJHNO/g5G6EKfQj3f3H0HCC5b8ZhJDNwwbfOED7hptrkXrkRgz0MM/psrCdKaMx 51MBian0ep4O7Uq5TKi5vkm5JmKv8kqo+UszuP3WZdjNUfEgIpw4x3Kvyu34l28L vDmNX8EvDaQ/b0oGabd/4ea+ynMSxb1eBDIPU4F0AnLAxjovVtH/PoBH0fIx/beI JH0jvsH5m0YGCClrQ/i1mgQtYy+HSqIVafD+k6yqRzEWTI46UR46BPFpcyOCmSQ7 kX1xdc71Y4q1NuKP9Y1AOWTutKLKybx+jPqfmzxSjNbmUf7hx8gQhOBe9f7rrr/P myZVOw/wg9Xw+7PR/r+0RFF361oKNnY6Lt8mF/j/Zv9KHQlhwrsWlLE+CB9CoLWY f0FAkTginXCihftU1Nu/gypCU2Z/FQRZez5jLE2nFV3I9cxpv90bG47bUohzdwzo oGk2V750bRS6baPvX/o9ZYzIyVWyVW73Jxfzv5prLygHaN+wLuUI+V3WFtc5pxQx QhPUYezuCll+HLu4hc+1pcFs9OWRpoURo8aQtXYH5PScqjGCZ+W9vs+W/BHDN0QS rdvjdMoxitA82tQP5ChGy7XtVn8bzDtpwuWIFw/V4PyGSz0m+FqFSlprVhINqxC1 ARUa0DYzQz1gzcnpSIfN9UNZ+PqmJydRwLPZ2S76pG6ZFA2ZcxBz/LvHaEvMScLl rYgHGatEMOGkPJU70ijzg2prJil6jhSWR3w9DraY3luUrlZwl3g80KSrv63BFBx4 cid9PfRtmu3aEP82qx7EbqFCr3F3T4lhi3zXqD5WQ/aXldDNEniyq7vQaqAoWIxW fTQcJ5eLIfthtIMP9rIvEJc8XwsNKJq0MBAIhbf23YYlRdWafPq6JNMM30ZYJ1yf q8cnEq40yODNH1gWRoUyA1ZPnejZjbHQTBrfoGwXRw4vhW9LtaMhvUbQactR+RNi +8Z+SZNVlQRuRZRFIFJwiHNoXIdYhRUxAXT3HPd0j/A= Extension name: 01x7n11eo3 ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://dnpscnbaix6nkwvystl3yxglz7nteicqrou3t75tpcc5532cztc46qyd.onion

https://www.coveware.com/blog/2019/7/15/ransomware-amounts-rise-3x-in-q2-as-ryuk-amp-sodinokibi-spread

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/CA0F81BABD219E86

http://decryptor.cc/CA0F81BABD219E86

https://filehippo.com/download_tor_browser_for_windows/

Signatures

  • Ryuk

    Ransomware distributed via existing botnets, often Trickbot or Emotet.

  • Modifies extensions of user files 5 IoCs

    Ransomware generally changes the extension on encrypted files.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Enumerates connected drives 3 TTPs 24 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Program Files directory 34 IoCs
  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 5 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\46fa5e8d0b26f4f94aa0d84610beb7c619216590ec3c7072885421c9a316f6d8.exe
    "C:\Users\Admin\AppData\Local\Temp\46fa5e8d0b26f4f94aa0d84610beb7c619216590ec3c7072885421c9a316f6d8.exe"
    1⤵
    • Modifies extensions of user files
    • Enumerates connected drives
    • Drops file in Program Files directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:1064
  • C:\Windows\system32\wbem\unsecapp.exe
    C:\Windows\system32\wbem\unsecapp.exe -Embedding
    1⤵
      PID:1676
    • C:\Windows\system32\vssvc.exe
      C:\Windows\system32\vssvc.exe
      1⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:1896

    Network

    MITRE ATT&CK Enterprise v6

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/1064-54-0x0000000076001000-0x0000000076003000-memory.dmp

      Filesize

      8KB