Analysis

  • max time kernel
    166s
  • max time network
    168s
  • platform
    windows10_x64
  • resource
    win10-en-20211208
  • submitted
    24-01-2022 02:10

General

  • Target

    46fa5e8d0b26f4f94aa0d84610beb7c619216590ec3c7072885421c9a316f6d8.exe

  • Size

    118KB

  • MD5

    f3f5d30242ae83e62457845b4b874155

  • SHA1

    4ff1007d56fd2a4d2fbad33278a72a8cc89a9c8c

  • SHA256

    46fa5e8d0b26f4f94aa0d84610beb7c619216590ec3c7072885421c9a316f6d8

  • SHA512

    c7169d2ba271a81456cce290074e45a6e0646c6d2abe82b027688a76a675f6617b08408dbd234bb77f2ed2b973a55200e2a40e11403030830bdf01d7675f5682

Score
10/10

Malware Config

Extracted

Path

C:\1375724bn-readme.txt

Family

ryuk

Ransom Note
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Dear executives of companies such as DOCUWARE AB, Bakels Sweden and PoolKungen, we ask you to be vigilant. We have encrypted all your servers and also downloaded all important files, databases, invoices, vendors, tax returns, personal data of your customers, etc. Thanks to your IT professional, we were able to easily reach all your servers, for which we are grateful. You will have two options, pay all together, or we will discuss the price with each manager separately. Don't try to deceive us, we will perfectly understand who is writing to us. In the near future, we will create a blog that will indicate that your files are with us and will soon become publicly available, and we will sell more valuable documents at auction. Please be aware that our blog is followed by the world's leading media and law enforcement officials. Hurry up, you are short on time. Your files are encrypted, and currently unavailable. You can check it: all files on your computer has extension 1375724bn. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). Be sure all your files are safe and will not be leaked if payment is made. There is a serious flaw in your security system that makes you a vulnerable target for many who want to compromise your system and gain access to all of your computers. Our team specializes very well in the field of computer security and can help you cover this vulnerabilities and help restore all your files to their original state. And now let's imagine what losses your company will suffer if a huge part of confidential information on customers and partners is in the hands of people who know the value of this information. Given the experience of previous years, even the giants of the financial markets suffered from huge losses with such leaks. I would like to dwell on a small list of problems that you can avoid: 1. Reputation losses 2. Financial damage 3. Lawsuits from customers and partners for the leak of confidential information entailing enormous problems for them. 4. The involvement of federal services for a full check of the company and its financial audit. 5. The actual stagnation of the development of the company and the ability of competitors to take your market share. We think that your risk department can perfectly continue this list without us, but now back to your proposal. Actually, it only says one thing; your security system is not able to protect information and assess the extent of what happened in reality. You can see our work methods in our blog. If a company don't pay, we public data or sell it in auction: http://dnpscnbaix6nkwvystl3yxglz7nteicqrou3t75tpcc5532cztc46qyd.onion All companies that do not pay the ransom sooner or later end up on the list whose files are sold at auction, or are directly merged in the public. [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. I suggest you read about us on the Internet, we are known as "Sodinokibi Ransomware". For example, this article: https://www.coveware.com/blog/2019/7/15/ransomware-amounts-rise-3x-in-q2-as-ryuk-amp-sodinokibi-spread Pay attention to that: "How Much Data Is Decrypted with a Ransomware Decryptor? In Q2 2019, victims who paid for a decryptor recovered 92% of their encrypted data. This statistic varied dramatically depending on the ransomware type. For example, Ryuk ransomware has a relatively low data recovery rate, at ~ 87%, while Sodinokibi was close to 100%. " Now you have a guarantee that your files will be returned 100 %. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/B27A10886534E466 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/B27A10886534E466 Warning: secondary website can be blocked, thats why first variant much better and more available. If you have problem with connect, use strictly TOR version 8.5.5 link for download TOR version 8.5.5 here: https://filehippo.com/download_tor_browser_for_windows/ When you open our website, put the following data in the input form: Key: YiELGkUjXnKFIn6RAQ0vQkwARqnuHd9SmpD2cO51WxE2tAVr3nWNKVyD679iByfJ 7oj9dgsZfp+SU8kUK7MGVYK3BOnSObF0i7rp5QSwdsbZ/K05VZjMc7U9DdEgrmPT qCUhdZGBEGq+pZ77/dyZ1IcZydOFRacoZBCKKV83+KLAw86wfEj2r+6lNS6XOcNK 7Cl0ir5iqMZ0eBNasndyf7rQwYWHAOn+0PWEGolCGPVnVRgU9we2GEoJkgII5sZu qZ+H8tbzu/A9i2PV6SN0YEILguMiqUwNh5zxnLV3hjwuC70SyqU5p85xlEVW5Djb XobvnyLgL0h4PL26LpbOaKB/8Xnhgx6bLGKT4TX0LV0cPfjHZDj3QZ9gYNrMWFE5 Xd5y9jrlrEDhLWyo6WWLcO+poasB3yEQZoVwUHscsroZMtCeJ0JCzloOsyo2Nw+H QP2SJ2C4yozXQpzABOTHMNE1yCH7tH5Mp7ODC62kvya2fBFhR3YuJA+tRurXBTIG ehvsgWwNAN4ejfyYRO4Ly9XB0MI0McNdrxH1x4qRB2W99oupmEp1sNVPAHjNVLGS NxN6jIkTWhjHaTajKyyp4V3YkJm9D9oYoXfcBgKtLVAehS+G9eqKebguuAnA6rnh ynTSg/r8o/NVM1P+5lQoK/nOTH6ZeN8aakQTuiqgdkRHNyxmDzJet5h9ZbWMZIJm VRR0wWX6jUcjmLuUyuP7uuojIaHRAaRW+QO1i29sYgpvJwoqGL5u7D9CXUguoCXM L3sTEf6+0TmJREOHfWFR1xzOFMbN+bjfxv9yV5mrLIVZjK64y/+BmtNW6Wx2p7Lk IumQIDjC0YfCqziLLbNT1wTsFLAkYd+vm7kNH+f2vrR5O4IRb0j8DEVBFymUMJop 35tcVHEI/ny3EQKQ6kyn85suQxRVUMFcXmMmBCpBSj8Bfd/WT0KiURklzdrAh1zr QI3tPHQ9xbk5AAFoDtVIM1Zk9oDPtzUnfzUrbYJgO5PJKYZ7NR7rvIta+4NCsoCu 6quqm0/BRZzC4ewsRdHrQXzc+EL5m38PDCRCVMKwOpxguMmbMQK/XwP2Hl30SGAh bcxbIbjf5dnI4CvA7li8LiBVDLqfGApITfeEgWasXfFnYqU/sb91kuvAO5aHFVYk y91S5sq70fxesaHkiHYeGWjuFwhTWBSoowlyzQPZ/CK1yVpynU388H5Y8kERbHRv LKSZz8vMALPZ+1owVV0N3a38Wy+2dKQZ8MOX8ihQN+dq6qthYILA1Jn1Dh+442Kf bnXFc8hn8YDZOGL4Spa4JZslsU1wdQ== Extension name: 1375724bn ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://dnpscnbaix6nkwvystl3yxglz7nteicqrou3t75tpcc5532cztc46qyd.onion

https://www.coveware.com/blog/2019/7/15/ransomware-amounts-rise-3x-in-q2-as-ryuk-amp-sodinokibi-spread

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/B27A10886534E466

http://decryptor.cc/B27A10886534E466

https://filehippo.com/download_tor_browser_for_windows/

Signatures

  • Ryuk

    Ransomware distributed via existing botnets, often Trickbot or Emotet.

  • Enumerates connected drives 3 TTPs 24 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Program Files directory 30 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 5 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\46fa5e8d0b26f4f94aa0d84610beb7c619216590ec3c7072885421c9a316f6d8.exe
    "C:\Users\Admin\AppData\Local\Temp\46fa5e8d0b26f4f94aa0d84610beb7c619216590ec3c7072885421c9a316f6d8.exe"
    1⤵
    • Enumerates connected drives
    • Drops file in Program Files directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:2464
  • C:\Windows\system32\wbem\unsecapp.exe
    C:\Windows\system32\wbem\unsecapp.exe -Embedding
    1⤵
      PID:1180
    • C:\Windows\system32\vssvc.exe
      C:\Windows\system32\vssvc.exe
      1⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:956

    Network

    MITRE ATT&CK Enterprise v6

    Replay Monitor

    Loading Replay Monitor...

    Downloads