Analysis
- max time kernel
146s - max time network
174s - platform
windows7_x64 - resource
win7-en-20211208 - submitted
24/01/2022, 02:18
General
- Target 338e8f24eeb38b5ef67ef662b65d592c816eba94dfaaac856021dac407daf294.exe
- Size 164KB
- Sample220124-crgf2aacc2
- SHA256 338e8f24eeb38b5ef67ef662b65d592c816eba94dfaaac856021dac407daf294
Score
10/10
Malware Config
Extracted
Path
-
C:\c0v9r-readme.txt
-
sodinokibi
Ransom Note
- ---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on you computer has expansion c0v9r. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/CE5F1BFDA648CAEF 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.top/CE5F1BFDA648CAEF Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: WkA9ay9Q31IDkcGuj2dp9nixy2ooZ1PFqTyhCNXTBwqSMKi0QCt6okF/HNY3Vhib REFc3lqdT0P5hMUosxqSQGhis4mlJA76Z6fMb2ChuO5aCuzDoHRpiP58n0OKR/Db mDoq0CVFVozbn9pAxAKvpopdyPbZhNCoXwmG8ox9VpLY7mZy1kDyEpKzp4UzjaEk 9lSvrSwhR9igwZ/ZklmaxPMCDaFO2r2eZE2KmGgfXaqiPn/AcxR8m8k/gRgpxJ1m +TTWLsopEYZkAbaDd5FrjMzFz8FEH44e/R/0ygFZT92uexQp2bIlQgHGIK0Mhufy voT0eqS53putgWRbxPbHRCUmzVEnPg8AedeSsUelDIR1X445oKKAEi0FF8QGUlcG r0xhfe4FkV6jeKG2mVPzj4V6bP8aT9IXWwghqLakxKnGCGN6lnkOzDIuI1w2tU+h W2r6d4BtVwb/1lE1KSHMauhFcxidcCkjHed7qpFlZGDfV9cUPuTYuvo1loNUB9Nz BIlRIqbicAnfYRG3IjcYLl2QxaEpfQ5nDxJSwwXFzcIR0oo+YPZcqDh1DheWMoDt fFZ6D2PG/tIu5g2j7Rq/LVi2lkQNp0yQaHzFJ7AZ2IfSJIAkjjm13wu6e6FUzjpa GxAgoiPgZ5uKuz6FmiuMTW6hEbCoYOul3mjIsB2An5WSN4JbaYPqYQTVj6gGE1JT Np+xT/y4+ImeeGf359dlQv4NKRy7tElOMW/zxKkB0BCobspScy/u964ES5FEUGTu 5WSXwtS4QbzFK9bOkdYIdreXow5Ju3vveageKn5ZCmq4dt0qccjCklYX6JOSko6k KJ7hKFeSpHEhNSZ/kFRVrcqNKq5fSj+uStS8GAccupBActqVDgzkkoqqNirJFzww bYge6Hj/YxIy3cwybVvSuuRHf9L0vNgq4B88SDugOMTymI92Fp4O2OyLxOylZe4N QhrXQlB8GPUzHly48ZbK39Cbkd+o4e1SFvWcaVgm3lQWJL5oj7475fMz1KksfU4c LYuP4a5QaRNfZq+vbfL4+Et+pQpUIcjwqluhQuT5Ey/8jxcB95ikUDZuotDOhPAF u3wtiZgmi1uQWc5AwsXmdlDPBdUzn76Gc88SdJl1VzVLDnj+OPEtJ9S5fdVEtR0A Extension name: c0v9r ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs
-
http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/CE5F1BFDA648CAEF
-
http://decryptor.top/CE5F1BFDA648CAEF
Signatures
- Sodin,Sodinokibi,REvil
Ransomware with advanced anti-analysis and privilege escalation functionality.
- Modifies extensions of user files 8 IoCs
Ransomware generally changes the extension on encrypted files.
- Enumerates connected drives 3 TTPs 25 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
- Drops file in System32 directory 1 IoCs
- Sets desktop wallpaper using registry 2 TTPs 1 IoCs
- Drops file in Program Files directory 30 IoCs
- Modifies system certificate store 2 TTPs 4 IoCs
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 4 IoCs
- Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\338e8f24eeb38b5ef67ef662b65d592c816eba94dfaaac856021dac407daf294.exe"C:\Users\Admin\AppData\Local\Temp\338e8f24eeb38b5ef67ef662b65d592c816eba94dfaaac856021dac407daf294.exe"1⤵
- Modifies extensions of user files
- Enumerates connected drives
- Drops file in System32 directory
- Sets desktop wallpaper using registry
- Drops file in Program Files directory
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -e RwBlAHQALQBXAG0AaQBPAGIAagBlAGMAdAAgAFcAaQBuADMAMgBfAFMAaABhAGQAbwB3AGMAbwBwAHkAIAB8ACAARgBvAHIARQBhAGMAaAAtAE8AYgBqAGUAYwB0ACAAewAkAF8ALgBEAGUAbABlAHQAZQAoACkAOwB9AA==2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\wbem\unsecapp.exeC:\Windows\system32\wbem\unsecapp.exe -Embedding1⤵
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/752-54-0x0000000075431000-0x0000000075433000-memory.dmp
memory/1688-55-0x000007FEFBE11000-0x000007FEFBE13000-memory.dmp
memory/1688-57-0x0000000002880000-0x0000000002882000-memory.dmp
memory/1688-58-0x0000000002882000-0x0000000002884000-memory.dmp
memory/1688-59-0x0000000002884000-0x0000000002887000-memory.dmp
memory/1688-56-0x000007FEF2D50000-0x000007FEF38AD000-memory.dmp
memory/1688-60-0x000000001B760000-0x000000001BA5F000-memory.dmp
memory/1688-61-0x000000000288B000-0x00000000028AA000-memory.dmp