Overview

overview

10

Static

static

10

23dfac36eb...d7.exe

windows7_x64

10

23dfac36eb...d7.exe

windows10_x64

10

Analysis

  • max time kernel
    159s
  • max time network
    155s
  • platform
    windows10_x64
  • resource
    win10-en-20211208
  • submitted
    30-01-2022 07:56

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    23dfac36eb9bd2e433dfd9c456cbfe944b01628d922228a143f326356225a5d7.exe

  • Size

    122KB

  • MD5

    1abeefbab61ac4feca6872eb84ba4be1

  • SHA1

    1c6d390d7c59b04adbad25ea87fc64357f6c7d43

  • SHA256

    23dfac36eb9bd2e433dfd9c456cbfe944b01628d922228a143f326356225a5d7

  • SHA512

    0643cf3823ccae44aa29ccc4e63364dfea73d8ad95dcde9b5fca440fd713eb30355025c48cc42d6541fa9a4be7f81909e648dac59b0ecbff823438014faffafd

Score
10/10
sodinokibievasionpersistenceransomware

Malware Config

Extracted

Path

C:\1elv3vsh-readme.txt

Family

sodinokibi

Ransom Note
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension 1elv3vsh. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practice - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/A5D7D8275F5F3DA6 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decoder.re/A5D7D8275F5F3DA6 Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: X58JiirDTUwF5VKoOIPZkWeA8ffJd2IKyH6MZZqJujZsCSHb9DtvwJpG7tq2SLcL W5AuIZOODsLz8zaXQ55B8lCXtsiGXC7jOqnd6IE9lyBFT9OWC8wUNkvQwKYjKqHk R+etZ2BscuteKM2lXxg471wrsBm9z0EqquMZAow6C7kZOvIF1VRmqLmpvQJkQ+49 L82YtxptbSbfgIzoCwW42ViNNNhv3jLCCFouKkE8z5JP/u4tIQnLadItcoa3Nrwy NkxZomIJvtbtTsbqSXxS9BOvCTzQMvSiASqYpvjFC3r8ZVIBm3m4/f2f2CF7AI6O QKjmaep1hCjgMLgkRVij7BHTZbnAS6AbJng/FUGjNmTHlLm3TGCNxZbbQcWeGknt Vxc5bXZpP0bwKX60yB/pOiuclZNAXlv+OhV0xg5hzILK22kr1oT4WE2ah8ZbH4ut +dUI1E71DiZF9Psh5l7m2ig5pkYjvv5XdQ7TWj/MU2nq9ofFcN6adtX5l7gEpnpm BZGVv/FNIMjN8URavKJoltlT5zNyEuoHhXC0SAoIlI+VjYZI5DBrDwpaAy0md9Aj GiFtHYXQpkNRj8lI8VwYgI+VO9gRvMhM2lgNn8fpk1r858FW6aVWRKOe8ahhbsHc tsicOS7az9/heZOdeBM3xEkxGXLAKpyvXJpoJil1RO1vysGvjSIzDlVZLMTUwcTj G28f5OAHjNzwd1TsF2MpONlMPOkG4CkjrZByU3rM0brMaGY2VF3gLNMOtDZhmb22 KGcIsGUME2AMGupVRkFteHr56XfsjqnQkSW6Am8nYPrvyV+FsWp3fU1TflWIDLVn AHmz2pgKJgrzRbS1RUkNRXop+VD2m/FSn/ymVw5S13RQnHev69S5LK8YCE3fiADT 3kR8ufOdpPIpDUHDQhooOa6UvN7QAUg66dZvcRj0IJzfV9JxtO4bxLtERM2kqigV A2nWl7hPPshU4ifbO+cKm2UmwC0ev6YH2Xvz1HqMtmmj7MnzkYxsHQ+f98OiVZOV ZbqJuFY3Tb/GkSjmRj17WXLHWQwG5NlzqxAweFz+60FP/m2M3/+hnN+ERqBOhu3U EMHW6OA8TeSvdNjF/0l/F88QNB5eoEsoOKKmdWqktqKXKD9ysWHfHl+RHZbIk5oE wHixMode7odcnDOjYVnBAssv0ereqBDj/fhhvLjB+9fDnTIVN9gj/tihuRImpdEG MWrgTb8RNzO6KJqTAcinhodmBHI5kt+Xb/Cv5waFAgIl2K4DdVOpvMsmpZ9+guPk phCBYOO5F7otGw== ----------------------------------------------------------------------------------------- !!! DANGER !!! DON'T try to change files by yourself, DON'T use any third party software for restoring your data or antivirus solutions - its may entail damage of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/A5D7D8275F5F3DA6

http://decoder.re/A5D7D8275F5F3DA6

Signatures

  • Sodin,Sodinokibi,REvil

    Ransomware with advanced anti-analysis and privilege escalation functionality.

    ransomwaresodinokibi
  • Modifies Windows Firewall 1 TTPs
    evasion
  • Modifies extensions of user files 5 IoCs

    Ransomware generally changes the extension on encrypted files.

    ransomware
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 25 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Sets desktop wallpaper using registry 2 TTPs 1 IoCs
    ransomware
  • Drops file in Program Files directory 26 IoCs
  • Drops file in Windows directory 13 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious behavior: EnumeratesProcesses 10 IoCs
  • Suspicious use of AdjustPrivilegeToken 5 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\23dfac36eb9bd2e433dfd9c456cbfe944b01628d922228a143f326356225a5d7.exe
    "C:\Users\Admin\AppData\Local\Temp\23dfac36eb9bd2e433dfd9c456cbfe944b01628d922228a143f326356225a5d7.exe"
    1⤵
    • Modifies extensions of user files
    • Adds Run key to start application
    • Enumerates connected drives
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:3592
    • C:\Windows\SysWOW64\netsh.exe
      netsh advfirewall firewall set rule group="Network Discovery" new enable=Yes
      2⤵
      • Drops file in Windows directory
      PID:4212
  • C:\Windows\system32\wbem\unsecapp.exe
    C:\Windows\system32\wbem\unsecapp.exe -Embedding
    1⤵
      PID:4368
    • C:\Windows\system32\vssvc.exe
      C:\Windows\system32\vssvc.exe
      1⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:1020

    Network

    MITRE ATT&CK Enterprise v6

    Replay Monitor

    Loading Replay Monitor...

    Downloads