Overview

overview

10

Static

static

10

147b098aab...8b.exe

windows7_x64

10

147b098aab...8b.exe

windows10_x64

10

Analysis

  • max time kernel
    133s
  • max time network
    165s
  • platform
    windows7_x64
  • resource
    win7-en-20211208
  • submitted
    30-01-2022 08:01

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    147b098aabc3a9744c64dc48ea8ddff09a524112b5c4ec87815b2b964ca8c78b.exe

  • Size

    150KB

  • MD5

    a37c84998bba38feb018560d11c04d25

  • SHA1

    49f78543385096b7833f8fb6322ad7f07586f47c

  • SHA256

    147b098aabc3a9744c64dc48ea8ddff09a524112b5c4ec87815b2b964ca8c78b

  • SHA512

    951d8260201b06a04b5cf069010a8887859c9533267fd2044ad1ac6e46de524b6ba6ad10bedddf2e45e3520c93836ed98a942f8c336281dc687391187dc5da7d

Score
10/10
evasionpersistenceransomware

Malware Config

Extracted

Path

C:\6miuub-readme.txt

Ransom Note
---=== Welcome. Again. ===--- We strongly encourage You to pay your attention to this message and read it to the end. All Your files are encrypted, and currently unavailable, now all files on your system has extension 6miuub Before that, all of your most important personal and business files were backed up to our secure offline storage. We took them for temporary storage - but we don't need your files and we are not personally interested in your business. Our encryption algorithm is the most technically difficult and max resistant to burglary. Only OUR specialists can decrypted your files without loss(!) Any attempts to decrypt files on your own lead to damage them beyond repair(!) Best way to you will be consent to negotiations and mutual agreement between us. To connect us you need to download TOR browser and follow the link to begin negotiations.(You can find full instructions below.) We are waiting You and ready to listen all your offers and discuss them. If You will ignore this letter - we will have to sell closed auction all yours private files, photoes, business correspondence, documents and business files + with our analysis of your work activity (weakness of your business, financial violations and the opportunity to profit from this information). It will offset our financial losses. Or we'll just put all your files in the public domain, where everyone can download and use them as they wish. * For TOR Browser http://dnpscnbaix6nkwvystl3yxglz7nteicqrou3t75tpcc5532cztc46qyd.onion/ We are known as "Sodinokibi (REvil) Ransomware". For example, this article: https://www.coveware.com/blog/2019/7/15/ransomware-amounts-rise-3x-in-q2-as-ryuk-amp-sodinokibi-spread You have a guarantee that your files will be returned 100 %. And remember, this is only business, nothing personal.. We have a concept of business honor, and we can promise something if we come to a mutual agreement: 1. We guarantee to decrypt all your files in the shortest possible time 2. We will delete all your files and forget about your company. 3. We will show your weaknesses in your networks. .-= INSTRUCTIONS TO CONNECT =-. How to get access on website? You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/1846C9C717BFF3C4 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decoder.re/1846C9C717BFF3C4 Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: YPdm+ouKL5CpOP/GHnfhnVKiUSC2MoRcbKQwNEzDP7JR/S/6qQ4clySgsMWNlk0D IA0LLARcN7ueHdCoD/t9TLArr7erHAudGtQI0P9+ofMs5UcOJhhL3po5mUAfSQrR 5fmqPPrGP0eyYZirZcQGv4vYPEygWLB7dUj4e487pY56Pe62FbGSL+39JZb6WW7y 20Bti09chZdRA1e0ZPy09pqiK7WkBLDexT7CCQfTgZqN/7YF8rmcGgFJwB5QioSe DtRTWeBm2hVL63icoA3G+oHMTIha8dRtZkejUFjdGzI0zfw/xzMprWouy4j8gz3D 4lws+W2WfjoRZcGeX3CGvBO7C32ipyFlNPI9LMieqlfNc4L1Bg47CvaQqitxL3ak D/MJcnZ41ES8CMSaKxM+jwQp7vS8mpZx4wCja5Vht1u1wq/WKbjJP+ergyWKyHIq kAQzWR+WeDZNC6RDEPgp3DuytkD6LmC27zTrWj914D8O5Du0kx05BY+Abq9tUrXR 7p3N+BQrT7/edS1vLus/Cy/GH3BM1Qd18hQw8A8I8Q0gMVk0gjnOxkQiqVxdULYO gVqadsbssoZh0z6X/HrgPqIGmXtXCxmo3Q9GU08jiv3VTieEovKkzb9j5RgqiBLB g4gEduEU3YXJKzlhMpvERqiTUKgAN3tKTHlzGrICuyH71TOljc/pFa4a1i6lFkSN GugpOFdadu82rJbos5IuPey4hqREQsxsIfSR6uq2K8Aywx98GTsVPWZ5RBA+DJiq InkMv6yY4hYyfpMtxIbjZfOM3Cy3pfaFzqc0PXq8rJFFc+s0G0mvIf7AjjYeA95L OJQmlTz5VoZ3GmTMIieOQgMj+kDeB3QII3060sUN/p3KpBOUuQef54z3VfsMgnbO jzTPGOaiPvXC+NHWlrCdRcCLDP9gIF2P2PlpuP8FuuQwOMG2xCOmy2NnoNJBudek Yj3KYPfOFBbPs7fJOxqLjvZoydwG0T1O9jUcu+jUAS2b6fOJb+Znx9UyIXn7GSkt uWSHAr0/JnkfVodhFtYQbup+v7IJGXtmpgxJ9mJQKNhNmZIH6GOIiAMxKmdgmMFH 8u2xcYJjwc4aPWrRmfCbdMiK6QqBc7M5eH75+zssg+bdtOcgENg4/3G9eNxOZK1R 0BF7YcaPAf2Qc5OQ5v9pfLJijS2HISPjgdSBgbGnk0zR7O9jl9D+hbmrjs39TvOX m4bXAR0W4nSNRD4y3TdezgNUpoZdJ4ENEd5aUOb+42Jj+63muP3BdSl2e7MpsQVS EuGUTym4Wr0QtygCjIQ= ---------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all your data!
URLs

http://dnpscnbaix6nkwvystl3yxglz7nteicqrou3t75tpcc5532cztc46qyd.onion/

https://www.coveware.com/blog/2019/7/15/ransomware-amounts-rise-3x-in-q2-as-ryuk-amp-sodinokibi-spread

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/1846C9C717BFF3C4

http://decoder.re/1846C9C717BFF3C4

Signatures

  • Modifies Windows Firewall 1 TTPs
    evasion
  • Modifies extensions of user files 7 IoCs

    Ransomware generally changes the extension on encrypted files.

    ransomware
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 25 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Sets desktop wallpaper using registry 2 TTPs 1 IoCs
    ransomware
  • Drops file in Program Files directory 44 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Modifies system certificate store 2 TTPs 2 IoCs
    evasionspywaretrojan
  • Suspicious behavior: EnumeratesProcesses 5 IoCs
  • Suspicious use of AdjustPrivilegeToken 5 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\147b098aabc3a9744c64dc48ea8ddff09a524112b5c4ec87815b2b964ca8c78b.exe
    "C:\Users\Admin\AppData\Local\Temp\147b098aabc3a9744c64dc48ea8ddff09a524112b5c4ec87815b2b964ca8c78b.exe"
    1⤵
    • Modifies extensions of user files
    • Adds Run key to start application
    • Enumerates connected drives
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • Modifies system certificate store
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1772
    • C:\Windows\SysWOW64\netsh.exe
      netsh advfirewall firewall set rule group="Network Discovery" new enable=Yes
      2⤵
        PID:1136
    • C:\Windows\system32\wbem\unsecapp.exe
      C:\Windows\system32\wbem\unsecapp.exe -Embedding
      1⤵
        PID:744
      • C:\Windows\system32\vssvc.exe
        C:\Windows\system32\vssvc.exe
        1⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:1084

      Network

      MITRE ATT&CK Enterprise v6

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • memory/1772-55-0x00000000762C1000-0x00000000762C3000-memory.dmp
        Filesize

        8KB

        Download