Overview

overview

10

Static

static

10

10d24ce42d...d6.exe

windows7_x64

10

10d24ce42d...d6.exe

windows10_x64

10

Analysis

  • max time kernel
    152s
  • max time network
    166s
  • platform
    windows7_x64
  • resource
    win7-en-20211208
  • submitted
    30-01-2022 08:03

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    10d24ce42d973516ebec5abad7d0e927c162ba313244992d398e40716ae10ed6.exe

  • Size

    166KB

  • MD5

    a975fcb157f5d3cb1f18931d529098c4

  • SHA1

    b33ca444868e3864144b1ac5a1b62644cbd70270

  • SHA256

    10d24ce42d973516ebec5abad7d0e927c162ba313244992d398e40716ae10ed6

  • SHA512

    6982cc58f43e49cd50a8796bdf0cabe74b4411e010224e5a7baa63cd5080bb3b3800b6418ee7a4e0e762fd75f40ebe4e27b3af6e3e86ff5febde34310e139c86

Score
10/10
sodinokibipersistenceransomware

Malware Config

Extracted

Path

C:\w4yms4w-readme.txt

Family

sodinokibi

Ransom Note
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension w4yms4w. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/F98B1C4B943C62B4 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/F98B1C4B943C62B4 Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: M0ANP8SpPnE4SjJaiFRCZYOx96M5IWX7nHBYSSSy0O0ha1jlWD7w6T4rL1nSNXJb yC6Yz2cJFpP7adPsVeRUy9Q9vipZpTemiediUJd3+vKBaLzG07ho8HgdHF2MHVXI vfBGKnnTm3BaqNPhmyxR7Y7NhzVS0+qJumtYMdsp2b/uogx9T8mOCCRHkWyW+mg0 yoCIuJw5KSyuzmxTyX3196nR1GSyY0i+nBqHuyZmyCpF4BR3EM0SQQJr5ZxbwkQE UR1y3BRcgs375aFrhLA7hceujEkXPvdZAsmfo9mzyM8oFbjinbbqLAMxhaYzqMyA zI+fMvoP9WK+CVMCnd1rCXsKR8DHhV+tgdCZnl7t/iNwU56HlueRd7gbgMUDktyn ANUQLSHNJKuEQJVtQjTPla4mdZuOoJbyEyWGveblDj9qGXddTLYToUtINzPFU8CX Inv0dhQUtKhf7hQMEMzHTPSJn52AIuTk7b8++ejChFisgj6Jnz6/tKC9BWGAKgui qQDjfd2gdT4nUPmYEUAIiMvV0YUW2RUjWLV1+NaVlQGOuibHZXZ37Pd1tU1j9dra aoq/yyUB2JwZzulcjEjMwCDPe2WNFKgFtQxhAXLHf1PDwzmHKlKTf+8vanbDxiTi cfETaWgxuLZgt4Sf3eceY33gRRJ5boeNHlfvgFj1Jtk65R/JL445f7UJN9hsuG4b oWFpmL1QfAq8B7xo6N51Y9ohMxOszsoOYNWPEGwyT8zUMrux7FANydp2Menmq+pW 8+wzSAh/utnjBqVMkTvjfBLFuX4eyOr/lbcG7jNG0O0Pc1Vqv0OYBGHRIUc25Qb8 1Wafwup5PgvQY6O8Nva9/XYQ7OswTVgxvymHJN/wSZTFY06mNMCGBiu7ZogI7D++ +1UocYfjYtMEX7COeY0lWnKO307Z5k71w1ZLU/hkjATfQHa1eQQ8z3WeBVMsmpwG zPSAmksY6VTasIyXpzqJ71gSpfv8LNRM+oLYv3SzJuMjiWmjaXEWXIajo1IvGdjs d9XTeLJkHmxNTMPC8CniiWjus48YZwkRZnKkp+DNeNMFwpPQFfsoI+2i9NcoYqTH Ymd3A5iuOcXQP38MPhl46G5MhUxP4PmtGCkLbSyXxUrK4W511yKGYTiWH9kcw520 Yys6jmn0mOahj3+1eS2HoBVrlP14B5Ux7/HDIHnyX7y/Z/WZOUeqK4BnTyTgrGvf MFlwy0x177cXxJqM8qEwWb6TocWFASPkunFeBoOy/w0t6VD3GHsHl6jHRtZbYUFc +OZmROhrPGg+jQRboULK34p/TzGiLbACq5M= Extension name: w4yms4w ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/F98B1C4B943C62B4

http://decryptor.cc/F98B1C4B943C62B4

Signatures

  • Sodin,Sodinokibi,REvil

    Ransomware with advanced anti-analysis and privilege escalation functionality.

    ransomwaresodinokibi
  • Modifies extensions of user files 3 IoCs

    Ransomware generally changes the extension on encrypted files.

    ransomware
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 25 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Sets desktop wallpaper using registry 2 TTPs 1 IoCs
    ransomware
  • Drops file in Program Files directory 35 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 6 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\10d24ce42d973516ebec5abad7d0e927c162ba313244992d398e40716ae10ed6.exe
    "C:\Users\Admin\AppData\Local\Temp\10d24ce42d973516ebec5abad7d0e927c162ba313244992d398e40716ae10ed6.exe"
    1⤵
    • Modifies extensions of user files
    • Adds Run key to start application
    • Enumerates connected drives
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1884
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -e RwBlAHQALQBXAG0AaQBPAGIAagBlAGMAdAAgAFcAaQBuADMAMgBfAFMAaABhAGQAbwB3AGMAbwBwAHkAIAB8ACAARgBvAHIARQBhAGMAaAAtAE8AYgBqAGUAYwB0ACAAewAkAF8ALgBEAGUAbABlAHQAZQAoACkAOwB9AA==
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:756
  • C:\Windows\system32\wbem\unsecapp.exe
    C:\Windows\system32\wbem\unsecapp.exe -Embedding
    1⤵
      PID:1424
    • C:\Windows\system32\vssvc.exe
      C:\Windows\system32\vssvc.exe
      1⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:1960

    Network

    MITRE ATT&CK Enterprise v6

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/756-55-0x000007FEFBEE1000-0x000007FEFBEE3000-memory.dmp
      Filesize

      8KB

      Download
    • memory/756-56-0x000007FEF2FB0000-0x000007FEF3B0D000-memory.dmp
      Filesize

      11.4MB

      Download
    • memory/756-57-0x00000000024D0000-0x00000000024D2000-memory.dmp
      Filesize

      8KB

      Download
    • memory/756-59-0x00000000024D4000-0x00000000024D7000-memory.dmp
      Filesize

      12KB

      Download
    • memory/756-58-0x00000000024D2000-0x00000000024D4000-memory.dmp
      Filesize

      8KB

      Download
    • memory/756-60-0x00000000024DB000-0x00000000024FA000-memory.dmp
      Filesize

      124KB

      Download
    • memory/1884-54-0x0000000075D61000-0x0000000075D63000-memory.dmp
      Filesize

      8KB

      Download