Analysis
- max time kernel
418s - max time network
574s - platform
windows10-2004_x64 - resource
win10v2004-en-20220113 - submitted
09/02/2022, 03:54
General
- Target Ransimware.exe
- Size 107KB
- Sample220209-ef7vyshcfr
- SHA256 b8a3da8c60459974767732321a29b91dfea59ab5ad993caf832f2bb2484b5c96
Score
10/10
Malware Config
Extracted
Path
-
C:\Users\Admin\Desktop\4agrfsh5tx7-HOW-TO-DECRYPT.txt
-
sodinokibi
Ransom Note
- ---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on you computer has expansion 4agrfsh5tx7. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://wwylgcvegp33t2ytnsqa6klroq3kz643q5ceinkqb7x6232g3guit2id.onion 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.top/913AED0B5FE1497D Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: JVL8EaySiy34cSlR67vIJ8EojMKIr8uBEGYI4rE8DeWRYESRngfPD3tKQhZ2Qpk jD2zV4dWO2wEpmxPe43eLcf8LWN1XRMsY3wNgO6WKJQWRyEhdR47WKZHi3o8rm9 6pDqv0ksP8gUBLJqWSpYFXPWNeopnk7piJUqOITr2io900X5ZMSqBO4jardRM5F pA1v21ccO98fgsPfWGsQaRRnUPuQgoCf7d989EfE6tDqCsX1KLGKdppXsNbnHL6 j7diDsRgRloTqOkkl12FVh1BRxlPvn26uxetjKTI3pzjyW8JHm0vOGlBFbQPHBu osri3t1BbhuLpsSN5zbIJxGsoMdoH3EB24L0GxFaQkYNe55TxOUap3k0m93qQN3 hdsSugcGIuB1iY3NtQK12joV9TUOH3YKDq1uvmKwUIMqnBCcsvKaGVB7zWTaMN9 OV1x1gJbGGXguW8r7R2fVs8Drp34ZStjHJ8UwOK5jTEUszQk1oWJUsnfXxGLmOC yWyZlYn5tH66BonV2ZSDu6kPZfc68I8SURQ74aoMNtmBXvm0tcNwULR1wiAG5r6 lJnltYqbbuGzBTi1n2mMg4M8J9YLVaiQgwB2uK2cDAwBNVQhNqWNTeZr6ocu9eF BMzTOSpHcAJJgHKuxt08oDU7CXU5FsHci4vyYBBPhj4MJU3jw4oAIgb722R17uC u2rklWWWwrlaFJHxrdvJLEHTCdx6fuJRxgJUctSMZh2ThFWyuEkYMk1qvXiHjZ0 BhTni9xV7LjtnMxw6H9LbKvFMpdiELKmAq0vNcxy6smNn0Ne7kmAkOZ1wNa3gOQ wA6t7VCidTKOthicWb8keiJCvR98AC4Rsb0MqHPI4BJqZ9qTOuEbhnwN037qWDi bZ3gRqVvOL0pcZdnwkpuP7dtEpnVxJjw1dsRgcYm29zPr8TyXPLFqTTd6JclDA8 FmEy9rMHULC2QINBGVy8h8dFhJOUW9xi1AumnJUGLI03oaDUsHWQOBaGI8Rzc1u UYdAPXkY7AswZHjaHG3lPngUzkodo1foUYgfKZy7ItZPgPB8jiJsiPeq2JKotGt FeDcBkEQrS6dgNQxkjp4GswFE30mAOJOB9UudwAXeRcamv8dlWjFDLmXs8XHubP cJsbg3fUyiRZzPWdT4WBopDKzW7CeY2nDB9Q3TbkFCvhvwxHVeENXalxFimK5cz ZqoWxQGj9dw5m3gYDi0rAUpPnZMKVrRon Extension name: 4agrfsh5tx7 ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs
-
http://wwylgcvegp33t2ytnsqa6klroq3kz643q5ceinkqb7x6232g3guit2id.onion
-
http://decryptor.top/913AED0B5FE1497D
Signatures
- Sodin,Sodinokibi,REvil
Ransomware with advanced anti-analysis and privilege escalation functionality.
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Adds Run key to start application 2 TTPs 1 IoCs
- Drops desktop.ini file(s) 1 IoCs
- Sets desktop wallpaper using registry 2 TTPs 1 IoCs
- Drops file in Windows directory 8 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Modifies Control Panel 2 IoCs
- Modifies data under HKEY_USERS 1 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Ransimware.exe"C:\Users\Admin\AppData\Local\Temp\Ransimware.exe"1⤵
- Checks computer location settings
- Adds Run key to start application
- Drops desktop.ini file(s)
- Sets desktop wallpaper using registry
- Modifies Control Panel
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" netsh advfirewall firewall set rule group==”Network Discovery” new enable=Yes”2⤵
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C vssadmin.exe Delete Shadows /All /Quiet & bcdedit /set {default} recoveryenabled No & bcdedit /set {default} bootstatuspolicy ignoreallfailures2⤵
-
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k netsvcs -p -s BITS1⤵
- Modifies data under HKEY_USERS
-
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\4agrfsh5tx7-HOW-TO-DECRYPT.txt1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s wuauserv1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exeC:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe -Embedding1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/560-130-0x0000000074C1E000-0x0000000074C1F000-memory.dmp
memory/560-131-0x0000000000A20000-0x0000000000A40000-memory.dmp
memory/560-132-0x0000000005410000-0x0000000005411000-memory.dmp
memory/560-133-0x00000000054C0000-0x0000000005552000-memory.dmp
memory/2056-136-0x000001B957270000-0x000001B957274000-memory.dmp
memory/2056-135-0x000001B954CC0000-0x000001B954CD0000-memory.dmp
memory/2056-134-0x000001B954C60000-0x000001B954C70000-memory.dmp
memory/2056-141-0x000001B957540000-0x000001B957544000-memory.dmp
memory/2056-142-0x000001B957520000-0x000001B957521000-memory.dmp
memory/2056-143-0x000001B9572A0000-0x000001B9572A4000-memory.dmp
memory/2056-144-0x000001B957290000-0x000001B957291000-memory.dmp
memory/2056-145-0x000001B957290000-0x000001B957294000-memory.dmp
memory/2056-146-0x000001B954F90000-0x000001B954F91000-memory.dmp
memory/4992-140-0x0000029519620000-0x0000029519624000-memory.dmp