Overview

overview

10

Static

static

10

dc92f1c232...9c.exe

windows7_x64

10

dc92f1c232...9c.exe

windows10-2004_x64

10

Analysis

  • max time kernel
    134s
  • max time network
    150s
  • platform
    windows7_x64
  • resource
    win7-en-20211208
  • submitted
    05-03-2022 22:32

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    dc92f1c232d4df9cda71db227085e26424920c981c9be4d905d9bc89a504709c.exe

  • Size

    116KB

  • MD5

    6cd56946aa6245d1eac3a88d4470a40c

  • SHA1

    b4635b3f442e3541a92f026fbb108abeb5d67df7

  • SHA256

    dc92f1c232d4df9cda71db227085e26424920c981c9be4d905d9bc89a504709c

  • SHA512

    4dffd58030258616b5123246d88abc4f2444aa0cc2809cb3cdcc81e01beaaa1ea784c5e7b969c1982ecd938041e658300c24a67049fe868f4b172a55311dbd8c

Score
10/10
sodinokibipersistenceransomware

Malware Config

Extracted

Path

C:\mr3d7-readme.txt

Family

sodinokibi

Ransom Note
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on you computer has expansion mr3d7. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/E50508EB35E0A248 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/E50508EB35E0A248 Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: M14oAEBuzGbyqAjqhraBW0Y1L9tbtX/ijvcIkB+h+GfuWjOWtOBa5J7ElojPn5SA gzoM/3ecrpN5EfTg2XgmC3jnm5Q4P5SHMxi7aIy5do7ck/KFodQ8SmZHWwTanIDw 38xg1axR/4Es9YPyfuD/qAvP4xUP/163wdbE/UiVBGRByFGS+EJUIdfoQQYdnVoQ ndM48ilz43h2uElXYJwTKyXH2NV3dIGfjJ+TUl8HhiwAmZTbNRgP6oHoeRs3dO4F E//G8qrdKeZdaIINT7lOXYa0pHawes8lFSwNM0MMosDLU+4W6ns4GFjFD0ZTVud5 8e1CLCWYcS5tXRKV3CWU4y435eTQ1+VyVUQ5u6l7aob33DCUZlchCkZNGFCeV6IK PBPjOI3iZSeKBdw1erMHxZPUFa4M4A5/l+PvwFDD7/gn5VCIUU7/PeOy5dc6YIgZ tRbfdihFaLWqT3sF/JF0PTAtfdjpw5FsfVCC6ZItv2G5cg90W8alOAIZrMpt1hbP VeWcPnmhLaDnl7VOMMWgqqw/Q8r/azlJtvZQfJO1Akr8GNv6VwKvXbnOKUiPGAlw nLIaUS7x9a7Yj7KYK8REAN8aV7+pA6YrmcWvaLLo77i8q3cijOfPUoL1TLojbABR dYEKLQ7EhVSPILJ5MdH2o0Eam45iXcIYfRAQL2QCR6DbzEgGmsLCAtyLCBvTIZ4N MMJnKWzbsG7xxLalK/Ul7YPhQBUtATPYNNnWjzN7TR/+GIKWbq5u6a1Nre2wD7Zc jBkTeHWIJBHECFsmyHK35WoDv6zOIlx100k2/NeNSsXhsqylQiQtECN49GeSre57 t3YRJp44P6HVVjz1BZOl9AYbo0RDDFFbEDO/x81y0hmp4dJoUiAKXTMao735rnMS zlvc2jxvmDZAP/Mtdqy9yeeGkXR/oKU8x4cZlRkF+u6mHt6XSjgkqOPCk8qBr0OQ YQluXpIBFafwi0xHFxwjvrJ55TLchL50sPrlvh4WZjyun0mAQIMVssbO8ZGVV7Nr DosrMwsHrvW7RBx3WP0nU/5NbQsxSW7BwdMpkd0oC7fT47pD7akOyxhNlE3K/G7q hCmt3DMFE30ta2K8k4lmu2ZonOZFBDpMsfBcJnfzOzihoUKzWSuxScn8cAFcUgGX +ASmAkPhIXvm5gae08EGJuH+iR3fuHJJzwcGAj5uCSkbQFIbvgP3gSjzlX8ndlBA 5268QHCZvMbirTtVQqkxnYafQzyldhcx8uXH+yMyRCOCp3mgnP1PY8B3oug685Uc KPO2QoGF39YOfXfZWEYyRPnUYuc= Extension name: mr3d7 ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/E50508EB35E0A248

http://decryptor.cc/E50508EB35E0A248

Signatures

  • Sodin,Sodinokibi,REvil

    Ransomware with advanced anti-analysis and privilege escalation functionality.

    ransomwaresodinokibi
  • Modifies extensions of user files 14 IoCs

    Ransomware generally changes the extension on encrypted files.

    ransomware
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Drops desktop.ini file(s) 28 IoCs
  • Enumerates connected drives 3 TTPs 25 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in System32 directory 1 IoCs
  • Sets desktop wallpaper using registry 2 TTPs 1 IoCs
    ransomware
  • Drops file in Program Files directory 40 IoCs
  • Modifies system certificate store 2 TTPs 4 IoCs
    evasionspywaretrojan
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 5 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\dc92f1c232d4df9cda71db227085e26424920c981c9be4d905d9bc89a504709c.exe
    "C:\Users\Admin\AppData\Local\Temp\dc92f1c232d4df9cda71db227085e26424920c981c9be4d905d9bc89a504709c.exe"
    1⤵
    • Modifies extensions of user files
    • Adds Run key to start application
    • Drops desktop.ini file(s)
    • Enumerates connected drives
    • Drops file in System32 directory
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • Modifies system certificate store
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:1728
  • C:\Windows\system32\wbem\unsecapp.exe
    C:\Windows\system32\wbem\unsecapp.exe -Embedding
    1⤵
      PID:880
    • C:\Windows\system32\vssvc.exe
      C:\Windows\system32\vssvc.exe
      1⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:1288

    Network

    MITRE ATT&CK Enterprise v6

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/1728-54-0x0000000074F11000-0x0000000074F13000-memory.dmp
      Filesize

      8KB

      Download