Overview

overview

10

Static

static

10

117f128807...01.exe

windows7_x64

10

117f128807...01.exe

windows10-2004_x64

10

Analysis

  • max time kernel
    155s
  • max time network
    157s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-en-20220112
  • submitted
    05-03-2022 16:01

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    117f128807504f387d0b8e174ada23238c3556c7284a598ed25790dc2d9b7301.exe

  • Size

    117KB

  • MD5

    92bd5043b057192ea0153c98da1adebf

  • SHA1

    0444bb2621ed073ced634e1916204dff5fc6a186

  • SHA256

    117f128807504f387d0b8e174ada23238c3556c7284a598ed25790dc2d9b7301

  • SHA512

    3c4c2026d9306cb25699b7dd7d1e6e2e0f97b5f228b49bdfd25e8b4cd68645eb3df2a6a84506b6da1937ab7e1269057ce9ae2e0be68c4c088dd753a733e19170

Score
10/10
sodinokibiransomware

Malware Config

Extracted

Path

C:\2n2ac-readme.txt

Family

sodinokibi

Ransom Note
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension 2n2ac. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/B6B5F437544440C6 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/B6B5F437544440C6 Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: Ysp65zD99/IITJuAjLWilX8Y3Q9eqWh7epQlgLSK1PS8s2MGqT4aBPmkFWXNn3sq 0lVOz5WSuuIEvwtOVOkxA2t+0WuXMY6UefEbWWgeW3GTcpC8/nxtmh9BRXfRJQm8 gV8cx/U3dHPMlvwSgD5ueRTI+mP7MmdoNfx9KbMNHiwTGgTgdY5DTsBK+OEV//rp DQ6Rt17B6eCtjAgPLJHs9blN2vHE1JNowkirx5IlkZJ7Gxqrk/FPKSA6lV+/dmqE dHLE0IWrrEl/Ux7TwQgS4C5MXno/hfu41NZB90QV6Dr8pRMTXkoyEWJcqWq2p1f3 7ZGMbZs9gqOwnOhRVerMlVU0k6bktCACgBOZdfzCRixG2kMi9kvqrMmIkvfF/P9o iiBj2isLeWWTP/BgLFLW5qVaWClTkaP7PdwsDeRYzKgB32BC/nX9tKmCNYoaYdqb 7poFYUAlzT2FxNC/lBG3lu+huYASJtSG5SCtHTbP5PgtNTu/cWUdFbnE0zNCWbje oX+L0sunGJZfmyNK9Lfny65xSapnthkid+yRsAACX2wbVeMKqLKXH6BrXbwStxLW voHMaSe0w+o/T6ZZzzoRX68kA5zPac2ArLW8+jTvHHaFdFzhczVQTLXPQI+U+xZm TbJg1rm3QP+DvVBe7znUOxFQTpAfE1QPTNVLGYJsUf1PHCQjPndpC1FQHzbfMo7w oteKLU4Cae+TXj/qeWjLg8O8RWKu+3n3+BSyopwr36DC34S699OflEWeDaUEA/KX eAkKaXPavKLWJseuNZiLxs6dnROpTUbY130l+znsMSuYOYCKEjLVHQ+4vniubPGA bhHZb8F+UqrOLg/jS2YYVWg5mj22cvWWGesi9VoAsWIYVJFocxyLqtXNZPy3cwi8 WHgowxDQ+vuNB+En+IPgUall0GiLRsO8263J1YDU6aLFNuDEoF2CFlG0yEOOsHBR DLKqt06LtOHT4zKGZPmuD/QHvhFT0xwjLDTy46YC2oJmASP5BFL15C4tOQnYIZ59 hxnyP4iJYwE8yoWPOfJ8ffn0/1VBrpav3FI58qs1sj+RHHOwAkmoL78YKcllQdht pKGARhwnpN5VvKpKi2WKoDD+RVNqsmHUfbc+lFlEovQjGJWdI2yGllS/BuScXDCs d3ltt0jjPeq8r88E2jtbyUp6TMjhlhbByJDm2K5clsvrev+Q19ELon3FnNa0DDZe TBWbiTUQqWe784ImxQYngnisDkGpYvalw0uE9Uk2CNYdNP3gjX5gsvHJcbcTLVrn aGFkgEExZDdgVUDTT1XxjuZoqL2JbWpgOv5Npg== ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/B6B5F437544440C6

http://decryptor.cc/B6B5F437544440C6

Signatures

  • Sodin,Sodinokibi,REvil

    Ransomware with advanced anti-analysis and privilege escalation functionality.

    ransomwaresodinokibi
  • Modifies extensions of user files 7 IoCs

    Ransomware generally changes the extension on encrypted files.

    ransomware
  • Enumerates connected drives 3 TTPs 25 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Sets desktop wallpaper using registry 2 TTPs 1 IoCs
    ransomware
  • Drops file in Program Files directory 13 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 5 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\117f128807504f387d0b8e174ada23238c3556c7284a598ed25790dc2d9b7301.exe
    "C:\Users\Admin\AppData\Local\Temp\117f128807504f387d0b8e174ada23238c3556c7284a598ed25790dc2d9b7301.exe"
    1⤵
    • Modifies extensions of user files
    • Enumerates connected drives
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:3028
  • C:\Windows\system32\wbem\unsecapp.exe
    C:\Windows\system32\wbem\unsecapp.exe -Embedding
    1⤵
      PID:3076
    • C:\Windows\system32\vssvc.exe
      C:\Windows\system32\vssvc.exe
      1⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:3932

    Network

    MITRE ATT&CK Enterprise v6

    Replay Monitor

    Loading Replay Monitor...

    Downloads