Overview

overview

10

Static

static

10

692b0db3de...3a.exe

windows7_x64

10

692b0db3de...3a.exe

windows10-2004_x64

10

Analysis

  • max time kernel
    141s
  • max time network
    153s
  • platform
    windows7_x64
  • resource
    win7-en-20211208
  • submitted
    05-03-2022 20:27

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    692b0db3de579b4dc20697a949a4c6e8e930720ce48cea62042c0522442a403a.exe

  • Size

    116KB

  • MD5

    dd3150ad746520d50ce61aa146b0fd4e

  • SHA1

    a90c355f8f751d1575e9be13ad12fddf009f71c6

  • SHA256

    692b0db3de579b4dc20697a949a4c6e8e930720ce48cea62042c0522442a403a

  • SHA512

    baf3507d71247d3c169dcafa0fd180c5f6abc2e753c34c19cea1684156cdab6e01b45e2defdbde567e527a47a73a21725e8283137a8b77236ceafa1dd2d77e0d

Score
10/10
sodinokibipersistenceransomware

Malware Config

Extracted

Path

C:\jabwv5-readme.txt

Family

sodinokibi

Ransom Note
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on you computer has expansion jabwv5. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/495E77D584F0E6EB 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/495E77D584F0E6EB Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: KNPCjDTXaUYCDhm6N/xayl39lDXqjQe2PNPof2djWRW1aVcqrUdFXuBwobKX18OD /z5Bna2oYYuqFqKGTVvr4nScbjaQieX4bohUfdCxbvdiI7yu/OTAmt68wVyjGM/x gUEZBkFP5z2C1NwEa/Wq+6bRE/C/GTuKPhGxwMUp1PGeSkoOmHj2HhV94o/DEL+U QVUDRxJ1G2oAkSKva9v2s4/mRlZVgJshhGLyPBWh1zAMaH7W10A00Mh+i7Cf/5QY 5lhPnT1jBQvi/90hKsDTbfpu1tP5eSfGEb8J4vOnvuj5KRo/OxHNVQbDZjjM4E3K 2lf//XAZ4r1TDTzibumCAIlKs9VG9tH+RG6xfZwftpoi6Q8YI4snYjdu1CwBcmhe ggz1rIgOjQRVJ2CVbAqu16n4XdHGabtocntesa9T72BaQ5chVRKzsO7sb0Kq+9mt lxYTta6XaLf/1JlK10+m8+slgb4mOZSMpTdLSRoTCsILlgTrGG5zevWZLmlYMCTR azEGhL0/A75eOSPgvPHWePJVJBRrD+hwUfhLCqj31W9py7DZEjABDvdf7pBtceAZ JPzsv0cEed92Uv82Dx/z78ZPzBJyeCVrDJMo1NqStiX2od3/Rm2wwKM7QfYYf+1l CGu8kgnQhShk9g8ZmuNjaDSAE3TK7BoDbuIPbZu4xWNUxGr0TG2eFohLYf1vyUWq vxcpOkkgVemKw0DF6J4KxvVAaMLNFLKGYa2nj4mX9uiAb5JK+H1kvYpVV8ZoaUAX dqtHhRKDQljUCTIHnmdCLfGn2FIDeRxZobIDYSARiwMxlixeM1/P3YD+k3HsB51m ox4sAHmvOIwqhHkfHgjkSYI3i5M/NHFtCn4vD+DZfesNYOAfLeReHnZ9/TwxcfU6 Xn25mTNXYm3Y841y1tMS8ymg3YN1kaVtnUtv3X7+PJD46dmQM3R3mpdZ4p7MQpOw VUW3VlfAAqzNRrXKWlu1ySF8ik1Bw4Fy+WKb1aoKDz50Z6UHgSOfMafSzdYHbu6v bApMg7/xzoViaNgM9TwkjkW+5kuwHsR7vM7iYyD+3mh4EpfFhMdJXcmq+j+9Qk5d J+BX55Fhq4bbyWSIs0LK01jzsZ0Gdp9ABR4OPfPOb8rGJH6FaBe0Imb9AiE1FB5t sjvTVPnP7FsZMm6CtfY5Nk5RnV1G0Siq0Z5o4iH68eyydZlEtUzSdM1DceKEXxXN w+k6GaNJg8Mgd/vL/sPQBAV3TUTCxXuPgJG0BHOOrWckHyqTY0G+f9w+SlPCoeWT +Ya+aWzUf8o5ohznjc9TOVO6/j5jkjOk Extension name: jabwv5 ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/495E77D584F0E6EB

http://decryptor.cc/495E77D584F0E6EB

Signatures

  • Sodin,Sodinokibi,REvil

    Ransomware with advanced anti-analysis and privilege escalation functionality.

    ransomwaresodinokibi
  • Modifies extensions of user files 2 IoCs

    Ransomware generally changes the extension on encrypted files.

    ransomware
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Drops desktop.ini file(s) 28 IoCs
  • Enumerates connected drives 3 TTPs 25 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in System32 directory 1 IoCs
  • Sets desktop wallpaper using registry 2 TTPs 1 IoCs
    ransomware
  • Drops file in Program Files directory 41 IoCs
  • Modifies system certificate store 2 TTPs 6 IoCs
    evasionspywaretrojan
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 5 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\692b0db3de579b4dc20697a949a4c6e8e930720ce48cea62042c0522442a403a.exe
    "C:\Users\Admin\AppData\Local\Temp\692b0db3de579b4dc20697a949a4c6e8e930720ce48cea62042c0522442a403a.exe"
    1⤵
    • Modifies extensions of user files
    • Adds Run key to start application
    • Drops desktop.ini file(s)
    • Enumerates connected drives
    • Drops file in System32 directory
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • Modifies system certificate store
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:1908
  • C:\Windows\system32\wbem\unsecapp.exe
    C:\Windows\system32\wbem\unsecapp.exe -Embedding
    1⤵
      PID:872
    • C:\Windows\system32\vssvc.exe
      C:\Windows\system32\vssvc.exe
      1⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:1776

    Network

    MITRE ATT&CK Enterprise v6

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/1908-55-0x0000000076731000-0x0000000076733000-memory.dmp
      Filesize

      8KB

      Download