Analysis

  • max time kernel
    4294183s
  • max time network
    145s
  • platform
    windows7_x64
  • resource
    win7-20220223-en
  • submitted
    06-03-2022 04:18

General

  • Target

    937829f7defd9b3e80bb36d82f2e3421c80ec39cb858756dc647547635821d7e.exe

  • Size

    118KB

  • MD5

    0237b989a2baee892313244ad6376153

  • SHA1

    8677b1fa138f908fc791426f681995a1ca462ba9

  • SHA256

    937829f7defd9b3e80bb36d82f2e3421c80ec39cb858756dc647547635821d7e

  • SHA512

    88ea1dfb64da80834619c4039431cd1051fb00a9f081ff4697b05636f9e7aab83d6351a20437e26c40d7bfb3dc281e5cf55c3fb6b599410902c3c96aca9b2609

Malware Config

Extracted

Path

C:\7i376-readme.txt

Family

ryuk

Ransom Note
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your computer has extension 7i376. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). Dear Bil Aurelis, President of CLEVELAND CRANE & SHOVEL SALES INC, besides the fact that we encrypted your files, we also downloaded 400 GB of the most important data from your servers. sql db, customers, taxes. As proof, write to us in the chat. Be sure all your files are safe and will not be leaked if payment is made. There is a serious flaw in your security system that makes you a vulnerable target for many who want to compromise your system and gain access to all of your computers. Our team specializes very well in the field of computer security and can help you cover this vulnerabilities and help restore all your files to their original state. You must understand, we do not want to do you bad and leave you with a vulnerable system. Our goal is to help you maintain the privacy of your clients and prevent your files from being leaked. And now let's imagine what losses your company will suffer if a huge part of confidential information on customers and partners is in the hands of people who know the value of this information. Given the experience of previous years, even the giants of the financial markets suffered from huge losses with such leaks. They hardly try to restore company's reputation, which of course entailed a bunch of associated problems. I would like to dwell on a small list of problems that you can avoid: 1. Reputation losses 2. Financial damage 3. Lawsuits from customers and partners for the leak of confidential information entailing enormous problems for them. 4. The involvement of federal services for a full check of the company and its financial audit. 5. The actual stagnation of the development of the company and the ability of competitors to take your market share. We think that your risk department can perfectly continue this list without us, but now back to your proposal. Actually, it only says one thing; your security system is not able to protect information and assess the extent of what happened in reality. You can see our work methods in our blog. If a company don't pay, we public data or sell it in auction: http://dnpscnbaix6nkwvystl3yxglz7nteicqrou3t75tpcc5532cztc46qyd.onion All companies that do not pay the ransom sooner or later end up on the list whose files are sold at auction, or are directly merged in the public. [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. I suggest you read about us on the Internet, we are known as "Sodinokibi Ransomware". For example, this article: https://www.coveware.com/blog/2019/7/15/ransomware-amounts-rise-3x-in-q2-as-ryuk-amp-sodinokibi-spread Pay attention to that: "How Much Data Is Decrypted with a Ransomware Decryptor? In Q2 2019, victims who paid for a decryptor recovered 92% of their encrypted data. This statistic varied dramatically depending on the ransomware type. For example, Ryuk ransomware has a relatively low data recovery rate, at ~ 87%, while Sodinokibi was close to 100%. " Now you have a guarantee that your files will be returned 100 %. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/0273E1CADF203DED 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/0273E1CADF203DED Warning: secondary website can be blocked, thats why first variant much better and more available. If you have problem with connect, use strictly TOR version 8.5.5 link for download TOR version 8.5.5 here: https://filehippo.com/download_tor_browser_for_windows/ When you open our website, put the following data in the input form: Key: 0w7uE4JH8Xkfv4HE93COdZY9QbZ4OQ7ptHo2a6F52s9Vh+2zA6zD4zonpKV2zq+S 5LPqxLUXC9XXW5uX+vnK9RZPT4v37i8ytkr9zOC0ZwfDUb/IOU/B8W6axgQLP/PY /nZ7+Xv+wqwX/8DVBkSqgm1MzbtPencZq1w8Q37bTmukakD0fKT2B+LygWf5MYsi wZniiPa7w+SCVEyCBrfNdi8zaR5zKTcf8PZoXk9Z0pSNrSPZb2zNK+GT+Ms37aje oIt7pH+qnnZcu9U5QxC8hLJS/QSoYAv7VxX7qydhtTnApdq8d0FUi9wG7am540NB vejE2/nz72HVIlIzyrP9PoAoQB/vEJ0GALiVrzYWdOgsVPv3xrpYSQc6rXjnkZSd Xeq7BWW6L3EWa7B2Hdn38vN2KDrRGsIysjGIlIUI9YP06N/wpWNwcyJXZ6mmX6hW 83EpM3xl1iL2mB/x7EbX/XDm5hZkb5wBLGtcvvpasIt32Lc7xxLsZlbjGYn4YApF Tow3PgyOzurafKKuFZsIBhUN9UQMaTDXcGmy9CnRNWPjQcu4ZleJPiVngT9a6ZAf A7FHFFEsMj3xou46MrVncYwQcmYjpj4t6YCrYAguc7V65NxEiKz80K30zrx5PYHt DCn4xC1o6RKXXZOoHtpTU5ypnvGQbJOReCjXlmmwlVaV3fcMRknL4MjaH7NIhCNo cEz30wLdgesSyO13SSBbNfB6h0Okwk/A/44WpgV47Z5jO0FAeth9ujv/rvxgVZ2w YdM81gcZO+rojenmOzbXdpV8TEEA87AnaWJNHH6SOXhJ9i8nfZL0jkCacJ3cEssy kttchDmIrvgfq9MBqltBDMNvMEqau4D+36llDWdEytrt5OS/K29VqnthWmxt6BQE oIIcgZwizQGmCyjhZgnJMr1tSYyojVi7OuJw3/tqRJQJYWEWxlN0wnPTyQ1OdU2/ Zf8F/BWJLaKhSfJtuymbzeF2zVsKjtftkEhMxF86ndDUhPsKJIk2/f9WdFg1OuHY nd9vjlLdygXp1oG+1WPD2jcl+R2X5QIdwHXHUgNSTBaXP8YD3zkiY6zjhpIEhZCL 57bqelWsSVd3bNlVrioVwuEbI4vvFXHoeFJNMpwhRi05oBN0cghyxaIUrNF12Bix N326iPZWDhGtl4QtU2rGKqPeYGWSiV81qnKKt+BbQoOLHSHgzBBgG4sW+4lAhtcR D7KLeaT8GKrWQ3x6WSt/jaS7mOy1rJUdaTLdWuaqGlo7v1itw0/24RpghmcwcyCR Ygn7fHIoFygyVN2zz5hn0vs7yJOJvg== Extension name: 7i376 ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://dnpscnbaix6nkwvystl3yxglz7nteicqrou3t75tpcc5532cztc46qyd.onion

https://www.coveware.com/blog/2019/7/15/ransomware-amounts-rise-3x-in-q2-as-ryuk-amp-sodinokibi-spread

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/0273E1CADF203DED

http://decryptor.cc/0273E1CADF203DED

https://filehippo.com/download_tor_browser_for_windows/

Signatures

  • Ryuk

    Ransomware distributed via existing botnets, often Trickbot or Emotet.

  • Modifies extensions of user files 4 IoCs

    Ransomware generally changes the extension on encrypted files.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Enumerates connected drives 3 TTPs 25 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in System32 directory 1 IoCs
  • Sets desktop wallpaper using registry 2 TTPs 1 IoCs
  • Drops file in Program Files directory 12 IoCs
  • Modifies system certificate store 2 TTPs 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 13 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\937829f7defd9b3e80bb36d82f2e3421c80ec39cb858756dc647547635821d7e.exe
    "C:\Users\Admin\AppData\Local\Temp\937829f7defd9b3e80bb36d82f2e3421c80ec39cb858756dc647547635821d7e.exe"
    1⤵
    • Modifies extensions of user files
    • Enumerates connected drives
    • Drops file in System32 directory
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • Modifies system certificate store
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:1088
  • C:\Windows\system32\wbem\unsecapp.exe
    C:\Windows\system32\wbem\unsecapp.exe -Embedding
    1⤵
      PID:524
    • C:\Windows\system32\vssvc.exe
      C:\Windows\system32\vssvc.exe
      1⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:652

    Network

    MITRE ATT&CK Enterprise v6

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/1088-54-0x0000000075801000-0x0000000075803000-memory.dmp

      Filesize

      8KB