Overview

overview

10

Static

static

10

6ff8946c26...e2.exe

windows7_x64

1

6ff8946c26...e2.exe

windows10-2004_x64

10

Analysis

  • max time kernel
    112s
  • max time network
    130s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220414-en
  • submitted
    25-06-2022 08:29

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    6ff8946c265263670540c1d7d9122ed7ead84f7fa898e2bd5a718211b2c384e2.exe

  • Size

    164KB

  • MD5

    68e56a7c328917186ab66b526bb456a6

  • SHA1

    ad3df656c2700e551376751c3202c260ad26eccb

  • SHA256

    6ff8946c265263670540c1d7d9122ed7ead84f7fa898e2bd5a718211b2c384e2

  • SHA512

    43ef8c3b8829ff599aaf4c141d78f84f022f03a05d881ced50f1b2ee175cb12a376124f5d0f283c95b35c587061f6813da827dca03c5f2294c6cc49caecaa4ef

Score
10/10
ransomware

Malware Config

Extracted

Path

C:\8q1g3-readme.txt

Ransom Note
---=== Welcome. ===--- Merry Christmas and Happy Holidays everyone! You have a great opportunity to enter the new year, leaving all the bad in the outgoing year. I advise you to write to us as soon as possible and not waste your precious time that you can spend with your family. With our decryptors recovery will take you the least time, without us you will have a very hard time and some of your files will not be recovered never. The longer you think, the harder it will be for us to negotiate with you . Waiting for your dialogues in our chat, below you can get acquainted with what happened. [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension 8q1g3. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/7C3D8C22D76EC643 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.top/7C3D8C22D76EC643 Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: mW3oHlvbdCdKq9QdjhEmKnUJD6yapdGtRSTVCU82UaRkrg8XyV8t4s98dq0vBOeh IvQ/sg6tbDqNO3sdSyXoYu6nStzqjxe8UpAQG6+SOTO8Mg3ORKsaID1XxaXfXvS+ pMaKq9peRKn0azSWjOjVWVj6jrqUOiTVxSGVYKV64EXxLgXwxHhWr8MrDwiOSJ5W uyuayg9H2CSkvQtoww78nT8XKAlJeReIkrQeeRX9uxXeqDtdn3USZlMwZjZ1KDJ4 uJuTbHbhFgaXyfbCFiCs8U6jH+y+J4sIvN0QbPc4tybmLBJ8wT5kJwLTmifTO9g6 nTa2eFScKGbpMgfxpaaKk5Y4Y47iMr7Ss8xm0IZskou6FLR0Ubz6lAZqtRSgKYJ+ iTNN+mkuawF9dY/1Rsy104XihsyATPy06JhXlgYzV8JRbIw5i4MjUNgTN+Am8l56 4tp3POIRvOFt+Ncv5zbpI2Fni4u2fkDj3U60+Ad5RpgrFqsCHy45zR1IDQ1v/VRp h1de5AyKCBwTO56ykUYgpiHgIEhvPwq25Wl+vupQx/rZy/TXyT66xoCVLkMJTPlg QNJb+k/jSjCGe/yOSl9AHcjCG9NAU1GxlpVyzOA9+92OWDeNzkfnIDAEs6shPrfK n1hPPZpHi+joWjteIEK2ihTCKNh5jkJUk3IS0g3yc34m8S9Ll+KQeRBNA5wX4Mbq PryC4sh0WiRnmGEskazd/QeOVByy6esF6HyZsGRj0J3QXlszYqpg/6ixOePa3Njk eRkfIQxVabxfkj6DEE+s+ZaSENtZFLg67JM59JWRdt5/B5WyDWDTfjtf5FOCeqM4 fZYqOSV+D1P1tC27x2aCqSlf9y7xRL77qjkHhIIkDMyd+W3ICDOuY9uj5HD7D40q br5oTgz6UwnwU7oD7XST6FZf7nnTgtXl0kMnoCRRaW7Ci6PD+cd+E6KhH/1/YDQ6 +05jM7hTlR7AgPwwBpJZCbDvW+9XsiBOYSWJAHCQA1U2gwUCb+nATxffXKg6PdvK QwczeEWGjcr3hMaasTQE4Hhqam6lV1o33y/smbzBBDPK4rpmKSNtF0rPZsULKYNl 0friZ8wflNRILhlZQ7mUTbE9pkgw+nkBk3sEEFMcTXBmyW0BDcx0L9ILC3DuNIO1 feGpz6tkAzM= Extension name: 8q1g3 ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!! For google: Revil/Sodinokibi
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/7C3D8C22D76EC643

http://decryptor.top/7C3D8C22D76EC643

Signatures

  • Modifies extensions of user files 5 IoCs

    Ransomware generally changes the extension on encrypted files.

    ransomware
  • Enumerates connected drives 3 TTPs 25 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Sets desktop wallpaper using registry 2 TTPs 1 IoCs
    ransomware
  • Drops file in Program Files directory 26 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\6ff8946c265263670540c1d7d9122ed7ead84f7fa898e2bd5a718211b2c384e2.exe
    "C:\Users\Admin\AppData\Local\Temp\6ff8946c265263670540c1d7d9122ed7ead84f7fa898e2bd5a718211b2c384e2.exe"
    1⤵
    • Modifies extensions of user files
    • Enumerates connected drives
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:4352
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -e RwBlAHQALQBXAG0AaQBPAGIAagBlAGMAdAAgAFcAaQBuADMAMgBfAFMAaABhAGQAbwB3AGMAbwBwAHkAIAB8ACAARgBvAHIARQBhAGMAaAAtAE8AYgBqAGUAYwB0ACAAewAkAF8ALgBEAGUAbABlAHQAZQAoACkAOwB9AA==
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:4152
  • C:\Windows\system32\wbem\unsecapp.exe
    C:\Windows\system32\wbem\unsecapp.exe -Embedding
    1⤵
      PID:2412
    • C:\Windows\system32\vssvc.exe
      C:\Windows\system32\vssvc.exe
      1⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:1824

    Network

    MITRE ATT&CK Matrix ATT&CK v6

    Initial Access

    Execution

    Persistence

    Privilege Escalation

    Defense Evasion

    Modify Registry

    1
    T1112

    Credential Access

    Discovery

    Query Registry

    1
    T1012

    Peripheral Device Discovery

    1
    T1120

    System Information Discovery

    1
    T1082

    Lateral Movement

    Collection

    Exfiltration

    Command and Control

    Impact

    Defacement

    1
    T1491

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/4152-130-0x0000000000000000-mapping.dmp
      Download
    • memory/4152-131-0x00000294AD580000-0x00000294AD5A2000-memory.dmp
      Filesize

      136KB

      Download
    • memory/4152-132-0x00007FF877C00000-0x00007FF8786C1000-memory.dmp
      Filesize

      10.8MB

      Download
    • memory/4152-133-0x00007FF877C00000-0x00007FF8786C1000-memory.dmp
      Filesize

      10.8MB

      Download