Overview

overview

10

Static

static

10

44f0c8fe6f...5c.exe

windows7_x64

1

44f0c8fe6f...5c.exe

windows10-2004_x64

10

Analysis

  • max time kernel
    155s
  • max time network
    162s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220414-en
  • submitted
    07-07-2022 17:41

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    44f0c8fe6fd1c02c3563cb543388df80caba977b86bdc06092d98b9041249e5c.exe

  • Size

    164KB

  • MD5

    e25e14fc035850c0bb22b0f821d47c86

  • SHA1

    b85685991ab03818582fdda67a71c785d7b872c8

  • SHA256

    44f0c8fe6fd1c02c3563cb543388df80caba977b86bdc06092d98b9041249e5c

  • SHA512

    4f2530884fcef3a586117e432227b897a2f4d797427b2e7e0efccff7d3d2f53b86202f3e009b1cd0f0b84fe3bb421b1cf1120bcb0dfe72e99d5e594615b08ef1

Score
10/10
ryukransomware

Malware Config

Extracted

Path

C:\4ucj0u5-readme.txt

Family

ryuk

Ransom Note
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your computer has extension 4ucj0u5. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. I suggest you read about us on the Internet, we are known as "Sodinokibi Ransomware". For example, this article: https://www.coveware.com/blog/2019/7/15/ransomware-amounts-rise-3x-in-q2-as-ryuk-amp-sodinokibi-spread Pay attention to that: "How Much Data Is Decrypted with a Ransomware Decryptor? In Q2 2019, victims who paid for a decryptor recovered 92% of their encrypted data. This statistic varied dramatically depending on the ransomware type. For example, Ryuk ransomware has a relatively low data recovery rate, at ~ 87%, while Sodinokibi was close to 100%. " Now you have a guarantee that your files will be returned 100 %. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/9899F57A271D7D17 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.top/9899F57A271D7D17 Warning: secondary website can be blocked, thats why first variant much better and more available. If you have problem with connect, use strictly TOR version 8.5.5 link for download TOR version 8.5.5 here: https://filehippo.com/download_tor_browser_for_windows/ When you open our website, put the following data in the input form: Key: a3mUMdWhe+KzM3rZx/o3kNvTdIIL5fgd5VsBjFf3vHZGKyolgiNBB8yim07O4iJg HfVAfY9jQ7T2aSoVUZ5VZA1DjzW/QWZKol2WaBg4wCuRkH/8/l2YS91aTjSQZSdr viOBC0ZNiANeqF4vzORJ4n9tlcxUKItzAegfUNPWAp/wkOqXkTjpvqS1H35/4fdz V8S0m3LGw/lYHe0XfHSHmHELxDGQ0qXQDc4OgkCErNm/I38mjqY3Y0VQfZ4/k+qq UgjxcnyFVg8hwgsooDjjLSRZHC75BVJzhOst38YUtmDENDFYYisVPmnPR9VWXkeJ Ita6RGAcf70UdaeNZfWlfwa36cKCFIFmQx2sznrHV33x7DopJurAuv6GZgujIol9 DfuvWFUIA2lnOKGcMNjyvX/NS5aGQwuVYw4MXIVXs2YtJzEirdhNNrViHaPjsLqq H6XTQBiAXY3S1o7w/fD61IEeHoN5KE4hOSpEeiiOyRy190zY17AXTHi5TtHxcJqm /WTJQhq3KyItqe6VHcV3oMNJGiTIqzGHjn9pnP1mZNeKvemflJCneNoR7vJW76qo J3CkrDulF53DU7QcAwdpGncQKhtGv4KXYyFwAhUsOrNZRLoa0MhwrFuJoDJoQ2Cm coyCwwWTrcNwqdyM4ijnfjgdMsWjmcIerqo4kFUzwTY7EhJ/nny2VRuqOj2iTtJr 7SPy1lbp9X1+YBQCP3F0S4iMe93XfH2hsE/kqFBU40wJdbxl2o45HuEWyO8B1eXW lxY/XF3ovyoz7/nfZBn7a1OnaArdopX+6zjL8ctQ2ZP03BK03jmYoF99otHpFRIk 2nA8uN4gJAIPIiq1talGFN2DxhctCQ2nKGJzRFgbixZkKhSCytsgqWDKJt+TKmuj 1M0+95e+YDirma+ftT2FH1KfbQBcnDNMvFzrkijuUJkJy9HpxfdMwWOvBl6zgaH5 a/w1EmJ0gtklVQeKdonH9ZUSfqkAx2rNHxlth7n+hRh7Ganm7hYpuPDy8rVL7oSB 0b8roLHMBsyi7jzZWSpfBEpO4j0KM5H3if1x+CHzsR8p1fACEJnTfHiOpzyjwAx7 EJ5M8NOZ9c8GW4hGXDhGWGbNDqc/nwT6qCTFK9aph+IEA67k2Hd/LllJI4rKGZsY JIG+nsCucDM8cWWw Extension name: 4ucj0u5 ----------------------------------------------------------------------------------------- postscript: In case you want to independently decrypt your servers, we will be forced to put the databases of your companies in the public domain. MDF files: DB_UTILITY LeasePlus LPSecurity LTShared PaperVision !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

https://www.coveware.com/blog/2019/7/15/ransomware-amounts-rise-3x-in-q2-as-ryuk-amp-sodinokibi-spread

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/9899F57A271D7D17

http://decryptor.top/9899F57A271D7D17

https://filehippo.com/download_tor_browser_for_windows/

Signatures

  • Ryuk

    Ransomware distributed via existing botnets, often Trickbot or Emotet.

    ransomwareryuk
  • Modifies extensions of user files 14 IoCs

    Ransomware generally changes the extension on encrypted files.

    ransomware
  • Enumerates connected drives 3 TTPs 25 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Sets desktop wallpaper using registry 2 TTPs 1 IoCs
    ransomware
  • Drops file in Program Files directory 12 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 5 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\44f0c8fe6fd1c02c3563cb543388df80caba977b86bdc06092d98b9041249e5c.exe
    "C:\Users\Admin\AppData\Local\Temp\44f0c8fe6fd1c02c3563cb543388df80caba977b86bdc06092d98b9041249e5c.exe"
    1⤵
    • Modifies extensions of user files
    • Enumerates connected drives
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:3324
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -e RwBlAHQALQBXAG0AaQBPAGIAagBlAGMAdAAgAFcAaQBuADMAMgBfAFMAaABhAGQAbwB3AGMAbwBwAHkAIAB8ACAARgBvAHIARQBhAGMAaAAtAE8AYgBqAGUAYwB0ACAAewAkAF8ALgBEAGUAbABlAHQAZQAoACkAOwB9AA==
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:4716
  • C:\Windows\system32\wbem\unsecapp.exe
    C:\Windows\system32\wbem\unsecapp.exe -Embedding
    1⤵
      PID:2132
    • C:\Windows\system32\vssvc.exe
      C:\Windows\system32\vssvc.exe
      1⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:1396

    Network

    MITRE ATT&CK Enterprise v6

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/4716-131-0x0000028AE9AC0000-0x0000028AE9AE2000-memory.dmp

      Filesize

      136KB

      Download

    • memory/4716-132-0x00007FFE195C0000-0x00007FFE1A081000-memory.dmp

      Filesize

      10.8MB

      Download

    • memory/4716-133-0x00007FFE195C0000-0x00007FFE1A081000-memory.dmp

      Filesize

      10.8MB

      Download