Overview

overview

10

Static

static

10

Ransomware...KB.exe

windows10-2004-x64

10

Ransomware...KB.exe

windows10-2004-x64

10

Ransomware...KB.exe

windows10-2004-x64

10

Ransomware...KB.exe

windows10-2004-x64

10

Ransomware...KB.exe

windows10-2004-x64

10

Ransomware...KB.exe

windows10-2004-x64

10

Ransomware...KB.exe

windows10-2004-x64

10

Ransomware...KB.exe

windows10-2004-x64

10

Ransomware...KB.exe

windows10-2004-x64

10

Ransomware...KB.exe

windows10-2004-x64

10

Ransomware...KB.exe

windows10-2004-x64

10

Ransomware...KB.exe

windows10-2004-x64

10

Ransomware...KB.exe

windows10-2004-x64

10

Ransomware...KB.exe

windows10-2004-x64

10

Ransomware...KB.exe

windows10-2004-x64

10

Ransomware...KB.exe

windows10-2004-x64

10

Ransomware...KB.exe

windows10-2004-x64

10

Ransomware...KB.ps1

windows10-2004-x64

10

Ransomware...KB.exe

windows10-2004-x64

10

Ransomware...KB.exe

windows10-2004-x64

10

Ransomware...KB.exe

windows10-2004-x64

10

Ransomware...KB.exe

windows10-2004-x64

10

Ransomware...KB.exe

windows10-2004-x64

10

Ransomware...KB.exe

windows10-2004-x64

10

Ransomware...KB.exe

windows10-2004-x64

10

Ransomware...KB.exe

windows10-2004-x64

10

Ransomware...KB.exe

windows10-2004-x64

10

Ransomware...KB.msi

windows10-2004-x64

10

Ransomware...KB.exe

windows10-2004-x64

10

Ransomware...KB.ps1

windows10-2004-x64

10

Ransomware...KB.exe

windows10-2004-x64

8

Ransomware...KB.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    1693s
  • max time network
    1706s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    13-09-2022 17:54

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    RansomwareSamples/Sekhmet_30_03_2020_364KB.msi

  • Size

    364KB

  • MD5

    15fc8a15e86c367586e3661b03bcab44

  • SHA1

    a6a6f2dc244d75cac1509e46c7de88ff479b9ee6

  • SHA256

    b2945f293ee3f68a97cc493774ff1e8818f104fb92ef9dbeead05a32fc7006ff

  • SHA512

    cad4c868065a4715126a6e644c1fc1c5d9832e027f62f2f9370172e523fe7db63119871ba64977fc2f25959197a20f0e0e98bd66b2539eae7d46ded9d571436b

  • SSDEEP

    6144:nj+vyxz9WYWqpkGbOAqMK/oVZUlz/F8GO53OuzZOJM7CQ5g//s4Y:j+wpWYkGA/WGUGO53OIZkh/Y

Score
10/10
egregorsekhmetransomware

Malware Config

Extracted

Path

C:\RECOVER-FILES.txt

Family

sekhmet

Ransom Note
-------------- | Attention! | -------------- Your company network has been hacked and breached. We downloaded confidential and private data. In case of not contacting us in 3 business days this data will be published on a special website available for public view. Also we had executed a special software that turned files, databases and other important data in your network into an encrypted state using RSA-2048 and ChaCha algorithms. A special key is required to decrypt and restore these files. Only we have this key and only we can give it to you with a reliable decryption software. --------------------------------------- | How to contact us and be safe again | --------------------------------------- The only method to restore your files and be safe from data leakage is to purchase a private key which is unique for you and securely stored on our servers. After the payment we provide you with decryption software that will decrypt all your files, also we remove the downloaded data from your network and never post any information about you. There are 2 ways to directly contact us: 1) Using hidden TOR network: a) Download a special TOR browser: https://www.torproject.org/ b) Install the TOR browser c) Open our website in the TOR browser: http://o3n4bhhtybbtwqqs.onion/9A2F8824BB2D98FA d) Follow the instructions on this page. 2) If you have any problems connecting or using TOR network a) Open our website: https://sekhmet.top/9A2F8824BB2D98FA b) Follow the instructions on this page On this web site, you will get instructions on how to make a free decryption test and how to pay. Also it has a live chat with our operators and support team. ----------------------- |Questions and answers| ----------------------- We understand you may have questions, so we provide here answers to the frequently asked questions. ==== Q: What about decryption guarantees? A: You have a FREE opportunity to test a service by instantly decrypting for free 3 files from every system in your network. If you have any problems our friendly support team is always here to assist you in a live chat. ==== ==== Q: How can we be sure that after the payment data is removed and not published or used in any nefarious ways? A: We can assure you, downloaded data will be securely removed using DoD 5220.22-M wiping standart. We are not interested in keeping this data as we do not gain any profit from it. This data is used only to leverage you to make a payment and nothing more. On the market the data itself are relatively useless and cheap. Also we perfectly understand that using or publishing this data after the payment will compromise our reliable business operations and we are not interested in it. ==== ==== Q: How did you get into the network? A: Detailed report on how we did it and how to fix your vulnerabilities can be provided by request after the payment. ==== -------------------------------------------------------------------------------------- This is techinal information we need to identify you correctly and give decryption key to you, do not redact! ---SEKHMET--- zQM6f996t5fqWX55ilcAyb6WS5f89fPVfQ08sSo0LaAbPRpZuo9Aj79YVAZBmGeQsfaQY396KVinLIAdKCW6c96TtdFLYBwZT1UM8iTeI9tvmvf/YIE5W3eBvTcqtDmnzPPPpiCqjc+wqYu2zLeaN/cGm53Hhn+nReyi3zx8kjJytue9piMipEJJhp3QTIuwQGy17pJU412PVhTU4vFviOww2Xu4gnJv1tDQXTWrHjHsGtcUSJ0acfi56IXvBr8Pz43cnOIisjkGl5Y3iMIhdcwo6XbTAIJAdaolCnVFNAnQKhp+AYoLamXw0Yv3q7SPtMEF7gUxumG2SC6kuoZW09ZQnJfEMhnuqAauDFezNTiRIx8mRulGl1ssidfz0hRFA+L97N85p+UcNyE0dWuX2lr5gnVqPA9r3JHZ9jWtgav4tsf6DyY59I0X+guUzfLO1G+qXCn+L6lTYscBxuar7OYTR2P7JuixAlrHnl1QrMrdUDP3AOs87IinjbDCW6y2ywsufXb3Y0VprlnsgURM7Ih/xEDYfFAL2e2W7kEEdZ8xsjV18kIdQYkbxYSIaxNoeI/qoC5UElFjVEdkUUNqV9b2Z3YSMt652ws5kX+wU/kD6BAm08ZnJNFSKGOn/5sLZuKjqIy1NCKbAfb53R8JxXTo0OdAmEc5Vf6p6yC9ecZX/J5naR8ZQSZnuuaGQwJeKgF94Xz9JlYtY2HWGWOs3dLQyutRvR3ItLCRWdHr/m4WYTUfFDT8EFt4Lg+Cxx4wCJGnMRgY8oQA0aLwQYMqIVQV8mjtn+7Qph4X+giN19N3853s5hxnrgHRCdRLZOkwTqVYf3krks7sxC2TGrEzYLKPdCZwSU/Jx/TBxsoipfny68ab9nHsXIOR2wquMEqwSnVatuyJqDb0M9Td0qpedVh2iWIDL6J+Wp69Tl3Jw9qvTSyhCfqByP5YDEVler/RWlJMj2WiYJ3N5GzU4YLraXLoP1JJ9tQciioSCA4VpcMldTa6jYmA3XJeB3ueBBoCLoKYfd4Vtb+la9X0aRpSlgw9PgWuhmLUNf8Dq6WwKiVHztcdzc4UWgQJrWPrb4+EBluHtW7tL9uV7qctbOkwtJD9vAT/6HguDpO6zRgCsXK85n3xc+1x/NkXTf/5s0WirLcLs1nV/CbL59P0c3IxIEdqdqVp2Jd021eWYwWETTXkdzE5HJdNQwKKlKkvkEHCZMKQ20WG0wr47vgvHuovya/WrVqB+9BWPfvGAzwuVRgpbIeBvsktCm4TifZnR85nOid/Blnq41IInUbuib1DkXY2c6oqTVgQ7v/6bkSw90TnBnPQpAYe+0wE9a9bmhan5urq0N7rQpjffhSv+2gq4/Mb8bciMCIX80upLB8NvkI3Cd7i/EQfscww8DXZ9QJBPKpSH9O2uPo/n1wHOrgVBs/LSdEJUr/9fiTMHPDXsibQRDCxJJi+s+HpRP2lQykdXCrppZntB58M6Ock+SNwJsfrcOuFcbbFv8EaT/fpcEAirS0h9UMruwi5dwFdJVHqUH3SB++6CDtatwbZX657JMmNNmg1OVYZJjYvLAmb8+NUuMMY+t61+/stO0d8nEmt6LRgM0tBRQFpSgUPbsS1RsYhlX/Tk1+qAh7x9m2eb4BxozUzR4S9rWQAiASl1rOB9NotMK2+uytw48WKqGVfKmtEYVd4NEm3Om4o2Y1Hxp/gIUlBsEhgvW7LIg/djiJkNAF076+QnqN1/5SoPkZCQ1Y2rXBI8nB927KqgDsnYQbFRtRVSvz6iRFNKbUR86D+7KEwoVuqYnhLQZGejcIKIwDzAfbgvea3ZtHP0ydp+zt5ONpD/fTzVkY2lPSH7ulO7W7ADgdXR6Ss1VfAGO8OQBlEj+h1y32RJP/K+eTgeoKrHwgmDv2fhCMpnji2Kvaeug7/Sed4jHxww94ySHICNefrvML+xH+wJdPEG6MG7bJm9sn3oxUhB9TZnEL1yWmrIQOKSjACe376+wgaNNkC7JTu3k05vg38skJVOTN8l2EXKdNS6LSwHZpeEaVzGkGgJYs4psId7JYKyS6GuvEae3PWc1osVSIV4olzmIOLbyWVkb8A7/gsz4mR0dPM92X9x1/rYxlH6HkxSD/TVih+QCNfOADFoWQ+L/FRGNSS8BP7m1536CiMz9he4Wdm4nia3V4vREQrj/N2d4hCqfH1hrpU9DJx71yC+3wBtUsxfgC8EKP2i88EGFR6Es6YISmFxitnfAgBEAEYASCAAigAOhJHAEIAUQBIAFUAUgBDAEMAAABCIjkAQQAyAEYAOAA4ADIANABCAEIAMgBEADkAOABGAEEAAABKNnwAQwA6AEYAXwAyADAAMQA4ADcALwAyADYAMQA4ADQAMQB8AEQAOgBDAF8AMAAvADAAfAAAAFIOUwBZAFMAVABFAE0AAABoAHIsVwBpAG4AZABvAHcAcwAgADEAMAAgAEUAbgB0AGUAcgBwAHIAaQBzAGUAAAB6FFcATwBSAEsARwBSAE8AVQBQAAAA ---SEKHMET---
URLs

http://o3n4bhhtybbtwqqs.onion/9A2F8824BB2D98FA

https://sekhmet.top/9A2F8824BB2D98FA

Signatures

  • Detected Egregor ransomware 2 IoCs
  • Egregor Ransomware

    Variant of the Sekhmet ransomware first seen in September 2020.

    ransomwareegregor
  • Sekhmet Ransomware

    Ransomware family active in the wild since early 2020.

    ransomwaresekhmet
  • Blocklisted process makes network request 21 IoCs
  • Modifies extensions of user files 6 IoCs

    Ransomware generally changes the extension on encrypted files.

    ransomware
  • Drops startup file 4 IoCs
  • Loads dropped DLL 1 IoCs
  • Enumerates connected drives 3 TTPs 48 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Program Files directory 4 IoCs
  • Drops file in Windows directory 10 IoCs
  • Checks SCSI registry key(s) 3 TTPs 5 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies data under HKEY_USERS 11 IoCs
  • Modifies registry class 22 IoCs
  • Suspicious behavior: EnumeratesProcesses 8 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of WriteProcessMemory 5 IoCs

Processes

  • C:\Windows\system32\msiexec.exe
    msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\RansomwareSamples\Sekhmet_30_03_2020_364KB.msi
    1⤵
    • Blocklisted process makes network request
    • Enumerates connected drives
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    PID:2268
  • C:\Windows\system32\msiexec.exe
    C:\Windows\system32\msiexec.exe /V
    1⤵
    • Blocklisted process makes network request
    • Enumerates connected drives
    • Drops file in Windows directory
    • Modifies data under HKEY_USERS
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1376
    • C:\Windows\system32\srtasks.exe
      C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
      2⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:700
    • C:\Windows\syswow64\MsiExec.exe
      "C:\Windows\syswow64\MsiExec.exe" /Y "C:\Users\Admin\AppData\Local\Temp\System Update\patch_may13869.dll"
      2⤵
      • Blocklisted process makes network request
      • Modifies extensions of user files
      • Drops startup file
      • Loads dropped DLL
      • Drops file in Program Files directory
      • Drops file in Windows directory
      • Modifies data under HKEY_USERS
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:4568
  • C:\Windows\system32\vssvc.exe
    C:\Windows\system32\vssvc.exe
    1⤵
    • Checks SCSI registry key(s)
    • Suspicious use of AdjustPrivilegeToken
    PID:772

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

2
T1012

Peripheral Device Discovery

2
T1120

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\System Update\patch_may13869.dll
    Filesize

    707KB

    MD5

    1343bd0e55191ff224f2a5d4b30cdf3b

    SHA1

    6412cbf10ac523452e051267afce4095d7f3d5ac

    SHA256

    fceb299326ef4298a3c30e10b31d8c64f1369b182ac256d1eeaf148c1adcea8d

    SHA512

    f3fcb8d1c89f463f2e73dadbf32afda7716c8c065990f3422fc2b5f10cb396a68ea6f711a0184989b83f474e660bc12fb47db60966011b1a18f84755571e9b9e

    Download Submit
  • C:\Users\Admin\AppData\Local\Temp\System Update\patch_may13869.dll
    Filesize

    707KB

    MD5

    1343bd0e55191ff224f2a5d4b30cdf3b

    SHA1

    6412cbf10ac523452e051267afce4095d7f3d5ac

    SHA256

    fceb299326ef4298a3c30e10b31d8c64f1369b182ac256d1eeaf148c1adcea8d

    SHA512

    f3fcb8d1c89f463f2e73dadbf32afda7716c8c065990f3422fc2b5f10cb396a68ea6f711a0184989b83f474e660bc12fb47db60966011b1a18f84755571e9b9e

    Download Submit
  • \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
    Filesize

    23.0MB

    MD5

    29fd729d6b6dc9cdb504417482e31b94

    SHA1

    d1839722d33296228d91297a9d70ebcd2ea42344

    SHA256

    993bb7b78a6b157471f1e1a51a87bb455c3245538851f13df4a27f312f94a437

    SHA512

    6157e2364f04213a99384aef81e8af77b591df2a5dae82d42ae910149b8b7166c73a42d1763eeff27388707cda76b9c133bc9cb4eb0d570cd1d934a900767052

    Download Submit
  • \??\Volume{2fb4ccdc-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{6bddaa16-b84d-4c47-ada4-4524fa4f4427}_OnDiskSnapshotProp
    Filesize

    5KB

    MD5

    f9e47970f8a93f1915081d8fdab29c63

    SHA1

    ef0db285b077d90a5994a08477783242f73400a0

    SHA256

    afd2d15c495ba1e8d968d99164cdb30ec38c942f77bd31d752f7aa518ab31281

    SHA512

    fa9aee14534d3b78180442e6863e76606931691b099c19fad9a2177524112c86b3ff148960f47899c9ace88b296a12167334f0ae370022fd7d530c6c9df87fe9

    Download Submit
  • memory/700-132-0x0000000000000000-mapping.dmp
    Download
  • memory/4568-135-0x0000000000000000-mapping.dmp
    Download
  • memory/4568-138-0x0000000000D90000-0x0000000000DB8000-memory.dmp
    Filesize

    160KB

    Download
  • memory/4568-143-0x0000000000D90000-0x0000000000DB8000-memory.dmp
    Filesize

    160KB

    Download