Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

10

2023-05-13...il.exe

windows7-x64

1

2023-05-13...il.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    152s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230220-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
  • submitted
    14/05/2023, 07:36

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    2023-05-13_38bb6d3370e91deee960c8aeb6b0a50e_revil.exe

  • Size

    122KB

  • MD5

    38bb6d3370e91deee960c8aeb6b0a50e

  • SHA1

    ba9e23c4f6e7435e90e92ffef836386053c04ca3

  • SHA256

    8ece3ce00a84b7365b96487f215cbbea379a8df57ed7c23a2add8758858fba6e

  • SHA512

    532b5f6d68b2526250d1c307cf265b84985ce4c4bc4b00a3c6c05edb051bcc6fa06b64c987de1279746a2c5d91c951aa6c4820546cf2985a1e6d608c0a011b22

  • SSDEEP

    1536:hxOUyl20w8bVZQ40iMSO1fY+iUyQs2r8t5p1ySotICS4A6UdSJOfTo4QVvA3T2+g:hMhQNDEtb3AirfTz0vAVR/6

Score
10/10
evasionpersistenceransomware

Malware Config

Extracted

Path

C:\Recovery\yq7er5k-readme.txt

Ransom Note
---=== Welcome. Again. ===--- We strongly encourage You to pay your attention to this message and read it to the end. All Your files are encrypted, and currently unavailable, now all files on your system has extension yq7er5k Before that, all of your most important personal and business files were backed up to our secure offline storage. We took them for temporary storage - but we don't need your files and we are not personally interested in your business. Our encryption algorithm is the most technically difficult and max resistant to burglary. Only OUR specialists can decrypted your files without loss(!) Any attempts to decrypt files on your own lead to damage them beyond repair(!) Best way to you will be consent to negotiations and mutual agreement between us. To connect us you need to download TOR browser and follow the link to begin negotiations.(You can find full instructions below.) We are waiting You and ready to listen all your offers and discuss them. If You will ignore this letter - we will have to sell closed auction all yours private files, photoes, business correspondence, documents and business files + with our analysis of your work activity (weakness of your business, financial violations and the opportunity to profit from this information). It will offset our financial losses. Or we'll just put all your files in the public domain, where everyone can download and use them as they wish. * For TOR Browser http://dnpscnbaix6nkwvystl3yxglz7nteicqrou3t75tpcc5532cztc46qyd.onion/ We are known as "Sodinokibi (REvil) Ransomware". For example, this article: https://www.coveware.com/blog/2019/7/15/ransomware-amounts-rise-3x-in-q2-as-ryuk-amp-sodinokibi-spread You have a guarantee that your files will be returned 100 %. And remember, this is only business, nothing personal.. We have a concept of business honor, and we can promise something if we come to a mutual agreement: 1. We guarantee to decrypt all your files in the shortest possible time 2. We will delete all your files and forget about your company. 3. We will show your weaknesses in your networks. .-= INSTRUCTIONS TO CONNECT =-. How to get access on website? You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/A5EB7190918517BE 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decoder.re/A5EB7190918517BE Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: 9sqwWaEap2al6ssIQub1ljawVJ2uYc727ThI7Dx3/dQviqG8xu3bYwL1EsxwFB+5 Qe7prFnq9m4ZznuzrZ2u56zDMGo8GYvr6l9Kt/scCzah/zeaRwGwF2cJhnkwTiSW hoJe8uA8qikGCYfBQHXC5nLAjo5AZ7kJSX9mC6e5NLXiUn99GgSQFzOo5lB4O4Iz Q/lV2oMl/1zKNRfCTe4UCasKJ8u05VcIoFwqX0j0jm3ogSiZFkyLbwSAcfuNZmMy ugTUGnJMWErjHaqG40vGkdjp28EFg1apT17T/QLbJL7zW7qHeMnWWXbzdPRJqUvy ya802VkjK+bdPPD5nYvGDAzveaP73G5yvC2qtRw5dpI6czeTTOMx9j/FlyhanyrC go6vTW9SNtParZPsCgo6cF82MEqTndD8OpxnZtG511q73P7hwG+FOh8w0U1RR2a9 kiUJnKeJOdvLtR2VNgX7DqXf3AFc3wzt1V2zXdrR5RxkMJJy6wXLsSXgqN0rREEm f0/AYEA6opKR0BGmo0uBVOdjLjs20VGcmCZFIMUI1UcTuf74lDhlEmYXdGisjJvc jthKrDLHP+WEs3SpQnMIaB/ZzampVI1GIogXbdi0XFtyOw1D2crR+s020O71WwnI bM/4xsRxfOXx5JeLwaFdcsGiATQAwvs4cCmcFxbqlbHnkr/jGsgmx0kOEQmqBAVm ztybn7lvaffV2EIssQITIVF1n32lpgNmLkGY3XBF4oxuQL4ni6VUyj2GIRsCwnlW 8wrbzckEM4BvAPIgvzh7qrYhgotGy5mxgSK4qesaC99an9In/3hrfUvw2iXGNjTN o61bekOivMnup/+livhfxPYs1GCl4ogJqgJCjHFzr8jX3SrhbqOFoG2jtetHZdKP nSJlWUCfhVctp58Malr7AHwXCBjTcMr10x5NACRqXzlF2NH6AIx7qAcy6+S8RHhk lOb5khB96G9bSxF9h540l2thYXBHdyG/XVem61Q4YNeGJQ2iNNoUMP7orSrqS0Xg hvJsX3dprL3DDVdF14ZEHY4kSY9bYnpq5wS5N7z/DvxBUS780l1guPveg8nIw/UI KyAvm5MX9DL7bBd494lUf7liFedRuj9Of7bP1RCkmPKrL2lcRsx9MNJl/ASmTDs3 LBviYDm8WIcE7+RCEms54smvQXOx0Ag+aTP4yxBkhmN7DnzI3K1Z7vQzj4LpcyCH VBrfcL519cIsaZVEnHLuZ1mRU+r0/70MLmIEyk4iHVu/R/aFFG7U68XVvCTeEQ9z /yLuzYW8IRA5ifzaBaJb+57KMcywGw== ---------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all your data!
URLs

http://dnpscnbaix6nkwvystl3yxglz7nteicqrou3t75tpcc5532cztc46qyd.onion/

https://www.coveware.com/blog/2019/7/15/ransomware-amounts-rise-3x-in-q2-as-ryuk-amp-sodinokibi-spread

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/A5EB7190918517BE

http://decoder.re/A5EB7190918517BE

Signatures

  • Modifies Windows Firewall 1 TTPs 1 IoCs
    evasion
  • Modifies extensions of user files 2 IoCs

    Ransomware generally changes the extension on encrypted files.

    ransomware
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 25 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Sets desktop wallpaper using registry 2 TTPs 1 IoCs
    ransomware
  • Drops file in Program Files directory 36 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 10 IoCs
  • Suspicious use of AdjustPrivilegeToken 5 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\2023-05-13_38bb6d3370e91deee960c8aeb6b0a50e_revil.exe
    "C:\Users\Admin\AppData\Local\Temp\2023-05-13_38bb6d3370e91deee960c8aeb6b0a50e_revil.exe"
    1⤵
    • Modifies extensions of user files
    • Adds Run key to start application
    • Enumerates connected drives
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1796
    • C:\Windows\SysWOW64\netsh.exe
      netsh advfirewall firewall set rule group="Network Discovery" new enable=Yes
      2⤵
      • Modifies Windows Firewall
      PID:1748
  • C:\Windows\system32\wbem\unsecapp.exe
    C:\Windows\system32\wbem\unsecapp.exe -Embedding
    1⤵
      PID:1436
    • C:\Windows\system32\vssvc.exe
      C:\Windows\system32\vssvc.exe
      1⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:1568

    Network

    MITRE ATT&CK Enterprise v6

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Recovery\yq7er5k-readme.txt
      Filesize

      8KB

      MD5

      77bd641d5387d1314588c0d6baaeb97c

      SHA1

      b15f7cb2bbb932aa012a567a567759828fa7f29d

      SHA256

      6cf68f8b51f872d45cfc24923bab9b18e4e25975c4500706244aacaf06cc93be

      SHA512

      a15b3a850ce199b24225025f362be4ca5e92f74de03684a279751bc47df75e129a06937fb4cb83c4d6b42f36be17b1f2165ade4f399d7ecd74d304e8eea0b038

      Download Submit