Analysis
- max time kernel
150s - max time network
152s - platform
windows10-2004_x64 - resource
win10v2004-20230220-en - resource tags
- submitted
14/05/2023, 07:36
General
- Target 2023-05-13_38bb6d3370e91deee960c8aeb6b0a50e_revil.exe
- Size 122KB
- Sample230514-jfhchsbb42
- SHA256 8ece3ce00a84b7365b96487f215cbbea379a8df57ed7c23a2add8758858fba6e
Score
10/10
Malware Config
Extracted
Path
-
C:\Recovery\yq7er5k-readme.txt
Ransom Note
- ---=== Welcome. Again. ===--- We strongly encourage You to pay your attention to this message and read it to the end. All Your files are encrypted, and currently unavailable, now all files on your system has extension yq7er5k Before that, all of your most important personal and business files were backed up to our secure offline storage. We took them for temporary storage - but we don't need your files and we are not personally interested in your business. Our encryption algorithm is the most technically difficult and max resistant to burglary. Only OUR specialists can decrypted your files without loss(!) Any attempts to decrypt files on your own lead to damage them beyond repair(!) Best way to you will be consent to negotiations and mutual agreement between us. To connect us you need to download TOR browser and follow the link to begin negotiations.(You can find full instructions below.) We are waiting You and ready to listen all your offers and discuss them. If You will ignore this letter - we will have to sell closed auction all yours private files, photoes, business correspondence, documents and business files + with our analysis of your work activity (weakness of your business, financial violations and the opportunity to profit from this information). It will offset our financial losses. Or we'll just put all your files in the public domain, where everyone can download and use them as they wish. * For TOR Browser http://dnpscnbaix6nkwvystl3yxglz7nteicqrou3t75tpcc5532cztc46qyd.onion/ We are known as "Sodinokibi (REvil) Ransomware". For example, this article: https://www.coveware.com/blog/2019/7/15/ransomware-amounts-rise-3x-in-q2-as-ryuk-amp-sodinokibi-spread You have a guarantee that your files will be returned 100 %. And remember, this is only business, nothing personal.. We have a concept of business honor, and we can promise something if we come to a mutual agreement: 1. We guarantee to decrypt all your files in the shortest possible time 2. We will delete all your files and forget about your company. 3. We will show your weaknesses in your networks. .-= INSTRUCTIONS TO CONNECT =-. How to get access on website? You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/A5EB7190918517BE 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decoder.re/A5EB7190918517BE Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: 9sqwWaEap2al6ssIQub1ljawVJ2uYc727ThI7Dx3/dQviqG8xu3bYwL1EsxwFB+5 Qe7prFnq9m4ZznuzrZ2u56zDMGo8GYvr6l9Kt/scCzah/zeaRwGwF2cJhnkwTiSW hoJe8uA8qikGCYfBQHXC5nLAjo5AZ7kJSX9mC6e5NLXiUn99GgSQFzOo5lB4O4Iz Q/lV2oMl/1zKNRfCTe4UCasKJ8u05VcIoFwqX0j0jm3ogSiZFkyLbwSAcfuNZmMy ugTUGnJMWErjHaqG40vGkdjp28EFg1apT17T/QLbJL7zW7qHeMnWWXbzdPRJqUvy ya802VkjK+bdPPD5nYvGDAzveaP73G5yvC2qtRw5dpI6czeTTOMx9j/FlyhanyrC go6vTW9SNtParZPsCgo6cF82MEqTndD8OpxnZtG511q73P7hwG+FOh8w0U1RR2a9 kiUJnKeJOdvLtR2VNgX7DqXf3AFc3wzt1V2zXdrR5RxkMJJy6wXLsSXgqN0rREEm f0/AYEA6opKR0BGmo0uBVOdjLjs20VGcmCZFIMUI1UcTuf74lDhlEmYXdGisjJvc jthKrDLHP+WEs3SpQnMIaB/ZzampVI1GIogXbdi0XFtyOw1D2crR+s020O71WwnI bM/4xsRxfOXx5JeLwaFdcsGiATQAwvs4cCmcFxbqlbHnkr/jGsgmx0kOEQmqBAVm ztybn7lvaffV2EIssQITIVF1n32lpgNmLkGY3XBF4oxuQL4ni6VUyj2GIRsCwnlW 8wrbzckEM4BvAPIgvzh7qrYhgotGy5mxgSK4qesaC99an9In/3hrfUvw2iXGNjTN o61bekOivMnup/+livhfxPYs1GCl4ogJqgJCjHFzr8jX3SrhbqOFoG2jtetHZdKP nSJlWUCfhVctp58Malr7AHwXCBjTcMr10x5NACRqXzlF2NH6AIx7qAcy6+S8RHhk lOb5khB96G9bSxF9h540l2thYXBHdyG/XVem61Q4YNeGJQ2iNNoUMP7orSrqS0Xg hvJsX3dprL3DDVdF14ZEHY4kSY9bYnpq5wS5N7z/DvxBUS780l1guPveg8nIw/UI KyAvm5MX9DL7bBd494lUf7liFedRuj9Of7bP1RCkmPKrL2lcRsx9MNJl/ASmTDs3 LBviYDm8WIcE7+RCEms54smvQXOx0Ag+aTP4yxBkhmN7DnzI3K1Z7vQzj4LpcyCH VBrfcL519cIsaZVEnHLuZ1mRU+r0/70MLmIEyk4iHVu/R/aFFG7U68XVvCTeEQ9z /yLuzYW8IRA5ifzaBaJb+57KMcywGw== ---------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all your data!
URLs
-
http://dnpscnbaix6nkwvystl3yxglz7nteicqrou3t75tpcc5532cztc46qyd.onion/
-
https://www.coveware.com/blog/2019/7/15/ransomware-amounts-rise-3x-in-q2-as-ryuk-amp-sodinokibi-spread
-
http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/A5EB7190918517BE
-
http://decoder.re/A5EB7190918517BE
Signatures
- Modifies Windows Firewall 1 TTPs 1 IoCs
- Modifies extensions of user files 2 IoCs
Ransomware generally changes the extension on encrypted files.
- Adds Run key to start application 2 TTPs 2 IoCs
- Enumerates connected drives 3 TTPs 25 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
- Sets desktop wallpaper using registry 2 TTPs 1 IoCs
- Drops file in Program Files directory 36 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Suspicious behavior: EnumeratesProcesses 10 IoCs
- Suspicious use of AdjustPrivilegeToken 5 IoCs
- Suspicious use of WriteProcessMemory 3 IoCs
- Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\2023-05-13_38bb6d3370e91deee960c8aeb6b0a50e_revil.exe"C:\Users\Admin\AppData\Local\Temp\2023-05-13_38bb6d3370e91deee960c8aeb6b0a50e_revil.exe"1⤵
- Modifies extensions of user files
- Adds Run key to start application
- Enumerates connected drives
- Sets desktop wallpaper using registry
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\netsh.exenetsh advfirewall firewall set rule group="Network Discovery" new enable=Yes2⤵
- Modifies Windows Firewall
-
-
C:\Windows\system32\wbem\unsecapp.exeC:\Windows\system32\wbem\unsecapp.exe -Embedding1⤵
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
yq7er5k-readme.txt