Overview

overview

10

Static

static

10

NA_NA_38bb...JC.exe

windows7-x64

10

NA_NA_38bb...JC.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    144s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230703-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
  • submitted
    23-07-2023 20:45

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    NA_NA_38bb6d3370e91dexeexe_JC.exe

  • Size

    122KB

  • MD5

    38bb6d3370e91deee960c8aeb6b0a50e

  • SHA1

    ba9e23c4f6e7435e90e92ffef836386053c04ca3

  • SHA256

    8ece3ce00a84b7365b96487f215cbbea379a8df57ed7c23a2add8758858fba6e

  • SHA512

    532b5f6d68b2526250d1c307cf265b84985ce4c4bc4b00a3c6c05edb051bcc6fa06b64c987de1279746a2c5d91c951aa6c4820546cf2985a1e6d608c0a011b22

  • SSDEEP

    1536:hxOUyl20w8bVZQ40iMSO1fY+iUyQs2r8t5p1ySotICS4A6UdSJOfTo4QVvA3T2+g:hMhQNDEtb3AirfTz0vAVR/6

Score
10/10
evasionpersistenceransomware

Malware Config

Extracted

Path

C:\Recovery\qbmos-readme.txt

Ransom Note
---=== Welcome. Again. ===--- We strongly encourage You to pay your attention to this message and read it to the end. All Your files are encrypted, and currently unavailable, now all files on your system has extension qbmos Before that, all of your most important personal and business files were backed up to our secure offline storage. We took them for temporary storage - but we don't need your files and we are not personally interested in your business. Our encryption algorithm is the most technically difficult and max resistant to burglary. Only OUR specialists can decrypted your files without loss(!) Any attempts to decrypt files on your own lead to damage them beyond repair(!) Best way to you will be consent to negotiations and mutual agreement between us. To connect us you need to download TOR browser and follow the link to begin negotiations.(You can find full instructions below.) We are waiting You and ready to listen all your offers and discuss them. If You will ignore this letter - we will have to sell closed auction all yours private files, photoes, business correspondence, documents and business files + with our analysis of your work activity (weakness of your business, financial violations and the opportunity to profit from this information). It will offset our financial losses. Or we'll just put all your files in the public domain, where everyone can download and use them as they wish. * For TOR Browser http://dnpscnbaix6nkwvystl3yxglz7nteicqrou3t75tpcc5532cztc46qyd.onion/ We are known as "Sodinokibi (REvil) Ransomware". For example, this article: https://www.coveware.com/blog/2019/7/15/ransomware-amounts-rise-3x-in-q2-as-ryuk-amp-sodinokibi-spread You have a guarantee that your files will be returned 100 %. And remember, this is only business, nothing personal.. We have a concept of business honor, and we can promise something if we come to a mutual agreement: 1. We guarantee to decrypt all your files in the shortest possible time 2. We will delete all your files and forget about your company. 3. We will show your weaknesses in your networks. .-= INSTRUCTIONS TO CONNECT =-. How to get access on website? You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/3DEA987E905BF3C7 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decoder.re/3DEA987E905BF3C7 Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: yt/VBIYZaTzo5x/GLAAQdExMYh3JIAisjMTdI0PnxToV0DCZ+TGvujoSC0OFbrHR 88rEzUEPy1yuoPBrRx+UeK3T+XgRR7SVfWm0fnzdCEd0z2ZRvhH2lgIOE+H8e/ND J355poKTHTpTmFaQcb1V4Y9zk/OnormZ7Wc1zzarI5aiaUoqRF4mMOqdcYAfO23D J+8ABCWLUgamXja7Q/QNvs+oZPu5YPfAeONbH1t46h+INu/nvZII9Ez24NZ0kL7h KtfkYlEhdkUJ9ZD+F32wzsSjOsRt5m2ErWmH9MncgEeWiDOtFP9GcRQqpADT5byw wi9lRBKV2TxPRQiINcLpggBq05Tdx4+rWiwWYlT9SaboczWsTnjPVlDfhHzR9NuJ 8skbMoMLgmMTEZ2Mx8S5jcnxwGoSWX+C95QZhFqoJL44IZA64LM8nwHwh07QKirX 07mVS6wYcW+pWciuVYSQunXS66RnItZBkaFq/5nHM41wU87FJ+rTNCNA8DZyIkLs tlu9a9sbGfse1/nlNUrJmoj5qmvFXd4kVrxKkwszGIuzKIXjZuAL6FVDM6r3nE7H 0N6hPIhUWoJ2uJjI9Zue0OH2WJ2RQC0QQeXYke1atm4dDZorJFQZ9plcEmHZQMAN V+skQTBKAOhJ6/56FJzew3xEGohjG4L/yqP7+AUteDHJPOrrd/gWjDLmxJ4/XW+y ZtOcHIvPGtPyskaMDrXuafRVbw3QAYjWOMIigzk4HDOUUJxjthBL8xdsoyMrfH1+ MSTtdA/mgu9qy0V2r7U7blFv7yxE+Qg80o6oGwjjydPcNWqV1Ar6GEgFyC3Y/Q43 6yrW1/ShgbhA7MfJAIv/Tdkf8tZhN/hvtptYbtTeNckLJ1QfuOI7ARZGYZ+bbuZO GOorJNsSl0Whpr8UzOAaqNTG0sRiRSH5yHqitWQtu9gpUksfTZ4D3MAME6Uf/8IZ z5qtTHtSkNz2fneW7+Ku6KaUiP2D7LcPGm7DIHJXaqMz4n8AfucqpyQnf3PQIVKI AdzWNoxSylYM0fUIyOHPWXxLBbwa2QwUvxtQFdK/+C7S/2MH6TcE95tSdwf9m/7I 6eMzYgIGGJLfnzyoNNUhMAY4YHE1kEdq5aHMQTYxGVH7f0tFwpMHNihffs+Kcdnc e746UoD9OIo1ecyblVwTZTJPs8vSXmKdNVQNvWLAUjrVN4jRpU1COIPi3G+rGT8a 1wiePIpzMY5R0V0To+F4Htk5sz2K3hEnp64qsUyNNUK88r2a0epK7u9WSEHdgEZG 2U5iBseygRSWqmwTPwFhDliiAY4gN8PX2GK9VqXhaGDLyK9uWXbhcHju9SsBn0bx MJB2wbJu38Qmn+unxS9HN5ehExLzq+RrgDs= ---------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all your data!
URLs

http://dnpscnbaix6nkwvystl3yxglz7nteicqrou3t75tpcc5532cztc46qyd.onion/

https://www.coveware.com/blog/2019/7/15/ransomware-amounts-rise-3x-in-q2-as-ryuk-amp-sodinokibi-spread

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/3DEA987E905BF3C7

http://decoder.re/3DEA987E905BF3C7

Signatures

  • Modifies Windows Firewall 1 TTPs 1 IoCs
    evasion
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 25 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Sets desktop wallpaper using registry 2 TTPs 1 IoCs
    ransomware
  • Drops file in Program Files directory 28 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies system certificate store 2 TTPs 5 IoCs
    evasionspywaretrojan
  • Suspicious behavior: EnumeratesProcesses 10 IoCs
  • Suspicious use of AdjustPrivilegeToken 5 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\NA_NA_38bb6d3370e91dexeexe_JC.exe
    "C:\Users\Admin\AppData\Local\Temp\NA_NA_38bb6d3370e91dexeexe_JC.exe"
    1⤵
    • Adds Run key to start application
    • Enumerates connected drives
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • Modifies system certificate store
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:756
    • C:\Windows\SysWOW64\netsh.exe
      netsh advfirewall firewall set rule group="Network Discovery" new enable=Yes
      2⤵
      • Modifies Windows Firewall
      PID:2924
  • C:\Windows\system32\wbem\unsecapp.exe
    C:\Windows\system32\wbem\unsecapp.exe -Embedding
    1⤵
      PID:4732
    • C:\Windows\system32\vssvc.exe
      C:\Windows\system32\vssvc.exe
      1⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:4760

    Network

    MITRE ATT&CK Matrix ATT&CK v13

    Initial Access

    Execution

    Persistence

    Create or Modify System Process

    1
    T1543

    Windows Service

    1
    T1543.003

    Boot or Logon Autostart Execution

    1
    T1547

    Registry Run Keys / Startup Folder

    1
    T1547.001

    Privilege Escalation

    Create or Modify System Process

    1
    T1543

    Windows Service

    1
    T1543.003

    Boot or Logon Autostart Execution

    1
    T1547

    Registry Run Keys / Startup Folder

    1
    T1547.001

    Defense Evasion

    Modify Registry

    3
    T1112

    Subvert Trust Controls

    1
    T1553

    Install Root Certificate

    1
    T1553.004

    Credential Access

    Discovery

    Query Registry

    1
    T1012

    Peripheral Device Discovery

    1
    T1120

    System Information Discovery

    2
    T1082

    Lateral Movement

    Collection

    Exfiltration

    Command and Control

    Impact

    Defacement

    1
    T1491

    Resource Development

    Reconnaissance

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Recovery\qbmos-readme.txt
      Filesize

      9KB

      MD5

      917227a4a28cc03b7bc874ed4dbcf03e

      SHA1

      53d1abe109a4b50888401a05084f5fd81c3d68fc

      SHA256

      531aa81c80656d74912cd9c535e2e84766bc2639630a3e59bac894167fc6c7a3

      SHA512

      9b163a40e8f57f7712e5babedecced33dd6b6a44ff31393c223364e12f928c471bde3c5d4a56e2f7e1e96c287ad2c4e6bdd4c265ebb1b6e9fd4891bd51e8233d

      Download Submit