Overview

overview

10

Static

static

10

2023-08-06...bi.exe

windows7-x64

10

2023-08-06...bi.exe

windows10-2004-x64

10

Resubmissions

07-08-2023 08:22

230807-j9kdzaed44 10

Analysis

  • max time kernel
    121s
  • max time network
    143s
  • platform
    windows7_x64
  • resource
    win7-20230712-en
  • resource tags

    arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
  • submitted
    07-08-2023 08:22

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    2023-08-06_b572a0486274ee9c0ba816c1b91b87c7_revil_sodinokibi.exe

  • Size

    160KB

  • MD5

    b572a0486274ee9c0ba816c1b91b87c7

  • SHA1

    43a904323a8583203b307c622c71c8ca706c2462

  • SHA256

    15ef2d6ef402a46165be39d9dbc0081cf28ebca0f407306dd80ac3a73a32c07b

  • SHA512

    77d4ee400ded4b4be92da0170e7d2c197c312089429a1650e2843d0ceb15402d14f7e4fc3c2e84f20eeaa24995f0814c2106a37fc4cc32de7dbb4c15b6c5a171

  • SSDEEP

    3072:tp5SexkWi1Lbi4eTMlwDCnu/qjUt7ptQJS+s:HvGWwbnWJ/3tTQg

Score
10/10
sodinokibiransomware

Malware Config

Extracted

Path

C:\ProgramData\33ygh39u3-readme.txt

Family

sodinokibi

Ransom Note
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on you computer has expansion 33ygh39u3. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/569FAA6380C8B137 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.top/569FAA6380C8B137 Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: Je7FwhnlGiv1YA2B9uMefo7BIA6mok43wBWbALtzobJ/x8B9LKDi8pqzGU0d0L6V s0y9I8v1IZuTf0rAfP6HGezcbpbAqLsFa4t47/DyFJrURX0E36JHDccD+HwWYNNb nRLTjviiqOvuvO/RDwYF6d7QS/FYtLRWjMd4o2XxXtD4shWV8LnHEmuy5h2fmQtP 2z/J0JFS25a6hEo4yQzUfHZE7SumjCfk/ntsmHJDalAdqBQ4A/AVWU+DEMvW53gi iJRNtOJpdFnelfzQfY6OAYfYKugDRC8vkHIKMraWFV10XF1bN/fGtqEwr0ahZ7P3 G72eQDHZDxoLZ0RcQNRnsqKtqc1l6TWezxAob+UNrIfO6aBVwSQSwIJSmP7ATrhX xXYcMykazMtzLTyTn2XVQhX7zvvD2/FdIXZc3tA3fLYF4XY6GVdPGKdMro5YdF0J tGDQiorU4t6ezV6cB4PB/nJc8my/LboK59H7ZPJxjs66FUIXA6i2zm1t0fDb1Slq ku6N3pYbmSW+BvSl6FQ5aranj4hfIzPB+zjPJ+eAmdC2FEpDE9d2Xfwgbgfb4+An 087WS48nW0jD6rvBGoJ5JVkjcN7JFPBduoBxnwAFBhA/XAkvt876CCaij415+6DJ RNS2n+2KJzWqqd+4FfFjkKt6D/uTZBaRNvcxWnlTKwX8ceDnv0Zb8BZCchlwyxx/ bQ3Dk3YDQwI30ntOr7R8ApwM/bkvGYbe6dB9Yx9L6tlHXlRqWMkKLVuQ5Z3gtGiX 7yRw5k7djw6xwro+Suv76zYUj693GQa8zCyMrGNvrwnGadqlOR7BaoLV36R0GWbp pSj6AVlm5EvCV8mmAECmQ4V+d6r0NnEFePsjiE/ykvklSAaHbMdEqvn0UakFwN0P cVK8lXf+2JMHtpXRljFjmIN1NvcBozNfIH8dXjSu2P9ZXjE8dpTnfMSZb/lZQehe uASvPXzLSBz4L4nNbMd2jgoeP6DDKCOwMOmgKllMybRZR1j3USgLujRc3T0qKVcR JbRvzVZTaJci1zjfJKSBNDu5OV/0MrH1WbzZpGhJSu74WWEarrATkxdK8JmDMHK0 hBIuXFDxo/S0IK/oxolho/QyqL2gU3JcXMCAFQ10YzYnZc2wmqnSqq4VxJQ3gF4W 07wWjXsLz8KpSh2O29HSAwW3GWrCu5rhEEcIok00exo38anj/zXWnp0Cu6w5Hp2J kufa9xrZCLakeM5GfCg= Extension name: 33ygh39u3 ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/569FAA6380C8B137

http://decryptor.top/569FAA6380C8B137

Signatures

  • Sodin,Sodinokibi,REvil

    Ransomware with advanced anti-analysis and privilege escalation functionality.

    ransomwaresodinokibi
  • Deletes shadow copies 2 TTPs

    Ransomware often targets backup files to inhibit system recovery.

    ransomware
  • Enumerates connected drives 3 TTPs 25 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Sets desktop wallpaper using registry 2 TTPs 1 IoCs
    ransomware
  • Drops file in Program Files directory 23 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Interacts with shadow copies 2 TTPs 1 IoCs

    Shadow copies are often targeted by ransomware to inhibit system recovery.

    ransomware
  • Modifies system certificate store 2 TTPs 8 IoCs
    evasionspywaretrojan
  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2023-08-06_b572a0486274ee9c0ba816c1b91b87c7_revil_sodinokibi.exe
    "C:\Users\Admin\AppData\Local\Temp\2023-08-06_b572a0486274ee9c0ba816c1b91b87c7_revil_sodinokibi.exe"
    1⤵
    • Enumerates connected drives
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • Modifies system certificate store
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:2400
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c vssadmin.exe Delete Shadows /All /Quiet & bcdedit /set {default} recoveryenabled No & bcdedit /set {default} bootstatuspolicy ignoreallfailures
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:2568
      • C:\Windows\SysWOW64\vssadmin.exe
        vssadmin.exe Delete Shadows /All /Quiet
        3⤵
        • Interacts with shadow copies
        PID:2696
  • C:\Windows\system32\vssvc.exe
    C:\Windows\system32\vssvc.exe
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:1696

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\ProgramData\33ygh39u3-readme.txt
    Filesize

    6KB

    MD5

    9fea8d2b3136fe77deb606420cc4852e

    SHA1

    775a607f07c42ae12cbe8a2c5e96c03a0f6cda23

    SHA256

    98c81d4e8474d37dde92eb6d004d0a2fa012c2dccdbd510b5dffbd29c77198f1

    SHA512

    11b5d058e54ffae53e1181c7e2536884f8e13a3346f9cb63bd024633554a2eb304e6c5bcb9d9564741fa456490f1ba001a8783993f19ff9d68a47d8b634ff0bf

    Download Submit
  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015
    Filesize

    62KB

    MD5

    3ac860860707baaf32469fa7cc7c0192

    SHA1

    c33c2acdaba0e6fa41fd2f00f186804722477639

    SHA256

    d015145d551ecd14916270efad773bbc9fd57fad2228d2c24559f696c961d904

    SHA512

    d62ad2408c969a95550fb87efda50f988770ba5e39972041bf85924275baf156b8bec309ecc6409e5acdd37ec175dea40eff921ab58933b5b5b5d35a6147567c

    Download Submit
  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357
    Filesize

    1KB

    MD5

    a266bb7dcc38a562631361bbf61dd11b

    SHA1

    3b1efd3a66ea28b16697394703a72ca340a05bd5

    SHA256

    df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

    SHA512

    0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

    Download Submit
  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
    Filesize

    344B

    MD5

    11a996b0d75d2dca42e71e3684eea09a

    SHA1

    4f50b29cded76c99b8a2362e16792a2ad3b07fc8

    SHA256

    471febb21871a975baa2976054eb0705c38858252c3eeb59e2f33d44a57f8c6b

    SHA512

    07d8645d0f8128aa6896f256cd3d57f40b4f3405641f1613e72113cc38a165e4c195cfb91de583a257de96080cb69e7b50248014091912ea8c8e10a0c9f11816

    Download Submit
  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357
    Filesize

    242B

    MD5

    51bf65153ff83812e41935aa99698377

    SHA1

    8586ff448c64ce49ce7695b0cf1d2b2d5ad04fc1

    SHA256

    c74f6a32060a08c5a948ef6f613aa5806050299b1c126d65b9bf586006fb705f

    SHA512

    01755370d3c829ff5705ced50072e72620bb3e410e6fa58822ca25e85e1c73c6fcf9125e4929c6115d727683ef9535d54dbacc541c625d33ef939c2699eb0c4e

    Download Submit
  • C:\Users\Admin\AppData\Local\Temp\TarC2F6.tmp
    Filesize

    164KB

    MD5

    4ff65ad929cd9a367680e0e5b1c08166

    SHA1

    c0af0d4396bd1f15c45f39d3b849ba444233b3a2

    SHA256

    c8733c93cc5aaf5ca206d06af22ee8dbdec764fb5085019a6a9181feb9dfdee6

    SHA512

    f530dc0d024a5a3b8903ffaaa41b608a5ccdd6da4ba1949f2c2e55a9fca475fec5c8d2119b5763cabe7ef1c3788fb9dcac621869db51d65b1d83cfe404fb4c27

    Download Submit