Overview

overview

10

Static

static

10

2023-08-22...JC.exe

windows7-x64

10

2023-08-22...JC.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    122s
  • max time network
    126s
  • platform
    windows7_x64
  • resource
    win7-20230831-en
  • resource tags

    arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
  • submitted
    03-09-2023 14:54

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    2023-08-22_ff1f6956f07e700a86b5986b63ea12db_revil_JC.exe

  • Size

    126KB

  • MD5

    ff1f6956f07e700a86b5986b63ea12db

  • SHA1

    a8d88813f2691cf71e8d6790e473593644c913ed

  • SHA256

    3e6fbc358e0204cb67a41b05771fac74f1b49737c7ab7138e415c7e9628ef545

  • SHA512

    04f4d29f37079ef04e2b1be812d20d89dca82e4fffff28047de435425a18573cc3edfd5b148e0aded71d652583785e82585c708e0fc38b5dbda61962cbb1f927

  • SSDEEP

    1536:YxOUyl20w8bVZQ40iMSO1fY+iUyQs2r8t5p1ySotICS4A6QdZls8XzUXiWr4X5Fg:YMhQNDEtb3A2ZHjUyWr4X5FTDUA

Score
10/10
evasionransomware

Malware Config

Extracted

Path

C:\Users\n430ar4kv-readme.txt

Ransom Note
---=== Welcome. Again. ===--- [-] Whats HapPen? [-] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension n430ar4kv. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practice - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/B1D679FE97CFEA5D 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decoder.re/B1D679FE97CFEA5D Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: f3bjknY7/+4Nq0P/w53HCp5wmfJXrvC4VVzP3BuN/kZfVjlo2PUhPovbagi9YQIy F2SPf52tSAXQIEzHyV3S4/mLuYvlMLDf15WF8WcRotQpGEh6VzYevFwrxxQjvKgm QPtS39qpWHBa/+JaT4+dasXhdscHCFmg+bw5JQpr3IuOtblLuSva/qLjesXvWYu0 803I4QpP2tgpXRSxSANu9hbzOzHPpEvePlFtbshynrwJ7UvG5KNwgephLnLRVr2S 41HoT1cnDdAT0LlfFWBGmUY3GfbX1n+cY8ViVvzYhN35i0ds4Xidl6hayHHry3ke F0lcf8AdGbo+1jBJQhNteq0UlRaZsf4srffNg8khaZLtRID+Z9gShwSCxFTqw2EV 8AXQieyRzTXK++MezKLUhT/D6M5qrDUNnnkzjWQBeUfflohTtKh+jw22RDZ/09sN sdVQjTBdP5tyC9oNoTo3wsg2Q/xwQY4gf+oS4yyD7dTLf4ALkIC0/j0qPiAiM2XB kw5qotgxiXGKNltYeYLpcR+qfCkM3/9LHaYYeUBXbwl4PtpD0OOiueCNoqxl7oH7 CSmx6eRm1nI3modkvawKPJbIQ0Qb5uz9o764U1GnYbqjutfiBwLz4WjFrwqSPePy T4+JLkAZWQ6NfHsdb5MtrGd8VgCxwJBnnlswNgsNPlOHjvynTnPurnkG6InplN0F AzuAh9pGt8tWGj5kv34NE06h7gXSWAlxsSE+H3da9fe6u4IMJwa6GIKnruFNZuYd 3TC158Tv4iwiBWwpFSR61GEGEi46pT4PlvMj8Gam/drYOoD4dRRCbnH6TCnKKeGx diMeelA4pb4VpcMr+iPwB1fS04YtMe+AirA68usg7IBGb8bzUZgkrXDyktHAY6yH AEzM+UvMTkR5qsVugqGMVRCbQzJStXibUVxZv8h72SxnDsevMwihFDZaENBFhI2l oVWmc/oeYCaSVnXnGqeVDp/e8aCUIYbtWa3fWj4h0NNU0MyBf/c/hJn6cqCRthLf PueTdd5mM6otsUB8qZ2L5IqfttuEhReYYjHP4e1knzn/uoNilKWZEN78Lhn58jMk ADyqTMhl5uEMLCor+Xh1oGQDniw7G+plNNhljbF5GOR3kielAH0mPciMdsy3Uhv/ YlS5Jobbfg6mv7rxG9u4DE/WEkGI++E/Sl0alynmc7sSFgGTpB4IW/j2f0PRICT0 /VugDBcOQpXu8p56YEX0CaPT/ZeO0QM+xi3HZsfR9kehkdYo2TswsXRFjMQqIrig pgo+Rqcy+ojokpVVDUv+Zg7Q5hSbtDLh0rlmovz6J1VkK32ruvgUxD3p0iQESG6l 2SZ/xtkQtEIpUWX1sNv1wtvTiz5Pvv1bz0Mmvw== ----------------------------------------------------------------------------------------- !!! DANGER !!! DON'T try to change files by yourself, DON'T use any third party software for restoring your data or antivirus solutions - its may entail damage of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/B1D679FE97CFEA5D

http://decoder.re/B1D679FE97CFEA5D

Signatures

  • Modifies Windows Firewall 1 TTPs 1 IoCs
    evasion
  • Enumerates connected drives 3 TTPs 25 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Sets desktop wallpaper using registry 2 TTPs 1 IoCs
    ransomware
  • Drops file in Program Files directory 39 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 5 IoCs
  • Suspicious use of AdjustPrivilegeToken 11 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\2023-08-22_ff1f6956f07e700a86b5986b63ea12db_revil_JC.exe
    "C:\Users\Admin\AppData\Local\Temp\2023-08-22_ff1f6956f07e700a86b5986b63ea12db_revil_JC.exe"
    1⤵
    • Enumerates connected drives
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2468
    • C:\Windows\SysWOW64\netsh.exe
      netsh advfirewall firewall set rule group="Network Discovery" new enable=Yes
      2⤵
      • Modifies Windows Firewall
      PID:2236
  • C:\Windows\system32\wbem\unsecapp.exe
    C:\Windows\system32\wbem\unsecapp.exe -Embedding
    1⤵
      PID:2652
    • C:\Windows\system32\vssvc.exe
      C:\Windows\system32\vssvc.exe
      1⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:1936
    • C:\Windows\system32\vssvc.exe
      C:\Windows\system32\vssvc.exe
      1⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:2172
    • C:\Windows\system32\vssvc.exe
      C:\Windows\system32\vssvc.exe
      1⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:2008

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\n430ar4kv-readme.txt
      Filesize

      6KB

      MD5

      1e495581c25c932c70af85354dec9b74

      SHA1

      630c3e352ca43a5011d5dc2c505039560e221795

      SHA256

      b0f9cdd1db0f7b581e22f7cc384efc080282e8cbfc32bebb379b2165445bd554

      SHA512

      2ec06754f0a89d97687e6a2634dc5fc2e2178801af81cdf470c610c9851719ac3a0d1e0c4cbfa58a5bad33d71cff5d9d68a414b780aa696a1f78b9e284e11417

      Download Submit