Overview

overview

10

Static

static

10

2023-08-22...JC.exe

windows7-x64

10

2023-08-22...JC.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    143s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230831-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230831-enlocale:en-usos:windows10-2004-x64system
  • submitted
    03-09-2023 14:54

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    2023-08-22_ff1f6956f07e700a86b5986b63ea12db_revil_JC.exe

  • Size

    126KB

  • MD5

    ff1f6956f07e700a86b5986b63ea12db

  • SHA1

    a8d88813f2691cf71e8d6790e473593644c913ed

  • SHA256

    3e6fbc358e0204cb67a41b05771fac74f1b49737c7ab7138e415c7e9628ef545

  • SHA512

    04f4d29f37079ef04e2b1be812d20d89dca82e4fffff28047de435425a18573cc3edfd5b148e0aded71d652583785e82585c708e0fc38b5dbda61962cbb1f927

  • SSDEEP

    1536:YxOUyl20w8bVZQ40iMSO1fY+iUyQs2r8t5p1ySotICS4A6QdZls8XzUXiWr4X5Fg:YMhQNDEtb3A2ZHjUyWr4X5FTDUA

Score
10/10
evasionransomware

Malware Config

Extracted

Path

C:\Recovery\8e1ikou-readme.txt

Ransom Note
---=== Welcome. Again. ===--- [-] Whats HapPen? [-] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension 8e1ikou. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practice - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/C228E7916B17DB67 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decoder.re/C228E7916B17DB67 Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: 8iSg09n+/3WXGKlsyeXhDOpU/5C9OO/dF8ni1sQemCYAFPiTRDnT3S2pSPO43WeS 0+tz/na86QTcexwWHy76qhVwJVyguhoBQVyonmU5GO7PhST7ZHLV6x/g5LTOIYQe cXFwdUEPYo0jRAHBjkaUYhNUZ1CcK14/R0gK1Zi0VaQR8EsaA+t7AhknYCUWwZLB FoNtJC3qukLoR9OTUyj2JUpqXvn72zVz4wrM+DXvGUDdPcNHsIp4ELqqBodyV83m YyTCKsTD0sftPxdog7NjCyqJKilknKeLr4IGZYQybrbDkv7WJPT6FMVbigKUPFT6 tVbuJksY0iamy389Ls6+R322fKISK4WGufUhSKelbZdo6n5r3GpYi/yhoOm55i1Z 8Ox987xClsPSzLIITYxCRJnJil7Y/6wRghYYE/hVJZH6LpLzXvQM9LtY70NX1p5l vys1Wm3m0ShF20YomcaMYZrhsL/HMPLA/8OoxT5108AtgT+hY+s22ifKySrAr+tD Afh5RjyC1V7GigXVfhv2xEjashIxA+WBC9zL1XQN0fTa60TJEdqDViez108dDd7A Ut5R+eGIHZWBgxvw5LOTy3UQ+3vLq9gBBFNuKlyZSqVwOmipiaDCFpV/KkYpyIP5 1RTFe1mVNT038Z89sUZsHc4VieZYRZiy/mLvAoByJC2eh9ZHTeWERA4es6EyEI31 Lu8Zb7RTdotP6itLD3JV3KCvFwXaGnpNvL0ObJoET98/d5W9QVwpaDtBknz94NfR ssUoAf3hRQROMKTNfy5hcPIZBNeOVCTAEwhy3WSNdJdkXcsMvVg+KsFWnXY7bCFp gP9Ze1I80RH8IdQ78NKjVMWwrHsNA0uiqd4sCaLWA4/CWUAfqu1uQdprDhiofRBp b3eqoDJXE0QenNRPDlXfDUFv/cL+ZAWcgaCvThQGv0awjwyA4IaRp43j9qM0DMsq HoiyIav5RMhwK6kuTi0rDoJD+MJVRKwDXrp4X5qrhfbbX/anDB4wG/+OmrmQujEO niK1ZMQMKiIBzMqcHy27BR/S8fs5lZ4Wq1sl9ATvcYWZ0XMbLucO7RSKoT6/Ni5b lOXzLVTNwpMWzoENppkKQziw+RJediWW2wVnqUDzwuheqk4QUicuwxnvm4s+s+kv uDC6D/CTHIXW8s6zgf+9WwIzILSd9PwKYT9p60wYnvBTqSX+ptTYQ2zaJOpHhRo6 6ZqPzmhCg4UB/1PTQPAtU1xc5pwBmP4EaAxtoXdv2A8bepSSIYgJWLPB7rPWL1O5 yIoqdhs8UfavRpY+aLNsHUKjt1n7/5Vxytj3Ftoj55fP/Vg83UsxzxY2uofw84u9 /cbruVV427UPLDHGgBwlOk9HyeQS/n2emLEarbXQ ----------------------------------------------------------------------------------------- !!! DANGER !!! DON'T try to change files by yourself, DON'T use any third party software for restoring your data or antivirus solutions - its may entail damage of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/C228E7916B17DB67

http://decoder.re/C228E7916B17DB67

Signatures

  • Modifies Windows Firewall 1 TTPs 1 IoCs
    evasion
  • Enumerates connected drives 3 TTPs 25 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Sets desktop wallpaper using registry 2 TTPs 1 IoCs
    ransomware
  • Drops file in Program Files directory 40 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 10 IoCs
  • Suspicious use of AdjustPrivilegeToken 5 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\2023-08-22_ff1f6956f07e700a86b5986b63ea12db_revil_JC.exe
    "C:\Users\Admin\AppData\Local\Temp\2023-08-22_ff1f6956f07e700a86b5986b63ea12db_revil_JC.exe"
    1⤵
    • Enumerates connected drives
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:5108
    • C:\Windows\SysWOW64\netsh.exe
      netsh advfirewall firewall set rule group="Network Discovery" new enable=Yes
      2⤵
      • Modifies Windows Firewall
      PID:1580
  • C:\Windows\system32\wbem\unsecapp.exe
    C:\Windows\system32\wbem\unsecapp.exe -Embedding
    1⤵
      PID:3560
    • C:\Windows\system32\vssvc.exe
      C:\Windows\system32\vssvc.exe
      1⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:3792

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Recovery\8e1ikou-readme.txt
      Filesize

      6KB

      MD5

      b2764910a4fbf9307e324b054221ab86

      SHA1

      6d1b4d87051b4efb29d5203efe790a1bba35e2db

      SHA256

      7c4d983bc5eae0675f8d6de780ae403439423385fb278c798ebc29df11fd4f39

      SHA512

      fc8244c75a7ffc03a0b71b13c48e43f06aa58766fc21109570fea984621141b36706137675c4699f1714d29a5ab19393d104e47a3bd31c9bfb0ffe9158a8ac14

      Download Submit