Overview

overview

10

Static

static

10

81689f1be9...ed.exe

windows7-x64

10

81689f1be9...ed.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    122s
  • max time network
    126s
  • platform
    windows7_x64
  • resource
    win7-20231020-en
  • resource tags

    arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system
  • submitted
    20-11-2023 23:03

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    81689f1be92c8fb7e94fe241441c7eb43cfb77c6d23592b0248566bd709ff2ed.exe

  • Size

    115KB

  • MD5

    7e18b037a068c56417fb8e56aa7e49e8

  • SHA1

    f6739569a24358c8c060d7131be70712f70f36e0

  • SHA256

    81689f1be92c8fb7e94fe241441c7eb43cfb77c6d23592b0248566bd709ff2ed

  • SHA512

    d6188e5536b6e0b5c49d572e35155d633c11fd30bc8d4bf4ea87fea7196ae2f67bca364a0afaeed8209e5d4b2be0b98d81c49293d3fed95c70c8388b8387899d

  • SSDEEP

    1536:AkdeUcaK8Qz4PQIUnq5WMrAmyopACC9ICS4A0vh4NKwTNA28V5/Ogsck:mlnXEXyk7yvh4NKwTNF8V8v

Score
10/10
sodinokibiransomware

Malware Config

Extracted

Path

C:\Users\bgopoa-readme.txt

Family

sodinokibi

Ransom Note
---=== Welcome Massive Prints. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension bgopoa. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practice - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/F000715E99199B02 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/F000715E99199B02 Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: W/6WiI6yPdP02WEQ/ze948tlU+/HDBh7ACOeDPbro98r4wUfaUEhYIlunvNJkbTN bdwvnG/IU7hIAfDvy65MceY6hhlKqC5zlAPlbXVSqJYW1d3zxUQAG5qtUgwsd7HI MrVvBHP3zsPFb3kCo5nmFDuWEyPFKqPHoyvUZWUiILny1TUFicREMD6Zkp2lzCzR 26m/P4j6tWkmLngONcweHM00UlpLUINrk9d24nHLL+iCIJ9JKkE+aqNeEXu401fE 8R1ltTBNMe/a2dW8qvMg0rGTtbDd4/oTQqA1F2LC3hLMrI7XnkX2dDB85F0KrtnC TGiBjf56NPbwBPiMe1ZxpwW1MunxfydnmpZjeZYqfroBCSHzOq39Est0TZk+GMip cq1h3BLQ2iHXziDMLl2bHJsbGUYhIBRpMJNxV6ADtcIa4330hT+6+PTeafHdnK9q Yx0I9xF1jtS0WbU7j5nhJa+rGX2PIKT+bL6IXqCYpzqkHxKjSqQeY0Wi7z6xBiZ/ F+L6c8THpffjosgmcKkEoSyerQtjWPFdx9r6RiwaHS62+Pg0Z7rcZgXYixdR1Xbg 1pIGqz/lk6FN1nigQbR2iQK874KporW2iCGnCwwRNHXXWNnMj7r08ro+AsGTBO0d jUcKAWN6gbzMB7Hfl9rc2WEhjqdifZOTu2QaOu+RrFYddW8V/UABY8UdsCJZjODC UJ0SPeabmHUSK0ute1qNsOEolWU4v1pS3eRWGXDAcJcDB6SVx/6rcWJFI8Fht4mH 3aflB/SU7GVxl/vMxY7HNcfudoUGu471XLwr68agODfEQhklY5OZW/yiai8rpdsA ZPJlagwEVXVVh3uywpBmOnljDbEDpf8BZ39lqCHSHYRYkMfPtjeM9jWvrOw9HSl8 VKv+S9a8RgXHQ1ZSJtg25t6A8k8NxISW5YxIB4QwkW4u8s1T76l0j8/X99aleWot OG1dg7Kiv9c1rpy2a82n7cHl5L3CdQ/hO7Phh0v4+Cz16xRd78duPpEJ+7W4ZPpK DnV7x48NRnx2WuVJmXzqV8kIcj5BN6sPUfeq2vKFKphGs8uA71p6XE5408cLkH6P bH69y29LgRr6x5VC2CbaZq1FgOjY0Tl2CzPzFN9RExsI+CoSvJQfbF10lT4LbRyp mzKEwZLTQvKCk3+T1u+w9ktWvSOcLA7mYaaM0COePKsYtpaJbBs+aVyQZTSc6xVj td/VolQNGm7hl1gMFmCm+ifqGa2sqAvZRagsWWYNDfLmkB/kRvQA5yKdmQLEIRr9 nFeyN5LNiRGfMTV+LnBJOkXdGXp9ltN7cZiSdHQHu+Kzcoxx7npD6h9npYjgTi4Y GT5TiisutAUnqVBuyUn15AovTTfGP+LZ0j3Zttz+/P8= ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damage of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/F000715E99199B02

http://decryptor.cc/F000715E99199B02

Signatures

  • Sodin,Sodinokibi,REvil

    Ransomware with advanced anti-analysis and privilege escalation functionality.

    ransomwaresodinokibi
  • Enumerates connected drives 3 TTPs 25 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Sets desktop wallpaper using registry 2 TTPs 1 IoCs
    ransomware
  • Drops file in Program Files directory 36 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\81689f1be92c8fb7e94fe241441c7eb43cfb77c6d23592b0248566bd709ff2ed.exe
    "C:\Users\Admin\AppData\Local\Temp\81689f1be92c8fb7e94fe241441c7eb43cfb77c6d23592b0248566bd709ff2ed.exe"
    1⤵
    • Enumerates connected drives
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • Suspicious use of AdjustPrivilegeToken
    PID:2516

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Query Registry

1
T1012

Peripheral Device Discovery

1
T1120

System Information Discovery

1
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Defacement

1
T1491

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\bgopoa-readme.txt
    Filesize

    6KB

    MD5

    af1b6835877628c4eb928e2e45ca76ec

    SHA1

    75d730c793724dc2c79f32e42cb15f95d52019eb

    SHA256

    31c193e6f7b6530b75f7528bca2366d5e00dcced506995779c73ad150ff7f2ed

    SHA512

    97b35e1d2aa30ed59b71006dc75643a19132f585183384e1ccdc7b9c9dfd8f6772a44cfa15498131402fa983577ac6ca3d67df8624204c7258b7f66aea56fa72

    Download Submit