Analysis
- max time kernel
140s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20231215-en - resource tags
- submitted
18/01/2024, 22:36
General
- Target 2024-01-18_329b8aaea517a511908683b56446db99_revil.exe
- Size 126KB
- Sample240118-2jk7pacfc5
- SHA256 c09c691d40d8b935de4b60c92e1d4fc85f409fb546fd4a5e5b5483ae150fbf20
Score
10/10
Malware Config
Extracted
Path
-
C:\Recovery\74t71xs-readme.txt
Ransom Note
- ---=== Welcome. Again. ===--- [-] Whats HapPen? [-] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension 74t71xs. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practice - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/D5EC50D57851DC05 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decoder.re/D5EC50D57851DC05 Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: b0/vL0iujnwJn01MaHR/TwB9LTRQfreY5jJ7OLqmhyVxhGqVt1PsAXjFCInLFmAM u9o5OqWGQnM2XdcZQbp3dBxNu2VIcDYD7Ol3EsmHuaqtwRxGVmAKfbgFIaEfsQHU FwDMIa68WnrIiQ4NwKnSf68VD7D8ifDrEn6SS1A7uDE6sexJbjacjrw/4JLPc9sa MpyCiE/MUzR0wxjLUHZpQzdQbX41vlYdVXBu+IYgOcfwT5lyc8OvITEO94tYb6w5 zUXwvtDPuniO+zsElkjV8zHrvpwi9gsLZP8nA29aRtb70z99Xh87EEX+H89qpcG9 J2vwiKPDtl60S3frphWmnRx1FbEvCGnsanP8AB6uSCFatjMgIom+i7F04EVE3I72 vY61/8AzK8TCBn5cI/FarUyrm2s6c7Sy2gdIzi7iU/WA7FDYKQW7UeYkiA2lvk7D SXPdtUqsIgMYMdHO1y2Bf48C9DwHwNdKwMn4keCpa4fPBLE0j/1lq2UBipCn90Bf LNLE4RqIDfQw5GeGVQfbj1ZAH+iNgdqQGyECzlRa1o5XCq8ye419ISO7tDSUU5xr LUIdXnF7LxZdy4PNiGG1mJ53CJGHKV8sEwcFFx0+zEg6o1mWLEQsxzFTtyZmBn66 5r1F9zXOMbmtPkWWV4uHd01XOi40gbs10Vu84NUktML8iQdOwqpb8+f+geTEYU9L nVwVrfPmqsVAOIVDT2dm9JfMRA2xjzBAabbj0eGasDTifPDDEIAwEdN56QTzcESA H053mXfDfcNzN9dRjXqbDe8J/FpBCUD0I2l/Cuh5ORpwDUQZiwGdiHAtVXf8VIIC 7HShRyDIXNo/2ClhGPRred0iw7JPJUkuU48zepYTnUFBA5IyMs/ARuokWb9Nz5/K rhaS44TNpyCdqs+bL9Ir735LDgXTx9RLsRbH8soytkH7ggXJssYyIU0JZ8dFFO0+ obO+bwSvz+0ubpvNV2TEwOAAbZLRY1/EnHWC2aVYCbuywN3ap8J9xVx5PlsFky28 W37ayZahsndaoD/CIgXErKc0G2c5uKWJh7mVw/MOeBN6X4zLF+EYfoKrOm3nNGZ+ ZlAUWz6KhYBvYE8LMf32yFUG4UjwlRVpqJ8yzpBAhiiD0GS8+IBkDG2PPtwoEHPA fyTwg44CVchzslXlo4/iTOi8pxD+dnRSl//8OmGess593/9nObO/U2c7waNpngnw cLeMcmosKzTqKE3XtlVZ+hW0mPwabzgpVZPKmt7X5fBWQrhUqYEiaRcfj99QAsjJ QCuc9IVcCqYuGPr7K+jIEZf9GIIgDHViYqech6Y6R2G3zVJo4ae6z6wrhIm71nyL 2YJjSwTp7g6ZTNy0VNrg692ZY1oDcTQBAcOxPvwg ----------------------------------------------------------------------------------------- !!! DANGER !!! DON'T try to change files by yourself, DON'T use any third party software for restoring your data or antivirus solutions - its may entail damage of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs
-
http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/D5EC50D57851DC05
-
http://decoder.re/D5EC50D57851DC05
Signatures
- Modifies Windows Firewall 1 TTPs 1 IoCs
- Enumerates connected drives 3 TTPs 25 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
- Sets desktop wallpaper using registry 2 TTPs 1 IoCs
- Drops file in Program Files directory 19 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Suspicious behavior: EnumeratesProcesses 10 IoCs
- Suspicious use of AdjustPrivilegeToken 5 IoCs
- Suspicious use of WriteProcessMemory 3 IoCs
- Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-01-18_329b8aaea517a511908683b56446db99_revil.exe"C:\Users\Admin\AppData\Local\Temp\2024-01-18_329b8aaea517a511908683b56446db99_revil.exe"1⤵
- Enumerates connected drives
- Sets desktop wallpaper using registry
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\netsh.exenetsh advfirewall firewall set rule group="Network Discovery" new enable=Yes2⤵
- Modifies Windows Firewall
-
-
C:\Windows\system32\wbem\unsecapp.exeC:\Windows\system32\wbem\unsecapp.exe -Embedding1⤵
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
74t71xs-readme.txt