Overview

overview

10

Static

static

10

2024-01-18...il.exe

windows7-x64

10

2024-01-18...il.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    121s
  • max time network
    127s
  • platform
    windows7_x64
  • resource
    win7-20231215-en
  • resource tags

    arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
  • submitted
    18-01-2024 13:42

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    2024-01-18_329b8aaea517a511908683b56446db99_revil.exe

  • Size

    126KB

  • MD5

    329b8aaea517a511908683b56446db99

  • SHA1

    9abe20a9c460a3e530cb96658541c6d25700a529

  • SHA256

    c09c691d40d8b935de4b60c92e1d4fc85f409fb546fd4a5e5b5483ae150fbf20

  • SHA512

    172d290abe8fef35e8bea43319dc68092c61389257c73e94fcde68f67f97022c1bbda1fe50cd35775bda6e2473af1bad0e5cdb2ff7060e8365bbbe4765a3b3fa

  • SSDEEP

    1536:oxOUyl20w8bVZQ40iMSO1fY+iUyQs2r8t5p1ySotICS4A6QdZls8XzUXiWr4X5Fg:oMhQNDEtb3A2ZHjUyWr4X5FTDUA

Score
10/10
evasionransomware

Malware Config

Extracted

Path

C:\Users\10w27-readme.txt

Ransom Note
---=== Welcome. Again. ===--- [-] Whats HapPen? [-] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension 10w27. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practice - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/C193AA5B7B749436 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decoder.re/C193AA5B7B749436 Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: vTjWTLfPDGh+Hjz2E+Gp17IEarGGp7oPRPv7gOa19ArTMHGYaQwqqj9EPqphXZ1S 3gGp8W/jatMTS0XvQqNq9VFajwfUrL7CXn9/6T/iv/hKTwKxvsofoj32IALAdSeI NrhZKzvzZGW064XfRhPdoynTOBrMmQnER/q7tlem9qoLzRYHBycN8QhYnUZpq3y/ Ay8kOKMK2l4UjvqEhF01pJUFDN5wOe7gfTS+dn5esPwGPQos9bIw5RXV7XlgfKIO esH0NHSoKHo6S9LyPZDx4M8Yah1iW5K65d0MR2OSPUblKuZKLCDYUfXKGm6pz+TK 2vhOaA/gLSzeNnlaUqguVPklsUdq1xnezk+x7cBOixd0HINfBdzGeEs3jwhCX0vn 7AW46OWmb2lwnHVAra4/6Tx9lf84TX1xMvHm3b0VMb1MXIx2OXNBd0zjphOuR4J9 ZkisT+tBt4n+pR3nMqWWrgB4wLUQGiCuaDN6V67jiv4+iK5Z0+OVylSrvXUsJ9fL t1n+0ALivekahZ5dAxE/0L1Dc6hCO8o9rC3PRrxqbd3rHq7q54dCYx4J47E7jl0y l5W3doNn6vUgxVmJLidGfPQQAFALZAt06FuHTP6adn8WHHqW3lMc75l0q+2rjHhR a29yD8VBq1i5XTpcaiA/2Be8ZsUUQBAQ4ZtnP1BFXKkJgRAu6XCRAkIZ/1qeFEaK aLJs1Rm9ToysEARrWJIPWEyoEtoJnGM/8dzUQSIyrWpM1hHssusd0JzCuAwP+Z0r NYCFVw51VERWNtyl2AUNlBEpFrU7NXZqERFiWfWDsLigquxdNtWvQojGd3Tojv0r oDMTLsVoMVRdXNge8q8dXjPjQJXQcHwcqDnYYEGR9t76uTlTKYe0veu728TFL4bf sgfyBP1HPdb+t6rh6yD/qR7h1KR4brBXYyG7IVHvWhroBKx55qcNnAKhtQxX8G+M dprv+ndhfZL/wTEKywGghwhUCAj/2HmSa3k90xBqDwXL9JrX6+UCtYzHGM3eNBty QAioPNeASSw02e8yl7z12FmwBb8GX2nZFzw2UupdgUkwl3eNoaAumRPFEV9aBhJz V7EBYeYgDjg1mC3FqDClmeefph3ToZ2Jlxqegc+6lWXsuLjk5z5rU1YGuo0TckBg xO0hSpG6Cpm6JramF95OJGq1YTsbv1xg/j/Oo14gLgI3LeOY7FGvc0iXOHQddaa9 oEQ5TDx5m6+YR+/XIc2P3T0tTq7kiC5DRkJI77/Bxx0wOJwbLQI1fFzC61AmCuQQ UZrCSj+gIQpiwsxK+cOiWabbpOF/0TuVWHe0G6YhEGBJDw7ZYT5VXfoMaZAY7Khm xHOQV0lCmEz6HpRyO9XvHXMOhZk= ----------------------------------------------------------------------------------------- !!! DANGER !!! DON'T try to change files by yourself, DON'T use any third party software for restoring your data or antivirus solutions - its may entail damage of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/C193AA5B7B749436

http://decoder.re/C193AA5B7B749436

Signatures

  • Modifies Windows Firewall 1 TTPs 1 IoCs
    evasion
  • Enumerates connected drives 3 TTPs 25 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Sets desktop wallpaper using registry 2 TTPs 1 IoCs
    ransomware
  • Drops file in Program Files directory 20 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 5 IoCs
  • Suspicious use of AdjustPrivilegeToken 5 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-01-18_329b8aaea517a511908683b56446db99_revil.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-01-18_329b8aaea517a511908683b56446db99_revil.exe"
    1⤵
    • Enumerates connected drives
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2976
    • C:\Windows\SysWOW64\netsh.exe
      netsh advfirewall firewall set rule group="Network Discovery" new enable=Yes
      2⤵
      • Modifies Windows Firewall
      PID:2700
  • C:\Windows\system32\wbem\unsecapp.exe
    C:\Windows\system32\wbem\unsecapp.exe -Embedding
    1⤵
      PID:920
    • C:\Windows\system32\vssvc.exe
      C:\Windows\system32\vssvc.exe
      1⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:1980

    Network

    MITRE ATT&CK Matrix ATT&CK v13

    Initial Access

    Execution

    Persistence

    Create or Modify System Process

    1
    T1543

    Windows Service

    1
    T1543.003

    Privilege Escalation

    Create or Modify System Process

    1
    T1543

    Windows Service

    1
    T1543.003

    Defense Evasion

    Modify Registry

    1
    T1112

    Credential Access

    Discovery

    Query Registry

    1
    T1012

    Peripheral Device Discovery

    1
    T1120

    System Information Discovery

    2
    T1082

    Lateral Movement

    Collection

    Exfiltration

    Command and Control

    Impact

    Defacement

    1
    T1491

    Resource Development

    Reconnaissance

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\10w27-readme.txt
      Filesize

      6KB

      MD5

      f93b2729ed7d3c4b7a68a961867435b7

      SHA1

      59684cc52d8e4ca2248ab56a7eeb456dc4adce36

      SHA256

      5ac150ff05cfa4876b0efe50674dca13a6244b500ff02631c9b3e628e1e83047

      SHA512

      c120dec649cb4686bf537ac1ac74c90dac268b7546e5903530e53fa013c144e95f79c0bb1c46bb4d3fb65616ea1a8709c81758fbe15eff34413593d737bcc4fb

      Download Submit