Overview

overview

10

Static

static

10

2024-01-18...il.exe

windows7-x64

10

2024-01-18...il.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    106s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    18-01-2024 13:42

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    2024-01-18_329b8aaea517a511908683b56446db99_revil.exe

  • Size

    126KB

  • MD5

    329b8aaea517a511908683b56446db99

  • SHA1

    9abe20a9c460a3e530cb96658541c6d25700a529

  • SHA256

    c09c691d40d8b935de4b60c92e1d4fc85f409fb546fd4a5e5b5483ae150fbf20

  • SHA512

    172d290abe8fef35e8bea43319dc68092c61389257c73e94fcde68f67f97022c1bbda1fe50cd35775bda6e2473af1bad0e5cdb2ff7060e8365bbbe4765a3b3fa

  • SSDEEP

    1536:oxOUyl20w8bVZQ40iMSO1fY+iUyQs2r8t5p1ySotICS4A6QdZls8XzUXiWr4X5Fg:oMhQNDEtb3A2ZHjUyWr4X5FTDUA

Score
10/10
evasionransomware

Malware Config

Extracted

Path

C:\Recovery\b39a7x9s1r-readme.txt

Ransom Note
---=== Welcome. Again. ===--- [-] Whats HapPen? [-] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension b39a7x9s1r. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practice - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/121E315B4A0B181F 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decoder.re/121E315B4A0B181F Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: cNNrETrx0+mqfexYO4HoUGMD2qjOqACbYn5leMJnL+x4ftPS/89sjkC8uDpMaUo7 hrRFSasCmLpyfx6LFK73wNg9l+evYBRl7G1OXA6QbIoRZKEiiYGhKJHhLNW76O9o 4G9+a6TSI1t597apZnzmko4BGIPoYgO8gn6AeJCKRD4aHxEJf2mKaXsm2lw7k25f Eqlti1e3G9T7acDIHThxHszFfPQ4ucsUNFq4oLay+/NIAjcXhuKrm9/N00LCAual XlDpTabiIco/MTlsAIHbqRbmAPYsriYjAsj3GMLGRoVGd8iniHNK9u+eFdIsISBB oEmcTrOou2K9N/XB4WlX1MjJw2ENl5r1CT2JJ5wYKDqzfaPTyoGMi9Fs0IS3h7Cj R/A2KWyY9dzhVvfHjnpHiVVr3GP88WwQWpZdToiu/oSExgLGjK85schRPN/rXr/N DhiSzHgTmvY2McVdHWv81ylOpiicBu+LLrU3YLjoFv4lqUg8rYzENmpDCCcv6Drc 2+QDslI1W4Q4irMjEfOR/KdHh97H6jbJVyZEWs/MgFMnIieEc1Ao6KcJetrBeT4W L8pJkqElkSfnGBxMjlmpclVPXN6UFRHEFN2prfdASg+KhroYvKMJ3zK22RiP+nBO gh9jVAK2Okfhgbmknyy70XVzTgkJelAM+Hl75UamvJRWJQBFEIQTWCBMkZq1up5F SnWT5kMqxIo59KGwufsxwsyyLgi2oEKupxlOefI52oSFrU9+QktLk/Ff1/bAzqKJ dbipye+JKWJQjwHmyq7VnaGkr/Uf2sBj/vh/ibd1QX6dHxayQUZ423lzcBfYkTaP v4hBYXo8lWc04ijwpLRan86S8aA+krjxbIp0gmCRmKWRbrNews2lnhpNR+EsZfLv HCRIMGoV7kmL/Jsjw2SoFMG6lg/lSXw5sNqtzChJznIiPz6xSKEbCysD8LP0Mo7e 4abQBFz8V/CZOH07aZOxJFM7lF59bji/CV/B3AdPukb+oUJQdD111crN5CgaNMbi V6VnUne9EyDCIaHOIbBUmSmwQoRWpdOYpp52LXLc277Quj4RblERAGvS2jgTWCK6 5hltiJegQSNEXgjkygcLsLXXn20KTBAzIT+RkkSdYpkXkRB5sb23nX6ITtCaO8Ds dUh1hk+pTIANWDdXx0LE52L8+ghE7rvGcfyDH/2p5wxYQm+CB6ZsXXGgkgfnjf/Q KGCeQmzPYP2GYfjxt/gq+V3PZLxymIWq/Vt53L9YlN9khX9arvLj6swvFLDy0bsY 23Rc7cNXxNIoCKDsvY+MuJM8CSyqBoOy42NtftdUcHDEerH8fmCz/W1gStv8x0Rj RJ7987CfkRnhlbpAWDEodVCz1pdVZlt/gvDnxP0n+ZpCTlRk ----------------------------------------------------------------------------------------- !!! DANGER !!! DON'T try to change files by yourself, DON'T use any third party software for restoring your data or antivirus solutions - its may entail damage of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/121E315B4A0B181F

http://decoder.re/121E315B4A0B181F

Signatures

  • Modifies Windows Firewall 1 TTPs 1 IoCs
    evasion
  • Enumerates connected drives 3 TTPs 25 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Sets desktop wallpaper using registry 2 TTPs 1 IoCs
    ransomware
  • Drops file in Program Files directory 26 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 10 IoCs
  • Suspicious use of AdjustPrivilegeToken 5 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-01-18_329b8aaea517a511908683b56446db99_revil.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-01-18_329b8aaea517a511908683b56446db99_revil.exe"
    1⤵
    • Enumerates connected drives
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:3812
    • C:\Windows\SysWOW64\netsh.exe
      netsh advfirewall firewall set rule group="Network Discovery" new enable=Yes
      2⤵
      • Modifies Windows Firewall
      PID:3820
  • C:\Windows\system32\wbem\unsecapp.exe
    C:\Windows\system32\wbem\unsecapp.exe -Embedding
    1⤵
      PID:3844
    • C:\Windows\system32\vssvc.exe
      C:\Windows\system32\vssvc.exe
      1⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:5316

    Network

    MITRE ATT&CK Matrix ATT&CK v13

    Initial Access

    Execution

    Persistence

    Create or Modify System Process

    1
    T1543

    Windows Service

    1
    T1543.003

    Privilege Escalation

    Create or Modify System Process

    1
    T1543

    Windows Service

    1
    T1543.003

    Defense Evasion

    Modify Registry

    1
    T1112

    Credential Access

    Discovery

    Query Registry

    1
    T1012

    Peripheral Device Discovery

    1
    T1120

    System Information Discovery

    2
    T1082

    Lateral Movement

    Collection

    Exfiltration

    Command and Control

    Impact

    Defacement

    1
    T1491

    Resource Development

    Reconnaissance

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Recovery\b39a7x9s1r-readme.txt
      Filesize

      6KB

      MD5

      3132ed82a42c60da3ddd09c710e7bdaa

      SHA1

      882274d4d825db888bfa871035ba8b1d4597273a

      SHA256

      b855423c6383a584ff0a4940bdf8bb2baf1a226fadb5331c6aa20f06d29ca56d

      SHA512

      ba4d96e77c31c056aae3e25119f09510a3a767e8aad3725d18c9cbfaa3e5622d618bd9f5f2b198960f37137d23a928574daff607262b308eb182eb905bf9caaa

      Download Submit