Overview

overview

10

Static

static

10

v2.exe

windows10-2004-x64

10

Resubmissions

11-04-2024 17:53

240411-wgrc2agf82 10

11-04-2024 17:50

240411-weydkagf52 10

07-03-2024 21:32

240307-1d2rtafd3x 10

05-03-2024 03:22

240305-dw4ykadb7x 10

26-02-2024 08:40

240226-klbmlahd92 10

25-01-2024 23:42

240125-3p3jlaagej 10

10-10-2023 00:01

231010-aaxetahb7s 10

14-07-2023 13:07

230714-qc385seh7w 10

11-07-2023 13:35

230711-qv314aad81 10

Analysis

  • max time kernel
    61s
  • max time network
    64s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    25-01-2024 23:42

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    v2.exe

  • Size

    121KB

  • MD5

    944ed18066724dc6ca3fb3d72e4b9bdf

  • SHA1

    1a19c8793cd783a5bb89777f5bc09e580f97ce29

  • SHA256

    74ce1be7fe32869dbbfe599d7992c306a7ee693eb517924135975daa64a3a92f

  • SHA512

    a4d23cba68205350ae58920479cb52836f9c6dac20d1634993f3758a1e5866f40b0296226341958d1200e1fcd292b8138c41a9ed8911d7abeaa223a06bfe4ad3

  • SSDEEP

    1536:vjVXKif7kaCtHM7qpo6ZQDtFnNi+ti09or2LkLpLik8ICS4Ao3uZs/WVEdz725sK:J1MZwlLk9Bm3uW/Wud2K36cn/wCY

Score
10/10
sodinokibiransomwarespywarestealer

Malware Config

Extracted

Path

C:\ProgramData\91j63-readme.txt

Family

sodinokibi

Ransom Note
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension 91j63. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/4622FFA5C14C933B 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decoder.re/4622FFA5C14C933B Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: MEu9pNTt//ljc0uR77/7uQMsruK+eMUFWYbDvcQMxThwm7iKhZt/IkZn5PIiuq7r EO9ouojSikHJHlOX36OJffpFa4C/MsmuuMvsC4etvAD53cUnxB/gpPmxR6IQzqem rbKfhwSysLvHWPziklcXtS9Js9HtvxxMUJWBRp0xeT4zL5MDFqBg+3/kqg1f/b+h 0XXY9RpU84T0sWet6tnLVX7tJ9ky/TT7DS0HddksSHRC9Vp70g41J9MwmR9NOPBV TkOgCFgdx8lsMSYwTxfLVXfEhlhapGzQMzVJsj3bHNoZJT5shSRHqBVQW1bVa5d/ 6el8HgRXqU/Tq+r0NeWTK1qLCeBRY5i5NkwKYbIjnfZSn9ZHKU81Myaxs0rJhyRu ORXf3Li4kbPT85QWeUqIxSpqkmmHM5drgGn4shZDFN4dHWcE+hneiZuVS1Lu39Ak k+CetZWtjSDx9gx1snvj73E3Lt7yZUOTLtPj2JkHlhqLHPIgH7j3q8eu/MFrNlCc w+sqsYhX5h1URAQb4tLQkagtSUHHOhxc2M1ONJBuIvls4Bxl8fyk/u1GjDil0g/9 B806zD0p7vpfdmEO/bF1MNG7zMK6VJXLv/o/qNzVE+qWM7zJNtaio9Yualmf+SVC zFdDvhrrmFxCQXZJmXP+KHdTdpXVGuFFgs/X8eBs6WGroOq2qQ7mRJOmcAQhfXGN NwADeLyMB7gvfZP13JZCsXjA+qb30fO6pqkPM8qT/+DOhs/+ebLcuYMECszQco4M QFtXalN2vJHg+y36jvMBtyvrWesvBCy7ls0a5Y2j1m392inBbE75nFmn0AghCFkQ k8i+mLZHLeVwnk1kT1MVWgdYuuc+j7VBLt8NZwPnaKJf0+AZQYhktID3A/n6iWvS g5OIOs2XecEinwf0/ScXtQs3nqcY6S5hj8UzrLureSiXSk9GkSb+Jy7TIzjo/cO4 DVabukRfNbohGqpIj7xYuiXjpccDQRdoCgXdzjcr012EI3ctOeuZwayy6TFV4FFr hEEnzJWLRVSoQCXz9zea1WHNNe99P2/WzdD05nrvuKdveeo5QxQeQM2umViOthxT uNT7CVFgfnEL+kWjSicxWY2E2Tw8v7CkIoGKoxJNXm2UBw7K1j3R8B9y9WMGwQr0 T+5cFpi0rEXAmC39ngIuYm1L7xt+Ar8oHRz7u1QpLQ9lXpFEz1CLbH3bpxsL8YWd 1eK3a5lNvcHyyVHL+oosPX4RJH+EhvY8ilC9pRPuzlBYl85sCnqy6IkXQoVmSpEc c6F/Khr/clENam9t6Yof5lQL8CgmUCuXP0OgLmoCXekudVpEnu+VZNS4aOoOMy79 MHUKSmE/G9DDO9qtxh84FoFzKqx48c7gLJw= ----------------------------------------------------------------------------------------- We will use the data gathered from your systems in future campaigns in 14 days !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/4622FFA5C14C933B

http://decoder.re/4622FFA5C14C933B

Signatures

  • Sodin,Sodinokibi,REvil

    Ransomware with advanced anti-analysis and privilege escalation functionality.

    ransomwaresodinokibi
  • Drops startup file 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Enumerates connected drives 3 TTPs 25 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Program Files directory 10 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 8 IoCs
  • Suspicious use of AdjustPrivilegeToken 5 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\v2.exe
    "C:\Users\Admin\AppData\Local\Temp\v2.exe"
    1⤵
    • Drops startup file
    • Enumerates connected drives
    • Drops file in Program Files directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:1864
  • C:\Windows\system32\wbem\unsecapp.exe
    C:\Windows\system32\wbem\unsecapp.exe -Embedding
    1⤵
      PID:1992
    • C:\Windows\system32\vssvc.exe
      C:\Windows\system32\vssvc.exe
      1⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:3064
    • C:\Windows\system32\NOTEPAD.EXE
      "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\91j63-readme.txt
      1⤵
      • Suspicious use of FindShellTrayWindow
      PID:5188

    Network

    MITRE ATT&CK Matrix ATT&CK v13

    Initial Access

    Execution

    Persistence

    Privilege Escalation

    Defense Evasion

    Credential Access

    Unsecured Credentials

    1
    T1552

    Credentials In Files

    1
    T1552.001

    Discovery

    Query Registry

    1
    T1012

    Peripheral Device Discovery

    1
    T1120

    System Information Discovery

    2
    T1082

    Lateral Movement

    Collection

    Data from Local System

    1
    T1005

    Exfiltration

    Command and Control

    Impact

    Resource Development

    Reconnaissance

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\ProgramData\91j63-readme.txt
      Filesize

      7KB

      MD5

      4367c297d60025af07d8e2177a07c366

      SHA1

      b458f1622b91c86d74f09faa2d6876c50f82f2cc

      SHA256

      7c044fa8fe8bee4414b90aa92cb6d47ca1d0481870dc1410e4d2d34b2411881c

      SHA512

      b864acc827269c36cec9a73da71b64c06df6fda80a6bc05e89e66193c7a5bf8deeb5ae7013a20157427f0f226685eb628326c21ed071fb0ad5e41882b2388689

      Download Submit