Resubmissions

03-02-2024 19:47

240203-yhy6daghh2 10

03-02-2024 19:28

240203-x6yn3sgfa4 10

General

  • Target

    3cff33197edc918d47d08f44d6ddbdda157337f0ad58288d15746cf72c0e4c57.bin

  • Size

    166KB

  • Sample

    240203-yhy6daghh2

  • MD5

    340b6f816bfdcfcb466cfc126c976844

  • SHA1

    e2e3adfcf621166a9f5bb7ee9795b7914cda2095

  • SHA256

    3cff33197edc918d47d08f44d6ddbdda157337f0ad58288d15746cf72c0e4c57

  • SHA512

    3e729878fe7ae2ea2f025d71d78226ddb5930b791143eb8c4ba4a7589d5944e5b0e37e8ffe1ea4983bbc66c71587e3a4b158b3e8a2b71ccbed2889c4778962f9

  • SSDEEP

    3072:1LFrb30BRtBZZg+i2ayy2RjLTuVyu7CJDgoMT3QLOoBB2W:ZJ0BXScFy2RsQJ8zgLOYB

Malware Config

Extracted

Family

sodinokibi

Botnet

$2a$10$maSqYzCs2s.gezYwrFOoJuI4SIRqDq0fr0z6iKBeb4EdgQpwYnYjq

Campaign

3385

Decoy

balticdermatology.lt

liveottelut.com

michaelsmeriglioracing.com

spsshomeworkhelp.com

campus2day.de

madinblack.com

tanciu.com

agence-referencement-naturel-geneve.net

jakekozmor.com

tinkoff-mobayl.ru

myhealth.net.au

maasreusel.nl

pmc-services.de

evergreen-fishing.com

noskierrenteria.com

galleryartfair.com

importardechina.info

trapiantofue.it

tux-espacios.com

ecoledansemulhouse.fr

Attributes
  • net

    true

  • pid

    $2a$10$maSqYzCs2s.gezYwrFOoJuI4SIRqDq0fr0z6iKBeb4EdgQpwYnYjq

  • prc

    thunderbird

    thebat

    msaccess

    mydesktopqos

    ocomm

    ocautoupds

    outlook

    xfssvccon

    wordpad

    encsvc

    excel

    agntsvc

    sql

    winword

    isqlplussvc

    powerpnt

    ocssd

    dbeng50

    synctime

    visio

    sqbcoreservice

    mspub

    tbirdconfig

    steam

    dbsnmp

    onenote

    oracle

    firefox

    infopath

    mydesktopservice

  • ransom_oneliner

    All of your files are encrypted! Find {EXT}-readme.txt and follow instuctions

  • ransom_template

    ---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension {EXT}. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practice - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/{UID} 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/{UID} Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: {KEY} ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damage of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!

  • sub

    3385

  • svc

    veeam

    backup

    vss

    sql

    memtas

    svc$

    mepocs

    sophos

Extracted

Path

C:\Recovery\7ze6i-readme.txt

Family

sodinokibi

Ransom Note
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension 7ze6i. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practice - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/C624FCF7347A25A7 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/C624FCF7347A25A7 Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: fQJSpGGc7CkLK7nbG5FEkiQJqeDUdKYBHawC6tTnzts+j7jdDOGiWW2LMayv8uQJ GcvCMHzT22TasfHIVNqVQtxKI2kC9SDDE92Sdulj3WOkuMF2xdFzzdPgJJU4eyYi u7jCibnscOZ2ocDuK4uxAztsjbXO+xfxwJEeub9dcSYDG78RgkBJ5zszUCZTccxt TxDIQKcPd1sBljBcVEGJMYTc52fNB3XV0+qPBvrIhXVQfDo6IbZZZHb0ShumEGU4 trMVgzrrloZyqkKWE/ElZh9xwmpw0u/LDQ+tah5RHGQ227/IALGCHj3sE2hw2w5H hl5Usk8CHp1vmN6z3gAOQyGm2HzA0rsjp2A/0Hwqmos2m4tW5DN55fBuYonDV/LG ykV8hwZ2nCqIRD2arWDI/RF6KfIUVEH7uH0Qa7wTpbxVJ+NBwzSvdHPKa5KPto9A p/VCUL9C8A9XbIolVCd2p/KKDzVUPM6+tH5NOL6V9IroCmcMOLIzMb449FhMuEDM MWNLtlSd1d5CXO1kgUoiKK8Xx7gMrGsq4p0WZiLP0xJupkz+XIrPtEOKBYYwmIKD gwhmk1Xi0fwBU+/1Pb2qOL0TE2WzdX/Xxj+uG509rCsgb6D5xgKhemqcwWW4nsK1 l75yRk+In4mZn0dQqFyC79VA83wpZXeMKhM+TMphqJ/zw4rVkJA7ODy+nG5HHa41 nLILilXLD6eWrAiJGJsRZzm+PrTo5ZM1Tz1E+MifDt9Ug8GT8YUURL5At8DzrdC/ HVDvWceHuLV3ZjU2mPC2onfhFgKUcFMQDlvgITjwt3t8vQtN6niM8T0kCMujhLu3 B2zH/9RJs5/9X/NgeqN2WhhJ0DhaOprjQbwOLCW+oHUpQZU9FWevxDTQmVzukxff Ii76tlMNCY70uWztGc4vo/h8mXCob/453VsWhrivb7JhJpd1X+MdTYp3GTPJO9++ 67dK2zS39M1Aci4skE85SYKfE0XSsihSATqDiVQik67U1DhT2Uazc3NbEL45Gl+b YUz7QGJ6nf5LDiDE2CmijaTPbkKYMB+u0Xd5tyvncKZaT1cKlVMuTuaI3KMYs216 r2h8M+4vuYLnmRgs4DH79a79FbQnyrwp5i1B8IkU/XH36WXC7vAnH5XMeh191y9K KnUoPZzzjbk4nxWngW3so2sl4E8MYDXNcXMJqIw5m23SV7PGvzY4rjHdXxsEtbp7 wP2CtY7PpWGIHrgqUb60Pm90HYMX8sHJfbyV17QK84Y8RwGDdzq8PKlBhHx9Xkkt kfQZFF0dBE/uc0j6WtPN6oCYKjsa5SmFr0AnocI7+7Z/hvhsFVlF5MJePWfmMQ0g hBnNXY2ecoZ2GUxt/WVCCLDObAZNEm90oAiF3OWON94DQIi7 ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damage of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/C624FCF7347A25A7

http://decryptor.cc/C624FCF7347A25A7

Targets

    • Target

      3cff33197edc918d47d08f44d6ddbdda157337f0ad58288d15746cf72c0e4c57.bin

    • Size

      166KB

    • MD5

      340b6f816bfdcfcb466cfc126c976844

    • SHA1

      e2e3adfcf621166a9f5bb7ee9795b7914cda2095

    • SHA256

      3cff33197edc918d47d08f44d6ddbdda157337f0ad58288d15746cf72c0e4c57

    • SHA512

      3e729878fe7ae2ea2f025d71d78226ddb5930b791143eb8c4ba4a7589d5944e5b0e37e8ffe1ea4983bbc66c71587e3a4b158b3e8a2b71ccbed2889c4778962f9

    • SSDEEP

      3072:1LFrb30BRtBZZg+i2ayy2RjLTuVyu7CJDgoMT3QLOoBB2W:ZJ0BXScFy2RsQJ8zgLOYB

    • Sodin,Sodinokibi,REvil

      Ransomware with advanced anti-analysis and privilege escalation functionality.

    • Adds Run key to start application

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Sets desktop wallpaper using registry

MITRE ATT&CK Matrix ATT&CK v13

Persistence

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Defense Evasion

Modify Registry

3
T1112

Subvert Trust Controls

1
T1553

Install Root Certificate

1
T1553.004

Discovery

Query Registry

2
T1012

Peripheral Device Discovery

1
T1120

System Information Discovery

2
T1082

Impact

Defacement

1
T1491

Tasks