Overview

overview

10

Static

static

10

v2.exe

windows7-x64

10

v2.exe

windows10-2004-x64

10

Resubmissions

11-04-2024 17:53

240411-wgrc2agf82 10

11-04-2024 17:50

240411-weydkagf52 10

07-03-2024 21:32

240307-1d2rtafd3x 10

05-03-2024 03:22

240305-dw4ykadb7x 10

26-02-2024 08:40

240226-klbmlahd92 10

25-01-2024 23:42

240125-3p3jlaagej 10

10-10-2023 00:01

231010-aaxetahb7s 10

14-07-2023 13:07

230714-qc385seh7w 10

11-07-2023 13:35

230711-qv314aad81 10

Analysis

  • max time kernel
    150s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    05-03-2024 03:22

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    v2.exe

  • Size

    121KB

  • MD5

    944ed18066724dc6ca3fb3d72e4b9bdf

  • SHA1

    1a19c8793cd783a5bb89777f5bc09e580f97ce29

  • SHA256

    74ce1be7fe32869dbbfe599d7992c306a7ee693eb517924135975daa64a3a92f

  • SHA512

    a4d23cba68205350ae58920479cb52836f9c6dac20d1634993f3758a1e5866f40b0296226341958d1200e1fcd292b8138c41a9ed8911d7abeaa223a06bfe4ad3

  • SSDEEP

    1536:vjVXKif7kaCtHM7qpo6ZQDtFnNi+ti09or2LkLpLik8ICS4Ao3uZs/WVEdz725sK:J1MZwlLk9Bm3uW/Wud2K36cn/wCY

Score
10/10
sodinokibiransomwarespywarestealer

Malware Config

Extracted

Path

C:\ProgramData\4ill810-readme.txt

Family

sodinokibi

Ransom Note
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension 4ill810. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/11007FAF1E8AC359 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decoder.re/11007FAF1E8AC359 Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: 7Pb5C7vkiAp9PcI6d7XCv3M2OFgd0nqquaeaqcbQx73N19cZsYCUNhsO8lB+yrWw vi3kREWsMrXXlnglQ/n/8AFmtEbgkbzaTkKIu6tRChSm59WhDQBSNdNM4PHB27Oy ID8HrbCy8GCiXh8Y/1MLtvWddN5LC6ogMneAlI2HRKZp17VS9bMaIRLZWyK3mEyf UY9AM8HvLQb3hqX1on8wK8ZCPJlfRcyRT51gy95WDWYoqS6gwNqC4Wm0jmCdwJt8 lU44ebxeqHonVpHNerK5Bs8DsKQXueZwotDhOWjioj+Z5n1qz2hw48mEEjOwd3NF cEAIvfrPmuMNSmxTFuAghnUKMRIR830hnyBgF9/j9lHxBkScki1JBBSqb10O+I3+ ZXdBFOuXEIdopmwExv35O9NALqwMg2cRohSwBguuKNu3vMUjRcF4mMKJxEjk13A7 nUnTql2dd9P0rNYreF1F6xG5yKX0X2r/pJX6aNNRBbAvKOJWrWQKW+F/DzcqJoJI zDoJk5sWBYZ57EHPTJnlNDU+HR54CguaVinRBwlc9jid/d3Oloj73G7/MlXR3Y/j YVtDnyh4B+sLyA9hzhhge4dwIc4KP+oQXiNeZCG0dzXutsugwSUKTbJX3N4RHAW8 1zTZ5YgFHC8jHai9+8t/OldxlJDqoIVg1xydqkK7XYHjufPaO6YXPf6Wiepcphdm EB2080N6A5t0CsxT0UfFV1VZE3lyot8q9OVQHj0s8cWC5N+boyy71G6i8hD4Qc0t F5fgmGl9OP+9RSQ83sa1Jy6LoRSMfgGAWn6z27if/6myTJdKNtiZMqoPm6u4qVRX jmgMvM/qiGKIaqrnwdvGNP+NBQMXmobElSH/g4F0W7rbS7Dm357czGj4pGjJ3flT j9tXpfDTWaOb84HndgKkZ59Xt4QgVtjpCcJGk9iPeHH76XhKhrp1oz/OH/Itb5qE dtUwEQRBEKYn1Da7SS54WJBAo2JAIyL3rwxLtOQ92s4a3wQH5g8ouY6y5b/b63+6 PV3TuIVU2amYErW/cTV6LP9aOA5LiaVDnEs+dnFF/NKRikmAq637foXb2SaL6k8S euJVETG74qTZTeDLctcqYpKu+5zEwRoryt2FpQIvMVo5oaF9xfxc1JNnU7ft2MTu maX43U06ZAV5tkzwu7V3X+q/nRnrr3nMHrCLN+QF0K2wW+OGNRXO9w1+C+H11Sbs kWMQwCtTv68lPuxaov2ZPDtzZ2HoEjmuxBKZvEeCfOzayCjQOGjwoJWFPZRQIRED Mn7yzC5DrKYGfJYKj5ti2yqbZv6xDD2KVji9O5VwI74CbuQxGyuzfnEDmT3rf5lv IOOT4Z/JnATiUeTMTmBWiD3mGbNNsQDKLzk0j/xC ----------------------------------------------------------------------------------------- We will use the data gathered from your systems in future campaigns in 14 days !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/11007FAF1E8AC359

http://decoder.re/11007FAF1E8AC359

Signatures

  • Sodin,Sodinokibi,REvil

    Ransomware with advanced anti-analysis and privilege escalation functionality.

    ransomwaresodinokibi
  • Drops startup file 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Enumerates connected drives 3 TTPs 25 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Sets desktop wallpaper using registry 2 TTPs 1 IoCs
    ransomware
  • Drops file in Program Files directory 28 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies registry class 1 IoCs
  • Opens file in notepad (likely ransom note) 1 IoCs
    ransomware
  • Suspicious behavior: EnumeratesProcesses 10 IoCs
  • Suspicious use of AdjustPrivilegeToken 5 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\v2.exe
    "C:\Users\Admin\AppData\Local\Temp\v2.exe"
    1⤵
    • Drops startup file
    • Enumerates connected drives
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:4872
  • C:\Windows\system32\wbem\unsecapp.exe
    C:\Windows\system32\wbem\unsecapp.exe -Embedding
    1⤵
      PID:456
    • C:\Windows\system32\vssvc.exe
      C:\Windows\system32\vssvc.exe
      1⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:2448
    • C:\Windows\system32\OpenWith.exe
      C:\Windows\system32\OpenWith.exe -Embedding
      1⤵
      • Modifies registry class
      • Suspicious use of SetWindowsHookEx
      PID:5248
    • C:\Windows\System32\notepad.exe
      "C:\Windows\System32\notepad.exe" "C:\Users\Admin\Desktop\SyncGet.ps1"
      1⤵
      • Opens file in notepad (likely ransom note)
      PID:5996

    Network

    MITRE ATT&CK Matrix ATT&CK v13

    Initial Access

    Execution

    Persistence

    Privilege Escalation

    Defense Evasion

    Modify Registry

    1
    T1112

    Credential Access

    Unsecured Credentials

    1
    T1552

    Credentials In Files

    1
    T1552.001

    Discovery

    Query Registry

    1
    T1012

    Peripheral Device Discovery

    1
    T1120

    System Information Discovery

    2
    T1082

    Lateral Movement

    Collection

    Data from Local System

    1
    T1005

    Exfiltration

    Command and Control

    Impact

    Defacement

    1
    T1491

    Resource Development

    Reconnaissance

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\ProgramData\4ill810-readme.txt
      Filesize

      7KB

      MD5

      cd71294a8774171a8e6f4309a8e1f6aa

      SHA1

      e34c7042df2d4e76cb6a5dbe87942deaaa7f68e9

      SHA256

      716d07e35cedd1e3da8610a21d52a085455877cfe91d9bc08aa3720302a7baa3

      SHA512

      89e54d714c586c538302d370c5e6fb4c9167028ce8f1afeeada46239afd7570866f6bc3ec7270f3e3520bc40a1d4aa384868cd0cba642d157324a21dd0327416

      Download Submit