Analysis

  • max time kernel
    140s
  • max time network
    147s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    31-05-2024 11:32

General

  • Target

    30d7bf239c612f655136b3b6956067905cdfb61f03abbbd785cf4cbdfac43ef8.exe

  • Size

    324KB

  • MD5

    cbdedc1f3a4f57b61ec2d497ba18ce1f

  • SHA1

    d3cd6370a4936a1366bc19443616939a6f24c410

  • SHA256

    30d7bf239c612f655136b3b6956067905cdfb61f03abbbd785cf4cbdfac43ef8

  • SHA512

    879b0a23939c8b0f5e6f73968d7a55c79b292deab6c70995bc57cc0b861dc306c94c6f915b580d1eda8e7ebdceea11ea81aba653000f8f4d3d0daf39071c789c

  • SSDEEP

    6144:ayiouaWCsfHt29qABThGvGJKCQcXkqE92RIUF6gXuRssjL8j6tFpJXq0AIlN1X:frtxsf4TcGKCFI2JT+9u6jpJa0NN1

Malware Config

Extracted

Family

sodinokibi

Botnet

$2a$10$gY18iotaXYmlrMg1kdA1A.nn.3UCuyrtv2KK1NDgXEMdKfXHHwDK.

Campaign

7295

Decoy

femxarxa.cat

mooshine.com

classycurtainsltd.co.uk

bookspeopleplaces.com

zonamovie21.net

waveneyrivercentre.co.uk

real-estate-experts.com

tigsltd.com

galleryartfair.com

herbstfeststaefa.ch

readberserk.com

waermetauscher-berechnen.de

haremnick.com

mariposapropaneaz.com

luckypatcher-apkz.com

slimani.net

greenpark.ch

assurancesalextrespaille.fr

cite4me.org

gymnasedumanagement.com

Attributes
  • net

    true

  • pid

    $2a$10$gY18iotaXYmlrMg1kdA1A.nn.3UCuyrtv2KK1NDgXEMdKfXHHwDK.

  • prc

    isqlplussvc

    dbsnmp

    mydesktopqos

    msaccess

    synctime

    sql

    steam

    agntsvc

    thebat

    sqbcoreservice

    mspub

    firefox

    tbirdconfig

    infopath

    oracle

    thunderbird

    xfssvccon

    visio

    onenote

    wordpad

    mydesktopservice

    ocomm

    winword

    encsvc

    excel

    outlook

    ocssd

    powerpnt

    dbeng50

    ocautoupds

  • ransom_oneliner

    All of your files are encrypted! Find {EXT}-readme.txt and follow instuctions

  • ransom_template

    ---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, stolen, and currently unavailable. You can check it: all files on your system has extension {EXT}. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/{UID} 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decoder.re/{UID} Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: {KEY} ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!

  • sub

    7295

  • svc

    memtas

    backup

    sql

    veeam

    sophos

    svc$

    vss

    mepocs

Extracted

Path

C:\Users\pr61z-readme.txt

Family

sodinokibi

Ransom Note
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, stolen, and currently unavailable. You can check it: all files on your system has extension pr61z. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/5D45199BC8A0FB68 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decoder.re/5D45199BC8A0FB68 Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: 0sqPe+vu03A86uLRnuGbHXsix7m1V1HfIaWUTTxZDOSPLxrHa+kQWzZgJSWt6sj/ RDKhq/oZPuh02+oIbg+BrIvQfZeF3AJmpIl6Y6yN+UnoQENBHWmAf6m4uqtz3yB2 JrD9nhU2EqcYjVTLnSLDIolT/dZniLiNBIxfxU3+/s9ByCpf9Qs0onsioS9OSCsY vZupbU7EVE3DvFaPPjKPkuIL3GO3aifO8n7svsJGBVfHgiaW89BY89tmjDIBZMVo m7KSvSM5sqzPZarsSsYMLoOzBcVjOqHpgL1LHeugbhstVzt8SscWgJQo80L9OzW6 SwBwdo5sh8Ydknkf6+Uo2ZKOhFYGuPqL6Z8AYae/k2lZCdCc07/RF08YG740dFyP OUWjZ704c1O73y9G6SMBPqb0r3iWwH0/fYwL/VDVPXf9lRsrG8Kt4DiebbUVpM9J Wqdsmjm/4KuE6Qo0iFlVd8HmwiH1cbW7jWCiTg3HKUA7jdoQefj4C7C/WB9LP9zI hrEPy4MhEb3TEKEKNI1UIxKKW7E6X37zCleijYU0kLWyGxw6NLKEV4tfFvUu2IR4 A9eGfoZH7Vrgm++43+6CgNmGCMA9awVBXiM6R9LWkGDVYW2PNuHE+cLVPXj24mR4 AhToMKFrEQuhzDT5aUIlrmBgMFLC358CyuceNI1eY61SytelEqa2s+wqzBCW7Vt/ FDtqyfTcVf1/gFVv2KFArZ3Y+brf76oSSDBsQCnhvNmSQ8fhEmR5vHeDADMmW/K3 NhSs3e7vyvyiPeWg58AnhDWuD+yBbgMwl7QZ5/HHnvEvmeZRci8GxLXgWUnqtTmW ov+qLyRFh5t0bgXzo6DmnL/6WaCVYNAN8bXsz3VrMaWih/dAIrpe3TLraSsGFiuI 37evXVdFYXJcw8+d+AijgLQOxoNs1KXhx56TPeAx6+JeACXtQY8DjrXCXi1RwOQe 1p3mR5xv1HSpSL9Hy3yJIE/nAy8LfqZsmxgqjKqxkWdyhaGDXUMb1W3c6szziD2f QPv4l2a3rsKenpQ7tTo10PVOWodHHVJ/RHckJvpLr0P03XmL+VCuiiEFAhWYZhIR gaauGm0JwAqDBll1tzUgNO5cJhjRCh1mAcAR8r8a4SZkt4yZe4AliE84D/RgVg4q MBcjgSGI+EG3GY4+dmCaqa76QktJaxzHpS/ylZM3Thjg5n/JQJdA9mvT+C7meY2Y NwiYQdwK8N4jBr+fNjjvU4hnHM5IHv6BLMYThViac9zW1VTutgOnGKfXVE9Clf23 OSQtpfrSFeiCAN58VhRaCuoeC+BMZsznYfrg/BMIj3Q8g2Cos0PAi8rpMyQP+jsL HwppZnjusw/ZCJAuGps5OS50iRE= ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/5D45199BC8A0FB68

http://decoder.re/5D45199BC8A0FB68

Signatures

  • Sodin,Sodinokibi,REvil

    Ransomware with advanced anti-analysis and privilege escalation functionality.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Enumerates connected drives 3 TTPs 25 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in System32 directory 1 IoCs
  • Sets desktop wallpaper using registry 2 TTPs 1 IoCs
  • Drops file in Program Files directory 28 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies system certificate store 2 TTPs 4 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 5 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

Processes

  • C:\Users\Admin\AppData\Local\Temp\30d7bf239c612f655136b3b6956067905cdfb61f03abbbd785cf4cbdfac43ef8.exe
    "C:\Users\Admin\AppData\Local\Temp\30d7bf239c612f655136b3b6956067905cdfb61f03abbbd785cf4cbdfac43ef8.exe"
    1⤵
    • Enumerates connected drives
    • Drops file in System32 directory
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • Modifies system certificate store
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:2388
  • C:\Windows\system32\wbem\unsecapp.exe
    C:\Windows\system32\wbem\unsecapp.exe -Embedding
    1⤵
      PID:2884
    • C:\Windows\system32\vssvc.exe
      C:\Windows\system32\vssvc.exe
      1⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:2496

    Network

    MITRE ATT&CK Matrix ATT&CK v13

    Defense Evasion

    Modify Registry

    2
    T1112

    Subvert Trust Controls

    1
    T1553

    Install Root Certificate

    1
    T1553.004

    Credential Access

    Unsecured Credentials

    1
    T1552

    Credentials In Files

    1
    T1552.001

    Discovery

    Query Registry

    1
    T1012

    Peripheral Device Discovery

    1
    T1120

    System Information Discovery

    2
    T1082

    Collection

    Data from Local System

    1
    T1005

    Impact

    Defacement

    1
    T1491

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015
      Filesize

      70KB

      MD5

      49aebf8cbd62d92ac215b2923fb1b9f5

      SHA1

      1723be06719828dda65ad804298d0431f6aff976

      SHA256

      b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

      SHA512

      bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

    • C:\Users\Admin\AppData\Local\Temp\Cab44EE.tmp
      Filesize

      65KB

      MD5

      ac05d27423a85adc1622c714f2cb6184

      SHA1

      b0fe2b1abddb97837ea0195be70ab2ff14d43198

      SHA256

      c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

      SHA512

      6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

    • C:\Users\Admin\AppData\Local\Temp\Tar462D.tmp
      Filesize

      181KB

      MD5

      4ea6026cf93ec6338144661bf1202cd1

      SHA1

      a1dec9044f750ad887935a01430bf49322fbdcb7

      SHA256

      8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

      SHA512

      6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

    • C:\Users\pr61z-readme.txt
      Filesize

      6KB

      MD5

      3450e5dbb039bda5b4cd0d900c040870

      SHA1

      097618cb97f140b3fcc26d77e679c50ad01c21a1

      SHA256

      287b8831505e6d0ce43d4ba59a080701f95d05f8625343884492f739c3975798

      SHA512

      22e4e8a383a402102f90a003ae20276be511aced2341396b4c4d7c052e5309754f70078f8e93f93fe85f7f4c5ad037b1cc89884ae523ec0cf334595ddade0db9

    • C:\Windows\System32\catroot2\dberr.txt
      Filesize

      192KB

      MD5

      4214201fa9df6d293f9f131a37d5f203

      SHA1

      202203741b22dd385bd0ce1ae64676a4b27c89be

      SHA256

      50eb1ab28625258cdb6c589d9cd3854c9e002a1e2339510da6fd4fcfd7d38849

      SHA512

      4506961328f3e02ab872951338abdaad0ea8f45c70eef003875bf1da6fcc87a630ed2ac84127ace0fec8b4fd0e48cd8eaec27b4cfdd9856aea0c899e4924a322

    • memory/2388-474-0x0000000000400000-0x000000000043B000-memory.dmp
      Filesize

      236KB

    • memory/2388-476-0x0000000000400000-0x000000000043B000-memory.dmp
      Filesize

      236KB

    • memory/2388-8-0x0000000000400000-0x000000000043B000-memory.dmp
      Filesize

      236KB

    • memory/2388-9-0x0000000000400000-0x000000000043B000-memory.dmp
      Filesize

      236KB

    • memory/2388-7-0x0000000000400000-0x000000000043B000-memory.dmp
      Filesize

      236KB

    • memory/2388-10-0x0000000000400000-0x000000000043B000-memory.dmp
      Filesize

      236KB

    • memory/2388-1-0x0000000000400000-0x000000000043B000-memory.dmp
      Filesize

      236KB

    • memory/2388-457-0x0000000000400000-0x000000000043B000-memory.dmp
      Filesize

      236KB

    • memory/2388-458-0x0000000000260000-0x000000000029C000-memory.dmp
      Filesize

      240KB

    • memory/2388-459-0x0000000000400000-0x000000000043B000-memory.dmp
      Filesize

      236KB

    • memory/2388-471-0x000000000040D000-0x0000000000410000-memory.dmp
      Filesize

      12KB

    • memory/2388-6-0x0000000000400000-0x000000000043B000-memory.dmp
      Filesize

      236KB

    • memory/2388-475-0x0000000000400000-0x000000000043B000-memory.dmp
      Filesize

      236KB

    • memory/2388-0-0x0000000000400000-0x000000000043B000-memory.dmp
      Filesize

      236KB

    • memory/2388-477-0x0000000000400000-0x000000000043B000-memory.dmp
      Filesize

      236KB

    • memory/2388-2-0x0000000000400000-0x000000000043B000-memory.dmp
      Filesize

      236KB

    • memory/2388-3-0x00000000002A0000-0x00000000002A1000-memory.dmp
      Filesize

      4KB

    • memory/2388-4-0x0000000000260000-0x000000000029C000-memory.dmp
      Filesize

      240KB

    • memory/2388-5-0x000000000040D000-0x0000000000410000-memory.dmp
      Filesize

      12KB

    • memory/2388-605-0x0000000000400000-0x000000000043B000-memory.dmp
      Filesize

      236KB

    • memory/2388-607-0x0000000000400000-0x000000000043B000-memory.dmp
      Filesize

      236KB

    • memory/2388-609-0x0000000000400000-0x000000000043B000-memory.dmp
      Filesize

      236KB

    • memory/2388-656-0x0000000000400000-0x000000000043B000-memory.dmp
      Filesize

      236KB

    • memory/2388-658-0x0000000000400000-0x000000000043B000-memory.dmp
      Filesize

      236KB

    • memory/2388-660-0x0000000000400000-0x000000000043B000-memory.dmp
      Filesize

      236KB

    • memory/2388-662-0x0000000000400000-0x000000000043B000-memory.dmp
      Filesize

      236KB

    • memory/2388-709-0x0000000000400000-0x000000000043B000-memory.dmp
      Filesize

      236KB