Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

10

v2.exe

windows7-x64

10

v2.exe

windows10-2004-x64

10

Resubmissions

11/03/2025, 16:12

250311-tnqnzaxn12 10

11/03/2025, 16:12

250311-tnj67axnz5 10

11/03/2025, 16:11

250311-tnb6ksxnz3 10

10/03/2025, 17:20

250310-vwhtrssxct 10

10/03/2025, 16:34

250310-t3aaja1xfv 10

31/01/2025, 15:30

250131-sxp85azjcz 10

14/01/2025, 05:35

250114-gaenbszqam 10

10/01/2025, 23:50

250110-3vv2pswmhj 10

11/12/2024, 15:19

241211-sqgcmssnbr 10

09/12/2024, 01:54

241209-cbqprsxngx 10

Analysis

  • max time kernel
    3s
  • max time network
    58s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240426-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
  • submitted
    04/06/2024, 23:39

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    v2.exe

  • Size

    121KB

  • MD5

    944ed18066724dc6ca3fb3d72e4b9bdf

  • SHA1

    1a19c8793cd783a5bb89777f5bc09e580f97ce29

  • SHA256

    74ce1be7fe32869dbbfe599d7992c306a7ee693eb517924135975daa64a3a92f

  • SHA512

    a4d23cba68205350ae58920479cb52836f9c6dac20d1634993f3758a1e5866f40b0296226341958d1200e1fcd292b8138c41a9ed8911d7abeaa223a06bfe4ad3

  • SSDEEP

    1536:vjVXKif7kaCtHM7qpo6ZQDtFnNi+ti09or2LkLpLik8ICS4Ao3uZs/WVEdz725sK:J1MZwlLk9Bm3uW/Wud2K36cn/wCY

Score
10/10
sodinokibiransomware

Malware Config

Extracted

Path

C:\Recovery\c4i7645x-readme.txt

Family

sodinokibi

Ransom Note
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension c4i7645x. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/DAA1E987B2CAB117 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decoder.re/DAA1E987B2CAB117 Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: J34+Xdf2OojR6wb7Bu5n56HB7qpfd8JFkDCyHxur0JN3ne7Xsixz4Kp8l+lKn6PT /D6Se4suoyJt/R+LozQLCLxcESYpZ+KR0k1USz5VQrsWiDaGjyvhn9LgVJ2IQdIc QbTH+f01CLFgpjB2dUGu+UKR2DYudOE7IpdfpOgTnUpKRUE9/3ApcFkTRV7X3wAD w1HX6P6k47RGCcZ4tFjXVJsgA+UNwButNzbirpfI/GwQIMgOpN7ysLmcvVrcbLPT tbYlFP3exXyiV0Mz2Y4sRZSXLqVC+r4KZFE6LZTnUWJrXqBJoYjMQuq6aq6YgbR1 +fIuiqODKDfuPatutVkcypTtDmomwbNi76dFLZMxN3na1EMqPQmRsW9I6xQtoKoN W1zGKm0v/6bY3wQTYGLw8Ru/BoqXklq0o9p8QuDD6cDQZmNRXwVIBs34r9Vn6jxo w5ezU+RfP5I48enxPz5BAaeZTJ3d57nspt+84+ffHovLWaE7S+6vDeAxq/8jVjuc r6JJ08d/fofX86WvqGqMRYlkipSmKN3ZPmCd71ZJtlgZhHfNoKzacLsKyrfQ4mJo lSUMeQBVtyiE1CbvfQTMAd+PIns650NhNylKtCjc1LAe8zp20tpA1ui+OiE46VPO nNMO03PMPNvtH8I/m7g4LEwK22zW+8TenS/xehGqfzTuPlcvrU0QVWheQH1nPwNK +09BWmiqtF4ykqK8VwjxUXS6SWT7MwvzIW3I59JWD6zfvG17dgE1B/zOHaIiG5nt jhwRNoeYamIdRvAV3f7WqRYFyJ6peWRR8FTUFUhaPFPRCL2UFtgEwyMFW4WBUMPh TKi/kNlmsJo2AyzO5VbCBSwY0N+LOwQqqsvjJAUX8sJhcuwEZTj171PqwsTd8azF 3uzgafYGD44j9bioSdUze/pZTItvRESPEttrApHCG+1cdOEfwGLwhLah7c5nPQmu leT8RhZNFj4AkdzAiuGYbXrb0E0rP1MGul1Qobdr0ZbQ4Da6pRAWuuk6vbk4JdAz dMB5K3UAPIQRaN/L+omRrSbrw3JVRYVRQ6zRqIsiqf+apynD3tT4Xq1TyUwxGeeg Rk3yKXOGc43iASUsfzVhRKpQrqEvZ3x8hsb5OIkalRc5PK6Y5NDiJ7E6kHwIvDUs wSwM5k+8aycGstJnDoKVHz0euf4hlhJkYUpWqL5pW99K4EuO8j32D2Q993fpicYT b8vKL1MZkuVq3TZ8xBVWvkYdtGG5XtmDUY20740KjM2xy5Smo4P1eaiORmOi0KA7 HMVRmVX5vGffJtISucsYFiml53hgmrAc3iyov/oCjmJb01mXYdKYipE1vUKAtg8j eDvFOLqnEW4zmUYQbGV1qb3DoA0Y3BQxOuPxTo9RT+s= ----------------------------------------------------------------------------------------- We will use the data gathered from your systems in future campaigns in 14 days !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/DAA1E987B2CAB117

http://decoder.re/DAA1E987B2CAB117

Signatures

  • Sodin,Sodinokibi,REvil

    Ransomware with advanced anti-analysis and privilege escalation functionality.

    ransomwaresodinokibi
  • Enumerates connected drives 3 TTPs 24 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

Processes

  • C:\Users\Admin\AppData\Local\Temp\v2.exe
    "C:\Users\Admin\AppData\Local\Temp\v2.exe"
    1⤵
    • Enumerates connected drives
    PID:3416
  • C:\Windows\system32\wbem\unsecapp.exe
    C:\Windows\system32\wbem\unsecapp.exe -Embedding
    1⤵
      PID:4788
    • C:\Windows\system32\vssvc.exe
      C:\Windows\system32\vssvc.exe
      1⤵
        PID:5064

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Recovery\c4i7645x-readme.txt
        Filesize

        7KB

        MD5

        113e7d90aa655055a56d96ff5b3fe04e

        SHA1

        b775dd1f72abd9a485309ebc169bd4cd4dfbcfb9

        SHA256

        b031e7a7b4c64607c14acec2e856a136961e6c7041ab0e22e6dda071fa563671

        SHA512

        18b4018497772cd1cc8ae4908fd1441f939f9fc860e4bd85f2ffbd3967719830d20438c687879679a3a1c0d835104811414e9eecc2d0f8d242934cac83b675db

        Download Submit