Overview

overview

10

Static

static

10

ffe7fe4532...95.exe

windows7-x64

10

ffe7fe4532...95.exe

windows10-1703-x64

10

ffe7fe4532...95.exe

windows10-2004-x64

10

ffe7fe4532...95.exe

windows11-21h2-x64

10

Analysis

  • max time kernel
    133s
  • max time network
    137s
  • platform
    windows10-1703_x64
  • resource
    win10-20240404-en
  • resource tags

    arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
  • submitted
    15-06-2024 11:58

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    ffe7fe45327645a48ca83b7dd4586de22618206001b7a7354d9d285e0308f195.exe

  • Size

    115KB

  • MD5

    63a945da1a63a8e56e8220c4ccf7fd0c

  • SHA1

    a99cf1a2426edeac97c789d0a4b7d38606d7aa45

  • SHA256

    ffe7fe45327645a48ca83b7dd4586de22618206001b7a7354d9d285e0308f195

  • SHA512

    34006d84587ea90e243ebe0dd6bde8bd502ed688001a412898cd4e4c16a5de5788a9fa4c53d3ea79e4307adaa74496e05b205bf9717ac833db976551b1a7c89c

  • SSDEEP

    1536:ikB/Ih3+7QuoZVQgf5GV2jSzGpAyZ4ICS4AwnfxnuLdSbSmoNUExd9M4dgS:gFW7gSzKDin5nWhw4dgS

Score
10/10
sodinokibiransomware

Malware Config

Extracted

Path

C:\Users\93z2w2j3-readme.txt

Family

sodinokibi

Ransom Note
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension 93z2w2j3. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). We have copied financial files and other important information about personal data, it will be published on the Internet or will be used against you if you do not pay us, so if you do not want such consequences as customer churn, media coverage, fines like GDRP and other damages, we recommend you to contact us and pay the ransom. [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practice - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/0846C4A22137B9D5 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/0846C4A22137B9D5 Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: ceL4M+s0tdpXTe65H075vuwqhPHwOi6vDcRWgkTA7VP4cLdMTb+SKVOT4H6zjmkC BErU4pka6T6nA/ZHoucAwS9I6xaR8kttAt3P74eMte3OCpoqUUofybZFwYN0yI0u yQi8/zLSYkjNSy0ZjppYIqBxTNQsLIbIg9Gi9HrY2ykk28IHUFcRuHIBWGBvKcsZ Gbx23BFJ9VOfDya/yhafzfvePvmfJbCp7h01gCVnsVv7eENqU7X/Sh3/XFCfctBW Gz5NEigZdDS4pC5M33mQ89HD3/tK77s/CGLoFkJWGnM2MqXfLnAH5fyt2kfIci1k DkbvM1oW5oJeLdIePZC/N5Wal7P2VkRNh8s/SZo1o89b32h616vd4ckm7aoThSp9 juiBZm4NiqDtiDk5DVozJWQ38ZyeK4Es5UEwew7hG1teBXuMdAMYahkfLukc2YRK NJduezd7uAO/BZ9emMmCG5mSGdVtrQXmxIGYgreJ0SKW7HQ+Cr9pJwEQvn4QBvwH g2qzstcRU6eF/ASEoMbOUYrVUhIsMt2vDPw9/5E8D+XY65lRQV2dfi60TIfcsZCu AJPxNyXM7OWb2Oo7fjstMcQDSvDggyM92PB//EHZC29sAkvHYyBuUtXHfz4pEMnO 3rgjQzZg2IY3U1ncwT0StieV0F4ML3yKU7enTmtaoW2UIrlKOldtuLDoHr88hR7m P6u39jOZJhPRw1pIMULVfsH1jj/OvBiyPpW/cLTJ3KpRPAG87QBHu8O4UECZ33Ls 322lW/sIORfyJPh48w7HIqL163zQ4KUAphqE3TcpBz0CPtAa/sOXGUhdAtI4sGoX WtH2gOw3g5Zp+jJjf+6/h7wI3QU4QCFmHnr3NvUlVUf6WXCIso/2GWsu6UnmTORs APVlfUXT8bo4lpT7flGAoeiRdWh8EsI4J+BXbdAqFc31ZUBwXoWygX7ssHGBZTyM ivR10n34ovdZEBe2kzOr+E3T3Ru+IGiNviHmbLl5X6FgEMS+Ukk5Aia3kxbrK6o2 BcruwPX3gUFGnW4BVL3iBzvdFUOlrWH9tWKxN16Jg1Lq9OwF0iCN/BSXQhI0/1Zq l4JKW/exmwSE+6NUccG2+IfVrLPpYis/zWJlL8nWvsURJr1Bo00zhI0EwYzG3Xnr aHacZ8s2LuYj5KbeZE8Vtzw2qRphHFvePD5xfsGxKe5lt+QKoGlmIdRkbGW5Bwqu licWN6WQp62dROTqlkqgIhBIauseKcYjYyHa6YM22iWpk4OJc41bspX5o5lucN0d FcnEKr5xtiQQXVki8wbxXmjQ+9OEGW8vYmWVeVvfq8DIcmeZAGAwJ9Zg72Vk4i44 BsctSbJZeCKHjQWLCkcffa+GHHE9+3lWWpatwQ== ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damage of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/0846C4A22137B9D5

http://decryptor.cc/0846C4A22137B9D5

Signatures

  • Sodin,Sodinokibi,REvil

    Ransomware with advanced anti-analysis and privilege escalation functionality.

    ransomwaresodinokibi
  • Enumerates connected drives 3 TTPs 25 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Sets desktop wallpaper using registry 2 TTPs 1 IoCs
    ransomware
  • Drops file in Program Files directory 37 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 6 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\ffe7fe45327645a48ca83b7dd4586de22618206001b7a7354d9d285e0308f195.exe
    "C:\Users\Admin\AppData\Local\Temp\ffe7fe45327645a48ca83b7dd4586de22618206001b7a7354d9d285e0308f195.exe"
    1⤵
    • Enumerates connected drives
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2820
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -e RwBlAHQALQBXAG0AaQBPAGIAagBlAGMAdAAgAFcAaQBuADMAMgBfAFMAaABhAGQAbwB3AGMAbwBwAHkAIAB8ACAARgBvAHIARQBhAGMAaAAtAE8AYgBqAGUAYwB0ACAAewAkAF8ALgBEAGUAbABlAHQAZQAoACkAOwB9AA==
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:4648
  • C:\Windows\system32\wbem\unsecapp.exe
    C:\Windows\system32\wbem\unsecapp.exe -Embedding
    1⤵
      PID:2732
    • C:\Windows\system32\vssvc.exe
      C:\Windows\system32\vssvc.exe
      1⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:1388

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\93z2w2j3-readme.txt
      Filesize

      7KB

      MD5

      2ab808d861b1e618d6611ff8dce9bc71

      SHA1

      c9afb807887fc85a5128be2f75d4d3d676fece71

      SHA256

      bf04e4001e0f6afac785b833cf21ecccd480077094b372a8d8ec87a5f4291075

      SHA512

      f2d66a1ce7b5c839af09c19e1464dad22ef423f76caa4a61696d60e4eb76b355c42aa2cc855fc9376a4b9197f421570b5d0f7f6dc70027331d92ddee3a8723d9

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_ysidsrce.kjh.ps1
      Filesize

      1B

      MD5

      c4ca4238a0b923820dcc509a6f75849b

      SHA1

      356a192b7913b04c54574d18c28d46e6395428ab

      SHA256

      6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b

      SHA512

      4dff4ea340f0a823f15d3f4f01ab62eae0e5da579ccb851f8db9dfe84c58b2b37b89903a740e1ee172da793a6e79d560e5f7f9bd058a12a280433ed6fa46510a

      Download Submit

    • memory/4648-3-0x00007FFD5EBC3000-0x00007FFD5EBC4000-memory.dmp

      Filesize

      4KB

      Download

    • memory/4648-5-0x000001995A2A0000-0x000001995A2C2000-memory.dmp

      Filesize

      136KB

      Download

    • memory/4648-8-0x00007FFD5EBC0000-0x00007FFD5F5AC000-memory.dmp

      Filesize

      9.9MB

      Download

    • memory/4648-9-0x00007FFD5EBC0000-0x00007FFD5F5AC000-memory.dmp

      Filesize

      9.9MB

      Download

    • memory/4648-10-0x000001995A450000-0x000001995A4C6000-memory.dmp

      Filesize

      472KB

      Download

    • memory/4648-32-0x00007FFD5EBC0000-0x00007FFD5F5AC000-memory.dmp

      Filesize

      9.9MB

      Download