Overview

overview

10

Static

static

10

81689f1be9...ed.exe

windows7-x64

10

81689f1be9...ed.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    94s
  • max time network
    97s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240709-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
  • submitted
    15-07-2024 10:39

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    81689f1be92c8fb7e94fe241441c7eb43cfb77c6d23592b0248566bd709ff2ed.exe

  • Size

    115KB

  • MD5

    7e18b037a068c56417fb8e56aa7e49e8

  • SHA1

    f6739569a24358c8c060d7131be70712f70f36e0

  • SHA256

    81689f1be92c8fb7e94fe241441c7eb43cfb77c6d23592b0248566bd709ff2ed

  • SHA512

    d6188e5536b6e0b5c49d572e35155d633c11fd30bc8d4bf4ea87fea7196ae2f67bca364a0afaeed8209e5d4b2be0b98d81c49293d3fed95c70c8388b8387899d

  • SSDEEP

    1536:AkdeUcaK8Qz4PQIUnq5WMrAmyopACC9ICS4A0vh4NKwTNA28V5/Ogsck:mlnXEXyk7yvh4NKwTNF8V8v

Score
10/10
sodinokibiransomware

Malware Config

Extracted

Path

C:\Users\2er64-readme.txt

Family

sodinokibi

Ransom Note
---=== Welcome Massive Prints. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension 2er64. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practice - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/FAC260F1451E1E82 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/FAC260F1451E1E82 Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: Hx0yCKRxh9IXpnwYhXZc1ItSTeDA/t59ZItrSspVNYBOD5Djx9E32EWxQVe+kAIj RRe0PE31r8Fbx9ow6Tm8I72UYyiSaOjOJUGSYgAdfQuDGJwKMUhMd1e8kxVVkNTz sPnc/xu+nR7BnEx9y7oScNpH2oiGG9mIXrQGA2oGVKA6ZpygYjn6YCEomSDqSjaR esf9zyP9YFjCqU4B1CsXu3t2/lCmBbfWtoZWYO7bLHkb1IiIC76IUxsV/IyPDUPs GM5EZnSqhyVvaE0kpz+K6xuX1xhcFXqOyNoOYzPtPZP35MONvwvLO0vrNmVZWbVg WH3J6GGnwdlqdQTLNKvALbwyWUM7QmKa2NDWbgqdR8zLmGZpBil81KNrL8i3bgWa 1Cvg3h2K9V4gtb1zAEXCjTen4qI0bDuPlkKm73zCPEn0zZsHxGI600/JMcy74g0w 6WvuFDpUYPUIIznLJlZMxiejx53i/zdzfNnhxQen1Vvdq+2zWRoRpcfRk0MqAsCm zVKv+VpNPrezzlytcbpTSJAB50uSh+lxWYcVNWgWif+ErgMDHyGGT2+QHkWDA00d vV6wwDVPXsU6qV9CWOeQ58JpprS+wRsd7aDFCPkvgAiOdCOyLbhL5fmv2M96/+q1 THKAESWDRI4vDDHX9xmy23suEfyCHJTlo1H2EfftfDGDzvKouBn0yCwQDgFSzuxk Df4Mp5gTlu7wkFeb76W+p3kRMi6/VqjT4C0fVhcj/jcl8hLOSdUN8/WXlHQLT+Wu wiGXAQ3SCb91+K2MG0FJ9NK9qC6Ow7UCVBgPVCG1q5XjN2YXZQNnQKiqmq8Zyyil BF3NQ37RkLg/T/sM/gBkwL0mGm+p3xk5S8VwjPV0Sb3SwbiO88oz/JvLIsEJD3u5 m5Qpv3Iy9mqf3scKIodh3yt0hjYjzuAb8Db0vJMi9TTN5s2H2fGiXk/GFaXoxSEr JzFLYO/TARM+URyNrUttnzqAMl9O3WwlGTZwGQHo5+uhxqc9wIkfaAe3njypvN1o q8kvnTzIhoGXUr3nFp3G7F/+PJYmcPxHF/YvzUQejWWkQYrdQHvPSYCPkLArp/nv hF3oJJi+DlQT3WyiA3U/NTqB0pLjYMrdHPjCMR0b2XNEEYwmBxdf3BqiKaNui9NZ 3U9J3hYahk/Ka3LLXCU/2heO9EIOZu/hw+mGfM3z7DMWkAWyixwHqJBaj+qixX6a dhpSzYzOxP6CrB1Y4bdew6sCmPbxQNZUDjzZUt8f0Br+mIW2mksKo/OpRa0SGnAi Yqb0tDvPRIFat7dpiiWPTy8xehbfhQW1FWhMT1ufelyrqeghtdVaCOmJRl/Azl2L Gxs+GidrDRXfutqdFiv2M9pIJ0X0xZuQD0GSgdBafgwsSt8Q ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damage of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/FAC260F1451E1E82

http://decryptor.cc/FAC260F1451E1E82

Signatures

  • Sodin,Sodinokibi,REvil

    Ransomware with advanced anti-analysis and privilege escalation functionality.

    ransomwaresodinokibi
  • Enumerates connected drives 3 TTPs 25 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Sets desktop wallpaper using registry 2 TTPs 1 IoCs
    ransomware
  • Drops file in Program Files directory 21 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\81689f1be92c8fb7e94fe241441c7eb43cfb77c6d23592b0248566bd709ff2ed.exe
    "C:\Users\Admin\AppData\Local\Temp\81689f1be92c8fb7e94fe241441c7eb43cfb77c6d23592b0248566bd709ff2ed.exe"
    1⤵
    • Enumerates connected drives
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • Suspicious use of AdjustPrivilegeToken
    PID:4432

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Query Registry

1
T1012

Peripheral Device Discovery

1
T1120

System Information Discovery

1
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Defacement

1
T1491

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\2er64-readme.txt
    Filesize

    6KB

    MD5

    11304919c5790f4c27a481464b87a486

    SHA1

    793899dd2e9f2165c4d4162ba92b8779beafd156

    SHA256

    d643b8c17646190ce35e9b84b73bfce5f30a278d930fb5f6d943f4f6e74b70d2

    SHA512

    aadbb6eb31467e5ef64fb64224ce6cc9fd982b888c90a89d9c6a1d5abfb028ad519a8a03eb719f4f556dc94b54b43d099e35018fec025f0497821f099232c5ed

    Download Submit