Analysis
-
max time kernel
1563s -
max time network
1564s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
-
submitted
16-07-2024 08:54
General
-
Target
2896b38ec3f5f196a9d127dbda3f44c7c29c844f53ae5f209229d56fd6f2a59c.exe
-
Size
120KB
-
MD5
af94ccb62f97700115a219c4b7626d22
-
SHA1
bb67edcfe4e5b6fe09ee96e5b8ace7a4cfe39eb7
-
SHA256
2896b38ec3f5f196a9d127dbda3f44c7c29c844f53ae5f209229d56fd6f2a59c
-
SHA512
08c05f8dc98aba168734732d043c3e403f531522e0ec0ec64484d15375f353aa23f9654852ad2c54a3e6b2a9344f4ffb553cac24455f62bb65b55800e311c12a
-
SSDEEP
1536:J8A4krBJLarHZZd/M4PI8iwplAXpzK88ICS4Aer9DIPcG5zXbwMcClFyFfjRto2C:+/LPrlAZZE0cOzbwMflEBPo
Score
10/10
Malware Config
Extracted
Path
C:\Users\c5m3my215-readme.txt
Family
sodinokibi
Ransom Note
---=== Welcome. Again. ===---
[+] Whats Happen? [+]
Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension c5m3my215.
By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER).
=========Attention!!!=========
Also your private data was downloaded. We will publish it in case you will not get in touch with us asap.
==============================
[+] What guarantees? [+]
Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests.
To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee.
If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money.
[+] How to get access on website? [+]
You have two ways:
1) [Recommended] Using a TOR browser!
a) Download and install TOR browser from this site: https://torproject.org/
b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/21B59391D6165324
2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this:
a) Open your any browser (Chrome, Firefox, Opera, IE, Edge)
b) Open our secondary website: http://decoder.re/21B59391D6165324
Warning: secondary website can be blocked, thats why first variant much better and more available.
When you open our website, put the following data in the input form:
Key:
GEGVraz3zzDEPZzJ9hISOGLc/6IP1oT5UX6AX76y0zKrrIs71SaM1DHGLb8uEs/7
WXG6hACeFxvb4CN04gse2yFRoOQi9VQ4gVxJfPsjJwHVLJ0dXhWA0wc7t6IrMLtW
BhBK18Ctx1bPiyQpj26qEexM4E718C3scTC0N8/EImaLX74QEfwIJxuhXfFeVctp
nx/EW4ZKejBCDZodfMHjMdYoQFY2Co1dfpwNwkqKFMXZ/p4NIWmBeNJ23Z6wdJtH
TMegDsgSbWJY7rH8HniEXA6gZIe5cHsIGyDjeyowfD520kbADbN87iNyELJ5qaQU
JS9Xxt8sV0rGoP8UjVTaSZ1Ck/yAIIWWadr4DNL9G855NXFDZ6D9v3HULc0uU0yt
OK80JXOTSK2VZbXK2rjaVKaaAd99/b1abHWhiHAlfQwz294QU+Dv1/anxdg3hDqA
P/at1WYj5N5r/n+1bEdQ3YfueHX7Li2UvPHyCUrrgfa0+4LpEq4aEkqFMcQa1FvE
JOpSE/HGbDxyfAK6lwN/ZFISQb+z9F0ahEkMZsVqKf0/4r3BR5YPzaNgBaMHrfLo
ha7RYIZt2T0B+0w3Cv9LAvZkGP9IhwmGy/ogL3ZE1vV+pQsc10dqXnS1quq0jxeB
LO42rpAjJSxUqWekC5fi9uCTFvYNItqTGLNoFbJ8O2dPY6cSUtAlmk8hBn1izQz2
r96VYLtV/Xb5aLr//pLo+gRRIs+G8GOGe3Cb13oSmqFDmKuPnMVflR+R4BtT6qDV
6Qh9pZ1D3U4xFwyP0dXUmiTs2CdscCzoSmli6t4r2n+jNpkVUd4kcUghrMoxYaN4
aTPhl3qohJ242G9VbWLTBEynQd4cYmJgQ6a/y0HJyjRaeuHk8/FM/dDL5Xu/2HQj
ypPmEWTludYhntsJO7Lh/Bk8bwC46HmnM0EyVQyPrFcFxqGyZ5z/E3D5jCm/BgmU
881jsaXl7JKC0a6/h8JXCZi1Kprv/qsGlWdUNp1EracF+CoC1hPhqDfwZnC78fpR
tRRiyNGRuUN9OLlpTAzpb0qnRB0yq06JHjSkM34JR0VapVtUzqYE/DP2mDNVLY/m
xdeVnouvxbosDwkQS8pCu9XkiHolD0IZYwkQdfqxB6EMknQ2vtQkUbYfEp63UNHq
S6xyopc7bAPVShLlYtaN2U2csVLHS8t7Tb5JxeFsmXO929TonVH/2EhzdvRJxyOE
5eSSRyxMKWs2UsGjH61PyUJfmztksnzi1/3NsvWPHCbRdBPjdX8YKPrmtGoY2Y5+
GMSQLXTc/uBBQlhY/l6LxdqbAu91BhDxGVZEs4/Sr0heH3jm0Tu/oJNaVl6+t5hT
B7HdMBmKewGazJMKRHovTJYe1oOWwsYs6XgTJg==
-----------------------------------------------------------------------------------------
!!! DANGER !!!
DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data.
!!! !!! !!!
ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere.
!!! !!! !!!
URLs
http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/21B59391D6165324
http://decoder.re/21B59391D6165324
Signatures
-
Sodin,Sodinokibi,REvil
Ransomware with advanced anti-analysis and privilege escalation functionality.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Enumerates connected drives 3 TTPs 25 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
-
Sets desktop wallpaper using registry 2 TTPs 1 IoCs
-
Drops file in Program Files directory 28 IoCs
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 8 IoCs
-
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\2896b38ec3f5f196a9d127dbda3f44c7c29c844f53ae5f209229d56fd6f2a59c.exe"C:\Users\Admin\AppData\Local\Temp\2896b38ec3f5f196a9d127dbda3f44c7c29c844f53ae5f209229d56fd6f2a59c.exe"1⤵
- Adds Run key to start application
- Enumerates connected drives
- Sets desktop wallpaper using registry
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\wbem\unsecapp.exeC:\Windows\system32\wbem\unsecapp.exe -Embedding1⤵
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Public\Desktop\c5m3my215-readme.txt1⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
7KB
MD5bf7d02a39fdbf474e7faebd96bc2665c
SHA115ad2ce15edce3cc64cc2eb6a96e02dce51b4ab0
SHA2561f90d790d2f45ef934399dabec4172c311aaf77b768b591b1d4b733cede26953
SHA5128063a1bcacc68bf9b4e34fe133d5d3122a52be55cfaea2ed12972c80b08b6f126800559bafbeba289ae60bd95867cb4d66df990ab1d21bdbbcd79633e3e2d515