Overview

overview

10

Static

static

10

2025-03-14...il.exe

windows7-x64

10

2025-03-14...il.exe

windows10-2004-x64

10

Resubmissions

14/03/2025, 12:46

250314-pz49aatrv9 10

14/03/2025, 12:43

250314-pydpya1vbs 10

14/03/2025, 12:42

250314-pxnths1tf1 10

14/03/2025, 07:46

250314-jmdmxawvhv 10

Analysis

  • max time kernel
    120s
  • max time network
    122s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    14/03/2025, 07:46

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    2025-03-14_b66ef055f69d2d1a1d8a6f7128cc34a4_revil.exe

  • Size

    92KB

  • MD5

    b66ef055f69d2d1a1d8a6f7128cc34a4

  • SHA1

    b0bdbebb93abe1c437d9b8f243368ca0de74603a

  • SHA256

    c7d0fa4e911df7241f9385a109ad4814d10fb640bb8151e7d1abeec1065bcacd

  • SHA512

    c052dd76b90cad8b5d40409d00ef41d3e75439edab7e6cb79d60ec98bd17af172e4e56fa031bf1cd5256d7baa0f6ea13648044da641df90e992f36432fe0d64a

  • SSDEEP

    1536:Y73nkB0DyMgQSm9NwcKzwpR+7JICS4ABwZ/gsZujGC:c/hKzstg5gs2

Score
10/10
credential_accessdiscoveryransomwarespywarestealer

Malware Config

Extracted

Path

C:\Users\w57vivpvb-readme.txt

Ransom Note
---=== Welcome. Again. ===--- [-] Whats Happen? [-] All your data were stolen. Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension w57vivpvb. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [-] What guarantees? [-] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practice - time is much more valuable than money. [+] How to get access on website? [+] Using a TOR browser! 1) Download and install TOR browser from this site: https://torproject.org/ 2) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/CDB85F8BF688EDBF Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: Jsa69R6+nxtE79MyxapZMT+ufLUV6XxZCy4br+VfSMoZI9y5rv/u9wn/A26e6Vz0 cbmTSoPa6v4FKbDEatalg9aHDP80CYf7uJZgaNHcSV9iNinRcfio+CS0/SjPp5Ma Kpr8HfDcqwIwj2GiPCFWL6mRtr41q6TAlZ5OvuN8u79r9IZ9jpAd1xTYV1MA/hAR g0l0geBcA6IVz3ar5x9mo1N/kzom+16+BT0BjbNqvQsrLm1CL/L+80yrL8mz2pbp E86QwJlqD05wfFdkRRoeAC8rdL/PNBXCQ3ykkLEljS6rRlMTZbEaZZwJfN7erlYa iOazSrRtrpPIkILdyCtfjd/wRS7af73A3q4IO0a1W9JRNvwBT1xrDPTWNrhlu6u/ C2TqsjPVJwRu78Wg6qpvj92dqftDXYHmNe+QzB3bFWz2EG+Xja/69v69+VwrWSI3 wX2V/XNvgX2c/eW2ZqCUryT5bUqjuZE7fZ3JSb/LK8PwJJP9l+djoaThVvzDQHGD R5sRoGdAp+2JKPtyfebVIBM7W1qxQILjDrluVXEu0N2JVSKswHl9f9btl3SiBVdj UPEuAivSZf3VGvAMf6q2nShIsJRYBNzRX9VraUQR5SmdWpL1dUQGii9TmctQ3HIa Pk1HNiWSt8/XC8d0hpLgx+lOqPO9w3eoYvRQcGtBtn8E3eW34esZlzjfmcTZvOEb omgyCWxlP441MjvNXkBwWpCi97dEn3kTctOb5IPyCVTWVTYSYcepTyPFXbvH3wiF //A1XeVVoVrZG50CbmN6DAt8rBYpxfsSIwjTItkNqAyUXw6P7lohA0tRIdy7yKza C6GutwdKDIAWdf7zwH9IjGfOYAhJPM4pKMvV5zN3AFEhToow+uQKOUXGDvler82i NV/+1cYpxAbImVukYkFWTt6r25WbR1u/1WDhFyebgi/Uo8JvxElX6Jmfx8aVWgSN 492Gq5nu6qyeglPDYo7jGI0X0zqgLiHVjVXJA8IR3E+OKNx/Sa0o6lX2QbXYYqtU zIkOyFZcQ4oQDXxFXpxl4XRRTRo/KD473jIdVYX1Une49+xZxPB25dg/ifqAHzWG TLmlEA/+NtuC7Aze+fEBnGymkRN2PhTXeqb8kedQw0BMOUQ4rIyMB+6wfnPNEGcS brTOY166lPIgucBl5ULZ5izcT63s+7ap9UJkXo2GAUTcBbCdREBxtxuc7xmeQpD/ 6z1+Yl9SxXX+5uUddzF08L1OuPTtY26ATIzdCLjaeneAu00UpvHPpl6qtmETz/QV MNR2bHw4KqZj+wyBWcs7LF2w77XVXQiYPRj7LXfuM1rMqARY6dlK8vBmfnEMe80p EFNHdCjh3njCjaaFX2WZ/q36ERisQzbJAFqzMQ== ----------------------------------------------------------------------------------------- !!! DANGER !!! DON'T try to change files by yourself, DON'T use any third party software for restoring your data or antivirus solutions - its may entail damage of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/CDB85F8BF688EDBF

Signatures

  • Credentials from Password Stores: Windows Credential Manager 1 TTPs

    Suspicious access to Credentials History.

    credential_accessstealer
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Enumerates connected drives 3 TTPs 25 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Sets desktop wallpaper using registry 2 TTPs 1 IoCs
    ransomware
  • Drops file in Program Files directory 26 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 5 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\2025-03-14_b66ef055f69d2d1a1d8a6f7128cc34a4_revil.exe
    "C:\Users\Admin\AppData\Local\Temp\2025-03-14_b66ef055f69d2d1a1d8a6f7128cc34a4_revil.exe"
    1⤵
    • Enumerates connected drives
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2424
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2424 -s 1176
      2⤵
      • Program crash
      PID:1344
  • C:\Windows\system32\wbem\unsecapp.exe
    C:\Windows\system32\wbem\unsecapp.exe -Embedding
    1⤵
      PID:2916
    • C:\Windows\system32\vssvc.exe
      C:\Windows\system32\vssvc.exe
      1⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:3032

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\w57vivpvb-readme.txt
      Filesize

      6KB

      MD5

      616be1b3707d71f9fc04e4773d4bcf0b

      SHA1

      996864fd7ca51394e6dc9956063ffb410a88c2fb

      SHA256

      ea55c00b074c1ceb141f1f06954b61e72cb7307d0b918aa52ebe05b6942bc2bd

      SHA512

      4ceb9326537ee514059cf7025a13a6f8aa1c7ecb7ad56e8641d5a8129ebaf7d68bf6180af14cd113890375aa889b3f85bcd8743979f175bdfe3594e2c6c4762e

      Download Submit