Overview

overview

10

Static

static

10

2025-03-14...il.exe

windows7-x64

10

2025-03-14...il.exe

windows10-2004-x64

10

Resubmissions

14/03/2025, 12:46

250314-pz49aatrv9 10

14/03/2025, 12:43

250314-pydpya1vbs 10

14/03/2025, 12:42

250314-pxnths1tf1 10

14/03/2025, 07:46

250314-jmdmxawvhv 10

Analysis

  • max time kernel
    133s
  • max time network
    68s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20250314-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20250314-enlocale:en-usos:windows10-2004-x64system
  • submitted
    14/03/2025, 07:46

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    2025-03-14_b66ef055f69d2d1a1d8a6f7128cc34a4_revil.exe

  • Size

    92KB

  • MD5

    b66ef055f69d2d1a1d8a6f7128cc34a4

  • SHA1

    b0bdbebb93abe1c437d9b8f243368ca0de74603a

  • SHA256

    c7d0fa4e911df7241f9385a109ad4814d10fb640bb8151e7d1abeec1065bcacd

  • SHA512

    c052dd76b90cad8b5d40409d00ef41d3e75439edab7e6cb79d60ec98bd17af172e4e56fa031bf1cd5256d7baa0f6ea13648044da641df90e992f36432fe0d64a

  • SSDEEP

    1536:Y73nkB0DyMgQSm9NwcKzwpR+7JICS4ABwZ/gsZujGC:c/hKzstg5gs2

Score
10/10
credential_accessdiscoveryransomwarespywarestealer

Malware Config

Extracted

Path

C:\Program Files (x86)\vpk2054fa-readme.txt

Ransom Note
---=== Welcome. Again. ===--- [-] Whats Happen? [-] All your data were stolen. Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension vpk2054fa. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [-] What guarantees? [-] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practice - time is much more valuable than money. [+] How to get access on website? [+] Using a TOR browser! 1) Download and install TOR browser from this site: https://torproject.org/ 2) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/57A7CD721AC3E501 Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: DPFax+eluAf2F+Ksl6sYpWVOKoVJi21PeTKizQuY1n4ssfVswBbkiXVsVuKQNeCx KU4TlGGGLsNCMiY/IOxwTQ7NkYPlIVglIdWz7W6Rik7B/znWExvB/XFIWHn2Rnd3 bGqullP1wkTMi/YMAnZRulfvO4G0yDaSejWloKOBfE9Poj3QGtbyIhfCDcTlt332 q46Q8HAxKroohm3IZgCEQsP+gTd72a//RrPhaXozqNTkK/I/Cw023Ui7gPM0JOpU LsVOFBDDGx/A3n94Ku+SN6FQuygzNvIHpmDlhxri6xsOP+xAfDa15ca9bSYaIlda Grk4t9bIRdua4pGO70DICr/Uw2QlYIGdIwJeF1hPCST2A+j9a5jOEsdIlcQwyBpm ivqpa6kZn4HZ73Z9HkuH8dtpQLFTBgtgtWQ6GvQrTKcOkk1vC/Krb38OfybMZPJh JCDg/JZLPKqaELHvNVU2Bwyq4Z6FlfqBcl8wO38v9KC0132e63xbgbXulAm/EkqP GYYHRPJgOBJ3EiOgy94EoYAVf+L2mrvVLxWqS1L9FqOoxaVSPSNEH3bZVatxLzFj +NtCOv4JsE37KxjH8HhKDH63LeaRkFF23L2LReG9ZCohRSZS97rGVVBEwLXoyfys EiZBLu0xpFSttp7Dwwc+TvXbSOOXqIK/1i0xlU60MTvXmm6rw3LW4qdchrBgtbuA oydSn3e/cPntntgOt4cQ9q4cT/6coDOlu9VxWXifKeoBxTmH5A9KQuDDb8iIWAxz Kad952kxHsg6Db1p5e6JrEbPKE/dAYrOFlRRvuadKfTo2lDESFNFhYd54EwhCPll vVVKzREtOZfosCynsO3TfNAoG/qO8JpGzE7ZQGRAeC3jn3pKHnVOno15/7fxa6m4 Lo7aTbp19+pMxWiwTGooCUfyxwDZFDZoH3jsDVqUxuYEfPey3WwowcZF0yWRv0bV xZAMNxcJmSQJbsAWarDQdpR4DxTxiJRpTCmfn6cblTMCEmfVspx/B4dLeEDAOwdU Jrxm+0TLAWU6uN1ZmNed076Hm2+KZyIijAG+f1n9w1ERWnfD4Xpv0hiDaYxvQOZq 3z2YDIJKIAr29Czklir+Z5P2gqpU79vVgCqsD2bD3vTEdp3GCjCgJOP7BC4h1E0J 6zG/QLxKMv6bJOoZccIG5XdOLRST2NUUyEHauAS59FVNVencWtLe3mJGPju6WHdW jqqqtGaVVcFC3Etn3C51mlwsTG6oMtYuAJ57VDZgDKnJBLC6ntCIWanxbYd0v4d6 PwHsnf2qy/4Vr6kHvd3BlB0zxeCASnsXAYFNGs8F/rOUeyzUGfZe/OnXQq+D2Z9A HYwxIiLV141Hrz6OPRQRYmqJE6gu2MIJ93DHNnzK4gs5DA== ----------------------------------------------------------------------------------------- !!! DANGER !!! DON'T try to change files by yourself, DON'T use any third party software for restoring your data or antivirus solutions - its may entail damage of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/57A7CD721AC3E501

Signatures

  • Credentials from Password Stores: Windows Credential Manager 1 TTPs

    Suspicious access to Credentials History.

    credential_accessstealer
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Enumerates connected drives 3 TTPs 25 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Sets desktop wallpaper using registry 2 TTPs 1 IoCs
    ransomware
  • Drops file in Program Files directory 13 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 5 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\2025-03-14_b66ef055f69d2d1a1d8a6f7128cc34a4_revil.exe
    "C:\Users\Admin\AppData\Local\Temp\2025-03-14_b66ef055f69d2d1a1d8a6f7128cc34a4_revil.exe"
    1⤵
    • Enumerates connected drives
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:5824
  • C:\Windows\system32\wbem\unsecapp.exe
    C:\Windows\system32\wbem\unsecapp.exe -Embedding
    1⤵
      PID:4100
    • C:\Windows\system32\vssvc.exe
      C:\Windows\system32\vssvc.exe
      1⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:5500

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Program Files (x86)\vpk2054fa-readme.txt
      Filesize

      6KB

      MD5

      73c6c73b0f64213c42307295b1e1874d

      SHA1

      b06dd71322b87cf4356f7f597309ade9c47d217e

      SHA256

      ae10b8e3b2c080345041489c411fa5a2ac76f53c913a91e2861138020acec7d9

      SHA512

      9758865008e27bf258552c523cdb58e5c252d60fc3314c84b5eeece617c7a2453f37b06c06a28ec52c193d48f78963fc3664f429ee6933b7d0f3e8e40d8a608d

      Download Submit