Overview

overview

10

Static

static

10

2025-03-14...il.exe

windows11-21h2-x64

10

Resubmissions

14/03/2025, 12:46

250314-pz49aatrv9 10

14/03/2025, 12:43

250314-pydpya1vbs 10

14/03/2025, 12:42

250314-pxnths1tf1 10

14/03/2025, 07:46

250314-jmdmxawvhv 10

Analysis

  • max time kernel
    140s
  • max time network
    104s
  • platform
    windows11-21h2_x64
  • resource
    win11-20250313-en
  • resource tags

    arch:x64arch:x86image:win11-20250313-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    14/03/2025, 12:43

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    2025-03-14_b66ef055f69d2d1a1d8a6f7128cc34a4_revil.exe

  • Size

    92KB

  • MD5

    b66ef055f69d2d1a1d8a6f7128cc34a4

  • SHA1

    b0bdbebb93abe1c437d9b8f243368ca0de74603a

  • SHA256

    c7d0fa4e911df7241f9385a109ad4814d10fb640bb8151e7d1abeec1065bcacd

  • SHA512

    c052dd76b90cad8b5d40409d00ef41d3e75439edab7e6cb79d60ec98bd17af172e4e56fa031bf1cd5256d7baa0f6ea13648044da641df90e992f36432fe0d64a

  • SSDEEP

    1536:Y73nkB0DyMgQSm9NwcKzwpR+7JICS4ABwZ/gsZujGC:c/hKzstg5gs2

Score
10/10
credential_accessdiscoveryransomwarespywarestealer

Malware Config

Extracted

Path

C:\Program Files (x86)\g7nu864-readme.txt

Ransom Note
---=== Welcome. Again. ===--- [-] Whats Happen? [-] All your data were stolen. Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension g7nu864. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [-] What guarantees? [-] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practice - time is much more valuable than money. [+] How to get access on website? [+] Using a TOR browser! 1) Download and install TOR browser from this site: https://torproject.org/ 2) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/979A3F5C8536E116 Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: XnJzNSuffh+lWaNSfvWX63tmQh+vaq+BWL6z6UPOWcF4nJHv/4jbndbDOm2uO4uU i+HigYCDP3COmFSaY63zAbN+49zJRhPcbyeHntOylWAymHjfkjQDrCRn6ZHBULEf 8bD6WgVoKXwslty162mJUbXSazu5wJ3yDmRIIAPkaWuu9NnDdZ7/VYoO69mR3bho iQVbFleaNfNlMHlLalxppTWFmWHgo5GUbCpJBncPEXreWm3TQffpjD6fmtfOhVuL l9MOy4+pAOasRFykTKLxmiTI7VR2SIX2LbFHs0hj9NCXntnnoW6P6L/Eiv7DQb0X uXorB9hjViflEB+1i9QqKuSofmuXbyk7pneKmdTYcqUg04WhBAbWGnMtMgg/fR5s qvwBnqnUGVkUxZOIgBwjrpRHVEqQ2SqF3SVIuJFQb0nyn+cRmNv7bk0GuXbpN/Kn 7VbLMQEHykN/GN+XW01WnNuGOAragl7NK0CtKGuRr6w8ldhvVMKiqgckdalRy1CS Q4uILZOt5kM3wmZuO32msO5fz8OECg9mcys0Tqw6Shg0c+wdbuzNcfcYVnP9MpNt m9NRpr/zGWJdogdKgP98lVT6Eg37BwnGXW/Kn3wc3Lb/yFdkaGz8rGRhOu9TZa1F zZhn7xjT1L8pZa9oSfTvxkcAaqQ5pTg3qf+wSVzblgrAm1Q9YMwVlg7pHgg8X1jJ iETuxU+zEuIxV4W4oX/QyyxM9h1IHUEuoST6IAfAT/Epy12IZcyvQ+QD/iDGjYbC E9DGamli11ra/w19eGJhLe7bSdYb5/+XQGONW+sRPNKR66MswVAoTAnmmvUhc0b2 tOTCypXJoF7V+9cc3reSPwMuP5z+R5Y62QK+ZOwu4y7qPGL6NYtD2GEqft6b0dlC 8vTnZ3MPrVpUHYNW7fBo0YjUwb4kZBJqfCBZDdsEKl8mcgLNtyYftzen89hOKunF wKx0WXO79foSMDSbqqOoFtiomPPkzKuEN/J3YRc35+sAFMC/kgw8vcrk6xv3XPen CZ4AZ74Rr8uoE/5KLrcdvPMOFSnN/MTz1c7PpbIGjbX97cp+cZfvtIfO2zXKF8Ee l/qKBUH8V6d0Fmv1xbNuMbJ3dL8aY/Hsn05rhxSjq4sEsIaRFoGzLhS3xv6LvpEv APxn+kQv90OuDDw/zWbcBDYsTnhzs7aoxlEBJvA+D7I+LmdxE2+69peaVcWXas7D ruarNcJxzKjRXQyEThYsOeOXtl46Wqpa6x4AzlqY1Jk5FZi456OGCKcX0LqYs+Ae zIZfOamGEeIi9A61O9EPCqbsPy8aPdonAXC8WCsbBSE1besyMtDuDXQVbOaPa1WC fnEmRIoNfXu/PaNTXEEppLx3sOdNDGUQ70MLG61+ ----------------------------------------------------------------------------------------- !!! DANGER !!! DON'T try to change files by yourself, DON'T use any third party software for restoring your data or antivirus solutions - its may entail damage of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/979A3F5C8536E116

Signatures

  • Credentials from Password Stores: Windows Credential Manager 1 TTPs

    Suspicious access to Credentials History.

    credential_accessstealer
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Enumerates connected drives 3 TTPs 25 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Sets desktop wallpaper using registry 2 TTPs 1 IoCs
    ransomware
  • Drops file in Program Files directory 27 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 5 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\2025-03-14_b66ef055f69d2d1a1d8a6f7128cc34a4_revil.exe
    "C:\Users\Admin\AppData\Local\Temp\2025-03-14_b66ef055f69d2d1a1d8a6f7128cc34a4_revil.exe"
    1⤵
    • Enumerates connected drives
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:2104
  • C:\Windows\system32\wbem\unsecapp.exe
    C:\Windows\system32\wbem\unsecapp.exe -Embedding
    1⤵
      PID:2196
    • C:\Windows\system32\vssvc.exe
      C:\Windows\system32\vssvc.exe
      1⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:2708
    • C:\Windows\system32\NOTEPAD.EXE
      "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Public\Desktop\g7nu864-readme.txt
      1⤵
        PID:2776

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Program Files (x86)\g7nu864-readme.txt
        Filesize

        6KB

        MD5

        a4fbb625f2a41549e0080f5f4093c4b6

        SHA1

        cbb5aad7805101e16555b0a3fb0720facd708bf4

        SHA256

        f8d02ebc1b84ec8221bb014e45050c0995c013c3dfd590ad7e140f694f072b5b

        SHA512

        2d3b5444e0b103eb3f21167a3cea4f121698989849e0e798d082435edfbc8340e219e9f25be1b047a896b886f78718692c81c8027e5b1e8a482e85547a98704a

        Download Submit