Overview

overview

10

Static

static

10

Ransomware...KB.exe

windows10-ltsc_2021-x64

10

Ransomware...KB.exe

windows10-ltsc_2021-x64

10

Ransomware...KB.exe

windows10-ltsc_2021-x64

10

Ransomware...KB.exe

windows10-ltsc_2021-x64

10

Ransomware...KB.exe

windows10-ltsc_2021-x64

10

Ransomware...KB.exe

windows10-ltsc_2021-x64

10

Ransomware...KB.exe

windows10-ltsc_2021-x64

10

Ransomware...KB.exe

windows10-ltsc_2021-x64

10

Ransomware...KB.exe

windows10-ltsc_2021-x64

10

Ransomware...KB.exe

windows10-ltsc_2021-x64

Ransomware...KB.exe

windows10-ltsc_2021-x64

10

Ransomware...KB.exe

windows10-ltsc_2021-x64

10

Ransomware...KB.exe

windows10-ltsc_2021-x64

10

Ransomware...KB.exe

windows10-ltsc_2021-x64

10

Ransomware...KB.exe

windows10-ltsc_2021-x64

10

Ransomware...KB.exe

windows10-ltsc_2021-x64

7

Ransomware...KB.exe

windows10-ltsc_2021-x64

10

Ransomware...KB.exe

windows10-ltsc_2021-x64

10

Ransomware...KB.exe

windows10-ltsc_2021-x64

9

Ransomware...KB.exe

windows10-ltsc_2021-x64

9

Ransomware...KB.ps1

windows10-ltsc_2021-x64

10

Ransomware...KB.exe

windows10-ltsc_2021-x64

10

Ransomware...KB.exe

windows10-ltsc_2021-x64

10

Ransomware...KB.exe

windows10-ltsc_2021-x64

10

Ransomware...KB.exe

windows10-ltsc_2021-x64

10

Ransomware...KB.exe

windows10-ltsc_2021-x64

10

Ransomware...KB.exe

windows10-ltsc_2021-x64

10

Ransomware...KB.exe

windows10-ltsc_2021-x64

10

Ransomware...KB.exe

windows10-ltsc_2021-x64

10

Ransomware...KB.exe

windows10-ltsc_2021-x64

10

Ransomware...KB.msi

windows10-ltsc_2021-x64

10

Ransomware...KB.exe

windows10-ltsc_2021-x64

10

Resubmissions

31/03/2025, 00:22

250331-apdw1ssjs8 10

28/03/2025, 22:52

250328-2tfd7avl15 10

25/03/2025, 14:57

250325-sb3mbsxxht 10

Analysis

  • max time kernel
    359s
  • max time network
    370s
  • platform
    windows10-ltsc_2021_x64
  • resource
    win10ltsc2021-20250314-en
  • resource tags

    arch:x64arch:x86image:win10ltsc2021-20250314-enlocale:en-usos:windows10-ltsc_2021-x64system
  • submitted
    31/03/2025, 00:22

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    RansomwareSamples/Sekhmet_30_03_2020_364KB.msi

  • Size

    364KB

  • MD5

    15fc8a15e86c367586e3661b03bcab44

  • SHA1

    a6a6f2dc244d75cac1509e46c7de88ff479b9ee6

  • SHA256

    b2945f293ee3f68a97cc493774ff1e8818f104fb92ef9dbeead05a32fc7006ff

  • SHA512

    cad4c868065a4715126a6e644c1fc1c5d9832e027f62f2f9370172e523fe7db63119871ba64977fc2f25959197a20f0e0e98bd66b2539eae7d46ded9d571436b

  • SSDEEP

    6144:nj+vyxz9WYWqpkGbOAqMK/oVZUlz/F8GO53OuzZOJM7CQ5g//s4Y:j+wpWYkGA/WGUGO53OIZkh/Y

Score
10/10
egregorlockysekhmetcredential_accessdiscoverypersistenceprivilege_escalationransomwarestealer

Malware Config

Extracted

Path

F:\$RECYCLE.BIN\RECOVER-FILES.txt

Family

sekhmet

Ransom Note
-------------- | Attention! | -------------- Your company network has been hacked and breached. We downloaded confidential and private data. In case of not contacting us in 3 business days this data will be published on a special website available for public view. Also we had executed a special software that turned files, databases and other important data in your network into an encrypted state using RSA-2048 and ChaCha algorithms. A special key is required to decrypt and restore these files. Only we have this key and only we can give it to you with a reliable decryption software. --------------------------------------- | How to contact us and be safe again | --------------------------------------- The only method to restore your files and be safe from data leakage is to purchase a private key which is unique for you and securely stored on our servers. After the payment we provide you with decryption software that will decrypt all your files, also we remove the downloaded data from your network and never post any information about you. There are 2 ways to directly contact us: 1) Using hidden TOR network: a) Download a special TOR browser: https://www.torproject.org/ b) Install the TOR browser c) Open our website in the TOR browser: http://o3n4bhhtybbtwqqs.onion/13C67978CF0A518 d) Follow the instructions on this page. 2) If you have any problems connecting or using TOR network a) Open our website: https://sekhmet.top/13C67978CF0A518 b) Follow the instructions on this page On this web site, you will get instructions on how to make a free decryption test and how to pay. Also it has a live chat with our operators and support team. ----------------------- |Questions and answers| ----------------------- We understand you may have questions, so we provide here answers to the frequently asked questions. ==== Q: What about decryption guarantees? A: You have a FREE opportunity to test a service by instantly decrypting for free 3 files from every system in your network. If you have any problems our friendly support team is always here to assist you in a live chat. ==== ==== Q: How can we be sure that after the payment data is removed and not published or used in any nefarious ways? A: We can assure you, downloaded data will be securely removed using DoD 5220.22-M wiping standart. We are not interested in keeping this data as we do not gain any profit from it. This data is used only to leverage you to make a payment and nothing more. On the market the data itself are relatively useless and cheap. Also we perfectly understand that using or publishing this data after the payment will compromise our reliable business operations and we are not interested in it. ==== ==== Q: How did you get into the network? A: Detailed report on how we did it and how to fix your vulnerabilities can be provided by request after the payment. ==== -------------------------------------------------------------------------------------- This is techinal information we need to identify you correctly and give decryption key to you, do not redact! ---SEKHMET--- 3CSug/ypgXkTyNv4p2bu+rL3TPf0+r6fp+oFkVIcWHxVVU6ZJF60kE3fxaTfNWRyYmkbtLdixJgHwwbTINadPUPxUW8EPGBVulcC91g3FhigJ6PxWBeoqEemSdHMXB7jn565NTKiUIlp1OwhFHz+muFg4m5XzUNxvV3/+B09PA3voiR0oGBKkiL6s00OoZRTFOu4WcTRHwmoGK7nPfoBrjJc57BVI9r6qZkYtkYbiT3ASapAe53+JIkpwXJORjW717AQkH+I70p4ELHsHfW5pMi2qg3npSD4UBAqZ3TbiisoxVAI+OCULVgayXkf5BzOvABfrTT6y3GV8m+KaVpg4xixouXAW5nXlvpWfcEGP4J+aoaLDh02dOHQGsOm++hOlVtP5rpH1OnqNasNKobNUEvYX+WkbEuLJELKfo99vDOMgwsTzzXQxCKiIvoYrLl7wgRJcsLHG+eajmFYCwxxxrbfjM7KKjbqwZd7O2gbI+74y3wxnxm4KnYOQiOEb163FHkUdoG4CUM1QPq9RRFa2GNYgo1l69X4Mocz3F1+6Kn4V85uNpBiX6+l0fz3wSbT3Yv6rQEzi7PHwl/FMACy5pSgY/0VtIRcDl29xlGzyyYaGsTG1oR53HhfYtVYra2PKiWhTgJk/JCOFwESz69wMiwqcuO+e3A1feFWyE35JArytq3DZCwuahC62v9/R+mLvTffTEQ5jtKsb6bYaQxctCJDhpgdTxwVQRw4iUgQ45oAbdmY4mQs1qirOGJP+NMkZxO0/HGLmcxHZ/7Ry3YSiaYEtaJ5VXnbZwL2t5lEndMWirPM4LloLJuFKxGeNzi45HrdnjkUS+39spv97bh3mpZlkK98yGGbBx7Kia5/JeGytHvoLYcvAOEETfJhbVUoCURGvOIwMvzvbXzW2CtgBg5uBn2e7OBRIBmxlX9394kxMwTtC+TYnN4Yy4Zsto6+/1pGWPLW8nNftHLjn+Bqeltktowa/ThvsequOA4NjyOc2lcKRogaezORPggvP3zqBQ1DwG3VAI0d02MmjyheZJMhoIIdtAY+TNNmlwGB1WDbQPy8eMVygb/vHNbhG/eW7VfXjOV5uFBPEarSzBD9WZUQOlGvE0ealvGfg+NkoDXWqktjoSRONAHaForM9zzbT7wn6hq2vx21I5kP5eWGnWxknTPPs8PQ+I0ZwAct0uXPg04YyBZSiX/gUNemQjCq4VvH9Uynr0TAN7b6TnyC9AqqXo51IeGPgSHukLl7rupQwVSDHcc32OhidhFt7F6YAlcT9hThouSYpDooojMczxCzaTXTaqmEMyV9QDXirag8LTveMmoItfsUOLC27adERvbRd2kXqIah1xYroVxuatEFwbTER6kwSPergsCW1bF5Mxd8knU8bawF51YoSP3OuuCPvtbQtUPniM6DFfEHO3TK/qLXkfcvRM1JTac9kVNTzvxmHsDGDQ3rC0tJ8p7kC/hRa8RSfag5lYKG+MpyfgLC5vN7hdehxDMEBeEaYDNCBs0ma4oH5quQ7srvsrKFjy/Q7U1MqKj9q8lycrEa+9DxGLgJunAqAeC6HzlRSlhkH02RlWP+wQUANE2Cc/U+a3QlvzYL8ORe6kS/ZbaYeA2Vy0sctuVRYtrDkyXTO+flekQBifzNSlAjHuBMBO0QwYDkl9rxHP3HwdxOEoAWSJX7zwX2qftrHhXCfPwfkqVLogLQJWNHMeJcSkz9QSxGhSNNiL7Ljanx4gLFzna7eErA4yYHIM7NItzGDyP7EKwbfhomWXESqJLhu3TqB/Vo9gjk/Neoc8XUZLfP2ad6byuBd7WtuFWmyQj7vKddV0QCALWbEgk6wPGVqfeiWWnN47S7WwJvNSPm5t0RbCo5FdENEQloKli4x/v1+pKayGijaTkveQC06acs97np3RQ9rPpjrQ997Ff1aCK9EAS5tLv5um5H3H4luQTymFcsvb9rEvcU9HHKEGGlHRhPiXM68RX+dzMd3dlNcRx6ecnU6a3WPZ36FN85kz7pwuavKYAJkGgkcvBikd06hG1IenYe2wHtWH0JagytH54Hl28bi3/1j8zYK8RsAdkAkE99PGBumKnQERMS2nnWcsOsCZpkaKBd+U25iq82x3cJVfrJfRP+tisVITVQISJfPYHnl7E+dQWuuJ3nfKC+RjQLY8xN55VraF8azPg+k0tmJ3XvDJtO0Pl9Rk9tiuGFw6EsgHDOHg2D0sw5mzdnYEBrXJNMvRIXWggBEAEYASCAAigAOhJGAEEASgBKAFcAUwBSAEYAAABCIDEAMwBDADYANwA5ADcAOABDAEYAMABBADUAMQA4AAAASlZ8AEMAOgBGAF8AMgAwADIANAAxAC8AOQAyADIAOAA5ADEAfABFADoAQwBfADAALwAwAHwARgA6AEYAXwAyADAANAAyADEALwAyADAANAA3ADkAfAAAAFIOUwBZAFMAVABFAE0AAABoAHJAVwBpAG4AZABvAHcAcwAgADEAMAAgAEUAbgB0AGUAcgBwAHIAaQBzAGUAIABMAFQAUwBDACAAMgAwADIAMQAAAHoUVwBPAFIASwBHAFIATwBVAFAAAAA= ---SEKHMET---
URLs

http://o3n4bhhtybbtwqqs.onion/13C67978CF0A518

https://sekhmet.top/13C67978CF0A518

Signatures

  • Detected Egregor ransomware 1 IoCs
  • Egregor Ransomware

    Variant of the Sekhmet ransomware first seen in September 2020.

    ransomwareegregor
  • Egregor family
    egregor
  • Locky

    Ransomware strain released in 2016, with advanced features like anti-analysis.

    ransomwarelocky
  • Locky family
    locky
  • Sekhmet Ransomware

    Ransomware family active in the wild since early 2020.

    ransomwaresekhmet
  • Sekhmet family
    sekhmet
  • Credentials from Password Stores: Windows Credential Manager 1 TTPs

    Suspicious access to Credentials History.

    credential_accessstealer
  • Drops startup file 4 IoCs
  • Blocklisted process makes network request 18 IoCs
  • Enumerates connected drives 3 TTPs 46 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Program Files directory 4 IoCs
  • Drops file in Windows directory 10 IoCs
  • Loads dropped DLL 1 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs
    persistenceprivilege_escalation
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 5 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies data under HKEY_USERS 11 IoCs
  • Modifies registry class 22 IoCs
  • Suspicious behavior: EnumeratesProcesses 8 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of WriteProcessMemory 5 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Windows\system32\msiexec.exe
    msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\RansomwareSamples\Sekhmet_30_03_2020_364KB.msi
    1⤵
    • Enumerates connected drives
    • Event Triggered Execution: Installer Packages
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    PID:3340
  • C:\Windows\system32\msiexec.exe
    C:\Windows\system32\msiexec.exe /V
    1⤵
    • Enumerates connected drives
    • Drops file in Windows directory
    • Modifies data under HKEY_USERS
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:352
    • C:\Windows\system32\srtasks.exe
      C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
      2⤵
        PID:396
      • C:\Windows\syswow64\MsiExec.exe
        "C:\Windows\syswow64\MsiExec.exe" /Y "C:\Users\Admin\AppData\Local\Temp\System Update\patch_may13869.dll"
        2⤵
        • Drops startup file
        • Blocklisted process makes network request
        • Drops file in Program Files directory
        • Drops file in Windows directory
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Modifies data under HKEY_USERS
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:3804
    • C:\Windows\system32\vssvc.exe
      C:\Windows\system32\vssvc.exe
      1⤵
      • Checks SCSI registry key(s)
      • Suspicious use of AdjustPrivilegeToken
      PID:4976

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Config.Msi\e57fbe5.rbs
      Filesize

      7KB

      MD5

      364f00252f97606945a6121eee9aff8e

      SHA1

      e52d4f8a668516d70cc01ac79b938dbd2f1203ff

      SHA256

      54506e79f5d8b7108226e10c01f6964dcd384e63f0a113b749080246ca6ac922

      SHA512

      061c60e57cbb9f08b3039a68e3ec429379569c7fc4608fb76764a23961d8be7c150319526e8d3de09f50a37ec6045465cea219c7f2e483b1ac51433802a7e957

      Download Submit

    • C:\System Volume Information\SPP\OnlineMetadataCache\{ebbc241c-44bb-4318-8b6a-491057d642a6}_OnDiskSnapshotProp
      Filesize

      6KB

      MD5

      3f039a9601877732d157627df1b5fe71

      SHA1

      a2057c62c6c13c949a8529c16261209a1b9ac19c

      SHA256

      c2f003666322de7a277b5e4df37c2d884f9bee62ea607bd5acde84974fbd3f54

      SHA512

      2e1a3c5782604358fe2fa5aaf99f912bc88eeb34b7a81b64b1fc3c54a251f2b8783f923296b91b6f0e8cc784cb95cf5dc693531b059e6bbada9168e7c8f92dd9

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\System Update\patch_may13869.dll
      Filesize

      707KB

      MD5

      1343bd0e55191ff224f2a5d4b30cdf3b

      SHA1

      6412cbf10ac523452e051267afce4095d7f3d5ac

      SHA256

      fceb299326ef4298a3c30e10b31d8c64f1369b182ac256d1eeaf148c1adcea8d

      SHA512

      f3fcb8d1c89f463f2e73dadbf32afda7716c8c065990f3422fc2b5f10cb396a68ea6f711a0184989b83f474e660bc12fb47db60966011b1a18f84755571e9b9e

      Download Submit

    • C:\Windows\Installer\e57fbe4.msi
      Filesize

      364KB

      MD5

      15fc8a15e86c367586e3661b03bcab44

      SHA1

      a6a6f2dc244d75cac1509e46c7de88ff479b9ee6

      SHA256

      b2945f293ee3f68a97cc493774ff1e8818f104fb92ef9dbeead05a32fc7006ff

      SHA512

      cad4c868065a4715126a6e644c1fc1c5d9832e027f62f2f9370172e523fe7db63119871ba64977fc2f25959197a20f0e0e98bd66b2539eae7d46ded9d571436b

      Download Submit

    • F:\$RECYCLE.BIN\RECOVER-FILES.txt
      Filesize

      11KB

      MD5

      77aba84f448dc151ae64483b42e6231c

      SHA1

      d536addd735c4299de107f83a4ebaf62dbd76889

      SHA256

      5ecd2816429d43b7b0cdc0e264937d9ffc439245c0edff9a0c127f0350ed6fd2

      SHA512

      87da3cd81c5ea9c0210f79d6b6ce3604e3d589502b82c2907203ec85474285f061677dca192e5758c58c28b8f569260b5100ccdd964aa20fbd183ecd8042da5b

      Download Submit

    • memory/3804-13-0x0000000000FD0000-0x0000000000FF8000-memory.dmp

      Filesize

      160KB

      Download

    • memory/3804-20-0x0000000000FD0000-0x0000000000FF8000-memory.dmp

      Filesize

      160KB

      Download