Analysis
- max time kernel
141s - max time network
143s - platform
windows10-2004_x64 - resource
win10v2004-20250619-en - resource tags
- submitted
07/07/2025, 03:57
General
- Target d4919a7402d7ae02516589fbdfb3cc436749544052843a37b5d36ac4b7385b18.exe
- Size 205KB
- Sample250707-ehy1tsfn2x
- SHA256 d4919a7402d7ae02516589fbdfb3cc436749544052843a37b5d36ac4b7385b18
Malware Config
Extracted
-
C:\PerfLogs\README.txt
- Good afternoon, we are Sinobi Group. As you can see you have been attacked by us! We offer you to make a deal with us. all you need to do is contact us by following the instructions below. We are not politically motivated group, we are interested only in money, we always keep our word. You have a possibility to decrypt your files and save your reputation in case we find good solution! You have to know we do not like procrastination. You have 7 days to come to the chat room and start negotiations. - 1 Communication Process: In order to contact with us you need to download Tor Browser. You can download Tor Browser from this link: https://www.torproject.org/download/ After you joined to chat room you have the opportunity to request several things from us for free: 1. make a test decrypt. 2. get a list of the files stolen from you. At the end, we should agree on the price for our services. Keep in mind that we got your income/insurance documents. - 2 Access to the chat room: To access us please use one of the following links: 1. http://sinobi7yuoppj76qnkwiobwfc2qve2xkv2ckvzyyjblwd7ucpptl62ad.onion/login 2. http://sinobi57mfegeov2naiufkidlkpze263jtbldokimfjqmk2mye6s4yqd.onion/login 3. http://sinobibdvzohujkliofkxiz3ueyedfh6bed2lzjz2z6pafw5jeoptsid.onion/login 4. http://sinobibjqytwqxjw24zuerqcjyd3hoow6zia7z6kzvwawivamu7nqayd.onion/login 5. http://sinobicrh73ongfuxjajmlyyhalvkhlcgttxkxaxz3gvsgdcgf76uiqd.onion/login 6. http://sinobidxodgt4jsr3tlmf2rr4okjvvwfp5gh3lrqxnowomcx62ssrhqd.onion/login 7. http://sinobiea4snfqtkc43paumapo4oi7vxcy5vjzfoalunsnvzehozfhpyd.onion/login If Tor is blocked in your country you can use this link: http://chat.sinobi.us.org/login Your unique ID: 68676f1e88b6823fa29f32cb - use it to register in the chat room. - 3 Blog: To access us please use one of the following links: 1: http://sinobi6ftrg27d6g4sjdt65malds6cfptlnjyw52rskakqjda6uvb7yd.onion/leaks 2: http://sinobi6rlec6f2bgn6rd72xo7hvds4a5ajiu2if4oub2sut7fg3gomqd.onion/leaks 3: http://sinobi6ywgmmvg2gj2yygkb2hxbimaxpqkyk27wti5zjwhfcldhackid.onion/leaks 4: http://sinobi7l3wet3uqn4cagjiessuomv75aw3bvgah4jpj43od7xndb7kad.onion/leaks 5: http://sinobi7sukclb3ygtorysbtrodgdbnrmgbhov45rwzipubbzhiu5jvqd.onion/leaks 6: http://sinobi23i75c3znmqqxxyuzqvhxnjsar7actgvc4nqeuhgcn5yvz3zqd.onion/leaks 7: http://sinobia6mw6ht2wcdjphessyzpy7ph2y4dyqbd74bgobgju4ybytmkqd.onion/leaks If Tor is blocked in your country you can use this link: http://blog.sinobi.us.org/leaks - 4 Recommendations: Do not try to recover your files with third-party programs, you will only do harm. Do not turn off / reboot your computer. Do not procrastinate.
-
http://sinobi7yuoppj76qnkwiobwfc2qve2xkv2ckvzyyjblwd7ucpptl62ad.onion/login
-
http://sinobi57mfegeov2naiufkidlkpze263jtbldokimfjqmk2mye6s4yqd.onion/login
-
http://sinobibdvzohujkliofkxiz3ueyedfh6bed2lzjz2z6pafw5jeoptsid.onion/login
-
http://sinobibjqytwqxjw24zuerqcjyd3hoow6zia7z6kzvwawivamu7nqayd.onion/login
-
http://sinobicrh73ongfuxjajmlyyhalvkhlcgttxkxaxz3gvsgdcgf76uiqd.onion/login
-
http://sinobidxodgt4jsr3tlmf2rr4okjvvwfp5gh3lrqxnowomcx62ssrhqd.onion/login
-
http://sinobiea4snfqtkc43paumapo4oi7vxcy5vjzfoalunsnvzehozfhpyd.onion/login
-
http://chat.sinobi.us.org/login
-
http://sinobi6ftrg27d6g4sjdt65malds6cfptlnjyw52rskakqjda6uvb7yd.onion/leaks
-
http://sinobi6rlec6f2bgn6rd72xo7hvds4a5ajiu2if4oub2sut7fg3gomqd.onion/leaks
-
http://sinobi6ywgmmvg2gj2yygkb2hxbimaxpqkyk27wti5zjwhfcldhackid.onion/leaks
-
http://sinobi7l3wet3uqn4cagjiessuomv75aw3bvgah4jpj43od7xndb7kad.onion/leaks
-
http://sinobi7sukclb3ygtorysbtrodgdbnrmgbhov45rwzipubbzhiu5jvqd.onion/leaks
-
http://sinobi23i75c3znmqqxxyuzqvhxnjsar7actgvc4nqeuhgcn5yvz3zqd.onion/leaks
-
http://sinobia6mw6ht2wcdjphessyzpy7ph2y4dyqbd74bgobgju4ybytmkqd.onion/leaks
-
http://blog.sinobi.us.org/leaks
Signatures
- Renames multiple (311) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
- Credentials from Password Stores: Windows Credential Manager 1 TTPs
Suspicious access to Credentials History.
- Enumerates connected drives 3 TTPs 24 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
- Drops file in System32 directory 3 IoCs
- Sets desktop wallpaper using registry 2 TTPs 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
- Enumerates system info in registry 2 TTPs 3 IoCs
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of SetWindowsHookEx 13 IoCs
- Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\d4919a7402d7ae02516589fbdfb3cc436749544052843a37b5d36ac4b7385b18.exe"C:\Users\Admin\AppData\Local\Temp\d4919a7402d7ae02516589fbdfb3cc436749544052843a37b5d36ac4b7385b18.exe"1⤵
- Enumerates connected drives
- Drops file in System32 directory
- Sets desktop wallpaper using registry
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc1⤵
-
C:\Windows\system32\printfilterpipelinesvc.exeC:\Windows\system32\printfilterpipelinesvc.exe -Embedding1⤵
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE/insertdoc "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\{6019F20C-ACBB-49C2-9636-D703CC07FD27}.xps" 1339633423774400002⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
README.txt
{8B2586CF-13C8-4F64-9B12-FADE99D11E22}
memory/6056-920-0x00007FFDF6170000-0x00007FFDF6180000-memory.dmp
memory/6056-922-0x00007FFDF6170000-0x00007FFDF6180000-memory.dmp
memory/6056-921-0x00007FFDF6170000-0x00007FFDF6180000-memory.dmp
memory/6056-924-0x00007FFDF6170000-0x00007FFDF6180000-memory.dmp
memory/6056-923-0x00007FFDF6170000-0x00007FFDF6180000-memory.dmp
memory/6056-925-0x00007FFDF3FB0000-0x00007FFDF3FC0000-memory.dmp
memory/6056-926-0x00007FFDF3FB0000-0x00007FFDF3FC0000-memory.dmp