Overview

overview

10

task1

 

10

task2

 

10

Analysis

  • max time kernel
    133s
  • resource
    win10v191014
  • submitted
    09-12-2019 16:41

Sharing

Copy URL
Twitter E-mail

General

  • Target

    0fa207940ea53e2b54a2b769d8ab033a6b2c5e08c78bf4d7dade79849960b54d.exe

  • Sample

    191209-xr9d11evle

  • SHA256

    0fa207940ea53e2b54a2b769d8ab033a6b2c5e08c78bf4d7dade79849960b54d

Score
10/10
evasiontrojanransomwaresodinokibi

Malware Config

Extracted

Path

C:\odt\7hdd05b442-readme.txt

Family

sodinokibi

Ransom Note
Hello dear friend! Your files are encrypted, and, as result you can't use it. You must visit our page to get instructions about decryption process. All encrypted files have got 7hdd05b442 extension. Instructions into the TOR network ----------------------------- Install TOR browser from https://torproject.org/ Visit the following link: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/56A62750F38ACD5F Instructions into WWW (The following link can not be in work state, if true, use TOR above): ----------------------------- Visit the following link: http://decryptor.top/56A62750F38ACD5F Page will ask you for the key, here it is: td1n57pF9/ZYiATjj9YIRWzEOk8xUQgXy8ZPXaG5Rqu4WsKr3t1LNO7ZaKMzWUB6 s8mZdWS/QAqXSSN9yWg1V8HE8zFXiMxB83qsZ/W/sm+BC+vBrS5ZYwN9GjsokY5B j2PP/Jfm0HD/stPsmiuVWcpedKwG6GeZH5aKg6qrNKdIoY0RyYWQNoq6Kk1+4ifL L5NERXXUl6cpzHa/pYzcK3YPVFabIwi0IWHr5gRbe7DFByaMNGYkfHpDxrWz/X6b SKjhAZvmr0VwYnYM53Bd1QM60qsRzeYUbK9SKWZV7cxAphwV62jgcE71zdy5aGtF Zb19L9JwA5B7xA5EQFPj20fcZJJcDnwq5RT5JmP9J+e9yJELV5lJ9ZgBn3ILWMKU jf8FAGGVorw61ncrZYuclx8XzOOJvBDg/4FKuEEuNbgCP87ZSXGIgSel/G5OwCqA ngrg9T6DkKo3/Ylx/GqlNgghmaYV1A7N1OXtpj2nfJNhgxEAVUhDZ5TMuy3a8A9r 8JFrNldf/JiQl6c76a4fuKtXluDZ4AXqC2QkRQo6dpANq0GISYKhyIdpDWHI09sS 1IRBgVEhAgvRHqwC97R85pAU1DuI1wx7XNStJeLmDRi5mla7cMdTrPCAXIHpk0m7 Qt7O0Fs6l5g5leMwuix80dNGF4VtI0m8xrKENDbURiiu/CMFIWsS4uruIHQWUFqX OKSMW3iyWwIjRjt7GBt3zeRB+42ykg+SlIp5ssqxqVAx5lVDtUvEX2JJJSW91/ZK pzDreeZLhbhvNgitGA8IqtA4+xLSBdxTJiT6I3wrLSNquONNhQBvjLfGxO4/nqeK 7RHxtLG2TQsb7T7umL9OQv52cxYRCrHoALRB3u5D+81V7c1cUz1nVmgbWikTREEx 374w/bQquMnNVvLDAT65OOgke61zSJZn72yyGwjb1xmhLLCB6qSYB9ng7NwF19kI h/OgypMxlJRN9/KiYu5Ys5x9fI3JNG9ACyO/uVFijTOFFIT8pjSWl3g8Li6SWi0+ ubPLHw7FdiF1Ot3JmwCNyalNTezTWXmK8FuIZMnrGyLgJd19VmwkyjvifsZfZsn4 OadcIW2m
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/56A62750F38ACD5F

http://decryptor.top/56A62750F38ACD5F

Signatures

  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Deletes shadow copies 2 TTPs 1 IoCs
    ransomware
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware
  • Drops file in Windows directory 2109 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs
  • Sodin,Sodinokibi,REvil

    Ransomware with advanced anti-analysis and privilege escalation functionality

    ransomwaresodinokibi
  • Discovering connected drives 3 TTPs 6 IoCs
    ransomware
  • Sets desktop wallpaper using registry 2 TTPs 1 IoCs
    ransomware
  • Checks system information in the registry 2 TTPs 2 IoCs

    System information is often read in order to detect sandboxing environments.

  • Windows security modification 2 TTPs 2 IoCs
    evasiontrojan

Processes

  • C:\Users\Admin\AppData\Local\Temp\0fa207940ea53e2b54a2b769d8ab033a6b2c5e08c78bf4d7dade79849960b54d.exe
    "C:\Users\Admin\AppData\Local\Temp\0fa207940ea53e2b54a2b769d8ab033a6b2c5e08c78bf4d7dade79849960b54d.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Drops file in Windows directory
    • Suspicious use of WriteProcessMemory
    • Discovering connected drives
    PID:4904
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c vssadmin.exe Delete Shadows /All /Quiet & bcdedit /set {default} recoveryenabled No & bcdedit /set {default} bootstatuspolicy ignoreallfailures
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:1544
      • C:\Windows\SysWOW64\vssadmin.exe
        vssadmin.exe Delete Shadows /All /Quiet
        3⤵
        • Deletes shadow copies
        PID:1000
  • C:\Windows\system32\SppExtComObj.exe
    C:\Windows\system32\SppExtComObj.exe -Embedding
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:4996
    • C:\Windows\System32\SLUI.exe
      "C:\Windows\System32\SLUI.exe" RuleId=eeba1977-569e-4571-b639-7623d8bfecc0;Action=AutoActivate;AppId=55c92734-d682-4d71-983e-d6ec3f16059f;SkuId=2de67392-b7a7-462a-b1ca-108dd189f588;NotificationInterval=1440;Trigger=TimerEvent
      2⤵
        PID:5028
    • C:\Windows\system32\vssvc.exe
      C:\Windows\system32\vssvc.exe
      1⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:2900
    • \??\c:\windows\system32\svchost.exe
      c:\windows\system32\svchost.exe -k netsvcs -s BITS
      1⤵
      • Discovering connected drives
      PID:4640
    • \??\c:\windows\system32\svchost.exe
      c:\windows\system32\svchost.exe -k localserviceandnoimpersonation -s SSDPSRV
      1⤵
        PID:3820
      • \??\c:\windows\system32\svchost.exe
        c:\windows\system32\svchost.exe -k netsvcs -s DoSvc
        1⤵
          PID:4848
        • \??\c:\windows\system32\svchost.exe
          c:\windows\system32\svchost.exe -k unistacksvcgroup
          1⤵
            PID:4944
          • \??\c:\windows\system32\svchost.exe
            c:\windows\system32\svchost.exe -k localservicenetworkrestricted -s wscsvc
            1⤵
              PID:768

            Network

            MITRE ATT&CK Enterprise v6

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            • memory/4904-0-0x00000000006DB000-0x00000000006F9000-memory.dmp

              Filesize

              120KB

              Download