sodinokibi | adef0855d17dd8dddcb6c4446e58aa9f5508a0453f53dd3feff8d034d692616f

Reason

Machine shutdown

General

Target

1.exe
Size

234KB
MD5

f084eae234967eded358d98d11aed693
SHA1

e841d89f5605108f6304d50ebb384aa62ec3ecaa
SHA256

adef0855d17dd8dddcb6c4446e58aa9f5508a0453f53dd3feff8d034d692616f
SHA512

8d66f0319741f4daad87919a3f48605e7f81a5556009c8575ae0aff95c2ddd78116bdaf74e10509a6f908f45e0155c71eb320274154c7016cbb72a09d5618d59

Score

10^/10

ransomware sodinokibi persistence

Malware Config

Extracted

Path

C:\1zac11n-readme.txt

Family

sodinokibi

Ransom Note

---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on you computer has expansion 1zac11n. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/73F0511197A918F7 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.top/73F0511197A918F7 c) If you are having difficulty purchase bitcoins, or you doubt in buying decryptor, contact to any data recovery company in your country, they will give you more guarantees and take purchase and decryption procedure on themselves. Almost all such companies heared about us and know that our decryption program work, so they can help you. Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: cxs2Oz2rNbS/g6LAuomfOGLEj8q9EV5/osKKkjH8jzjS5icMdu4F7znMKSNKzGRY aDQYpoqcBjSNU0Ogtgj/qJubg0RiaNaAzA135rV++mNgWIZ8v9qXChV8331IRA9P xhxSuE+kbjs4OnSSv607boag7fZA03rawMnC31RUognEJp971/ycolJ+4qXPlrVn kyxhLZ6giPZgIjwwARPvXr6RphXWHxGa6yeGY2IByczcdAdzSp+hth45Vwdku7aP rokkmAOwhSK7hnIidqInWi8YJvEcOQw+0Y2B8xgupPACrVgs4IIgeLkXzoiw/eYq sy3+MCudAlEy9CcHRbxH4RkGq8w3OP3PImyuNd/6/2nt2cwLfUQ+l8IrABBymEIB yerSFSOh2YDGhJTHGgjn+HMswacB2A3aA62RtuIFl2d4wabEoYPyzVOiVOmGpumB 3fQssxhSGVNeDJHbHS+R/Ct4FpQ7F8j8DsHQDRmJUVC/Ldi+WkIMxJllm5oMNUAI Jol6oYz2ZZDj8R7hNlklxLXJPfcDMWvscSZ1ahGrfZcRJBW+GcNKy2suFEPq2XlQ 4qnRn3O3UmRp8o+6hR8Q5W20luMaJjTh0J6Pn1x/FtU3VsBx9OwU2ixOi8w/dkMn Z7JVqlTICLq2CZUCf89Cfp7eE521MzAQrekecGjw0R6FRsajij1Q3pZhwV+9iuZC 8x7Zr6FFqOa4k/zhPnkyHxQysniuetloMrUFbmgNrBJoE9VH2y+LAU6JIuvHm8tJ vO054PatY5mPeF/O7BMLLj77pvRNwP/QUZy4eh3V8kW5lt6m6x5RRlgZyf4fDaTn FWSBVKrzLc75Gm0GjupeJzZYzhJdv+CXkiMLu0QxxhCMpQTTspz5vI3A1MtGRBYm Tmj+zcksvDq6cGFoMEiqoRhyWNOUGp+Sf8cH8/UTFlCwzGM3wSzkZaZJWi8Fxmsx sv+DTohW5eNj0DxJJfwaivv1MbqvSeYoI/ZJX7ZOjyS0pMxtK1+Y55n0pom9AYSr Gs9ZAcAXN/vMNduw6hDXka4XqMp4s0Ar1Jf3WLmB2WMoD+q+dr7WXMne754uCHAD 0nAl4hor+gx7DBZ0lZEdYVd8ImLAvhpk5rz2HW/5TcGeV5dWjkvC8xHx8xU= Extension name: 1zac11n ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!

URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/73F0511197A918F7

http://decryptor.top/73F0511197A918F7

Signatures

Enumerates connected drives 3 TTPs

Query Registry
T1012

Peripheral Device Discovery
T1120

System Information Discovery
T1082

Drops file in Program Files directory 35 IoCs

Processes:

1.exe

description	ioc	process
File opened for modification	\??\c:\program files\SubmitOpen.asp	1.exe
File opened for modification	\??\c:\program files\WriteConvert.7z	1.exe
File opened for modification	\??\c:\program files\SplitOpen.wax	1.exe
File opened for modification	\??\c:\program files\SubmitInstall.ppsx	1.exe
File opened for modification	\??\c:\program files\UnpublishWait.mhtml	1.exe
File opened for modification	\??\c:\program files\UseSet.kix	1.exe
File opened for modification	\??\c:\program files\GetUnpublish.search-ms	1.exe
File opened for modification	\??\c:\program files\ResizeGrant.ttf	1.exe
File opened for modification	\??\c:\program files\CheckpointInstall.au3	1.exe
File opened for modification	\??\c:\program files\PopMeasure.mht	1.exe
File opened for modification	\??\c:\program files\UninstallSend.wma	1.exe
File opened for modification	\??\c:\program files\AddReset.xltm	1.exe
File opened for modification	\??\c:\program files\ApproveCompress.wvx	1.exe
File opened for modification	\??\c:\program files\ClearResolve.xml	1.exe
File opened for modification	\??\c:\program files\ShowExport.jfif	1.exe
File opened for modification	\??\c:\program files\EnterClear.ttc	1.exe
File opened for modification	\??\c:\program files\JoinMove.vst	1.exe
File opened for modification	\??\c:\program files\ResizeUpdate.docx	1.exe
File opened for modification	\??\c:\program files\UninstallStart.xla	1.exe
File created	\??\c:\program files\1zac11n-readme.txt	1.exe
File opened for modification	\??\c:\program files\CompareRegister.rtf	1.exe
File opened for modification	\??\c:\program files\PublishEnable.mov	1.exe
File opened for modification	\??\c:\program files\RedoWrite.html	1.exe
File opened for modification	\??\c:\program files\RestoreUse.vst	1.exe
File opened for modification	\??\c:\program files\UnprotectConvertFrom.3gpp	1.exe
File opened for modification	\??\c:\program files\ClearAdd.html	1.exe
File opened for modification	\??\c:\program files\FindRequest.3gp	1.exe
File opened for modification	\??\c:\program files\ResolveOptimize.wm	1.exe
File opened for modification	\??\c:\program files\UnblockSet.rar	1.exe
File created	\??\c:\program files (x86)\1zac11n-readme.txt	1.exe
File opened for modification	\??\c:\program files\RequestOut.ram	1.exe
File opened for modification	\??\c:\program files\ResumeLimit.vssx	1.exe
File opened for modification	\??\c:\program files\UnlockSend.scf	1.exe
File opened for modification	\??\c:\program files\ApproveReceive.mpeg2	1.exe
File opened for modification	\??\c:\program files\RepairCheckpoint.rtf	1.exe

Modifies registry class 1 IoCs

Processes:

OpenWith.exe

description ioc process

Key created \REGISTRY\USER\S-1-5-21-1231583446-2617009595-2137880041-1000_Classes\Local Settings OpenWith.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-1231583446-2617009595-2137880041-1000_Classes\Local Settings	OpenWith.exe

Modifies data under HKEY_USERS 15 IoCs

Processes:

LogonUI.exe

description	ioc	process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\StartColorMenu = "4288567808"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365271"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglow = "3288365271"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationGlassAttribute = "1"	LogonUI.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = a6d8ff0076b9ed00429ce3000078d700005a9e000042750000264200f7630c00	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentColorMenu = "4292311040"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\AccentColor = "4292311040"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationBlurBalance = "1"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColorBalance = "89"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglowBalance = "10"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\EnableWindowColorization = "1"	LogonUI.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes:

powershell.exevssvc.exe

description	pid	process
Token: SeDebugPrivilege	3744	powershell.exe
Token: SeBackupPrivilege	3304	vssvc.exe
Token: SeRestorePrivilege	3304	vssvc.exe
Token: SeAuditPrivilege	3304	vssvc.exe

Suspicious use of WriteProcessMemory 2 IoCs

Processes:

1.exe

description pid process target process

PID 2556 wrote to memory of 3744 2556 1.exe powershell.exe
PID 2556 wrote to memory of 3744 2556 1.exe powershell.exe
Suspicious use of SetWindowsHookEx 3 IoCs

Processes:

OpenWith.exeLogonUI.exe

pid process

1304 OpenWith.exe
3180 LogonUI.exe
3180 LogonUI.exe
Sodin,Sodinokibi,REvil
Ransomware with advanced anti-analysis and privilege escalation functionality.
ransomware sodinokibi

description	pid	process	target process
PID 2556 wrote to memory of 3744	2556	1.exe	powershell.exe
PID 2556 wrote to memory of 3744	2556	1.exe	powershell.exe

pid	process
1304	OpenWith.exe
3180	LogonUI.exe
3180	LogonUI.exe

Modifies service 2 TTPs 5 IoCs

persistence

Modify Registry

T1112

Modify Existing Service

T1031

Processes:

vssvc.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\Registry Writer	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\COM+ REGDB Writer	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\ASR Writer	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SwProvider_{b5946137-7b9f-4925-af80-51abd60b20d5}	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\Shadow Copy Optimization Writer	vssvc.exe

Sets desktop wallpaper using registry 2 TTPs 1 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

Processes:

1.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-1231583446-2617009595-2137880041-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\799c0zbg82st.bmp"	1.exe

Modifies Winlogon 2 TTPs 1 IoCs
persistence

Winlogon Helper DLL
T1004

Modify Registry
T1112

Processes:

LogonUI.exe

description ioc process

Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\AutoLogonChecked LogonUI.exe
Suspicious behavior: EnumeratesProcesses 5 IoCs

Processes:

1.exepowershell.exe

pid process

2556 1.exe
2556 1.exe
3744 powershell.exe
3744 powershell.exe
3744 powershell.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\AutoLogonChecked	LogonUI.exe

pid	process
2556	1.exe
2556	1.exe
3744	powershell.exe
3744	powershell.exe
3744	powershell.exe

C:\Users\Admin\AppData\Local\Temp\1.exe
"C:\Users\Admin\AppData\Local\Temp\1.exe"
1⤵
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
- Sets desktop wallpaper using registry
- Suspicious behavior: EnumeratesProcesses
PID:2556

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell -e RwBlAHQALQBXAG0AaQBPAGIAagBlAGMAdAAgAFcAaQBuADMAMgBfAFMAaABhAGQAbwB3AGMAbwBwAHkAIAB8ACAARgBvAHIARQBhAGMAaAAtAE8AYgBqAGUAYwB0ACAAewAkAF8ALgBEAGUAbABlAHQAZQAoACkAOwB9AA==
2⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: EnumeratesProcesses
PID:3744

C:\Windows\system32\wbem\unsecapp.exe
C:\Windows\system32\wbem\unsecapp.exe -Embedding
1⤵
PID:2868

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
- Modifies service
PID:3304

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:1304

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x0 /state0:0xa3ad6055 /state1:0x41c64e6d
1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
- Modifies Winlogon
PID:3180

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Modify Existing Service

Winlogon Helper DLL

Privilege Escalation

Defense Evasion

Modify Registry

3

T1112

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Defacement

1

T1491

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2556-0-0x0000000004FA9000-0x0000000004FAA000-memory.dmp

Filesize
4KB

Download
memory/2556-1-0x0000000006DB0000-0x0000000006DB1000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

Errors

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads