sodinokibi | fcb9ba05f921f7af41dba56b278c39715a8631c27048c70d098574e7ec20db22

Analysis

max time kernel
149s
max time network
151s
platform
windows10_x64
resource
win10
submitted
20/07/2020, 18:46

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
fcb9ba05f921f7af41dba56b278c39715a8631c27048c70d098574e7ec20db22.bin.exe
Size 166KB
Sample200720-gpkbnv7ql6
SHA256 fcb9ba05f921f7af41dba56b278c39715a8631c27048c70d098574e7ec20db22
MD5 9c21e23a91e0488d8df5e65b5d29a2fe
SHA1 f032814f2e072178a0c20d7500c2e1e4352aca39
SHA512 6a9008181203b1d02e62256c62d41e6788caf16b60977ff796bff8b4c42efc815b092082ee99d92d459c54f3b6e440ecfa16d5bfff9a63aa099f48ba20fc53b1
MD5 SHA1 SHA512

Score

10^/10

ransomware persistence sodinokibi

Malware Config

Extracted

Path

C:\06fp30-readme.txt

sodinokibi

Ransom Note

---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension 06fp30. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practice - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/5755C63FBF55DAB7 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/5755C63FBF55DAB7 Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: LOgY9TUhPIdz1pMOTQK0nw1wn145t+TlalqSEvnAa7AiPkS5yGTLLCPp1ECioW1o OBkXTAX655iSngyUEdkaV+7UgEHkL7aBza7wwGOl+ue5lU1veRITpvMNQlo1RNds tyFrX1U71+O4Lyr4vShHLi7mx/vMZMXNaH3htQ6/cyRHpfjLec5C5O/UkkZDe0V8 NHbJjlmSdXK1/l9/c8GreNK1IUBbJnNVexXfkdWicbabt9hbRdqUoz75xEQ2TOyV 9gzX0ye61foBIFbSQUDqlqqkHqxT6+Msg6uMsGQn0hEoDyYcFMyvXRuvfRq55Cwm vJJjTMm/e5Bg13zCGnMGeKwZO4869u4K+snIDb11KBA8aD8zzl3Am7qZs9PP+U7K kxmSncrX2aS0zZGVMJNM5Q5p11ZlL1Pch+OzYLbVaDwSmnsmAGQEbBTidOMPys1x rNUnxJMaaVIi5AxwVKhuT8D9IrEQYI/4LmVSKfV/RxCwOnmTAEI5xgF0INphUaT+ gw9j+LIYp6jk2LJIsHpol3NrhaqgUhUlzrPyVuBuaMJ6ZCLmAgphr9DTDWJgMOIn MDZdZDlWMmAtizfrXgbv/fQA6EEmS5FCnz1w1hSAY0aiNo/MBQMK4RI9x6tce+2h ntOdvuyoJXtFpUOHVQ9i8tV1gmMddKOGrBKQj9NKm9mVmxOXVHWVASyLuNUPVdvv WR1FAQLYUsM4/A5w+EQ5UcTK7TZ1sgw19pfRwWtm8f7tN820crCCUNJbEN8hdvpy jEnLplzvyxl8DDMu+n6tRRdcAbay3pM+3BRxVAGFZtR2JMx9Lui6jAtpgntHmEDD 8HTPNhSQFQ7AV0ZlQeDHUyYUPuQ9OgF4oReMP2zTPw19lRLOy9OEsYnETTydZCmD AXzlaJy6UwAthCIqEkiQQEp8JgTgBeccmWGytOF2kIEMmwVSL20FLRyzTSLRHcBb /DP3+halRaIOJw2ck/DyS/oqDkDNkedp0RXpocSKSarmRf/aAeAHYz6+9noS73ZS Gt6K0PlTzq/4OvLYV/c1FGfHdn0RIEqTJ53/Zj54Ggwq3U+dHn8C+LR8wGQ6PHVB P2W8QMUsS1N8nXeTfkddNJ+LqsIG3v7UtnHefNQ+jbrEbQ2Ee27ijlxT9WmP1fKl 3+qcZ3S4jeyXzttoAGTIZ8/lXOXQjkp/hZ9RImA0WqD/MYZKt19ss9Ijnxl/sLUQ r9N5olUCFHqxICD436QgY8gYTE+bjdOuKmokhpAz6fa3bS1Mz9hkcMbN7WNjneDq osIPLJGdEkZc+5fH5fSAIA== ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damage of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!

URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/5755C63FBF55DAB7
http://decryptor.cc/5755C63FBF55DAB7

Signatures

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeDebugPrivilege	4048	fcb9ba05f921f7af41dba56b278c39715a8631c27048c70d098574e7ec20db22.bin.exe
Token: SeDebugPrivilege	3832	powershell.exe
Token: SeBackupPrivilege	580	vssvc.exe
Token: SeRestorePrivilege	580	vssvc.exe
Token: SeAuditPrivilege	580	vssvc.exe
Token: SeTakeOwnershipPrivilege	4048	fcb9ba05f921f7af41dba56b278c39715a8631c27048c70d098574e7ec20db22.bin.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4048 wrote to memory of 3832	4048	fcb9ba05f921f7af41dba56b278c39715a8631c27048c70d098574e7ec20db22.bin.exe	67
PID 4048 wrote to memory of 3832	4048	fcb9ba05f921f7af41dba56b278c39715a8631c27048c70d098574e7ec20db22.bin.exe	67

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	fcb9ba05f921f7af41dba56b278c39715a8631c27048c70d098574e7ec20db22.bin.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\oXnEn2JlQT = "C:\\Users\\Admin\\AppData\\Local\\Temp\\fcb9ba05f921f7af41dba56b278c39715a8631c27048c70d098574e7ec20db22.bin.exe"	fcb9ba05f921f7af41dba56b278c39715a8631c27048c70d098574e7ec20db22.bin.exe

Sets desktop wallpaper using registry 2 TTPs 1 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2b9ghd7jhl5l.bmp"	fcb9ba05f921f7af41dba56b278c39715a8631c27048c70d098574e7ec20db22.bin.exe

Suspicious behavior: EnumeratesProcesses 5 IoCs

pid	Process
4048	fcb9ba05f921f7af41dba56b278c39715a8631c27048c70d098574e7ec20db22.bin.exe
4048	fcb9ba05f921f7af41dba56b278c39715a8631c27048c70d098574e7ec20db22.bin.exe
3832	powershell.exe
3832	powershell.exe
3832	powershell.exe

Enumerates connected drives 3 TTPs

Query Registry
T1012

Peripheral Device Discovery
T1120

System Information Discovery
T1082

Modifies service 2 TTPs 5 IoCs

persistence

Modify Registry

T1112

Modify Existing Service

T1031

description	ioc	Process
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\Shadow Copy Optimization Writer	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SwProvider_{b5946137-7b9f-4925-af80-51abd60b20d5}	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\Registry Writer	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\COM+ REGDB Writer	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\ASR Writer	vssvc.exe

Drops file in Program Files directory 33 IoCs

description	ioc	Process
File opened for modification	\??\c:\program files\SearchBlock.vssm	fcb9ba05f921f7af41dba56b278c39715a8631c27048c70d098574e7ec20db22.bin.exe
File opened for modification	\??\c:\program files\DisablePush.xsl	fcb9ba05f921f7af41dba56b278c39715a8631c27048c70d098574e7ec20db22.bin.exe
File opened for modification	\??\c:\program files\EnterUninstall.dib	fcb9ba05f921f7af41dba56b278c39715a8631c27048c70d098574e7ec20db22.bin.exe
File opened for modification	\??\c:\program files\DenyFormat.avi	fcb9ba05f921f7af41dba56b278c39715a8631c27048c70d098574e7ec20db22.bin.exe
File opened for modification	\??\c:\program files\SuspendGrant.jtx	fcb9ba05f921f7af41dba56b278c39715a8631c27048c70d098574e7ec20db22.bin.exe
File opened for modification	\??\c:\program files\GroupEdit.mp4v	fcb9ba05f921f7af41dba56b278c39715a8631c27048c70d098574e7ec20db22.bin.exe
File opened for modification	\??\c:\program files\OpenRequest.ex_	fcb9ba05f921f7af41dba56b278c39715a8631c27048c70d098574e7ec20db22.bin.exe
File opened for modification	\??\c:\program files\RedoUnpublish.crw	fcb9ba05f921f7af41dba56b278c39715a8631c27048c70d098574e7ec20db22.bin.exe
File opened for modification	\??\c:\program files\RestoreBlock.dwg	fcb9ba05f921f7af41dba56b278c39715a8631c27048c70d098574e7ec20db22.bin.exe
File opened for modification	\??\c:\program files\SplitRestart.nfo	fcb9ba05f921f7af41dba56b278c39715a8631c27048c70d098574e7ec20db22.bin.exe
File opened for modification	\??\c:\program files\SyncResume.ppt	fcb9ba05f921f7af41dba56b278c39715a8631c27048c70d098574e7ec20db22.bin.exe
File opened for modification	\??\c:\program files\UninstallConvert.M2V	fcb9ba05f921f7af41dba56b278c39715a8631c27048c70d098574e7ec20db22.bin.exe
File created	\??\c:\program files\06fp30-readme.txt	fcb9ba05f921f7af41dba56b278c39715a8631c27048c70d098574e7ec20db22.bin.exe
File opened for modification	\??\c:\program files\NewLimit.vssx	fcb9ba05f921f7af41dba56b278c39715a8631c27048c70d098574e7ec20db22.bin.exe
File opened for modification	\??\c:\program files\SetConnect.rle	fcb9ba05f921f7af41dba56b278c39715a8631c27048c70d098574e7ec20db22.bin.exe
File opened for modification	\??\c:\program files\UninstallPop.xltx	fcb9ba05f921f7af41dba56b278c39715a8631c27048c70d098574e7ec20db22.bin.exe
File opened for modification	\??\c:\program files\UnlockStart.rm	fcb9ba05f921f7af41dba56b278c39715a8631c27048c70d098574e7ec20db22.bin.exe
File opened for modification	\??\c:\program files\AddFind.pdf	fcb9ba05f921f7af41dba56b278c39715a8631c27048c70d098574e7ec20db22.bin.exe
File opened for modification	\??\c:\program files\PingStep.emz	fcb9ba05f921f7af41dba56b278c39715a8631c27048c70d098574e7ec20db22.bin.exe
File opened for modification	\??\c:\program files\RenameSearch.ini	fcb9ba05f921f7af41dba56b278c39715a8631c27048c70d098574e7ec20db22.bin.exe
File opened for modification	\??\c:\program files\ShowUnlock.jpg	fcb9ba05f921f7af41dba56b278c39715a8631c27048c70d098574e7ec20db22.bin.exe
File opened for modification	\??\c:\program files\NewUnprotect.dotx	fcb9ba05f921f7af41dba56b278c39715a8631c27048c70d098574e7ec20db22.bin.exe
File opened for modification	\??\c:\program files\RenameCompress.wvx	fcb9ba05f921f7af41dba56b278c39715a8631c27048c70d098574e7ec20db22.bin.exe
File opened for modification	\??\c:\program files\GetRedo.ppsm	fcb9ba05f921f7af41dba56b278c39715a8631c27048c70d098574e7ec20db22.bin.exe
File opened for modification	\??\c:\program files\LimitFormat.rtf	fcb9ba05f921f7af41dba56b278c39715a8631c27048c70d098574e7ec20db22.bin.exe
File opened for modification	\??\c:\program files\RegisterInstall.ps1xml	fcb9ba05f921f7af41dba56b278c39715a8631c27048c70d098574e7ec20db22.bin.exe
File opened for modification	\??\c:\program files\SendUninstall.xhtml	fcb9ba05f921f7af41dba56b278c39715a8631c27048c70d098574e7ec20db22.bin.exe
File created	\??\c:\program files (x86)\06fp30-readme.txt	fcb9ba05f921f7af41dba56b278c39715a8631c27048c70d098574e7ec20db22.bin.exe
File opened for modification	\??\c:\program files\ConnectComplete.odp	fcb9ba05f921f7af41dba56b278c39715a8631c27048c70d098574e7ec20db22.bin.exe
File opened for modification	\??\c:\program files\SplitUnblock.crw	fcb9ba05f921f7af41dba56b278c39715a8631c27048c70d098574e7ec20db22.bin.exe
File opened for modification	\??\c:\program files\SwitchRevoke.pcx	fcb9ba05f921f7af41dba56b278c39715a8631c27048c70d098574e7ec20db22.bin.exe
File opened for modification	\??\c:\program files\CompressDismount.bmp	fcb9ba05f921f7af41dba56b278c39715a8631c27048c70d098574e7ec20db22.bin.exe
File opened for modification	\??\c:\program files\SearchOptimize.zip	fcb9ba05f921f7af41dba56b278c39715a8631c27048c70d098574e7ec20db22.bin.exe

Modifies system certificate store 2 TTPs 5 IoCs

evasion spyware trojan

Install Root Certificate

T1130

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\02FAF3E291435468607857694DF5E45B68851868\Blob = 0f000000010000001400000009b9105c5bba24343ca7f341c624e183f6ee7c1b090000000100000054000000305206082b06010505070308060a2b0601040182370a030406082b0601050507030606082b0601050507030106082b0601050507030706082b0601050507030206082b0601050507030406082b0601050507030353000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c00b00000001000000260000005300650063007400690067006f00200028004100640064005400720075007300740029000000620000000100000020000000687fa451382278fff0c8b11f8d43d576671c6eb2bceab413fb83d965d06d2ff2140000000100000014000000adbd987a34b426f7fac42654ef03bde024cb541a1d000000010000001000000006f9583c00a763c23fb9e065a3366d5503000000010000001400000002faf3e291435468607857694df5e45b6885186820000000010000003a040000308204363082031ea003020102020101300d06092a864886f70d0101050500306f310b300906035504061302534531143012060355040a130b416464547275737420414231263024060355040b131d41646454727573742045787465726e616c20545450204e6574776f726b312230200603550403131941646454727573742045787465726e616c20434120526f6f74301e170d3030303533303130343833385a170d3230303533303130343833385a306f310b300906035504061302534531143012060355040a130b416464547275737420414231263024060355040b131d41646454727573742045787465726e616c20545450204e6574776f726b312230200603550403131941646454727573742045787465726e616c20434120526f6f7430820122300d06092a864886f70d01010105000382010f003082010a0282010100b7f71a33e6f200042d39e04e5bed1fbc6c0fcdb5fa23b6cede9b113397a4294c7d939fbd4abc93ed031ae38fcfe56d505ad69729945a80b0497adb2e95fdb8cabf37382d1e3e9141ad7056c7f04f3fe8329e74cac89054e9c65f0f789d9a403c0eac61aa5e148f9e87a16a50dcd79a4eaf05b3a671949c71b350600ac7139d38078602a8e9a869261890ab4cb04f23ab3a4f84d8dfce9fe1696fbbd742d76b44e4c7adee6d415f725a710837b37965a459a09437f7002f0dc29272dad03872db14a845c45d2a7db7b4d6c4eeaccd1344b7c92bdd430025fa61b9696a582311b7a7338f567559f5cd29d746b70a2b65b6d3426f15b2b87bfbefe95d53d5345a270203010001a381dc3081d9301d0603551d0e04160414adbd987a34b426f7fac42654ef03bde024cb541a300b0603551d0f040403020106300f0603551d130101ff040530030101ff3081990603551d2304819130818e8014adbd987a34b426f7fac42654ef03bde024cb541aa173a471306f310b300906035504061302534531143012060355040a130b416464547275737420414231263024060355040b131d41646454727573742045787465726e616c20545450204e6574776f726b312230200603550403131941646454727573742045787465726e616c20434120526f6f74820101300d06092a864886f70d01010505000382010100b09be08525c2d623e20f9606929d41989cd9847981d91e5b14072336658fb0d877bbac416c47608351b0f9323de7fcf62613c78016a5bf5afc87cf787989219ae24c070a8635bcf2de51c4d296b7dc7e4eee70fd1c39eb0c0251142d8ebd16e0c1df4675e724adecf442b48593701067ba9d06354a18d32b7acc5142a17a63d1e6bba1c52bc236be130de6bd637e797ba7090d40ab6add8f8ac3f6f68c1a420551d445f59fa76221681520433c99e77cbd24d8a9911773883f561b313818b4710f9acdc80e9e8e2e1be18c9883cb1f31f1444cc604734976600fc7f8bd17806b2ee9cc4c0e5a9a790f200a2ed59e63261e559294d882175a7bd0bcc78f4e8604	fcb9ba05f921f7af41dba56b278c39715a8631c27048c70d098574e7ec20db22.bin.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\02FAF3E291435468607857694DF5E45B68851868\Blob = 0400000001000000100000001d3554048578b03f42424dbf20730a3f03000000010000001400000002faf3e291435468607857694df5e45b688518681d000000010000001000000006f9583c00a763c23fb9e065a3366d55140000000100000014000000adbd987a34b426f7fac42654ef03bde024cb541a620000000100000020000000687fa451382278fff0c8b11f8d43d576671c6eb2bceab413fb83d965d06d2ff20b00000001000000260000005300650063007400690067006f0020002800410064006400540072007500730074002900000053000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0090000000100000054000000305206082b06010505070308060a2b0601040182370a030406082b0601050507030606082b0601050507030106082b0601050507030706082b0601050507030206082b0601050507030406082b060105050703030f000000010000001400000009b9105c5bba24343ca7f341c624e183f6ee7c1b20000000010000003a040000308204363082031ea003020102020101300d06092a864886f70d0101050500306f310b300906035504061302534531143012060355040a130b416464547275737420414231263024060355040b131d41646454727573742045787465726e616c20545450204e6574776f726b312230200603550403131941646454727573742045787465726e616c20434120526f6f74301e170d3030303533303130343833385a170d3230303533303130343833385a306f310b300906035504061302534531143012060355040a130b416464547275737420414231263024060355040b131d41646454727573742045787465726e616c20545450204e6574776f726b312230200603550403131941646454727573742045787465726e616c20434120526f6f7430820122300d06092a864886f70d01010105000382010f003082010a0282010100b7f71a33e6f200042d39e04e5bed1fbc6c0fcdb5fa23b6cede9b113397a4294c7d939fbd4abc93ed031ae38fcfe56d505ad69729945a80b0497adb2e95fdb8cabf37382d1e3e9141ad7056c7f04f3fe8329e74cac89054e9c65f0f789d9a403c0eac61aa5e148f9e87a16a50dcd79a4eaf05b3a671949c71b350600ac7139d38078602a8e9a869261890ab4cb04f23ab3a4f84d8dfce9fe1696fbbd742d76b44e4c7adee6d415f725a710837b37965a459a09437f7002f0dc29272dad03872db14a845c45d2a7db7b4d6c4eeaccd1344b7c92bdd430025fa61b9696a582311b7a7338f567559f5cd29d746b70a2b65b6d3426f15b2b87bfbefe95d53d5345a270203010001a381dc3081d9301d0603551d0e04160414adbd987a34b426f7fac42654ef03bde024cb541a300b0603551d0f040403020106300f0603551d130101ff040530030101ff3081990603551d2304819130818e8014adbd987a34b426f7fac42654ef03bde024cb541aa173a471306f310b300906035504061302534531143012060355040a130b416464547275737420414231263024060355040b131d41646454727573742045787465726e616c20545450204e6574776f726b312230200603550403131941646454727573742045787465726e616c20434120526f6f74820101300d06092a864886f70d01010505000382010100b09be08525c2d623e20f9606929d41989cd9847981d91e5b14072336658fb0d877bbac416c47608351b0f9323de7fcf62613c78016a5bf5afc87cf787989219ae24c070a8635bcf2de51c4d296b7dc7e4eee70fd1c39eb0c0251142d8ebd16e0c1df4675e724adecf442b48593701067ba9d06354a18d32b7acc5142a17a63d1e6bba1c52bc236be130de6bd637e797ba7090d40ab6add8f8ac3f6f68c1a420551d445f59fa76221681520433c99e77cbd24d8a9911773883f561b313818b4710f9acdc80e9e8e2e1be18c9883cb1f31f1444cc604734976600fc7f8bd17806b2ee9cc4c0e5a9a790f200a2ed59e63261e559294d882175a7bd0bcc78f4e8604	fcb9ba05f921f7af41dba56b278c39715a8631c27048c70d098574e7ec20db22.bin.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\02FAF3E291435468607857694DF5E45B68851868\Blob = 19000000010000001000000045ed9bbc5e43d3b9ecd63c060db78e5c0f000000010000001400000009b9105c5bba24343ca7f341c624e183f6ee7c1b090000000100000054000000305206082b06010505070308060a2b0601040182370a030406082b0601050507030606082b0601050507030106082b0601050507030706082b0601050507030206082b0601050507030406082b0601050507030353000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c00b00000001000000260000005300650063007400690067006f00200028004100640064005400720075007300740029000000620000000100000020000000687fa451382278fff0c8b11f8d43d576671c6eb2bceab413fb83d965d06d2ff2140000000100000014000000adbd987a34b426f7fac42654ef03bde024cb541a1d000000010000001000000006f9583c00a763c23fb9e065a3366d5503000000010000001400000002faf3e291435468607857694df5e45b688518680400000001000000100000001d3554048578b03f42424dbf20730a3f20000000010000003a040000308204363082031ea003020102020101300d06092a864886f70d0101050500306f310b300906035504061302534531143012060355040a130b416464547275737420414231263024060355040b131d41646454727573742045787465726e616c20545450204e6574776f726b312230200603550403131941646454727573742045787465726e616c20434120526f6f74301e170d3030303533303130343833385a170d3230303533303130343833385a306f310b300906035504061302534531143012060355040a130b416464547275737420414231263024060355040b131d41646454727573742045787465726e616c20545450204e6574776f726b312230200603550403131941646454727573742045787465726e616c20434120526f6f7430820122300d06092a864886f70d01010105000382010f003082010a0282010100b7f71a33e6f200042d39e04e5bed1fbc6c0fcdb5fa23b6cede9b113397a4294c7d939fbd4abc93ed031ae38fcfe56d505ad69729945a80b0497adb2e95fdb8cabf37382d1e3e9141ad7056c7f04f3fe8329e74cac89054e9c65f0f789d9a403c0eac61aa5e148f9e87a16a50dcd79a4eaf05b3a671949c71b350600ac7139d38078602a8e9a869261890ab4cb04f23ab3a4f84d8dfce9fe1696fbbd742d76b44e4c7adee6d415f725a710837b37965a459a09437f7002f0dc29272dad03872db14a845c45d2a7db7b4d6c4eeaccd1344b7c92bdd430025fa61b9696a582311b7a7338f567559f5cd29d746b70a2b65b6d3426f15b2b87bfbefe95d53d5345a270203010001a381dc3081d9301d0603551d0e04160414adbd987a34b426f7fac42654ef03bde024cb541a300b0603551d0f040403020106300f0603551d130101ff040530030101ff3081990603551d2304819130818e8014adbd987a34b426f7fac42654ef03bde024cb541aa173a471306f310b300906035504061302534531143012060355040a130b416464547275737420414231263024060355040b131d41646454727573742045787465726e616c20545450204e6574776f726b312230200603550403131941646454727573742045787465726e616c20434120526f6f74820101300d06092a864886f70d01010505000382010100b09be08525c2d623e20f9606929d41989cd9847981d91e5b14072336658fb0d877bbac416c47608351b0f9323de7fcf62613c78016a5bf5afc87cf787989219ae24c070a8635bcf2de51c4d296b7dc7e4eee70fd1c39eb0c0251142d8ebd16e0c1df4675e724adecf442b48593701067ba9d06354a18d32b7acc5142a17a63d1e6bba1c52bc236be130de6bd637e797ba7090d40ab6add8f8ac3f6f68c1a420551d445f59fa76221681520433c99e77cbd24d8a9911773883f561b313818b4710f9acdc80e9e8e2e1be18c9883cb1f31f1444cc604734976600fc7f8bd17806b2ee9cc4c0e5a9a790f200a2ed59e63261e559294d882175a7bd0bcc78f4e8604	fcb9ba05f921f7af41dba56b278c39715a8631c27048c70d098574e7ec20db22.bin.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\02FAF3E291435468607857694DF5E45B68851868\Blob = 5c0000000100000004000000000800000400000001000000100000001d3554048578b03f42424dbf20730a3f03000000010000001400000002faf3e291435468607857694df5e45b688518681d000000010000001000000006f9583c00a763c23fb9e065a3366d55140000000100000014000000adbd987a34b426f7fac42654ef03bde024cb541a620000000100000020000000687fa451382278fff0c8b11f8d43d576671c6eb2bceab413fb83d965d06d2ff20b00000001000000260000005300650063007400690067006f0020002800410064006400540072007500730074002900000053000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0090000000100000054000000305206082b06010505070308060a2b0601040182370a030406082b0601050507030606082b0601050507030106082b0601050507030706082b0601050507030206082b0601050507030406082b060105050703030f000000010000001400000009b9105c5bba24343ca7f341c624e183f6ee7c1b19000000010000001000000045ed9bbc5e43d3b9ecd63c060db78e5c20000000010000003a040000308204363082031ea003020102020101300d06092a864886f70d0101050500306f310b300906035504061302534531143012060355040a130b416464547275737420414231263024060355040b131d41646454727573742045787465726e616c20545450204e6574776f726b312230200603550403131941646454727573742045787465726e616c20434120526f6f74301e170d3030303533303130343833385a170d3230303533303130343833385a306f310b300906035504061302534531143012060355040a130b416464547275737420414231263024060355040b131d41646454727573742045787465726e616c20545450204e6574776f726b312230200603550403131941646454727573742045787465726e616c20434120526f6f7430820122300d06092a864886f70d01010105000382010f003082010a0282010100b7f71a33e6f200042d39e04e5bed1fbc6c0fcdb5fa23b6cede9b113397a4294c7d939fbd4abc93ed031ae38fcfe56d505ad69729945a80b0497adb2e95fdb8cabf37382d1e3e9141ad7056c7f04f3fe8329e74cac89054e9c65f0f789d9a403c0eac61aa5e148f9e87a16a50dcd79a4eaf05b3a671949c71b350600ac7139d38078602a8e9a869261890ab4cb04f23ab3a4f84d8dfce9fe1696fbbd742d76b44e4c7adee6d415f725a710837b37965a459a09437f7002f0dc29272dad03872db14a845c45d2a7db7b4d6c4eeaccd1344b7c92bdd430025fa61b9696a582311b7a7338f567559f5cd29d746b70a2b65b6d3426f15b2b87bfbefe95d53d5345a270203010001a381dc3081d9301d0603551d0e04160414adbd987a34b426f7fac42654ef03bde024cb541a300b0603551d0f040403020106300f0603551d130101ff040530030101ff3081990603551d2304819130818e8014adbd987a34b426f7fac42654ef03bde024cb541aa173a471306f310b300906035504061302534531143012060355040a130b416464547275737420414231263024060355040b131d41646454727573742045787465726e616c20545450204e6574776f726b312230200603550403131941646454727573742045787465726e616c20434120526f6f74820101300d06092a864886f70d01010505000382010100b09be08525c2d623e20f9606929d41989cd9847981d91e5b14072336658fb0d877bbac416c47608351b0f9323de7fcf62613c78016a5bf5afc87cf787989219ae24c070a8635bcf2de51c4d296b7dc7e4eee70fd1c39eb0c0251142d8ebd16e0c1df4675e724adecf442b48593701067ba9d06354a18d32b7acc5142a17a63d1e6bba1c52bc236be130de6bd637e797ba7090d40ab6add8f8ac3f6f68c1a420551d445f59fa76221681520433c99e77cbd24d8a9911773883f561b313818b4710f9acdc80e9e8e2e1be18c9883cb1f31f1444cc604734976600fc7f8bd17806b2ee9cc4c0e5a9a790f200a2ed59e63261e559294d882175a7bd0bcc78f4e8604	fcb9ba05f921f7af41dba56b278c39715a8631c27048c70d098574e7ec20db22.bin.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\02FAF3E291435468607857694DF5E45B68851868	fcb9ba05f921f7af41dba56b278c39715a8631c27048c70d098574e7ec20db22.bin.exe

Sodin,Sodinokibi,REvil
Ransomware with advanced anti-analysis and privilege escalation functionality.
ransomware sodinokibi

C:\Users\Admin\AppData\Local\Temp\fcb9ba05f921f7af41dba56b278c39715a8631c27048c70d098574e7ec20db22.bin.exe
"C:\Users\Admin\AppData\Local\Temp\fcb9ba05f921f7af41dba56b278c39715a8631c27048c70d098574e7ec20db22.bin.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- Adds Run key to start application
- Sets desktop wallpaper using registry
- Suspicious behavior: EnumeratesProcesses
- Drops file in Program Files directory
- Modifies system certificate store
PID:4048
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -e RwBlAHQALQBXAG0AaQBPAGIAagBlAGMAdAAgAFcAaQBuADMAMgBfAFMAaABhAGQAbwB3AGMAbwBwAHkAIAB8ACAARgBvAHIARQBhAGMAaAAtAE8AYgBqAGUAYwB0ACAAewAkAF8ALgBEAGUAbABlAHQAZQAoACkAOwB9AA==
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious behavior: EnumeratesProcesses
  PID:3832

C:\Windows\system32\wbem\unsecapp.exe
C:\Windows\system32\wbem\unsecapp.exe -Embedding
1⤵
PID:3868

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
- Modifies service
PID:580

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Modify Existing Service

T1031

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Install Root Certificate

T1130

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Defacement

T1491

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads