sodinokibi | b10d9a62edb6081aa9f7fc865554064bb212555392b1181dc40040e12927f988

General

Target

as.exe
Size

192KB
MD5

beed14bc183ad523b94ef6ac2b270b08
SHA1

4ea45e0d8a4d50182063cc97c8a86d579f3adf05
SHA256

b10d9a62edb6081aa9f7fc865554064bb212555392b1181dc40040e12927f988
SHA512

da74c44e21e120af26074fb6493a35067f037cc633e630b415d9b6947c9dc58e354fbb33afc87f733da8cd4d1f8ca66081df0e96d249ffb1c2ba8142c9317196

Score

10^/10

sodinokibi persistence ransomware

Malware Config

Extracted

Path

C:\11tt7id9-readme.txt

Family

sodinokibi

Ransom Note

---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension 11tt7id9. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practice - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/61773AFBBE4DF929 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/61773AFBBE4DF929 Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: d5VViLFSZ4A8FfZUaqlqm92QOkFNk2NbShAyh7kVNX9HE0yg3f9fdJb47XnjbwFP zyfDlan/FaHvIcudx834TqRHvwN5WKUuuQF5BP+XfF/4fL9CcRcwRnzySfOjbpf3 X30tKfQ5Vf0qqziUCXX5DDG+5QjUoC4AHR2kXwsoQNRN7rntVf6SzDP8uRIupJAy fcszwMApduon6VAEqORNFRy6T336oqP9JPJJgOtE+sBqXM7dBNvi85SCGgOYnWxl A4ixQq75YrWOPahWenzlVi3kTCu2yG6bS1vvmrhepdyiAfv6buzYf0gEsPxAcG3n 3AYqd8as/WpLVOmuuK1kPPMvkAuqiJ3X0aNGcFR9uEiQ+Yse2ec4X/mYgPL9ydFV RaD6+BMohtqsIIwQdkeftTo6mKZb0NB+Ofxsx/cZJdZJo05Qo17ajCgDuJWW1BDy 3nvbFAuUfx+B8raASeaUUVDA7Tz+Ph0jK0B9gzkm6/btcNJKq06RaBZWuoupeXKs xihOZDJfmUZxEZmwBaPTYIc/rwK+VEcq7p2csbg4dI2IZKvlU2DWnGZ95TAagWhz DFhbkQbXyyMDyctmLcSrbws6Q2hZDqGKRHk+lejJ6ta1Mxr/rO20RPZKqsHLtv3F ry4uSxzX5ow6xqGkD0MMvvo31ozqGMEfybgoFs42jrEBKzlMkdUEUYLo1HM0dC/3 MGJj7Bjhe87wooZRWamXg+dQBtzUjSmm4Ct+1an5Xk3mYL/oesGMH1JMFiRWrglu Bnv5b2XSIrSLvvv/dnjFus0ksM48ZVSH0eoXxcWa9XFyNG8ALVFSrtQlpzdLl3kC 4bJMy7XOakiyj0ZqTXj8McJ+8SASLRdSQG5vimQVZ09Ug5rAOtCrA1WNWrBZp4Xa FGpgaXnN9t41fP9s0Kbvg5BKVz97jugsEsYhfjN/EKNd/62TEpfbR1uwoGQ7+xy1 pSh3FOvtBJmvF0B94LuyGi/a64kfieiAGmCwCUIbk4JDTmyMRYP8NRM4VwTSQEYv bC4PmItuHU/nOJPNgbMI0waOd+Y1DXA2uG2fk1eqsUOdI+0SKbTWmIJn7rOuGuNJ B9Z2HkbA/5F5sjIziRs5v+tN+JtLt6AXhyfE7bCyb6TucOk6eP7GeO4oNeNx3gpy ednU73vOw6XOiVI43u/zNL7WhLmsE0ESPN9sUAlVOAHmCKq1qtF2mEmvywo/laM+ wNqfSNA9dncencEWw/BMYkadjcIENVb4cgjQdkNG4x7WRGPN+xdrd6SgyRkXOKU8 /g4UOW+p+UYQVY53XDpTCA/QK3o= ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damage of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!

URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/61773AFBBE4DF929

http://decryptor.cc/61773AFBBE4DF929

Signatures

Sodin,Sodinokibi,REvil
Ransomware with advanced anti-analysis and privilege escalation functionality.
ransomware sodinokibi

Modifies extensions of user files 13 IoCs

Ransomware generally changes the extension on encrypted files.

ransomware

Processes:

as.exe

description	ioc	process
File renamed	C:\Users\Admin\Pictures\AddImport.crw => \??\c:\users\admin\pictures\AddImport.crw.11tt7id9	as.exe
File renamed	C:\Users\Admin\Pictures\BlockMove.raw => \??\c:\users\admin\pictures\BlockMove.raw.11tt7id9	as.exe
File renamed	C:\Users\Admin\Pictures\DisableSuspend.tif => \??\c:\users\admin\pictures\DisableSuspend.tif.11tt7id9	as.exe
File renamed	C:\Users\Admin\Pictures\ReceiveEdit.raw => \??\c:\users\admin\pictures\ReceiveEdit.raw.11tt7id9	as.exe
File renamed	C:\Users\Admin\Pictures\ResolveResume.tif => \??\c:\users\admin\pictures\ResolveResume.tif.11tt7id9	as.exe
File opened for modification	\??\c:\users\admin\pictures\DisconnectResize.tiff	as.exe
File renamed	C:\Users\Admin\Pictures\CloseMerge.raw => \??\c:\users\admin\pictures\CloseMerge.raw.11tt7id9	as.exe
File renamed	C:\Users\Admin\Pictures\CompressUnprotect.raw => \??\c:\users\admin\pictures\CompressUnprotect.raw.11tt7id9	as.exe
File renamed	C:\Users\Admin\Pictures\DisconnectResize.tiff => \??\c:\users\admin\pictures\DisconnectResize.tiff.11tt7id9	as.exe
File renamed	C:\Users\Admin\Pictures\MeasureReset.crw => \??\c:\users\admin\pictures\MeasureReset.crw.11tt7id9	as.exe
File renamed	C:\Users\Admin\Pictures\InvokeSwitch.tif => \??\c:\users\admin\pictures\InvokeSwitch.tif.11tt7id9	as.exe
File renamed	C:\Users\Admin\Pictures\SelectReceive.png => \??\c:\users\admin\pictures\SelectReceive.png.11tt7id9	as.exe
File renamed	C:\Users\Admin\Pictures\WaitStart.png => \??\c:\users\admin\pictures\WaitStart.png.11tt7id9	as.exe

Enumerates connected drives 3 TTPs 25 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

as.exe

description	ioc	process
File opened (read-only)	\??\L:	as.exe
File opened (read-only)	\??\Q:	as.exe
File opened (read-only)	\??\X:	as.exe
File opened (read-only)	\??\A:	as.exe
File opened (read-only)	\??\H:	as.exe
File opened (read-only)	\??\J:	as.exe
File opened (read-only)	\??\M:	as.exe
File opened (read-only)	\??\N:	as.exe
File opened (read-only)	\??\O:	as.exe
File opened (read-only)	\??\W:	as.exe
File opened (read-only)	\??\Z:	as.exe
File opened (read-only)	\??\B:	as.exe
File opened (read-only)	\??\G:	as.exe
File opened (read-only)	\??\K:	as.exe
File opened (read-only)	\??\S:	as.exe
File opened (read-only)	\??\T:	as.exe
File opened (read-only)	\??\U:	as.exe
File opened (read-only)	\??\Y:	as.exe
File opened (read-only)	\??\F:	as.exe
File opened (read-only)	\??\I:	as.exe
File opened (read-only)	\??\R:	as.exe
File opened (read-only)	\??\D:	as.exe
File opened (read-only)	\??\E:	as.exe
File opened (read-only)	\??\P:	as.exe
File opened (read-only)	\??\V:	as.exe

Modifies service 2 TTPs 5 IoCs

persistence

Modify Registry

T1112

Modify Existing Service

T1031

Processes:

vssvc.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SwProvider_{b5946137-7b9f-4925-af80-51abd60b20d5}	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\Registry Writer	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\COM+ REGDB Writer	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\ASR Writer	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\Shadow Copy Optimization Writer	vssvc.exe

Sets desktop wallpaper using registry 2 TTPs 1 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

Processes:

as.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\00p0.bmp"	as.exe

Drops file in Program Files directory 27 IoCs

Processes:

as.exe

description	ioc	process
File opened for modification	\??\c:\program files\ConvertFromRequest.mht	as.exe
File opened for modification	\??\c:\program files\DebugSave.scf	as.exe
File opened for modification	\??\c:\program files\DenyMeasure.m3u	as.exe
File opened for modification	\??\c:\program files\RepairConfirm.gif	as.exe
File opened for modification	\??\c:\program files\RestoreEdit.xhtml	as.exe
File opened for modification	\??\c:\program files\SplitCopy.snd	as.exe
File opened for modification	\??\c:\program files\InvokeConnect.cfg	as.exe
File opened for modification	\??\c:\program files\JoinUninstall.zip	as.exe
File opened for modification	\??\c:\program files\BackupSkip.jpg	as.exe
File created	\??\c:\program files (x86)\11tt7id9-readme.txt	as.exe
File opened for modification	\??\c:\program files\SubmitTest.avi	as.exe
File opened for modification	\??\c:\program files\CompressUnblock.m4a	as.exe
File opened for modification	\??\c:\program files\InvokeOpen.mpg	as.exe
File opened for modification	\??\c:\program files\InvokeCompress.css	as.exe
File opened for modification	\??\c:\program files\InvokeGroup.xltx	as.exe
File opened for modification	\??\c:\program files\ResizeExpand.vsx	as.exe
File opened for modification	\??\c:\program files\StopBackup.vstm	as.exe
File created	\??\c:\program files\11tt7id9-readme.txt	as.exe
File opened for modification	\??\c:\program files\ConvertSelect.DVR	as.exe
File opened for modification	\??\c:\program files\ConvertSkip.ppt	as.exe
File opened for modification	\??\c:\program files\MoveReceive.vssx	as.exe
File opened for modification	\??\c:\program files\ProtectStep.ttf	as.exe
File opened for modification	\??\c:\program files\RegisterUse.vb	as.exe
File opened for modification	\??\c:\program files\RestoreSplit.rle	as.exe
File opened for modification	\??\c:\program files\AssertResize.mpeg2	as.exe
File opened for modification	\??\c:\program files\GroupSearch.htm	as.exe
File opened for modification	\??\c:\program files\MergeSwitch.css	as.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

as.exe

pid process

4628 as.exe
4628 as.exe

pid	process
4628	as.exe
4628	as.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

Processes:

as.exevssvc.exe

description	pid	process
Token: SeDebugPrivilege	4628	as.exe
Token: SeTakeOwnershipPrivilege	4628	as.exe
Token: SeBackupPrivilege	4188	vssvc.exe
Token: SeRestorePrivilege	4188	vssvc.exe
Token: SeAuditPrivilege	4188	vssvc.exe

C:\Users\Admin\AppData\Local\Temp\as.exe
"C:\Users\Admin\AppData\Local\Temp\as.exe"
1⤵
- Modifies extensions of user files
- Enumerates connected drives
- Sets desktop wallpaper using registry
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4628

C:\Windows\system32\wbem\unsecapp.exe
C:\Windows\system32\wbem\unsecapp.exe -Embedding
1⤵
PID:3292

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Modifies service
- Suspicious use of AdjustPrivilegeToken
PID:4188

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Modify Existing Service

1

T1031

Privilege Escalation

Defense Evasion

Modify Registry

2

T1112

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Defacement

1

T1491

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4628-0-0x0000000000B11000-0x0000000000B12000-memory.dmp

Filesize
4KB

Download
memory/4628-1-0x0000000000C00000-0x0000000000C01000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads