Analysis
-
max time kernel
148s -
max time network
150s -
platform
windows10_x64 -
resource
win10v20210410 -
submitted
08-05-2021 16:21
Static task
static1
Behavioral task
behavioral1
Sample
17a54bd46e7815b74ccb29af6a836dda52b63d5ae46b51c941f93aeca5eb2ec4.exe
Resource
win7v20210408
Behavioral task
behavioral2
Sample
17a54bd46e7815b74ccb29af6a836dda52b63d5ae46b51c941f93aeca5eb2ec4.exe
Resource
win10v20210410
General
-
Target
17a54bd46e7815b74ccb29af6a836dda52b63d5ae46b51c941f93aeca5eb2ec4.exe
-
Size
115KB
-
MD5
f4197dd28646000528e651ee1aead23a
-
SHA1
7b1b259c0b84cae045f02c1d17154673141b6947
-
SHA256
17a54bd46e7815b74ccb29af6a836dda52b63d5ae46b51c941f93aeca5eb2ec4
-
SHA512
5b97ed21b885f0f2c6db8c35d27dbd0bfd1e0f1b5e34d566556db9ffe6f7cb38a2c639d8281e9a8798dd31ef9b4075cb57c98fef7243a9a9795c8c8adfe393df
Malware Config
Extracted
C:\ry2r0v1h-readme.txt
sodinokibi
http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/2EFD8E6AAC6D1959
http://decryptor.cc/2EFD8E6AAC6D1959
Signatures
-
Sodin,Sodinokibi,REvil
Ransomware with advanced anti-analysis and privilege escalation functionality.
-
Modifies extensions of user files 9 IoCs
Ransomware generally changes the extension on encrypted files.
Processes:
17a54bd46e7815b74ccb29af6a836dda52b63d5ae46b51c941f93aeca5eb2ec4.exedescription ioc process File renamed C:\Users\Admin\Pictures\CompressUpdate.crw => \??\c:\users\admin\pictures\CompressUpdate.crw.ry2r0v1h 17a54bd46e7815b74ccb29af6a836dda52b63d5ae46b51c941f93aeca5eb2ec4.exe File renamed C:\Users\Admin\Pictures\FindUndo.tif => \??\c:\users\admin\pictures\FindUndo.tif.ry2r0v1h 17a54bd46e7815b74ccb29af6a836dda52b63d5ae46b51c941f93aeca5eb2ec4.exe File opened for modification \??\c:\users\admin\pictures\WaitSuspend.tiff 17a54bd46e7815b74ccb29af6a836dda52b63d5ae46b51c941f93aeca5eb2ec4.exe File renamed C:\Users\Admin\Pictures\ReceiveCompress.png => \??\c:\users\admin\pictures\ReceiveCompress.png.ry2r0v1h 17a54bd46e7815b74ccb29af6a836dda52b63d5ae46b51c941f93aeca5eb2ec4.exe File renamed C:\Users\Admin\Pictures\PublishConvert.tif => \??\c:\users\admin\pictures\PublishConvert.tif.ry2r0v1h 17a54bd46e7815b74ccb29af6a836dda52b63d5ae46b51c941f93aeca5eb2ec4.exe File renamed C:\Users\Admin\Pictures\SkipUnblock.crw => \??\c:\users\admin\pictures\SkipUnblock.crw.ry2r0v1h 17a54bd46e7815b74ccb29af6a836dda52b63d5ae46b51c941f93aeca5eb2ec4.exe File renamed C:\Users\Admin\Pictures\SuspendClose.crw => \??\c:\users\admin\pictures\SuspendClose.crw.ry2r0v1h 17a54bd46e7815b74ccb29af6a836dda52b63d5ae46b51c941f93aeca5eb2ec4.exe File renamed C:\Users\Admin\Pictures\WaitSuspend.tiff => \??\c:\users\admin\pictures\WaitSuspend.tiff.ry2r0v1h 17a54bd46e7815b74ccb29af6a836dda52b63d5ae46b51c941f93aeca5eb2ec4.exe File renamed C:\Users\Admin\Pictures\WatchMeasure.png => \??\c:\users\admin\pictures\WatchMeasure.png.ry2r0v1h 17a54bd46e7815b74ccb29af6a836dda52b63d5ae46b51c941f93aeca5eb2ec4.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
17a54bd46e7815b74ccb29af6a836dda52b63d5ae46b51c941f93aeca5eb2ec4.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\DNXeNcyLON = "C:\\Users\\Admin\\AppData\\Local\\Temp\\17a54bd46e7815b74ccb29af6a836dda52b63d5ae46b51c941f93aeca5eb2ec4.exe" 17a54bd46e7815b74ccb29af6a836dda52b63d5ae46b51c941f93aeca5eb2ec4.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run 17a54bd46e7815b74ccb29af6a836dda52b63d5ae46b51c941f93aeca5eb2ec4.exe -
Enumerates connected drives 3 TTPs 25 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
17a54bd46e7815b74ccb29af6a836dda52b63d5ae46b51c941f93aeca5eb2ec4.exedescription ioc process File opened (read-only) \??\J: 17a54bd46e7815b74ccb29af6a836dda52b63d5ae46b51c941f93aeca5eb2ec4.exe File opened (read-only) \??\U: 17a54bd46e7815b74ccb29af6a836dda52b63d5ae46b51c941f93aeca5eb2ec4.exe File opened (read-only) \??\Q: 17a54bd46e7815b74ccb29af6a836dda52b63d5ae46b51c941f93aeca5eb2ec4.exe File opened (read-only) \??\S: 17a54bd46e7815b74ccb29af6a836dda52b63d5ae46b51c941f93aeca5eb2ec4.exe File opened (read-only) \??\W: 17a54bd46e7815b74ccb29af6a836dda52b63d5ae46b51c941f93aeca5eb2ec4.exe File opened (read-only) \??\X: 17a54bd46e7815b74ccb29af6a836dda52b63d5ae46b51c941f93aeca5eb2ec4.exe File opened (read-only) \??\B: 17a54bd46e7815b74ccb29af6a836dda52b63d5ae46b51c941f93aeca5eb2ec4.exe File opened (read-only) \??\G: 17a54bd46e7815b74ccb29af6a836dda52b63d5ae46b51c941f93aeca5eb2ec4.exe File opened (read-only) \??\M: 17a54bd46e7815b74ccb29af6a836dda52b63d5ae46b51c941f93aeca5eb2ec4.exe File opened (read-only) \??\O: 17a54bd46e7815b74ccb29af6a836dda52b63d5ae46b51c941f93aeca5eb2ec4.exe File opened (read-only) \??\D: 17a54bd46e7815b74ccb29af6a836dda52b63d5ae46b51c941f93aeca5eb2ec4.exe File opened (read-only) \??\P: 17a54bd46e7815b74ccb29af6a836dda52b63d5ae46b51c941f93aeca5eb2ec4.exe File opened (read-only) \??\T: 17a54bd46e7815b74ccb29af6a836dda52b63d5ae46b51c941f93aeca5eb2ec4.exe File opened (read-only) \??\A: 17a54bd46e7815b74ccb29af6a836dda52b63d5ae46b51c941f93aeca5eb2ec4.exe File opened (read-only) \??\E: 17a54bd46e7815b74ccb29af6a836dda52b63d5ae46b51c941f93aeca5eb2ec4.exe File opened (read-only) \??\F: 17a54bd46e7815b74ccb29af6a836dda52b63d5ae46b51c941f93aeca5eb2ec4.exe File opened (read-only) \??\H: 17a54bd46e7815b74ccb29af6a836dda52b63d5ae46b51c941f93aeca5eb2ec4.exe File opened (read-only) \??\R: 17a54bd46e7815b74ccb29af6a836dda52b63d5ae46b51c941f93aeca5eb2ec4.exe File opened (read-only) \??\V: 17a54bd46e7815b74ccb29af6a836dda52b63d5ae46b51c941f93aeca5eb2ec4.exe File opened (read-only) \??\Y: 17a54bd46e7815b74ccb29af6a836dda52b63d5ae46b51c941f93aeca5eb2ec4.exe File opened (read-only) \??\Z: 17a54bd46e7815b74ccb29af6a836dda52b63d5ae46b51c941f93aeca5eb2ec4.exe File opened (read-only) \??\I: 17a54bd46e7815b74ccb29af6a836dda52b63d5ae46b51c941f93aeca5eb2ec4.exe File opened (read-only) \??\K: 17a54bd46e7815b74ccb29af6a836dda52b63d5ae46b51c941f93aeca5eb2ec4.exe File opened (read-only) \??\L: 17a54bd46e7815b74ccb29af6a836dda52b63d5ae46b51c941f93aeca5eb2ec4.exe File opened (read-only) \??\N: 17a54bd46e7815b74ccb29af6a836dda52b63d5ae46b51c941f93aeca5eb2ec4.exe -
Sets desktop wallpaper using registry 2 TTPs 1 IoCs
Processes:
17a54bd46e7815b74ccb29af6a836dda52b63d5ae46b51c941f93aeca5eb2ec4.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ouza67pg88x7.bmp" 17a54bd46e7815b74ccb29af6a836dda52b63d5ae46b51c941f93aeca5eb2ec4.exe -
Drops file in Program Files directory 38 IoCs
Processes:
17a54bd46e7815b74ccb29af6a836dda52b63d5ae46b51c941f93aeca5eb2ec4.exedescription ioc process File opened for modification \??\c:\program files\ShowRestart.mp4 17a54bd46e7815b74ccb29af6a836dda52b63d5ae46b51c941f93aeca5eb2ec4.exe File opened for modification \??\c:\program files\InitializeAssert.wmf 17a54bd46e7815b74ccb29af6a836dda52b63d5ae46b51c941f93aeca5eb2ec4.exe File opened for modification \??\c:\program files\LockDisconnect.contact 17a54bd46e7815b74ccb29af6a836dda52b63d5ae46b51c941f93aeca5eb2ec4.exe File opened for modification \??\c:\program files\PopInvoke.3gp2 17a54bd46e7815b74ccb29af6a836dda52b63d5ae46b51c941f93aeca5eb2ec4.exe File opened for modification \??\c:\program files\RemoveUnblock.css 17a54bd46e7815b74ccb29af6a836dda52b63d5ae46b51c941f93aeca5eb2ec4.exe File opened for modification \??\c:\program files\UnlockInitialize.ogg 17a54bd46e7815b74ccb29af6a836dda52b63d5ae46b51c941f93aeca5eb2ec4.exe File opened for modification \??\c:\program files\WatchCompare.MTS 17a54bd46e7815b74ccb29af6a836dda52b63d5ae46b51c941f93aeca5eb2ec4.exe File opened for modification \??\c:\program files\WriteInstall.mpg 17a54bd46e7815b74ccb29af6a836dda52b63d5ae46b51c941f93aeca5eb2ec4.exe File opened for modification \??\c:\program files\ConvertBackup.mp4 17a54bd46e7815b74ccb29af6a836dda52b63d5ae46b51c941f93aeca5eb2ec4.exe File opened for modification \??\c:\program files\OptimizeResize.zip 17a54bd46e7815b74ccb29af6a836dda52b63d5ae46b51c941f93aeca5eb2ec4.exe File opened for modification \??\c:\program files\OpenCopy.aifc 17a54bd46e7815b74ccb29af6a836dda52b63d5ae46b51c941f93aeca5eb2ec4.exe File opened for modification \??\c:\program files\UnprotectTest.xml 17a54bd46e7815b74ccb29af6a836dda52b63d5ae46b51c941f93aeca5eb2ec4.exe File created \??\c:\program files (x86)\ry2r0v1h-readme.txt 17a54bd46e7815b74ccb29af6a836dda52b63d5ae46b51c941f93aeca5eb2ec4.exe File opened for modification \??\c:\program files\ExitPublish.xps 17a54bd46e7815b74ccb29af6a836dda52b63d5ae46b51c941f93aeca5eb2ec4.exe File opened for modification \??\c:\program files\WatchInitialize.txt 17a54bd46e7815b74ccb29af6a836dda52b63d5ae46b51c941f93aeca5eb2ec4.exe File opened for modification \??\c:\program files\StopDeny.mpeg 17a54bd46e7815b74ccb29af6a836dda52b63d5ae46b51c941f93aeca5eb2ec4.exe File opened for modification \??\c:\program files\SubmitSkip.m4v 17a54bd46e7815b74ccb29af6a836dda52b63d5ae46b51c941f93aeca5eb2ec4.exe File opened for modification \??\c:\program files\MovePop.xla 17a54bd46e7815b74ccb29af6a836dda52b63d5ae46b51c941f93aeca5eb2ec4.exe File opened for modification \??\c:\program files\NewSwitch.aifc 17a54bd46e7815b74ccb29af6a836dda52b63d5ae46b51c941f93aeca5eb2ec4.exe File opened for modification \??\c:\program files\DismountUnlock.dib 17a54bd46e7815b74ccb29af6a836dda52b63d5ae46b51c941f93aeca5eb2ec4.exe File opened for modification \??\c:\program files\EnableConvertFrom.aif 17a54bd46e7815b74ccb29af6a836dda52b63d5ae46b51c941f93aeca5eb2ec4.exe File opened for modification \??\c:\program files\MoveSet.jpg 17a54bd46e7815b74ccb29af6a836dda52b63d5ae46b51c941f93aeca5eb2ec4.exe File opened for modification \??\c:\program files\ResetCompare.potx 17a54bd46e7815b74ccb29af6a836dda52b63d5ae46b51c941f93aeca5eb2ec4.exe File opened for modification \??\c:\program files\ResetEnable.jfif 17a54bd46e7815b74ccb29af6a836dda52b63d5ae46b51c941f93aeca5eb2ec4.exe File opened for modification \??\c:\program files\DebugSubmit.php 17a54bd46e7815b74ccb29af6a836dda52b63d5ae46b51c941f93aeca5eb2ec4.exe File opened for modification \??\c:\program files\DismountComplete.tiff 17a54bd46e7815b74ccb29af6a836dda52b63d5ae46b51c941f93aeca5eb2ec4.exe File opened for modification \??\c:\program files\OptimizeUse.vsw 17a54bd46e7815b74ccb29af6a836dda52b63d5ae46b51c941f93aeca5eb2ec4.exe File opened for modification \??\c:\program files\ProtectCopy.vssx 17a54bd46e7815b74ccb29af6a836dda52b63d5ae46b51c941f93aeca5eb2ec4.exe File opened for modification \??\c:\program files\RestartUnblock.vsdx 17a54bd46e7815b74ccb29af6a836dda52b63d5ae46b51c941f93aeca5eb2ec4.exe File opened for modification \??\c:\program files\UnprotectConvertTo.eps 17a54bd46e7815b74ccb29af6a836dda52b63d5ae46b51c941f93aeca5eb2ec4.exe File opened for modification \??\c:\program files\ClearUpdate.fon 17a54bd46e7815b74ccb29af6a836dda52b63d5ae46b51c941f93aeca5eb2ec4.exe File opened for modification \??\c:\program files\MountExpand.wvx 17a54bd46e7815b74ccb29af6a836dda52b63d5ae46b51c941f93aeca5eb2ec4.exe File opened for modification \??\c:\program files\ConvertFromRemove.xlt 17a54bd46e7815b74ccb29af6a836dda52b63d5ae46b51c941f93aeca5eb2ec4.exe File opened for modification \??\c:\program files\LimitSubmit.3g2 17a54bd46e7815b74ccb29af6a836dda52b63d5ae46b51c941f93aeca5eb2ec4.exe File opened for modification \??\c:\program files\UnblockDeny.contact 17a54bd46e7815b74ccb29af6a836dda52b63d5ae46b51c941f93aeca5eb2ec4.exe File opened for modification \??\c:\program files\UpdateUnblock.vsdx 17a54bd46e7815b74ccb29af6a836dda52b63d5ae46b51c941f93aeca5eb2ec4.exe File created \??\c:\program files\ry2r0v1h-readme.txt 17a54bd46e7815b74ccb29af6a836dda52b63d5ae46b51c941f93aeca5eb2ec4.exe File opened for modification \??\c:\program files\CloseRegister.AAC 17a54bd46e7815b74ccb29af6a836dda52b63d5ae46b51c941f93aeca5eb2ec4.exe -
Suspicious behavior: EnumeratesProcesses 5 IoCs
Processes:
17a54bd46e7815b74ccb29af6a836dda52b63d5ae46b51c941f93aeca5eb2ec4.exepowershell.exepid process 1852 17a54bd46e7815b74ccb29af6a836dda52b63d5ae46b51c941f93aeca5eb2ec4.exe 1852 17a54bd46e7815b74ccb29af6a836dda52b63d5ae46b51c941f93aeca5eb2ec4.exe 1252 powershell.exe 1252 powershell.exe 1252 powershell.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
Processes:
17a54bd46e7815b74ccb29af6a836dda52b63d5ae46b51c941f93aeca5eb2ec4.exepowershell.exevssvc.exedescription pid process Token: SeDebugPrivilege 1852 17a54bd46e7815b74ccb29af6a836dda52b63d5ae46b51c941f93aeca5eb2ec4.exe Token: SeDebugPrivilege 1252 powershell.exe Token: SeBackupPrivilege 1616 vssvc.exe Token: SeRestorePrivilege 1616 vssvc.exe Token: SeAuditPrivilege 1616 vssvc.exe Token: SeTakeOwnershipPrivilege 1852 17a54bd46e7815b74ccb29af6a836dda52b63d5ae46b51c941f93aeca5eb2ec4.exe -
Suspicious use of WriteProcessMemory 2 IoCs
Processes:
17a54bd46e7815b74ccb29af6a836dda52b63d5ae46b51c941f93aeca5eb2ec4.exedescription pid process target process PID 1852 wrote to memory of 1252 1852 17a54bd46e7815b74ccb29af6a836dda52b63d5ae46b51c941f93aeca5eb2ec4.exe powershell.exe PID 1852 wrote to memory of 1252 1852 17a54bd46e7815b74ccb29af6a836dda52b63d5ae46b51c941f93aeca5eb2ec4.exe powershell.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\17a54bd46e7815b74ccb29af6a836dda52b63d5ae46b51c941f93aeca5eb2ec4.exe"C:\Users\Admin\AppData\Local\Temp\17a54bd46e7815b74ccb29af6a836dda52b63d5ae46b51c941f93aeca5eb2ec4.exe"1⤵
- Modifies extensions of user files
- Adds Run key to start application
- Enumerates connected drives
- Sets desktop wallpaper using registry
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -e RwBlAHQALQBXAG0AaQBPAGIAagBlAGMAdAAgAFcAaQBuADMAMgBfAFMAaABhAGQAbwB3AGMAbwBwAHkAIAB8ACAARgBvAHIARQBhAGMAaAAtAE8AYgBqAGUAYwB0ACAAewAkAF8ALgBEAGUAbABlAHQAZQAoACkAOwB9AA==2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\wbem\unsecapp.exeC:\Windows\system32\wbem\unsecapp.exe -Embedding1⤵
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1252-114-0x0000000000000000-mapping.dmp
-
memory/1252-119-0x000001887CAF0000-0x000001887CAF1000-memory.dmpFilesize
4KB
-
memory/1252-122-0x000001887CCA0000-0x000001887CCA1000-memory.dmpFilesize
4KB
-
memory/1252-128-0x000001887CA40000-0x000001887CA42000-memory.dmpFilesize
8KB
-
memory/1252-129-0x000001887CA43000-0x000001887CA45000-memory.dmpFilesize
8KB
-
memory/1252-135-0x000001887CA46000-0x000001887CA48000-memory.dmpFilesize
8KB