Analysis
-
max time kernel
153s -
max time network
160s -
platform
windows10_x64 -
resource
win10-en -
submitted
06-09-2021 07:34
Static task
static1
Behavioral task
behavioral1
Sample
1fe9b489c25bb23b04d9996e8107671edee69bd6f6def2fe7ece38a0fb35f98e.exe
Resource
win7-en
Behavioral task
behavioral2
Sample
1fe9b489c25bb23b04d9996e8107671edee69bd6f6def2fe7ece38a0fb35f98e.exe
Resource
win10-en
General
-
Target
1fe9b489c25bb23b04d9996e8107671edee69bd6f6def2fe7ece38a0fb35f98e.exe
-
Size
910KB
-
MD5
18786bfac1be0ddf23ff94c029ca4d63
-
SHA1
3c2b0dcdb2a46fc1ec0a12a54309e35621caa925
-
SHA256
1fe9b489c25bb23b04d9996e8107671edee69bd6f6def2fe7ece38a0fb35f98e
-
SHA512
49c9af2b357df516ceb2841f7f3d7554ea9fabe219e40ef555c67fef9cee239e73d995ff069c8cc20fa09749ad6adfcce56f6922011929b4dce5d09b5860d48f
Malware Config
Extracted
C:\1g9ycelm3f-readme.txt
sodinokibi
http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/773E26303FC88E26
http://decoder.re/773E26303FC88E26
Signatures
-
Sodin,Sodinokibi,REvil
Ransomware with advanced anti-analysis and privilege escalation functionality.
-
Executes dropped EXE 1 IoCs
Processes:
MsMpEng.exepid process 1476 MsMpEng.exe -
Modifies extensions of user files 8 IoCs
Ransomware generally changes the extension on encrypted files.
Processes:
MsMpEng.exedescription ioc process File renamed C:\Users\Admin\Pictures\RestartCopy.crw => \??\c:\users\admin\pictures\RestartCopy.crw.1g9ycelm3f MsMpEng.exe File opened for modification \??\c:\users\admin\pictures\UseDebug.tiff MsMpEng.exe File renamed C:\Users\Admin\Pictures\UseDebug.tiff => \??\c:\users\admin\pictures\UseDebug.tiff.1g9ycelm3f MsMpEng.exe File renamed C:\Users\Admin\Pictures\WaitRename.raw => \??\c:\users\admin\pictures\WaitRename.raw.1g9ycelm3f MsMpEng.exe File opened for modification \??\c:\users\admin\pictures\WatchEdit.tiff MsMpEng.exe File renamed C:\Users\Admin\Pictures\WatchEdit.tiff => \??\c:\users\admin\pictures\WatchEdit.tiff.1g9ycelm3f MsMpEng.exe File renamed C:\Users\Admin\Pictures\DisconnectRead.crw => \??\c:\users\admin\pictures\DisconnectRead.crw.1g9ycelm3f MsMpEng.exe File renamed C:\Users\Admin\Pictures\OpenResize.raw => \??\c:\users\admin\pictures\OpenResize.raw.1g9ycelm3f MsMpEng.exe -
Loads dropped DLL 1 IoCs
Processes:
MsMpEng.exepid process 1476 MsMpEng.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Enumerates connected drives 3 TTPs 25 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
MsMpEng.exedescription ioc process File opened (read-only) \??\T: MsMpEng.exe File opened (read-only) \??\D: MsMpEng.exe File opened (read-only) \??\P: MsMpEng.exe File opened (read-only) \??\S: MsMpEng.exe File opened (read-only) \??\V: MsMpEng.exe File opened (read-only) \??\J: MsMpEng.exe File opened (read-only) \??\K: MsMpEng.exe File opened (read-only) \??\N: MsMpEng.exe File opened (read-only) \??\O: MsMpEng.exe File opened (read-only) \??\R: MsMpEng.exe File opened (read-only) \??\A: MsMpEng.exe File opened (read-only) \??\B: MsMpEng.exe File opened (read-only) \??\E: MsMpEng.exe File opened (read-only) \??\U: MsMpEng.exe File opened (read-only) \??\X: MsMpEng.exe File opened (read-only) \??\Z: MsMpEng.exe File opened (read-only) \??\I: MsMpEng.exe File opened (read-only) \??\L: MsMpEng.exe File opened (read-only) \??\M: MsMpEng.exe File opened (read-only) \??\Q: MsMpEng.exe File opened (read-only) \??\W: MsMpEng.exe File opened (read-only) \??\F: MsMpEng.exe File opened (read-only) \??\G: MsMpEng.exe File opened (read-only) \??\H: MsMpEng.exe File opened (read-only) \??\Y: MsMpEng.exe -
Sets desktop wallpaper using registry 2 TTPs 1 IoCs
Processes:
MsMpEng.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\e01706b5.bmp" MsMpEng.exe -
Drops file in Program Files directory 34 IoCs
Processes:
MsMpEng.exedescription ioc process File opened for modification \??\c:\program files\ShowPop.bmp MsMpEng.exe File opened for modification \??\c:\program files\SyncSwitch.TS MsMpEng.exe File opened for modification \??\c:\program files\UnregisterGrant.rtf MsMpEng.exe File opened for modification \??\c:\program files\JoinInstall.pub MsMpEng.exe File opened for modification \??\c:\program files\MoveOptimize.ppsx MsMpEng.exe File opened for modification \??\c:\program files\OutGroup.wm MsMpEng.exe File opened for modification \??\c:\program files\ReceiveSelect.bmp MsMpEng.exe File created \??\c:\program files\1g9ycelm3f-readme.txt MsMpEng.exe File opened for modification \??\c:\program files\ExitInvoke.i64 MsMpEng.exe File opened for modification \??\c:\program files\PushUnpublish.cfg MsMpEng.exe File opened for modification \??\c:\program files\ConvertTest.TTS MsMpEng.exe File opened for modification \??\c:\program files\ExportJoin.shtml MsMpEng.exe File opened for modification \??\c:\program files\UnprotectConvertTo.jpg MsMpEng.exe File opened for modification \??\c:\program files\GrantSplit.midi MsMpEng.exe File opened for modification \??\c:\program files\MoveSkip.crw MsMpEng.exe File opened for modification \??\c:\program files\SubmitMove.xlsm MsMpEng.exe File opened for modification \??\c:\program files\ResumeCompare.midi MsMpEng.exe File opened for modification \??\c:\program files\SyncSend.wmv MsMpEng.exe File opened for modification \??\c:\program files\ConvertFromUpdate.au3 MsMpEng.exe File opened for modification \??\c:\program files\MountReset.asx MsMpEng.exe File opened for modification \??\c:\program files\RestoreInstall.rtf MsMpEng.exe File created \??\c:\program files (x86)\1g9ycelm3f-readme.txt MsMpEng.exe File opened for modification \??\c:\program files\ImportMeasure.shtml MsMpEng.exe File opened for modification \??\c:\program files\SkipEnter.cfg MsMpEng.exe File opened for modification \??\c:\program files\ReceiveStep.tiff MsMpEng.exe File opened for modification \??\c:\program files\ResizeInvoke.xml MsMpEng.exe File opened for modification \??\c:\program files\RestartInitialize.wma MsMpEng.exe File opened for modification \??\c:\program files\AssertWait.ps1 MsMpEng.exe File opened for modification \??\c:\program files\GroupUse.xls MsMpEng.exe File opened for modification \??\c:\program files\PushSwitch.ppsm MsMpEng.exe File opened for modification \??\c:\program files\TraceRestore.clr MsMpEng.exe File opened for modification \??\c:\program files\CompareInitialize.ppsm MsMpEng.exe File opened for modification \??\c:\program files\SelectLock.mpe MsMpEng.exe File opened for modification \??\c:\program files\SetRequest.asx MsMpEng.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 10 IoCs
Processes:
MsMpEng.exepid process 1476 MsMpEng.exe 1476 MsMpEng.exe 1476 MsMpEng.exe 1476 MsMpEng.exe 1476 MsMpEng.exe 1476 MsMpEng.exe 1476 MsMpEng.exe 1476 MsMpEng.exe 1476 MsMpEng.exe 1476 MsMpEng.exe -
Suspicious use of AdjustPrivilegeToken 5 IoCs
Processes:
MsMpEng.exevssvc.exedescription pid process Token: SeDebugPrivilege 1476 MsMpEng.exe Token: SeTakeOwnershipPrivilege 1476 MsMpEng.exe Token: SeBackupPrivilege 2056 vssvc.exe Token: SeRestorePrivilege 2056 vssvc.exe Token: SeAuditPrivilege 2056 vssvc.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
1fe9b489c25bb23b04d9996e8107671edee69bd6f6def2fe7ece38a0fb35f98e.execmd.exedescription pid process target process PID 3968 wrote to memory of 1152 3968 1fe9b489c25bb23b04d9996e8107671edee69bd6f6def2fe7ece38a0fb35f98e.exe cmd.exe PID 3968 wrote to memory of 1152 3968 1fe9b489c25bb23b04d9996e8107671edee69bd6f6def2fe7ece38a0fb35f98e.exe cmd.exe PID 3968 wrote to memory of 1152 3968 1fe9b489c25bb23b04d9996e8107671edee69bd6f6def2fe7ece38a0fb35f98e.exe cmd.exe PID 1152 wrote to memory of 1476 1152 cmd.exe MsMpEng.exe PID 1152 wrote to memory of 1476 1152 cmd.exe MsMpEng.exe PID 1152 wrote to memory of 1476 1152 cmd.exe MsMpEng.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\1fe9b489c25bb23b04d9996e8107671edee69bd6f6def2fe7ece38a0fb35f98e.exe"C:\Users\Admin\AppData\Local\Temp\1fe9b489c25bb23b04d9996e8107671edee69bd6f6def2fe7ece38a0fb35f98e.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3968 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\System32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\MsMpEng.exe2⤵
- Suspicious use of WriteProcessMemory
PID:1152 -
C:\Users\Admin\AppData\Local\Temp\MsMpEng.exeC:\Users\Admin\AppData\Local\Temp\MsMpEng.exe3⤵
- Executes dropped EXE
- Modifies extensions of user files
- Loads dropped DLL
- Enumerates connected drives
- Sets desktop wallpaper using registry
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1476
-
C:\Windows\system32\wbem\unsecapp.exeC:\Windows\system32\wbem\unsecapp.exe -Embedding1⤵PID:4044
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2056
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\MsMpEng.exeMD5
8cc83221870dd07144e63df594c391d9
SHA13d409b39b8502fcd23335a878f2cbdaf6d721995
SHA25633bc14d231a4afaa18f06513766d5f69d8b88f1e697cd127d24fb4b72ad44c7a
SHA512e7f964a10a8799310a519fa569d264f652e13cc7ea199792dc6a5c0507dec4a12844a87bf8bab714255dce717839908ed5d967ce8f65f5520fe4e7f9d25a622c
-
C:\Users\Admin\AppData\Local\Temp\MsMpEng.exeMD5
8cc83221870dd07144e63df594c391d9
SHA13d409b39b8502fcd23335a878f2cbdaf6d721995
SHA25633bc14d231a4afaa18f06513766d5f69d8b88f1e697cd127d24fb4b72ad44c7a
SHA512e7f964a10a8799310a519fa569d264f652e13cc7ea199792dc6a5c0507dec4a12844a87bf8bab714255dce717839908ed5d967ce8f65f5520fe4e7f9d25a622c
-
C:\Users\Admin\AppData\Local\Temp\mpsvc.dllMD5
040818b1b3c9b1bf8245f5bcb4eebbbc
SHA1c0f569fc22cb5dd8e02e44f85168b4b72a6669c3
SHA2560496ca57e387b10dfdac809de8a4e039f68e8d66535d5d19ec76d39f7d0a4402
SHA512bf4dcfb3c7cac05776560e751414a8babfa25fb8703768d0264133d4964f841055cfcab9f30d9854e422642855b4452b9fbf431889cb70a37ecbca7564f638c1
-
\Users\Admin\AppData\Local\Temp\MpsVc.dllMD5
040818b1b3c9b1bf8245f5bcb4eebbbc
SHA1c0f569fc22cb5dd8e02e44f85168b4b72a6669c3
SHA2560496ca57e387b10dfdac809de8a4e039f68e8d66535d5d19ec76d39f7d0a4402
SHA512bf4dcfb3c7cac05776560e751414a8babfa25fb8703768d0264133d4964f841055cfcab9f30d9854e422642855b4452b9fbf431889cb70a37ecbca7564f638c1
-
memory/1152-115-0x0000000000000000-mapping.dmp
-
memory/1476-116-0x0000000000000000-mapping.dmp
-
memory/1476-121-0x00000000009F0000-0x0000000000A9E000-memory.dmpFilesize
696KB