Analysis
-
max time kernel
128s -
max time network
152s -
platform
windows7_x64 -
resource
win7-en-20211208 -
submitted
20-12-2021 16:16
Static task
static1
Behavioral task
behavioral1
Sample
sodinokibi.exe
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
sodinokibi.exe
Resource
win10-en-20211208
General
-
Target
sodinokibi.exe
-
Size
143KB
-
MD5
a3749c66f65d247d8a6fae1be26d3ef9
-
SHA1
c394464bba56e62ddfe2c9073932fb656fb78b6c
-
SHA256
d191761ac8a7b0a3525764664609a8fccfa3732d331c525e9c1c9eb0a7068a9c
-
SHA512
65bc1dba7e4de098e6b27b13b1e0723f703f645e4a4c6e53b7b03ec096a70d48ec2aca7e8bcd911ced61bab35e95983510604421ef35a593278414bfbb1cb01c
Malware Config
Extracted
C:\qyocd34-readme.txt
sodinokibi
http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/06463500467D581C
http://decryptor.top/06463500467D581C
Signatures
-
Sodin,Sodinokibi,REvil
Ransomware with advanced anti-analysis and privilege escalation functionality.
-
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Modifies extensions of user files 4 IoCs
Ransomware generally changes the extension on encrypted files.
Processes:
sodinokibi.exedescription ioc process File opened for modification \??\c:\users\admin\pictures\SkipBlock.tiff sodinokibi.exe File renamed C:\Users\Admin\Pictures\ReadOpen.png => \??\c:\users\admin\pictures\ReadOpen.png.qyocd34 sodinokibi.exe File renamed C:\Users\Admin\Pictures\RepairEdit.tif => \??\c:\users\admin\pictures\RepairEdit.tif.qyocd34 sodinokibi.exe File renamed C:\Users\Admin\Pictures\SkipBlock.tiff => \??\c:\users\admin\pictures\SkipBlock.tiff.qyocd34 sodinokibi.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Enumerates connected drives 3 TTPs 25 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
sodinokibi.exedescription ioc process File opened (read-only) \??\Q: sodinokibi.exe File opened (read-only) \??\Y: sodinokibi.exe File opened (read-only) \??\A: sodinokibi.exe File opened (read-only) \??\G: sodinokibi.exe File opened (read-only) \??\L: sodinokibi.exe File opened (read-only) \??\O: sodinokibi.exe File opened (read-only) \??\R: sodinokibi.exe File opened (read-only) \??\S: sodinokibi.exe File opened (read-only) \??\T: sodinokibi.exe File opened (read-only) \??\V: sodinokibi.exe File opened (read-only) \??\B: sodinokibi.exe File opened (read-only) \??\E: sodinokibi.exe File opened (read-only) \??\M: sodinokibi.exe File opened (read-only) \??\X: sodinokibi.exe File opened (read-only) \??\D: sodinokibi.exe File opened (read-only) \??\J: sodinokibi.exe File opened (read-only) \??\K: sodinokibi.exe File opened (read-only) \??\N: sodinokibi.exe File opened (read-only) \??\P: sodinokibi.exe File opened (read-only) \??\U: sodinokibi.exe File opened (read-only) \??\F: sodinokibi.exe File opened (read-only) \??\H: sodinokibi.exe File opened (read-only) \??\I: sodinokibi.exe File opened (read-only) \??\W: sodinokibi.exe File opened (read-only) \??\Z: sodinokibi.exe -
Sets desktop wallpaper using registry 2 TTPs 1 IoCs
Processes:
sodinokibi.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2u8368z0aju.bmp" sodinokibi.exe -
Drops file in Program Files directory 24 IoCs
Processes:
sodinokibi.exedescription ioc process File created \??\c:\program files (x86)\d60dff40.lock sodinokibi.exe File opened for modification \??\c:\program files\ApproveInvoke.vssx sodinokibi.exe File opened for modification \??\c:\program files\ApproveTest.wmf sodinokibi.exe File opened for modification \??\c:\program files\FindUnprotect.vdw sodinokibi.exe File created \??\c:\program files\d60dff40.lock sodinokibi.exe File created \??\c:\program files (x86)\qyocd34-readme.txt sodinokibi.exe File opened for modification \??\c:\program files\OutFormat.docx sodinokibi.exe File opened for modification \??\c:\program files\RedoConnect.pcx sodinokibi.exe File opened for modification \??\c:\program files\UseFormat.png sodinokibi.exe File created \??\c:\program files (x86)\microsoft sql server compact edition\v3.5\desktop\d60dff40.lock sodinokibi.exe File opened for modification \??\c:\program files\LimitSearch.pptx sodinokibi.exe File opened for modification \??\c:\program files\MergeSend.7z sodinokibi.exe File opened for modification \??\c:\program files\OutResolve.wav sodinokibi.exe File opened for modification \??\c:\program files\UnblockProtect.docx sodinokibi.exe File created \??\c:\program files (x86)\microsoft sql server compact edition\d60dff40.lock sodinokibi.exe File created \??\c:\program files (x86)\microsoft sql server compact edition\v3.5\d60dff40.lock sodinokibi.exe File opened for modification \??\c:\program files\FindAssert.png sodinokibi.exe File opened for modification \??\c:\program files\MountAssert.xlsm sodinokibi.exe File opened for modification \??\c:\program files\ImportEnter.rle sodinokibi.exe File created \??\c:\program files (x86)\microsoft sql server compact edition\qyocd34-readme.txt sodinokibi.exe File created \??\c:\program files (x86)\microsoft sql server compact edition\v3.5\qyocd34-readme.txt sodinokibi.exe File created \??\c:\program files (x86)\microsoft sql server compact edition\v3.5\desktop\qyocd34-readme.txt sodinokibi.exe File created \??\c:\program files\qyocd34-readme.txt sodinokibi.exe File opened for modification \??\c:\program files\CheckpointRead.tmp sodinokibi.exe -
Drops file in Windows directory 64 IoCs
Processes:
sodinokibi.exedescription ioc process File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-eventlog-api.resources_31bf3856ad364e35_6.1.7600.16385_de-de_d6dabc6182566680.manifest sodinokibi.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-f..-truetype-gishabold_31bf3856ad364e35_6.1.7600.16385_none_f50009547b049b77_gishabd.ttf_f731b2ea sodinokibi.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-m..ents-mdac.resources_31bf3856ad364e35_6.1.7600.16385_en-us_2dba46ae3c357fb2_odbcinst.chm_608e33e2 sodinokibi.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-o..ct-picker.resources_31bf3856ad364e35_6.1.7601.17514_de-de_1c083148b78fc347_objsel.dll.mui_9b915792 sodinokibi.exe File opened for modification C:\Windows\winsxs\Backup\x86_microsoft-windows-mlang.resources_31bf3856ad364e35_6.1.7600.16385_et-ee_7fa4216b784f1383.manifest sodinokibi.exe File opened for modification C:\Windows\winsxs\Backup\x86_networking-mpssvc-svc.resources_31bf3856ad364e35_6.1.7601.17514_de-de_e07f4824fddc38e6_mpssvc.dll.mui_4b194b5f sodinokibi.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-efs-service.resources_31bf3856ad364e35_6.1.7600.16385_es-es_a8a35d7d66a988e1_efssvc.dll.mui_03cc4e41 sodinokibi.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-font-bitmap-system_31bf3856ad364e35_6.1.7600.16385_none_df4bbe8e10903104_vgasys.fon_5d8bebb4 sodinokibi.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-user32.resources_31bf3856ad364e35_6.1.7601.17514_es-es_9bef5a1d41e3b5f3_user32.dll.mui_14652dbb sodinokibi.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-wmi-core-wbemcomn-dll_31bf3856ad364e35_6.1.7601.17514_none_61a1336c39d1f6dc.manifest sodinokibi.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-comdlg32.resources_31bf3856ad364e35_6.1.7601.17514_fr-fr_eb9f068d79867b24_comdlg32.dll.mui_ac8e62f4 sodinokibi.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-d..memanager.resources_31bf3856ad364e35_6.1.7600.16385_de-de_5797a7f9b2be5a11.manifest sodinokibi.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-rasbase.resources_31bf3856ad364e35_6.1.7600.16385_de-de_111bacf3e074578c_netrass.inf_loc_17636d00 sodinokibi.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-s..subsystem.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_f23d96c52b159c2d.manifest sodinokibi.exe File opened for modification C:\Windows\winsxs\Backup\x86_microsoft-windows-comctl32-v5.resources_31bf3856ad364e35_6.1.7600.16385_he-il_49429473d09ea38c.manifest sodinokibi.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-dns-client.resources_31bf3856ad364e35_6.1.7600.16385_de-de_7002897809b71b0c.manifest sodinokibi.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-font-bitmap-system_31bf3856ad364e35_6.1.7600.16385_none_df4bbe8e10903104_hvgasys.fon_9f580ce4 sodinokibi.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-font-truetype-sylfaen_31bf3856ad364e35_6.1.7600.16385_none_baa3a3fe00df3026.manifest sodinokibi.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-lua.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_ed028e8c78f92183_consent.exe.mui_2eb3b9db sodinokibi.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-s..subsystem.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_f23d96c52b159c2d_sccls.dll.mui_f104be47 sodinokibi.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-wbiosrvc.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_ea0765d13cc3f170_wbiosrvc.dll.mui_d5b8b2b8 sodinokibi.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-webservices_31bf3856ad364e35_6.1.7601.17514_none_6ca25da84551ca13.manifest sodinokibi.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-winbio.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_269ffdbfc2380290.manifest sodinokibi.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-winsock-helper-tcpip_31bf3856ad364e35_6.1.7600.16385_none_27a7f7694b388c01_wshtcpip.dll_7ee2ca52 sodinokibi.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-wmi-core.resources_31bf3856ad364e35_6.1.7600.16385_en-us_30bc7fe1e159c5d3_mofd.dll.mui_793ef98d sodinokibi.exe File opened for modification C:\Windows\winsxs\Backup\x86_microsoft-windows-newdev.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_1564d79270d6651c_ndadmin.exe.mui_2e106c3e sodinokibi.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-m..ents-mdac.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_d03d19912f2e87b9.manifest sodinokibi.exe File opened for modification C:\Windows\winsxs\Backup\x86_microsoft-windows-bootvid_31bf3856ad364e35_6.1.7600.16385_none_384fd19ce787f20c_bootvid.dll_c188118d sodinokibi.exe File opened for modification C:\Windows\winsxs\Backup\x86_microsoft-windows-imageres.resources_31bf3856ad364e35_6.1.7600.16385_es-es_1e194cca03815af4.manifest sodinokibi.exe File opened for modification C:\Windows\winsxs\Backup\x86_microsoft-windows-mlang.resources_31bf3856ad364e35_6.1.7600.16385_th-th_103f1cd3ad950892.manifest sodinokibi.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-a..on-authui.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_1641d14c740080f5.manifest sodinokibi.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-font-bitmap-small_31bf3856ad364e35_6.1.7600.16385_none_d7839341959a2de0_smallfe.fon_f4ae14b9 sodinokibi.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-font-truetype-daunpenh_31bf3856ad364e35_6.1.7601.17514_none_65eab3ba3a64f6af_daunpenh.ttf_f02ee377 sodinokibi.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-legacyhwui.resources_31bf3856ad364e35_6.1.7600.16385_de-de_041941e0648fcc17_hdwwiz.exe.mui_b4acc7bc sodinokibi.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-o..iles-core.resources_31bf3856ad364e35_6.1.7600.16385_es-es_5f7103aaf3c5ba0d.manifest sodinokibi.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-tcpip.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_caba3de2d9ce0d4b_tcpip.sys.mui_5885771c sodinokibi.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-usp_31bf3856ad364e35_6.1.7601.17514_none_0b207e7d6f1bea6f.manifest sodinokibi.exe File opened for modification C:\Windows\winsxs\Backup\x86_microsoft-windows-f..libraries.resources_31bf3856ad364e35_6.1.7600.16385_es-es_33867737402be86b_ulib.dll.mui_bb7d4db5 sodinokibi.exe File opened for modification C:\Windows\winsxs\Backup\x86_microsoft-windows-legacyhwui.resources_31bf3856ad364e35_6.1.7600.16385_en-us_50eb7c559b1066a6_hdwwiz.exe.mui_b4acc7bc sodinokibi.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-f..truetype-lucidasans_31bf3856ad364e35_6.1.7600.16385_none_d0e8774fa1155a53_l_10646.ttf_f757c3ca sodinokibi.exe File opened for modification C:\Windows\winsxs\Backup\wow64_microsoft-windows-dns-client.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_521851f9ea3be82c.manifest sodinokibi.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-comdlg32.resources_31bf3856ad364e35_6.1.7601.17514_hr-hr_31db610f5ea8e8d8.manifest sodinokibi.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-eventlog-api.resources_31bf3856ad364e35_6.1.7600.16385_de-de_d6dabc6182566680_wevtapi.dll.mui_27c9f5dd sodinokibi.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-shlwapi.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_de94b27efb001334_shlwapi.dll.mui_a6436c6f sodinokibi.exe File opened for modification C:\Windows\winsxs\Backup\x86_hid-user.resources_31bf3856ad364e35_6.1.7600.16385_en-us_6578e61f4c86036e_hid.dll.mui_cccd5ae0 sodinokibi.exe File opened for modification C:\Windows\winsxs\Backup\x86_microsoft-windows-cryptdll-dll_31bf3856ad364e35_6.1.7600.16385_none_0574dc0a0f190696.manifest sodinokibi.exe File opened for modification C:\Windows\winsxs\Backup\x86_microsoft-windows-v..skservice.resources_31bf3856ad364e35_6.1.7600.16385_de-de_f8f65c9d5ef440b6.manifest sodinokibi.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-ntlanman.resources_31bf3856ad364e35_6.1.7600.16385_de-de_eec5a30173304188.manifest sodinokibi.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft.windows.s..rt_driver.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_dbc47294c79487ee_scsiport.sys.mui_ef25385f sodinokibi.exe File opened for modification C:\Windows\winsxs\Backup\x86_microsoft-windows-b..ager-pcat.resources_31bf3856ad364e35_6.1.7600.16385_zh-tw_82dac7a36bd74688_bootmgr.exe.mui_c434701f sodinokibi.exe File opened for modification C:\Windows\winsxs\Backup\x86_microsoft-windows-u..dem-voice.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_1c9f3fffd349960b_serwvdrv.dll.mui_6a9f4568 sodinokibi.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-b..nt-core-bootmanager_31bf3856ad364e35_6.1.7600.16385_none_47c7bd6588bcb9f8.manifest sodinokibi.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-mlang.resources_31bf3856ad364e35_6.1.7600.16385_sv-se_c75396a474adbc87.manifest sodinokibi.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-p..onmanager.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_fca38a2d57506000.manifest sodinokibi.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-rasserver.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_79b8d8cfc8e56a7e_rtm.dll.mui_55e4e990 sodinokibi.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-smartcardksp.resources_31bf3856ad364e35_6.1.7600.16385_de-de_ba18a8ee6660c432_scksp.dll.mui_05f14191 sodinokibi.exe File opened for modification C:\Windows\winsxs\Backup\x86_microsoft-windows-legacyhwui.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_7fbbc48c58566606.manifest sodinokibi.exe File opened for modification C:\Windows\winsxs\Backup\x86_microsoft-windows-mlang.resources_31bf3856ad364e35_6.1.7600.16385_ko-kr_58531de323d90bc5_mlang.dll.mui_2904864a sodinokibi.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-crypt32-dll.resources_31bf3856ad364e35_6.1.7600.16385_es-es_29e72c19d41e6ceb.manifest sodinokibi.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-u..em-config.resources_31bf3856ad364e35_6.1.7600.16385_en-us_edb61e94e4562781_modemui.dll.mui_a710bc71 sodinokibi.exe File opened for modification C:\Windows\winsxs\Backup\wow64_microsoft-windows-rasbase_31bf3856ad364e35_6.1.7601.17514_none_765b17a2c56f9155_pppmenu.scp_74b84d65 sodinokibi.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-shdocvw.resources_31bf3856ad364e35_6.1.7600.16385_en-us_23b7b32e73eca54a_shdocvw.dll.mui_9b8f26d5 sodinokibi.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-shdocvw.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_c63a861166e5ad51.manifest sodinokibi.exe File opened for modification C:\Windows\winsxs\Backup\wow64_microsoft-windows-dns-client.resources_31bf3856ad364e35_6.1.7600.16385_de-de_7a5733ca3e17dd07_dnsapi.dll.mui_97465f8a sodinokibi.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Interacts with shadow copies 2 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
Processes:
vssadmin.exepid process 1368 vssadmin.exe -
Processes:
sodinokibi.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436 sodinokibi.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436\Blob = 04000000010000001000000079e4a9840d7d3a96d7c04fe2434c892e0f0000000100000014000000b34ddd372ed92e8f2abfbb9e20a9d31f204f194b090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030814000000010000001400000003de503556d14cbb66f0a3e21b1bc397b23dd1550b00000001000000120000004400690067006900430065007200740000001d000000010000001000000059779e39e21a2e3dfced6857ed5c5fd9030000000100000014000000a8985d3a65e5e5c4b2d7d66d40c6dd2fb19c54361900000001000000100000000f3a0527d242de2dc98e5cfcb1e991ee2000000001000000b3030000308203af30820297a0030201020210083be056904246b1a1756ac95991c74a300d06092a864886f70d01010505003061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100e23be11172dea8a4d3a357aa50a28f0b7790c9a2a5ee12ce965b010920cc0193a74e30b753f743c46900579de28d22dd870640008109cece1b83bfdfcd3b7146e2d666c705b37627168f7b9e1e957deeb748a308dad6af7a0c3906657f4a5d1fbc17f8abbeee28d7747f7a78995985686e5c23324bbf4ec0e85a6de370bf7710bffc01f685d9a844105832a97518d5d1a2be47e2276af49a33f84908608bd45fb43a84bfa1aa4a4c7d3ecf4f5f6c765ea04b37919edc22e66dce141a8e6acbfecdb3146417c75b299e32bff2eefad30b42d4abb74132da0cd4eff881d5bb8d583fb51be84928a270da3104ddf7b216f24c0a4e07a8ed4a3d5eb57fa390c3af270203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041403de503556d14cbb66f0a3e21b1bc397b23dd155301f0603551d2304183016801403de503556d14cbb66f0a3e21b1bc397b23dd155300d06092a864886f70d01010505000382010100cb9c37aa4813120afadd449c4f52b0f4dfae04f5797908a32418fc4b2b84c02db9d5c7fef4c11f58cbb86d9c7a74e79829ab11b5e370a0a1cd4c8899938c9170e2ab0f1cbe93a9ff63d5e40760d3a3bf9d5b09f1d58ee353f48e63fa3fa7dbb466df6266d6d16e418df22db5ea774a9f9d58e22b59c04023ed2d2882453e7954922698e08048a837eff0d6796016deace80ecd6eac4417382f49dae1453e2ab93653cf3a5006f72ee8c457496c612118d504ad783c2c3a806ba7ebaf1514e9d889c1b9386ce2916c8aff64b977255730c01b24a3e1dce9df477cb5b424080530ec2dbd0bbf45bf50b9a9f3eb980112adc888c698345f8d0a3cc6e9d595956dde sodinokibi.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
sodinokibi.exepid process 604 sodinokibi.exe 604 sodinokibi.exe 604 sodinokibi.exe 604 sodinokibi.exe 604 sodinokibi.exe 604 sodinokibi.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
vssvc.exedescription pid process Token: SeBackupPrivilege 816 vssvc.exe Token: SeRestorePrivilege 816 vssvc.exe Token: SeAuditPrivilege 816 vssvc.exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
sodinokibi.execmd.exedescription pid process target process PID 604 wrote to memory of 284 604 sodinokibi.exe cmd.exe PID 604 wrote to memory of 284 604 sodinokibi.exe cmd.exe PID 604 wrote to memory of 284 604 sodinokibi.exe cmd.exe PID 604 wrote to memory of 284 604 sodinokibi.exe cmd.exe PID 284 wrote to memory of 1368 284 cmd.exe vssadmin.exe PID 284 wrote to memory of 1368 284 cmd.exe vssadmin.exe PID 284 wrote to memory of 1368 284 cmd.exe vssadmin.exe PID 284 wrote to memory of 1368 284 cmd.exe vssadmin.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\sodinokibi.exe"C:\Users\Admin\AppData\Local\Temp\sodinokibi.exe"1⤵
- Modifies extensions of user files
- Enumerates connected drives
- Sets desktop wallpaper using registry
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c vssadmin.exe Delete Shadows /All /Quiet & bcdedit /set {default} recoveryenabled No & bcdedit /set {default} bootstatuspolicy ignoreallfailures2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\vssadmin.exevssadmin.exe Delete Shadows /All /Quiet3⤵
- Interacts with shadow copies
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/284-64-0x0000000000000000-mapping.dmp
-
memory/604-53-0x0000000076C91000-0x0000000076C93000-memory.dmpFilesize
8KB
-
memory/604-55-0x0000000000CE0000-0x0000000000D7F000-memory.dmpFilesize
636KB
-
memory/604-56-0x0000000000E80000-0x0000000000FAD000-memory.dmpFilesize
1.2MB
-
memory/604-57-0x0000000000620000-0x000000000063F000-memory.dmpFilesize
124KB
-
memory/604-59-0x00000000000E0000-0x00000000000EA000-memory.dmpFilesize
40KB
-
memory/604-60-0x00000000001F0000-0x00000000001F1000-memory.dmpFilesize
4KB
-
memory/604-61-0x0000000000200000-0x0000000000201000-memory.dmpFilesize
4KB
-
memory/604-63-0x0000000000340000-0x0000000000346000-memory.dmpFilesize
24KB
-
memory/604-62-0x0000000000330000-0x0000000000331000-memory.dmpFilesize
4KB
-
memory/604-58-0x0000000002670000-0x0000000002779000-memory.dmpFilesize
1.0MB
-
memory/1368-65-0x0000000000000000-mapping.dmp