Analysis
-
max time kernel
300s -
max time network
300s -
platform
windows10_x64 -
resource
win10-en-20211208 -
submitted
22-12-2021 08:18
Static task
static1
Behavioral task
behavioral1
Sample
sodinokibi.exe
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
sodinokibi.exe
Resource
win10-en-20211208
General
-
Target
sodinokibi.exe
-
Size
143KB
-
MD5
a3749c66f65d247d8a6fae1be26d3ef9
-
SHA1
c394464bba56e62ddfe2c9073932fb656fb78b6c
-
SHA256
d191761ac8a7b0a3525764664609a8fccfa3732d331c525e9c1c9eb0a7068a9c
-
SHA512
65bc1dba7e4de098e6b27b13b1e0723f703f645e4a4c6e53b7b03ec096a70d48ec2aca7e8bcd911ced61bab35e95983510604421ef35a593278414bfbb1cb01c
Malware Config
Extracted
C:\1u02u-readme.txt
sodinokibi
http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/4C27ACAAB49009ED
http://decryptor.top/4C27ACAAB49009ED
Signatures
-
Sodin,Sodinokibi,REvil
Ransomware with advanced anti-analysis and privilege escalation functionality.
-
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Modifies extensions of user files 6 IoCs
Ransomware generally changes the extension on encrypted files.
Processes:
sodinokibi.exedescription ioc process File renamed C:\Users\Admin\Pictures\AddCompress.crw => \??\c:\users\admin\pictures\AddCompress.crw.1u02u sodinokibi.exe File renamed C:\Users\Admin\Pictures\ClearResize.png => \??\c:\users\admin\pictures\ClearResize.png.1u02u sodinokibi.exe File renamed C:\Users\Admin\Pictures\FormatUse.crw => \??\c:\users\admin\pictures\FormatUse.crw.1u02u sodinokibi.exe File renamed C:\Users\Admin\Pictures\RenameUpdate.tif => \??\c:\users\admin\pictures\RenameUpdate.tif.1u02u sodinokibi.exe File renamed C:\Users\Admin\Pictures\SearchRestart.tif => \??\c:\users\admin\pictures\SearchRestart.tif.1u02u sodinokibi.exe File renamed C:\Users\Admin\Pictures\StartOpen.raw => \??\c:\users\admin\pictures\StartOpen.raw.1u02u sodinokibi.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Enumerates connected drives 3 TTPs 25 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
sodinokibi.exedescription ioc process File opened (read-only) \??\W: sodinokibi.exe File opened (read-only) \??\Y: sodinokibi.exe File opened (read-only) \??\D: sodinokibi.exe File opened (read-only) \??\P: sodinokibi.exe File opened (read-only) \??\U: sodinokibi.exe File opened (read-only) \??\O: sodinokibi.exe File opened (read-only) \??\T: sodinokibi.exe File opened (read-only) \??\Z: sodinokibi.exe File opened (read-only) \??\L: sodinokibi.exe File opened (read-only) \??\M: sodinokibi.exe File opened (read-only) \??\F: sodinokibi.exe File opened (read-only) \??\I: sodinokibi.exe File opened (read-only) \??\J: sodinokibi.exe File opened (read-only) \??\K: sodinokibi.exe File opened (read-only) \??\Q: sodinokibi.exe File opened (read-only) \??\V: sodinokibi.exe File opened (read-only) \??\B: sodinokibi.exe File opened (read-only) \??\E: sodinokibi.exe File opened (read-only) \??\H: sodinokibi.exe File opened (read-only) \??\N: sodinokibi.exe File opened (read-only) \??\R: sodinokibi.exe File opened (read-only) \??\S: sodinokibi.exe File opened (read-only) \??\X: sodinokibi.exe File opened (read-only) \??\A: sodinokibi.exe File opened (read-only) \??\G: sodinokibi.exe -
Sets desktop wallpaper using registry 2 TTPs 1 IoCs
Processes:
sodinokibi.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\086hde4r8f.bmp" sodinokibi.exe -
Drops file in Program Files directory 26 IoCs
Processes:
sodinokibi.exedescription ioc process File opened for modification \??\c:\program files\RestoreUnblock.001 sodinokibi.exe File opened for modification \??\c:\program files\SubmitCheckpoint.css sodinokibi.exe File opened for modification \??\c:\program files\TestSwitch.vsdx sodinokibi.exe File created \??\c:\program files\d60dff40.lock sodinokibi.exe File opened for modification \??\c:\program files\MoveGrant.bmp sodinokibi.exe File opened for modification \??\c:\program files\ResetConnect.TTS sodinokibi.exe File opened for modification \??\c:\program files\UsePing.pub sodinokibi.exe File opened for modification \??\c:\program files\WaitFormat.reg sodinokibi.exe File opened for modification \??\c:\program files\WatchClear.cr2 sodinokibi.exe File opened for modification \??\c:\program files\RedoDismount.aifc sodinokibi.exe File opened for modification \??\c:\program files\TestBackup.wmf sodinokibi.exe File opened for modification \??\c:\program files\UnprotectSplit.xlsm sodinokibi.exe File opened for modification \??\c:\program files\LockConvertTo.pps sodinokibi.exe File opened for modification \??\c:\program files\StepGet.wmf sodinokibi.exe File opened for modification \??\c:\program files\UnpublishUndo.odp sodinokibi.exe File created \??\c:\program files (x86)\1u02u-readme.txt sodinokibi.exe File opened for modification \??\c:\program files\ConvertToComplete.mp3 sodinokibi.exe File opened for modification \??\c:\program files\DenySend.png sodinokibi.exe File opened for modification \??\c:\program files\FormatStep.xsl sodinokibi.exe File opened for modification \??\c:\program files\GroupRequest.edrwx sodinokibi.exe File opened for modification \??\c:\program files\OpenExpand.xps sodinokibi.exe File opened for modification \??\c:\program files\OptimizeRedo.midi sodinokibi.exe File opened for modification \??\c:\program files\SaveSplit.potx sodinokibi.exe File created \??\c:\program files\1u02u-readme.txt sodinokibi.exe File created \??\c:\program files (x86)\d60dff40.lock sodinokibi.exe File opened for modification \??\c:\program files\EnablePush.wmv sodinokibi.exe -
Drops file in Windows directory 64 IoCs
Processes:
sodinokibi.exedescription ioc process File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-basesrv_31bf3856ad364e35_10.0.15063.0_none_1ddec40f1c898738_basesrv.dll_8c1ad808 sodinokibi.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-user32_31bf3856ad364e35_10.0.15063.0_none_de4c457aa62b389a_user32.dll_55f4ed20 sodinokibi.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-i..er-engine.resources_31bf3856ad364e35_10.0.15063.0_es-es_5801262b97b61409_msimsg.dll.mui_72e8994f sodinokibi.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-wmilib_31bf3856ad364e35_10.0.15063.0_none_6a68d3903cfb6ab2.manifest sodinokibi.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft.windows.c..-controls.resources_6595b64144ccf1df_6.0.15063.0_hu-hu_108ceb72e3e4e2a9_comctl32.dll.mui_0da4e682 sodinokibi.exe File opened for modification C:\Windows\WinSxS\Backup\wow64_microsoft-windows-b..iagnostic.resources_31bf3856ad364e35_10.0.15063.0_zh-tw_35d482afdcce483a.manifest sodinokibi.exe File opened for modification C:\Windows\WinSxS\Backup\wow64_microsoft-windows-cryptdll-dll_31bf3856ad364e35_10.0.15063.0_none_210709721af4ec88_cryptdll.dll_e0da7eac sodinokibi.exe File opened for modification C:\Windows\WinSxS\Backup\x86_microsoft-windows-i..er-engine.resources_31bf3856ad364e35_10.0.15063.0_cs-cz_b8c0e267f83754d0_msimsg.dll.mui_72e8994f sodinokibi.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-commonlog.resources_31bf3856ad364e35_10.0.15063.0_fr-fr_c5ef67472648fded_clfs.sys.mui_1310ba12 sodinokibi.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-font-bitmap-fixed_31bf3856ad364e35_10.0.15063.0_none_9023bb87676e429a_85f1257.fon_77baa7cb sodinokibi.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-rasbase-ndiswan_31bf3856ad364e35_10.0.15063.0_none_044c69fa901981b6.manifest sodinokibi.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-rpc-kernel_31bf3856ad364e35_10.0.15063.0_none_d0205d0ebab54d57.manifest sodinokibi.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-w..e-ws2ifsl.resources_31bf3856ad364e35_10.0.15063.0_en-us_3ac92db0078e1b3e.manifest sodinokibi.exe File opened for modification C:\Windows\WinSxS\Backup\wow64_microsoft-windows-com-base.resources_31bf3856ad364e35_10.0.15063.0_es-es_d3b39c8eaaff0b3e_combase.dll.mui_6db10b33 sodinokibi.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-wmpdui.resources_31bf3856ad364e35_10.0.15063.0_fr-fr_2d3314094995484e.manifest sodinokibi.exe File opened for modification C:\Windows\WinSxS\Backup\wow64_microsoft-windows-gdi_31bf3856ad364e35_10.0.15063.0_none_c53b9c03c7b5d8af_fontdrvhost.exe_94bdc76d sodinokibi.exe File opened for modification C:\Windows\WinSxS\Backup\wow64_microsoft-windows-v..skservice.resources_31bf3856ad364e35_10.0.15063.0_en-us_bd795ffe59ae326d_vdsutil.dll.mui_0caf9b0e sodinokibi.exe File opened for modification C:\Windows\WinSxS\Backup\x86_microsoft-windows-i..r_service.resources_31bf3856ad364e35_10.0.15063.0_en-us_67aabff02c2da9b2.manifest sodinokibi.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-client-li..scription.resources_31bf3856ad364e35_10.0.15063.0_en-us_1923ad0413dac689.manifest sodinokibi.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-d..-usermode.resources_31bf3856ad364e35_10.0.15063.0_en-us_d7f85fce907a2ddd.manifest sodinokibi.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-font-bitmap-terminal_31bf3856ad364e35_10.0.15063.0_none_2583321dfa2b45c4_app852.fon_e3869f49 sodinokibi.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-msvcp110_31bf3856ad364e35_10.0.15063.0_none_feca243ea9e4c6cb_msvcp110_win.dll_397cf9b6 sodinokibi.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-sxssrv_31bf3856ad364e35_10.0.15063.0_none_7199b2a6f00baf63_sxssrv.dll_4cd0c747 sodinokibi.exe File opened for modification C:\Windows\WinSxS\Backup\wow64_microsoft-windows-security-spp.resources_31bf3856ad364e35_10.0.15063.0_es-es_b7fbd781a4310857.manifest sodinokibi.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-b..os-loader.resources_31bf3856ad364e35_10.0.15063.0_es-es_8777f0231cf98180_winresume.exe.mui_ff8b5358 sodinokibi.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-font-bitmap-terminal_31bf3856ad364e35_10.0.15063.0_none_2583321dfa2b45c4_app950.fon_e2e577aa sodinokibi.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-tcpip.resources_31bf3856ad364e35_10.0.15063.0_fr-fr_7fd92574f8ebc00c_tcpipcfg.dll.mui_a5479fc1 sodinokibi.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-w..r-webclnt.resources_31bf3856ad364e35_10.0.15063.0_fr-fr_f301a0aafc6617f7.manifest sodinokibi.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft.windows.c..-controls.resources_6595b64144ccf1df_6.0.15063.0_sr-..-rs_b4183ea5c856b36b.manifest sodinokibi.exe File opened for modification C:\Windows\WinSxS\Backup\wow64_microsoft-windows-wininit.resources_31bf3856ad364e35_10.0.15063.0_de-de_b7dd3e5888d8b545.manifest sodinokibi.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft.windows.c..-controls.resources_6595b64144ccf1df_6.0.15063.0_lv-lv_9d6c57b8ade8de89.manifest sodinokibi.exe File opened for modification C:\Windows\WinSxS\Backup\wow64_microsoft-windows-appidcore_31bf3856ad364e35_10.0.15063.0_none_4a395d1c23946704_srpapi.dll_5f1dbe43 sodinokibi.exe File opened for modification C:\Windows\WinSxS\Backup\wow64_microsoft-windows-s..-webauthn.resources_31bf3856ad364e35_10.0.15063.0_fr-fr_df251a873c69481a_webauthn.dll.mui_acc69b8d sodinokibi.exe File opened for modification C:\Windows\WinSxS\Backup\wow64_microsoft-windows-userenv_31bf3856ad364e35_10.0.15063.0_none_aba8edfeb8725505_userenv.dll_1a3a70b6 sodinokibi.exe File opened for modification C:\Windows\WinSxS\Backup\wow64_networking-mpssvc-svc.resources_31bf3856ad364e35_10.0.15063.0_fr-fr_45540aa0eea0af0a_firewallapi.dll.mui_43c7a05b sodinokibi.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-d..ient-core.resources_31bf3856ad364e35_10.0.15063.0_en-us_2856dfb73a0bd794_dnsapi.dll.mui_97465f8a sodinokibi.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-font-bitmap-oem_31bf3856ad364e35_10.0.15063.0_none_0e77f624e73557a1_vga932.fon_1042dbe9 sodinokibi.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-rasserver_31bf3856ad364e35_10.0.15063.0_none_bcbd1290a09b9a77_iprtprio.dll_5829c3c7 sodinokibi.exe File opened for modification C:\Windows\WinSxS\Backup\wow64_microsoft-windows-usermodensi.resources_31bf3856ad364e35_10.0.15063.0_de-de_aec8c3bb5e24a21b.manifest sodinokibi.exe File opened for modification C:\Windows\WinSxS\Backup\wow64_microsoft-windows-v..skservice.resources_31bf3856ad364e35_10.0.15063.0_es-es_bd44bce259d52412.manifest sodinokibi.exe File opened for modification C:\Windows\WinSxS\Backup\x86_microsoft.windows.c..-controls.resources_6595b64144ccf1df_5.82.15063.0_nl-nl_5a65c056121dede0.manifest sodinokibi.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-appid.resources_31bf3856ad364e35_10.0.15063.0_fr-fr_e9c1351fd8a28638.manifest sodinokibi.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-g..licy-base.resources_31bf3856ad364e35_10.0.15063.0_en-us_d24874d4a9b4e91a_gpapi.dll.mui_ef0a9748 sodinokibi.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-tcpip_31bf3856ad364e35_10.0.15063.0_none_72996f15c8286420.manifest sodinokibi.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_networking-mpssvc-drv.resources_31bf3856ad364e35_10.0.15063.0_ja-jp_8da870b17bdbc93e.manifest sodinokibi.exe File opened for modification C:\Windows\WinSxS\Backup\wow64_microsoft-windows-com-base.resources_31bf3856ad364e35_10.0.15063.0_es-es_d3b39c8eaaff0b3e_wintypes.dll.mui_36d5f25a sodinokibi.exe File opened for modification C:\Windows\WinSxS\Backup\x86_microsoft.windows.c..-controls.resources_6595b64144ccf1df_6.0.15063.0_pl-pl_6d8f1aff8f329e47_comctl32.dll.mui_0da4e682 sodinokibi.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft.windows.c..-controls.resources_6595b64144ccf1df_6.0.15063.0_it-it_b3446171d6b6f90b.manifest sodinokibi.exe File opened for modification C:\Windows\WinSxS\Backup\x86_microsoft-windows-h..p-listsvc.resources_31bf3856ad364e35_10.0.15063.0_es-es_156eb89290ac6cb1.manifest sodinokibi.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-dns-client-minwin_31bf3856ad364e35_10.0.15063.0_none_a69f8cf95bf4534e_dnsapi.dll_c81f5791 sodinokibi.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-fileinfominifilter_31bf3856ad364e35_10.0.15063.0_none_e7c8d45e6a1c8c7b.manifest sodinokibi.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-profsvc.resources_31bf3856ad364e35_10.0.15063.0_en-us_77cfed1b3d429e22.manifest sodinokibi.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-s..-netlogon.resources_31bf3856ad364e35_10.0.15063.0_ja-jp_6fa7a65a14e4e298.manifest sodinokibi.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-smss-minwin_31bf3856ad364e35_10.0.15063.0_none_8f74af7c219a26c7.manifest sodinokibi.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-themeservice.resources_31bf3856ad364e35_10.0.15063.0_es-es_7247840a2ba5b8ac.manifest sodinokibi.exe File opened for modification C:\Windows\WinSxS\Backup\x86_microsoft-windows-i..r_service.resources_31bf3856ad364e35_10.0.15063.0_de-de_beb9e9f73d4f9ded_iscsidsc.dll.mui_6acb64a6 sodinokibi.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-com-base.resources_31bf3856ad364e35_10.0.15063.0_en-us_c99395587677579e.manifest sodinokibi.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-network-security_31bf3856ad364e35_10.0.15063.0_none_de38492263599171.manifest sodinokibi.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-partitionmanager_31bf3856ad364e35_10.0.15063.0_none_f2afecc4f33e49fb_partmgr.sys_fcac898c sodinokibi.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-rasbase-core_31bf3856ad364e35_10.0.15063.0_none_42fa52cffce831fb_wanarp.sys_19b9c668 sodinokibi.exe File opened for modification C:\Windows\WinSxS\Backup\x86_microsoft-windows-b..ager-pcat.resources_31bf3856ad364e35_10.0.15063.0_en-us_d4770771a66242c7_bootmgr.exe.mui_c434701f sodinokibi.exe File opened for modification C:\Windows\WinSxS\Backup\x86_microsoft-windows-b..ager-pcat.resources_31bf3856ad364e35_10.0.15063.0_ko-kr_a6b12c5d5619093d_bootmgr.exe.mui_c434701f sodinokibi.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.15063.0_de-de_e6faf81d32dd9c12_bootmgr.efi.mui_be5d0075 sodinokibi.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-h..p-provsvc.resources_31bf3856ad364e35_10.0.15063.0_de-de_db9cb62863cfdc98.manifest sodinokibi.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Interacts with shadow copies 2 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
Processes:
vssadmin.exepid process 2956 vssadmin.exe -
Processes:
sodinokibi.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\2B8F1B57330DBBA2D07A6C51F70EE90DDAB9AD8E sodinokibi.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\2B8F1B57330DBBA2D07A6C51F70EE90DDAB9AD8E\Blob = 0400000001000000100000001bfe69d191b71933a372a80fe155e5b50f000000010000003000000066b764a96581128168cf208e374dda479d54e311f32457f4aee0dbd2a6c8d171d531289e1cd22bfdbbd4cfd979625483090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0620000000100000020000000e793c9b02fd8aa13e21c31228accb08119643b749c898964b1746d46c3d4cbd21400000001000000140000005379bf5aaa2b4acf5480e1d89bc09df2b20366cb1d0000000100000010000000885010358d29a38f059b028559c95f900b00000001000000100000005300650063007400690067006f0000000300000001000000140000002b8f1b57330dbba2d07a6c51f70ee90ddab9ad8e190000000100000010000000ea6089055218053dd01e37e1d806eedf2000000001000000e2050000308205de308203c6a003020102021001fd6d30fca3ca51a81bbc640e35032d300d06092a864886f70d01010c0500308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f72697479301e170d3130303230313030303030305a170d3338303131383233353935395a308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f7269747930820222300d06092a864886f70d01010105000382020f003082020a028202010080126517360ec3db08b3d0ac570d76edcd27d34cad508361e2aa204d092d6409dcce899fcc3da9ecf6cfc1dcf1d3b1d67b3728112b47da39c6bc3a19b45fa6bd7d9da36342b676f2a93b2b91f8e26fd0ec162090093ee2e874c918b491d46264db7fa306f188186a90223cbcfe13f087147bf6e41f8ed4e451c61167460851cb8614543fbc33fe7e6c9cff169d18bd518e35a6a766c87267db2166b1d49b7803c0503ae8ccf0dcbc9e4cfeaf0596351f575ab7ffcef93db72cb6f654ddc8e7123a4dae4c8ab75c9ab4b7203dca7f2234ae7e3b68660144e7014e46539b3360f794be5337907343f332c353efdbaafe744e69c76b8c6093dec4c70cdfe132aecc933b517895678bee3d56fe0cd0690f1b0ff325266b336df76e47fa7343e57e0ea566b1297c3284635589c40dc19354301913acd37d37a7eb5d3a6c355cdb41d712daa9490bdfd8808a0993628eb566cf2588cd84b8b13fa4390fd9029eeb124c957cf36b05a95e1683ccb867e2e8139dcc5b82d34cb3ed5bffdee573ac233b2d00bf3555740949d849581a7f9236e651920ef3267d1c4d17bcc9ec4326d0bf415f40a94444f499e757879e501f5754a83efd74632fb1506509e658422e431a4cb4f0254759fa041e93d426464a5081b2debe78b7fc6715e1c957841e0f63d6e962bad65f552eea5cc62808042539b80e2ba9f24c971c073f0d52f5edef2f820f0203010001a3423040301d0603551d0e041604145379bf5aaa2b4acf5480e1d89bc09df2b20366cb300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff300d06092a864886f70d01010c050003820201005cd47c0dcff7017d4199650c73c5529fcbf8cf99067f1bda43159f9e0255579614f1523c27879428ed1f3a0137a276fc5350c0849bc66b4eba8c214fa28e556291f36915d8bc88e3c4aa0bfdefa8e94b552a06206d55782919ee5f305c4b241155ff249a6e5e2a2bee0b4d9f7ff70138941495430709fb60a9ee1cab128ca09a5ea7986a596d8b3f08fbc8d145af18156490120f73282ec5e2244efc58ecf0f445fe22b3eb2f8ed2d9456105c1976fa876728f8b8c36afbf0d05ce718de6a66f1f6ca67162c5d8d083720cf16711890c9c134c7234dfbcd571dfaa71dde1b96c8c3c125d65dabd5712b6436bffe5de4d661151cf99aeec17b6e871918cde49fedd3571a21527941ccf61e326bb6fa36725215de6dd1d0b2e681b3b82afec836785d4985174b1b9998089ff7f78195c794a602e9240ae4c372a2cc9c762c80e5df7365bcae0252501b4dd1a079c77003fd0dcd5ec3dd4fabb3fcc85d66f7fa92ddfb902f7f5979ab535dac367b0874aa9289e238eff5c276be1b04ff307ee002ed45987cb524195eaf447d7ee6441557c8d590295dd629dc2b9ee5a287484a59bb790c70c07dff589367432d628c1b0b00be09c4cc31cd6fce369b54746812fa282abd3634470c48dff2d33baad8f7bb57088ae3e19cf4028d8fcc890bb5d9922f552e658c51f883143ee881dd7c68e3c436a1da718de7d3d16f162f9ca90a8fd sodinokibi.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\2B8F1B57330DBBA2D07A6C51F70EE90DDAB9AD8E\Blob = 5c000000010000000400000000100000190000000100000010000000ea6089055218053dd01e37e1d806eedf0300000001000000140000002b8f1b57330dbba2d07a6c51f70ee90ddab9ad8e0b00000001000000100000005300650063007400690067006f0000001d0000000100000010000000885010358d29a38f059b028559c95f901400000001000000140000005379bf5aaa2b4acf5480e1d89bc09df2b20366cb620000000100000020000000e793c9b02fd8aa13e21c31228accb08119643b749c898964b1746d46c3d4cbd253000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b060105050703080f000000010000003000000066b764a96581128168cf208e374dda479d54e311f32457f4aee0dbd2a6c8d171d531289e1cd22bfdbbd4cfd9796254830400000001000000100000001bfe69d191b71933a372a80fe155e5b52000000001000000e2050000308205de308203c6a003020102021001fd6d30fca3ca51a81bbc640e35032d300d06092a864886f70d01010c0500308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f72697479301e170d3130303230313030303030305a170d3338303131383233353935395a308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f7269747930820222300d06092a864886f70d01010105000382020f003082020a028202010080126517360ec3db08b3d0ac570d76edcd27d34cad508361e2aa204d092d6409dcce899fcc3da9ecf6cfc1dcf1d3b1d67b3728112b47da39c6bc3a19b45fa6bd7d9da36342b676f2a93b2b91f8e26fd0ec162090093ee2e874c918b491d46264db7fa306f188186a90223cbcfe13f087147bf6e41f8ed4e451c61167460851cb8614543fbc33fe7e6c9cff169d18bd518e35a6a766c87267db2166b1d49b7803c0503ae8ccf0dcbc9e4cfeaf0596351f575ab7ffcef93db72cb6f654ddc8e7123a4dae4c8ab75c9ab4b7203dca7f2234ae7e3b68660144e7014e46539b3360f794be5337907343f332c353efdbaafe744e69c76b8c6093dec4c70cdfe132aecc933b517895678bee3d56fe0cd0690f1b0ff325266b336df76e47fa7343e57e0ea566b1297c3284635589c40dc19354301913acd37d37a7eb5d3a6c355cdb41d712daa9490bdfd8808a0993628eb566cf2588cd84b8b13fa4390fd9029eeb124c957cf36b05a95e1683ccb867e2e8139dcc5b82d34cb3ed5bffdee573ac233b2d00bf3555740949d849581a7f9236e651920ef3267d1c4d17bcc9ec4326d0bf415f40a94444f499e757879e501f5754a83efd74632fb1506509e658422e431a4cb4f0254759fa041e93d426464a5081b2debe78b7fc6715e1c957841e0f63d6e962bad65f552eea5cc62808042539b80e2ba9f24c971c073f0d52f5edef2f820f0203010001a3423040301d0603551d0e041604145379bf5aaa2b4acf5480e1d89bc09df2b20366cb300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff300d06092a864886f70d01010c050003820201005cd47c0dcff7017d4199650c73c5529fcbf8cf99067f1bda43159f9e0255579614f1523c27879428ed1f3a0137a276fc5350c0849bc66b4eba8c214fa28e556291f36915d8bc88e3c4aa0bfdefa8e94b552a06206d55782919ee5f305c4b241155ff249a6e5e2a2bee0b4d9f7ff70138941495430709fb60a9ee1cab128ca09a5ea7986a596d8b3f08fbc8d145af18156490120f73282ec5e2244efc58ecf0f445fe22b3eb2f8ed2d9456105c1976fa876728f8b8c36afbf0d05ce718de6a66f1f6ca67162c5d8d083720cf16711890c9c134c7234dfbcd571dfaa71dde1b96c8c3c125d65dabd5712b6436bffe5de4d661151cf99aeec17b6e871918cde49fedd3571a21527941ccf61e326bb6fa36725215de6dd1d0b2e681b3b82afec836785d4985174b1b9998089ff7f78195c794a602e9240ae4c372a2cc9c762c80e5df7365bcae0252501b4dd1a079c77003fd0dcd5ec3dd4fabb3fcc85d66f7fa92ddfb902f7f5979ab535dac367b0874aa9289e238eff5c276be1b04ff307ee002ed45987cb524195eaf447d7ee6441557c8d590295dd629dc2b9ee5a287484a59bb790c70c07dff589367432d628c1b0b00be09c4cc31cd6fce369b54746812fa282abd3634470c48dff2d33baad8f7bb57088ae3e19cf4028d8fcc890bb5d9922f552e658c51f883143ee881dd7c68e3c436a1da718de7d3d16f162f9ca90a8fd sodinokibi.exe Key created \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000\Software\Microsoft\SystemCertificates\CA\Certificates\247106A405B288A46E70A0262717162D0903E734 sodinokibi.exe Set value (data) \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000\Software\Microsoft\SystemCertificates\CA\Certificates\247106A405B288A46E70A0262717162D0903E734\Blob = 030000000100000014000000247106a405b288a46e70a0262717162d0903e734140000000100000014000000b390a7d8c9af4ecd613c9f7cad5d7f41fd6930ea0400000001000000100000001a9a69a81f6da92d87f7694e16d8b8790f00000001000000300000009e9609372f45b5101548e8af9a20e0dbf5932dea9b9af86759c2029bc3b53e306e6491f6b15bf00b1e2dee3bb8d43d2219000000010000001000000043e6fa09a3b9d0de6fbe3aacd184c8fd5c000000010000000400000000080000180000000100000010000000ea6089055218053dd01e37e1d806eedf2000000001000000ed050000308205e9308203d1a003020102021005e4dc3b9438ab3b8597cba6a19850e3300d06092a864886f70d01010c0500308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f72697479301e170d3134303931323030303030305a170d3234303931313233353935395a305f310b3009060355040613024652310e300c060355040813055061726973310e300c060355040713055061726973310e300c060355040a130547616e64693120301e0603550403131747616e6469205374616e646172642053534c204341203230820122300d06092a864886f70d01010105000382010f003082010a028201010094042da6799574ffd5003cf5aed894b1297cc08f0b0b89b98283976e3728f5a21acfd2920b9ba8d387947384109fdc35cbc22d92ac21b9cb3bfc40c1c18321f0bff8f69cfa9c8210c0d08e4ee50d4cb0915c90b4a4405116dae484122d055ca11f17192451aa7aeae1071b868d0172f2e7d48323399ee0e14c1f6b22a3b41066b0ed8296d76e6ab4f23fb542fcdd8ab5abba2d1d3a759b31dc3e9dac5bd3410d6cb01bf53af579ea21a2f8f433524b242d1ea499b16d48bcb812fe72707cf7fb0275f48dded6dac0a0321a52df386b2e45383f3f049600fda1f4a2bbd517d6277c1b5859955e8a12fd9cab813e52284851856bf391b2863f29b56e0362eed6050203010001a382017530820171301f0603551d230418301680145379bf5aaa2b4acf5480e1d89bc09df2b20366cb301d0603551d0e04160414b390a7d8c9af4ecd613c9f7cad5d7f41fd6930ea300e0603551d0f0101ff04040302018630120603551d130101ff040830060101ff020100301d0603551d250416301406082b0601050507030106082b0601050507030230220603551d20041b3019300d060b2b06010401b2310102021a3008060667810c01020130500603551d1f044930473045a043a041863f687474703a2f2f63726c2e7573657274727573742e636f6d2f55534552547275737452534143657274696669636174696f6e417574686f726974792e63726c307606082b06010505070101046a3068303f06082b060105050730028633687474703a2f2f6372742e7573657274727573742e636f6d2f555345525472757374525341416464547275737443412e637274302506082b060105050730018619687474703a2f2f6f6373702e7573657274727573742e636f6d300d06092a864886f70d01010c050003820201005867fd72b26ad77c6196197ed94346d1267dc853fa66b06b2da7d3aa56f73a88d03b72c950fdf759b2aa68f58c7303bb956517ce2f1cdd9813a291c9eea1406e3c98d65cf3b2223c2dee1ba4e1de202416f28c1173913af6face240287ca93ecb4b6c81617c572fc2740f613fe93a69d51ef3c2bd877579b8c653a352536b7b58a636f072793b1608d80db96d47a8f2dab1c88c96e7ed6651faf5dca163f2846dca035e5f9e9e5d596880c4fc6b77767488427b61fb068dbacbf77b090b8a2c91c325d02ba2543814247bbd8e18f0c0c465fee46336b031482d37ecd8faf90d68e247d4042b46a6a17c69597e1f238cda7edb4274093df72a9b8c666633738642230a23bf1b9c87bc8fb293aab1a72d206124ef682d4236f3ec393e5d8b6c0dedc2316d61330b7a09a0e2c5506007001cfea391d80db88f7a520b85bfd3126698f2d0a61833a47a613542c1ee3ed44cabc6a1f280e51d9de0e9f75cd0e0395caf9c5a92a2dfe41a4a147ae0dc2f93966334a5be18428596c7d941776e44582ad7020fdd26f63a8d7faa033fa37cbf7b2659eda506f3fe4a7f38e5d58329770232ee7fdc4159b9c278f32ed17ad58813129111a9bd4fc6c9528c74e0507a6fd1dbc19e2e8b7b9118a2d701252858d8c334a0ffc9992e06370daa594476307e758c7315f053d3655fe83b2e8a6add7e9e6027488745cda34db90d26d510a23d623 sodinokibi.exe -
Suspicious behavior: EnumeratesProcesses 12 IoCs
Processes:
sodinokibi.exepid process 3544 sodinokibi.exe 3544 sodinokibi.exe 3544 sodinokibi.exe 3544 sodinokibi.exe 3544 sodinokibi.exe 3544 sodinokibi.exe 3544 sodinokibi.exe 3544 sodinokibi.exe 3544 sodinokibi.exe 3544 sodinokibi.exe 3544 sodinokibi.exe 3544 sodinokibi.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
vssvc.exedescription pid process Token: SeBackupPrivilege 732 vssvc.exe Token: SeRestorePrivilege 732 vssvc.exe Token: SeAuditPrivilege 732 vssvc.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
sodinokibi.execmd.exedescription pid process target process PID 3544 wrote to memory of 4028 3544 sodinokibi.exe cmd.exe PID 3544 wrote to memory of 4028 3544 sodinokibi.exe cmd.exe PID 3544 wrote to memory of 4028 3544 sodinokibi.exe cmd.exe PID 4028 wrote to memory of 2956 4028 cmd.exe vssadmin.exe PID 4028 wrote to memory of 2956 4028 cmd.exe vssadmin.exe PID 4028 wrote to memory of 2956 4028 cmd.exe vssadmin.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\sodinokibi.exe"C:\Users\Admin\AppData\Local\Temp\sodinokibi.exe"1⤵
- Modifies extensions of user files
- Enumerates connected drives
- Sets desktop wallpaper using registry
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c vssadmin.exe Delete Shadows /All /Quiet & bcdedit /set {default} recoveryenabled No & bcdedit /set {default} bootstatuspolicy ignoreallfailures2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\vssadmin.exevssadmin.exe Delete Shadows /All /Quiet3⤵
- Interacts with shadow copies
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2956-121-0x0000000000000000-mapping.dmp
-
memory/3544-116-0x0000000000900000-0x00000000009AE000-memory.dmpFilesize
696KB
-
memory/3544-115-0x0000000000900000-0x00000000009AE000-memory.dmpFilesize
696KB
-
memory/3544-118-0x00000000012C0000-0x00000000012C1000-memory.dmpFilesize
4KB
-
memory/3544-117-0x00000000009C0000-0x0000000000B0A000-memory.dmpFilesize
1.3MB
-
memory/3544-119-0x00000000012D0000-0x00000000012D6000-memory.dmpFilesize
24KB
-
memory/4028-120-0x0000000000000000-mapping.dmp