Analysis
-
max time kernel
154s -
max time network
166s -
platform
windows10_x64 -
resource
win10-en-20211208 -
submitted
24-01-2022 00:52
Static task
static1
Behavioral task
behavioral1
Sample
dd8028e5d5f57da2e6e3cf897e5e183b5b3194dd6886aef12e29c14cc3354e7f.exe
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
dd8028e5d5f57da2e6e3cf897e5e183b5b3194dd6886aef12e29c14cc3354e7f.exe
Resource
win10-en-20211208
General
-
Target
dd8028e5d5f57da2e6e3cf897e5e183b5b3194dd6886aef12e29c14cc3354e7f.exe
-
Size
115KB
-
MD5
ab5b30424c5b33662c98e03462ec286c
-
SHA1
bdaff521b07ec866281f070c177a4bfbc0a56790
-
SHA256
dd8028e5d5f57da2e6e3cf897e5e183b5b3194dd6886aef12e29c14cc3354e7f
-
SHA512
779f6bbfebac2e7412394d42a03f9da94eadf23ccb0a5380c908cdef3331b9cf538049e0c880fac27d7d02c3c797bc7457201817fd6faecba2ba302194744596
Malware Config
Extracted
C:\0ahw1k-readme.txt
sodinokibi
http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/0B9823807A1DFDD0
http://decryptor.cc/0B9823807A1DFDD0
Signatures
-
Sodin,Sodinokibi,REvil
Ransomware with advanced anti-analysis and privilege escalation functionality.
-
Modifies extensions of user files 5 IoCs
Ransomware generally changes the extension on encrypted files.
Processes:
dd8028e5d5f57da2e6e3cf897e5e183b5b3194dd6886aef12e29c14cc3354e7f.exedescription ioc process File renamed C:\Users\Admin\Pictures\BlockExport.crw => \??\c:\users\admin\pictures\BlockExport.crw.0ahw1k dd8028e5d5f57da2e6e3cf897e5e183b5b3194dd6886aef12e29c14cc3354e7f.exe File renamed C:\Users\Admin\Pictures\CheckpointFind.raw => \??\c:\users\admin\pictures\CheckpointFind.raw.0ahw1k dd8028e5d5f57da2e6e3cf897e5e183b5b3194dd6886aef12e29c14cc3354e7f.exe File renamed C:\Users\Admin\Pictures\DisconnectAssert.tif => \??\c:\users\admin\pictures\DisconnectAssert.tif.0ahw1k dd8028e5d5f57da2e6e3cf897e5e183b5b3194dd6886aef12e29c14cc3354e7f.exe File renamed C:\Users\Admin\Pictures\CompressStep.raw => \??\c:\users\admin\pictures\CompressStep.raw.0ahw1k dd8028e5d5f57da2e6e3cf897e5e183b5b3194dd6886aef12e29c14cc3354e7f.exe File renamed C:\Users\Admin\Pictures\RequestRename.tif => \??\c:\users\admin\pictures\RequestRename.tif.0ahw1k dd8028e5d5f57da2e6e3cf897e5e183b5b3194dd6886aef12e29c14cc3354e7f.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
dd8028e5d5f57da2e6e3cf897e5e183b5b3194dd6886aef12e29c14cc3354e7f.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run dd8028e5d5f57da2e6e3cf897e5e183b5b3194dd6886aef12e29c14cc3354e7f.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\7THSMUAouJ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\dd8028e5d5f57da2e6e3cf897e5e183b5b3194dd6886aef12e29c14cc3354e7f.exe" dd8028e5d5f57da2e6e3cf897e5e183b5b3194dd6886aef12e29c14cc3354e7f.exe -
Enumerates connected drives 3 TTPs 25 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
dd8028e5d5f57da2e6e3cf897e5e183b5b3194dd6886aef12e29c14cc3354e7f.exedescription ioc process File opened (read-only) \??\U: dd8028e5d5f57da2e6e3cf897e5e183b5b3194dd6886aef12e29c14cc3354e7f.exe File opened (read-only) \??\Y: dd8028e5d5f57da2e6e3cf897e5e183b5b3194dd6886aef12e29c14cc3354e7f.exe File opened (read-only) \??\E: dd8028e5d5f57da2e6e3cf897e5e183b5b3194dd6886aef12e29c14cc3354e7f.exe File opened (read-only) \??\N: dd8028e5d5f57da2e6e3cf897e5e183b5b3194dd6886aef12e29c14cc3354e7f.exe File opened (read-only) \??\P: dd8028e5d5f57da2e6e3cf897e5e183b5b3194dd6886aef12e29c14cc3354e7f.exe File opened (read-only) \??\V: dd8028e5d5f57da2e6e3cf897e5e183b5b3194dd6886aef12e29c14cc3354e7f.exe File opened (read-only) \??\D: dd8028e5d5f57da2e6e3cf897e5e183b5b3194dd6886aef12e29c14cc3354e7f.exe File opened (read-only) \??\F: dd8028e5d5f57da2e6e3cf897e5e183b5b3194dd6886aef12e29c14cc3354e7f.exe File opened (read-only) \??\M: dd8028e5d5f57da2e6e3cf897e5e183b5b3194dd6886aef12e29c14cc3354e7f.exe File opened (read-only) \??\R: dd8028e5d5f57da2e6e3cf897e5e183b5b3194dd6886aef12e29c14cc3354e7f.exe File opened (read-only) \??\S: dd8028e5d5f57da2e6e3cf897e5e183b5b3194dd6886aef12e29c14cc3354e7f.exe File opened (read-only) \??\T: dd8028e5d5f57da2e6e3cf897e5e183b5b3194dd6886aef12e29c14cc3354e7f.exe File opened (read-only) \??\W: dd8028e5d5f57da2e6e3cf897e5e183b5b3194dd6886aef12e29c14cc3354e7f.exe File opened (read-only) \??\J: dd8028e5d5f57da2e6e3cf897e5e183b5b3194dd6886aef12e29c14cc3354e7f.exe File opened (read-only) \??\O: dd8028e5d5f57da2e6e3cf897e5e183b5b3194dd6886aef12e29c14cc3354e7f.exe File opened (read-only) \??\Q: dd8028e5d5f57da2e6e3cf897e5e183b5b3194dd6886aef12e29c14cc3354e7f.exe File opened (read-only) \??\H: dd8028e5d5f57da2e6e3cf897e5e183b5b3194dd6886aef12e29c14cc3354e7f.exe File opened (read-only) \??\I: dd8028e5d5f57da2e6e3cf897e5e183b5b3194dd6886aef12e29c14cc3354e7f.exe File opened (read-only) \??\K: dd8028e5d5f57da2e6e3cf897e5e183b5b3194dd6886aef12e29c14cc3354e7f.exe File opened (read-only) \??\L: dd8028e5d5f57da2e6e3cf897e5e183b5b3194dd6886aef12e29c14cc3354e7f.exe File opened (read-only) \??\X: dd8028e5d5f57da2e6e3cf897e5e183b5b3194dd6886aef12e29c14cc3354e7f.exe File opened (read-only) \??\A: dd8028e5d5f57da2e6e3cf897e5e183b5b3194dd6886aef12e29c14cc3354e7f.exe File opened (read-only) \??\B: dd8028e5d5f57da2e6e3cf897e5e183b5b3194dd6886aef12e29c14cc3354e7f.exe File opened (read-only) \??\G: dd8028e5d5f57da2e6e3cf897e5e183b5b3194dd6886aef12e29c14cc3354e7f.exe File opened (read-only) \??\Z: dd8028e5d5f57da2e6e3cf897e5e183b5b3194dd6886aef12e29c14cc3354e7f.exe -
Sets desktop wallpaper using registry 2 TTPs 1 IoCs
Processes:
dd8028e5d5f57da2e6e3cf897e5e183b5b3194dd6886aef12e29c14cc3354e7f.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\l22fph04c540.bmp" dd8028e5d5f57da2e6e3cf897e5e183b5b3194dd6886aef12e29c14cc3354e7f.exe -
Drops file in Program Files directory 30 IoCs
Processes:
dd8028e5d5f57da2e6e3cf897e5e183b5b3194dd6886aef12e29c14cc3354e7f.exedescription ioc process File opened for modification \??\c:\program files\SaveBackup.mp2 dd8028e5d5f57da2e6e3cf897e5e183b5b3194dd6886aef12e29c14cc3354e7f.exe File opened for modification \??\c:\program files\SavePing.mhtml dd8028e5d5f57da2e6e3cf897e5e183b5b3194dd6886aef12e29c14cc3354e7f.exe File opened for modification \??\c:\program files\UpdateResume.3g2 dd8028e5d5f57da2e6e3cf897e5e183b5b3194dd6886aef12e29c14cc3354e7f.exe File opened for modification \??\c:\program files\GrantRename.dxf dd8028e5d5f57da2e6e3cf897e5e183b5b3194dd6886aef12e29c14cc3354e7f.exe File opened for modification \??\c:\program files\ConvertToRepair.ADT dd8028e5d5f57da2e6e3cf897e5e183b5b3194dd6886aef12e29c14cc3354e7f.exe File opened for modification \??\c:\program files\FindMeasure.svg dd8028e5d5f57da2e6e3cf897e5e183b5b3194dd6886aef12e29c14cc3354e7f.exe File opened for modification \??\c:\program files\OptimizeConnect.easmx dd8028e5d5f57da2e6e3cf897e5e183b5b3194dd6886aef12e29c14cc3354e7f.exe File created \??\c:\program files (x86)\0ahw1k-readme.txt dd8028e5d5f57da2e6e3cf897e5e183b5b3194dd6886aef12e29c14cc3354e7f.exe File opened for modification \??\c:\program files\MountMeasure.pot dd8028e5d5f57da2e6e3cf897e5e183b5b3194dd6886aef12e29c14cc3354e7f.exe File opened for modification \??\c:\program files\OutUnregister.shtml dd8028e5d5f57da2e6e3cf897e5e183b5b3194dd6886aef12e29c14cc3354e7f.exe File opened for modification \??\c:\program files\StepRegister.eprtx dd8028e5d5f57da2e6e3cf897e5e183b5b3194dd6886aef12e29c14cc3354e7f.exe File created \??\c:\program files\0ahw1k-readme.txt dd8028e5d5f57da2e6e3cf897e5e183b5b3194dd6886aef12e29c14cc3354e7f.exe File opened for modification \??\c:\program files\CheckpointResolve.tiff dd8028e5d5f57da2e6e3cf897e5e183b5b3194dd6886aef12e29c14cc3354e7f.exe File opened for modification \??\c:\program files\LimitGet.iso dd8028e5d5f57da2e6e3cf897e5e183b5b3194dd6886aef12e29c14cc3354e7f.exe File opened for modification \??\c:\program files\StepConvert.xlt dd8028e5d5f57da2e6e3cf897e5e183b5b3194dd6886aef12e29c14cc3354e7f.exe File opened for modification \??\c:\program files\StopUnregister.m3u dd8028e5d5f57da2e6e3cf897e5e183b5b3194dd6886aef12e29c14cc3354e7f.exe File opened for modification \??\c:\program files\UseStep.wvx dd8028e5d5f57da2e6e3cf897e5e183b5b3194dd6886aef12e29c14cc3354e7f.exe File opened for modification \??\c:\program files\ClearUndo.fon dd8028e5d5f57da2e6e3cf897e5e183b5b3194dd6886aef12e29c14cc3354e7f.exe File opened for modification \??\c:\program files\OutExpand.pub dd8028e5d5f57da2e6e3cf897e5e183b5b3194dd6886aef12e29c14cc3354e7f.exe File opened for modification \??\c:\program files\ReceiveMerge.docm dd8028e5d5f57da2e6e3cf897e5e183b5b3194dd6886aef12e29c14cc3354e7f.exe File opened for modification \??\c:\program files\CompressRename.mpeg2 dd8028e5d5f57da2e6e3cf897e5e183b5b3194dd6886aef12e29c14cc3354e7f.exe File opened for modification \??\c:\program files\ExitMeasure.mpeg3 dd8028e5d5f57da2e6e3cf897e5e183b5b3194dd6886aef12e29c14cc3354e7f.exe File opened for modification \??\c:\program files\ReadEnter.zip dd8028e5d5f57da2e6e3cf897e5e183b5b3194dd6886aef12e29c14cc3354e7f.exe File opened for modification \??\c:\program files\StartOptimize.zip dd8028e5d5f57da2e6e3cf897e5e183b5b3194dd6886aef12e29c14cc3354e7f.exe File opened for modification \??\c:\program files\CheckpointUse.jpg dd8028e5d5f57da2e6e3cf897e5e183b5b3194dd6886aef12e29c14cc3354e7f.exe File opened for modification \??\c:\program files\DebugProtect.cr2 dd8028e5d5f57da2e6e3cf897e5e183b5b3194dd6886aef12e29c14cc3354e7f.exe File opened for modification \??\c:\program files\DisconnectShow.jpeg dd8028e5d5f57da2e6e3cf897e5e183b5b3194dd6886aef12e29c14cc3354e7f.exe File opened for modification \??\c:\program files\MeasureCheckpoint.jtx dd8028e5d5f57da2e6e3cf897e5e183b5b3194dd6886aef12e29c14cc3354e7f.exe File opened for modification \??\c:\program files\UnregisterGrant.wvx dd8028e5d5f57da2e6e3cf897e5e183b5b3194dd6886aef12e29c14cc3354e7f.exe File opened for modification \??\c:\program files\WaitTest.dwfx dd8028e5d5f57da2e6e3cf897e5e183b5b3194dd6886aef12e29c14cc3354e7f.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
dd8028e5d5f57da2e6e3cf897e5e183b5b3194dd6886aef12e29c14cc3354e7f.exedescription pid process Token: SeTakeOwnershipPrivilege 3204 dd8028e5d5f57da2e6e3cf897e5e183b5b3194dd6886aef12e29c14cc3354e7f.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\dd8028e5d5f57da2e6e3cf897e5e183b5b3194dd6886aef12e29c14cc3354e7f.exe"C:\Users\Admin\AppData\Local\Temp\dd8028e5d5f57da2e6e3cf897e5e183b5b3194dd6886aef12e29c14cc3354e7f.exe"1⤵
- Modifies extensions of user files
- Adds Run key to start application
- Enumerates connected drives
- Sets desktop wallpaper using registry
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
PID:3204