Analysis
-
max time kernel
195s -
max time network
205s -
platform
windows10_x64 -
resource
win10-en-20211208 -
submitted
24-01-2022 01:45
Static task
static1
Behavioral task
behavioral1
Sample
7bafd5de1b6724962ab920f71031978a101055f061ae3cc21db8bb9fa64c5829.exe
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
7bafd5de1b6724962ab920f71031978a101055f061ae3cc21db8bb9fa64c5829.exe
Resource
win10-en-20211208
General
-
Target
7bafd5de1b6724962ab920f71031978a101055f061ae3cc21db8bb9fa64c5829.exe
-
Size
160KB
-
MD5
fac2cf669daebaf56f2fd4b3e0da10c0
-
SHA1
778bef878540c39021b50942faaebf9b473d4918
-
SHA256
7bafd5de1b6724962ab920f71031978a101055f061ae3cc21db8bb9fa64c5829
-
SHA512
0f8688c5f66c99e6951886c34123c5a8882e877fffd82b150810d8664784ea26e445e5dd9b93ed38bd2aff6506df2466286d0500682b6d5ebc4df12c0d0b5c92
Malware Config
Extracted
C:\cmzln986u-readme.txt
sodinokibi
http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/37C123AE73F31004
http://decryptor.top/37C123AE73F31004
Signatures
-
Sodin,Sodinokibi,REvil
Ransomware with advanced anti-analysis and privilege escalation functionality.
-
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Modifies extensions of user files 13 IoCs
Ransomware generally changes the extension on encrypted files.
Processes:
7bafd5de1b6724962ab920f71031978a101055f061ae3cc21db8bb9fa64c5829.exedescription ioc process File renamed C:\Users\Admin\Pictures\ClearWatch.crw => \??\c:\users\admin\pictures\ClearWatch.crw.cmzln986u 7bafd5de1b6724962ab920f71031978a101055f061ae3cc21db8bb9fa64c5829.exe File renamed C:\Users\Admin\Pictures\DenyEnable.tiff => \??\c:\users\admin\pictures\DenyEnable.tiff.cmzln986u 7bafd5de1b6724962ab920f71031978a101055f061ae3cc21db8bb9fa64c5829.exe File renamed C:\Users\Admin\Pictures\NewFind.crw => \??\c:\users\admin\pictures\NewFind.crw.cmzln986u 7bafd5de1b6724962ab920f71031978a101055f061ae3cc21db8bb9fa64c5829.exe File renamed C:\Users\Admin\Pictures\PingUnpublish.tiff => \??\c:\users\admin\pictures\PingUnpublish.tiff.cmzln986u 7bafd5de1b6724962ab920f71031978a101055f061ae3cc21db8bb9fa64c5829.exe File renamed C:\Users\Admin\Pictures\ResizeRestore.tif => \??\c:\users\admin\pictures\ResizeRestore.tif.cmzln986u 7bafd5de1b6724962ab920f71031978a101055f061ae3cc21db8bb9fa64c5829.exe File opened for modification \??\c:\users\admin\pictures\DenyEnable.tiff 7bafd5de1b6724962ab920f71031978a101055f061ae3cc21db8bb9fa64c5829.exe File opened for modification \??\c:\users\admin\pictures\RenameEnter.tiff 7bafd5de1b6724962ab920f71031978a101055f061ae3cc21db8bb9fa64c5829.exe File renamed C:\Users\Admin\Pictures\RenameEnter.tiff => \??\c:\users\admin\pictures\RenameEnter.tiff.cmzln986u 7bafd5de1b6724962ab920f71031978a101055f061ae3cc21db8bb9fa64c5829.exe File renamed C:\Users\Admin\Pictures\SetWatch.raw => \??\c:\users\admin\pictures\SetWatch.raw.cmzln986u 7bafd5de1b6724962ab920f71031978a101055f061ae3cc21db8bb9fa64c5829.exe File renamed C:\Users\Admin\Pictures\SyncCompare.crw => \??\c:\users\admin\pictures\SyncCompare.crw.cmzln986u 7bafd5de1b6724962ab920f71031978a101055f061ae3cc21db8bb9fa64c5829.exe File renamed C:\Users\Admin\Pictures\UnpublishUndo.crw => \??\c:\users\admin\pictures\UnpublishUndo.crw.cmzln986u 7bafd5de1b6724962ab920f71031978a101055f061ae3cc21db8bb9fa64c5829.exe File opened for modification \??\c:\users\admin\pictures\PingUnpublish.tiff 7bafd5de1b6724962ab920f71031978a101055f061ae3cc21db8bb9fa64c5829.exe File renamed C:\Users\Admin\Pictures\HideConvertTo.crw => \??\c:\users\admin\pictures\HideConvertTo.crw.cmzln986u 7bafd5de1b6724962ab920f71031978a101055f061ae3cc21db8bb9fa64c5829.exe -
Enumerates connected drives 3 TTPs 24 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
7bafd5de1b6724962ab920f71031978a101055f061ae3cc21db8bb9fa64c5829.exedescription ioc process File opened (read-only) \??\E: 7bafd5de1b6724962ab920f71031978a101055f061ae3cc21db8bb9fa64c5829.exe File opened (read-only) \??\H: 7bafd5de1b6724962ab920f71031978a101055f061ae3cc21db8bb9fa64c5829.exe File opened (read-only) \??\I: 7bafd5de1b6724962ab920f71031978a101055f061ae3cc21db8bb9fa64c5829.exe File opened (read-only) \??\J: 7bafd5de1b6724962ab920f71031978a101055f061ae3cc21db8bb9fa64c5829.exe File opened (read-only) \??\Q: 7bafd5de1b6724962ab920f71031978a101055f061ae3cc21db8bb9fa64c5829.exe File opened (read-only) \??\F: 7bafd5de1b6724962ab920f71031978a101055f061ae3cc21db8bb9fa64c5829.exe File opened (read-only) \??\U: 7bafd5de1b6724962ab920f71031978a101055f061ae3cc21db8bb9fa64c5829.exe File opened (read-only) \??\V: 7bafd5de1b6724962ab920f71031978a101055f061ae3cc21db8bb9fa64c5829.exe File opened (read-only) \??\W: 7bafd5de1b6724962ab920f71031978a101055f061ae3cc21db8bb9fa64c5829.exe File opened (read-only) \??\Y: 7bafd5de1b6724962ab920f71031978a101055f061ae3cc21db8bb9fa64c5829.exe File opened (read-only) \??\Z: 7bafd5de1b6724962ab920f71031978a101055f061ae3cc21db8bb9fa64c5829.exe File opened (read-only) \??\X: 7bafd5de1b6724962ab920f71031978a101055f061ae3cc21db8bb9fa64c5829.exe File opened (read-only) \??\A: 7bafd5de1b6724962ab920f71031978a101055f061ae3cc21db8bb9fa64c5829.exe File opened (read-only) \??\G: 7bafd5de1b6724962ab920f71031978a101055f061ae3cc21db8bb9fa64c5829.exe File opened (read-only) \??\L: 7bafd5de1b6724962ab920f71031978a101055f061ae3cc21db8bb9fa64c5829.exe File opened (read-only) \??\O: 7bafd5de1b6724962ab920f71031978a101055f061ae3cc21db8bb9fa64c5829.exe File opened (read-only) \??\P: 7bafd5de1b6724962ab920f71031978a101055f061ae3cc21db8bb9fa64c5829.exe File opened (read-only) \??\S: 7bafd5de1b6724962ab920f71031978a101055f061ae3cc21db8bb9fa64c5829.exe File opened (read-only) \??\T: 7bafd5de1b6724962ab920f71031978a101055f061ae3cc21db8bb9fa64c5829.exe File opened (read-only) \??\B: 7bafd5de1b6724962ab920f71031978a101055f061ae3cc21db8bb9fa64c5829.exe File opened (read-only) \??\K: 7bafd5de1b6724962ab920f71031978a101055f061ae3cc21db8bb9fa64c5829.exe File opened (read-only) \??\M: 7bafd5de1b6724962ab920f71031978a101055f061ae3cc21db8bb9fa64c5829.exe File opened (read-only) \??\N: 7bafd5de1b6724962ab920f71031978a101055f061ae3cc21db8bb9fa64c5829.exe File opened (read-only) \??\R: 7bafd5de1b6724962ab920f71031978a101055f061ae3cc21db8bb9fa64c5829.exe -
Sets desktop wallpaper using registry 2 TTPs 1 IoCs
Processes:
7bafd5de1b6724962ab920f71031978a101055f061ae3cc21db8bb9fa64c5829.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\xz2whly5v.bmp" 7bafd5de1b6724962ab920f71031978a101055f061ae3cc21db8bb9fa64c5829.exe -
Drops file in Program Files directory 43 IoCs
Processes:
7bafd5de1b6724962ab920f71031978a101055f061ae3cc21db8bb9fa64c5829.exedescription ioc process File opened for modification \??\c:\program files\InitializeExpand.aif 7bafd5de1b6724962ab920f71031978a101055f061ae3cc21db8bb9fa64c5829.exe File opened for modification \??\c:\program files\MergeStart.ADT 7bafd5de1b6724962ab920f71031978a101055f061ae3cc21db8bb9fa64c5829.exe File opened for modification \??\c:\program files\SendUpdate.ttc 7bafd5de1b6724962ab920f71031978a101055f061ae3cc21db8bb9fa64c5829.exe File opened for modification \??\c:\program files\ShowWait.mpeg3 7bafd5de1b6724962ab920f71031978a101055f061ae3cc21db8bb9fa64c5829.exe File opened for modification \??\c:\program files\UndoExpand.ico 7bafd5de1b6724962ab920f71031978a101055f061ae3cc21db8bb9fa64c5829.exe File opened for modification \??\c:\program files\UnregisterRename.aif 7bafd5de1b6724962ab920f71031978a101055f061ae3cc21db8bb9fa64c5829.exe File opened for modification \??\c:\program files\WriteRedo.dib 7bafd5de1b6724962ab920f71031978a101055f061ae3cc21db8bb9fa64c5829.exe File created \??\c:\program files\79823d8d.lock 7bafd5de1b6724962ab920f71031978a101055f061ae3cc21db8bb9fa64c5829.exe File opened for modification \??\c:\program files\AddConnect.cfg 7bafd5de1b6724962ab920f71031978a101055f061ae3cc21db8bb9fa64c5829.exe File opened for modification \??\c:\program files\EnableStep.eps 7bafd5de1b6724962ab920f71031978a101055f061ae3cc21db8bb9fa64c5829.exe File opened for modification \??\c:\program files\RepairCheckpoint.bin 7bafd5de1b6724962ab920f71031978a101055f061ae3cc21db8bb9fa64c5829.exe File opened for modification \??\c:\program files\LockStart.mhtml 7bafd5de1b6724962ab920f71031978a101055f061ae3cc21db8bb9fa64c5829.exe File opened for modification \??\c:\program files\StopUnblock.avi 7bafd5de1b6724962ab920f71031978a101055f061ae3cc21db8bb9fa64c5829.exe File opened for modification \??\c:\program files\UseSplit.xml 7bafd5de1b6724962ab920f71031978a101055f061ae3cc21db8bb9fa64c5829.exe File created \??\c:\program files (x86)\79823d8d.lock 7bafd5de1b6724962ab920f71031978a101055f061ae3cc21db8bb9fa64c5829.exe File opened for modification \??\c:\program files\DenyDismount.lock 7bafd5de1b6724962ab920f71031978a101055f061ae3cc21db8bb9fa64c5829.exe File opened for modification \??\c:\program files\LimitDisable.vsw 7bafd5de1b6724962ab920f71031978a101055f061ae3cc21db8bb9fa64c5829.exe File opened for modification \??\c:\program files\PublishImport.DVR 7bafd5de1b6724962ab920f71031978a101055f061ae3cc21db8bb9fa64c5829.exe File opened for modification \??\c:\program files\SearchConvertTo.ppt 7bafd5de1b6724962ab920f71031978a101055f061ae3cc21db8bb9fa64c5829.exe File opened for modification \??\c:\program files\UnprotectRevoke.js 7bafd5de1b6724962ab920f71031978a101055f061ae3cc21db8bb9fa64c5829.exe File opened for modification \??\c:\program files\WatchSearch.mov 7bafd5de1b6724962ab920f71031978a101055f061ae3cc21db8bb9fa64c5829.exe File opened for modification \??\c:\program files\CompareResolve.asf 7bafd5de1b6724962ab920f71031978a101055f061ae3cc21db8bb9fa64c5829.exe File opened for modification \??\c:\program files\EnterJoin.odt 7bafd5de1b6724962ab920f71031978a101055f061ae3cc21db8bb9fa64c5829.exe File opened for modification \??\c:\program files\ExitGroup.eprtx 7bafd5de1b6724962ab920f71031978a101055f061ae3cc21db8bb9fa64c5829.exe File opened for modification \??\c:\program files\OutAssert.DVR-MS 7bafd5de1b6724962ab920f71031978a101055f061ae3cc21db8bb9fa64c5829.exe File opened for modification \??\c:\program files\ProtectConvertFrom.jpeg 7bafd5de1b6724962ab920f71031978a101055f061ae3cc21db8bb9fa64c5829.exe File opened for modification \??\c:\program files\ResizeInstall.xltm 7bafd5de1b6724962ab920f71031978a101055f061ae3cc21db8bb9fa64c5829.exe File opened for modification \??\c:\program files\WatchCompare.otf 7bafd5de1b6724962ab920f71031978a101055f061ae3cc21db8bb9fa64c5829.exe File opened for modification \??\c:\program files\MoveUnprotect.DVR-MS 7bafd5de1b6724962ab920f71031978a101055f061ae3cc21db8bb9fa64c5829.exe File opened for modification \??\c:\program files\RepairSkip.TS 7bafd5de1b6724962ab920f71031978a101055f061ae3cc21db8bb9fa64c5829.exe File created \??\c:\program files\cmzln986u-readme.txt 7bafd5de1b6724962ab920f71031978a101055f061ae3cc21db8bb9fa64c5829.exe File opened for modification \??\c:\program files\AssertNew.mpeg2 7bafd5de1b6724962ab920f71031978a101055f061ae3cc21db8bb9fa64c5829.exe File opened for modification \??\c:\program files\CheckpointRepair.ps1 7bafd5de1b6724962ab920f71031978a101055f061ae3cc21db8bb9fa64c5829.exe File opened for modification \??\c:\program files\GroupInvoke.ram 7bafd5de1b6724962ab920f71031978a101055f061ae3cc21db8bb9fa64c5829.exe File opened for modification \??\c:\program files\PingGet.au3 7bafd5de1b6724962ab920f71031978a101055f061ae3cc21db8bb9fa64c5829.exe File opened for modification \??\c:\program files\WatchSuspend.dwg 7bafd5de1b6724962ab920f71031978a101055f061ae3cc21db8bb9fa64c5829.exe File created \??\c:\program files (x86)\cmzln986u-readme.txt 7bafd5de1b6724962ab920f71031978a101055f061ae3cc21db8bb9fa64c5829.exe File opened for modification \??\c:\program files\DisableStop.ADTS 7bafd5de1b6724962ab920f71031978a101055f061ae3cc21db8bb9fa64c5829.exe File opened for modification \??\c:\program files\DismountDisconnect.asp 7bafd5de1b6724962ab920f71031978a101055f061ae3cc21db8bb9fa64c5829.exe File opened for modification \??\c:\program files\DismountRequest.inf 7bafd5de1b6724962ab920f71031978a101055f061ae3cc21db8bb9fa64c5829.exe File opened for modification \??\c:\program files\ExportInvoke.cmd 7bafd5de1b6724962ab920f71031978a101055f061ae3cc21db8bb9fa64c5829.exe File opened for modification \??\c:\program files\ResizeRequest.raw 7bafd5de1b6724962ab920f71031978a101055f061ae3cc21db8bb9fa64c5829.exe File opened for modification \??\c:\program files\TestEnter.eps 7bafd5de1b6724962ab920f71031978a101055f061ae3cc21db8bb9fa64c5829.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Interacts with shadow copies 2 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
Processes:
vssadmin.exepid process 1892 vssadmin.exe -
Processes:
7bafd5de1b6724962ab920f71031978a101055f061ae3cc21db8bb9fa64c5829.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000\Software\Microsoft\SystemCertificates\CA\Certificates\4C27431717565A3A07F3E6D0032C4258949CF9EC 7bafd5de1b6724962ab920f71031978a101055f061ae3cc21db8bb9fa64c5829.exe Set value (data) \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000\Software\Microsoft\SystemCertificates\CA\Certificates\4C27431717565A3A07F3E6D0032C4258949CF9EC\Blob = 0300000001000000140000004c27431717565a3a07f3e6d0032c4258949cf9ec140000000100000014000000f5cdd53c0850f96a4f3ab797da5683e669d268f7040000000100000010000000342e1e02d91852d4a66f8a892167c8fa0f0000000100000020000000a2de33490c476d356e2dbc737c2779692249526b65ab8fba9a34280481c8bdfc19000000010000001000000014b989b317682449c76eb3c21dac16e75c000000010000000400000000080000180000000100000010000000a823b4a20180beb460cab955c24d7e212000000001000000510400003082044d30820335a003020102020b040000000001444ef03631300d06092a864886f70d01010b05003057310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613110300e060355040b1307526f6f74204341311b301906035504031312476c6f62616c5369676e20526f6f74204341301e170d3134303232303130303030305a170d3234303232303130303030305a304c310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613122302006035504031319416c70686153534c204341202d20534841323536202d20473230820122300d06092a864886f70d01010105000382010f003082010a0282010100da01ece4ec7360fb7e8f6ab7c617e3926432d4ac00d9a20fb9edee6b8a86ca9267d974d75d47023c8f40d69e6d14cdc3da2939a70f050a68a2661a1ec4b28b7658e5ab5d1d8f40b3398bef1e837d22d0e3a9002eec53cf62198544284cc027cb7b0eec10640010a405cca072be416c315b48e4b1ecb923eb554dd07d624aa5b4a5a45985c52591a6fea6099f06106d8f810c64405e73009ae02e65985410007098c8e1ed345fd89cc70dc0d6235945fcfe557a86ee946022f1aed1e65546f699c51b08745facb064848f89381ca1a790214f026ebde06167d4f842870f0af7c9046d2aa92fef42a5dfdda353db981e81f99a727b5ade4f3e7fa258a0e217ad670203010001a38201233082011f300e0603551d0f0101ff04040302010630120603551d130101ff040830060101ff020100301d0603551d0e04160414f5cdd53c0850f96a4f3ab797da5683e669d268f730450603551d20043e303c303a0604551d20003032303006082b06010505070201162468747470733a2f2f7777772e616c70686173736c2e636f6d2f7265706f7369746f72792f30330603551d1f042c302a3028a026a0248622687474703a2f2f63726c2e676c6f62616c7369676e2e6e65742f726f6f742e63726c303d06082b060105050701010431302f302d06082b060105050730018621687474703a2f2f6f6373702e676c6f62616c7369676e2e636f6d2f726f6f747231301f0603551d23041830168014607b661a450d97ca89502f7d04cd34a8fffcfd4b300d06092a864886f70d01010b050003820101006040681647e7168ddb5ca1562acbf45c9bb01ea24bf5cb023ff80ba1f2a742d4b74cebe36680f32543782e1b1756075218cbd1a8ece6fb733ea4628c80b4d2c51273a3d3fa0238be633d84b899c1f1baf79fc340d1581853c162ddaf18427f344ec543d571b03000c7e390ae3f578697ceea0c128e2270e366a7547f2e28cbd454d0b31e626708f927e1cbe366b8241b896a894465f2d94cd2581c8c4ec095a1d4ef672f3820e82eff9651f0bad83d927047651c9e7372b4600c5ce2d17376e0af4ee2e537a5452f8a233e87c730e631387cf4dd52caf353042557566694e80beee603144eeefd6d94649e5ece79d4b2a6cf40b144a83e87195ee9f821165953 7bafd5de1b6724962ab920f71031978a101055f061ae3cc21db8bb9fa64c5829.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
7bafd5de1b6724962ab920f71031978a101055f061ae3cc21db8bb9fa64c5829.exepid process 844 7bafd5de1b6724962ab920f71031978a101055f061ae3cc21db8bb9fa64c5829.exe 844 7bafd5de1b6724962ab920f71031978a101055f061ae3cc21db8bb9fa64c5829.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
vssvc.exedescription pid process Token: SeBackupPrivilege 3496 vssvc.exe Token: SeRestorePrivilege 3496 vssvc.exe Token: SeAuditPrivilege 3496 vssvc.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
7bafd5de1b6724962ab920f71031978a101055f061ae3cc21db8bb9fa64c5829.execmd.exedescription pid process target process PID 844 wrote to memory of 3468 844 7bafd5de1b6724962ab920f71031978a101055f061ae3cc21db8bb9fa64c5829.exe cmd.exe PID 844 wrote to memory of 3468 844 7bafd5de1b6724962ab920f71031978a101055f061ae3cc21db8bb9fa64c5829.exe cmd.exe PID 844 wrote to memory of 3468 844 7bafd5de1b6724962ab920f71031978a101055f061ae3cc21db8bb9fa64c5829.exe cmd.exe PID 3468 wrote to memory of 1892 3468 cmd.exe vssadmin.exe PID 3468 wrote to memory of 1892 3468 cmd.exe vssadmin.exe PID 3468 wrote to memory of 1892 3468 cmd.exe vssadmin.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\7bafd5de1b6724962ab920f71031978a101055f061ae3cc21db8bb9fa64c5829.exe"C:\Users\Admin\AppData\Local\Temp\7bafd5de1b6724962ab920f71031978a101055f061ae3cc21db8bb9fa64c5829.exe"1⤵
- Modifies extensions of user files
- Enumerates connected drives
- Sets desktop wallpaper using registry
- Drops file in Program Files directory
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c vssadmin.exe Delete Shadows /All /Quiet & bcdedit /set {default} recoveryenabled No & bcdedit /set {default} bootstatuspolicy ignoreallfailures2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\vssadmin.exevssadmin.exe Delete Shadows /All /Quiet3⤵
- Interacts with shadow copies
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken