Analysis
-
max time kernel
149s -
max time network
133s -
platform
windows7_x64 -
resource
win7-en-20211208 -
submitted
24-01-2022 01:07
Static task
static1
Behavioral task
behavioral1
Sample
c407c0db2f79f607dfdc5eb2f4f222491f96ea3540d8689c8ed6fba89a240757.exe
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
c407c0db2f79f607dfdc5eb2f4f222491f96ea3540d8689c8ed6fba89a240757.exe
Resource
win10-en-20211208
General
-
Target
c407c0db2f79f607dfdc5eb2f4f222491f96ea3540d8689c8ed6fba89a240757.exe
-
Size
158KB
-
MD5
21409a615234a47e7799d1d9a7b3aa56
-
SHA1
cafee6c61566fa05e6f4caf53e8ddbd4d604a7c9
-
SHA256
c407c0db2f79f607dfdc5eb2f4f222491f96ea3540d8689c8ed6fba89a240757
-
SHA512
32468ccc092fc9222984c912dc8f0f997d13d0754530ad0b03cefaf76381c3be66cbf1fceb8b8e6f3814b665d9078d5efddc7e9b2e38514bff3d9727d634411d
Malware Config
Extracted
C:\0096aka-readme.txt
sodinokibi
http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/D052AFA03A8B7E79
http://decryptor.top/D052AFA03A8B7E79
Signatures
-
Sodin,Sodinokibi,REvil
Ransomware with advanced anti-analysis and privilege escalation functionality.
-
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Modifies extensions of user files 10 IoCs
Ransomware generally changes the extension on encrypted files.
Processes:
c407c0db2f79f607dfdc5eb2f4f222491f96ea3540d8689c8ed6fba89a240757.exedescription ioc process File opened for modification C:\Users\Admin\Pictures\StopSet.tiff c407c0db2f79f607dfdc5eb2f4f222491f96ea3540d8689c8ed6fba89a240757.exe File renamed C:\Users\Admin\Pictures\ExpandGet.png => C:\Users\Admin\Pictures\ExpandGet.png.0096aka c407c0db2f79f607dfdc5eb2f4f222491f96ea3540d8689c8ed6fba89a240757.exe File renamed C:\Users\Admin\Pictures\PushUnregister.raw => C:\Users\Admin\Pictures\PushUnregister.raw.0096aka c407c0db2f79f607dfdc5eb2f4f222491f96ea3540d8689c8ed6fba89a240757.exe File renamed C:\Users\Admin\Pictures\ShowGrant.tiff => C:\Users\Admin\Pictures\ShowGrant.tiff.0096aka c407c0db2f79f607dfdc5eb2f4f222491f96ea3540d8689c8ed6fba89a240757.exe File renamed C:\Users\Admin\Pictures\StopSet.tiff => C:\Users\Admin\Pictures\StopSet.tiff.0096aka c407c0db2f79f607dfdc5eb2f4f222491f96ea3540d8689c8ed6fba89a240757.exe File renamed C:\Users\Admin\Pictures\UnblockExit.tif => C:\Users\Admin\Pictures\UnblockExit.tif.0096aka c407c0db2f79f607dfdc5eb2f4f222491f96ea3540d8689c8ed6fba89a240757.exe File opened for modification C:\Users\Admin\Pictures\ShowGrant.tiff c407c0db2f79f607dfdc5eb2f4f222491f96ea3540d8689c8ed6fba89a240757.exe File opened for modification C:\Users\Admin\Pictures\UpdateGet.tiff c407c0db2f79f607dfdc5eb2f4f222491f96ea3540d8689c8ed6fba89a240757.exe File renamed C:\Users\Admin\Pictures\MountGrant.raw => C:\Users\Admin\Pictures\MountGrant.raw.0096aka c407c0db2f79f607dfdc5eb2f4f222491f96ea3540d8689c8ed6fba89a240757.exe File renamed C:\Users\Admin\Pictures\UpdateGet.tiff => C:\Users\Admin\Pictures\UpdateGet.tiff.0096aka c407c0db2f79f607dfdc5eb2f4f222491f96ea3540d8689c8ed6fba89a240757.exe -
Enumerates connected drives 3 TTPs 24 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
c407c0db2f79f607dfdc5eb2f4f222491f96ea3540d8689c8ed6fba89a240757.exedescription ioc process File opened (read-only) \??\F: c407c0db2f79f607dfdc5eb2f4f222491f96ea3540d8689c8ed6fba89a240757.exe File opened (read-only) \??\H: c407c0db2f79f607dfdc5eb2f4f222491f96ea3540d8689c8ed6fba89a240757.exe File opened (read-only) \??\K: c407c0db2f79f607dfdc5eb2f4f222491f96ea3540d8689c8ed6fba89a240757.exe File opened (read-only) \??\L: c407c0db2f79f607dfdc5eb2f4f222491f96ea3540d8689c8ed6fba89a240757.exe File opened (read-only) \??\M: c407c0db2f79f607dfdc5eb2f4f222491f96ea3540d8689c8ed6fba89a240757.exe File opened (read-only) \??\B: c407c0db2f79f607dfdc5eb2f4f222491f96ea3540d8689c8ed6fba89a240757.exe File opened (read-only) \??\G: c407c0db2f79f607dfdc5eb2f4f222491f96ea3540d8689c8ed6fba89a240757.exe File opened (read-only) \??\N: c407c0db2f79f607dfdc5eb2f4f222491f96ea3540d8689c8ed6fba89a240757.exe File opened (read-only) \??\P: c407c0db2f79f607dfdc5eb2f4f222491f96ea3540d8689c8ed6fba89a240757.exe File opened (read-only) \??\T: c407c0db2f79f607dfdc5eb2f4f222491f96ea3540d8689c8ed6fba89a240757.exe File opened (read-only) \??\V: c407c0db2f79f607dfdc5eb2f4f222491f96ea3540d8689c8ed6fba89a240757.exe File opened (read-only) \??\W: c407c0db2f79f607dfdc5eb2f4f222491f96ea3540d8689c8ed6fba89a240757.exe File opened (read-only) \??\X: c407c0db2f79f607dfdc5eb2f4f222491f96ea3540d8689c8ed6fba89a240757.exe File opened (read-only) \??\E: c407c0db2f79f607dfdc5eb2f4f222491f96ea3540d8689c8ed6fba89a240757.exe File opened (read-only) \??\Z: c407c0db2f79f607dfdc5eb2f4f222491f96ea3540d8689c8ed6fba89a240757.exe File opened (read-only) \??\Q: c407c0db2f79f607dfdc5eb2f4f222491f96ea3540d8689c8ed6fba89a240757.exe File opened (read-only) \??\O: c407c0db2f79f607dfdc5eb2f4f222491f96ea3540d8689c8ed6fba89a240757.exe File opened (read-only) \??\I: c407c0db2f79f607dfdc5eb2f4f222491f96ea3540d8689c8ed6fba89a240757.exe File opened (read-only) \??\J: c407c0db2f79f607dfdc5eb2f4f222491f96ea3540d8689c8ed6fba89a240757.exe File opened (read-only) \??\R: c407c0db2f79f607dfdc5eb2f4f222491f96ea3540d8689c8ed6fba89a240757.exe File opened (read-only) \??\S: c407c0db2f79f607dfdc5eb2f4f222491f96ea3540d8689c8ed6fba89a240757.exe File opened (read-only) \??\U: c407c0db2f79f607dfdc5eb2f4f222491f96ea3540d8689c8ed6fba89a240757.exe File opened (read-only) \??\Y: c407c0db2f79f607dfdc5eb2f4f222491f96ea3540d8689c8ed6fba89a240757.exe File opened (read-only) \??\A: c407c0db2f79f607dfdc5eb2f4f222491f96ea3540d8689c8ed6fba89a240757.exe -
Drops file in Program Files directory 64 IoCs
Processes:
c407c0db2f79f607dfdc5eb2f4f222491f96ea3540d8689c8ed6fba89a240757.exedescription ioc process File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\hwrdeulm.dat c407c0db2f79f607dfdc5eb2f4f222491f96ea3540d8689c8ed6fba89a240757.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\Stationery\Stars.jpg c407c0db2f79f607dfdc5eb2f4f222491f96ea3540d8689c8ed6fba89a240757.exe File created C:\Program Files\Common Files\System\ado\fr-FR\1dbc51d0.lock c407c0db2f79f607dfdc5eb2f4f222491f96ea3540d8689c8ed6fba89a240757.exe File opened for modification C:\Program Files\Microsoft Games\FreeCell\FreeCellMCE.png c407c0db2f79f607dfdc5eb2f4f222491f96ea3540d8689c8ed6fba89a240757.exe File opened for modification C:\Program Files\Windows Defender\ja-JP\MpAsDesc.dll.mui c407c0db2f79f607dfdc5eb2f4f222491f96ea3540d8689c8ed6fba89a240757.exe File created C:\Program Files (x86)\Common Files\microsoft shared\Web Folders\1dbc51d0.lock c407c0db2f79f607dfdc5eb2f4f222491f96ea3540d8689c8ed6fba89a240757.exe File created C:\Program Files (x86)\Common Files\SpeechEngines\Microsoft\1dbc51d0.lock c407c0db2f79f607dfdc5eb2f4f222491f96ea3540d8689c8ed6fba89a240757.exe File created C:\Program Files (x86)\Microsoft Office\Stationery\1033\0096aka-readme.txt c407c0db2f79f607dfdc5eb2f4f222491f96ea3540d8689c8ed6fba89a240757.exe File created C:\Program Files (x86)\Microsoft Office\Templates\1033\0096aka-readme.txt c407c0db2f79f607dfdc5eb2f4f222491f96ea3540d8689c8ed6fba89a240757.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\hwrcommonlm.dat c407c0db2f79f607dfdc5eb2f4f222491f96ea3540d8689c8ed6fba89a240757.exe File created C:\Program Files\VideoLAN\VLC\1dbc51d0.lock c407c0db2f79f607dfdc5eb2f4f222491f96ea3540d8689c8ed6fba89a240757.exe File opened for modification C:\Program Files\DVD Maker\fr-FR\DVDMaker.exe.mui c407c0db2f79f607dfdc5eb2f4f222491f96ea3540d8689c8ed6fba89a240757.exe File created C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\0096aka-readme.txt c407c0db2f79f607dfdc5eb2f4f222491f96ea3540d8689c8ed6fba89a240757.exe File created C:\Program Files (x86)\Common Files\microsoft shared\TRANSLAT\0096aka-readme.txt c407c0db2f79f607dfdc5eb2f4f222491f96ea3540d8689c8ed6fba89a240757.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\en-US\0096aka-readme.txt c407c0db2f79f607dfdc5eb2f4f222491f96ea3540d8689c8ed6fba89a240757.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\ipsptb.xml c407c0db2f79f607dfdc5eb2f4f222491f96ea3540d8689c8ed6fba89a240757.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\lv-LV\1dbc51d0.lock c407c0db2f79f607dfdc5eb2f4f222491f96ea3540d8689c8ed6fba89a240757.exe File created C:\Program Files\Common Files\Microsoft Shared\Triedit\1dbc51d0.lock c407c0db2f79f607dfdc5eb2f4f222491f96ea3540d8689c8ed6fba89a240757.exe File created C:\Program Files\Microsoft Games\FreeCell\fr-FR\1dbc51d0.lock c407c0db2f79f607dfdc5eb2f4f222491f96ea3540d8689c8ed6fba89a240757.exe File opened for modification C:\Program Files\Windows Mail\en-US\WinMail.exe.mui c407c0db2f79f607dfdc5eb2f4f222491f96ea3540d8689c8ed6fba89a240757.exe File created C:\Program Files (x86)\Microsoft Office\Office14\ADDINS\1dbc51d0.lock c407c0db2f79f607dfdc5eb2f4f222491f96ea3540d8689c8ed6fba89a240757.exe File created C:\Program Files\Uninstall Information\0096aka-readme.txt c407c0db2f79f607dfdc5eb2f4f222491f96ea3540d8689c8ed6fba89a240757.exe File created C:\Program Files (x86)\Internet Explorer\fr-FR\0096aka-readme.txt c407c0db2f79f607dfdc5eb2f4f222491f96ea3540d8689c8ed6fba89a240757.exe File opened for modification C:\Program Files\StepRestore.odt c407c0db2f79f607dfdc5eb2f4f222491f96ea3540d8689c8ed6fba89a240757.exe File created C:\Program Files (x86)\Microsoft Synchronization Services\0096aka-readme.txt c407c0db2f79f607dfdc5eb2f4f222491f96ea3540d8689c8ed6fba89a240757.exe File opened for modification C:\Program Files\Windows NT\TableTextService\TableTextServiceSimplifiedZhengMa.txt c407c0db2f79f607dfdc5eb2f4f222491f96ea3540d8689c8ed6fba89a240757.exe File created C:\Program Files\Windows Journal\en-US\1dbc51d0.lock c407c0db2f79f607dfdc5eb2f4f222491f96ea3540d8689c8ed6fba89a240757.exe File created C:\Program Files\Windows Media Player\de-DE\1dbc51d0.lock c407c0db2f79f607dfdc5eb2f4f222491f96ea3540d8689c8ed6fba89a240757.exe File opened for modification C:\Program Files\7-Zip\Lang\co.txt c407c0db2f79f607dfdc5eb2f4f222491f96ea3540d8689c8ed6fba89a240757.exe File created C:\Program Files\DVD Maker\de-DE\1dbc51d0.lock c407c0db2f79f607dfdc5eb2f4f222491f96ea3540d8689c8ed6fba89a240757.exe File opened for modification C:\Program Files\Mozilla Firefox\removed-files c407c0db2f79f607dfdc5eb2f4f222491f96ea3540d8689c8ed6fba89a240757.exe File opened for modification C:\Program Files\Windows Journal\Templates\blank.jtp c407c0db2f79f607dfdc5eb2f4f222491f96ea3540d8689c8ed6fba89a240757.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Document Themes 14\Origin.thmx c407c0db2f79f607dfdc5eb2f4f222491f96ea3540d8689c8ed6fba89a240757.exe File created C:\Program Files\Windows Defender\0096aka-readme.txt c407c0db2f79f607dfdc5eb2f4f222491f96ea3540d8689c8ed6fba89a240757.exe File created C:\Program Files\Common Files\Microsoft Shared\MSInfo\de-DE\0096aka-readme.txt c407c0db2f79f607dfdc5eb2f4f222491f96ea3540d8689c8ed6fba89a240757.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\Stationery\Monet.jpg c407c0db2f79f607dfdc5eb2f4f222491f96ea3540d8689c8ed6fba89a240757.exe File opened for modification C:\Program Files\Windows Journal\Templates\Month_Calendar.jtp c407c0db2f79f607dfdc5eb2f4f222491f96ea3540d8689c8ed6fba89a240757.exe File created C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\1dbc51d0.lock c407c0db2f79f607dfdc5eb2f4f222491f96ea3540d8689c8ed6fba89a240757.exe File created C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\0096aka-readme.txt c407c0db2f79f607dfdc5eb2f4f222491f96ea3540d8689c8ed6fba89a240757.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\hwrdeush.dat c407c0db2f79f607dfdc5eb2f4f222491f96ea3540d8689c8ed6fba89a240757.exe File created C:\Program Files (x86)\Windows Mail\de-DE\0096aka-readme.txt c407c0db2f79f607dfdc5eb2f4f222491f96ea3540d8689c8ed6fba89a240757.exe File created C:\Program Files (x86)\Windows Sidebar\es-ES\0096aka-readme.txt c407c0db2f79f607dfdc5eb2f4f222491f96ea3540d8689c8ed6fba89a240757.exe File opened for modification C:\Program Files\7-Zip\Lang\be.txt c407c0db2f79f607dfdc5eb2f4f222491f96ea3540d8689c8ed6fba89a240757.exe File created C:\Program Files\Mozilla Firefox\defaults\pref\0096aka-readme.txt c407c0db2f79f607dfdc5eb2f4f222491f96ea3540d8689c8ed6fba89a240757.exe File created C:\Program Files\Common Files\SpeechEngines\1dbc51d0.lock c407c0db2f79f607dfdc5eb2f4f222491f96ea3540d8689c8ed6fba89a240757.exe File created C:\Program Files (x86)\Microsoft Office\Office14\OneNote\0096aka-readme.txt c407c0db2f79f607dfdc5eb2f4f222491f96ea3540d8689c8ed6fba89a240757.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\FlipPage\0096aka-readme.txt c407c0db2f79f607dfdc5eb2f4f222491f96ea3540d8689c8ed6fba89a240757.exe File created C:\Program Files\Microsoft Games\Hearts\1dbc51d0.lock c407c0db2f79f607dfdc5eb2f4f222491f96ea3540d8689c8ed6fba89a240757.exe File opened for modification C:\Program Files\DVD Maker\fr-FR\OmdProject.dll.mui c407c0db2f79f607dfdc5eb2f4f222491f96ea3540d8689c8ed6fba89a240757.exe File created C:\Program Files\Microsoft Games\Multiplayer\Backgammon\0096aka-readme.txt c407c0db2f79f607dfdc5eb2f4f222491f96ea3540d8689c8ed6fba89a240757.exe File opened for modification C:\Program Files\Windows Media Player\fr-FR\WMPDMCCore.dll.mui c407c0db2f79f607dfdc5eb2f4f222491f96ea3540d8689c8ed6fba89a240757.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\ASCIIENG.LNG c407c0db2f79f607dfdc5eb2f4f222491f96ea3540d8689c8ed6fba89a240757.exe File created C:\Program Files (x86)\Microsoft Office\Office14\Bibliography\0096aka-readme.txt c407c0db2f79f607dfdc5eb2f4f222491f96ea3540d8689c8ed6fba89a240757.exe File opened for modification C:\Program Files\Common Files\System\ado\msadox28.tlb c407c0db2f79f607dfdc5eb2f4f222491f96ea3540d8689c8ed6fba89a240757.exe File created C:\Program Files\Internet Explorer\de-DE\0096aka-readme.txt c407c0db2f79f607dfdc5eb2f4f222491f96ea3540d8689c8ed6fba89a240757.exe File created C:\Program Files\Windows Journal\fr-FR\1dbc51d0.lock c407c0db2f79f607dfdc5eb2f4f222491f96ea3540d8689c8ed6fba89a240757.exe File created C:\Program Files\Windows NT\TableTextService\1dbc51d0.lock c407c0db2f79f607dfdc5eb2f4f222491f96ea3540d8689c8ed6fba89a240757.exe File created C:\Program Files\Windows NT\Accessories\fr-FR\1dbc51d0.lock c407c0db2f79f607dfdc5eb2f4f222491f96ea3540d8689c8ed6fba89a240757.exe File opened for modification C:\Program Files\RedoSplit.TTS c407c0db2f79f607dfdc5eb2f4f222491f96ea3540d8689c8ed6fba89a240757.exe File created C:\Program Files (x86)\Microsoft Office\Office14\OutlookAutoDiscover\0096aka-readme.txt c407c0db2f79f607dfdc5eb2f4f222491f96ea3540d8689c8ed6fba89a240757.exe File opened for modification C:\Program Files (x86)\Windows Media Player\es-ES\wmplayer.exe.mui c407c0db2f79f607dfdc5eb2f4f222491f96ea3540d8689c8ed6fba89a240757.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Mso Example Setup File A.txt c407c0db2f79f607dfdc5eb2f4f222491f96ea3540d8689c8ed6fba89a240757.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\REMINDER.WAV c407c0db2f79f607dfdc5eb2f4f222491f96ea3540d8689c8ed6fba89a240757.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\Stationery\Garden.jpg c407c0db2f79f607dfdc5eb2f4f222491f96ea3540d8689c8ed6fba89a240757.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Interacts with shadow copies 2 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
Processes:
vssadmin.exepid process 332 vssadmin.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
c407c0db2f79f607dfdc5eb2f4f222491f96ea3540d8689c8ed6fba89a240757.exepid process 1700 c407c0db2f79f607dfdc5eb2f4f222491f96ea3540d8689c8ed6fba89a240757.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
vssvc.exedescription pid process Token: SeBackupPrivilege 788 vssvc.exe Token: SeRestorePrivilege 788 vssvc.exe Token: SeAuditPrivilege 788 vssvc.exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
c407c0db2f79f607dfdc5eb2f4f222491f96ea3540d8689c8ed6fba89a240757.execmd.exedescription pid process target process PID 1700 wrote to memory of 1516 1700 c407c0db2f79f607dfdc5eb2f4f222491f96ea3540d8689c8ed6fba89a240757.exe cmd.exe PID 1700 wrote to memory of 1516 1700 c407c0db2f79f607dfdc5eb2f4f222491f96ea3540d8689c8ed6fba89a240757.exe cmd.exe PID 1700 wrote to memory of 1516 1700 c407c0db2f79f607dfdc5eb2f4f222491f96ea3540d8689c8ed6fba89a240757.exe cmd.exe PID 1700 wrote to memory of 1516 1700 c407c0db2f79f607dfdc5eb2f4f222491f96ea3540d8689c8ed6fba89a240757.exe cmd.exe PID 1516 wrote to memory of 332 1516 cmd.exe vssadmin.exe PID 1516 wrote to memory of 332 1516 cmd.exe vssadmin.exe PID 1516 wrote to memory of 332 1516 cmd.exe vssadmin.exe PID 1516 wrote to memory of 332 1516 cmd.exe vssadmin.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\c407c0db2f79f607dfdc5eb2f4f222491f96ea3540d8689c8ed6fba89a240757.exe"C:\Users\Admin\AppData\Local\Temp\c407c0db2f79f607dfdc5eb2f4f222491f96ea3540d8689c8ed6fba89a240757.exe"1⤵
- Modifies extensions of user files
- Enumerates connected drives
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1700 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c vssadmin.exe Delete Shadows /All /Quiet & bcdedit /set {default} recoveryenabled No & bcdedit /set {default} bootstatuspolicy ignoreallfailures2⤵
- Suspicious use of WriteProcessMemory
PID:1516 -
C:\Windows\SysWOW64\vssadmin.exevssadmin.exe Delete Shadows /All /Quiet3⤵
- Interacts with shadow copies
PID:332
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:788
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1700-54-0x0000000075601000-0x0000000075603000-memory.dmpFilesize
8KB