Analysis
-
max time kernel
126s -
max time network
168s -
platform
windows7_x64 -
resource
win7-en-20211208 -
submitted
24-01-2022 01:07
Static task
static1
Behavioral task
behavioral1
Sample
c3a9d8de3247814aa681fc4ceed0e22b47872b4c767807534665df762335c58f.exe
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
c3a9d8de3247814aa681fc4ceed0e22b47872b4c767807534665df762335c58f.exe
Resource
win10-en-20211208
General
-
Target
c3a9d8de3247814aa681fc4ceed0e22b47872b4c767807534665df762335c58f.exe
-
Size
212KB
-
MD5
c3c62f924e4e354680d5f516da901ad3
-
SHA1
265cb778142e3b11f00321858a7f27bdc9e93a81
-
SHA256
c3a9d8de3247814aa681fc4ceed0e22b47872b4c767807534665df762335c58f
-
SHA512
cbf776eb0dc16c73e47d2144a42d488dbdfa560989c1361cf32767407dd2165ff7f33b71ce8c72bab790df1efd10f7a0775a2eaf97558707584d92572194dab2
Malware Config
Extracted
C:\t6mw9ft-readme.txt
sodinokibi
http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/CE903FB2116A84F3
http://decryptor.top/CE903FB2116A84F3
Signatures
-
Sodin,Sodinokibi,REvil
Ransomware with advanced anti-analysis and privilege escalation functionality.
-
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Modifies extensions of user files 14 IoCs
Ransomware generally changes the extension on encrypted files.
Processes:
c3a9d8de3247814aa681fc4ceed0e22b47872b4c767807534665df762335c58f.exedescription ioc process File renamed C:\Users\Admin\Pictures\OpenRestore.crw => \??\c:\users\admin\pictures\OpenRestore.crw.t6mw9ft c3a9d8de3247814aa681fc4ceed0e22b47872b4c767807534665df762335c58f.exe File opened for modification \??\c:\users\admin\pictures\InvokeSearch.tiff c3a9d8de3247814aa681fc4ceed0e22b47872b4c767807534665df762335c58f.exe File renamed C:\Users\Admin\Pictures\PushInitialize.crw => \??\c:\users\admin\pictures\PushInitialize.crw.t6mw9ft c3a9d8de3247814aa681fc4ceed0e22b47872b4c767807534665df762335c58f.exe File renamed C:\Users\Admin\Pictures\ReadUndo.crw => \??\c:\users\admin\pictures\ReadUndo.crw.t6mw9ft c3a9d8de3247814aa681fc4ceed0e22b47872b4c767807534665df762335c58f.exe File renamed C:\Users\Admin\Pictures\SuspendGrant.raw => \??\c:\users\admin\pictures\SuspendGrant.raw.t6mw9ft c3a9d8de3247814aa681fc4ceed0e22b47872b4c767807534665df762335c58f.exe File renamed C:\Users\Admin\Pictures\ExitClose.png => \??\c:\users\admin\pictures\ExitClose.png.t6mw9ft c3a9d8de3247814aa681fc4ceed0e22b47872b4c767807534665df762335c58f.exe File renamed C:\Users\Admin\Pictures\ResolveEnter.tiff => \??\c:\users\admin\pictures\ResolveEnter.tiff.t6mw9ft c3a9d8de3247814aa681fc4ceed0e22b47872b4c767807534665df762335c58f.exe File renamed C:\Users\Admin\Pictures\SyncLimit.png => \??\c:\users\admin\pictures\SyncLimit.png.t6mw9ft c3a9d8de3247814aa681fc4ceed0e22b47872b4c767807534665df762335c58f.exe File renamed C:\Users\Admin\Pictures\TestSkip.tif => \??\c:\users\admin\pictures\TestSkip.tif.t6mw9ft c3a9d8de3247814aa681fc4ceed0e22b47872b4c767807534665df762335c58f.exe File renamed C:\Users\Admin\Pictures\ConvertFromGet.crw => \??\c:\users\admin\pictures\ConvertFromGet.crw.t6mw9ft c3a9d8de3247814aa681fc4ceed0e22b47872b4c767807534665df762335c58f.exe File renamed C:\Users\Admin\Pictures\EnableClose.raw => \??\c:\users\admin\pictures\EnableClose.raw.t6mw9ft c3a9d8de3247814aa681fc4ceed0e22b47872b4c767807534665df762335c58f.exe File renamed C:\Users\Admin\Pictures\InvokeSearch.tiff => \??\c:\users\admin\pictures\InvokeSearch.tiff.t6mw9ft c3a9d8de3247814aa681fc4ceed0e22b47872b4c767807534665df762335c58f.exe File renamed C:\Users\Admin\Pictures\ReceiveRename.png => \??\c:\users\admin\pictures\ReceiveRename.png.t6mw9ft c3a9d8de3247814aa681fc4ceed0e22b47872b4c767807534665df762335c58f.exe File opened for modification \??\c:\users\admin\pictures\ResolveEnter.tiff c3a9d8de3247814aa681fc4ceed0e22b47872b4c767807534665df762335c58f.exe -
Drops desktop.ini file(s) 28 IoCs
Processes:
c3a9d8de3247814aa681fc4ceed0e22b47872b4c767807534665df762335c58f.exedescription ioc process File opened for modification \??\c:\users\public\downloads\desktop.ini c3a9d8de3247814aa681fc4ceed0e22b47872b4c767807534665df762335c58f.exe File opened for modification \??\c:\users\public\recorded tv\sample media\desktop.ini c3a9d8de3247814aa681fc4ceed0e22b47872b4c767807534665df762335c58f.exe File opened for modification \??\c:\users\admin\links\desktop.ini c3a9d8de3247814aa681fc4ceed0e22b47872b4c767807534665df762335c58f.exe File opened for modification \??\c:\users\admin\music\desktop.ini c3a9d8de3247814aa681fc4ceed0e22b47872b4c767807534665df762335c58f.exe File opened for modification \??\c:\users\admin\videos\desktop.ini c3a9d8de3247814aa681fc4ceed0e22b47872b4c767807534665df762335c58f.exe File opened for modification \??\c:\users\public\desktop\desktop.ini c3a9d8de3247814aa681fc4ceed0e22b47872b4c767807534665df762335c58f.exe File opened for modification \??\c:\users\public\music\sample music\desktop.ini c3a9d8de3247814aa681fc4ceed0e22b47872b4c767807534665df762335c58f.exe File opened for modification \??\c:\users\admin\contacts\desktop.ini c3a9d8de3247814aa681fc4ceed0e22b47872b4c767807534665df762335c58f.exe File opened for modification \??\c:\users\admin\pictures\desktop.ini c3a9d8de3247814aa681fc4ceed0e22b47872b4c767807534665df762335c58f.exe File opened for modification \??\c:\program files\desktop.ini c3a9d8de3247814aa681fc4ceed0e22b47872b4c767807534665df762335c58f.exe File opened for modification \??\c:\program files (x86)\desktop.ini c3a9d8de3247814aa681fc4ceed0e22b47872b4c767807534665df762335c58f.exe File opened for modification \??\c:\users\admin\downloads\desktop.ini c3a9d8de3247814aa681fc4ceed0e22b47872b4c767807534665df762335c58f.exe File opened for modification \??\c:\users\admin\favorites\links for united states\desktop.ini c3a9d8de3247814aa681fc4ceed0e22b47872b4c767807534665df762335c58f.exe File opened for modification \??\c:\users\public\videos\sample videos\desktop.ini c3a9d8de3247814aa681fc4ceed0e22b47872b4c767807534665df762335c58f.exe File opened for modification \??\c:\users\admin\favorites\desktop.ini c3a9d8de3247814aa681fc4ceed0e22b47872b4c767807534665df762335c58f.exe File opened for modification \??\c:\users\admin\searches\desktop.ini c3a9d8de3247814aa681fc4ceed0e22b47872b4c767807534665df762335c58f.exe File opened for modification \??\c:\users\public\documents\desktop.ini c3a9d8de3247814aa681fc4ceed0e22b47872b4c767807534665df762335c58f.exe File opened for modification \??\c:\users\public\pictures\desktop.ini c3a9d8de3247814aa681fc4ceed0e22b47872b4c767807534665df762335c58f.exe File opened for modification \??\c:\users\public\desktop.ini c3a9d8de3247814aa681fc4ceed0e22b47872b4c767807534665df762335c58f.exe File opened for modification \??\c:\users\admin\desktop\desktop.ini c3a9d8de3247814aa681fc4ceed0e22b47872b4c767807534665df762335c58f.exe File opened for modification \??\c:\users\public\libraries\desktop.ini c3a9d8de3247814aa681fc4ceed0e22b47872b4c767807534665df762335c58f.exe File opened for modification \??\c:\users\admin\documents\desktop.ini c3a9d8de3247814aa681fc4ceed0e22b47872b4c767807534665df762335c58f.exe File opened for modification \??\c:\users\admin\saved games\desktop.ini c3a9d8de3247814aa681fc4ceed0e22b47872b4c767807534665df762335c58f.exe File opened for modification \??\c:\users\public\recorded tv\desktop.ini c3a9d8de3247814aa681fc4ceed0e22b47872b4c767807534665df762335c58f.exe File opened for modification \??\c:\users\public\videos\desktop.ini c3a9d8de3247814aa681fc4ceed0e22b47872b4c767807534665df762335c58f.exe File opened for modification \??\c:\users\public\music\desktop.ini c3a9d8de3247814aa681fc4ceed0e22b47872b4c767807534665df762335c58f.exe File opened for modification \??\c:\users\admin\favorites\links\desktop.ini c3a9d8de3247814aa681fc4ceed0e22b47872b4c767807534665df762335c58f.exe File opened for modification \??\c:\users\public\pictures\sample pictures\desktop.ini c3a9d8de3247814aa681fc4ceed0e22b47872b4c767807534665df762335c58f.exe -
Enumerates connected drives 3 TTPs 25 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
c3a9d8de3247814aa681fc4ceed0e22b47872b4c767807534665df762335c58f.exedescription ioc process File opened (read-only) \??\J: c3a9d8de3247814aa681fc4ceed0e22b47872b4c767807534665df762335c58f.exe File opened (read-only) \??\O: c3a9d8de3247814aa681fc4ceed0e22b47872b4c767807534665df762335c58f.exe File opened (read-only) \??\T: c3a9d8de3247814aa681fc4ceed0e22b47872b4c767807534665df762335c58f.exe File opened (read-only) \??\U: c3a9d8de3247814aa681fc4ceed0e22b47872b4c767807534665df762335c58f.exe File opened (read-only) \??\F: c3a9d8de3247814aa681fc4ceed0e22b47872b4c767807534665df762335c58f.exe File opened (read-only) \??\H: c3a9d8de3247814aa681fc4ceed0e22b47872b4c767807534665df762335c58f.exe File opened (read-only) \??\I: c3a9d8de3247814aa681fc4ceed0e22b47872b4c767807534665df762335c58f.exe File opened (read-only) \??\N: c3a9d8de3247814aa681fc4ceed0e22b47872b4c767807534665df762335c58f.exe File opened (read-only) \??\R: c3a9d8de3247814aa681fc4ceed0e22b47872b4c767807534665df762335c58f.exe File opened (read-only) \??\S: c3a9d8de3247814aa681fc4ceed0e22b47872b4c767807534665df762335c58f.exe File opened (read-only) \??\X: c3a9d8de3247814aa681fc4ceed0e22b47872b4c767807534665df762335c58f.exe File opened (read-only) \??\Y: c3a9d8de3247814aa681fc4ceed0e22b47872b4c767807534665df762335c58f.exe File opened (read-only) \??\B: c3a9d8de3247814aa681fc4ceed0e22b47872b4c767807534665df762335c58f.exe File opened (read-only) \??\G: c3a9d8de3247814aa681fc4ceed0e22b47872b4c767807534665df762335c58f.exe File opened (read-only) \??\M: c3a9d8de3247814aa681fc4ceed0e22b47872b4c767807534665df762335c58f.exe File opened (read-only) \??\Z: c3a9d8de3247814aa681fc4ceed0e22b47872b4c767807534665df762335c58f.exe File opened (read-only) \??\D: c3a9d8de3247814aa681fc4ceed0e22b47872b4c767807534665df762335c58f.exe File opened (read-only) \??\P: c3a9d8de3247814aa681fc4ceed0e22b47872b4c767807534665df762335c58f.exe File opened (read-only) \??\V: c3a9d8de3247814aa681fc4ceed0e22b47872b4c767807534665df762335c58f.exe File opened (read-only) \??\W: c3a9d8de3247814aa681fc4ceed0e22b47872b4c767807534665df762335c58f.exe File opened (read-only) \??\L: c3a9d8de3247814aa681fc4ceed0e22b47872b4c767807534665df762335c58f.exe File opened (read-only) \??\Q: c3a9d8de3247814aa681fc4ceed0e22b47872b4c767807534665df762335c58f.exe File opened (read-only) \??\A: c3a9d8de3247814aa681fc4ceed0e22b47872b4c767807534665df762335c58f.exe File opened (read-only) \??\E: c3a9d8de3247814aa681fc4ceed0e22b47872b4c767807534665df762335c58f.exe File opened (read-only) \??\K: c3a9d8de3247814aa681fc4ceed0e22b47872b4c767807534665df762335c58f.exe -
Sets desktop wallpaper using registry 2 TTPs 1 IoCs
Processes:
c3a9d8de3247814aa681fc4ceed0e22b47872b4c767807534665df762335c58f.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\89ggc030oqn.bmp" c3a9d8de3247814aa681fc4ceed0e22b47872b4c767807534665df762335c58f.exe -
Drops file in Program Files directory 41 IoCs
Processes:
c3a9d8de3247814aa681fc4ceed0e22b47872b4c767807534665df762335c58f.exedescription ioc process File opened for modification \??\c:\program files\GroupSync.docx c3a9d8de3247814aa681fc4ceed0e22b47872b4c767807534665df762335c58f.exe File opened for modification \??\c:\program files\OutConnect.xltx c3a9d8de3247814aa681fc4ceed0e22b47872b4c767807534665df762335c58f.exe File opened for modification \??\c:\program files\ResumeUninstall.raw c3a9d8de3247814aa681fc4ceed0e22b47872b4c767807534665df762335c58f.exe File opened for modification \??\c:\program files\SuspendSubmit.wmx c3a9d8de3247814aa681fc4ceed0e22b47872b4c767807534665df762335c58f.exe File opened for modification \??\c:\program files\SyncPush.edrwx c3a9d8de3247814aa681fc4ceed0e22b47872b4c767807534665df762335c58f.exe File opened for modification \??\c:\program files\BackupRequest.reg c3a9d8de3247814aa681fc4ceed0e22b47872b4c767807534665df762335c58f.exe File opened for modification \??\c:\program files\RepairResume.mov c3a9d8de3247814aa681fc4ceed0e22b47872b4c767807534665df762335c58f.exe File created \??\c:\program files (x86)\microsoft sql server compact edition\t6mw9ft-readme.txt c3a9d8de3247814aa681fc4ceed0e22b47872b4c767807534665df762335c58f.exe File created \??\c:\program files (x86)\microsoft sql server compact edition\v3.5\desktop\t6mw9ft-readme.txt c3a9d8de3247814aa681fc4ceed0e22b47872b4c767807534665df762335c58f.exe File created \??\c:\program files (x86)\t6mw9ft-readme.txt c3a9d8de3247814aa681fc4ceed0e22b47872b4c767807534665df762335c58f.exe File opened for modification \??\c:\program files\CompressDismount.eprtx c3a9d8de3247814aa681fc4ceed0e22b47872b4c767807534665df762335c58f.exe File opened for modification \??\c:\program files\HideSuspend.mpe c3a9d8de3247814aa681fc4ceed0e22b47872b4c767807534665df762335c58f.exe File opened for modification \??\c:\program files\HideWrite.xlsm c3a9d8de3247814aa681fc4ceed0e22b47872b4c767807534665df762335c58f.exe File opened for modification \??\c:\program files\NewConnect.jpg c3a9d8de3247814aa681fc4ceed0e22b47872b4c767807534665df762335c58f.exe File opened for modification \??\c:\program files\ResolveSync.001 c3a9d8de3247814aa681fc4ceed0e22b47872b4c767807534665df762335c58f.exe File opened for modification \??\c:\program files\RestartTest.xps c3a9d8de3247814aa681fc4ceed0e22b47872b4c767807534665df762335c58f.exe File opened for modification \??\c:\program files\ConvertFromConfirm.001 c3a9d8de3247814aa681fc4ceed0e22b47872b4c767807534665df762335c58f.exe File opened for modification \??\c:\program files\desktop.ini c3a9d8de3247814aa681fc4ceed0e22b47872b4c767807534665df762335c58f.exe File opened for modification \??\c:\program files\DismountResolve.rar c3a9d8de3247814aa681fc4ceed0e22b47872b4c767807534665df762335c58f.exe File opened for modification \??\c:\program files\OutSet.ogg c3a9d8de3247814aa681fc4ceed0e22b47872b4c767807534665df762335c58f.exe File opened for modification \??\c:\program files\RepairPublish.asf c3a9d8de3247814aa681fc4ceed0e22b47872b4c767807534665df762335c58f.exe File opened for modification \??\c:\program files\SkipNew.WTV c3a9d8de3247814aa681fc4ceed0e22b47872b4c767807534665df762335c58f.exe File opened for modification \??\c:\program files\UseCopy.jpe c3a9d8de3247814aa681fc4ceed0e22b47872b4c767807534665df762335c58f.exe File created \??\c:\program files\t6mw9ft-readme.txt c3a9d8de3247814aa681fc4ceed0e22b47872b4c767807534665df762335c58f.exe File opened for modification \??\c:\program files\AssertClose.xml c3a9d8de3247814aa681fc4ceed0e22b47872b4c767807534665df762335c58f.exe File opened for modification \??\c:\program files\DenyRestart.dib c3a9d8de3247814aa681fc4ceed0e22b47872b4c767807534665df762335c58f.exe File opened for modification \??\c:\program files\RevokeStep.rar c3a9d8de3247814aa681fc4ceed0e22b47872b4c767807534665df762335c58f.exe File opened for modification \??\c:\program files\ShowGet.reg c3a9d8de3247814aa681fc4ceed0e22b47872b4c767807534665df762335c58f.exe File opened for modification \??\c:\program files\DisconnectResolve.xht c3a9d8de3247814aa681fc4ceed0e22b47872b4c767807534665df762335c58f.exe File opened for modification \??\c:\program files\OpenInitialize.mov c3a9d8de3247814aa681fc4ceed0e22b47872b4c767807534665df762335c58f.exe File opened for modification \??\c:\program files\SetShow.inf c3a9d8de3247814aa681fc4ceed0e22b47872b4c767807534665df762335c58f.exe File created \??\c:\program files (x86)\microsoft sql server compact edition\v3.5\t6mw9ft-readme.txt c3a9d8de3247814aa681fc4ceed0e22b47872b4c767807534665df762335c58f.exe File opened for modification \??\c:\program files\ConfirmDisconnect.contact c3a9d8de3247814aa681fc4ceed0e22b47872b4c767807534665df762335c58f.exe File opened for modification \??\c:\program files\MergeRestore.css c3a9d8de3247814aa681fc4ceed0e22b47872b4c767807534665df762335c58f.exe File opened for modification \??\c:\program files (x86)\desktop.ini c3a9d8de3247814aa681fc4ceed0e22b47872b4c767807534665df762335c58f.exe File opened for modification \??\c:\program files\SuspendTrace.asp c3a9d8de3247814aa681fc4ceed0e22b47872b4c767807534665df762335c58f.exe File opened for modification \??\c:\program files\ClearConfirm.mp4 c3a9d8de3247814aa681fc4ceed0e22b47872b4c767807534665df762335c58f.exe File opened for modification \??\c:\program files\ClearWait.mp3 c3a9d8de3247814aa681fc4ceed0e22b47872b4c767807534665df762335c58f.exe File opened for modification \??\c:\program files\DisableComplete.cfg c3a9d8de3247814aa681fc4ceed0e22b47872b4c767807534665df762335c58f.exe File opened for modification \??\c:\program files\ImportConfirm.tiff c3a9d8de3247814aa681fc4ceed0e22b47872b4c767807534665df762335c58f.exe File opened for modification \??\c:\program files\LockSet.TS c3a9d8de3247814aa681fc4ceed0e22b47872b4c767807534665df762335c58f.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Interacts with shadow copies 2 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
Processes:
vssadmin.exepid process 1116 vssadmin.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
c3a9d8de3247814aa681fc4ceed0e22b47872b4c767807534665df762335c58f.exepid process 1864 c3a9d8de3247814aa681fc4ceed0e22b47872b4c767807534665df762335c58f.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
vssvc.exedescription pid process Token: SeBackupPrivilege 656 vssvc.exe Token: SeRestorePrivilege 656 vssvc.exe Token: SeAuditPrivilege 656 vssvc.exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
c3a9d8de3247814aa681fc4ceed0e22b47872b4c767807534665df762335c58f.execmd.exedescription pid process target process PID 1864 wrote to memory of 812 1864 c3a9d8de3247814aa681fc4ceed0e22b47872b4c767807534665df762335c58f.exe cmd.exe PID 1864 wrote to memory of 812 1864 c3a9d8de3247814aa681fc4ceed0e22b47872b4c767807534665df762335c58f.exe cmd.exe PID 1864 wrote to memory of 812 1864 c3a9d8de3247814aa681fc4ceed0e22b47872b4c767807534665df762335c58f.exe cmd.exe PID 1864 wrote to memory of 812 1864 c3a9d8de3247814aa681fc4ceed0e22b47872b4c767807534665df762335c58f.exe cmd.exe PID 812 wrote to memory of 1116 812 cmd.exe vssadmin.exe PID 812 wrote to memory of 1116 812 cmd.exe vssadmin.exe PID 812 wrote to memory of 1116 812 cmd.exe vssadmin.exe PID 812 wrote to memory of 1116 812 cmd.exe vssadmin.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\c3a9d8de3247814aa681fc4ceed0e22b47872b4c767807534665df762335c58f.exe"C:\Users\Admin\AppData\Local\Temp\c3a9d8de3247814aa681fc4ceed0e22b47872b4c767807534665df762335c58f.exe"1⤵
- Modifies extensions of user files
- Drops desktop.ini file(s)
- Enumerates connected drives
- Sets desktop wallpaper using registry
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c vssadmin.exe Delete Shadows /All /Quiet & bcdedit /set {default} recoveryenabled No & bcdedit /set {default} bootstatuspolicy ignoreallfailures2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\vssadmin.exevssadmin.exe Delete Shadows /All /Quiet3⤵
- Interacts with shadow copies
-
C:\Windows\system32\wbem\unsecapp.exeC:\Windows\system32\wbem\unsecapp.exe -Embedding1⤵
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1864-54-0x0000000076041000-0x0000000076043000-memory.dmpFilesize
8KB