Analysis
-
max time kernel
170s -
max time network
156s -
platform
windows10_x64 -
resource
win10-en-20211208 -
submitted
24-01-2022 01:06
Static task
static1
Behavioral task
behavioral1
Sample
c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67.exe
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67.exe
Resource
win10-en-20211208
General
-
Target
c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67.exe
-
Size
144KB
-
MD5
e2a18b5d4f05c4708e4763c6d2e1529c
-
SHA1
28b3f748da6911033ef1d77966c6592eb787e2f3
-
SHA256
c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67
-
SHA512
4f3b77fbfe8a8356f454bbb167cfc2f29dc9e7419df4259c9bfc70f16654dedd2a252bcdfbe34fe4b5d7415a40ca7ee25aca6898aad0450b23ebf6f1c110468e
Malware Config
Extracted
C:\5dj706t2n-readme.txt
sodinokibi
http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/860ED5D58D28E4B5
http://decryptor.cc/860ED5D58D28E4B5
Signatures
-
Sodin,Sodinokibi,REvil
Ransomware with advanced anti-analysis and privilege escalation functionality.
-
Modifies extensions of user files 11 IoCs
Ransomware generally changes the extension on encrypted files.
Processes:
c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67.exedescription ioc process File renamed C:\Users\Admin\Pictures\CopyUndo.tiff => \??\c:\users\admin\pictures\CopyUndo.tiff.5dj706t2n c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67.exe File renamed C:\Users\Admin\Pictures\PingDismount.raw => \??\c:\users\admin\pictures\PingDismount.raw.5dj706t2n c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67.exe File renamed C:\Users\Admin\Pictures\UnregisterRestore.tiff => \??\c:\users\admin\pictures\UnregisterRestore.tiff.5dj706t2n c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67.exe File opened for modification \??\c:\users\admin\pictures\CopyUndo.tiff c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67.exe File opened for modification \??\c:\users\admin\pictures\UnregisterRestore.tiff c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67.exe File renamed C:\Users\Admin\Pictures\ConfirmSwitch.raw => \??\c:\users\admin\pictures\ConfirmSwitch.raw.5dj706t2n c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67.exe File renamed C:\Users\Admin\Pictures\ConfirmDebug.raw => \??\c:\users\admin\pictures\ConfirmDebug.raw.5dj706t2n c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67.exe File opened for modification \??\c:\users\admin\pictures\DebugTrace.tiff c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67.exe File renamed C:\Users\Admin\Pictures\CheckpointPublish.tif => \??\c:\users\admin\pictures\CheckpointPublish.tif.5dj706t2n c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67.exe File renamed C:\Users\Admin\Pictures\DebugTrace.tiff => \??\c:\users\admin\pictures\DebugTrace.tiff.5dj706t2n c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67.exe File renamed C:\Users\Admin\Pictures\ResumeSet.crw => \??\c:\users\admin\pictures\ResumeSet.crw.5dj706t2n c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\BV7BRrErOX = "C:\\Users\\Admin\\AppData\\Local\\Temp\\c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67.exe" c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67.exe -
Enumerates connected drives 3 TTPs 25 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67.exedescription ioc process File opened (read-only) \??\V: c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67.exe File opened (read-only) \??\E: c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67.exe File opened (read-only) \??\G: c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67.exe File opened (read-only) \??\J: c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67.exe File opened (read-only) \??\M: c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67.exe File opened (read-only) \??\Q: c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67.exe File opened (read-only) \??\S: c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67.exe File opened (read-only) \??\T: c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67.exe File opened (read-only) \??\W: c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67.exe File opened (read-only) \??\Z: c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67.exe File opened (read-only) \??\A: c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67.exe File opened (read-only) \??\I: c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67.exe File opened (read-only) \??\P: c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67.exe File opened (read-only) \??\Y: c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67.exe File opened (read-only) \??\B: c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67.exe File opened (read-only) \??\L: c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67.exe File opened (read-only) \??\N: c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67.exe File opened (read-only) \??\O: c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67.exe File opened (read-only) \??\X: c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67.exe File opened (read-only) \??\D: c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67.exe File opened (read-only) \??\F: c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67.exe File opened (read-only) \??\H: c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67.exe File opened (read-only) \??\K: c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67.exe File opened (read-only) \??\R: c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67.exe File opened (read-only) \??\U: c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67.exe -
Drops file in Program Files directory 36 IoCs
Processes:
c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67.exedescription ioc process File opened for modification \??\c:\program files\TraceSet.3gp2 c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67.exe File opened for modification \??\c:\program files\UnblockApprove.xla c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67.exe File opened for modification \??\c:\program files\FindMount.fon c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67.exe File opened for modification \??\c:\program files\ReceiveRegister.M2TS c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67.exe File opened for modification \??\c:\program files\RenameConvertTo.pot c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67.exe File opened for modification \??\c:\program files\LockDisable.dot c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67.exe File opened for modification \??\c:\program files\RestoreNew.aif c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67.exe File created \??\c:\program files\5dj706t2n-readme.txt c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67.exe File opened for modification \??\c:\program files\ConnectUnlock.xht c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67.exe File opened for modification \??\c:\program files\ConvertToExpand.raw c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67.exe File opened for modification \??\c:\program files\InitializeConvert.3gpp c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67.exe File opened for modification \??\c:\program files\LimitGrant.vbs c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67.exe File opened for modification \??\c:\program files\OptimizeMeasure.m1v c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67.exe File opened for modification \??\c:\program files\ResetRedo.rtf c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67.exe File opened for modification \??\c:\program files\DebugMove.avi c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67.exe File opened for modification \??\c:\program files\EnablePing.ex_ c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67.exe File opened for modification \??\c:\program files\ExpandCheckpoint.xml c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67.exe File opened for modification \??\c:\program files\InvokeStep.jpeg c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67.exe File opened for modification \??\c:\program files\MountInvoke.jtx c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67.exe File opened for modification \??\c:\program files\StepResolve.scf c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67.exe File opened for modification \??\c:\program files\UnregisterClear.potm c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67.exe File opened for modification \??\c:\program files\WatchEnable.TTS c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67.exe File opened for modification \??\c:\program files\AssertOptimize.rmi c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67.exe File opened for modification \??\c:\program files\ExpandRestart.avi c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67.exe File opened for modification \??\c:\program files\ExportConnect.asf c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67.exe File opened for modification \??\c:\program files\RevokeProtect.dxf c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67.exe File opened for modification \??\c:\program files\SkipEnable.fon c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67.exe File opened for modification \??\c:\program files\AddDisconnect.midi c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67.exe File opened for modification \??\c:\program files\MeasureMerge.ex_ c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67.exe File opened for modification \??\c:\program files\OutGrant.i64 c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67.exe File opened for modification \??\c:\program files\SetInstall.dxf c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67.exe File created \??\c:\program files (x86)\5dj706t2n-readme.txt c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67.exe File opened for modification \??\c:\program files\ExitRestart.odp c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67.exe File opened for modification \??\c:\program files\ReadSkip.mid c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67.exe File opened for modification \??\c:\program files\ConvertProtect.fon c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67.exe File opened for modification \??\c:\program files\SuspendBlock.ods c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67.exepowershell.exepid process 2732 c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67.exe 2732 c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67.exe 1096 powershell.exe 1096 powershell.exe 1096 powershell.exe 2732 c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67.exe 2732 c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67.exe 2732 c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67.exe 2732 c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67.exe 2732 c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67.exe 2732 c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67.exe 2732 c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67.exe 2732 c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67.exe 2732 c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67.exe 2732 c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67.exe 2732 c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67.exe 2732 c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67.exe 2732 c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67.exe 2732 c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67.exe 2732 c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67.exe 2732 c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67.exe 2732 c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67.exe 2732 c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67.exe 2732 c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67.exe 2732 c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67.exe 2732 c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67.exe 2732 c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67.exe 2732 c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67.exe 2732 c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67.exe 2732 c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67.exe 2732 c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67.exe 2732 c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67.exe 2732 c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67.exe 2732 c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67.exe 2732 c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67.exe 2732 c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67.exe 2732 c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67.exe 2732 c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67.exe 2732 c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67.exe 2732 c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67.exe 2732 c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67.exe 2732 c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67.exe 2732 c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67.exe 2732 c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67.exe 2732 c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67.exe 2732 c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67.exe 2732 c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67.exe 2732 c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67.exe 2732 c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67.exe 2732 c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67.exe 2732 c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67.exe 2732 c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67.exe 2732 c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67.exe 2732 c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67.exe 2732 c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67.exe 2732 c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67.exe 2732 c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67.exe 2732 c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67.exe 2732 c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67.exe 2732 c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67.exe 2732 c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67.exe 2732 c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67.exe 2732 c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67.exe 2732 c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
Processes:
c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67.exepowershell.exevssvc.exedescription pid process Token: SeDebugPrivilege 2732 c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67.exe Token: SeDebugPrivilege 1096 powershell.exe Token: SeBackupPrivilege 2132 vssvc.exe Token: SeRestorePrivilege 2132 vssvc.exe Token: SeAuditPrivilege 2132 vssvc.exe Token: SeTakeOwnershipPrivilege 2732 c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67.exe -
Suspicious use of WriteProcessMemory 2 IoCs
Processes:
c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67.exedescription pid process target process PID 2732 wrote to memory of 1096 2732 c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67.exe powershell.exe PID 2732 wrote to memory of 1096 2732 c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67.exe powershell.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67.exe"C:\Users\Admin\AppData\Local\Temp\c595336e585b24392ab7587174f3eb277784a27e2a987c42711355ff1178ad67.exe"1⤵
- Modifies extensions of user files
- Adds Run key to start application
- Enumerates connected drives
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2732 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -e RwBlAHQALQBXAG0AaQBPAGIAagBlAGMAdAAgAFcAaQBuADMAMgBfAFMAaABhAGQAbwB3AGMAbwBwAHkAIAB8ACAARgBvAHIARQBhAGMAaAAtAE8AYgBqAGUAYwB0ACAAewAkAF8ALgBEAGUAbABlAHQAZQAoACkAOwB9AA==2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1096
-
C:\Windows\system32\wbem\unsecapp.exeC:\Windows\system32\wbem\unsecapp.exe -Embedding1⤵PID:1408
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2132
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1096-122-0x000001AACC8F0000-0x000001AACC912000-memory.dmpFilesize
136KB
-
memory/1096-127-0x000001AACEBF0000-0x000001AACEC66000-memory.dmpFilesize
472KB
-
memory/1096-134-0x000001AAB48C0000-0x000001AACC9A0000-memory.dmpFilesize
384.9MB
-
memory/1096-135-0x000001AAB48C0000-0x000001AACC9A0000-memory.dmpFilesize
384.9MB