Analysis
-
max time kernel
175s -
max time network
136s -
platform
windows10_x64 -
resource
win10-en-20211208 -
submitted
24-01-2022 01:18
Static task
static1
Behavioral task
behavioral1
Sample
af4796662d4dca855050c42a69c01096573b9acd3faa550ce55560c1dc9ac31c.exe
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
af4796662d4dca855050c42a69c01096573b9acd3faa550ce55560c1dc9ac31c.exe
Resource
win10-en-20211208
General
-
Target
af4796662d4dca855050c42a69c01096573b9acd3faa550ce55560c1dc9ac31c.exe
-
Size
196KB
-
MD5
7813228c80b5e0dda5a89927e15013f1
-
SHA1
8ae0fee7c240effa89f1f4d73a50c6b8ebd9f6b7
-
SHA256
af4796662d4dca855050c42a69c01096573b9acd3faa550ce55560c1dc9ac31c
-
SHA512
f3dc4f9a9726ad48fa868cc382d0ab97f1a5840e77deba7469c5a461503fa8d9fcca61c3c77fc21d27aafe44e0b0040f6fa5aa38160a06c785ba0c67933d71a2
Malware Config
Extracted
C:\sd64av-readme.txt
sodinokibi
http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/C9F7D3D69878FC55
http://decryptor.cc/C9F7D3D69878FC55
Signatures
-
Sodin,Sodinokibi,REvil
Ransomware with advanced anti-analysis and privilege escalation functionality.
-
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
af4796662d4dca855050c42a69c01096573b9acd3faa550ce55560c1dc9ac31c.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\BV7BRrErOX = "C:\\Users\\Admin\\AppData\\Local\\Temp\\af4796662d4dca855050c42a69c01096573b9acd3faa550ce55560c1dc9ac31c.exe" af4796662d4dca855050c42a69c01096573b9acd3faa550ce55560c1dc9ac31c.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run af4796662d4dca855050c42a69c01096573b9acd3faa550ce55560c1dc9ac31c.exe -
Enumerates connected drives 3 TTPs 24 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
af4796662d4dca855050c42a69c01096573b9acd3faa550ce55560c1dc9ac31c.exedescription ioc process File opened (read-only) \??\N: af4796662d4dca855050c42a69c01096573b9acd3faa550ce55560c1dc9ac31c.exe File opened (read-only) \??\S: af4796662d4dca855050c42a69c01096573b9acd3faa550ce55560c1dc9ac31c.exe File opened (read-only) \??\X: af4796662d4dca855050c42a69c01096573b9acd3faa550ce55560c1dc9ac31c.exe File opened (read-only) \??\Z: af4796662d4dca855050c42a69c01096573b9acd3faa550ce55560c1dc9ac31c.exe File opened (read-only) \??\A: af4796662d4dca855050c42a69c01096573b9acd3faa550ce55560c1dc9ac31c.exe File opened (read-only) \??\E: af4796662d4dca855050c42a69c01096573b9acd3faa550ce55560c1dc9ac31c.exe File opened (read-only) \??\I: af4796662d4dca855050c42a69c01096573b9acd3faa550ce55560c1dc9ac31c.exe File opened (read-only) \??\O: af4796662d4dca855050c42a69c01096573b9acd3faa550ce55560c1dc9ac31c.exe File opened (read-only) \??\Q: af4796662d4dca855050c42a69c01096573b9acd3faa550ce55560c1dc9ac31c.exe File opened (read-only) \??\Y: af4796662d4dca855050c42a69c01096573b9acd3faa550ce55560c1dc9ac31c.exe File opened (read-only) \??\G: af4796662d4dca855050c42a69c01096573b9acd3faa550ce55560c1dc9ac31c.exe File opened (read-only) \??\H: af4796662d4dca855050c42a69c01096573b9acd3faa550ce55560c1dc9ac31c.exe File opened (read-only) \??\K: af4796662d4dca855050c42a69c01096573b9acd3faa550ce55560c1dc9ac31c.exe File opened (read-only) \??\T: af4796662d4dca855050c42a69c01096573b9acd3faa550ce55560c1dc9ac31c.exe File opened (read-only) \??\V: af4796662d4dca855050c42a69c01096573b9acd3faa550ce55560c1dc9ac31c.exe File opened (read-only) \??\R: af4796662d4dca855050c42a69c01096573b9acd3faa550ce55560c1dc9ac31c.exe File opened (read-only) \??\U: af4796662d4dca855050c42a69c01096573b9acd3faa550ce55560c1dc9ac31c.exe File opened (read-only) \??\B: af4796662d4dca855050c42a69c01096573b9acd3faa550ce55560c1dc9ac31c.exe File opened (read-only) \??\F: af4796662d4dca855050c42a69c01096573b9acd3faa550ce55560c1dc9ac31c.exe File opened (read-only) \??\J: af4796662d4dca855050c42a69c01096573b9acd3faa550ce55560c1dc9ac31c.exe File opened (read-only) \??\L: af4796662d4dca855050c42a69c01096573b9acd3faa550ce55560c1dc9ac31c.exe File opened (read-only) \??\M: af4796662d4dca855050c42a69c01096573b9acd3faa550ce55560c1dc9ac31c.exe File opened (read-only) \??\P: af4796662d4dca855050c42a69c01096573b9acd3faa550ce55560c1dc9ac31c.exe File opened (read-only) \??\W: af4796662d4dca855050c42a69c01096573b9acd3faa550ce55560c1dc9ac31c.exe -
Drops file in Program Files directory 36 IoCs
Processes:
af4796662d4dca855050c42a69c01096573b9acd3faa550ce55560c1dc9ac31c.exedescription ioc process File opened for modification \??\c:\program files\ConvertProtect.fon af4796662d4dca855050c42a69c01096573b9acd3faa550ce55560c1dc9ac31c.exe File opened for modification \??\c:\program files\EnablePing.ex_ af4796662d4dca855050c42a69c01096573b9acd3faa550ce55560c1dc9ac31c.exe File opened for modification \??\c:\program files\FindMount.fon af4796662d4dca855050c42a69c01096573b9acd3faa550ce55560c1dc9ac31c.exe File opened for modification \??\c:\program files\MeasureMerge.ex_ af4796662d4dca855050c42a69c01096573b9acd3faa550ce55560c1dc9ac31c.exe File opened for modification \??\c:\program files\SkipEnable.fon af4796662d4dca855050c42a69c01096573b9acd3faa550ce55560c1dc9ac31c.exe File opened for modification \??\c:\program files\ExportConnect.asf af4796662d4dca855050c42a69c01096573b9acd3faa550ce55560c1dc9ac31c.exe File opened for modification \??\c:\program files\RevokeProtect.dxf af4796662d4dca855050c42a69c01096573b9acd3faa550ce55560c1dc9ac31c.exe File opened for modification \??\c:\program files\ConvertToExpand.raw af4796662d4dca855050c42a69c01096573b9acd3faa550ce55560c1dc9ac31c.exe File opened for modification \??\c:\program files\ExpandRestart.avi af4796662d4dca855050c42a69c01096573b9acd3faa550ce55560c1dc9ac31c.exe File opened for modification \??\c:\program files\OutGrant.i64 af4796662d4dca855050c42a69c01096573b9acd3faa550ce55560c1dc9ac31c.exe File opened for modification \??\c:\program files\ReceiveRegister.M2TS af4796662d4dca855050c42a69c01096573b9acd3faa550ce55560c1dc9ac31c.exe File opened for modification \??\c:\program files\ResetRedo.rtf af4796662d4dca855050c42a69c01096573b9acd3faa550ce55560c1dc9ac31c.exe File opened for modification \??\c:\program files\SuspendBlock.ods af4796662d4dca855050c42a69c01096573b9acd3faa550ce55560c1dc9ac31c.exe File opened for modification \??\c:\program files\UnblockApprove.xla af4796662d4dca855050c42a69c01096573b9acd3faa550ce55560c1dc9ac31c.exe File created \??\c:\program files (x86)\sd64av-readme.txt af4796662d4dca855050c42a69c01096573b9acd3faa550ce55560c1dc9ac31c.exe File opened for modification \??\c:\program files\ExitRestart.odp af4796662d4dca855050c42a69c01096573b9acd3faa550ce55560c1dc9ac31c.exe File opened for modification \??\c:\program files\InitializeConvert.3gpp af4796662d4dca855050c42a69c01096573b9acd3faa550ce55560c1dc9ac31c.exe File opened for modification \??\c:\program files\MountInvoke.jtx af4796662d4dca855050c42a69c01096573b9acd3faa550ce55560c1dc9ac31c.exe File opened for modification \??\c:\program files\OptimizeMeasure.m1v af4796662d4dca855050c42a69c01096573b9acd3faa550ce55560c1dc9ac31c.exe File opened for modification \??\c:\program files\AssertOptimize.rmi af4796662d4dca855050c42a69c01096573b9acd3faa550ce55560c1dc9ac31c.exe File opened for modification \??\c:\program files\ConnectUnlock.xht af4796662d4dca855050c42a69c01096573b9acd3faa550ce55560c1dc9ac31c.exe File opened for modification \??\c:\program files\LimitGrant.vbs af4796662d4dca855050c42a69c01096573b9acd3faa550ce55560c1dc9ac31c.exe File opened for modification \??\c:\program files\DebugMove.avi af4796662d4dca855050c42a69c01096573b9acd3faa550ce55560c1dc9ac31c.exe File opened for modification \??\c:\program files\ExpandCheckpoint.xml af4796662d4dca855050c42a69c01096573b9acd3faa550ce55560c1dc9ac31c.exe File opened for modification \??\c:\program files\SetInstall.dxf af4796662d4dca855050c42a69c01096573b9acd3faa550ce55560c1dc9ac31c.exe File opened for modification \??\c:\program files\TraceSet.3gp2 af4796662d4dca855050c42a69c01096573b9acd3faa550ce55560c1dc9ac31c.exe File opened for modification \??\c:\program files\UnregisterClear.potm af4796662d4dca855050c42a69c01096573b9acd3faa550ce55560c1dc9ac31c.exe File opened for modification \??\c:\program files\AddDisconnect.midi af4796662d4dca855050c42a69c01096573b9acd3faa550ce55560c1dc9ac31c.exe File opened for modification \??\c:\program files\ReadSkip.mid af4796662d4dca855050c42a69c01096573b9acd3faa550ce55560c1dc9ac31c.exe File opened for modification \??\c:\program files\RenameConvertTo.pot af4796662d4dca855050c42a69c01096573b9acd3faa550ce55560c1dc9ac31c.exe File opened for modification \??\c:\program files\WatchEnable.TTS af4796662d4dca855050c42a69c01096573b9acd3faa550ce55560c1dc9ac31c.exe File created \??\c:\program files\sd64av-readme.txt af4796662d4dca855050c42a69c01096573b9acd3faa550ce55560c1dc9ac31c.exe File opened for modification \??\c:\program files\InvokeStep.jpeg af4796662d4dca855050c42a69c01096573b9acd3faa550ce55560c1dc9ac31c.exe File opened for modification \??\c:\program files\LockDisable.dot af4796662d4dca855050c42a69c01096573b9acd3faa550ce55560c1dc9ac31c.exe File opened for modification \??\c:\program files\RestoreNew.aif af4796662d4dca855050c42a69c01096573b9acd3faa550ce55560c1dc9ac31c.exe File opened for modification \??\c:\program files\StepResolve.scf af4796662d4dca855050c42a69c01096573b9acd3faa550ce55560c1dc9ac31c.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
af4796662d4dca855050c42a69c01096573b9acd3faa550ce55560c1dc9ac31c.exepowershell.exepid process 952 af4796662d4dca855050c42a69c01096573b9acd3faa550ce55560c1dc9ac31c.exe 952 af4796662d4dca855050c42a69c01096573b9acd3faa550ce55560c1dc9ac31c.exe 1212 powershell.exe 1212 powershell.exe 1212 powershell.exe 952 af4796662d4dca855050c42a69c01096573b9acd3faa550ce55560c1dc9ac31c.exe 952 af4796662d4dca855050c42a69c01096573b9acd3faa550ce55560c1dc9ac31c.exe 952 af4796662d4dca855050c42a69c01096573b9acd3faa550ce55560c1dc9ac31c.exe 952 af4796662d4dca855050c42a69c01096573b9acd3faa550ce55560c1dc9ac31c.exe 952 af4796662d4dca855050c42a69c01096573b9acd3faa550ce55560c1dc9ac31c.exe 952 af4796662d4dca855050c42a69c01096573b9acd3faa550ce55560c1dc9ac31c.exe 952 af4796662d4dca855050c42a69c01096573b9acd3faa550ce55560c1dc9ac31c.exe 952 af4796662d4dca855050c42a69c01096573b9acd3faa550ce55560c1dc9ac31c.exe 952 af4796662d4dca855050c42a69c01096573b9acd3faa550ce55560c1dc9ac31c.exe 952 af4796662d4dca855050c42a69c01096573b9acd3faa550ce55560c1dc9ac31c.exe 952 af4796662d4dca855050c42a69c01096573b9acd3faa550ce55560c1dc9ac31c.exe 952 af4796662d4dca855050c42a69c01096573b9acd3faa550ce55560c1dc9ac31c.exe 952 af4796662d4dca855050c42a69c01096573b9acd3faa550ce55560c1dc9ac31c.exe 952 af4796662d4dca855050c42a69c01096573b9acd3faa550ce55560c1dc9ac31c.exe 952 af4796662d4dca855050c42a69c01096573b9acd3faa550ce55560c1dc9ac31c.exe 952 af4796662d4dca855050c42a69c01096573b9acd3faa550ce55560c1dc9ac31c.exe 952 af4796662d4dca855050c42a69c01096573b9acd3faa550ce55560c1dc9ac31c.exe 952 af4796662d4dca855050c42a69c01096573b9acd3faa550ce55560c1dc9ac31c.exe 952 af4796662d4dca855050c42a69c01096573b9acd3faa550ce55560c1dc9ac31c.exe 952 af4796662d4dca855050c42a69c01096573b9acd3faa550ce55560c1dc9ac31c.exe 952 af4796662d4dca855050c42a69c01096573b9acd3faa550ce55560c1dc9ac31c.exe 952 af4796662d4dca855050c42a69c01096573b9acd3faa550ce55560c1dc9ac31c.exe 952 af4796662d4dca855050c42a69c01096573b9acd3faa550ce55560c1dc9ac31c.exe 952 af4796662d4dca855050c42a69c01096573b9acd3faa550ce55560c1dc9ac31c.exe 952 af4796662d4dca855050c42a69c01096573b9acd3faa550ce55560c1dc9ac31c.exe 952 af4796662d4dca855050c42a69c01096573b9acd3faa550ce55560c1dc9ac31c.exe 952 af4796662d4dca855050c42a69c01096573b9acd3faa550ce55560c1dc9ac31c.exe 952 af4796662d4dca855050c42a69c01096573b9acd3faa550ce55560c1dc9ac31c.exe 952 af4796662d4dca855050c42a69c01096573b9acd3faa550ce55560c1dc9ac31c.exe 952 af4796662d4dca855050c42a69c01096573b9acd3faa550ce55560c1dc9ac31c.exe 952 af4796662d4dca855050c42a69c01096573b9acd3faa550ce55560c1dc9ac31c.exe 952 af4796662d4dca855050c42a69c01096573b9acd3faa550ce55560c1dc9ac31c.exe 952 af4796662d4dca855050c42a69c01096573b9acd3faa550ce55560c1dc9ac31c.exe 952 af4796662d4dca855050c42a69c01096573b9acd3faa550ce55560c1dc9ac31c.exe 952 af4796662d4dca855050c42a69c01096573b9acd3faa550ce55560c1dc9ac31c.exe 952 af4796662d4dca855050c42a69c01096573b9acd3faa550ce55560c1dc9ac31c.exe 952 af4796662d4dca855050c42a69c01096573b9acd3faa550ce55560c1dc9ac31c.exe 952 af4796662d4dca855050c42a69c01096573b9acd3faa550ce55560c1dc9ac31c.exe 952 af4796662d4dca855050c42a69c01096573b9acd3faa550ce55560c1dc9ac31c.exe 952 af4796662d4dca855050c42a69c01096573b9acd3faa550ce55560c1dc9ac31c.exe 952 af4796662d4dca855050c42a69c01096573b9acd3faa550ce55560c1dc9ac31c.exe 952 af4796662d4dca855050c42a69c01096573b9acd3faa550ce55560c1dc9ac31c.exe 952 af4796662d4dca855050c42a69c01096573b9acd3faa550ce55560c1dc9ac31c.exe 952 af4796662d4dca855050c42a69c01096573b9acd3faa550ce55560c1dc9ac31c.exe 952 af4796662d4dca855050c42a69c01096573b9acd3faa550ce55560c1dc9ac31c.exe 952 af4796662d4dca855050c42a69c01096573b9acd3faa550ce55560c1dc9ac31c.exe 952 af4796662d4dca855050c42a69c01096573b9acd3faa550ce55560c1dc9ac31c.exe 952 af4796662d4dca855050c42a69c01096573b9acd3faa550ce55560c1dc9ac31c.exe 952 af4796662d4dca855050c42a69c01096573b9acd3faa550ce55560c1dc9ac31c.exe 952 af4796662d4dca855050c42a69c01096573b9acd3faa550ce55560c1dc9ac31c.exe 952 af4796662d4dca855050c42a69c01096573b9acd3faa550ce55560c1dc9ac31c.exe 952 af4796662d4dca855050c42a69c01096573b9acd3faa550ce55560c1dc9ac31c.exe 952 af4796662d4dca855050c42a69c01096573b9acd3faa550ce55560c1dc9ac31c.exe 952 af4796662d4dca855050c42a69c01096573b9acd3faa550ce55560c1dc9ac31c.exe 952 af4796662d4dca855050c42a69c01096573b9acd3faa550ce55560c1dc9ac31c.exe 952 af4796662d4dca855050c42a69c01096573b9acd3faa550ce55560c1dc9ac31c.exe 952 af4796662d4dca855050c42a69c01096573b9acd3faa550ce55560c1dc9ac31c.exe 952 af4796662d4dca855050c42a69c01096573b9acd3faa550ce55560c1dc9ac31c.exe 952 af4796662d4dca855050c42a69c01096573b9acd3faa550ce55560c1dc9ac31c.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
Processes:
af4796662d4dca855050c42a69c01096573b9acd3faa550ce55560c1dc9ac31c.exepowershell.exevssvc.exedescription pid process Token: SeDebugPrivilege 952 af4796662d4dca855050c42a69c01096573b9acd3faa550ce55560c1dc9ac31c.exe Token: SeDebugPrivilege 1212 powershell.exe Token: SeBackupPrivilege 1140 vssvc.exe Token: SeRestorePrivilege 1140 vssvc.exe Token: SeAuditPrivilege 1140 vssvc.exe Token: SeTakeOwnershipPrivilege 952 af4796662d4dca855050c42a69c01096573b9acd3faa550ce55560c1dc9ac31c.exe -
Suspicious use of WriteProcessMemory 2 IoCs
Processes:
af4796662d4dca855050c42a69c01096573b9acd3faa550ce55560c1dc9ac31c.exedescription pid process target process PID 952 wrote to memory of 1212 952 af4796662d4dca855050c42a69c01096573b9acd3faa550ce55560c1dc9ac31c.exe powershell.exe PID 952 wrote to memory of 1212 952 af4796662d4dca855050c42a69c01096573b9acd3faa550ce55560c1dc9ac31c.exe powershell.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\af4796662d4dca855050c42a69c01096573b9acd3faa550ce55560c1dc9ac31c.exe"C:\Users\Admin\AppData\Local\Temp\af4796662d4dca855050c42a69c01096573b9acd3faa550ce55560c1dc9ac31c.exe"1⤵
- Adds Run key to start application
- Enumerates connected drives
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -e RwBlAHQALQBXAG0AaQBPAGIAagBlAGMAdAAgAFcAaQBuADMAMgBfAFMAaABhAGQAbwB3AGMAbwBwAHkAIAB8ACAARgBvAHIARQBhAGMAaAAtAE8AYgBqAGUAYwB0ACAAewAkAF8ALgBEAGUAbABlAHQAZQAoACkAOwB9AA==2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\wbem\unsecapp.exeC:\Windows\system32\wbem\unsecapp.exe -Embedding1⤵
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1212-122-0x000001FACCD00000-0x000001FACCD57000-memory.dmpFilesize
348KB
-
memory/1212-124-0x000001FACCD00000-0x000001FACCD57000-memory.dmpFilesize
348KB
-
memory/1212-125-0x000001FAE8BF0000-0x000001FAE8C12000-memory.dmpFilesize
136KB
-
memory/1212-130-0x000001FAE8DA0000-0x000001FAE8E16000-memory.dmpFilesize
472KB