Analysis
-
max time kernel
179s -
max time network
167s -
platform
windows10_x64 -
resource
win10-en-20211208 -
submitted
24-01-2022 01:22
Static task
static1
Behavioral task
behavioral1
Sample
a75cf15bfccf9ba17af264a3d90e14a6f9c2266c6072a735aa10bd5a432055d4.exe
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
a75cf15bfccf9ba17af264a3d90e14a6f9c2266c6072a735aa10bd5a432055d4.exe
Resource
win10-en-20211208
General
-
Target
a75cf15bfccf9ba17af264a3d90e14a6f9c2266c6072a735aa10bd5a432055d4.exe
-
Size
156KB
-
MD5
fb8acbcc610798fbd17b5bad56b0420e
-
SHA1
49f095e928c2293aac7cb21afb43fb629d77318f
-
SHA256
a75cf15bfccf9ba17af264a3d90e14a6f9c2266c6072a735aa10bd5a432055d4
-
SHA512
879fed94f79bca3c25ae292874ae0efe40c40983431a4ef106be3bbe796d32071b16772f6fa184df1c2032daab0f631c7d80a1dd1504df1da5011147f42e9624
Malware Config
Extracted
C:\dpv4p-readme.txt
sodinokibi
http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/284C5114CB211B69
http://decryptor.cc/284C5114CB211B69
Signatures
-
Sodin,Sodinokibi,REvil
Ransomware with advanced anti-analysis and privilege escalation functionality.
-
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
a75cf15bfccf9ba17af264a3d90e14a6f9c2266c6072a735aa10bd5a432055d4.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run a75cf15bfccf9ba17af264a3d90e14a6f9c2266c6072a735aa10bd5a432055d4.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\BV7BRrErOX = "C:\\Users\\Admin\\AppData\\Local\\Temp\\a75cf15bfccf9ba17af264a3d90e14a6f9c2266c6072a735aa10bd5a432055d4.exe" a75cf15bfccf9ba17af264a3d90e14a6f9c2266c6072a735aa10bd5a432055d4.exe -
Enumerates connected drives 3 TTPs 24 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
a75cf15bfccf9ba17af264a3d90e14a6f9c2266c6072a735aa10bd5a432055d4.exedescription ioc process File opened (read-only) \??\T: a75cf15bfccf9ba17af264a3d90e14a6f9c2266c6072a735aa10bd5a432055d4.exe File opened (read-only) \??\V: a75cf15bfccf9ba17af264a3d90e14a6f9c2266c6072a735aa10bd5a432055d4.exe File opened (read-only) \??\A: a75cf15bfccf9ba17af264a3d90e14a6f9c2266c6072a735aa10bd5a432055d4.exe File opened (read-only) \??\H: a75cf15bfccf9ba17af264a3d90e14a6f9c2266c6072a735aa10bd5a432055d4.exe File opened (read-only) \??\J: a75cf15bfccf9ba17af264a3d90e14a6f9c2266c6072a735aa10bd5a432055d4.exe File opened (read-only) \??\M: a75cf15bfccf9ba17af264a3d90e14a6f9c2266c6072a735aa10bd5a432055d4.exe File opened (read-only) \??\Q: a75cf15bfccf9ba17af264a3d90e14a6f9c2266c6072a735aa10bd5a432055d4.exe File opened (read-only) \??\U: a75cf15bfccf9ba17af264a3d90e14a6f9c2266c6072a735aa10bd5a432055d4.exe File opened (read-only) \??\Y: a75cf15bfccf9ba17af264a3d90e14a6f9c2266c6072a735aa10bd5a432055d4.exe File opened (read-only) \??\Z: a75cf15bfccf9ba17af264a3d90e14a6f9c2266c6072a735aa10bd5a432055d4.exe File opened (read-only) \??\B: a75cf15bfccf9ba17af264a3d90e14a6f9c2266c6072a735aa10bd5a432055d4.exe File opened (read-only) \??\E: a75cf15bfccf9ba17af264a3d90e14a6f9c2266c6072a735aa10bd5a432055d4.exe File opened (read-only) \??\F: a75cf15bfccf9ba17af264a3d90e14a6f9c2266c6072a735aa10bd5a432055d4.exe File opened (read-only) \??\I: a75cf15bfccf9ba17af264a3d90e14a6f9c2266c6072a735aa10bd5a432055d4.exe File opened (read-only) \??\K: a75cf15bfccf9ba17af264a3d90e14a6f9c2266c6072a735aa10bd5a432055d4.exe File opened (read-only) \??\L: a75cf15bfccf9ba17af264a3d90e14a6f9c2266c6072a735aa10bd5a432055d4.exe File opened (read-only) \??\O: a75cf15bfccf9ba17af264a3d90e14a6f9c2266c6072a735aa10bd5a432055d4.exe File opened (read-only) \??\P: a75cf15bfccf9ba17af264a3d90e14a6f9c2266c6072a735aa10bd5a432055d4.exe File opened (read-only) \??\S: a75cf15bfccf9ba17af264a3d90e14a6f9c2266c6072a735aa10bd5a432055d4.exe File opened (read-only) \??\G: a75cf15bfccf9ba17af264a3d90e14a6f9c2266c6072a735aa10bd5a432055d4.exe File opened (read-only) \??\N: a75cf15bfccf9ba17af264a3d90e14a6f9c2266c6072a735aa10bd5a432055d4.exe File opened (read-only) \??\R: a75cf15bfccf9ba17af264a3d90e14a6f9c2266c6072a735aa10bd5a432055d4.exe File opened (read-only) \??\W: a75cf15bfccf9ba17af264a3d90e14a6f9c2266c6072a735aa10bd5a432055d4.exe File opened (read-only) \??\X: a75cf15bfccf9ba17af264a3d90e14a6f9c2266c6072a735aa10bd5a432055d4.exe -
Drops file in Program Files directory 33 IoCs
Processes:
a75cf15bfccf9ba17af264a3d90e14a6f9c2266c6072a735aa10bd5a432055d4.exedescription ioc process File opened for modification \??\c:\program files\PublishAdd.vssm a75cf15bfccf9ba17af264a3d90e14a6f9c2266c6072a735aa10bd5a432055d4.exe File opened for modification \??\c:\program files\RemovePing.rm a75cf15bfccf9ba17af264a3d90e14a6f9c2266c6072a735aa10bd5a432055d4.exe File opened for modification \??\c:\program files\ResetMove.xlsb a75cf15bfccf9ba17af264a3d90e14a6f9c2266c6072a735aa10bd5a432055d4.exe File opened for modification \??\c:\program files\RevokeUnprotect.asp a75cf15bfccf9ba17af264a3d90e14a6f9c2266c6072a735aa10bd5a432055d4.exe File opened for modification \??\c:\program files\SearchExpand.mht a75cf15bfccf9ba17af264a3d90e14a6f9c2266c6072a735aa10bd5a432055d4.exe File opened for modification \??\c:\program files\WatchProtect.m4a a75cf15bfccf9ba17af264a3d90e14a6f9c2266c6072a735aa10bd5a432055d4.exe File opened for modification \??\c:\program files\SuspendDismount.xls a75cf15bfccf9ba17af264a3d90e14a6f9c2266c6072a735aa10bd5a432055d4.exe File opened for modification \??\c:\program files\WatchAdd.vsdx a75cf15bfccf9ba17af264a3d90e14a6f9c2266c6072a735aa10bd5a432055d4.exe File opened for modification \??\c:\program files\PingCompare.mp3 a75cf15bfccf9ba17af264a3d90e14a6f9c2266c6072a735aa10bd5a432055d4.exe File opened for modification \??\c:\program files\PingRevoke.png a75cf15bfccf9ba17af264a3d90e14a6f9c2266c6072a735aa10bd5a432055d4.exe File opened for modification \??\c:\program files\ResolveMove.ex_ a75cf15bfccf9ba17af264a3d90e14a6f9c2266c6072a735aa10bd5a432055d4.exe File opened for modification \??\c:\program files\DebugRegister.rar a75cf15bfccf9ba17af264a3d90e14a6f9c2266c6072a735aa10bd5a432055d4.exe File opened for modification \??\c:\program files\DenyRead.tiff a75cf15bfccf9ba17af264a3d90e14a6f9c2266c6072a735aa10bd5a432055d4.exe File opened for modification \??\c:\program files\RequestClear.mp4 a75cf15bfccf9ba17af264a3d90e14a6f9c2266c6072a735aa10bd5a432055d4.exe File opened for modification \??\c:\program files\UnblockUnprotect.dxf a75cf15bfccf9ba17af264a3d90e14a6f9c2266c6072a735aa10bd5a432055d4.exe File opened for modification \??\c:\program files\CopyReset.xlsb a75cf15bfccf9ba17af264a3d90e14a6f9c2266c6072a735aa10bd5a432055d4.exe File opened for modification \??\c:\program files\JoinDebug.xlsx a75cf15bfccf9ba17af264a3d90e14a6f9c2266c6072a735aa10bd5a432055d4.exe File opened for modification \??\c:\program files\UnpublishRepair.potm a75cf15bfccf9ba17af264a3d90e14a6f9c2266c6072a735aa10bd5a432055d4.exe File opened for modification \??\c:\program files\UnprotectRestart.ttf a75cf15bfccf9ba17af264a3d90e14a6f9c2266c6072a735aa10bd5a432055d4.exe File created \??\c:\program files\dpv4p-readme.txt a75cf15bfccf9ba17af264a3d90e14a6f9c2266c6072a735aa10bd5a432055d4.exe File created \??\c:\program files (x86)\dpv4p-readme.txt a75cf15bfccf9ba17af264a3d90e14a6f9c2266c6072a735aa10bd5a432055d4.exe File opened for modification \??\c:\program files\DisconnectClose.cr2 a75cf15bfccf9ba17af264a3d90e14a6f9c2266c6072a735aa10bd5a432055d4.exe File opened for modification \??\c:\program files\OpenDismount.xltx a75cf15bfccf9ba17af264a3d90e14a6f9c2266c6072a735aa10bd5a432055d4.exe File opened for modification \??\c:\program files\ResetDisconnect.pptm a75cf15bfccf9ba17af264a3d90e14a6f9c2266c6072a735aa10bd5a432055d4.exe File opened for modification \??\c:\program files\ResetSwitch.css a75cf15bfccf9ba17af264a3d90e14a6f9c2266c6072a735aa10bd5a432055d4.exe File opened for modification \??\c:\program files\SyncCheckpoint.ADTS a75cf15bfccf9ba17af264a3d90e14a6f9c2266c6072a735aa10bd5a432055d4.exe File opened for modification \??\c:\program files\RequestCompare.otf a75cf15bfccf9ba17af264a3d90e14a6f9c2266c6072a735aa10bd5a432055d4.exe File opened for modification \??\c:\program files\ResolveReceive.ppsm a75cf15bfccf9ba17af264a3d90e14a6f9c2266c6072a735aa10bd5a432055d4.exe File opened for modification \??\c:\program files\UninstallPing.TS a75cf15bfccf9ba17af264a3d90e14a6f9c2266c6072a735aa10bd5a432055d4.exe File opened for modification \??\c:\program files\WatchApprove.ps1xml a75cf15bfccf9ba17af264a3d90e14a6f9c2266c6072a735aa10bd5a432055d4.exe File opened for modification \??\c:\program files\WriteRedo.xla a75cf15bfccf9ba17af264a3d90e14a6f9c2266c6072a735aa10bd5a432055d4.exe File opened for modification \??\c:\program files\ResolveResume.txt a75cf15bfccf9ba17af264a3d90e14a6f9c2266c6072a735aa10bd5a432055d4.exe File opened for modification \??\c:\program files\SendWait.WTV a75cf15bfccf9ba17af264a3d90e14a6f9c2266c6072a735aa10bd5a432055d4.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
a75cf15bfccf9ba17af264a3d90e14a6f9c2266c6072a735aa10bd5a432055d4.exepowershell.exepid process 3312 a75cf15bfccf9ba17af264a3d90e14a6f9c2266c6072a735aa10bd5a432055d4.exe 3312 a75cf15bfccf9ba17af264a3d90e14a6f9c2266c6072a735aa10bd5a432055d4.exe 4544 powershell.exe 4544 powershell.exe 4544 powershell.exe 3312 a75cf15bfccf9ba17af264a3d90e14a6f9c2266c6072a735aa10bd5a432055d4.exe 3312 a75cf15bfccf9ba17af264a3d90e14a6f9c2266c6072a735aa10bd5a432055d4.exe 3312 a75cf15bfccf9ba17af264a3d90e14a6f9c2266c6072a735aa10bd5a432055d4.exe 3312 a75cf15bfccf9ba17af264a3d90e14a6f9c2266c6072a735aa10bd5a432055d4.exe 3312 a75cf15bfccf9ba17af264a3d90e14a6f9c2266c6072a735aa10bd5a432055d4.exe 3312 a75cf15bfccf9ba17af264a3d90e14a6f9c2266c6072a735aa10bd5a432055d4.exe 3312 a75cf15bfccf9ba17af264a3d90e14a6f9c2266c6072a735aa10bd5a432055d4.exe 3312 a75cf15bfccf9ba17af264a3d90e14a6f9c2266c6072a735aa10bd5a432055d4.exe 3312 a75cf15bfccf9ba17af264a3d90e14a6f9c2266c6072a735aa10bd5a432055d4.exe 3312 a75cf15bfccf9ba17af264a3d90e14a6f9c2266c6072a735aa10bd5a432055d4.exe 3312 a75cf15bfccf9ba17af264a3d90e14a6f9c2266c6072a735aa10bd5a432055d4.exe 3312 a75cf15bfccf9ba17af264a3d90e14a6f9c2266c6072a735aa10bd5a432055d4.exe 3312 a75cf15bfccf9ba17af264a3d90e14a6f9c2266c6072a735aa10bd5a432055d4.exe 3312 a75cf15bfccf9ba17af264a3d90e14a6f9c2266c6072a735aa10bd5a432055d4.exe 3312 a75cf15bfccf9ba17af264a3d90e14a6f9c2266c6072a735aa10bd5a432055d4.exe 3312 a75cf15bfccf9ba17af264a3d90e14a6f9c2266c6072a735aa10bd5a432055d4.exe 3312 a75cf15bfccf9ba17af264a3d90e14a6f9c2266c6072a735aa10bd5a432055d4.exe 3312 a75cf15bfccf9ba17af264a3d90e14a6f9c2266c6072a735aa10bd5a432055d4.exe 3312 a75cf15bfccf9ba17af264a3d90e14a6f9c2266c6072a735aa10bd5a432055d4.exe 3312 a75cf15bfccf9ba17af264a3d90e14a6f9c2266c6072a735aa10bd5a432055d4.exe 3312 a75cf15bfccf9ba17af264a3d90e14a6f9c2266c6072a735aa10bd5a432055d4.exe 3312 a75cf15bfccf9ba17af264a3d90e14a6f9c2266c6072a735aa10bd5a432055d4.exe 3312 a75cf15bfccf9ba17af264a3d90e14a6f9c2266c6072a735aa10bd5a432055d4.exe 3312 a75cf15bfccf9ba17af264a3d90e14a6f9c2266c6072a735aa10bd5a432055d4.exe 3312 a75cf15bfccf9ba17af264a3d90e14a6f9c2266c6072a735aa10bd5a432055d4.exe 3312 a75cf15bfccf9ba17af264a3d90e14a6f9c2266c6072a735aa10bd5a432055d4.exe 3312 a75cf15bfccf9ba17af264a3d90e14a6f9c2266c6072a735aa10bd5a432055d4.exe 3312 a75cf15bfccf9ba17af264a3d90e14a6f9c2266c6072a735aa10bd5a432055d4.exe 3312 a75cf15bfccf9ba17af264a3d90e14a6f9c2266c6072a735aa10bd5a432055d4.exe 3312 a75cf15bfccf9ba17af264a3d90e14a6f9c2266c6072a735aa10bd5a432055d4.exe 3312 a75cf15bfccf9ba17af264a3d90e14a6f9c2266c6072a735aa10bd5a432055d4.exe 3312 a75cf15bfccf9ba17af264a3d90e14a6f9c2266c6072a735aa10bd5a432055d4.exe 3312 a75cf15bfccf9ba17af264a3d90e14a6f9c2266c6072a735aa10bd5a432055d4.exe 3312 a75cf15bfccf9ba17af264a3d90e14a6f9c2266c6072a735aa10bd5a432055d4.exe 3312 a75cf15bfccf9ba17af264a3d90e14a6f9c2266c6072a735aa10bd5a432055d4.exe 3312 a75cf15bfccf9ba17af264a3d90e14a6f9c2266c6072a735aa10bd5a432055d4.exe 3312 a75cf15bfccf9ba17af264a3d90e14a6f9c2266c6072a735aa10bd5a432055d4.exe 3312 a75cf15bfccf9ba17af264a3d90e14a6f9c2266c6072a735aa10bd5a432055d4.exe 3312 a75cf15bfccf9ba17af264a3d90e14a6f9c2266c6072a735aa10bd5a432055d4.exe 3312 a75cf15bfccf9ba17af264a3d90e14a6f9c2266c6072a735aa10bd5a432055d4.exe 3312 a75cf15bfccf9ba17af264a3d90e14a6f9c2266c6072a735aa10bd5a432055d4.exe 3312 a75cf15bfccf9ba17af264a3d90e14a6f9c2266c6072a735aa10bd5a432055d4.exe 3312 a75cf15bfccf9ba17af264a3d90e14a6f9c2266c6072a735aa10bd5a432055d4.exe 3312 a75cf15bfccf9ba17af264a3d90e14a6f9c2266c6072a735aa10bd5a432055d4.exe 3312 a75cf15bfccf9ba17af264a3d90e14a6f9c2266c6072a735aa10bd5a432055d4.exe 3312 a75cf15bfccf9ba17af264a3d90e14a6f9c2266c6072a735aa10bd5a432055d4.exe 3312 a75cf15bfccf9ba17af264a3d90e14a6f9c2266c6072a735aa10bd5a432055d4.exe 3312 a75cf15bfccf9ba17af264a3d90e14a6f9c2266c6072a735aa10bd5a432055d4.exe 3312 a75cf15bfccf9ba17af264a3d90e14a6f9c2266c6072a735aa10bd5a432055d4.exe 3312 a75cf15bfccf9ba17af264a3d90e14a6f9c2266c6072a735aa10bd5a432055d4.exe 3312 a75cf15bfccf9ba17af264a3d90e14a6f9c2266c6072a735aa10bd5a432055d4.exe 3312 a75cf15bfccf9ba17af264a3d90e14a6f9c2266c6072a735aa10bd5a432055d4.exe 3312 a75cf15bfccf9ba17af264a3d90e14a6f9c2266c6072a735aa10bd5a432055d4.exe 3312 a75cf15bfccf9ba17af264a3d90e14a6f9c2266c6072a735aa10bd5a432055d4.exe 3312 a75cf15bfccf9ba17af264a3d90e14a6f9c2266c6072a735aa10bd5a432055d4.exe 3312 a75cf15bfccf9ba17af264a3d90e14a6f9c2266c6072a735aa10bd5a432055d4.exe 3312 a75cf15bfccf9ba17af264a3d90e14a6f9c2266c6072a735aa10bd5a432055d4.exe 3312 a75cf15bfccf9ba17af264a3d90e14a6f9c2266c6072a735aa10bd5a432055d4.exe 3312 a75cf15bfccf9ba17af264a3d90e14a6f9c2266c6072a735aa10bd5a432055d4.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
Processes:
a75cf15bfccf9ba17af264a3d90e14a6f9c2266c6072a735aa10bd5a432055d4.exepowershell.exevssvc.exedescription pid process Token: SeDebugPrivilege 3312 a75cf15bfccf9ba17af264a3d90e14a6f9c2266c6072a735aa10bd5a432055d4.exe Token: SeDebugPrivilege 4544 powershell.exe Token: SeBackupPrivilege 1256 vssvc.exe Token: SeRestorePrivilege 1256 vssvc.exe Token: SeAuditPrivilege 1256 vssvc.exe Token: SeTakeOwnershipPrivilege 3312 a75cf15bfccf9ba17af264a3d90e14a6f9c2266c6072a735aa10bd5a432055d4.exe -
Suspicious use of WriteProcessMemory 2 IoCs
Processes:
a75cf15bfccf9ba17af264a3d90e14a6f9c2266c6072a735aa10bd5a432055d4.exedescription pid process target process PID 3312 wrote to memory of 4544 3312 a75cf15bfccf9ba17af264a3d90e14a6f9c2266c6072a735aa10bd5a432055d4.exe powershell.exe PID 3312 wrote to memory of 4544 3312 a75cf15bfccf9ba17af264a3d90e14a6f9c2266c6072a735aa10bd5a432055d4.exe powershell.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\a75cf15bfccf9ba17af264a3d90e14a6f9c2266c6072a735aa10bd5a432055d4.exe"C:\Users\Admin\AppData\Local\Temp\a75cf15bfccf9ba17af264a3d90e14a6f9c2266c6072a735aa10bd5a432055d4.exe"1⤵
- Adds Run key to start application
- Enumerates connected drives
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -e RwBlAHQALQBXAG0AaQBPAGIAagBlAGMAdAAgAFcAaQBuADMAMgBfAFMAaABhAGQAbwB3AGMAbwBwAHkAIAB8ACAARgBvAHIARQBhAGMAaAAtAE8AYgBqAGUAYwB0ACAAewAkAF8ALgBEAGUAbABlAHQAZQAoACkAOwB9AA==2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\wbem\unsecapp.exeC:\Windows\system32\wbem\unsecapp.exe -Embedding1⤵
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/4544-124-0x000001C6AD8B0000-0x000001C6AD8D2000-memory.dmpFilesize
136KB
-
memory/4544-130-0x000001C6AD8E0000-0x000001C6AD956000-memory.dmpFilesize
472KB
-
memory/4544-137-0x000001C695790000-0x000001C6AD980000-memory.dmpFilesize
385.9MB
-
memory/4544-138-0x000001C695790000-0x000001C6AD980000-memory.dmpFilesize
385.9MB
-
memory/4544-144-0x000001C695790000-0x000001C6AD980000-memory.dmpFilesize
385.9MB