Analysis
-
max time kernel
169s -
max time network
168s -
platform
windows10_x64 -
resource
win10-en-20211208 -
submitted
24-01-2022 01:26
Static task
static1
Behavioral task
behavioral1
Sample
a28e23ad4033341694551d6f59737138de9f1997384da5ae9a1642cc8c9e237f.exe
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
a28e23ad4033341694551d6f59737138de9f1997384da5ae9a1642cc8c9e237f.exe
Resource
win10-en-20211208
General
-
Target
a28e23ad4033341694551d6f59737138de9f1997384da5ae9a1642cc8c9e237f.exe
-
Size
116KB
-
MD5
2894ecbd12a791cbf7404febb43b5f4e
-
SHA1
8ed5327cf869893d6099df145c49aec08c86faa6
-
SHA256
a28e23ad4033341694551d6f59737138de9f1997384da5ae9a1642cc8c9e237f
-
SHA512
8b7a9ab31b4ff2f37d772308db28717947624d172b5b23e9979623e3cf03fa109480f83aa9243fa9ecf7d2fb7a7cc4deb5899b5f462d0c911bee3dab3e4b6115
Malware Config
Extracted
C:\oeyq480-readme.txt
sodinokibi
http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/01DF7CB2D6981761
http://decryptor.cc/01DF7CB2D6981761
Signatures
-
Sodin,Sodinokibi,REvil
Ransomware with advanced anti-analysis and privilege escalation functionality.
-
Modifies Installed Components in the registry 2 TTPs
-
Modifies extensions of user files 5 IoCs
Ransomware generally changes the extension on encrypted files.
Processes:
a28e23ad4033341694551d6f59737138de9f1997384da5ae9a1642cc8c9e237f.exedescription ioc process File renamed C:\Users\Admin\Pictures\ApproveConvertFrom.tiff => \??\c:\users\admin\pictures\ApproveConvertFrom.tiff.oeyq480 a28e23ad4033341694551d6f59737138de9f1997384da5ae9a1642cc8c9e237f.exe File renamed C:\Users\Admin\Pictures\DenyReset.tif => \??\c:\users\admin\pictures\DenyReset.tif.oeyq480 a28e23ad4033341694551d6f59737138de9f1997384da5ae9a1642cc8c9e237f.exe File renamed C:\Users\Admin\Pictures\ConvertGroup.tif => \??\c:\users\admin\pictures\ConvertGroup.tif.oeyq480 a28e23ad4033341694551d6f59737138de9f1997384da5ae9a1642cc8c9e237f.exe File renamed C:\Users\Admin\Pictures\WriteMeasure.raw => \??\c:\users\admin\pictures\WriteMeasure.raw.oeyq480 a28e23ad4033341694551d6f59737138de9f1997384da5ae9a1642cc8c9e237f.exe File opened for modification \??\c:\users\admin\pictures\ApproveConvertFrom.tiff a28e23ad4033341694551d6f59737138de9f1997384da5ae9a1642cc8c9e237f.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
a28e23ad4033341694551d6f59737138de9f1997384da5ae9a1642cc8c9e237f.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run a28e23ad4033341694551d6f59737138de9f1997384da5ae9a1642cc8c9e237f.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Z5egGonjst = "C:\\Users\\Admin\\AppData\\Local\\Temp\\a28e23ad4033341694551d6f59737138de9f1997384da5ae9a1642cc8c9e237f.exe" a28e23ad4033341694551d6f59737138de9f1997384da5ae9a1642cc8c9e237f.exe -
Drops desktop.ini file(s) 35 IoCs
Processes:
a28e23ad4033341694551d6f59737138de9f1997384da5ae9a1642cc8c9e237f.exedescription ioc process File opened for modification \??\c:\users\public\accountpictures\desktop.ini a28e23ad4033341694551d6f59737138de9f1997384da5ae9a1642cc8c9e237f.exe File opened for modification \??\c:\users\public\libraries\desktop.ini a28e23ad4033341694551d6f59737138de9f1997384da5ae9a1642cc8c9e237f.exe File opened for modification \??\c:\users\admin\favorites\links\desktop.ini a28e23ad4033341694551d6f59737138de9f1997384da5ae9a1642cc8c9e237f.exe File opened for modification \??\c:\users\public\desktop.ini a28e23ad4033341694551d6f59737138de9f1997384da5ae9a1642cc8c9e237f.exe File opened for modification \??\c:\users\admin\documents\desktop.ini a28e23ad4033341694551d6f59737138de9f1997384da5ae9a1642cc8c9e237f.exe File opened for modification \??\c:\users\admin\onedrive\desktop.ini a28e23ad4033341694551d6f59737138de9f1997384da5ae9a1642cc8c9e237f.exe File opened for modification \??\c:\users\admin\pictures\desktop.ini a28e23ad4033341694551d6f59737138de9f1997384da5ae9a1642cc8c9e237f.exe File opened for modification \??\c:\users\admin\favorites\desktop.ini a28e23ad4033341694551d6f59737138de9f1997384da5ae9a1642cc8c9e237f.exe File opened for modification \??\c:\users\admin\saved games\desktop.ini a28e23ad4033341694551d6f59737138de9f1997384da5ae9a1642cc8c9e237f.exe File opened for modification \??\c:\users\public\videos\desktop.ini a28e23ad4033341694551d6f59737138de9f1997384da5ae9a1642cc8c9e237f.exe File opened for modification \??\c:\programdata\microsoft\windows\start menu\programs\startup\desktop.ini a28e23ad4033341694551d6f59737138de9f1997384da5ae9a1642cc8c9e237f.exe File opened for modification \??\c:\programdata\microsoft\windows\start menu\desktop.ini a28e23ad4033341694551d6f59737138de9f1997384da5ae9a1642cc8c9e237f.exe File opened for modification \??\c:\users\admin\pictures\saved pictures\desktop.ini a28e23ad4033341694551d6f59737138de9f1997384da5ae9a1642cc8c9e237f.exe File opened for modification \??\c:\programdata\microsoft\windows\start menu\programs\accessories\desktop.ini a28e23ad4033341694551d6f59737138de9f1997384da5ae9a1642cc8c9e237f.exe File opened for modification \??\c:\program files (x86)\desktop.ini a28e23ad4033341694551d6f59737138de9f1997384da5ae9a1642cc8c9e237f.exe File opened for modification \??\c:\users\admin\downloads\desktop.ini a28e23ad4033341694551d6f59737138de9f1997384da5ae9a1642cc8c9e237f.exe File opened for modification \??\c:\users\public\desktop\desktop.ini a28e23ad4033341694551d6f59737138de9f1997384da5ae9a1642cc8c9e237f.exe File opened for modification \??\c:\users\public\pictures\desktop.ini a28e23ad4033341694551d6f59737138de9f1997384da5ae9a1642cc8c9e237f.exe File opened for modification \??\c:\users\public\downloads\desktop.ini a28e23ad4033341694551d6f59737138de9f1997384da5ae9a1642cc8c9e237f.exe File opened for modification \??\c:\users\public\music\desktop.ini a28e23ad4033341694551d6f59737138de9f1997384da5ae9a1642cc8c9e237f.exe File opened for modification \??\c:\programdata\microsoft\windows\start menu\programs\system tools\Desktop.ini a28e23ad4033341694551d6f59737138de9f1997384da5ae9a1642cc8c9e237f.exe File opened for modification \??\c:\users\admin\contacts\desktop.ini a28e23ad4033341694551d6f59737138de9f1997384da5ae9a1642cc8c9e237f.exe File opened for modification \??\c:\users\admin\music\desktop.ini a28e23ad4033341694551d6f59737138de9f1997384da5ae9a1642cc8c9e237f.exe File opened for modification \??\c:\users\admin\videos\desktop.ini a28e23ad4033341694551d6f59737138de9f1997384da5ae9a1642cc8c9e237f.exe File opened for modification \??\c:\users\public\documents\desktop.ini a28e23ad4033341694551d6f59737138de9f1997384da5ae9a1642cc8c9e237f.exe File opened for modification \??\c:\users\admin\desktop\desktop.ini a28e23ad4033341694551d6f59737138de9f1997384da5ae9a1642cc8c9e237f.exe File opened for modification \??\c:\programdata\microsoft\windows\start menu places\desktop.ini a28e23ad4033341694551d6f59737138de9f1997384da5ae9a1642cc8c9e237f.exe File opened for modification \??\c:\programdata\microsoft\windows\start menu\programs\accessibility\Desktop.ini a28e23ad4033341694551d6f59737138de9f1997384da5ae9a1642cc8c9e237f.exe File opened for modification \??\c:\programdata\microsoft\windows\start menu\programs\administrative tools\desktop.ini a28e23ad4033341694551d6f59737138de9f1997384da5ae9a1642cc8c9e237f.exe File opened for modification \??\c:\users\admin\links\desktop.ini a28e23ad4033341694551d6f59737138de9f1997384da5ae9a1642cc8c9e237f.exe File opened for modification \??\c:\users\admin\searches\desktop.ini a28e23ad4033341694551d6f59737138de9f1997384da5ae9a1642cc8c9e237f.exe File opened for modification \??\c:\programdata\microsoft\windows\start menu\programs\maintenance\Desktop.ini a28e23ad4033341694551d6f59737138de9f1997384da5ae9a1642cc8c9e237f.exe File opened for modification \??\c:\program files\desktop.ini a28e23ad4033341694551d6f59737138de9f1997384da5ae9a1642cc8c9e237f.exe File opened for modification \??\c:\users\admin\pictures\camera roll\desktop.ini a28e23ad4033341694551d6f59737138de9f1997384da5ae9a1642cc8c9e237f.exe File opened for modification \??\c:\programdata\microsoft\windows\start menu\programs\desktop.ini a28e23ad4033341694551d6f59737138de9f1997384da5ae9a1642cc8c9e237f.exe -
Enumerates connected drives 3 TTPs 24 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
a28e23ad4033341694551d6f59737138de9f1997384da5ae9a1642cc8c9e237f.exedescription ioc process File opened (read-only) \??\Z: a28e23ad4033341694551d6f59737138de9f1997384da5ae9a1642cc8c9e237f.exe File opened (read-only) \??\J: a28e23ad4033341694551d6f59737138de9f1997384da5ae9a1642cc8c9e237f.exe File opened (read-only) \??\K: a28e23ad4033341694551d6f59737138de9f1997384da5ae9a1642cc8c9e237f.exe File opened (read-only) \??\M: a28e23ad4033341694551d6f59737138de9f1997384da5ae9a1642cc8c9e237f.exe File opened (read-only) \??\Q: a28e23ad4033341694551d6f59737138de9f1997384da5ae9a1642cc8c9e237f.exe File opened (read-only) \??\R: a28e23ad4033341694551d6f59737138de9f1997384da5ae9a1642cc8c9e237f.exe File opened (read-only) \??\S: a28e23ad4033341694551d6f59737138de9f1997384da5ae9a1642cc8c9e237f.exe File opened (read-only) \??\H: a28e23ad4033341694551d6f59737138de9f1997384da5ae9a1642cc8c9e237f.exe File opened (read-only) \??\L: a28e23ad4033341694551d6f59737138de9f1997384da5ae9a1642cc8c9e237f.exe File opened (read-only) \??\O: a28e23ad4033341694551d6f59737138de9f1997384da5ae9a1642cc8c9e237f.exe File opened (read-only) \??\P: a28e23ad4033341694551d6f59737138de9f1997384da5ae9a1642cc8c9e237f.exe File opened (read-only) \??\V: a28e23ad4033341694551d6f59737138de9f1997384da5ae9a1642cc8c9e237f.exe File opened (read-only) \??\U: a28e23ad4033341694551d6f59737138de9f1997384da5ae9a1642cc8c9e237f.exe File opened (read-only) \??\A: a28e23ad4033341694551d6f59737138de9f1997384da5ae9a1642cc8c9e237f.exe File opened (read-only) \??\B: a28e23ad4033341694551d6f59737138de9f1997384da5ae9a1642cc8c9e237f.exe File opened (read-only) \??\E: a28e23ad4033341694551d6f59737138de9f1997384da5ae9a1642cc8c9e237f.exe File opened (read-only) \??\F: a28e23ad4033341694551d6f59737138de9f1997384da5ae9a1642cc8c9e237f.exe File opened (read-only) \??\G: a28e23ad4033341694551d6f59737138de9f1997384da5ae9a1642cc8c9e237f.exe File opened (read-only) \??\N: a28e23ad4033341694551d6f59737138de9f1997384da5ae9a1642cc8c9e237f.exe File opened (read-only) \??\I: a28e23ad4033341694551d6f59737138de9f1997384da5ae9a1642cc8c9e237f.exe File opened (read-only) \??\T: a28e23ad4033341694551d6f59737138de9f1997384da5ae9a1642cc8c9e237f.exe File opened (read-only) \??\W: a28e23ad4033341694551d6f59737138de9f1997384da5ae9a1642cc8c9e237f.exe File opened (read-only) \??\X: a28e23ad4033341694551d6f59737138de9f1997384da5ae9a1642cc8c9e237f.exe File opened (read-only) \??\Y: a28e23ad4033341694551d6f59737138de9f1997384da5ae9a1642cc8c9e237f.exe -
Drops file in Program Files directory 14 IoCs
Processes:
a28e23ad4033341694551d6f59737138de9f1997384da5ae9a1642cc8c9e237f.exedescription ioc process File opened for modification \??\c:\program files\ClearExpand.i64 a28e23ad4033341694551d6f59737138de9f1997384da5ae9a1642cc8c9e237f.exe File opened for modification \??\c:\program files\GroupConvertFrom.xml a28e23ad4033341694551d6f59737138de9f1997384da5ae9a1642cc8c9e237f.exe File opened for modification \??\c:\program files\UnblockRegister.docx a28e23ad4033341694551d6f59737138de9f1997384da5ae9a1642cc8c9e237f.exe File created \??\c:\program files (x86)\oeyq480-readme.txt a28e23ad4033341694551d6f59737138de9f1997384da5ae9a1642cc8c9e237f.exe File opened for modification \??\c:\program files\EnablePing.temp a28e23ad4033341694551d6f59737138de9f1997384da5ae9a1642cc8c9e237f.exe File opened for modification \??\c:\program files\HideResize.nfo a28e23ad4033341694551d6f59737138de9f1997384da5ae9a1642cc8c9e237f.exe File opened for modification \??\c:\program files\RepairWrite.jpg a28e23ad4033341694551d6f59737138de9f1997384da5ae9a1642cc8c9e237f.exe File opened for modification \??\c:\program files\MeasureSet.raw a28e23ad4033341694551d6f59737138de9f1997384da5ae9a1642cc8c9e237f.exe File created \??\c:\program files\oeyq480-readme.txt a28e23ad4033341694551d6f59737138de9f1997384da5ae9a1642cc8c9e237f.exe File opened for modification \??\c:\program files\ClearFind.dxf a28e23ad4033341694551d6f59737138de9f1997384da5ae9a1642cc8c9e237f.exe File opened for modification \??\c:\program files\desktop.ini a28e23ad4033341694551d6f59737138de9f1997384da5ae9a1642cc8c9e237f.exe File opened for modification \??\c:\program files\InitializeEdit.TTS a28e23ad4033341694551d6f59737138de9f1997384da5ae9a1642cc8c9e237f.exe File opened for modification \??\c:\program files\UnblockResume.rar a28e23ad4033341694551d6f59737138de9f1997384da5ae9a1642cc8c9e237f.exe File opened for modification \??\c:\program files (x86)\desktop.ini a28e23ad4033341694551d6f59737138de9f1997384da5ae9a1642cc8c9e237f.exe -
Drops file in Windows directory 1 IoCs
Processes:
explorer.exedescription ioc process File created C:\Windows\rescache\_merged\2717123927\1253081315.pri explorer.exe -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 2408 3040 WerFault.exe -
Modifies registry class 6 IoCs
Processes:
explorer.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance explorer.exe Key created \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000_Classes\Local Settings explorer.exe Key created \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell explorer.exe Key created \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02 explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff explorer.exe -
Suspicious behavior: EnumeratesProcesses 17 IoCs
Processes:
a28e23ad4033341694551d6f59737138de9f1997384da5ae9a1642cc8c9e237f.exepowershell.exeWerFault.exepid process 1352 a28e23ad4033341694551d6f59737138de9f1997384da5ae9a1642cc8c9e237f.exe 1352 a28e23ad4033341694551d6f59737138de9f1997384da5ae9a1642cc8c9e237f.exe 1268 powershell.exe 1268 powershell.exe 1268 powershell.exe 2408 WerFault.exe 2408 WerFault.exe 2408 WerFault.exe 2408 WerFault.exe 2408 WerFault.exe 2408 WerFault.exe 2408 WerFault.exe 2408 WerFault.exe 2408 WerFault.exe 2408 WerFault.exe 2408 WerFault.exe 2408 WerFault.exe -
Suspicious use of AdjustPrivilegeToken 17 IoCs
Processes:
a28e23ad4033341694551d6f59737138de9f1997384da5ae9a1642cc8c9e237f.exepowershell.exevssvc.exeWerFault.exeexplorer.exedescription pid process Token: SeDebugPrivilege 1352 a28e23ad4033341694551d6f59737138de9f1997384da5ae9a1642cc8c9e237f.exe Token: SeDebugPrivilege 1268 powershell.exe Token: SeBackupPrivilege 816 vssvc.exe Token: SeRestorePrivilege 816 vssvc.exe Token: SeAuditPrivilege 816 vssvc.exe Token: SeTakeOwnershipPrivilege 1352 a28e23ad4033341694551d6f59737138de9f1997384da5ae9a1642cc8c9e237f.exe Token: SeDebugPrivilege 2408 WerFault.exe Token: SeShutdownPrivilege 300 explorer.exe Token: SeCreatePagefilePrivilege 300 explorer.exe Token: SeShutdownPrivilege 300 explorer.exe Token: SeCreatePagefilePrivilege 300 explorer.exe Token: SeShutdownPrivilege 300 explorer.exe Token: SeCreatePagefilePrivilege 300 explorer.exe Token: SeShutdownPrivilege 300 explorer.exe Token: SeCreatePagefilePrivilege 300 explorer.exe Token: SeShutdownPrivilege 300 explorer.exe Token: SeCreatePagefilePrivilege 300 explorer.exe -
Suspicious use of FindShellTrayWindow 5 IoCs
Processes:
explorer.exepid process 300 explorer.exe 300 explorer.exe 300 explorer.exe 300 explorer.exe 300 explorer.exe -
Suspicious use of SendNotifyMessage 9 IoCs
Processes:
explorer.exepid process 300 explorer.exe 300 explorer.exe 300 explorer.exe 300 explorer.exe 300 explorer.exe 300 explorer.exe 300 explorer.exe 300 explorer.exe 300 explorer.exe -
Suspicious use of WriteProcessMemory 2 IoCs
Processes:
a28e23ad4033341694551d6f59737138de9f1997384da5ae9a1642cc8c9e237f.exedescription pid process target process PID 1352 wrote to memory of 1268 1352 a28e23ad4033341694551d6f59737138de9f1997384da5ae9a1642cc8c9e237f.exe powershell.exe PID 1352 wrote to memory of 1268 1352 a28e23ad4033341694551d6f59737138de9f1997384da5ae9a1642cc8c9e237f.exe powershell.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\a28e23ad4033341694551d6f59737138de9f1997384da5ae9a1642cc8c9e237f.exe"C:\Users\Admin\AppData\Local\Temp\a28e23ad4033341694551d6f59737138de9f1997384da5ae9a1642cc8c9e237f.exe"1⤵
- Modifies extensions of user files
- Adds Run key to start application
- Drops desktop.ini file(s)
- Enumerates connected drives
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1352 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -e RwBlAHQALQBXAG0AaQBPAGIAagBlAGMAdAAgAFcAaQBuADMAMgBfAFMAaABhAGQAbwB3AGMAbwBwAHkAIAB8ACAARgBvAHIARQBhAGMAaAAtAE8AYgBqAGUAYwB0ACAAewAkAF8ALgBEAGUAbABlAHQAZQAoACkAOwB9AA==2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1268
-
C:\Windows\system32\wbem\unsecapp.exeC:\Windows\system32\wbem\unsecapp.exe -Embedding1⤵PID:2420
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:816
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 3040 -s 69241⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2408
-
C:\Windows\explorer.exeexplorer.exe1⤵
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:300
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\ProgramData\Microsoft\Windows\Caches\{6AF0698E-D558-4F6E-9B3C-3716689AF493}.2.ver0x0000000000000001.db.oeyq480MD5
03e41e561f637351e0a9cdb71e55fcaa
SHA1c567f108dd787b91c473217cf7ebb42b0b415078
SHA2562f2acc75e217432d44e4c2ef910b43c9aed1e61db238ffe1c0e038ea67742498
SHA512f8d27c2f3265338f837492f95adc59e237898277110e493e7bd53d5a10cef510975ef6dca7b75e1d3f5f34899f824f4593067cd25a1b13c16f8f5ebb9f617294
-
C:\ProgramData\Microsoft\Windows\Caches\{DDF571F2-BE98-426D-8288-1A9A39C3FDA2}.2.ver0x0000000000000001.db.oeyq480MD5
7e5ee4e6d6e1a9a317454dcb8366e202
SHA163f13e6313d162649077cf5eebc4a3183011724e
SHA256ca1b136c9b6971c1579bc9876c9b4b144663856d7ecc98bf5affbf6d0cbbf4c2
SHA512a4dc5b365f5794107ad52f4073c37e6c07653e91d7b40260f9a11864029ef3a98a71858621167677c55766cecc20b32a0c542845e548c2db11039e9152360019
-
memory/1268-122-0x000001DFA9620000-0x000001DFA9642000-memory.dmpFilesize
136KB
-
memory/1268-125-0x000001DFC19A0000-0x000001DFC1A16000-memory.dmpFilesize
472KB
-
memory/1268-137-0x000001DFA9680000-0x000001DFC1820000-memory.dmpFilesize
385.6MB