Analysis
-
max time kernel
168s -
max time network
184s -
platform
windows10_x64 -
resource
win10-en-20211208 -
submitted
24-01-2022 01:52
General
-
Target
6cff57ed233dd9083464ccc23c0a59df300c8a0aece0d3651e5c9e7984c937fd.exe
-
Size
115KB
-
MD5
da50c8e2aeeecc39e8ae49cef8271733
-
SHA1
768d0597775446938114e0b5f1ad74b7c51b2a5b
-
SHA256
6cff57ed233dd9083464ccc23c0a59df300c8a0aece0d3651e5c9e7984c937fd
-
SHA512
adf77baf9095cd1be5a9a2639978e9b1150485d08c09d8146645930528e552bb1329467cc4e70901c17faee0b734b849d5ef83feb0da760ef7d636d75e1c4786
Malware Config
Extracted
C:\6u028f6-readme.txt
sodinokibi
http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/C33A1DF3229395B9
http://decryptor.cc/C33A1DF3229395B9
Signatures
-
Sodin,Sodinokibi,REvil
Ransomware with advanced anti-analysis and privilege escalation functionality.
-
Modifies Installed Components in the registry 2 TTPs
-
Modifies extensions of user files 15 IoCs
Ransomware generally changes the extension on encrypted files.
-
Drops startup file 3 IoCs
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 2 IoCs
-
Drops desktop.ini file(s) 64 IoCs
-
Enumerates connected drives 3 TTPs 27 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
-
Sets desktop wallpaper using registry 2 TTPs 1 IoCs
-
Drops file in Program Files directory 16 IoCs
-
Drops file in Windows directory 7 IoCs
-
Program crash 2 IoCs
-
Checks SCSI registry key(s) 3 TTPs 24 IoCs
SCSI information is often read in order to detect sandboxing environments.
-
Enumerates system info in registry 2 TTPs 2 IoCs
-
Modifies registry class 40 IoCs
-
Suspicious behavior: EnumeratesProcesses 26 IoCs
-
Suspicious use of AdjustPrivilegeToken 64 IoCs
-
Suspicious use of FindShellTrayWindow 64 IoCs
-
Suspicious use of SendNotifyMessage 54 IoCs
-
Suspicious use of SetWindowsHookEx 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\6cff57ed233dd9083464ccc23c0a59df300c8a0aece0d3651e5c9e7984c937fd.exe"C:\Users\Admin\AppData\Local\Temp\6cff57ed233dd9083464ccc23c0a59df300c8a0aece0d3651e5c9e7984c937fd.exe"1⤵
- Modifies extensions of user files
- Drops startup file
- Adds Run key to start application
- Drops desktop.ini file(s)
- Enumerates connected drives
- Sets desktop wallpaper using registry
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 3064 -s 55281⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\explorer.exeexplorer.exe1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 524 -s 72162⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe"C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe" -ServerName:App.AppXtk181tbxbce2qsex02s8tw7hfxa9xb3t.mca1⤵
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe"C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe" -ServerName:CortanaUI.AppXa50dqqa5gqv4a428c9y1jjw7m3btvepj.mca1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Windows\explorer.exeexplorer.exe1⤵
- Drops desktop.ini file(s)
- Enumerates connected drives
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\ProgramData\Microsoft\Windows\Caches\{6AF0698E-D558-4F6E-9B3C-3716689AF493}.2.ver0x0000000000000001.db.6u028f6MD5
4ef6e17cdc5804174308116296c864b5
SHA1ddcdc530e5a4b16871a54393dda8a21599c0101d
SHA2566b20064acfb26887ecf0cc9d48964e29992fa3f737d2c028d05cc33c904b9b93
SHA512b2016c27ed381fb0d6a3eb1409354f507179d678c4851391f6f26cdb3317a051a6f73003d592df8ade5432e3902081d139bb70ad0143a41e7088c9c3db032724
-
C:\ProgramData\Microsoft\Windows\Caches\{DDF571F2-BE98-426D-8288-1A9A39C3FDA2}.2.ver0x0000000000000001.db.6u028f6MD5
a509735102c5ee15bebb53c8a933e425
SHA163b5f0250c5156c89e793d369b70d47441a7cb77
SHA2562d22a96c9ea3b8244f1103349e66da4e3056a790a2b3811f467ac2c7068c78f2
SHA512badbd2e7e319e13c0a17e7bb66e381e53bfa7d15602e62434258dd413d34f979389d980f8eacc9880645b86c7b515a4206939905439fac32103d169c8ae93a68
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\{3DA71D5A-20CC-432F-A115-DFE92379E91F}.3.ver0x000000000000001f.db.6u028f6MD5
cd696904a116f03607ab8fbe2125d64b
SHA1198f4e3e502ec0f8e1b4e21480ef70928b3a06dd
SHA2563d86c71775a8ec1a89c4d850abb0914be07b8d5534ae650acee497444a8ee49a
SHA512e238e6bfa140ce48259e144bb8bef49bc09fe4a2a6d95fbd6e7be4600fe98e0fa1631f135d2d58bb2eb290f58d02f0152f95124dd83cddb1f0dc39a13d3a4e31
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\{3DA71D5A-20CC-432F-A115-DFE92379E91F}.3.ver0x0000000000000020.db.6u028f6MD5
f3ed4c94fb2d5c37c1fc5feffdb8f109
SHA1d98a0ac3e6c94193ad0d02bb900e625c00da2602
SHA256a766f50c75a0bfae1484c9ebae2ac00434b2253187429dc0024294bd28b45937
SHA5123ff555c348f42c450703e2672765f28d36dba51bf87ae80f3698f5a77fdbafc7b3e1686261b8b3ef6f53a3e8c306a998226c602775e53e4307fc1c0cc879cb22
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\{3DA71D5A-20CC-432F-A115-DFE92379E91F}.3.ver0x0000000000000021.db.6u028f6MD5
adc7f649464abc95bda1b5a66e88bdc2
SHA12c309262fb37a68d5246fbc8c3c82894f8fb6a31
SHA2563329db06c6b900e8383e263b378bfeb546a1568e1793f7343e8fbf2158302c0d
SHA51299ddd09b39da600d78f0a6c79bbcb04452d31d1835d34b5e2628ea8e421b4f23d4eab272bff8d1b824d81d2b83d7d5da24f72b8ae17d03daa611bad4191e1ce2
-
C:\Users\Admin\AppData\Local\Temp\g73w.bmpMD5
faeb816ab10f5aadf0d67055832491af
SHA1d578cb48d978760ad3a8b78423a9609ccf6e0609
SHA256089159ea37d6cc854d3e8c387bbf2685d21a20fa1f0dd43b011994adf330bca4
SHA512e726c0561b492f0d40126625c2d9b51d5a21ac757d22df57169557d0d1f78f700ea813addc36625f9e38f9ead653f1df3d3386fbcda651e45dfa5d04d7a34f3a
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\CachedFiles\6u028f6-readme.txtMD5
04cd9c862f92dc69f174854f02aa87c2
SHA1375105f19597399c31ca050949895920b1fb8a18
SHA256e2bf9bd71c4a4a7c8a8553b89dad7b4b385534ae27d3750766f12b59b324e3e4
SHA51291eb8c6a8e663f75bb61e857da4fad6e57421f9529844cd9f14fa652f13f31f804f095cdf8949a2b6302ed1635271b2427996feeca7d6a3ec6e7492e94f3bd2d
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\CachedFiles\CachedImage_1280_720_POS4.jpg.6u028f6MD5
28d7e4844070974bf2e446b7d36920b6
SHA134c2aed7c96a4651229f3680e60f76cde0f94086
SHA256926672b009331b83baa84fc5d5f458ec5897bfb746e0dbe27af266b52f6d8350
SHA512c0d2c17ef727ab7def107ded73f09a42477e20fb30fcc23e24d5781278dcc7b3ab184ff8e498d0700b029932f7c22b89d4451a2838149b67c631bad2ac6a5dd3
-
\??\c:\users\admin\appdata\local\packages\microsoft.windows.cortana_cw5n1h2txyewy\ac\microsoft\internet explorer\domstore\p411qd74\microsoft.windows[1].xmlMD5
acef63c004f13d6897653d8924eb524f
SHA1e52cebc34663566eae7ced0c5b9ecdac1606c5fc
SHA256504b7c05b93c0302d5ce0ad78bd37c6faf5210f8ccefcbe92cb2349168cbe4da
SHA5128ec15e11a43357f90186f264bd1e439caffee1a6a2e961b35ae37c6e166cfed4f3d1a8fbc303f7439cf3c52b572db139780f7aebb813f8cd86717db9affc1e60
-
memory/524-336-0x0000000002600000-0x0000000002601000-memory.dmpFilesize
4KB
-
memory/3372-549-0x0000000003670000-0x0000000003671000-memory.dmpFilesize
4KB
