Analysis
-
max time kernel
184s -
max time network
181s -
platform
windows10_x64 -
resource
win10-en-20211208 -
submitted
24-01-2022 02:11
Static task
static1
Behavioral task
behavioral1
Sample
448931d68d6614de83899a8f15f504af8f65f3a9543c74dcb8601fca7c6dffab.exe
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
448931d68d6614de83899a8f15f504af8f65f3a9543c74dcb8601fca7c6dffab.exe
Resource
win10-en-20211208
General
-
Target
448931d68d6614de83899a8f15f504af8f65f3a9543c74dcb8601fca7c6dffab.exe
-
Size
179KB
-
MD5
a4f599b558815938a9eabaca693b0021
-
SHA1
4a0ef962e3b2b01eb07177a2778d0cd7c9352989
-
SHA256
448931d68d6614de83899a8f15f504af8f65f3a9543c74dcb8601fca7c6dffab
-
SHA512
685ee2b6898432ed1c6429e680b8c34f578558ad42f08f0e07ffdf30d5de56a38d511245c9eb19d7a548d97ab64abcbf384e62a94433a205161bec3be0b48564
Malware Config
Extracted
C:\0p8z4-readme.txt
sodinokibi
http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/741B898F4C2E29AA
http://decryptor.top/741B898F4C2E29AA
Signatures
-
Sodin,Sodinokibi,REvil
Ransomware with advanced anti-analysis and privilege escalation functionality.
-
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Modifies extensions of user files 11 IoCs
Ransomware generally changes the extension on encrypted files.
Processes:
448931d68d6614de83899a8f15f504af8f65f3a9543c74dcb8601fca7c6dffab.exedescription ioc process File renamed C:\Users\Admin\Pictures\DebugTrace.tiff => \??\c:\users\admin\pictures\DebugTrace.tiff.0p8z4 448931d68d6614de83899a8f15f504af8f65f3a9543c74dcb8601fca7c6dffab.exe File renamed C:\Users\Admin\Pictures\PingDismount.raw => \??\c:\users\admin\pictures\PingDismount.raw.0p8z4 448931d68d6614de83899a8f15f504af8f65f3a9543c74dcb8601fca7c6dffab.exe File renamed C:\Users\Admin\Pictures\ResumeSet.crw => \??\c:\users\admin\pictures\ResumeSet.crw.0p8z4 448931d68d6614de83899a8f15f504af8f65f3a9543c74dcb8601fca7c6dffab.exe File renamed C:\Users\Admin\Pictures\UnregisterRestore.tiff => \??\c:\users\admin\pictures\UnregisterRestore.tiff.0p8z4 448931d68d6614de83899a8f15f504af8f65f3a9543c74dcb8601fca7c6dffab.exe File renamed C:\Users\Admin\Pictures\CheckpointPublish.tif => \??\c:\users\admin\pictures\CheckpointPublish.tif.0p8z4 448931d68d6614de83899a8f15f504af8f65f3a9543c74dcb8601fca7c6dffab.exe File renamed C:\Users\Admin\Pictures\ConfirmDebug.raw => \??\c:\users\admin\pictures\ConfirmDebug.raw.0p8z4 448931d68d6614de83899a8f15f504af8f65f3a9543c74dcb8601fca7c6dffab.exe File renamed C:\Users\Admin\Pictures\CopyUndo.tiff => \??\c:\users\admin\pictures\CopyUndo.tiff.0p8z4 448931d68d6614de83899a8f15f504af8f65f3a9543c74dcb8601fca7c6dffab.exe File opened for modification \??\c:\users\admin\pictures\DebugTrace.tiff 448931d68d6614de83899a8f15f504af8f65f3a9543c74dcb8601fca7c6dffab.exe File renamed C:\Users\Admin\Pictures\ConfirmSwitch.raw => \??\c:\users\admin\pictures\ConfirmSwitch.raw.0p8z4 448931d68d6614de83899a8f15f504af8f65f3a9543c74dcb8601fca7c6dffab.exe File opened for modification \??\c:\users\admin\pictures\CopyUndo.tiff 448931d68d6614de83899a8f15f504af8f65f3a9543c74dcb8601fca7c6dffab.exe File opened for modification \??\c:\users\admin\pictures\UnregisterRestore.tiff 448931d68d6614de83899a8f15f504af8f65f3a9543c74dcb8601fca7c6dffab.exe -
Enumerates connected drives 3 TTPs 25 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
448931d68d6614de83899a8f15f504af8f65f3a9543c74dcb8601fca7c6dffab.exedescription ioc process File opened (read-only) \??\B: 448931d68d6614de83899a8f15f504af8f65f3a9543c74dcb8601fca7c6dffab.exe File opened (read-only) \??\E: 448931d68d6614de83899a8f15f504af8f65f3a9543c74dcb8601fca7c6dffab.exe File opened (read-only) \??\I: 448931d68d6614de83899a8f15f504af8f65f3a9543c74dcb8601fca7c6dffab.exe File opened (read-only) \??\K: 448931d68d6614de83899a8f15f504af8f65f3a9543c74dcb8601fca7c6dffab.exe File opened (read-only) \??\O: 448931d68d6614de83899a8f15f504af8f65f3a9543c74dcb8601fca7c6dffab.exe File opened (read-only) \??\S: 448931d68d6614de83899a8f15f504af8f65f3a9543c74dcb8601fca7c6dffab.exe File opened (read-only) \??\V: 448931d68d6614de83899a8f15f504af8f65f3a9543c74dcb8601fca7c6dffab.exe File opened (read-only) \??\W: 448931d68d6614de83899a8f15f504af8f65f3a9543c74dcb8601fca7c6dffab.exe File opened (read-only) \??\Z: 448931d68d6614de83899a8f15f504af8f65f3a9543c74dcb8601fca7c6dffab.exe File opened (read-only) \??\H: 448931d68d6614de83899a8f15f504af8f65f3a9543c74dcb8601fca7c6dffab.exe File opened (read-only) \??\J: 448931d68d6614de83899a8f15f504af8f65f3a9543c74dcb8601fca7c6dffab.exe File opened (read-only) \??\R: 448931d68d6614de83899a8f15f504af8f65f3a9543c74dcb8601fca7c6dffab.exe File opened (read-only) \??\U: 448931d68d6614de83899a8f15f504af8f65f3a9543c74dcb8601fca7c6dffab.exe File opened (read-only) \??\D: 448931d68d6614de83899a8f15f504af8f65f3a9543c74dcb8601fca7c6dffab.exe File opened (read-only) \??\G: 448931d68d6614de83899a8f15f504af8f65f3a9543c74dcb8601fca7c6dffab.exe File opened (read-only) \??\L: 448931d68d6614de83899a8f15f504af8f65f3a9543c74dcb8601fca7c6dffab.exe File opened (read-only) \??\M: 448931d68d6614de83899a8f15f504af8f65f3a9543c74dcb8601fca7c6dffab.exe File opened (read-only) \??\N: 448931d68d6614de83899a8f15f504af8f65f3a9543c74dcb8601fca7c6dffab.exe File opened (read-only) \??\P: 448931d68d6614de83899a8f15f504af8f65f3a9543c74dcb8601fca7c6dffab.exe File opened (read-only) \??\Y: 448931d68d6614de83899a8f15f504af8f65f3a9543c74dcb8601fca7c6dffab.exe File opened (read-only) \??\A: 448931d68d6614de83899a8f15f504af8f65f3a9543c74dcb8601fca7c6dffab.exe File opened (read-only) \??\F: 448931d68d6614de83899a8f15f504af8f65f3a9543c74dcb8601fca7c6dffab.exe File opened (read-only) \??\Q: 448931d68d6614de83899a8f15f504af8f65f3a9543c74dcb8601fca7c6dffab.exe File opened (read-only) \??\T: 448931d68d6614de83899a8f15f504af8f65f3a9543c74dcb8601fca7c6dffab.exe File opened (read-only) \??\X: 448931d68d6614de83899a8f15f504af8f65f3a9543c74dcb8601fca7c6dffab.exe -
Drops file in Program Files directory 39 IoCs
Processes:
448931d68d6614de83899a8f15f504af8f65f3a9543c74dcb8601fca7c6dffab.exedescription ioc process File opened for modification \??\c:\program files\ConnectUnlock.xht 448931d68d6614de83899a8f15f504af8f65f3a9543c74dcb8601fca7c6dffab.exe File opened for modification \??\c:\program files\InitializeConvert.3gpp 448931d68d6614de83899a8f15f504af8f65f3a9543c74dcb8601fca7c6dffab.exe File opened for modification \??\c:\program files\TraceSet.3gp2 448931d68d6614de83899a8f15f504af8f65f3a9543c74dcb8601fca7c6dffab.exe File opened for modification \??\c:\program files\UninstallMount.ico 448931d68d6614de83899a8f15f504af8f65f3a9543c74dcb8601fca7c6dffab.exe File opened for modification \??\c:\program files\ExpandRestart.avi 448931d68d6614de83899a8f15f504af8f65f3a9543c74dcb8601fca7c6dffab.exe File opened for modification \??\c:\program files\FindMount.fon 448931d68d6614de83899a8f15f504af8f65f3a9543c74dcb8601fca7c6dffab.exe File opened for modification \??\c:\program files\MeasureMerge.ex_ 448931d68d6614de83899a8f15f504af8f65f3a9543c74dcb8601fca7c6dffab.exe File opened for modification \??\c:\program files\RestoreNew.aif 448931d68d6614de83899a8f15f504af8f65f3a9543c74dcb8601fca7c6dffab.exe File opened for modification \??\c:\program files\SetInstall.dxf 448931d68d6614de83899a8f15f504af8f65f3a9543c74dcb8601fca7c6dffab.exe File opened for modification \??\c:\program files\SuspendBlock.ods 448931d68d6614de83899a8f15f504af8f65f3a9543c74dcb8601fca7c6dffab.exe File opened for modification \??\c:\program files\LockDisable.dot 448931d68d6614de83899a8f15f504af8f65f3a9543c74dcb8601fca7c6dffab.exe File opened for modification \??\c:\program files\OutGrant.i64 448931d68d6614de83899a8f15f504af8f65f3a9543c74dcb8601fca7c6dffab.exe File created \??\c:\program files\0p8z4-readme.txt 448931d68d6614de83899a8f15f504af8f65f3a9543c74dcb8601fca7c6dffab.exe File created \??\c:\program files (x86)\0p8z4-readme.txt 448931d68d6614de83899a8f15f504af8f65f3a9543c74dcb8601fca7c6dffab.exe File opened for modification \??\c:\program files\AssertOptimize.rmi 448931d68d6614de83899a8f15f504af8f65f3a9543c74dcb8601fca7c6dffab.exe File opened for modification \??\c:\program files\ConvertProtect.fon 448931d68d6614de83899a8f15f504af8f65f3a9543c74dcb8601fca7c6dffab.exe File opened for modification \??\c:\program files\DebugMove.avi 448931d68d6614de83899a8f15f504af8f65f3a9543c74dcb8601fca7c6dffab.exe File opened for modification \??\c:\program files\LimitGrant.vbs 448931d68d6614de83899a8f15f504af8f65f3a9543c74dcb8601fca7c6dffab.exe File opened for modification \??\c:\program files\SkipEnable.fon 448931d68d6614de83899a8f15f504af8f65f3a9543c74dcb8601fca7c6dffab.exe File opened for modification \??\c:\program files\ResetRedo.rtf 448931d68d6614de83899a8f15f504af8f65f3a9543c74dcb8601fca7c6dffab.exe File opened for modification \??\c:\program files\UnblockApprove.xla 448931d68d6614de83899a8f15f504af8f65f3a9543c74dcb8601fca7c6dffab.exe File opened for modification \??\c:\program files\AddDisconnect.midi 448931d68d6614de83899a8f15f504af8f65f3a9543c74dcb8601fca7c6dffab.exe File opened for modification \??\c:\program files\InvokeStep.jpeg 448931d68d6614de83899a8f15f504af8f65f3a9543c74dcb8601fca7c6dffab.exe File opened for modification \??\c:\program files\MountInvoke.jtx 448931d68d6614de83899a8f15f504af8f65f3a9543c74dcb8601fca7c6dffab.exe File opened for modification \??\c:\program files\OptimizeMeasure.m1v 448931d68d6614de83899a8f15f504af8f65f3a9543c74dcb8601fca7c6dffab.exe File opened for modification \??\c:\program files\StepResolve.scf 448931d68d6614de83899a8f15f504af8f65f3a9543c74dcb8601fca7c6dffab.exe File opened for modification \??\c:\program files\UnregisterClear.potm 448931d68d6614de83899a8f15f504af8f65f3a9543c74dcb8601fca7c6dffab.exe File opened for modification \??\c:\program files\ReadSkip.mid 448931d68d6614de83899a8f15f504af8f65f3a9543c74dcb8601fca7c6dffab.exe File opened for modification \??\c:\program files\ReceiveRegister.M2TS 448931d68d6614de83899a8f15f504af8f65f3a9543c74dcb8601fca7c6dffab.exe File opened for modification \??\c:\program files\ResumeProtect.ocx 448931d68d6614de83899a8f15f504af8f65f3a9543c74dcb8601fca7c6dffab.exe File opened for modification \??\c:\program files\RevokeProtect.dxf 448931d68d6614de83899a8f15f504af8f65f3a9543c74dcb8601fca7c6dffab.exe File opened for modification \??\c:\program files\EnablePing.ex_ 448931d68d6614de83899a8f15f504af8f65f3a9543c74dcb8601fca7c6dffab.exe File opened for modification \??\c:\program files\ExitRestart.odp 448931d68d6614de83899a8f15f504af8f65f3a9543c74dcb8601fca7c6dffab.exe File opened for modification \??\c:\program files\ExpandCheckpoint.xml 448931d68d6614de83899a8f15f504af8f65f3a9543c74dcb8601fca7c6dffab.exe File opened for modification \??\c:\program files\UnlockNew.cab 448931d68d6614de83899a8f15f504af8f65f3a9543c74dcb8601fca7c6dffab.exe File opened for modification \??\c:\program files\WatchEnable.TTS 448931d68d6614de83899a8f15f504af8f65f3a9543c74dcb8601fca7c6dffab.exe File opened for modification \??\c:\program files\ConvertToExpand.raw 448931d68d6614de83899a8f15f504af8f65f3a9543c74dcb8601fca7c6dffab.exe File opened for modification \??\c:\program files\ExportConnect.asf 448931d68d6614de83899a8f15f504af8f65f3a9543c74dcb8601fca7c6dffab.exe File opened for modification \??\c:\program files\RenameConvertTo.pot 448931d68d6614de83899a8f15f504af8f65f3a9543c74dcb8601fca7c6dffab.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Interacts with shadow copies 2 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
Processes:
vssadmin.exepid process 2360 vssadmin.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
448931d68d6614de83899a8f15f504af8f65f3a9543c74dcb8601fca7c6dffab.exepid process 596 448931d68d6614de83899a8f15f504af8f65f3a9543c74dcb8601fca7c6dffab.exe 596 448931d68d6614de83899a8f15f504af8f65f3a9543c74dcb8601fca7c6dffab.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
vssvc.exedescription pid process Token: SeBackupPrivilege 2768 vssvc.exe Token: SeRestorePrivilege 2768 vssvc.exe Token: SeAuditPrivilege 2768 vssvc.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
448931d68d6614de83899a8f15f504af8f65f3a9543c74dcb8601fca7c6dffab.execmd.exedescription pid process target process PID 596 wrote to memory of 3696 596 448931d68d6614de83899a8f15f504af8f65f3a9543c74dcb8601fca7c6dffab.exe cmd.exe PID 596 wrote to memory of 3696 596 448931d68d6614de83899a8f15f504af8f65f3a9543c74dcb8601fca7c6dffab.exe cmd.exe PID 596 wrote to memory of 3696 596 448931d68d6614de83899a8f15f504af8f65f3a9543c74dcb8601fca7c6dffab.exe cmd.exe PID 3696 wrote to memory of 2360 3696 cmd.exe vssadmin.exe PID 3696 wrote to memory of 2360 3696 cmd.exe vssadmin.exe PID 3696 wrote to memory of 2360 3696 cmd.exe vssadmin.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\448931d68d6614de83899a8f15f504af8f65f3a9543c74dcb8601fca7c6dffab.exe"C:\Users\Admin\AppData\Local\Temp\448931d68d6614de83899a8f15f504af8f65f3a9543c74dcb8601fca7c6dffab.exe"1⤵
- Modifies extensions of user files
- Enumerates connected drives
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c vssadmin.exe Delete Shadows /All /Quiet & bcdedit /set {default} recoveryenabled No & bcdedit /set {default} bootstatuspolicy ignoreallfailures2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\vssadmin.exevssadmin.exe Delete Shadows /All /Quiet3⤵
- Interacts with shadow copies
-
C:\Windows\system32\wbem\unsecapp.exeC:\Windows\system32\wbem\unsecapp.exe -Embedding1⤵
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken