Analysis
-
max time kernel
122s -
max time network
141s -
platform
windows7_x64 -
resource
win7-en-20211208 -
submitted
24-01-2022 02:13
Static task
static1
Behavioral task
behavioral1
Sample
3fdad99a17a6766fe396081f82394f5e2da0142651427da64a5b6e28c9df2fd4.exe
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
3fdad99a17a6766fe396081f82394f5e2da0142651427da64a5b6e28c9df2fd4.exe
Resource
win10-en-20211208
General
-
Target
3fdad99a17a6766fe396081f82394f5e2da0142651427da64a5b6e28c9df2fd4.exe
-
Size
161KB
-
MD5
422f5cdf619404563b0c3e249bd121d4
-
SHA1
1a364144342602074a8140ec4da5eb4f0be26274
-
SHA256
3fdad99a17a6766fe396081f82394f5e2da0142651427da64a5b6e28c9df2fd4
-
SHA512
b63d22bb9556ed2d2aeefb94d9ef2245e76f433d897d5fba402d686682af3b3df14c20b7dc64694436245473a7bab8d6de8aafc6633e7e91f535f8c9ecbd3aa6
Malware Config
Signatures
-
Sodin,Sodinokibi,REvil
Ransomware with advanced anti-analysis and privilege escalation functionality.
-
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Enumerates connected drives 3 TTPs 24 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
3fdad99a17a6766fe396081f82394f5e2da0142651427da64a5b6e28c9df2fd4.exedescription ioc process File opened (read-only) \??\A: 3fdad99a17a6766fe396081f82394f5e2da0142651427da64a5b6e28c9df2fd4.exe File opened (read-only) \??\B: 3fdad99a17a6766fe396081f82394f5e2da0142651427da64a5b6e28c9df2fd4.exe File opened (read-only) \??\L: 3fdad99a17a6766fe396081f82394f5e2da0142651427da64a5b6e28c9df2fd4.exe File opened (read-only) \??\R: 3fdad99a17a6766fe396081f82394f5e2da0142651427da64a5b6e28c9df2fd4.exe File opened (read-only) \??\T: 3fdad99a17a6766fe396081f82394f5e2da0142651427da64a5b6e28c9df2fd4.exe File opened (read-only) \??\H: 3fdad99a17a6766fe396081f82394f5e2da0142651427da64a5b6e28c9df2fd4.exe File opened (read-only) \??\J: 3fdad99a17a6766fe396081f82394f5e2da0142651427da64a5b6e28c9df2fd4.exe File opened (read-only) \??\K: 3fdad99a17a6766fe396081f82394f5e2da0142651427da64a5b6e28c9df2fd4.exe File opened (read-only) \??\M: 3fdad99a17a6766fe396081f82394f5e2da0142651427da64a5b6e28c9df2fd4.exe File opened (read-only) \??\O: 3fdad99a17a6766fe396081f82394f5e2da0142651427da64a5b6e28c9df2fd4.exe File opened (read-only) \??\Q: 3fdad99a17a6766fe396081f82394f5e2da0142651427da64a5b6e28c9df2fd4.exe File opened (read-only) \??\Y: 3fdad99a17a6766fe396081f82394f5e2da0142651427da64a5b6e28c9df2fd4.exe File opened (read-only) \??\E: 3fdad99a17a6766fe396081f82394f5e2da0142651427da64a5b6e28c9df2fd4.exe File opened (read-only) \??\G: 3fdad99a17a6766fe396081f82394f5e2da0142651427da64a5b6e28c9df2fd4.exe File opened (read-only) \??\I: 3fdad99a17a6766fe396081f82394f5e2da0142651427da64a5b6e28c9df2fd4.exe File opened (read-only) \??\N: 3fdad99a17a6766fe396081f82394f5e2da0142651427da64a5b6e28c9df2fd4.exe File opened (read-only) \??\P: 3fdad99a17a6766fe396081f82394f5e2da0142651427da64a5b6e28c9df2fd4.exe File opened (read-only) \??\W: 3fdad99a17a6766fe396081f82394f5e2da0142651427da64a5b6e28c9df2fd4.exe File opened (read-only) \??\F: 3fdad99a17a6766fe396081f82394f5e2da0142651427da64a5b6e28c9df2fd4.exe File opened (read-only) \??\S: 3fdad99a17a6766fe396081f82394f5e2da0142651427da64a5b6e28c9df2fd4.exe File opened (read-only) \??\U: 3fdad99a17a6766fe396081f82394f5e2da0142651427da64a5b6e28c9df2fd4.exe File opened (read-only) \??\V: 3fdad99a17a6766fe396081f82394f5e2da0142651427da64a5b6e28c9df2fd4.exe File opened (read-only) \??\X: 3fdad99a17a6766fe396081f82394f5e2da0142651427da64a5b6e28c9df2fd4.exe File opened (read-only) \??\Z: 3fdad99a17a6766fe396081f82394f5e2da0142651427da64a5b6e28c9df2fd4.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Interacts with shadow copies 2 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
Processes:
vssadmin.exepid process 568 vssadmin.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
3fdad99a17a6766fe396081f82394f5e2da0142651427da64a5b6e28c9df2fd4.exepid process 1648 3fdad99a17a6766fe396081f82394f5e2da0142651427da64a5b6e28c9df2fd4.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
vssvc.exedescription pid process Token: SeBackupPrivilege 1156 vssvc.exe Token: SeRestorePrivilege 1156 vssvc.exe Token: SeAuditPrivilege 1156 vssvc.exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
3fdad99a17a6766fe396081f82394f5e2da0142651427da64a5b6e28c9df2fd4.execmd.exedescription pid process target process PID 1648 wrote to memory of 556 1648 3fdad99a17a6766fe396081f82394f5e2da0142651427da64a5b6e28c9df2fd4.exe cmd.exe PID 1648 wrote to memory of 556 1648 3fdad99a17a6766fe396081f82394f5e2da0142651427da64a5b6e28c9df2fd4.exe cmd.exe PID 1648 wrote to memory of 556 1648 3fdad99a17a6766fe396081f82394f5e2da0142651427da64a5b6e28c9df2fd4.exe cmd.exe PID 1648 wrote to memory of 556 1648 3fdad99a17a6766fe396081f82394f5e2da0142651427da64a5b6e28c9df2fd4.exe cmd.exe PID 556 wrote to memory of 568 556 cmd.exe vssadmin.exe PID 556 wrote to memory of 568 556 cmd.exe vssadmin.exe PID 556 wrote to memory of 568 556 cmd.exe vssadmin.exe PID 556 wrote to memory of 568 556 cmd.exe vssadmin.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\3fdad99a17a6766fe396081f82394f5e2da0142651427da64a5b6e28c9df2fd4.exe"C:\Users\Admin\AppData\Local\Temp\3fdad99a17a6766fe396081f82394f5e2da0142651427da64a5b6e28c9df2fd4.exe"1⤵
- Enumerates connected drives
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c vssadmin.exe Delete Shadows /All /Quiet & bcdedit /set {default} recoveryenabled No & bcdedit /set {default} bootstatuspolicy ignoreallfailures2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\vssadmin.exevssadmin.exe Delete Shadows /All /Quiet3⤵
- Interacts with shadow copies
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1648-55-0x00000000763B1000-0x00000000763B3000-memory.dmpFilesize
8KB