Analysis
-
max time kernel
172s -
max time network
187s -
platform
windows10_x64 -
resource
win10-en-20211208 -
submitted
24-01-2022 02:20
Static task
static1
Behavioral task
behavioral1
Sample
2d2d040b3d70c83082f80fcaf37823d0d5c0b9851749ce1c46828abc3566e6e8.exe
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
2d2d040b3d70c83082f80fcaf37823d0d5c0b9851749ce1c46828abc3566e6e8.exe
Resource
win10-en-20211208
General
-
Target
2d2d040b3d70c83082f80fcaf37823d0d5c0b9851749ce1c46828abc3566e6e8.exe
-
Size
164KB
-
MD5
274e539799a9d1bdc964c34a19fc7f6a
-
SHA1
b74f1a239112ab8105444f96d6f1ddcffb189ace
-
SHA256
2d2d040b3d70c83082f80fcaf37823d0d5c0b9851749ce1c46828abc3566e6e8
-
SHA512
a4399b9fb1d211c83ce16e67194191147c6c82e9298aa9cac6470ed022cc886914c512cc71ac6cc87e46ca642bab8cb759a5e477a1f979352c3849f126597350
Malware Config
Extracted
C:\8396yhlwqf-readme.txt
sodinokibi
http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/9E716961D4D35F80
http://decryptor.top/9E716961D4D35F80
Signatures
-
Sodin,Sodinokibi,REvil
Ransomware with advanced anti-analysis and privilege escalation functionality.
-
Modifies extensions of user files 3 IoCs
Ransomware generally changes the extension on encrypted files.
Processes:
2d2d040b3d70c83082f80fcaf37823d0d5c0b9851749ce1c46828abc3566e6e8.exedescription ioc process File renamed C:\Users\Admin\Pictures\SyncConfirm.tiff => \??\c:\users\admin\pictures\SyncConfirm.tiff.8396yhlwqf 2d2d040b3d70c83082f80fcaf37823d0d5c0b9851749ce1c46828abc3566e6e8.exe File opened for modification \??\c:\users\admin\pictures\SyncConfirm.tiff 2d2d040b3d70c83082f80fcaf37823d0d5c0b9851749ce1c46828abc3566e6e8.exe File renamed C:\Users\Admin\Pictures\FormatAdd.png => \??\c:\users\admin\pictures\FormatAdd.png.8396yhlwqf 2d2d040b3d70c83082f80fcaf37823d0d5c0b9851749ce1c46828abc3566e6e8.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
2d2d040b3d70c83082f80fcaf37823d0d5c0b9851749ce1c46828abc3566e6e8.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run 2d2d040b3d70c83082f80fcaf37823d0d5c0b9851749ce1c46828abc3566e6e8.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\sNpEShi30R = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2d2d040b3d70c83082f80fcaf37823d0d5c0b9851749ce1c46828abc3566e6e8.exe" 2d2d040b3d70c83082f80fcaf37823d0d5c0b9851749ce1c46828abc3566e6e8.exe -
Enumerates connected drives 3 TTPs 25 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
2d2d040b3d70c83082f80fcaf37823d0d5c0b9851749ce1c46828abc3566e6e8.exedescription ioc process File opened (read-only) \??\P: 2d2d040b3d70c83082f80fcaf37823d0d5c0b9851749ce1c46828abc3566e6e8.exe File opened (read-only) \??\V: 2d2d040b3d70c83082f80fcaf37823d0d5c0b9851749ce1c46828abc3566e6e8.exe File opened (read-only) \??\X: 2d2d040b3d70c83082f80fcaf37823d0d5c0b9851749ce1c46828abc3566e6e8.exe File opened (read-only) \??\K: 2d2d040b3d70c83082f80fcaf37823d0d5c0b9851749ce1c46828abc3566e6e8.exe File opened (read-only) \??\M: 2d2d040b3d70c83082f80fcaf37823d0d5c0b9851749ce1c46828abc3566e6e8.exe File opened (read-only) \??\N: 2d2d040b3d70c83082f80fcaf37823d0d5c0b9851749ce1c46828abc3566e6e8.exe File opened (read-only) \??\Z: 2d2d040b3d70c83082f80fcaf37823d0d5c0b9851749ce1c46828abc3566e6e8.exe File opened (read-only) \??\I: 2d2d040b3d70c83082f80fcaf37823d0d5c0b9851749ce1c46828abc3566e6e8.exe File opened (read-only) \??\J: 2d2d040b3d70c83082f80fcaf37823d0d5c0b9851749ce1c46828abc3566e6e8.exe File opened (read-only) \??\Q: 2d2d040b3d70c83082f80fcaf37823d0d5c0b9851749ce1c46828abc3566e6e8.exe File opened (read-only) \??\S: 2d2d040b3d70c83082f80fcaf37823d0d5c0b9851749ce1c46828abc3566e6e8.exe File opened (read-only) \??\Y: 2d2d040b3d70c83082f80fcaf37823d0d5c0b9851749ce1c46828abc3566e6e8.exe File opened (read-only) \??\D: 2d2d040b3d70c83082f80fcaf37823d0d5c0b9851749ce1c46828abc3566e6e8.exe File opened (read-only) \??\E: 2d2d040b3d70c83082f80fcaf37823d0d5c0b9851749ce1c46828abc3566e6e8.exe File opened (read-only) \??\F: 2d2d040b3d70c83082f80fcaf37823d0d5c0b9851749ce1c46828abc3566e6e8.exe File opened (read-only) \??\O: 2d2d040b3d70c83082f80fcaf37823d0d5c0b9851749ce1c46828abc3566e6e8.exe File opened (read-only) \??\H: 2d2d040b3d70c83082f80fcaf37823d0d5c0b9851749ce1c46828abc3566e6e8.exe File opened (read-only) \??\L: 2d2d040b3d70c83082f80fcaf37823d0d5c0b9851749ce1c46828abc3566e6e8.exe File opened (read-only) \??\R: 2d2d040b3d70c83082f80fcaf37823d0d5c0b9851749ce1c46828abc3566e6e8.exe File opened (read-only) \??\T: 2d2d040b3d70c83082f80fcaf37823d0d5c0b9851749ce1c46828abc3566e6e8.exe File opened (read-only) \??\U: 2d2d040b3d70c83082f80fcaf37823d0d5c0b9851749ce1c46828abc3566e6e8.exe File opened (read-only) \??\A: 2d2d040b3d70c83082f80fcaf37823d0d5c0b9851749ce1c46828abc3566e6e8.exe File opened (read-only) \??\B: 2d2d040b3d70c83082f80fcaf37823d0d5c0b9851749ce1c46828abc3566e6e8.exe File opened (read-only) \??\G: 2d2d040b3d70c83082f80fcaf37823d0d5c0b9851749ce1c46828abc3566e6e8.exe File opened (read-only) \??\W: 2d2d040b3d70c83082f80fcaf37823d0d5c0b9851749ce1c46828abc3566e6e8.exe -
Sets desktop wallpaper using registry 2 TTPs 1 IoCs
Processes:
2d2d040b3d70c83082f80fcaf37823d0d5c0b9851749ce1c46828abc3566e6e8.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\fveuvrjn0lw7d.bmp" 2d2d040b3d70c83082f80fcaf37823d0d5c0b9851749ce1c46828abc3566e6e8.exe -
Drops file in Program Files directory 18 IoCs
Processes:
2d2d040b3d70c83082f80fcaf37823d0d5c0b9851749ce1c46828abc3566e6e8.exedescription ioc process File opened for modification \??\c:\program files\ExpandComplete.html 2d2d040b3d70c83082f80fcaf37823d0d5c0b9851749ce1c46828abc3566e6e8.exe File opened for modification \??\c:\program files\SetCompare.jpeg 2d2d040b3d70c83082f80fcaf37823d0d5c0b9851749ce1c46828abc3566e6e8.exe File opened for modification \??\c:\program files\TraceResize.edrwx 2d2d040b3d70c83082f80fcaf37823d0d5c0b9851749ce1c46828abc3566e6e8.exe File opened for modification \??\c:\program files\UpdateUninstall.mpp 2d2d040b3d70c83082f80fcaf37823d0d5c0b9851749ce1c46828abc3566e6e8.exe File created \??\c:\program files (x86)\8396yhlwqf-readme.txt 2d2d040b3d70c83082f80fcaf37823d0d5c0b9851749ce1c46828abc3566e6e8.exe File opened for modification \??\c:\program files\GroupConfirm.ram 2d2d040b3d70c83082f80fcaf37823d0d5c0b9851749ce1c46828abc3566e6e8.exe File opened for modification \??\c:\program files\ReceiveAssert.mp3 2d2d040b3d70c83082f80fcaf37823d0d5c0b9851749ce1c46828abc3566e6e8.exe File opened for modification \??\c:\program files\RepairHide.dib 2d2d040b3d70c83082f80fcaf37823d0d5c0b9851749ce1c46828abc3566e6e8.exe File opened for modification \??\c:\program files\RestoreRepair.wpl 2d2d040b3d70c83082f80fcaf37823d0d5c0b9851749ce1c46828abc3566e6e8.exe File opened for modification \??\c:\program files\ConvertEnable.wma 2d2d040b3d70c83082f80fcaf37823d0d5c0b9851749ce1c46828abc3566e6e8.exe File opened for modification \??\c:\program files\EnableAdd.bmp 2d2d040b3d70c83082f80fcaf37823d0d5c0b9851749ce1c46828abc3566e6e8.exe File opened for modification \??\c:\program files\LimitCheckpoint.vstm 2d2d040b3d70c83082f80fcaf37823d0d5c0b9851749ce1c46828abc3566e6e8.exe File opened for modification \??\c:\program files\SubmitAssert.pps 2d2d040b3d70c83082f80fcaf37823d0d5c0b9851749ce1c46828abc3566e6e8.exe File created \??\c:\program files\8396yhlwqf-readme.txt 2d2d040b3d70c83082f80fcaf37823d0d5c0b9851749ce1c46828abc3566e6e8.exe File opened for modification \??\c:\program files\GroupOptimize.asp 2d2d040b3d70c83082f80fcaf37823d0d5c0b9851749ce1c46828abc3566e6e8.exe File opened for modification \??\c:\program files\LockCopy.shtml 2d2d040b3d70c83082f80fcaf37823d0d5c0b9851749ce1c46828abc3566e6e8.exe File opened for modification \??\c:\program files\SplitConvertTo.mp3 2d2d040b3d70c83082f80fcaf37823d0d5c0b9851749ce1c46828abc3566e6e8.exe File opened for modification \??\c:\program files\WatchJoin.mp2v 2d2d040b3d70c83082f80fcaf37823d0d5c0b9851749ce1c46828abc3566e6e8.exe -
Modifies data under HKEY_USERS 42 IoCs
Processes:
powershell.exedescription ioc process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot powershell.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000 powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates powershell.exe -
Suspicious behavior: EnumeratesProcesses 15 IoCs
Processes:
2d2d040b3d70c83082f80fcaf37823d0d5c0b9851749ce1c46828abc3566e6e8.exepowershell.exepid process 2736 2d2d040b3d70c83082f80fcaf37823d0d5c0b9851749ce1c46828abc3566e6e8.exe 2736 2d2d040b3d70c83082f80fcaf37823d0d5c0b9851749ce1c46828abc3566e6e8.exe 2736 2d2d040b3d70c83082f80fcaf37823d0d5c0b9851749ce1c46828abc3566e6e8.exe 2736 2d2d040b3d70c83082f80fcaf37823d0d5c0b9851749ce1c46828abc3566e6e8.exe 1236 powershell.exe 1236 powershell.exe 1236 powershell.exe 2736 2d2d040b3d70c83082f80fcaf37823d0d5c0b9851749ce1c46828abc3566e6e8.exe 2736 2d2d040b3d70c83082f80fcaf37823d0d5c0b9851749ce1c46828abc3566e6e8.exe 2736 2d2d040b3d70c83082f80fcaf37823d0d5c0b9851749ce1c46828abc3566e6e8.exe 2736 2d2d040b3d70c83082f80fcaf37823d0d5c0b9851749ce1c46828abc3566e6e8.exe 2736 2d2d040b3d70c83082f80fcaf37823d0d5c0b9851749ce1c46828abc3566e6e8.exe 2736 2d2d040b3d70c83082f80fcaf37823d0d5c0b9851749ce1c46828abc3566e6e8.exe 2736 2d2d040b3d70c83082f80fcaf37823d0d5c0b9851749ce1c46828abc3566e6e8.exe 2736 2d2d040b3d70c83082f80fcaf37823d0d5c0b9851749ce1c46828abc3566e6e8.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes:
powershell.exevssvc.exedescription pid process Token: SeDebugPrivilege 1236 powershell.exe Token: SeBackupPrivilege 1432 vssvc.exe Token: SeRestorePrivilege 1432 vssvc.exe Token: SeAuditPrivilege 1432 vssvc.exe -
Suspicious use of WriteProcessMemory 2 IoCs
Processes:
2d2d040b3d70c83082f80fcaf37823d0d5c0b9851749ce1c46828abc3566e6e8.exedescription pid process target process PID 2736 wrote to memory of 1236 2736 2d2d040b3d70c83082f80fcaf37823d0d5c0b9851749ce1c46828abc3566e6e8.exe powershell.exe PID 2736 wrote to memory of 1236 2736 2d2d040b3d70c83082f80fcaf37823d0d5c0b9851749ce1c46828abc3566e6e8.exe powershell.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2d2d040b3d70c83082f80fcaf37823d0d5c0b9851749ce1c46828abc3566e6e8.exe"C:\Users\Admin\AppData\Local\Temp\2d2d040b3d70c83082f80fcaf37823d0d5c0b9851749ce1c46828abc3566e6e8.exe"1⤵
- Modifies extensions of user files
- Adds Run key to start application
- Enumerates connected drives
- Sets desktop wallpaper using registry
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -e RwBlAHQALQBXAG0AaQBPAGIAagBlAGMAdAAgAFcAaQBuADMAMgBfAFMAaABhAGQAbwB3AGMAbwBwAHkAIAB8ACAARgBvAHIARQBhAGMAaAAtAE8AYgBqAGUAYwB0ACAAewAkAF8ALgBEAGUAbABlAHQAZQAoACkAOwB9AA==2⤵
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\wbem\unsecapp.exeC:\Windows\system32\wbem\unsecapp.exe -Embedding1⤵
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1236-126-0x000001767C6A0000-0x000001767C6A2000-memory.dmpFilesize
8KB
-
memory/1236-127-0x000001767C6A3000-0x000001767C6A5000-memory.dmpFilesize
8KB
-
memory/1236-128-0x000001767C650000-0x000001767C672000-memory.dmpFilesize
136KB
-
memory/1236-131-0x000001767D1C0000-0x000001767D236000-memory.dmpFilesize
472KB
-
memory/2736-117-0x0000000000B80000-0x0000000000BA3000-memory.dmpFilesize
140KB
-
memory/2736-118-0x0000000000B80000-0x0000000000BA3000-memory.dmpFilesize
140KB
-
memory/2736-119-0x0000000000BF0000-0x0000000000BF1000-memory.dmpFilesize
4KB
-
memory/2736-120-0x0000000000F40000-0x0000000000F46000-memory.dmpFilesize
24KB