Analysis
-
max time kernel
102s -
max time network
139s -
platform
windows10_x64 -
resource
win10-en-20211208 -
submitted
30-01-2022 08:04
Static task
static1
Behavioral task
behavioral1
Sample
0f48d0cdecc581ccc73b11ce229c21522d23996eb4f1d88c892e6a68b7a4ea19.exe
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
0f48d0cdecc581ccc73b11ce229c21522d23996eb4f1d88c892e6a68b7a4ea19.exe
Resource
win10-en-20211208
General
-
Target
0f48d0cdecc581ccc73b11ce229c21522d23996eb4f1d88c892e6a68b7a4ea19.exe
-
Size
164KB
-
MD5
e094ce96a4f634f28b97801ad942ec49
-
SHA1
1c4fd21b4633ae6d774d115e43aee0f1bbb94b9e
-
SHA256
0f48d0cdecc581ccc73b11ce229c21522d23996eb4f1d88c892e6a68b7a4ea19
-
SHA512
5ba65c38fabaf7d90af50775fbc8233a3b2e55224457f8d4bb41d6d715ced905327d9200cd656c04c9d7382750c22b2da4fc9e4df79c012ccba717e5acf9a69b
Malware Config
Extracted
C:\z005me5-readme.txt
sodinokibi
http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/BB2BDCA7D2BE75FD
http://decryptor.top/BB2BDCA7D2BE75FD
Signatures
-
Sodin,Sodinokibi,REvil
Ransomware with advanced anti-analysis and privilege escalation functionality.
-
Modifies extensions of user files 8 IoCs
Ransomware generally changes the extension on encrypted files.
Processes:
0f48d0cdecc581ccc73b11ce229c21522d23996eb4f1d88c892e6a68b7a4ea19.exedescription ioc process File renamed C:\Users\Admin\Pictures\ResetOut.tiff => \??\c:\users\admin\pictures\ResetOut.tiff.z005me5 0f48d0cdecc581ccc73b11ce229c21522d23996eb4f1d88c892e6a68b7a4ea19.exe File renamed C:\Users\Admin\Pictures\ShowOpen.raw => \??\c:\users\admin\pictures\ShowOpen.raw.z005me5 0f48d0cdecc581ccc73b11ce229c21522d23996eb4f1d88c892e6a68b7a4ea19.exe File renamed C:\Users\Admin\Pictures\WriteTest.raw => \??\c:\users\admin\pictures\WriteTest.raw.z005me5 0f48d0cdecc581ccc73b11ce229c21522d23996eb4f1d88c892e6a68b7a4ea19.exe File opened for modification \??\c:\users\admin\pictures\ConvertFromImport.tiff 0f48d0cdecc581ccc73b11ce229c21522d23996eb4f1d88c892e6a68b7a4ea19.exe File opened for modification \??\c:\users\admin\pictures\ResetOut.tiff 0f48d0cdecc581ccc73b11ce229c21522d23996eb4f1d88c892e6a68b7a4ea19.exe File renamed C:\Users\Admin\Pictures\ConvertFromImport.tiff => \??\c:\users\admin\pictures\ConvertFromImport.tiff.z005me5 0f48d0cdecc581ccc73b11ce229c21522d23996eb4f1d88c892e6a68b7a4ea19.exe File renamed C:\Users\Admin\Pictures\ExitSelect.raw => \??\c:\users\admin\pictures\ExitSelect.raw.z005me5 0f48d0cdecc581ccc73b11ce229c21522d23996eb4f1d88c892e6a68b7a4ea19.exe File renamed C:\Users\Admin\Pictures\RepairRequest.crw => \??\c:\users\admin\pictures\RepairRequest.crw.z005me5 0f48d0cdecc581ccc73b11ce229c21522d23996eb4f1d88c892e6a68b7a4ea19.exe -
Enumerates connected drives 3 TTPs 25 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
0f48d0cdecc581ccc73b11ce229c21522d23996eb4f1d88c892e6a68b7a4ea19.exedescription ioc process File opened (read-only) \??\X: 0f48d0cdecc581ccc73b11ce229c21522d23996eb4f1d88c892e6a68b7a4ea19.exe File opened (read-only) \??\B: 0f48d0cdecc581ccc73b11ce229c21522d23996eb4f1d88c892e6a68b7a4ea19.exe File opened (read-only) \??\H: 0f48d0cdecc581ccc73b11ce229c21522d23996eb4f1d88c892e6a68b7a4ea19.exe File opened (read-only) \??\Q: 0f48d0cdecc581ccc73b11ce229c21522d23996eb4f1d88c892e6a68b7a4ea19.exe File opened (read-only) \??\K: 0f48d0cdecc581ccc73b11ce229c21522d23996eb4f1d88c892e6a68b7a4ea19.exe File opened (read-only) \??\E: 0f48d0cdecc581ccc73b11ce229c21522d23996eb4f1d88c892e6a68b7a4ea19.exe File opened (read-only) \??\G: 0f48d0cdecc581ccc73b11ce229c21522d23996eb4f1d88c892e6a68b7a4ea19.exe File opened (read-only) \??\I: 0f48d0cdecc581ccc73b11ce229c21522d23996eb4f1d88c892e6a68b7a4ea19.exe File opened (read-only) \??\N: 0f48d0cdecc581ccc73b11ce229c21522d23996eb4f1d88c892e6a68b7a4ea19.exe File opened (read-only) \??\O: 0f48d0cdecc581ccc73b11ce229c21522d23996eb4f1d88c892e6a68b7a4ea19.exe File opened (read-only) \??\P: 0f48d0cdecc581ccc73b11ce229c21522d23996eb4f1d88c892e6a68b7a4ea19.exe File opened (read-only) \??\S: 0f48d0cdecc581ccc73b11ce229c21522d23996eb4f1d88c892e6a68b7a4ea19.exe File opened (read-only) \??\U: 0f48d0cdecc581ccc73b11ce229c21522d23996eb4f1d88c892e6a68b7a4ea19.exe File opened (read-only) \??\F: 0f48d0cdecc581ccc73b11ce229c21522d23996eb4f1d88c892e6a68b7a4ea19.exe File opened (read-only) \??\J: 0f48d0cdecc581ccc73b11ce229c21522d23996eb4f1d88c892e6a68b7a4ea19.exe File opened (read-only) \??\M: 0f48d0cdecc581ccc73b11ce229c21522d23996eb4f1d88c892e6a68b7a4ea19.exe File opened (read-only) \??\Y: 0f48d0cdecc581ccc73b11ce229c21522d23996eb4f1d88c892e6a68b7a4ea19.exe File opened (read-only) \??\Z: 0f48d0cdecc581ccc73b11ce229c21522d23996eb4f1d88c892e6a68b7a4ea19.exe File opened (read-only) \??\D: 0f48d0cdecc581ccc73b11ce229c21522d23996eb4f1d88c892e6a68b7a4ea19.exe File opened (read-only) \??\T: 0f48d0cdecc581ccc73b11ce229c21522d23996eb4f1d88c892e6a68b7a4ea19.exe File opened (read-only) \??\V: 0f48d0cdecc581ccc73b11ce229c21522d23996eb4f1d88c892e6a68b7a4ea19.exe File opened (read-only) \??\W: 0f48d0cdecc581ccc73b11ce229c21522d23996eb4f1d88c892e6a68b7a4ea19.exe File opened (read-only) \??\A: 0f48d0cdecc581ccc73b11ce229c21522d23996eb4f1d88c892e6a68b7a4ea19.exe File opened (read-only) \??\L: 0f48d0cdecc581ccc73b11ce229c21522d23996eb4f1d88c892e6a68b7a4ea19.exe File opened (read-only) \??\R: 0f48d0cdecc581ccc73b11ce229c21522d23996eb4f1d88c892e6a68b7a4ea19.exe -
Sets desktop wallpaper using registry 2 TTPs 1 IoCs
Processes:
0f48d0cdecc581ccc73b11ce229c21522d23996eb4f1d88c892e6a68b7a4ea19.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\xsa3kum7.bmp" 0f48d0cdecc581ccc73b11ce229c21522d23996eb4f1d88c892e6a68b7a4ea19.exe -
Drops file in Program Files directory 29 IoCs
Processes:
0f48d0cdecc581ccc73b11ce229c21522d23996eb4f1d88c892e6a68b7a4ea19.exedescription ioc process File opened for modification \??\c:\program files\ExpandEnter.jpg 0f48d0cdecc581ccc73b11ce229c21522d23996eb4f1d88c892e6a68b7a4ea19.exe File opened for modification \??\c:\program files\MergeUnregister.mpv2 0f48d0cdecc581ccc73b11ce229c21522d23996eb4f1d88c892e6a68b7a4ea19.exe File opened for modification \??\c:\program files\OptimizeSave.eprtx 0f48d0cdecc581ccc73b11ce229c21522d23996eb4f1d88c892e6a68b7a4ea19.exe File opened for modification \??\c:\program files\ResolvePush.ppt 0f48d0cdecc581ccc73b11ce229c21522d23996eb4f1d88c892e6a68b7a4ea19.exe File opened for modification \??\c:\program files\StartResolve.3gp2 0f48d0cdecc581ccc73b11ce229c21522d23996eb4f1d88c892e6a68b7a4ea19.exe File created \??\c:\program files (x86)\z005me5-readme.txt 0f48d0cdecc581ccc73b11ce229c21522d23996eb4f1d88c892e6a68b7a4ea19.exe File opened for modification \??\c:\program files\GetCompress.doc 0f48d0cdecc581ccc73b11ce229c21522d23996eb4f1d88c892e6a68b7a4ea19.exe File opened for modification \??\c:\program files\MountGrant.vbe 0f48d0cdecc581ccc73b11ce229c21522d23996eb4f1d88c892e6a68b7a4ea19.exe File opened for modification \??\c:\program files\UseRename.wmf 0f48d0cdecc581ccc73b11ce229c21522d23996eb4f1d88c892e6a68b7a4ea19.exe File opened for modification \??\c:\program files\CompleteRequest.3gp2 0f48d0cdecc581ccc73b11ce229c21522d23996eb4f1d88c892e6a68b7a4ea19.exe File opened for modification \??\c:\program files\GetWait.pub 0f48d0cdecc581ccc73b11ce229c21522d23996eb4f1d88c892e6a68b7a4ea19.exe File opened for modification \??\c:\program files\SkipRequest.dotm 0f48d0cdecc581ccc73b11ce229c21522d23996eb4f1d88c892e6a68b7a4ea19.exe File opened for modification \??\c:\program files\CloseTest.mp3 0f48d0cdecc581ccc73b11ce229c21522d23996eb4f1d88c892e6a68b7a4ea19.exe File opened for modification \??\c:\program files\CompleteUnregister.svg 0f48d0cdecc581ccc73b11ce229c21522d23996eb4f1d88c892e6a68b7a4ea19.exe File opened for modification \??\c:\program files\LockConfirm.xlsx 0f48d0cdecc581ccc73b11ce229c21522d23996eb4f1d88c892e6a68b7a4ea19.exe File opened for modification \??\c:\program files\SearchSync.mp2v 0f48d0cdecc581ccc73b11ce229c21522d23996eb4f1d88c892e6a68b7a4ea19.exe File opened for modification \??\c:\program files\SetReset.png 0f48d0cdecc581ccc73b11ce229c21522d23996eb4f1d88c892e6a68b7a4ea19.exe File opened for modification \??\c:\program files\OpenDismount.m4v 0f48d0cdecc581ccc73b11ce229c21522d23996eb4f1d88c892e6a68b7a4ea19.exe File opened for modification \??\c:\program files\ProtectFormat.dxf 0f48d0cdecc581ccc73b11ce229c21522d23996eb4f1d88c892e6a68b7a4ea19.exe File opened for modification \??\c:\program files\RenameDisable.avi 0f48d0cdecc581ccc73b11ce229c21522d23996eb4f1d88c892e6a68b7a4ea19.exe File opened for modification \??\c:\program files\RequestBackup.ttf 0f48d0cdecc581ccc73b11ce229c21522d23996eb4f1d88c892e6a68b7a4ea19.exe File opened for modification \??\c:\program files\ResolveSet.contact 0f48d0cdecc581ccc73b11ce229c21522d23996eb4f1d88c892e6a68b7a4ea19.exe File opened for modification \??\c:\program files\SplitExpand.pub 0f48d0cdecc581ccc73b11ce229c21522d23996eb4f1d88c892e6a68b7a4ea19.exe File opened for modification \??\c:\program files\HideRestart.mpp 0f48d0cdecc581ccc73b11ce229c21522d23996eb4f1d88c892e6a68b7a4ea19.exe File opened for modification \??\c:\program files\InitializeAssert.vssm 0f48d0cdecc581ccc73b11ce229c21522d23996eb4f1d88c892e6a68b7a4ea19.exe File created \??\c:\program files\z005me5-readme.txt 0f48d0cdecc581ccc73b11ce229c21522d23996eb4f1d88c892e6a68b7a4ea19.exe File opened for modification \??\c:\program files\FormatSend.vbe 0f48d0cdecc581ccc73b11ce229c21522d23996eb4f1d88c892e6a68b7a4ea19.exe File opened for modification \??\c:\program files\LimitMove.jtx 0f48d0cdecc581ccc73b11ce229c21522d23996eb4f1d88c892e6a68b7a4ea19.exe File opened for modification \??\c:\program files\ReadRename.pub 0f48d0cdecc581ccc73b11ce229c21522d23996eb4f1d88c892e6a68b7a4ea19.exe -
Suspicious behavior: EnumeratesProcesses 5 IoCs
Processes:
0f48d0cdecc581ccc73b11ce229c21522d23996eb4f1d88c892e6a68b7a4ea19.exepowershell.exepid process 964 0f48d0cdecc581ccc73b11ce229c21522d23996eb4f1d88c892e6a68b7a4ea19.exe 964 0f48d0cdecc581ccc73b11ce229c21522d23996eb4f1d88c892e6a68b7a4ea19.exe 2500 powershell.exe 2500 powershell.exe 2500 powershell.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes:
powershell.exevssvc.exedescription pid process Token: SeDebugPrivilege 2500 powershell.exe Token: SeBackupPrivilege 3908 vssvc.exe Token: SeRestorePrivilege 3908 vssvc.exe Token: SeAuditPrivilege 3908 vssvc.exe -
Suspicious use of WriteProcessMemory 2 IoCs
Processes:
0f48d0cdecc581ccc73b11ce229c21522d23996eb4f1d88c892e6a68b7a4ea19.exedescription pid process target process PID 964 wrote to memory of 2500 964 0f48d0cdecc581ccc73b11ce229c21522d23996eb4f1d88c892e6a68b7a4ea19.exe powershell.exe PID 964 wrote to memory of 2500 964 0f48d0cdecc581ccc73b11ce229c21522d23996eb4f1d88c892e6a68b7a4ea19.exe powershell.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\0f48d0cdecc581ccc73b11ce229c21522d23996eb4f1d88c892e6a68b7a4ea19.exe"C:\Users\Admin\AppData\Local\Temp\0f48d0cdecc581ccc73b11ce229c21522d23996eb4f1d88c892e6a68b7a4ea19.exe"1⤵
- Modifies extensions of user files
- Enumerates connected drives
- Sets desktop wallpaper using registry
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -e RwBlAHQALQBXAG0AaQBPAGIAagBlAGMAdAAgAFcAaQBuADMAMgBfAFMAaABhAGQAbwB3AGMAbwBwAHkAIAB8ACAARgBvAHIARQBhAGMAaAAtAE8AYgBqAGUAYwB0ACAAewAkAF8ALgBEAGUAbABlAHQAZQAoACkAOwB9AA==2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\wbem\unsecapp.exeC:\Windows\system32\wbem\unsecapp.exe -Embedding1⤵
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2500-123-0x000001CBEBAC0000-0x000001CBEBAE2000-memory.dmpFilesize
136KB
-
memory/2500-124-0x000001CBEB8A3000-0x000001CBEB8A5000-memory.dmpFilesize
8KB
-
memory/2500-122-0x000001CBEB8A0000-0x000001CBEB8A2000-memory.dmpFilesize
8KB
-
memory/2500-128-0x000001CBEC5B0000-0x000001CBEC626000-memory.dmpFilesize
472KB