Analysis
-
max time kernel
153s -
max time network
152s -
platform
windows7_x64 -
resource
win7-en-20211208 -
submitted
01-02-2022 08:26
Static task
static1
Behavioral task
behavioral1
Sample
0a739f4ec3d096010d0cd9fc0c0631f0b080cc2aad1f720fd1883737b6a6a952.dll
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
0a739f4ec3d096010d0cd9fc0c0631f0b080cc2aad1f720fd1883737b6a6a952.dll
Resource
win10v2004-en-20220113
General
-
Target
0a739f4ec3d096010d0cd9fc0c0631f0b080cc2aad1f720fd1883737b6a6a952.dll
-
Size
693KB
-
MD5
b7ad5f7ec71dc812b4771950671b192a
-
SHA1
cf02d630465eaf009db8bcc8a0dd4242a1d2dd82
-
SHA256
0a739f4ec3d096010d0cd9fc0c0631f0b080cc2aad1f720fd1883737b6a6a952
-
SHA512
5dd1d8e840b56f35cc06dd826aa335fec131ad202ccbb572c88b4dd4b630a291453df7c0fbfee2229ea7f4d2810a73a752ca8657c505f383974736a5f1f75369
Malware Config
Extracted
C:\RECOVER-FILES.txt
sekhmet
http://o3n4bhhtybbtwqqs.onion/703D833179A6EEC2
https://sekhmet.top/703D833179A6EEC2
Signatures
-
Sekhmet Ransomware
Ransomware family active in the wild since early 2020.
-
suricata: ET MALWARE Sekhmet Ransomware CnC Activity
suricata: ET MALWARE Sekhmet Ransomware CnC Activity
-
Modifies extensions of user files 4 IoCs
Ransomware generally changes the extension on encrypted files.
Processes:
regsvr32.exedescription ioc Process File renamed C:\Users\Admin\Pictures\FormatProtect.tif => C:\Users\Admin\Pictures\FormatProtect.tif.SnbzV regsvr32.exe File renamed C:\Users\Admin\Pictures\FormatSplit.crw => C:\Users\Admin\Pictures\FormatSplit.crw.SnbzV regsvr32.exe File renamed C:\Users\Admin\Pictures\SwitchConvert.raw => C:\Users\Admin\Pictures\SwitchConvert.raw.SnbzV regsvr32.exe File renamed C:\Users\Admin\Pictures\UnpublishReset.raw => C:\Users\Admin\Pictures\UnpublishReset.raw.otDLjT regsvr32.exe -
Drops startup file 2 IoCs
Processes:
regsvr32.exedescription ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\e6189640.lnk regsvr32.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\RECOVER-FILES.txt regsvr32.exe -
Drops file in Program Files directory 10 IoCs
Processes:
regsvr32.exedescription ioc Process File created C:\Program Files (x86)\e6189640.lnk regsvr32.exe File created C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\RECOVER-FILES.txt regsvr32.exe File created C:\Program Files (x86)\RECOVER-FILES.txt regsvr32.exe File created C:\Program Files (x86)\Microsoft SQL Server Compact Edition\e6189640.lnk regsvr32.exe File created C:\Program Files (x86)\Microsoft SQL Server Compact Edition\RECOVER-FILES.txt regsvr32.exe File created C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\e6189640.lnk regsvr32.exe File created C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\Desktop\e6189640.lnk regsvr32.exe File created C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\Desktop\RECOVER-FILES.txt regsvr32.exe File created C:\Program Files\e6189640.lnk regsvr32.exe File created C:\Program Files\RECOVER-FILES.txt regsvr32.exe -
Drops file in Windows directory 2 IoCs
Processes:
regsvr32.exedescription ioc Process File created C:\Windows\e6189640.lnk regsvr32.exe File created C:\Windows\RECOVER-FILES.txt regsvr32.exe -
Suspicious behavior: EnumeratesProcesses 29 IoCs
Processes:
regsvr32.exepid Process 1720 regsvr32.exe 1720 regsvr32.exe 1720 regsvr32.exe 1720 regsvr32.exe 1720 regsvr32.exe 1720 regsvr32.exe 1720 regsvr32.exe 1720 regsvr32.exe 1720 regsvr32.exe 1720 regsvr32.exe 1720 regsvr32.exe 1720 regsvr32.exe 1720 regsvr32.exe 1720 regsvr32.exe 1720 regsvr32.exe 1720 regsvr32.exe 1720 regsvr32.exe 1720 regsvr32.exe 1720 regsvr32.exe 1720 regsvr32.exe 1720 regsvr32.exe 1720 regsvr32.exe 1720 regsvr32.exe 1720 regsvr32.exe 1720 regsvr32.exe 1720 regsvr32.exe 1720 regsvr32.exe 1720 regsvr32.exe 1720 regsvr32.exe -
Suspicious use of AdjustPrivilegeToken 8 IoCs
Processes:
vssvc.exeregsvr32.exedescription pid Process Token: SeBackupPrivilege 1204 vssvc.exe Token: SeRestorePrivilege 1204 vssvc.exe Token: SeAuditPrivilege 1204 vssvc.exe Token: SeDebugPrivilege 1720 regsvr32.exe Token: SeDebugPrivilege 1720 regsvr32.exe Token: SeDebugPrivilege 1720 regsvr32.exe Token: SeDebugPrivilege 1720 regsvr32.exe Token: SeDebugPrivilege 1720 regsvr32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
Processes:
regsvr32.exedescription pid Process procid_target PID 1092 wrote to memory of 1720 1092 regsvr32.exe 27 PID 1092 wrote to memory of 1720 1092 regsvr32.exe 27 PID 1092 wrote to memory of 1720 1092 regsvr32.exe 27 PID 1092 wrote to memory of 1720 1092 regsvr32.exe 27 PID 1092 wrote to memory of 1720 1092 regsvr32.exe 27 PID 1092 wrote to memory of 1720 1092 regsvr32.exe 27 PID 1092 wrote to memory of 1720 1092 regsvr32.exe 27
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\0a739f4ec3d096010d0cd9fc0c0631f0b080cc2aad1f720fd1883737b6a6a952.dll1⤵
- Suspicious use of WriteProcessMemory
PID:1092 -
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\0a739f4ec3d096010d0cd9fc0c0631f0b080cc2aad1f720fd1883737b6a6a952.dll2⤵
- Modifies extensions of user files
- Drops startup file
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1720
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1204