Analysis
- max time kernel
151s - max time network
142s - platform
windows7_x64 - resource
win7-en-20211208 - submitted
01/02/2022, 15:37
Static task
static1
Behavioral task
behavioral1
Sample
853f52243ffdb3d14c9657b923e8d6ef6accf14c43a758e47e0df33e775883a6.exe
Resource
win7-en-20211208
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
853f52243ffdb3d14c9657b923e8d6ef6accf14c43a758e47e0df33e775883a6.exe
Resource
win10v2004-en-20220113
windows10-2004_x64
0 signatures
0 seconds
General
- Target 853f52243ffdb3d14c9657b923e8d6ef6accf14c43a758e47e0df33e775883a6.exe
- Size 233KB
- Sample220201-s2tr4shbf2
- SHA256 853f52243ffdb3d14c9657b923e8d6ef6accf14c43a758e47e0df33e775883a6
- MD5 4c652960619ffa387d73bc9f5dce133b
- SHA1 e8e19ec198e7b870d9ee5775140dafdfe73001da
- SHA512 8a9f868c40d183fc52ef985cee8a6d5df93f6c34c1e4856893cf91654be48f96fe9805c54a5c8a46a1442ec158c1dcedb7c77e53604a1c7d9439fd66c4eeef67
- MD5 SHA1 SHA512
Score
10/10
Malware Config
Extracted
Path
-
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\ako-readme.txt
-
ako
Ransom Note
- Your network have been locked. All your files, documents, photos, databases and other important data are encrypted and have the extension: .c0A6vQ Backups and shadow copies also encrypted or removed. Any third-party software may damage encrypted data but not recover. From this moment, it will be impossible to use files until they are decrypted. The only method of recovering files is to purchase an unique private key. Only we can give you this key and only we can recovery your files. To get info (decrypt your files) follow this steps: 1) Download and install Tor Browser: https://www.torproject.org/download/ 2) Open our website in TOR: http://kwvhrdibgmmpkhkidrby4mccwqpds5za6uo2thcw5gz75qncv7rbhyad.onion/U0T9NR3RCU3PNABN 3) Paste your ID in form (you can find your ID below) !! ATTENTION !! !! Any third - party software may damage encrypted data but not recover. !! DO NOT MODIFY ENCRYPTED FILES !! DO NOT CHANGE YOUR ID !! DO NOT REMOVE YOUR ID.KEY FILE --- BEGIN PERSONAL ID --- eyJleHQiOiIuYzBBNnZRIiwgImtleSI6ImF6R2VzWXROWXpOWDFTOVBpZm5icG1 wRWNBTnZzQ2RuZjErTmNpa2p2cWVIcXRTTkp4b1hnZktCbTJJb2l3TEF3M21uQ 0FJVTlkb2s0eEZLZEh4WGFMSEdZNCtvd0syTkxuZy9Hc3Y1aXhYYzAvL0QvWWF YMzYvWk11MmEvTXd4SkxHaTFOcVQrcmtoMEZiVDZWL0kyLzVIWWFRTWE0NU9ma 1dNazhJV2prN3d5dFg3bFNEZG5LbTVRKzNvbHpOSHgwVUprS0krSVVNRmlNNC8 xRjF3ZFpKZm9xVXhUR2JWU2E0MVJTQm9IWUJuckNFZ2ZGT09HMDFJZzhDdm16Z XFZL1BYeG9KMUZyMlVmb1BDMUh1cDQ0MTU4aTVaWWMvc1IzRndMVjlQaVorOC9 IVnBTUVNoV21aMlBncWdqVDZYc1hzbU5BRDQzdTRsd09YRXRTTmVnUT09IiwgI m5ldHdvcmsiOiJmYWxzZSIsICJzdWJpZCI6IjAiLCAidmVyIjoiMC41In0= --- END PERSONAL ID ---
URLs
-
http://kwvhrdibgmmpkhkidrby4mccwqpds5za6uo2thcw5gz75qncv7rbhyad.onion/U0T9NR3RCU3PNABN
Signatures
- Ako
Ransomware strain discovered in early 2020.
- Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
- Enumerates connected drives 3 TTPs 24 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\L: 853f52243ffdb3d14c9657b923e8d6ef6accf14c43a758e47e0df33e775883a6.exe File opened (read-only) \??\S: 853f52243ffdb3d14c9657b923e8d6ef6accf14c43a758e47e0df33e775883a6.exe File opened (read-only) \??\X: 853f52243ffdb3d14c9657b923e8d6ef6accf14c43a758e47e0df33e775883a6.exe File opened (read-only) \??\E: 853f52243ffdb3d14c9657b923e8d6ef6accf14c43a758e47e0df33e775883a6.exe File opened (read-only) \??\I: 853f52243ffdb3d14c9657b923e8d6ef6accf14c43a758e47e0df33e775883a6.exe File opened (read-only) \??\G: 853f52243ffdb3d14c9657b923e8d6ef6accf14c43a758e47e0df33e775883a6.exe File opened (read-only) \??\K: 853f52243ffdb3d14c9657b923e8d6ef6accf14c43a758e47e0df33e775883a6.exe File opened (read-only) \??\N: 853f52243ffdb3d14c9657b923e8d6ef6accf14c43a758e47e0df33e775883a6.exe File opened (read-only) \??\P: 853f52243ffdb3d14c9657b923e8d6ef6accf14c43a758e47e0df33e775883a6.exe File opened (read-only) \??\Q: 853f52243ffdb3d14c9657b923e8d6ef6accf14c43a758e47e0df33e775883a6.exe File opened (read-only) \??\U: 853f52243ffdb3d14c9657b923e8d6ef6accf14c43a758e47e0df33e775883a6.exe File opened (read-only) \??\B: 853f52243ffdb3d14c9657b923e8d6ef6accf14c43a758e47e0df33e775883a6.exe File opened (read-only) \??\F: 853f52243ffdb3d14c9657b923e8d6ef6accf14c43a758e47e0df33e775883a6.exe File opened (read-only) \??\Z: 853f52243ffdb3d14c9657b923e8d6ef6accf14c43a758e47e0df33e775883a6.exe File opened (read-only) \??\M: 853f52243ffdb3d14c9657b923e8d6ef6accf14c43a758e47e0df33e775883a6.exe File opened (read-only) \??\O: 853f52243ffdb3d14c9657b923e8d6ef6accf14c43a758e47e0df33e775883a6.exe File opened (read-only) \??\R: 853f52243ffdb3d14c9657b923e8d6ef6accf14c43a758e47e0df33e775883a6.exe File opened (read-only) \??\W: 853f52243ffdb3d14c9657b923e8d6ef6accf14c43a758e47e0df33e775883a6.exe File opened (read-only) \??\Y: 853f52243ffdb3d14c9657b923e8d6ef6accf14c43a758e47e0df33e775883a6.exe File opened (read-only) \??\A: 853f52243ffdb3d14c9657b923e8d6ef6accf14c43a758e47e0df33e775883a6.exe File opened (read-only) \??\H: 853f52243ffdb3d14c9657b923e8d6ef6accf14c43a758e47e0df33e775883a6.exe File opened (read-only) \??\V: 853f52243ffdb3d14c9657b923e8d6ef6accf14c43a758e47e0df33e775883a6.exe File opened (read-only) \??\J: 853f52243ffdb3d14c9657b923e8d6ef6accf14c43a758e47e0df33e775883a6.exe File opened (read-only) \??\T: 853f52243ffdb3d14c9657b923e8d6ef6accf14c43a758e47e0df33e775883a6.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Interacts with shadow copies 2 TTPs 3 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
pid Process 1108 vssadmin.exe 1092 vssadmin.exe 1820 vssadmin.exe - Suspicious use of AdjustPrivilegeToken 63 IoCs
description pid Process Token: SeBackupPrivilege 876 vssvc.exe Token: SeRestorePrivilege 876 vssvc.exe Token: SeAuditPrivilege 876 vssvc.exe Token: SeIncreaseQuotaPrivilege 564 wmic.exe Token: SeSecurityPrivilege 564 wmic.exe Token: SeTakeOwnershipPrivilege 564 wmic.exe Token: SeLoadDriverPrivilege 564 wmic.exe Token: SeSystemProfilePrivilege 564 wmic.exe Token: SeSystemtimePrivilege 564 wmic.exe Token: SeProfSingleProcessPrivilege 564 wmic.exe Token: SeIncBasePriorityPrivilege 564 wmic.exe Token: SeCreatePagefilePrivilege 564 wmic.exe Token: SeBackupPrivilege 564 wmic.exe Token: SeRestorePrivilege 564 wmic.exe Token: SeShutdownPrivilege 564 wmic.exe Token: SeDebugPrivilege 564 wmic.exe Token: SeSystemEnvironmentPrivilege 564 wmic.exe Token: SeRemoteShutdownPrivilege 564 wmic.exe Token: SeUndockPrivilege 564 wmic.exe Token: SeManageVolumePrivilege 564 wmic.exe Token: 33 564 wmic.exe Token: 34 564 wmic.exe Token: 35 564 wmic.exe Token: SeIncreaseQuotaPrivilege 1996 wmic.exe Token: SeSecurityPrivilege 1996 wmic.exe Token: SeTakeOwnershipPrivilege 1996 wmic.exe Token: SeLoadDriverPrivilege 1996 wmic.exe Token: SeSystemProfilePrivilege 1996 wmic.exe Token: SeSystemtimePrivilege 1996 wmic.exe Token: SeProfSingleProcessPrivilege 1996 wmic.exe Token: SeIncBasePriorityPrivilege 1996 wmic.exe Token: SeCreatePagefilePrivilege 1996 wmic.exe Token: SeBackupPrivilege 1996 wmic.exe Token: SeRestorePrivilege 1996 wmic.exe Token: SeShutdownPrivilege 1996 wmic.exe Token: SeDebugPrivilege 1996 wmic.exe Token: SeSystemEnvironmentPrivilege 1996 wmic.exe Token: SeRemoteShutdownPrivilege 1996 wmic.exe Token: SeUndockPrivilege 1996 wmic.exe Token: SeManageVolumePrivilege 1996 wmic.exe Token: 33 1996 wmic.exe Token: 34 1996 wmic.exe Token: 35 1996 wmic.exe Token: SeIncreaseQuotaPrivilege 1688 wmic.exe Token: SeSecurityPrivilege 1688 wmic.exe Token: SeTakeOwnershipPrivilege 1688 wmic.exe Token: SeLoadDriverPrivilege 1688 wmic.exe Token: SeSystemProfilePrivilege 1688 wmic.exe Token: SeSystemtimePrivilege 1688 wmic.exe Token: SeProfSingleProcessPrivilege 1688 wmic.exe Token: SeIncBasePriorityPrivilege 1688 wmic.exe Token: SeCreatePagefilePrivilege 1688 wmic.exe Token: SeBackupPrivilege 1688 wmic.exe Token: SeRestorePrivilege 1688 wmic.exe Token: SeShutdownPrivilege 1688 wmic.exe Token: SeDebugPrivilege 1688 wmic.exe Token: SeSystemEnvironmentPrivilege 1688 wmic.exe Token: SeRemoteShutdownPrivilege 1688 wmic.exe Token: SeUndockPrivilege 1688 wmic.exe Token: SeManageVolumePrivilege 1688 wmic.exe Token: 33 1688 wmic.exe Token: 34 1688 wmic.exe Token: 35 1688 wmic.exe - Suspicious use of WriteProcessMemory 24 IoCs
description pid Process procid_target PID 1848 wrote to memory of 1108 1848 853f52243ffdb3d14c9657b923e8d6ef6accf14c43a758e47e0df33e775883a6.exe 27 PID 1848 wrote to memory of 1108 1848 853f52243ffdb3d14c9657b923e8d6ef6accf14c43a758e47e0df33e775883a6.exe 27 PID 1848 wrote to memory of 1108 1848 853f52243ffdb3d14c9657b923e8d6ef6accf14c43a758e47e0df33e775883a6.exe 27 PID 1848 wrote to memory of 1108 1848 853f52243ffdb3d14c9657b923e8d6ef6accf14c43a758e47e0df33e775883a6.exe 27 PID 1848 wrote to memory of 564 1848 853f52243ffdb3d14c9657b923e8d6ef6accf14c43a758e47e0df33e775883a6.exe 30 PID 1848 wrote to memory of 564 1848 853f52243ffdb3d14c9657b923e8d6ef6accf14c43a758e47e0df33e775883a6.exe 30 PID 1848 wrote to memory of 564 1848 853f52243ffdb3d14c9657b923e8d6ef6accf14c43a758e47e0df33e775883a6.exe 30 PID 1848 wrote to memory of 564 1848 853f52243ffdb3d14c9657b923e8d6ef6accf14c43a758e47e0df33e775883a6.exe 30 PID 1848 wrote to memory of 1092 1848 853f52243ffdb3d14c9657b923e8d6ef6accf14c43a758e47e0df33e775883a6.exe 32 PID 1848 wrote to memory of 1092 1848 853f52243ffdb3d14c9657b923e8d6ef6accf14c43a758e47e0df33e775883a6.exe 32 PID 1848 wrote to memory of 1092 1848 853f52243ffdb3d14c9657b923e8d6ef6accf14c43a758e47e0df33e775883a6.exe 32 PID 1848 wrote to memory of 1092 1848 853f52243ffdb3d14c9657b923e8d6ef6accf14c43a758e47e0df33e775883a6.exe 32 PID 1848 wrote to memory of 1996 1848 853f52243ffdb3d14c9657b923e8d6ef6accf14c43a758e47e0df33e775883a6.exe 34 PID 1848 wrote to memory of 1996 1848 853f52243ffdb3d14c9657b923e8d6ef6accf14c43a758e47e0df33e775883a6.exe 34 PID 1848 wrote to memory of 1996 1848 853f52243ffdb3d14c9657b923e8d6ef6accf14c43a758e47e0df33e775883a6.exe 34 PID 1848 wrote to memory of 1996 1848 853f52243ffdb3d14c9657b923e8d6ef6accf14c43a758e47e0df33e775883a6.exe 34 PID 1848 wrote to memory of 1820 1848 853f52243ffdb3d14c9657b923e8d6ef6accf14c43a758e47e0df33e775883a6.exe 36 PID 1848 wrote to memory of 1820 1848 853f52243ffdb3d14c9657b923e8d6ef6accf14c43a758e47e0df33e775883a6.exe 36 PID 1848 wrote to memory of 1820 1848 853f52243ffdb3d14c9657b923e8d6ef6accf14c43a758e47e0df33e775883a6.exe 36 PID 1848 wrote to memory of 1820 1848 853f52243ffdb3d14c9657b923e8d6ef6accf14c43a758e47e0df33e775883a6.exe 36 PID 1848 wrote to memory of 1688 1848 853f52243ffdb3d14c9657b923e8d6ef6accf14c43a758e47e0df33e775883a6.exe 38 PID 1848 wrote to memory of 1688 1848 853f52243ffdb3d14c9657b923e8d6ef6accf14c43a758e47e0df33e775883a6.exe 38 PID 1848 wrote to memory of 1688 1848 853f52243ffdb3d14c9657b923e8d6ef6accf14c43a758e47e0df33e775883a6.exe 38 PID 1848 wrote to memory of 1688 1848 853f52243ffdb3d14c9657b923e8d6ef6accf14c43a758e47e0df33e775883a6.exe 38 - System policy modification 1 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLinkedConnections = "1" 853f52243ffdb3d14c9657b923e8d6ef6accf14c43a758e47e0df33e775883a6.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\853f52243ffdb3d14c9657b923e8d6ef6accf14c43a758e47e0df33e775883a6.exe"C:\Users\Admin\AppData\Local\Temp\853f52243ffdb3d14c9657b923e8d6ef6accf14c43a758e47e0df33e775883a6.exe"1⤵
- Enumerates connected drives
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1848 -
C:\Windows\SysWOW64\vssadmin.exevssadmin.exe Delete Shadows /All /Quiet2⤵
- Interacts with shadow copies
PID:1108
-
-
C:\Windows\SysWOW64\Wbem\wmic.exewmic.exe SHADOWCOPY /nointeractive2⤵
- Suspicious use of AdjustPrivilegeToken
PID:564
-
-
C:\Windows\SysWOW64\vssadmin.exevssadmin.exe Delete Shadows /All /Quiet2⤵
- Interacts with shadow copies
PID:1092
-
-
C:\Windows\SysWOW64\Wbem\wmic.exewmic.exe SHADOWCOPY /nointeractive2⤵
- Suspicious use of AdjustPrivilegeToken
PID:1996
-
-
C:\Windows\SysWOW64\vssadmin.exevssadmin.exe Delete Shadows /All /Quiet2⤵
- Interacts with shadow copies
PID:1820
-
-
C:\Windows\SysWOW64\Wbem\wmic.exewmic.exe SHADOWCOPY /nointeractive2⤵
- Suspicious use of AdjustPrivilegeToken
PID:1688
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:876