Analysis
- max time kernel
184s - max time network
170s - platform
windows10-2004_x64 - resource
win10v2004-en-20220113 - submitted
01/02/2022, 15:37
Static task
static1
Behavioral task
behavioral1
Sample
853f52243ffdb3d14c9657b923e8d6ef6accf14c43a758e47e0df33e775883a6.exe
Resource
win7-en-20211208
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
853f52243ffdb3d14c9657b923e8d6ef6accf14c43a758e47e0df33e775883a6.exe
Resource
win10v2004-en-20220113
windows10-2004_x64
0 signatures
0 seconds
General
- Target 853f52243ffdb3d14c9657b923e8d6ef6accf14c43a758e47e0df33e775883a6.exe
- Size 233KB
- Sample220201-s2tr4shbf2
- SHA256 853f52243ffdb3d14c9657b923e8d6ef6accf14c43a758e47e0df33e775883a6
- MD5 4c652960619ffa387d73bc9f5dce133b
- SHA1 e8e19ec198e7b870d9ee5775140dafdfe73001da
- SHA512 8a9f868c40d183fc52ef985cee8a6d5df93f6c34c1e4856893cf91654be48f96fe9805c54a5c8a46a1442ec158c1dcedb7c77e53604a1c7d9439fd66c4eeef67
- MD5 SHA1 SHA512
Score
10/10
Malware Config
Extracted
Path
-
C:\ako-readme.txt
-
ako
Ransom Note
- Your network have been locked. All your files, documents, photos, databases and other important data are encrypted and have the extension: .l0h2oh Backups and shadow copies also encrypted or removed. Any third-party software may damage encrypted data but not recover. From this moment, it will be impossible to use files until they are decrypted. The only method of recovering files is to purchase an unique private key. Only we can give you this key and only we can recovery your files. To get info (decrypt your files) follow this steps: 1) Download and install Tor Browser: https://www.torproject.org/download/ 2) Open our website in TOR: http://kwvhrdibgmmpkhkidrby4mccwqpds5za6uo2thcw5gz75qncv7rbhyad.onion/U0T9NR3RCU3PNABN 3) Paste your ID in form (you can find your ID below) !! ATTENTION !! !! Any third - party software may damage encrypted data but not recover. !! DO NOT MODIFY ENCRYPTED FILES !! DO NOT CHANGE YOUR ID !! DO NOT REMOVE YOUR ID.KEY FILE --- BEGIN PERSONAL ID --- eyJleHQiOiIubDBoMm9oIiwgImtleSI6IlB1RE9LTzZQejhWVHFhVFBCY1hBQm5 YT3d6VUZXcjFoeVJ1WjNHVmYxaTBKVWsyOVFXTjlrZmhoTi8rbjFyZzFOcE9JZ FNlaFpnWWNsbSs3ODdZY2J0UENOS2N6TVdRMXkzZEtsVUYwTFRSR2ZzOFNlaGZ xZ0pqNURRMWsxR0lsZ0JtRW1qNnk3Z2pGRytWb0NpR1dEQU45WEtqRWR3ZEE2b EFlbXIvVlViRzhINjdKTE5lUUhnM0lBem8rUDZveVI0NUNYekJUZlFPNmZLQXg 0Ulh6dm9sQUtnUEVPUVhPV3B1b3RPcVVCV2hkZEMxaEpKbkdHN2NhZCtqYXFLY XNlRGhwV1k4U1lpRm5zelptTjAvTVVPTHp5dzJwUVgreVFYN3ZPYU9HWFNraVM 3SjZ0ei9zYzNMU3hvbTh6anZCUkRrN1FldUFSL25PVEZHUDN2cE91dz09IiwgI m5ldHdvcmsiOiJmYWxzZSIsICJzdWJpZCI6IjAiLCAidmVyIjoiMC41In0= --- END PERSONAL ID ---
URLs
-
http://kwvhrdibgmmpkhkidrby4mccwqpds5za6uo2thcw5gz75qncv7rbhyad.onion/U0T9NR3RCU3PNABN
Signatures
- Ako
Ransomware strain discovered in early 2020.
- Sets service image path in registry 2 TTPs
- Enumerates connected drives 3 TTPs 24 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\G: 853f52243ffdb3d14c9657b923e8d6ef6accf14c43a758e47e0df33e775883a6.exe File opened (read-only) \??\H: 853f52243ffdb3d14c9657b923e8d6ef6accf14c43a758e47e0df33e775883a6.exe File opened (read-only) \??\I: 853f52243ffdb3d14c9657b923e8d6ef6accf14c43a758e47e0df33e775883a6.exe File opened (read-only) \??\U: 853f52243ffdb3d14c9657b923e8d6ef6accf14c43a758e47e0df33e775883a6.exe File opened (read-only) \??\X: 853f52243ffdb3d14c9657b923e8d6ef6accf14c43a758e47e0df33e775883a6.exe File opened (read-only) \??\N: 853f52243ffdb3d14c9657b923e8d6ef6accf14c43a758e47e0df33e775883a6.exe File opened (read-only) \??\T: 853f52243ffdb3d14c9657b923e8d6ef6accf14c43a758e47e0df33e775883a6.exe File opened (read-only) \??\W: 853f52243ffdb3d14c9657b923e8d6ef6accf14c43a758e47e0df33e775883a6.exe File opened (read-only) \??\Z: 853f52243ffdb3d14c9657b923e8d6ef6accf14c43a758e47e0df33e775883a6.exe File opened (read-only) \??\A: 853f52243ffdb3d14c9657b923e8d6ef6accf14c43a758e47e0df33e775883a6.exe File opened (read-only) \??\B: 853f52243ffdb3d14c9657b923e8d6ef6accf14c43a758e47e0df33e775883a6.exe File opened (read-only) \??\K: 853f52243ffdb3d14c9657b923e8d6ef6accf14c43a758e47e0df33e775883a6.exe File opened (read-only) \??\M: 853f52243ffdb3d14c9657b923e8d6ef6accf14c43a758e47e0df33e775883a6.exe File opened (read-only) \??\P: 853f52243ffdb3d14c9657b923e8d6ef6accf14c43a758e47e0df33e775883a6.exe File opened (read-only) \??\Q: 853f52243ffdb3d14c9657b923e8d6ef6accf14c43a758e47e0df33e775883a6.exe File opened (read-only) \??\V: 853f52243ffdb3d14c9657b923e8d6ef6accf14c43a758e47e0df33e775883a6.exe File opened (read-only) \??\E: 853f52243ffdb3d14c9657b923e8d6ef6accf14c43a758e47e0df33e775883a6.exe File opened (read-only) \??\F: 853f52243ffdb3d14c9657b923e8d6ef6accf14c43a758e47e0df33e775883a6.exe File opened (read-only) \??\J: 853f52243ffdb3d14c9657b923e8d6ef6accf14c43a758e47e0df33e775883a6.exe File opened (read-only) \??\L: 853f52243ffdb3d14c9657b923e8d6ef6accf14c43a758e47e0df33e775883a6.exe File opened (read-only) \??\O: 853f52243ffdb3d14c9657b923e8d6ef6accf14c43a758e47e0df33e775883a6.exe File opened (read-only) \??\R: 853f52243ffdb3d14c9657b923e8d6ef6accf14c43a758e47e0df33e775883a6.exe File opened (read-only) \??\S: 853f52243ffdb3d14c9657b923e8d6ef6accf14c43a758e47e0df33e775883a6.exe File opened (read-only) \??\Y: 853f52243ffdb3d14c9657b923e8d6ef6accf14c43a758e47e0df33e775883a6.exe - Drops file in Windows directory 6 IoCs
description ioc Process File opened for modification C:\Windows\WindowsUpdate.log svchost.exe File opened for modification C:\Windows\SoftwareDistribution\DataStore\Logs\edb.chk svchost.exe File opened for modification C:\Windows\SoftwareDistribution\DataStore\Logs\edb.log svchost.exe File opened for modification C:\Windows\SoftwareDistribution\DataStore\DataStore.edb svchost.exe File opened for modification C:\Windows\SoftwareDistribution\DataStore\DataStore.jfm svchost.exe File opened for modification C:\Windows\SoftwareDistribution\ReportingEvents.log svchost.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Modifies data under HKEY_USERS 41 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates WaaSMedicAgent.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 1556 wmic.exe Token: SeSecurityPrivilege 1556 wmic.exe Token: SeTakeOwnershipPrivilege 1556 wmic.exe Token: SeLoadDriverPrivilege 1556 wmic.exe Token: SeSystemProfilePrivilege 1556 wmic.exe Token: SeSystemtimePrivilege 1556 wmic.exe Token: SeProfSingleProcessPrivilege 1556 wmic.exe Token: SeIncBasePriorityPrivilege 1556 wmic.exe Token: SeCreatePagefilePrivilege 1556 wmic.exe Token: SeBackupPrivilege 1556 wmic.exe Token: SeRestorePrivilege 1556 wmic.exe Token: SeShutdownPrivilege 1556 wmic.exe Token: SeDebugPrivilege 1556 wmic.exe Token: SeSystemEnvironmentPrivilege 1556 wmic.exe Token: SeRemoteShutdownPrivilege 1556 wmic.exe Token: SeUndockPrivilege 1556 wmic.exe Token: SeManageVolumePrivilege 1556 wmic.exe Token: 33 1556 wmic.exe Token: 34 1556 wmic.exe Token: 35 1556 wmic.exe Token: 36 1556 wmic.exe Token: SeIncreaseQuotaPrivilege 3564 wmic.exe Token: SeSecurityPrivilege 3564 wmic.exe Token: SeTakeOwnershipPrivilege 3564 wmic.exe Token: SeLoadDriverPrivilege 3564 wmic.exe Token: SeSystemProfilePrivilege 3564 wmic.exe Token: SeSystemtimePrivilege 3564 wmic.exe Token: SeProfSingleProcessPrivilege 3564 wmic.exe Token: SeIncBasePriorityPrivilege 3564 wmic.exe Token: SeCreatePagefilePrivilege 3564 wmic.exe Token: SeBackupPrivilege 3564 wmic.exe Token: SeRestorePrivilege 3564 wmic.exe Token: SeShutdownPrivilege 3564 wmic.exe Token: SeDebugPrivilege 3564 wmic.exe Token: SeSystemEnvironmentPrivilege 3564 wmic.exe Token: SeRemoteShutdownPrivilege 3564 wmic.exe Token: SeUndockPrivilege 3564 wmic.exe Token: SeManageVolumePrivilege 3564 wmic.exe Token: 33 3564 wmic.exe Token: 34 3564 wmic.exe Token: 35 3564 wmic.exe Token: 36 3564 wmic.exe Token: SeIncreaseQuotaPrivilege 3108 wmic.exe Token: SeSecurityPrivilege 3108 wmic.exe Token: SeTakeOwnershipPrivilege 3108 wmic.exe Token: SeLoadDriverPrivilege 3108 wmic.exe Token: SeSystemProfilePrivilege 3108 wmic.exe Token: SeSystemtimePrivilege 3108 wmic.exe Token: SeProfSingleProcessPrivilege 3108 wmic.exe Token: SeIncBasePriorityPrivilege 3108 wmic.exe Token: SeCreatePagefilePrivilege 3108 wmic.exe Token: SeBackupPrivilege 3108 wmic.exe Token: SeRestorePrivilege 3108 wmic.exe Token: SeShutdownPrivilege 3108 wmic.exe Token: SeDebugPrivilege 3108 wmic.exe Token: SeSystemEnvironmentPrivilege 3108 wmic.exe Token: SeRemoteShutdownPrivilege 3108 wmic.exe Token: SeUndockPrivilege 3108 wmic.exe Token: SeManageVolumePrivilege 3108 wmic.exe Token: 33 3108 wmic.exe Token: 34 3108 wmic.exe Token: 35 3108 wmic.exe Token: 36 3108 wmic.exe Token: SeShutdownPrivilege 2516 svchost.exe - Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 2848 wrote to memory of 1556 2848 853f52243ffdb3d14c9657b923e8d6ef6accf14c43a758e47e0df33e775883a6.exe 86 PID 2848 wrote to memory of 1556 2848 853f52243ffdb3d14c9657b923e8d6ef6accf14c43a758e47e0df33e775883a6.exe 86 PID 2848 wrote to memory of 1556 2848 853f52243ffdb3d14c9657b923e8d6ef6accf14c43a758e47e0df33e775883a6.exe 86 PID 2848 wrote to memory of 3564 2848 853f52243ffdb3d14c9657b923e8d6ef6accf14c43a758e47e0df33e775883a6.exe 88 PID 2848 wrote to memory of 3564 2848 853f52243ffdb3d14c9657b923e8d6ef6accf14c43a758e47e0df33e775883a6.exe 88 PID 2848 wrote to memory of 3564 2848 853f52243ffdb3d14c9657b923e8d6ef6accf14c43a758e47e0df33e775883a6.exe 88 PID 2848 wrote to memory of 3108 2848 853f52243ffdb3d14c9657b923e8d6ef6accf14c43a758e47e0df33e775883a6.exe 90 PID 2848 wrote to memory of 3108 2848 853f52243ffdb3d14c9657b923e8d6ef6accf14c43a758e47e0df33e775883a6.exe 90 PID 2848 wrote to memory of 3108 2848 853f52243ffdb3d14c9657b923e8d6ef6accf14c43a758e47e0df33e775883a6.exe 90 - System policy modification 1 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLinkedConnections = "1" 853f52243ffdb3d14c9657b923e8d6ef6accf14c43a758e47e0df33e775883a6.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\853f52243ffdb3d14c9657b923e8d6ef6accf14c43a758e47e0df33e775883a6.exe"C:\Users\Admin\AppData\Local\Temp\853f52243ffdb3d14c9657b923e8d6ef6accf14c43a758e47e0df33e775883a6.exe"1⤵
- Enumerates connected drives
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2848 -
C:\Windows\SysWOW64\Wbem\wmic.exewmic.exe SHADOWCOPY /nointeractive2⤵
- Suspicious use of AdjustPrivilegeToken
PID:1556
-
-
C:\Windows\SysWOW64\Wbem\wmic.exewmic.exe SHADOWCOPY /nointeractive2⤵
- Suspicious use of AdjustPrivilegeToken
PID:3564
-
-
C:\Windows\SysWOW64\Wbem\wmic.exewmic.exe SHADOWCOPY /nointeractive2⤵
- Suspicious use of AdjustPrivilegeToken
PID:3108
-
-
C:\Windows\System32\WaaSMedicAgent.exeC:\Windows\System32\WaaSMedicAgent.exe b4a887ab5ef6e1ffd04f3c1bf96c0f1a LDYsgnA3jkCrwiQahBABGA.0.1.0.0.01⤵
- Modifies data under HKEY_USERS
PID:5056
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s wuauserv1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:2516