Analysis
- max time kernel
151s - max time network
129s - platform
windows7_x64 - resource
win7-en-20211208 - submitted
01/02/2022, 15:48
Static task
static1
Behavioral task
behavioral1
Sample
31b92a2a2a6fcd58fefa3bf7471911851284cb34e5ff668b99f724c653e3d77c.exe
Resource
win7-en-20211208
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
31b92a2a2a6fcd58fefa3bf7471911851284cb34e5ff668b99f724c653e3d77c.exe
Resource
win10v2004-en-20220113
windows10-2004_x64
0 signatures
0 seconds
General
- Target 31b92a2a2a6fcd58fefa3bf7471911851284cb34e5ff668b99f724c653e3d77c.exe
- Size 592KB
- Sample220201-s8stdshaaj
- SHA256 31b92a2a2a6fcd58fefa3bf7471911851284cb34e5ff668b99f724c653e3d77c
- MD5 0febdea9572d614806a0400344694036
- SHA1 f8183db409a49712d8bc4b0200c187e0531d2b76
- SHA512 6573b7d6798a70d057c47bed1631ab9e95950cc36a4df72ce80c9956d590e4e9042ab1ca92bbf66beb16fffaefb95b3dc8f648f904d7049ade1fbf51440ffad1
- MD5 SHA1 SHA512
Score
10/10
Malware Config
Extracted
Path
-
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\ako-readme.txt
-
ako
Ransom Note
- Your network have been locked. All your files, documents, photos, databases and other important data are encrypted and have the extension: .23Hkdi Backups and shadow copies also encrypted or removed. Any third-party software may damage encrypted data but not recover. From this moment, it will be impossible to use files until they are decrypted. The only method of recovering files is to purchase an unique private key. Only we can give you this key and only we can recovery your files. To get info (decrypt your files) follow this steps: 1) Download and install Tor Browser: https://www.torproject.org/download/ 2) Open our website in TOR: http://kwvhrdibgmmpkhkidrby4mccwqpds5za6uo2thcw5gz75qncv7rbhyad.onion/40JRLFEREJ4HO8BG 3) Paste your ID in form (you can find your ID below) !! ATTENTION !! !! Any third - party software may damage encrypted data but not recover. !! DO NOT MODIFY ENCRYPTED FILES !! DO NOT CHANGE YOUR ID !! DO NOT REMOVE YOUR ID.KEY FILE --- BEGIN PERSONAL ID --- eyJleHQiOiIuMjNIa2RpIiwgImtleSI6IjZRWUFKQURHcmR6ZEoyRkF4clVQMk9 mMTE0NFI4OHdwa3hUdlhlUFIxdHVUcUU3NXllaE9GSCtQUGZkTXM1MG1nMThFa mFsNVd3M282L2M2VlIya2xtVkJqT2taQzlicFRpd3p4YkhDTDZHTm1vekpSWGJ uckpwNUdnbW5nYTZxV0plaWxleHR2MFZXaWxDVXc5NWR4R2lOQnlFQmdKc1pUM 0VTUlNscDBOa3EzcmtMUDQvdnJGakQzc0pNRGRSWGEwTjJvVEd1eXd4Um9CV2R WY2Q5UFBxRDJXeTVOaGZTU0NuVGNHTG9USUkvSUtCeFhWUUVmTzcvMmo5ZllRW UVpamUzS0VmN2N4cHBUb1oxcEppTXcyZ0c1TjFCL09MSU9JTTNPOVA3OWhjZUY 1Wkl2eURqVkMzS0JTODFjYlZsTkloN2NGUi82OEZvUEhlVHV5T1RKdz09IiwgI m5ldHdvcmsiOiJmYWxzZSIsICJzdWJpZCI6IjAiLCAidmVyIjoiMC41In0= --- END PERSONAL ID ---
URLs
-
http://kwvhrdibgmmpkhkidrby4mccwqpds5za6uo2thcw5gz75qncv7rbhyad.onion/40JRLFEREJ4HO8BG
Signatures
- Ako
Ransomware strain discovered in early 2020.
- Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
- Enumerates connected drives 3 TTPs 24 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\B: 31b92a2a2a6fcd58fefa3bf7471911851284cb34e5ff668b99f724c653e3d77c.exe File opened (read-only) \??\F: 31b92a2a2a6fcd58fefa3bf7471911851284cb34e5ff668b99f724c653e3d77c.exe File opened (read-only) \??\K: 31b92a2a2a6fcd58fefa3bf7471911851284cb34e5ff668b99f724c653e3d77c.exe File opened (read-only) \??\M: 31b92a2a2a6fcd58fefa3bf7471911851284cb34e5ff668b99f724c653e3d77c.exe File opened (read-only) \??\U: 31b92a2a2a6fcd58fefa3bf7471911851284cb34e5ff668b99f724c653e3d77c.exe File opened (read-only) \??\W: 31b92a2a2a6fcd58fefa3bf7471911851284cb34e5ff668b99f724c653e3d77c.exe File opened (read-only) \??\A: 31b92a2a2a6fcd58fefa3bf7471911851284cb34e5ff668b99f724c653e3d77c.exe File opened (read-only) \??\G: 31b92a2a2a6fcd58fefa3bf7471911851284cb34e5ff668b99f724c653e3d77c.exe File opened (read-only) \??\H: 31b92a2a2a6fcd58fefa3bf7471911851284cb34e5ff668b99f724c653e3d77c.exe File opened (read-only) \??\I: 31b92a2a2a6fcd58fefa3bf7471911851284cb34e5ff668b99f724c653e3d77c.exe File opened (read-only) \??\N: 31b92a2a2a6fcd58fefa3bf7471911851284cb34e5ff668b99f724c653e3d77c.exe File opened (read-only) \??\V: 31b92a2a2a6fcd58fefa3bf7471911851284cb34e5ff668b99f724c653e3d77c.exe File opened (read-only) \??\X: 31b92a2a2a6fcd58fefa3bf7471911851284cb34e5ff668b99f724c653e3d77c.exe File opened (read-only) \??\Z: 31b92a2a2a6fcd58fefa3bf7471911851284cb34e5ff668b99f724c653e3d77c.exe File opened (read-only) \??\J: 31b92a2a2a6fcd58fefa3bf7471911851284cb34e5ff668b99f724c653e3d77c.exe File opened (read-only) \??\O: 31b92a2a2a6fcd58fefa3bf7471911851284cb34e5ff668b99f724c653e3d77c.exe File opened (read-only) \??\P: 31b92a2a2a6fcd58fefa3bf7471911851284cb34e5ff668b99f724c653e3d77c.exe File opened (read-only) \??\R: 31b92a2a2a6fcd58fefa3bf7471911851284cb34e5ff668b99f724c653e3d77c.exe File opened (read-only) \??\S: 31b92a2a2a6fcd58fefa3bf7471911851284cb34e5ff668b99f724c653e3d77c.exe File opened (read-only) \??\T: 31b92a2a2a6fcd58fefa3bf7471911851284cb34e5ff668b99f724c653e3d77c.exe File opened (read-only) \??\E: 31b92a2a2a6fcd58fefa3bf7471911851284cb34e5ff668b99f724c653e3d77c.exe File opened (read-only) \??\L: 31b92a2a2a6fcd58fefa3bf7471911851284cb34e5ff668b99f724c653e3d77c.exe File opened (read-only) \??\Q: 31b92a2a2a6fcd58fefa3bf7471911851284cb34e5ff668b99f724c653e3d77c.exe File opened (read-only) \??\Y: 31b92a2a2a6fcd58fefa3bf7471911851284cb34e5ff668b99f724c653e3d77c.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Interacts with shadow copies 2 TTPs 3 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
pid Process 1592 vssadmin.exe 964 vssadmin.exe 1012 vssadmin.exe - Suspicious use of AdjustPrivilegeToken 63 IoCs
description pid Process Token: SeBackupPrivilege 588 vssvc.exe Token: SeRestorePrivilege 588 vssvc.exe Token: SeAuditPrivilege 588 vssvc.exe Token: SeIncreaseQuotaPrivilege 816 wmic.exe Token: SeSecurityPrivilege 816 wmic.exe Token: SeTakeOwnershipPrivilege 816 wmic.exe Token: SeLoadDriverPrivilege 816 wmic.exe Token: SeSystemProfilePrivilege 816 wmic.exe Token: SeSystemtimePrivilege 816 wmic.exe Token: SeProfSingleProcessPrivilege 816 wmic.exe Token: SeIncBasePriorityPrivilege 816 wmic.exe Token: SeCreatePagefilePrivilege 816 wmic.exe Token: SeBackupPrivilege 816 wmic.exe Token: SeRestorePrivilege 816 wmic.exe Token: SeShutdownPrivilege 816 wmic.exe Token: SeDebugPrivilege 816 wmic.exe Token: SeSystemEnvironmentPrivilege 816 wmic.exe Token: SeRemoteShutdownPrivilege 816 wmic.exe Token: SeUndockPrivilege 816 wmic.exe Token: SeManageVolumePrivilege 816 wmic.exe Token: 33 816 wmic.exe Token: 34 816 wmic.exe Token: 35 816 wmic.exe Token: SeIncreaseQuotaPrivilege 1952 wmic.exe Token: SeSecurityPrivilege 1952 wmic.exe Token: SeTakeOwnershipPrivilege 1952 wmic.exe Token: SeLoadDriverPrivilege 1952 wmic.exe Token: SeSystemProfilePrivilege 1952 wmic.exe Token: SeSystemtimePrivilege 1952 wmic.exe Token: SeProfSingleProcessPrivilege 1952 wmic.exe Token: SeIncBasePriorityPrivilege 1952 wmic.exe Token: SeCreatePagefilePrivilege 1952 wmic.exe Token: SeBackupPrivilege 1952 wmic.exe Token: SeRestorePrivilege 1952 wmic.exe Token: SeShutdownPrivilege 1952 wmic.exe Token: SeDebugPrivilege 1952 wmic.exe Token: SeSystemEnvironmentPrivilege 1952 wmic.exe Token: SeRemoteShutdownPrivilege 1952 wmic.exe Token: SeUndockPrivilege 1952 wmic.exe Token: SeManageVolumePrivilege 1952 wmic.exe Token: 33 1952 wmic.exe Token: 34 1952 wmic.exe Token: 35 1952 wmic.exe Token: SeIncreaseQuotaPrivilege 1972 wmic.exe Token: SeSecurityPrivilege 1972 wmic.exe Token: SeTakeOwnershipPrivilege 1972 wmic.exe Token: SeLoadDriverPrivilege 1972 wmic.exe Token: SeSystemProfilePrivilege 1972 wmic.exe Token: SeSystemtimePrivilege 1972 wmic.exe Token: SeProfSingleProcessPrivilege 1972 wmic.exe Token: SeIncBasePriorityPrivilege 1972 wmic.exe Token: SeCreatePagefilePrivilege 1972 wmic.exe Token: SeBackupPrivilege 1972 wmic.exe Token: SeRestorePrivilege 1972 wmic.exe Token: SeShutdownPrivilege 1972 wmic.exe Token: SeDebugPrivilege 1972 wmic.exe Token: SeSystemEnvironmentPrivilege 1972 wmic.exe Token: SeRemoteShutdownPrivilege 1972 wmic.exe Token: SeUndockPrivilege 1972 wmic.exe Token: SeManageVolumePrivilege 1972 wmic.exe Token: 33 1972 wmic.exe Token: 34 1972 wmic.exe Token: 35 1972 wmic.exe - Suspicious use of WriteProcessMemory 24 IoCs
description pid Process procid_target PID 480 wrote to memory of 964 480 31b92a2a2a6fcd58fefa3bf7471911851284cb34e5ff668b99f724c653e3d77c.exe 27 PID 480 wrote to memory of 964 480 31b92a2a2a6fcd58fefa3bf7471911851284cb34e5ff668b99f724c653e3d77c.exe 27 PID 480 wrote to memory of 964 480 31b92a2a2a6fcd58fefa3bf7471911851284cb34e5ff668b99f724c653e3d77c.exe 27 PID 480 wrote to memory of 964 480 31b92a2a2a6fcd58fefa3bf7471911851284cb34e5ff668b99f724c653e3d77c.exe 27 PID 480 wrote to memory of 816 480 31b92a2a2a6fcd58fefa3bf7471911851284cb34e5ff668b99f724c653e3d77c.exe 30 PID 480 wrote to memory of 816 480 31b92a2a2a6fcd58fefa3bf7471911851284cb34e5ff668b99f724c653e3d77c.exe 30 PID 480 wrote to memory of 816 480 31b92a2a2a6fcd58fefa3bf7471911851284cb34e5ff668b99f724c653e3d77c.exe 30 PID 480 wrote to memory of 816 480 31b92a2a2a6fcd58fefa3bf7471911851284cb34e5ff668b99f724c653e3d77c.exe 30 PID 480 wrote to memory of 1012 480 31b92a2a2a6fcd58fefa3bf7471911851284cb34e5ff668b99f724c653e3d77c.exe 32 PID 480 wrote to memory of 1012 480 31b92a2a2a6fcd58fefa3bf7471911851284cb34e5ff668b99f724c653e3d77c.exe 32 PID 480 wrote to memory of 1012 480 31b92a2a2a6fcd58fefa3bf7471911851284cb34e5ff668b99f724c653e3d77c.exe 32 PID 480 wrote to memory of 1012 480 31b92a2a2a6fcd58fefa3bf7471911851284cb34e5ff668b99f724c653e3d77c.exe 32 PID 480 wrote to memory of 1952 480 31b92a2a2a6fcd58fefa3bf7471911851284cb34e5ff668b99f724c653e3d77c.exe 34 PID 480 wrote to memory of 1952 480 31b92a2a2a6fcd58fefa3bf7471911851284cb34e5ff668b99f724c653e3d77c.exe 34 PID 480 wrote to memory of 1952 480 31b92a2a2a6fcd58fefa3bf7471911851284cb34e5ff668b99f724c653e3d77c.exe 34 PID 480 wrote to memory of 1952 480 31b92a2a2a6fcd58fefa3bf7471911851284cb34e5ff668b99f724c653e3d77c.exe 34 PID 480 wrote to memory of 1592 480 31b92a2a2a6fcd58fefa3bf7471911851284cb34e5ff668b99f724c653e3d77c.exe 36 PID 480 wrote to memory of 1592 480 31b92a2a2a6fcd58fefa3bf7471911851284cb34e5ff668b99f724c653e3d77c.exe 36 PID 480 wrote to memory of 1592 480 31b92a2a2a6fcd58fefa3bf7471911851284cb34e5ff668b99f724c653e3d77c.exe 36 PID 480 wrote to memory of 1592 480 31b92a2a2a6fcd58fefa3bf7471911851284cb34e5ff668b99f724c653e3d77c.exe 36 PID 480 wrote to memory of 1972 480 31b92a2a2a6fcd58fefa3bf7471911851284cb34e5ff668b99f724c653e3d77c.exe 38 PID 480 wrote to memory of 1972 480 31b92a2a2a6fcd58fefa3bf7471911851284cb34e5ff668b99f724c653e3d77c.exe 38 PID 480 wrote to memory of 1972 480 31b92a2a2a6fcd58fefa3bf7471911851284cb34e5ff668b99f724c653e3d77c.exe 38 PID 480 wrote to memory of 1972 480 31b92a2a2a6fcd58fefa3bf7471911851284cb34e5ff668b99f724c653e3d77c.exe 38 - System policy modification 1 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLinkedConnections = "1" 31b92a2a2a6fcd58fefa3bf7471911851284cb34e5ff668b99f724c653e3d77c.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\31b92a2a2a6fcd58fefa3bf7471911851284cb34e5ff668b99f724c653e3d77c.exe"C:\Users\Admin\AppData\Local\Temp\31b92a2a2a6fcd58fefa3bf7471911851284cb34e5ff668b99f724c653e3d77c.exe"1⤵
- Enumerates connected drives
- Suspicious use of WriteProcessMemory
- System policy modification
PID:480 -
C:\Windows\SysWOW64\vssadmin.exevssadmin.exe Delete Shadows /All /Quiet2⤵
- Interacts with shadow copies
PID:964
-
-
C:\Windows\SysWOW64\Wbem\wmic.exewmic.exe SHADOWCOPY /nointeractive2⤵
- Suspicious use of AdjustPrivilegeToken
PID:816
-
-
C:\Windows\SysWOW64\vssadmin.exevssadmin.exe Delete Shadows /All /Quiet2⤵
- Interacts with shadow copies
PID:1012
-
-
C:\Windows\SysWOW64\Wbem\wmic.exewmic.exe SHADOWCOPY /nointeractive2⤵
- Suspicious use of AdjustPrivilegeToken
PID:1952
-
-
C:\Windows\SysWOW64\vssadmin.exevssadmin.exe Delete Shadows /All /Quiet2⤵
- Interacts with shadow copies
PID:1592
-
-
C:\Windows\SysWOW64\Wbem\wmic.exewmic.exe SHADOWCOPY /nointeractive2⤵
- Suspicious use of AdjustPrivilegeToken
PID:1972
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:588