Analysis
- max time kernel
177s - max time network
180s - platform
windows10-2004_x64 - resource
win10v2004-en-20220113 - submitted
01/02/2022, 15:48
Static task
static1
Behavioral task
behavioral1
Sample
31b92a2a2a6fcd58fefa3bf7471911851284cb34e5ff668b99f724c653e3d77c.exe
Resource
win7-en-20211208
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
31b92a2a2a6fcd58fefa3bf7471911851284cb34e5ff668b99f724c653e3d77c.exe
Resource
win10v2004-en-20220113
windows10-2004_x64
0 signatures
0 seconds
General
- Target 31b92a2a2a6fcd58fefa3bf7471911851284cb34e5ff668b99f724c653e3d77c.exe
- Size 592KB
- Sample220201-s8stdshaaj
- SHA256 31b92a2a2a6fcd58fefa3bf7471911851284cb34e5ff668b99f724c653e3d77c
- MD5 0febdea9572d614806a0400344694036
- SHA1 f8183db409a49712d8bc4b0200c187e0531d2b76
- SHA512 6573b7d6798a70d057c47bed1631ab9e95950cc36a4df72ce80c9956d590e4e9042ab1ca92bbf66beb16fffaefb95b3dc8f648f904d7049ade1fbf51440ffad1
- MD5 SHA1 SHA512
Score
10/10
Malware Config
Extracted
Path
-
C:\ako-readme.txt
-
ako
Ransom Note
- Your network have been locked. All your files, documents, photos, databases and other important data are encrypted and have the extension: .gZim20 Backups and shadow copies also encrypted or removed. Any third-party software may damage encrypted data but not recover. From this moment, it will be impossible to use files until they are decrypted. The only method of recovering files is to purchase an unique private key. Only we can give you this key and only we can recovery your files. To get info (decrypt your files) follow this steps: 1) Download and install Tor Browser: https://www.torproject.org/download/ 2) Open our website in TOR: http://kwvhrdibgmmpkhkidrby4mccwqpds5za6uo2thcw5gz75qncv7rbhyad.onion/40JRLFEREJ4HO8BG 3) Paste your ID in form (you can find your ID below) !! ATTENTION !! !! Any third - party software may damage encrypted data but not recover. !! DO NOT MODIFY ENCRYPTED FILES !! DO NOT CHANGE YOUR ID !! DO NOT REMOVE YOUR ID.KEY FILE --- BEGIN PERSONAL ID --- eyJleHQiOiIuZ1ppbTIwIiwgImtleSI6Im1tdlB5SklBUWgyandZTk9pbzFEUEc 2VG9QejUrblcrVGhnLzNDdjFQR1FGbWQxeklITENMUG8zNEFkMXVHcDNmZUdUb 1ZRbi9iNlY0bXBpY3dTVmE2Q3N3MGZyUlJTYVB5eitnL2craTB5R1hPdUV6YUR 4RDJJUkFsckkyQlJHRjNyWXFscDFyOW95cWtGSEpZT3J6d3ZxcEZ6Q0ZkSTJaY kp4SnFGUGQvSHpEUnhFVXU0ajdEK0VMdWczVE1XMmJYbGtiMnd2cjFzck5BOG9 WMDZzSXFwV0l5VmttMEVndjJjMlQzdnVYRW9VQkFaOXp0eHIvaFJycEpBa1BjN WhNUUhYb1FmOGlrZ2MxYmo3Sm8yOGtpWDRsMExPNmNEaExUbHBQcVFZQ1J0ZlZ 0UlZHblU2TFZxUDJocWJwV1doK2FhREpyc1BOWnhpS0pqNDFwb1Rzdz09IiwgI m5ldHdvcmsiOiJmYWxzZSIsICJzdWJpZCI6IjAiLCAidmVyIjoiMC41In0= --- END PERSONAL ID ---
URLs
-
http://kwvhrdibgmmpkhkidrby4mccwqpds5za6uo2thcw5gz75qncv7rbhyad.onion/40JRLFEREJ4HO8BG
Signatures
- Ako
Ransomware strain discovered in early 2020.
- Sets service image path in registry 2 TTPs
- Enumerates connected drives 3 TTPs 24 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\K: 31b92a2a2a6fcd58fefa3bf7471911851284cb34e5ff668b99f724c653e3d77c.exe File opened (read-only) \??\M: 31b92a2a2a6fcd58fefa3bf7471911851284cb34e5ff668b99f724c653e3d77c.exe File opened (read-only) \??\T: 31b92a2a2a6fcd58fefa3bf7471911851284cb34e5ff668b99f724c653e3d77c.exe File opened (read-only) \??\E: 31b92a2a2a6fcd58fefa3bf7471911851284cb34e5ff668b99f724c653e3d77c.exe File opened (read-only) \??\F: 31b92a2a2a6fcd58fefa3bf7471911851284cb34e5ff668b99f724c653e3d77c.exe File opened (read-only) \??\R: 31b92a2a2a6fcd58fefa3bf7471911851284cb34e5ff668b99f724c653e3d77c.exe File opened (read-only) \??\U: 31b92a2a2a6fcd58fefa3bf7471911851284cb34e5ff668b99f724c653e3d77c.exe File opened (read-only) \??\Y: 31b92a2a2a6fcd58fefa3bf7471911851284cb34e5ff668b99f724c653e3d77c.exe File opened (read-only) \??\Z: 31b92a2a2a6fcd58fefa3bf7471911851284cb34e5ff668b99f724c653e3d77c.exe File opened (read-only) \??\J: 31b92a2a2a6fcd58fefa3bf7471911851284cb34e5ff668b99f724c653e3d77c.exe File opened (read-only) \??\Q: 31b92a2a2a6fcd58fefa3bf7471911851284cb34e5ff668b99f724c653e3d77c.exe File opened (read-only) \??\N: 31b92a2a2a6fcd58fefa3bf7471911851284cb34e5ff668b99f724c653e3d77c.exe File opened (read-only) \??\X: 31b92a2a2a6fcd58fefa3bf7471911851284cb34e5ff668b99f724c653e3d77c.exe File opened (read-only) \??\G: 31b92a2a2a6fcd58fefa3bf7471911851284cb34e5ff668b99f724c653e3d77c.exe File opened (read-only) \??\I: 31b92a2a2a6fcd58fefa3bf7471911851284cb34e5ff668b99f724c653e3d77c.exe File opened (read-only) \??\H: 31b92a2a2a6fcd58fefa3bf7471911851284cb34e5ff668b99f724c653e3d77c.exe File opened (read-only) \??\L: 31b92a2a2a6fcd58fefa3bf7471911851284cb34e5ff668b99f724c653e3d77c.exe File opened (read-only) \??\O: 31b92a2a2a6fcd58fefa3bf7471911851284cb34e5ff668b99f724c653e3d77c.exe File opened (read-only) \??\P: 31b92a2a2a6fcd58fefa3bf7471911851284cb34e5ff668b99f724c653e3d77c.exe File opened (read-only) \??\S: 31b92a2a2a6fcd58fefa3bf7471911851284cb34e5ff668b99f724c653e3d77c.exe File opened (read-only) \??\V: 31b92a2a2a6fcd58fefa3bf7471911851284cb34e5ff668b99f724c653e3d77c.exe File opened (read-only) \??\A: 31b92a2a2a6fcd58fefa3bf7471911851284cb34e5ff668b99f724c653e3d77c.exe File opened (read-only) \??\B: 31b92a2a2a6fcd58fefa3bf7471911851284cb34e5ff668b99f724c653e3d77c.exe File opened (read-only) \??\W: 31b92a2a2a6fcd58fefa3bf7471911851284cb34e5ff668b99f724c653e3d77c.exe - Drops file in Windows directory 6 IoCs
description ioc Process File opened for modification C:\Windows\WindowsUpdate.log svchost.exe File opened for modification C:\Windows\SoftwareDistribution\DataStore\Logs\edb.chk svchost.exe File opened for modification C:\Windows\SoftwareDistribution\DataStore\Logs\edb.log svchost.exe File opened for modification C:\Windows\SoftwareDistribution\DataStore\DataStore.edb svchost.exe File opened for modification C:\Windows\SoftwareDistribution\DataStore\DataStore.jfm svchost.exe File opened for modification C:\Windows\SoftwareDistribution\ReportingEvents.log svchost.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Modifies data under HKEY_USERS 41 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs WaaSMedicAgent.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 2504 wmic.exe Token: SeSecurityPrivilege 2504 wmic.exe Token: SeTakeOwnershipPrivilege 2504 wmic.exe Token: SeLoadDriverPrivilege 2504 wmic.exe Token: SeSystemProfilePrivilege 2504 wmic.exe Token: SeSystemtimePrivilege 2504 wmic.exe Token: SeProfSingleProcessPrivilege 2504 wmic.exe Token: SeIncBasePriorityPrivilege 2504 wmic.exe Token: SeCreatePagefilePrivilege 2504 wmic.exe Token: SeBackupPrivilege 2504 wmic.exe Token: SeRestorePrivilege 2504 wmic.exe Token: SeShutdownPrivilege 2504 wmic.exe Token: SeDebugPrivilege 2504 wmic.exe Token: SeSystemEnvironmentPrivilege 2504 wmic.exe Token: SeRemoteShutdownPrivilege 2504 wmic.exe Token: SeUndockPrivilege 2504 wmic.exe Token: SeManageVolumePrivilege 2504 wmic.exe Token: 33 2504 wmic.exe Token: 34 2504 wmic.exe Token: 35 2504 wmic.exe Token: 36 2504 wmic.exe Token: SeIncreaseQuotaPrivilege 4940 wmic.exe Token: SeSecurityPrivilege 4940 wmic.exe Token: SeTakeOwnershipPrivilege 4940 wmic.exe Token: SeLoadDriverPrivilege 4940 wmic.exe Token: SeSystemProfilePrivilege 4940 wmic.exe Token: SeSystemtimePrivilege 4940 wmic.exe Token: SeProfSingleProcessPrivilege 4940 wmic.exe Token: SeIncBasePriorityPrivilege 4940 wmic.exe Token: SeCreatePagefilePrivilege 4940 wmic.exe Token: SeBackupPrivilege 4940 wmic.exe Token: SeRestorePrivilege 4940 wmic.exe Token: SeShutdownPrivilege 4940 wmic.exe Token: SeDebugPrivilege 4940 wmic.exe Token: SeSystemEnvironmentPrivilege 4940 wmic.exe Token: SeRemoteShutdownPrivilege 4940 wmic.exe Token: SeUndockPrivilege 4940 wmic.exe Token: SeManageVolumePrivilege 4940 wmic.exe Token: 33 4940 wmic.exe Token: 34 4940 wmic.exe Token: 35 4940 wmic.exe Token: 36 4940 wmic.exe Token: SeIncreaseQuotaPrivilege 1296 wmic.exe Token: SeSecurityPrivilege 1296 wmic.exe Token: SeTakeOwnershipPrivilege 1296 wmic.exe Token: SeLoadDriverPrivilege 1296 wmic.exe Token: SeSystemProfilePrivilege 1296 wmic.exe Token: SeSystemtimePrivilege 1296 wmic.exe Token: SeProfSingleProcessPrivilege 1296 wmic.exe Token: SeIncBasePriorityPrivilege 1296 wmic.exe Token: SeCreatePagefilePrivilege 1296 wmic.exe Token: SeBackupPrivilege 1296 wmic.exe Token: SeRestorePrivilege 1296 wmic.exe Token: SeShutdownPrivilege 1296 wmic.exe Token: SeDebugPrivilege 1296 wmic.exe Token: SeSystemEnvironmentPrivilege 1296 wmic.exe Token: SeRemoteShutdownPrivilege 1296 wmic.exe Token: SeUndockPrivilege 1296 wmic.exe Token: SeManageVolumePrivilege 1296 wmic.exe Token: 33 1296 wmic.exe Token: 34 1296 wmic.exe Token: 35 1296 wmic.exe Token: 36 1296 wmic.exe Token: SeShutdownPrivilege 4856 svchost.exe - Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 3200 wrote to memory of 2504 3200 31b92a2a2a6fcd58fefa3bf7471911851284cb34e5ff668b99f724c653e3d77c.exe 86 PID 3200 wrote to memory of 2504 3200 31b92a2a2a6fcd58fefa3bf7471911851284cb34e5ff668b99f724c653e3d77c.exe 86 PID 3200 wrote to memory of 2504 3200 31b92a2a2a6fcd58fefa3bf7471911851284cb34e5ff668b99f724c653e3d77c.exe 86 PID 3200 wrote to memory of 4940 3200 31b92a2a2a6fcd58fefa3bf7471911851284cb34e5ff668b99f724c653e3d77c.exe 88 PID 3200 wrote to memory of 4940 3200 31b92a2a2a6fcd58fefa3bf7471911851284cb34e5ff668b99f724c653e3d77c.exe 88 PID 3200 wrote to memory of 4940 3200 31b92a2a2a6fcd58fefa3bf7471911851284cb34e5ff668b99f724c653e3d77c.exe 88 PID 3200 wrote to memory of 1296 3200 31b92a2a2a6fcd58fefa3bf7471911851284cb34e5ff668b99f724c653e3d77c.exe 90 PID 3200 wrote to memory of 1296 3200 31b92a2a2a6fcd58fefa3bf7471911851284cb34e5ff668b99f724c653e3d77c.exe 90 PID 3200 wrote to memory of 1296 3200 31b92a2a2a6fcd58fefa3bf7471911851284cb34e5ff668b99f724c653e3d77c.exe 90 - System policy modification 1 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLinkedConnections = "1" 31b92a2a2a6fcd58fefa3bf7471911851284cb34e5ff668b99f724c653e3d77c.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\31b92a2a2a6fcd58fefa3bf7471911851284cb34e5ff668b99f724c653e3d77c.exe"C:\Users\Admin\AppData\Local\Temp\31b92a2a2a6fcd58fefa3bf7471911851284cb34e5ff668b99f724c653e3d77c.exe"1⤵
- Enumerates connected drives
- Suspicious use of WriteProcessMemory
- System policy modification
PID:3200 -
C:\Windows\SysWOW64\Wbem\wmic.exewmic.exe SHADOWCOPY /nointeractive2⤵
- Suspicious use of AdjustPrivilegeToken
PID:2504
-
-
C:\Windows\SysWOW64\Wbem\wmic.exewmic.exe SHADOWCOPY /nointeractive2⤵
- Suspicious use of AdjustPrivilegeToken
PID:4940
-
-
C:\Windows\SysWOW64\Wbem\wmic.exewmic.exe SHADOWCOPY /nointeractive2⤵
- Suspicious use of AdjustPrivilegeToken
PID:1296
-
-
C:\Windows\System32\WaaSMedicAgent.exeC:\Windows\System32\WaaSMedicAgent.exe 7838138637a373213a13bd24ec1f4345 exYODoUCP0ikMCSb/vNmBw.0.1.0.0.01⤵
- Modifies data under HKEY_USERS
PID:3704
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s wuauserv1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:4856