Analysis
-
max time kernel
127s -
max time network
147s -
platform
windows10-2004_x64 -
resource
win10v2004-en-20220112 -
submitted
05-03-2022 19:56
Static task
static1
Behavioral task
behavioral1
Sample
758dbaf45722c5d4fddb8770a9fcbad885d89fe4baf5aa7babae764b2580749b.exe
Resource
win7-20220223-en
Behavioral task
behavioral2
Sample
758dbaf45722c5d4fddb8770a9fcbad885d89fe4baf5aa7babae764b2580749b.exe
Resource
win10v2004-en-20220112
General
-
Target
758dbaf45722c5d4fddb8770a9fcbad885d89fe4baf5aa7babae764b2580749b.exe
-
Size
115KB
-
MD5
57bf129dff8a1e1e40293df1510764ac
-
SHA1
8ffd6f21464e9dc73ad3c1464da6bcca065f3039
-
SHA256
758dbaf45722c5d4fddb8770a9fcbad885d89fe4baf5aa7babae764b2580749b
-
SHA512
b611bed29a2f45f0942cc8ae22006ea905f420ead53204a80f9b5666a5b9d93ce5e9ea5137b4cc0dfe9fdd0531cff92520b11498291fed253c529226123cc059
Malware Config
Extracted
C:\14512en8v-readme.txt
sodinokibi
http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/BFC251FF5A2E50AB
http://decryptor.cc/BFC251FF5A2E50AB
Signatures
-
Sodin,Sodinokibi,REvil
Ransomware with advanced anti-analysis and privilege escalation functionality.
-
Modifies extensions of user files 6 IoCs
Ransomware generally changes the extension on encrypted files.
Processes:
758dbaf45722c5d4fddb8770a9fcbad885d89fe4baf5aa7babae764b2580749b.exedescription ioc process File renamed C:\Users\Admin\Pictures\ResumeAssert.png => \??\c:\users\admin\pictures\ResumeAssert.png.14512en8v 758dbaf45722c5d4fddb8770a9fcbad885d89fe4baf5aa7babae764b2580749b.exe File renamed C:\Users\Admin\Pictures\ResumeEnter.tif => \??\c:\users\admin\pictures\ResumeEnter.tif.14512en8v 758dbaf45722c5d4fddb8770a9fcbad885d89fe4baf5aa7babae764b2580749b.exe File renamed C:\Users\Admin\Pictures\UnblockCheckpoint.crw => \??\c:\users\admin\pictures\UnblockCheckpoint.crw.14512en8v 758dbaf45722c5d4fddb8770a9fcbad885d89fe4baf5aa7babae764b2580749b.exe File renamed C:\Users\Admin\Pictures\ImportRemove.png => \??\c:\users\admin\pictures\ImportRemove.png.14512en8v 758dbaf45722c5d4fddb8770a9fcbad885d89fe4baf5aa7babae764b2580749b.exe File renamed C:\Users\Admin\Pictures\CompressGet.png => \??\c:\users\admin\pictures\CompressGet.png.14512en8v 758dbaf45722c5d4fddb8770a9fcbad885d89fe4baf5aa7babae764b2580749b.exe File renamed C:\Users\Admin\Pictures\ResizeUnregister.tif => \??\c:\users\admin\pictures\ResizeUnregister.tif.14512en8v 758dbaf45722c5d4fddb8770a9fcbad885d89fe4baf5aa7babae764b2580749b.exe -
Enumerates connected drives 3 TTPs 25 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
758dbaf45722c5d4fddb8770a9fcbad885d89fe4baf5aa7babae764b2580749b.exedescription ioc process File opened (read-only) \??\K: 758dbaf45722c5d4fddb8770a9fcbad885d89fe4baf5aa7babae764b2580749b.exe File opened (read-only) \??\N: 758dbaf45722c5d4fddb8770a9fcbad885d89fe4baf5aa7babae764b2580749b.exe File opened (read-only) \??\Q: 758dbaf45722c5d4fddb8770a9fcbad885d89fe4baf5aa7babae764b2580749b.exe File opened (read-only) \??\B: 758dbaf45722c5d4fddb8770a9fcbad885d89fe4baf5aa7babae764b2580749b.exe File opened (read-only) \??\E: 758dbaf45722c5d4fddb8770a9fcbad885d89fe4baf5aa7babae764b2580749b.exe File opened (read-only) \??\S: 758dbaf45722c5d4fddb8770a9fcbad885d89fe4baf5aa7babae764b2580749b.exe File opened (read-only) \??\U: 758dbaf45722c5d4fddb8770a9fcbad885d89fe4baf5aa7babae764b2580749b.exe File opened (read-only) \??\W: 758dbaf45722c5d4fddb8770a9fcbad885d89fe4baf5aa7babae764b2580749b.exe File opened (read-only) \??\X: 758dbaf45722c5d4fddb8770a9fcbad885d89fe4baf5aa7babae764b2580749b.exe File opened (read-only) \??\Z: 758dbaf45722c5d4fddb8770a9fcbad885d89fe4baf5aa7babae764b2580749b.exe File opened (read-only) \??\G: 758dbaf45722c5d4fddb8770a9fcbad885d89fe4baf5aa7babae764b2580749b.exe File opened (read-only) \??\J: 758dbaf45722c5d4fddb8770a9fcbad885d89fe4baf5aa7babae764b2580749b.exe File opened (read-only) \??\O: 758dbaf45722c5d4fddb8770a9fcbad885d89fe4baf5aa7babae764b2580749b.exe File opened (read-only) \??\R: 758dbaf45722c5d4fddb8770a9fcbad885d89fe4baf5aa7babae764b2580749b.exe File opened (read-only) \??\D: 758dbaf45722c5d4fddb8770a9fcbad885d89fe4baf5aa7babae764b2580749b.exe File opened (read-only) \??\F: 758dbaf45722c5d4fddb8770a9fcbad885d89fe4baf5aa7babae764b2580749b.exe File opened (read-only) \??\L: 758dbaf45722c5d4fddb8770a9fcbad885d89fe4baf5aa7babae764b2580749b.exe File opened (read-only) \??\I: 758dbaf45722c5d4fddb8770a9fcbad885d89fe4baf5aa7babae764b2580749b.exe File opened (read-only) \??\M: 758dbaf45722c5d4fddb8770a9fcbad885d89fe4baf5aa7babae764b2580749b.exe File opened (read-only) \??\P: 758dbaf45722c5d4fddb8770a9fcbad885d89fe4baf5aa7babae764b2580749b.exe File opened (read-only) \??\T: 758dbaf45722c5d4fddb8770a9fcbad885d89fe4baf5aa7babae764b2580749b.exe File opened (read-only) \??\V: 758dbaf45722c5d4fddb8770a9fcbad885d89fe4baf5aa7babae764b2580749b.exe File opened (read-only) \??\Y: 758dbaf45722c5d4fddb8770a9fcbad885d89fe4baf5aa7babae764b2580749b.exe File opened (read-only) \??\A: 758dbaf45722c5d4fddb8770a9fcbad885d89fe4baf5aa7babae764b2580749b.exe File opened (read-only) \??\H: 758dbaf45722c5d4fddb8770a9fcbad885d89fe4baf5aa7babae764b2580749b.exe -
Sets desktop wallpaper using registry 2 TTPs 1 IoCs
Processes:
758dbaf45722c5d4fddb8770a9fcbad885d89fe4baf5aa7babae764b2580749b.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\5m5521rc.bmp" 758dbaf45722c5d4fddb8770a9fcbad885d89fe4baf5aa7babae764b2580749b.exe -
Drops file in Program Files directory 37 IoCs
Processes:
758dbaf45722c5d4fddb8770a9fcbad885d89fe4baf5aa7babae764b2580749b.exedescription ioc process File opened for modification \??\c:\program files\ConnectConvertTo.shtml 758dbaf45722c5d4fddb8770a9fcbad885d89fe4baf5aa7babae764b2580749b.exe File opened for modification \??\c:\program files\MountTrace.dot 758dbaf45722c5d4fddb8770a9fcbad885d89fe4baf5aa7babae764b2580749b.exe File opened for modification \??\c:\program files\WaitCompress.potm 758dbaf45722c5d4fddb8770a9fcbad885d89fe4baf5aa7babae764b2580749b.exe File opened for modification \??\c:\program files\EditStop.potm 758dbaf45722c5d4fddb8770a9fcbad885d89fe4baf5aa7babae764b2580749b.exe File opened for modification \??\c:\program files\ExpandRestore.cfg 758dbaf45722c5d4fddb8770a9fcbad885d89fe4baf5aa7babae764b2580749b.exe File opened for modification \??\c:\program files\GroupOptimize.M2T 758dbaf45722c5d4fddb8770a9fcbad885d89fe4baf5aa7babae764b2580749b.exe File opened for modification \??\c:\program files\DenyInvoke.m4a 758dbaf45722c5d4fddb8770a9fcbad885d89fe4baf5aa7babae764b2580749b.exe File opened for modification \??\c:\program files\EditRepair.emf 758dbaf45722c5d4fddb8770a9fcbad885d89fe4baf5aa7babae764b2580749b.exe File opened for modification \??\c:\program files\EnableClear.MTS 758dbaf45722c5d4fddb8770a9fcbad885d89fe4baf5aa7babae764b2580749b.exe File opened for modification \??\c:\program files\AddSkip.mpeg2 758dbaf45722c5d4fddb8770a9fcbad885d89fe4baf5aa7babae764b2580749b.exe File opened for modification \??\c:\program files\ConvertToOut.png 758dbaf45722c5d4fddb8770a9fcbad885d89fe4baf5aa7babae764b2580749b.exe File opened for modification \??\c:\program files\CopyMerge.mht 758dbaf45722c5d4fddb8770a9fcbad885d89fe4baf5aa7babae764b2580749b.exe File opened for modification \??\c:\program files\ConfirmSubmit.clr 758dbaf45722c5d4fddb8770a9fcbad885d89fe4baf5aa7babae764b2580749b.exe File opened for modification \??\c:\program files\DismountNew.nfo 758dbaf45722c5d4fddb8770a9fcbad885d89fe4baf5aa7babae764b2580749b.exe File opened for modification \??\c:\program files\ExpandInvoke.asp 758dbaf45722c5d4fddb8770a9fcbad885d89fe4baf5aa7babae764b2580749b.exe File opened for modification \??\c:\program files\GetPop.mp2v 758dbaf45722c5d4fddb8770a9fcbad885d89fe4baf5aa7babae764b2580749b.exe File opened for modification \??\c:\program files\HideWatch.dwg 758dbaf45722c5d4fddb8770a9fcbad885d89fe4baf5aa7babae764b2580749b.exe File opened for modification \??\c:\program files\PublishInvoke.rtf 758dbaf45722c5d4fddb8770a9fcbad885d89fe4baf5aa7babae764b2580749b.exe File opened for modification \??\c:\program files\TestReset.ADTS 758dbaf45722c5d4fddb8770a9fcbad885d89fe4baf5aa7babae764b2580749b.exe File opened for modification \??\c:\program files\ConvertFromClear.3g2 758dbaf45722c5d4fddb8770a9fcbad885d89fe4baf5aa7babae764b2580749b.exe File opened for modification \??\c:\program files\CopyTest.jpeg 758dbaf45722c5d4fddb8770a9fcbad885d89fe4baf5aa7babae764b2580749b.exe File opened for modification \??\c:\program files\EnableDebug.png 758dbaf45722c5d4fddb8770a9fcbad885d89fe4baf5aa7babae764b2580749b.exe File opened for modification \??\c:\program files\WatchRestore.7z 758dbaf45722c5d4fddb8770a9fcbad885d89fe4baf5aa7babae764b2580749b.exe File opened for modification \??\c:\program files\DisconnectSuspend.jpeg 758dbaf45722c5d4fddb8770a9fcbad885d89fe4baf5aa7babae764b2580749b.exe File opened for modification \??\c:\program files\InvokeFind.png 758dbaf45722c5d4fddb8770a9fcbad885d89fe4baf5aa7babae764b2580749b.exe File opened for modification \??\c:\program files\OpenDisable.aif 758dbaf45722c5d4fddb8770a9fcbad885d89fe4baf5aa7babae764b2580749b.exe File opened for modification \??\c:\program files\RevokeStep.zip 758dbaf45722c5d4fddb8770a9fcbad885d89fe4baf5aa7babae764b2580749b.exe File opened for modification \??\c:\program files\WatchRemove.xht 758dbaf45722c5d4fddb8770a9fcbad885d89fe4baf5aa7babae764b2580749b.exe File created \??\c:\program files (x86)\14512en8v-readme.txt 758dbaf45722c5d4fddb8770a9fcbad885d89fe4baf5aa7babae764b2580749b.exe File opened for modification \??\c:\program files\BlockCheckpoint.emz 758dbaf45722c5d4fddb8770a9fcbad885d89fe4baf5aa7babae764b2580749b.exe File opened for modification \??\c:\program files\DisconnectAdd.001 758dbaf45722c5d4fddb8770a9fcbad885d89fe4baf5aa7babae764b2580749b.exe File opened for modification \??\c:\program files\SuspendUndo.ps1xml 758dbaf45722c5d4fddb8770a9fcbad885d89fe4baf5aa7babae764b2580749b.exe File created \??\c:\program files\14512en8v-readme.txt 758dbaf45722c5d4fddb8770a9fcbad885d89fe4baf5aa7babae764b2580749b.exe File opened for modification \??\c:\program files\ClosePing.ps1xml 758dbaf45722c5d4fddb8770a9fcbad885d89fe4baf5aa7babae764b2580749b.exe File opened for modification \??\c:\program files\NewComplete.xml 758dbaf45722c5d4fddb8770a9fcbad885d89fe4baf5aa7babae764b2580749b.exe File opened for modification \??\c:\program files\ExitExpand.pptx 758dbaf45722c5d4fddb8770a9fcbad885d89fe4baf5aa7babae764b2580749b.exe File opened for modification \??\c:\program files\SuspendComplete.aifc 758dbaf45722c5d4fddb8770a9fcbad885d89fe4baf5aa7babae764b2580749b.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
758dbaf45722c5d4fddb8770a9fcbad885d89fe4baf5aa7babae764b2580749b.exepowershell.exepid process 3272 758dbaf45722c5d4fddb8770a9fcbad885d89fe4baf5aa7babae764b2580749b.exe 3272 758dbaf45722c5d4fddb8770a9fcbad885d89fe4baf5aa7babae764b2580749b.exe 3860 powershell.exe 3860 powershell.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
Processes:
758dbaf45722c5d4fddb8770a9fcbad885d89fe4baf5aa7babae764b2580749b.exepowershell.exevssvc.exedescription pid process Token: SeDebugPrivilege 3272 758dbaf45722c5d4fddb8770a9fcbad885d89fe4baf5aa7babae764b2580749b.exe Token: SeDebugPrivilege 3860 powershell.exe Token: SeBackupPrivilege 2448 vssvc.exe Token: SeRestorePrivilege 2448 vssvc.exe Token: SeAuditPrivilege 2448 vssvc.exe Token: SeTakeOwnershipPrivilege 3272 758dbaf45722c5d4fddb8770a9fcbad885d89fe4baf5aa7babae764b2580749b.exe -
Suspicious use of WriteProcessMemory 2 IoCs
Processes:
758dbaf45722c5d4fddb8770a9fcbad885d89fe4baf5aa7babae764b2580749b.exedescription pid process target process PID 3272 wrote to memory of 3860 3272 758dbaf45722c5d4fddb8770a9fcbad885d89fe4baf5aa7babae764b2580749b.exe powershell.exe PID 3272 wrote to memory of 3860 3272 758dbaf45722c5d4fddb8770a9fcbad885d89fe4baf5aa7babae764b2580749b.exe powershell.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\758dbaf45722c5d4fddb8770a9fcbad885d89fe4baf5aa7babae764b2580749b.exe"C:\Users\Admin\AppData\Local\Temp\758dbaf45722c5d4fddb8770a9fcbad885d89fe4baf5aa7babae764b2580749b.exe"1⤵
- Modifies extensions of user files
- Enumerates connected drives
- Sets desktop wallpaper using registry
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3272 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -e RwBlAHQALQBXAG0AaQBPAGIAagBlAGMAdAAgAFcAaQBuADMAMgBfAFMAaABhAGQAbwB3AGMAbwBwAHkAIAB8ACAARgBvAHIARQBhAGMAaAAtAE8AYgBqAGUAYwB0ACAAewAkAF8ALgBEAGUAbABlAHQAZQAoACkAOwB9AA==2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3860
-
C:\Windows\system32\wbem\unsecapp.exeC:\Windows\system32\wbem\unsecapp.exe -Embedding1⤵PID:1920
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2448
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/3860-134-0x00000197A5FE0000-0x00000197A6002000-memory.dmpFilesize
136KB
-
memory/3860-138-0x00000197A5FD0000-0x00000197A5FD2000-memory.dmpFilesize
8KB
-
memory/3860-137-0x00007FFC4F190000-0x00007FFC4FC51000-memory.dmpFilesize
10.8MB
-
memory/3860-139-0x00000197A5FD3000-0x00000197A5FD5000-memory.dmpFilesize
8KB
-
memory/3860-140-0x00000197A5FD6000-0x00000197A5FD8000-memory.dmpFilesize
8KB