Analysis
- max time kernel
150s - max time network
145s - platform
windows10-2004_x64 - resource
win10v2004-20220414-en - submitted
24/04/2022, 03:47
Static task
static1
Behavioral task
behavioral1
Sample
1-de.exe
Resource
win7-20220414-en
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
1-de.exe
Resource
win10v2004-20220414-en
windows10-2004_x64
0 signatures
0 seconds
General
- Target 1-de.exe
- Size 819KB
- Sample220424-ecnmxacbfl
- SHA256 a5eb835060919717bdddb6d66b08618586d55bfb41ccef791c4b5beb7ee319a3
- MD5 865a58f7fc861377f98d933165690110
- SHA1 d8ed586d83e3b37abc0b439ea175799769e9eec5
- SHA512 aab5cd363912a01268afe5fdbb769b50754c1f81d1447116826c0d832e988b2bd1d82386bbe9b088547b5094ec3b0ad26c9d7d5d1ebff1a8992492157616cc7c
- MD5 SHA1 SHA512
Score
10/10
Malware Config
Extracted
Path
-
C:\ako-readme.txt
-
ako
Ransom Note
- Your network have been locked. All your files, documents, photos, databases and other important data are encrypted and have the extension: .0ViUb6 Backups and shadow copies also encrypted or removed. Any third-party software may damage encrypted data but not recover. From this moment, it will be impossible to use files until they are decrypted. The only method of recovering files is to purchase an unique private key. Only we can give you this key and only we can recovery your files. To get info (decrypt your files) follow this steps: 1) Download and install Tor Browser: https://www.torproject.org/download/ 2) Open our website in TOR: http://kwvhrdibgmmpkhkidrby4mccwqpds5za6uo2thcw5gz75qncv7rbhyad.onion/AHXYFYBKTAXNGRZB 3) Paste your ID in form (you can find your ID below) !! ATTENTION !! !! Any third - party software may damage encrypted data but not recover. !! DO NOT MODIFY ENCRYPTED FILES !! DO NOT CHANGE YOUR ID !! DO NOT REMOVE YOUR ID.KEY FILE --- BEGIN PERSONAL ID --- eyJleHQiOiIuMFZpVWI2IiwgImtleSI6IjgyR09PdFJ0S2hqZlZuR2huMGxYZ1V 0UnM3Z1A5LzFGMU5yWFJOVHJiTlZwQ1lNekFLNW5ZdXUrd2RMWUFITDFOQnZUd Wt1Z2w2SHFvekQrWUk3SGsxeWtJMnFGRjlRcy9wOUJSS0svcnFvQXZqTG5keGl uSGQ2YWV4SDBuaDBTdFFPMTFVeVRHWTR3Y1NES2h4LzFZVTRBU0JxRThNSEpHb mtwNGU5YktsWU9wOWNmSmkxa1VLRE9EbzVYS0tITkRObCtKazZ5WkhKRjZybzd 6dG9FaGhmTDhDdE5RR29oandhSTRJZmhieGR0ZVNqNXJlRGhrWm1NdkYyWDdyU VQxK1d3VkxyS0lpZU1QUSszTGFoNDBvTWZNOGxIc0JZVjJWaXh6SjVKK3JHOTh KbW1tMDdSdE1rT3NhaGd1b3BDMUEwUDNOUUhmeEF0cGdqcTVORk9wQT09IiwgI m5ldHdvcmsiOiJmYWxzZSIsICJzdWJpZCI6IjAiLCAidmVyIjoiMC41In0= --- END PERSONAL ID ---
URLs
-
http://kwvhrdibgmmpkhkidrby4mccwqpds5za6uo2thcw5gz75qncv7rbhyad.onion/AHXYFYBKTAXNGRZB
Signatures
- Ako
Ransomware strain discovered in early 2020.
- Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
- Modifies boot configuration data using bcdedit 1 TTPs 6 IoCs
pid Process 3820 bcdedit.exe 2156 bcdedit.exe 4292 bcdedit.exe 1176 bcdedit.exe 2472 bcdedit.exe 1340 bcdedit.exe -
pid Process 4260 wbadmin.exe 5056 wbadmin.exe 4788 wbadmin.exe 2008 wbadmin.exe 4928 wbadmin.exe 3772 wbadmin.exe - Modifies extensions of user files 7 IoCs
Ransomware generally changes the extension on encrypted files.
description ioc Process File renamed C:\Users\Admin\Pictures\EditReceive.tif => C:\Users\Admin\Pictures\EditReceive.tif.0ViUb6 1-de.exe File renamed C:\Users\Admin\Pictures\HideReceive.crw => C:\Users\Admin\Pictures\HideReceive.crw.0ViUb6 1-de.exe File renamed C:\Users\Admin\Pictures\NewSearch.png => C:\Users\Admin\Pictures\NewSearch.png.0ViUb6 1-de.exe File renamed C:\Users\Admin\Pictures\ReceiveGet.crw => C:\Users\Admin\Pictures\ReceiveGet.crw.0ViUb6 1-de.exe File renamed C:\Users\Admin\Pictures\StartUnblock.crw => C:\Users\Admin\Pictures\StartUnblock.crw.0ViUb6 1-de.exe File opened for modification C:\Users\Admin\Pictures\SuspendDisable.tiff 1-de.exe File renamed C:\Users\Admin\Pictures\SuspendDisable.tiff => C:\Users\Admin\Pictures\SuspendDisable.tiff.0ViUb6 1-de.exe - Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Enumerates connected drives 3 TTPs 24 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\Y: 1-de.exe File opened (read-only) \??\B: 1-de.exe File opened (read-only) \??\G: 1-de.exe File opened (read-only) \??\N: 1-de.exe File opened (read-only) \??\P: 1-de.exe File opened (read-only) \??\Q: 1-de.exe File opened (read-only) \??\H: 1-de.exe File opened (read-only) \??\I: 1-de.exe File opened (read-only) \??\J: 1-de.exe File opened (read-only) \??\K: 1-de.exe File opened (read-only) \??\X: 1-de.exe File opened (read-only) \??\A: 1-de.exe File opened (read-only) \??\E: 1-de.exe File opened (read-only) \??\M: 1-de.exe File opened (read-only) \??\R: 1-de.exe File opened (read-only) \??\V: 1-de.exe File opened (read-only) \??\U: 1-de.exe File opened (read-only) \??\W: 1-de.exe File opened (read-only) \??\Z: 1-de.exe File opened (read-only) \??\F: 1-de.exe File opened (read-only) \??\L: 1-de.exe File opened (read-only) \??\O: 1-de.exe File opened (read-only) \??\S: 1-de.exe File opened (read-only) \??\T: 1-de.exe - Drops file in Windows directory 18 IoCs
description ioc Process File opened for modification C:\Windows\Logs\WindowsBackup\WBEngine.3.etl wbadmin.exe File opened for modification C:\Windows\Logs\WindowsBackup\WBEngine.1.etl wbadmin.exe File opened for modification C:\Windows\Logs\WindowsBackup\WBEngine.1.etl wbadmin.exe File opened for modification C:\Windows\Logs\WindowsBackup\WBEngine.1.etl wbadmin.exe File opened for modification C:\Windows\Logs\WindowsBackup\WBEngine.1.etl wbadmin.exe File opened for modification C:\Windows\Logs\WindowsBackup\WBEngine.2.etl wbadmin.exe File opened for modification C:\Windows\Logs\WindowsBackup\WBEngine.3.etl wbadmin.exe File opened for modification C:\Windows\Logs\WindowsBackup\WBEngine.2.etl wbadmin.exe File opened for modification C:\Windows\Logs\WindowsBackup\WBEngine.3.etl wbadmin.exe File opened for modification C:\Windows\Logs\WindowsBackup\WBEngine.3.etl wbadmin.exe File opened for modification C:\Windows\Logs\WindowsBackup\WBEngine.3.etl wbadmin.exe File opened for modification C:\Windows\Logs\WindowsBackup\WBEngine.3.etl wbadmin.exe File opened for modification C:\Windows\Logs\WindowsBackup\WBEngine.1.etl wbadmin.exe File opened for modification C:\Windows\Logs\WindowsBackup\WBEngine.2.etl wbadmin.exe File opened for modification C:\Windows\Logs\WindowsBackup\WBEngine.1.etl wbadmin.exe File opened for modification C:\Windows\Logs\WindowsBackup\WBEngine.2.etl wbadmin.exe File opened for modification C:\Windows\Logs\WindowsBackup\WBEngine.2.etl wbadmin.exe File opened for modification C:\Windows\Logs\WindowsBackup\WBEngine.2.etl wbadmin.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Interacts with shadow copies 2 TTPs 3 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
pid Process 2884 vssadmin.exe 5052 vssadmin.exe 116 vssadmin.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeBackupPrivilege 2212 vssvc.exe Token: SeRestorePrivilege 2212 vssvc.exe Token: SeAuditPrivilege 2212 vssvc.exe Token: SeIncreaseQuotaPrivilege 968 wmic.exe Token: SeSecurityPrivilege 968 wmic.exe Token: SeTakeOwnershipPrivilege 968 wmic.exe Token: SeLoadDriverPrivilege 968 wmic.exe Token: SeSystemProfilePrivilege 968 wmic.exe Token: SeSystemtimePrivilege 968 wmic.exe Token: SeProfSingleProcessPrivilege 968 wmic.exe Token: SeIncBasePriorityPrivilege 968 wmic.exe Token: SeCreatePagefilePrivilege 968 wmic.exe Token: SeBackupPrivilege 968 wmic.exe Token: SeRestorePrivilege 968 wmic.exe Token: SeShutdownPrivilege 968 wmic.exe Token: SeDebugPrivilege 968 wmic.exe Token: SeSystemEnvironmentPrivilege 968 wmic.exe Token: SeRemoteShutdownPrivilege 968 wmic.exe Token: SeUndockPrivilege 968 wmic.exe Token: SeManageVolumePrivilege 968 wmic.exe Token: 33 968 wmic.exe Token: 34 968 wmic.exe Token: 35 968 wmic.exe Token: 36 968 wmic.exe Token: SeIncreaseQuotaPrivilege 1712 wmic.exe Token: SeSecurityPrivilege 1712 wmic.exe Token: SeTakeOwnershipPrivilege 1712 wmic.exe Token: SeLoadDriverPrivilege 1712 wmic.exe Token: SeSystemProfilePrivilege 1712 wmic.exe Token: SeSystemtimePrivilege 1712 wmic.exe Token: SeProfSingleProcessPrivilege 1712 wmic.exe Token: SeIncBasePriorityPrivilege 1712 wmic.exe Token: SeCreatePagefilePrivilege 1712 wmic.exe Token: SeBackupPrivilege 1712 wmic.exe Token: SeRestorePrivilege 1712 wmic.exe Token: SeShutdownPrivilege 1712 wmic.exe Token: SeDebugPrivilege 1712 wmic.exe Token: SeSystemEnvironmentPrivilege 1712 wmic.exe Token: SeRemoteShutdownPrivilege 1712 wmic.exe Token: SeUndockPrivilege 1712 wmic.exe Token: SeManageVolumePrivilege 1712 wmic.exe Token: 33 1712 wmic.exe Token: 34 1712 wmic.exe Token: 35 1712 wmic.exe Token: 36 1712 wmic.exe Token: SeIncreaseQuotaPrivilege 2408 wmic.exe Token: SeSecurityPrivilege 2408 wmic.exe Token: SeTakeOwnershipPrivilege 2408 wmic.exe Token: SeLoadDriverPrivilege 2408 wmic.exe Token: SeSystemProfilePrivilege 2408 wmic.exe Token: SeSystemtimePrivilege 2408 wmic.exe Token: SeProfSingleProcessPrivilege 2408 wmic.exe Token: SeIncBasePriorityPrivilege 2408 wmic.exe Token: SeCreatePagefilePrivilege 2408 wmic.exe Token: SeBackupPrivilege 2408 wmic.exe Token: SeRestorePrivilege 2408 wmic.exe Token: SeShutdownPrivilege 2408 wmic.exe Token: SeDebugPrivilege 2408 wmic.exe Token: SeSystemEnvironmentPrivilege 2408 wmic.exe Token: SeRemoteShutdownPrivilege 2408 wmic.exe Token: SeUndockPrivilege 2408 wmic.exe Token: SeManageVolumePrivilege 2408 wmic.exe Token: 33 2408 wmic.exe Token: 34 2408 wmic.exe - Suspicious use of WriteProcessMemory 36 IoCs
description pid Process procid_target PID 1016 wrote to memory of 2884 1016 1-de.exe 79 PID 1016 wrote to memory of 2884 1016 1-de.exe 79 PID 1016 wrote to memory of 3820 1016 1-de.exe 84 PID 1016 wrote to memory of 3820 1016 1-de.exe 84 PID 1016 wrote to memory of 2156 1016 1-de.exe 86 PID 1016 wrote to memory of 2156 1016 1-de.exe 86 PID 1016 wrote to memory of 4260 1016 1-de.exe 88 PID 1016 wrote to memory of 4260 1016 1-de.exe 88 PID 1016 wrote to memory of 5056 1016 1-de.exe 90 PID 1016 wrote to memory of 5056 1016 1-de.exe 90 PID 1016 wrote to memory of 968 1016 1-de.exe 92 PID 1016 wrote to memory of 968 1016 1-de.exe 92 PID 1016 wrote to memory of 5052 1016 1-de.exe 94 PID 1016 wrote to memory of 5052 1016 1-de.exe 94 PID 1016 wrote to memory of 4292 1016 1-de.exe 96 PID 1016 wrote to memory of 4292 1016 1-de.exe 96 PID 1016 wrote to memory of 1176 1016 1-de.exe 98 PID 1016 wrote to memory of 1176 1016 1-de.exe 98 PID 1016 wrote to memory of 4788 1016 1-de.exe 100 PID 1016 wrote to memory of 4788 1016 1-de.exe 100 PID 1016 wrote to memory of 2008 1016 1-de.exe 102 PID 1016 wrote to memory of 2008 1016 1-de.exe 102 PID 1016 wrote to memory of 1712 1016 1-de.exe 104 PID 1016 wrote to memory of 1712 1016 1-de.exe 104 PID 1016 wrote to memory of 116 1016 1-de.exe 106 PID 1016 wrote to memory of 116 1016 1-de.exe 106 PID 1016 wrote to memory of 2472 1016 1-de.exe 108 PID 1016 wrote to memory of 2472 1016 1-de.exe 108 PID 1016 wrote to memory of 1340 1016 1-de.exe 110 PID 1016 wrote to memory of 1340 1016 1-de.exe 110 PID 1016 wrote to memory of 4928 1016 1-de.exe 112 PID 1016 wrote to memory of 4928 1016 1-de.exe 112 PID 1016 wrote to memory of 3772 1016 1-de.exe 114 PID 1016 wrote to memory of 3772 1016 1-de.exe 114 PID 1016 wrote to memory of 2408 1016 1-de.exe 116 PID 1016 wrote to memory of 2408 1016 1-de.exe 116 - System policy modification 1 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLinkedConnections = "1" 1-de.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\1-de.exe"C:\Users\Admin\AppData\Local\Temp\1-de.exe"1⤵
- Modifies extensions of user files
- Enumerates connected drives
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1016 -
C:\Windows\SYSTEM32\vssadmin.exevssadmin.exe Delete Shadows /All /Quiet2⤵
- Interacts with shadow copies
PID:2884
-
-
C:\Windows\SYSTEM32\bcdedit.exebcdedit.exe /set {default} recoveryenabled No2⤵
- Modifies boot configuration data using bcdedit
PID:3820
-
-
C:\Windows\SYSTEM32\bcdedit.exebcdedit.exe /set {default} bootstatuspolicy ignoreallfailures2⤵
- Modifies boot configuration data using bcdedit
PID:2156
-
-
C:\Windows\SYSTEM32\wbadmin.exewbadmin DELETE SYSTEMSTATEBACKUP2⤵
- Deletes System State backups
- Drops file in Windows directory
PID:4260
-
-
C:\Windows\SYSTEM32\wbadmin.exewbadmin DELETE SYSTEMSTATEBACKUP -deleteOldest2⤵
- Deletes System State backups
- Drops file in Windows directory
PID:5056
-
-
C:\Windows\System32\Wbem\wmic.exewmic.exe SHADOWCOPY /nointeractive2⤵
- Suspicious use of AdjustPrivilegeToken
PID:968
-
-
C:\Windows\SYSTEM32\vssadmin.exevssadmin.exe Delete Shadows /All /Quiet2⤵
- Interacts with shadow copies
PID:5052
-
-
C:\Windows\SYSTEM32\bcdedit.exebcdedit.exe /set {default} recoveryenabled No2⤵
- Modifies boot configuration data using bcdedit
PID:4292
-
-
C:\Windows\SYSTEM32\bcdedit.exebcdedit.exe /set {default} bootstatuspolicy ignoreallfailures2⤵
- Modifies boot configuration data using bcdedit
PID:1176
-
-
C:\Windows\SYSTEM32\wbadmin.exewbadmin DELETE SYSTEMSTATEBACKUP2⤵
- Deletes System State backups
- Drops file in Windows directory
PID:4788
-
-
C:\Windows\SYSTEM32\wbadmin.exewbadmin DELETE SYSTEMSTATEBACKUP -deleteOldest2⤵
- Deletes System State backups
- Drops file in Windows directory
PID:2008
-
-
C:\Windows\System32\Wbem\wmic.exewmic.exe SHADOWCOPY /nointeractive2⤵
- Suspicious use of AdjustPrivilegeToken
PID:1712
-
-
C:\Windows\SYSTEM32\vssadmin.exevssadmin.exe Delete Shadows /All /Quiet2⤵
- Interacts with shadow copies
PID:116
-
-
C:\Windows\SYSTEM32\bcdedit.exebcdedit.exe /set {default} recoveryenabled No2⤵
- Modifies boot configuration data using bcdedit
PID:2472
-
-
C:\Windows\SYSTEM32\bcdedit.exebcdedit.exe /set {default} bootstatuspolicy ignoreallfailures2⤵
- Modifies boot configuration data using bcdedit
PID:1340
-
-
C:\Windows\SYSTEM32\wbadmin.exewbadmin DELETE SYSTEMSTATEBACKUP2⤵
- Deletes System State backups
- Drops file in Windows directory
PID:4928
-
-
C:\Windows\SYSTEM32\wbadmin.exewbadmin DELETE SYSTEMSTATEBACKUP -deleteOldest2⤵
- Deletes System State backups
- Drops file in Windows directory
PID:3772
-
-
C:\Windows\System32\Wbem\wmic.exewmic.exe SHADOWCOPY /nointeractive2⤵
- Suspicious use of AdjustPrivilegeToken
PID:2408
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2212