Analysis
- max time kernel
150s - max time network
45s - platform
windows7_x64 - resource
win7-20220414-en - submitted
24/04/2022, 03:48
Static task
static1
Behavioral task
behavioral1
Sample
1-de.exe
Resource
win7-20220414-en
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
1-de.exe
Resource
win10v2004-20220414-en
windows10-2004_x64
0 signatures
0 seconds
General
- Target 1-de.exe
- Size 819KB
- Sample220424-ecsa4acbfm
- SHA256 a5eb835060919717bdddb6d66b08618586d55bfb41ccef791c4b5beb7ee319a3
- MD5 865a58f7fc861377f98d933165690110
- SHA1 d8ed586d83e3b37abc0b439ea175799769e9eec5
- SHA512 aab5cd363912a01268afe5fdbb769b50754c1f81d1447116826c0d832e988b2bd1d82386bbe9b088547b5094ec3b0ad26c9d7d5d1ebff1a8992492157616cc7c
- MD5 SHA1 SHA512
Score
10/10
Malware Config
Extracted
Path
-
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\ako-readme.txt
-
ako
Ransom Note
- Your network have been locked. All your files, documents, photos, databases and other important data are encrypted and have the extension: .0ZaqOC Backups and shadow copies also encrypted or removed. Any third-party software may damage encrypted data but not recover. From this moment, it will be impossible to use files until they are decrypted. The only method of recovering files is to purchase an unique private key. Only we can give you this key and only we can recovery your files. To get info (decrypt your files) follow this steps: 1) Download and install Tor Browser: https://www.torproject.org/download/ 2) Open our website in TOR: http://kwvhrdibgmmpkhkidrby4mccwqpds5za6uo2thcw5gz75qncv7rbhyad.onion/AHXYFYBKTAXNGRZB 3) Paste your ID in form (you can find your ID below) !! ATTENTION !! !! Any third - party software may damage encrypted data but not recover. !! DO NOT MODIFY ENCRYPTED FILES !! DO NOT CHANGE YOUR ID !! DO NOT REMOVE YOUR ID.KEY FILE --- BEGIN PERSONAL ID --- eyJleHQiOiIuMFphcU9DIiwgImtleSI6IjhVdmV6TW1mMHhEZW53WlpsbG5RbHo veHdXTXZYTjYyKzJhN09aaFpQTlFWWnl3WXhPQWlNQ1JvSDBVSXBzMjFrcWtKN ldYYVhlckw5U1Vkc2xXM29tVStoSmNPQnd1Vm9Kd0lKcXNVR2xtc0xJazNVcHN TN2czM2ZNTmRteUFxcU1sMUJMc3JyR3g1M3BwZDRselZTTUZLVzlLb0dMNnB5Z 2I5clJIMUxWdjlhd3BwLzliaWplT3JZcTJIdXpoa0g2NFFuRG1malZtdE9rRnB qNllTK3BFVmJDM0hFZlVsczAvUE1zMGdRc1JKT2U2QytwQk9pUXlPOEhHclpsS nMyK1psTFU1TTJDTkR6TUE2VHE5UDdNWmNLeXBoWlJOeSswQ1RyakZmUCtERkQ 5SkdoV2lRclZKZWExZkV0eXc1QVlqZ1ZSdkdHUE5hNnlwTHpkeTFpZz09IiwgI m5ldHdvcmsiOiJmYWxzZSIsICJzdWJpZCI6IjAiLCAidmVyIjoiMC41In0= --- END PERSONAL ID ---
URLs
-
http://kwvhrdibgmmpkhkidrby4mccwqpds5za6uo2thcw5gz75qncv7rbhyad.onion/AHXYFYBKTAXNGRZB
Signatures
- Ako
Ransomware strain discovered in early 2020.
- Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
- Modifies boot configuration data using bcdedit 1 TTPs 6 IoCs
pid Process 2008 bcdedit.exe 1396 bcdedit.exe 1112 bcdedit.exe 1884 bcdedit.exe 212 bcdedit.exe 236 bcdedit.exe -
pid Process 1160 wbadmin.exe 812 wbadmin.exe 932 wbadmin.exe 544 wbadmin.exe 1892 wbadmin.exe 1792 wbadmin.exe - Modifies extensions of user files 8 IoCs
Ransomware generally changes the extension on encrypted files.
description ioc Process File renamed C:\Users\Admin\Pictures\GrantWait.png => C:\Users\Admin\Pictures\GrantWait.png.0ZaqOC 1-de.exe File renamed C:\Users\Admin\Pictures\ImportComplete.raw => C:\Users\Admin\Pictures\ImportComplete.raw.0ZaqOC 1-de.exe File opened for modification C:\Users\Admin\Pictures\NewBackup.tiff 1-de.exe File renamed C:\Users\Admin\Pictures\NewBackup.tiff => C:\Users\Admin\Pictures\NewBackup.tiff.0ZaqOC 1-de.exe File opened for modification C:\Users\Admin\Pictures\ResumeEdit.tiff 1-de.exe File renamed C:\Users\Admin\Pictures\ResumeEdit.tiff => C:\Users\Admin\Pictures\ResumeEdit.tiff.0ZaqOC 1-de.exe File renamed C:\Users\Admin\Pictures\UnregisterGrant.raw => C:\Users\Admin\Pictures\UnregisterGrant.raw.0ZaqOC 1-de.exe File renamed C:\Users\Admin\Pictures\ConvertToSet.raw => C:\Users\Admin\Pictures\ConvertToSet.raw.0ZaqOC 1-de.exe - Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Enumerates connected drives 3 TTPs 24 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\M: 1-de.exe File opened (read-only) \??\Y: 1-de.exe File opened (read-only) \??\T: 1-de.exe File opened (read-only) \??\W: 1-de.exe File opened (read-only) \??\A: 1-de.exe File opened (read-only) \??\F: 1-de.exe File opened (read-only) \??\H: 1-de.exe File opened (read-only) \??\L: 1-de.exe File opened (read-only) \??\O: 1-de.exe File opened (read-only) \??\S: 1-de.exe File opened (read-only) \??\Z: 1-de.exe File opened (read-only) \??\B: 1-de.exe File opened (read-only) \??\I: 1-de.exe File opened (read-only) \??\J: 1-de.exe File opened (read-only) \??\Q: 1-de.exe File opened (read-only) \??\V: 1-de.exe File opened (read-only) \??\X: 1-de.exe File opened (read-only) \??\U: 1-de.exe File opened (read-only) \??\E: 1-de.exe File opened (read-only) \??\G: 1-de.exe File opened (read-only) \??\K: 1-de.exe File opened (read-only) \??\N: 1-de.exe File opened (read-only) \??\P: 1-de.exe File opened (read-only) \??\R: 1-de.exe - Drops file in Windows directory 18 IoCs
description ioc Process File opened for modification C:\Windows\Logs\WindowsBackup\Wbadmin.2.etl wbadmin.exe File opened for modification C:\Windows\Logs\WindowsBackup\Wbadmin.2.etl wbadmin.exe File opened for modification C:\Windows\Logs\WindowsBackup\Wbadmin.2.etl wbadmin.exe File opened for modification C:\Windows\Logs\WindowsBackup\Wbadmin.1.etl wbadmin.exe File opened for modification C:\Windows\Logs\WindowsBackup\Wbadmin.3.etl wbadmin.exe File opened for modification C:\Windows\Logs\WindowsBackup\Wbadmin.3.etl wbadmin.exe File opened for modification C:\Windows\Logs\WindowsBackup\Wbadmin.2.etl wbadmin.exe File opened for modification C:\Windows\Logs\WindowsBackup\Wbadmin.1.etl wbadmin.exe File opened for modification C:\Windows\Logs\WindowsBackup\Wbadmin.3.etl wbadmin.exe File opened for modification C:\Windows\Logs\WindowsBackup\Wbadmin.1.etl wbadmin.exe File opened for modification C:\Windows\Logs\WindowsBackup\Wbadmin.3.etl wbadmin.exe File opened for modification C:\Windows\Logs\WindowsBackup\Wbadmin.3.etl wbadmin.exe File opened for modification C:\Windows\Logs\WindowsBackup\Wbadmin.3.etl wbadmin.exe File opened for modification C:\Windows\Logs\WindowsBackup\Wbadmin.2.etl wbadmin.exe File opened for modification C:\Windows\Logs\WindowsBackup\Wbadmin.1.etl wbadmin.exe File opened for modification C:\Windows\Logs\WindowsBackup\Wbadmin.1.etl wbadmin.exe File opened for modification C:\Windows\Logs\WindowsBackup\Wbadmin.2.etl wbadmin.exe File opened for modification C:\Windows\Logs\WindowsBackup\Wbadmin.1.etl wbadmin.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Interacts with shadow copies 2 TTPs 3 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
pid Process 1640 vssadmin.exe 1372 vssadmin.exe 1996 vssadmin.exe - Suspicious use of AdjustPrivilegeToken 63 IoCs
description pid Process Token: SeBackupPrivilege 912 vssvc.exe Token: SeRestorePrivilege 912 vssvc.exe Token: SeAuditPrivilege 912 vssvc.exe Token: SeIncreaseQuotaPrivilege 1992 wmic.exe Token: SeSecurityPrivilege 1992 wmic.exe Token: SeTakeOwnershipPrivilege 1992 wmic.exe Token: SeLoadDriverPrivilege 1992 wmic.exe Token: SeSystemProfilePrivilege 1992 wmic.exe Token: SeSystemtimePrivilege 1992 wmic.exe Token: SeProfSingleProcessPrivilege 1992 wmic.exe Token: SeIncBasePriorityPrivilege 1992 wmic.exe Token: SeCreatePagefilePrivilege 1992 wmic.exe Token: SeBackupPrivilege 1992 wmic.exe Token: SeRestorePrivilege 1992 wmic.exe Token: SeShutdownPrivilege 1992 wmic.exe Token: SeDebugPrivilege 1992 wmic.exe Token: SeSystemEnvironmentPrivilege 1992 wmic.exe Token: SeRemoteShutdownPrivilege 1992 wmic.exe Token: SeUndockPrivilege 1992 wmic.exe Token: SeManageVolumePrivilege 1992 wmic.exe Token: 33 1992 wmic.exe Token: 34 1992 wmic.exe Token: 35 1992 wmic.exe Token: SeIncreaseQuotaPrivilege 316 wmic.exe Token: SeSecurityPrivilege 316 wmic.exe Token: SeTakeOwnershipPrivilege 316 wmic.exe Token: SeLoadDriverPrivilege 316 wmic.exe Token: SeSystemProfilePrivilege 316 wmic.exe Token: SeSystemtimePrivilege 316 wmic.exe Token: SeProfSingleProcessPrivilege 316 wmic.exe Token: SeIncBasePriorityPrivilege 316 wmic.exe Token: SeCreatePagefilePrivilege 316 wmic.exe Token: SeBackupPrivilege 316 wmic.exe Token: SeRestorePrivilege 316 wmic.exe Token: SeShutdownPrivilege 316 wmic.exe Token: SeDebugPrivilege 316 wmic.exe Token: SeSystemEnvironmentPrivilege 316 wmic.exe Token: SeRemoteShutdownPrivilege 316 wmic.exe Token: SeUndockPrivilege 316 wmic.exe Token: SeManageVolumePrivilege 316 wmic.exe Token: 33 316 wmic.exe Token: 34 316 wmic.exe Token: 35 316 wmic.exe Token: SeIncreaseQuotaPrivilege 1480 wmic.exe Token: SeSecurityPrivilege 1480 wmic.exe Token: SeTakeOwnershipPrivilege 1480 wmic.exe Token: SeLoadDriverPrivilege 1480 wmic.exe Token: SeSystemProfilePrivilege 1480 wmic.exe Token: SeSystemtimePrivilege 1480 wmic.exe Token: SeProfSingleProcessPrivilege 1480 wmic.exe Token: SeIncBasePriorityPrivilege 1480 wmic.exe Token: SeCreatePagefilePrivilege 1480 wmic.exe Token: SeBackupPrivilege 1480 wmic.exe Token: SeRestorePrivilege 1480 wmic.exe Token: SeShutdownPrivilege 1480 wmic.exe Token: SeDebugPrivilege 1480 wmic.exe Token: SeSystemEnvironmentPrivilege 1480 wmic.exe Token: SeRemoteShutdownPrivilege 1480 wmic.exe Token: SeUndockPrivilege 1480 wmic.exe Token: SeManageVolumePrivilege 1480 wmic.exe Token: 33 1480 wmic.exe Token: 34 1480 wmic.exe Token: 35 1480 wmic.exe - Suspicious use of WriteProcessMemory 54 IoCs
description pid Process procid_target PID 1016 wrote to memory of 1640 1016 1-de.exe 28 PID 1016 wrote to memory of 1640 1016 1-de.exe 28 PID 1016 wrote to memory of 1640 1016 1-de.exe 28 PID 1016 wrote to memory of 2008 1016 1-de.exe 32 PID 1016 wrote to memory of 2008 1016 1-de.exe 32 PID 1016 wrote to memory of 2008 1016 1-de.exe 32 PID 1016 wrote to memory of 1396 1016 1-de.exe 34 PID 1016 wrote to memory of 1396 1016 1-de.exe 34 PID 1016 wrote to memory of 1396 1016 1-de.exe 34 PID 1016 wrote to memory of 1160 1016 1-de.exe 36 PID 1016 wrote to memory of 1160 1016 1-de.exe 36 PID 1016 wrote to memory of 1160 1016 1-de.exe 36 PID 1016 wrote to memory of 812 1016 1-de.exe 38 PID 1016 wrote to memory of 812 1016 1-de.exe 38 PID 1016 wrote to memory of 812 1016 1-de.exe 38 PID 1016 wrote to memory of 1992 1016 1-de.exe 40 PID 1016 wrote to memory of 1992 1016 1-de.exe 40 PID 1016 wrote to memory of 1992 1016 1-de.exe 40 PID 1016 wrote to memory of 1372 1016 1-de.exe 42 PID 1016 wrote to memory of 1372 1016 1-de.exe 42 PID 1016 wrote to memory of 1372 1016 1-de.exe 42 PID 1016 wrote to memory of 1112 1016 1-de.exe 44 PID 1016 wrote to memory of 1112 1016 1-de.exe 44 PID 1016 wrote to memory of 1112 1016 1-de.exe 44 PID 1016 wrote to memory of 1884 1016 1-de.exe 46 PID 1016 wrote to memory of 1884 1016 1-de.exe 46 PID 1016 wrote to memory of 1884 1016 1-de.exe 46 PID 1016 wrote to memory of 932 1016 1-de.exe 48 PID 1016 wrote to memory of 932 1016 1-de.exe 48 PID 1016 wrote to memory of 932 1016 1-de.exe 48 PID 1016 wrote to memory of 544 1016 1-de.exe 50 PID 1016 wrote to memory of 544 1016 1-de.exe 50 PID 1016 wrote to memory of 544 1016 1-de.exe 50 PID 1016 wrote to memory of 316 1016 1-de.exe 52 PID 1016 wrote to memory of 316 1016 1-de.exe 52 PID 1016 wrote to memory of 316 1016 1-de.exe 52 PID 1016 wrote to memory of 1996 1016 1-de.exe 54 PID 1016 wrote to memory of 1996 1016 1-de.exe 54 PID 1016 wrote to memory of 1996 1016 1-de.exe 54 PID 1016 wrote to memory of 212 1016 1-de.exe 56 PID 1016 wrote to memory of 212 1016 1-de.exe 56 PID 1016 wrote to memory of 212 1016 1-de.exe 56 PID 1016 wrote to memory of 236 1016 1-de.exe 58 PID 1016 wrote to memory of 236 1016 1-de.exe 58 PID 1016 wrote to memory of 236 1016 1-de.exe 58 PID 1016 wrote to memory of 1892 1016 1-de.exe 60 PID 1016 wrote to memory of 1892 1016 1-de.exe 60 PID 1016 wrote to memory of 1892 1016 1-de.exe 60 PID 1016 wrote to memory of 1792 1016 1-de.exe 62 PID 1016 wrote to memory of 1792 1016 1-de.exe 62 PID 1016 wrote to memory of 1792 1016 1-de.exe 62 PID 1016 wrote to memory of 1480 1016 1-de.exe 64 PID 1016 wrote to memory of 1480 1016 1-de.exe 64 PID 1016 wrote to memory of 1480 1016 1-de.exe 64 - System policy modification 1 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLinkedConnections = "1" 1-de.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\1-de.exe"C:\Users\Admin\AppData\Local\Temp\1-de.exe"1⤵
- Modifies extensions of user files
- Enumerates connected drives
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1016 -
C:\Windows\system32\vssadmin.exevssadmin.exe Delete Shadows /All /Quiet2⤵
- Interacts with shadow copies
PID:1640
-
-
C:\Windows\system32\bcdedit.exebcdedit.exe /set {default} recoveryenabled No2⤵
- Modifies boot configuration data using bcdedit
PID:2008
-
-
C:\Windows\system32\bcdedit.exebcdedit.exe /set {default} bootstatuspolicy ignoreallfailures2⤵
- Modifies boot configuration data using bcdedit
PID:1396
-
-
C:\Windows\system32\wbadmin.exewbadmin DELETE SYSTEMSTATEBACKUP2⤵
- Deletes System State backups
- Drops file in Windows directory
PID:1160
-
-
C:\Windows\system32\wbadmin.exewbadmin DELETE SYSTEMSTATEBACKUP -deleteOldest2⤵
- Deletes System State backups
- Drops file in Windows directory
PID:812
-
-
C:\Windows\System32\Wbem\wmic.exewmic.exe SHADOWCOPY /nointeractive2⤵
- Suspicious use of AdjustPrivilegeToken
PID:1992
-
-
C:\Windows\system32\vssadmin.exevssadmin.exe Delete Shadows /All /Quiet2⤵
- Interacts with shadow copies
PID:1372
-
-
C:\Windows\system32\bcdedit.exebcdedit.exe /set {default} recoveryenabled No2⤵
- Modifies boot configuration data using bcdedit
PID:1112
-
-
C:\Windows\system32\bcdedit.exebcdedit.exe /set {default} bootstatuspolicy ignoreallfailures2⤵
- Modifies boot configuration data using bcdedit
PID:1884
-
-
C:\Windows\system32\wbadmin.exewbadmin DELETE SYSTEMSTATEBACKUP2⤵
- Deletes System State backups
- Drops file in Windows directory
PID:932
-
-
C:\Windows\system32\wbadmin.exewbadmin DELETE SYSTEMSTATEBACKUP -deleteOldest2⤵
- Deletes System State backups
- Drops file in Windows directory
PID:544
-
-
C:\Windows\System32\Wbem\wmic.exewmic.exe SHADOWCOPY /nointeractive2⤵
- Suspicious use of AdjustPrivilegeToken
PID:316
-
-
C:\Windows\system32\vssadmin.exevssadmin.exe Delete Shadows /All /Quiet2⤵
- Interacts with shadow copies
PID:1996
-
-
C:\Windows\system32\bcdedit.exebcdedit.exe /set {default} recoveryenabled No2⤵
- Modifies boot configuration data using bcdedit
PID:212
-
-
C:\Windows\system32\bcdedit.exebcdedit.exe /set {default} bootstatuspolicy ignoreallfailures2⤵
- Modifies boot configuration data using bcdedit
PID:236
-
-
C:\Windows\system32\wbadmin.exewbadmin DELETE SYSTEMSTATEBACKUP2⤵
- Deletes System State backups
- Drops file in Windows directory
PID:1892
-
-
C:\Windows\system32\wbadmin.exewbadmin DELETE SYSTEMSTATEBACKUP -deleteOldest2⤵
- Deletes System State backups
- Drops file in Windows directory
PID:1792
-
-
C:\Windows\System32\Wbem\wmic.exewmic.exe SHADOWCOPY /nointeractive2⤵
- Suspicious use of AdjustPrivilegeToken
PID:1480
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:912