Analysis
- max time kernel
150s - max time network
124s - platform
windows10-2004_x64 - resource
win10v2004-20220414-en - submitted
24/04/2022, 03:48
Static task
static1
Behavioral task
behavioral1
Sample
1-de.exe
Resource
win7-20220414-en
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
1-de.exe
Resource
win10v2004-20220414-en
windows10-2004_x64
0 signatures
0 seconds
General
- Target 1-de.exe
- Size 819KB
- Sample220424-ecsa4acbfm
- SHA256 a5eb835060919717bdddb6d66b08618586d55bfb41ccef791c4b5beb7ee319a3
- MD5 865a58f7fc861377f98d933165690110
- SHA1 d8ed586d83e3b37abc0b439ea175799769e9eec5
- SHA512 aab5cd363912a01268afe5fdbb769b50754c1f81d1447116826c0d832e988b2bd1d82386bbe9b088547b5094ec3b0ad26c9d7d5d1ebff1a8992492157616cc7c
- MD5 SHA1 SHA512
Score
10/10
Malware Config
Extracted
Path
-
C:\ako-readme.txt
-
ako
Ransom Note
- Your network have been locked. All your files, documents, photos, databases and other important data are encrypted and have the extension: .0ZaqOC Backups and shadow copies also encrypted or removed. Any third-party software may damage encrypted data but not recover. From this moment, it will be impossible to use files until they are decrypted. The only method of recovering files is to purchase an unique private key. Only we can give you this key and only we can recovery your files. To get info (decrypt your files) follow this steps: 1) Download and install Tor Browser: https://www.torproject.org/download/ 2) Open our website in TOR: http://kwvhrdibgmmpkhkidrby4mccwqpds5za6uo2thcw5gz75qncv7rbhyad.onion/AHXYFYBKTAXNGRZB 3) Paste your ID in form (you can find your ID below) !! ATTENTION !! !! Any third - party software may damage encrypted data but not recover. !! DO NOT MODIFY ENCRYPTED FILES !! DO NOT CHANGE YOUR ID !! DO NOT REMOVE YOUR ID.KEY FILE --- BEGIN PERSONAL ID --- eyJleHQiOiIuMFphcU9DIiwgImtleSI6IjEwTDRsWXNveVltRlgzUGVaTUJXNGp iV0M4dXc0RGRWUUhhY3FTSTI2WVlqR1hrUVl6bTI2V2FsRjFYdXdDSTJaaDFxa lNyUGJJNWZkS0JDeGFGT1BIR0M4QnBFWGxOTHBWd21hbGhWZ0E0NCtoYWU2akp xQ0g2SE9ONExXanlQTERFbkNVVVRtSEsxVFh1WlZab2c1bXpyK2hraU9nTDNpQ URsZzJIaWUvdS9YK0NycWlPc0JGbG5Sa1dOcU5kM3NGa09xYnpNK2ZuZUViS0p YRHFSby9IeHUvTGhuZ1RrOEU4SVdNZ2lERkd5MmN1TDlhZU1PcWo2cHQ1NlB3U DFpU1E2cjFFck1yUmhLU2VJWG55ek1aSlUvcVE1dW5BaWRuS0wyWjF4Q1dnNUN vMDByYWJoRUkxYVlPUlh0TWtZVSs5dThrR0VtcEZQcVhrVzlyNExzQT09IiwgI m5ldHdvcmsiOiJmYWxzZSIsICJzdWJpZCI6IjAiLCAidmVyIjoiMC41In0= --- END PERSONAL ID ---
URLs
-
http://kwvhrdibgmmpkhkidrby4mccwqpds5za6uo2thcw5gz75qncv7rbhyad.onion/AHXYFYBKTAXNGRZB
Signatures
- Ako
Ransomware strain discovered in early 2020.
- Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
- Modifies boot configuration data using bcdedit 1 TTPs 6 IoCs
pid Process 2664 bcdedit.exe 5064 bcdedit.exe 4400 bcdedit.exe 3644 bcdedit.exe 4628 bcdedit.exe 232 bcdedit.exe -
pid Process 488 wbadmin.exe 5068 wbadmin.exe 1480 wbadmin.exe 4676 wbadmin.exe 3476 wbadmin.exe 3860 wbadmin.exe - Modifies extensions of user files 4 IoCs
Ransomware generally changes the extension on encrypted files.
description ioc Process File renamed C:\Users\Admin\Pictures\DenyUnregister.crw => C:\Users\Admin\Pictures\DenyUnregister.crw.0ZaqOC 1-de.exe File renamed C:\Users\Admin\Pictures\RedoReset.raw => C:\Users\Admin\Pictures\RedoReset.raw.0ZaqOC 1-de.exe File renamed C:\Users\Admin\Pictures\SendEdit.raw => C:\Users\Admin\Pictures\SendEdit.raw.0ZaqOC 1-de.exe File renamed C:\Users\Admin\Pictures\ClearAssert.tif => C:\Users\Admin\Pictures\ClearAssert.tif.0ZaqOC 1-de.exe - Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Enumerates connected drives 3 TTPs 24 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\G: 1-de.exe File opened (read-only) \??\J: 1-de.exe File opened (read-only) \??\K: 1-de.exe File opened (read-only) \??\Q: 1-de.exe File opened (read-only) \??\R: 1-de.exe File opened (read-only) \??\A: 1-de.exe File opened (read-only) \??\B: 1-de.exe File opened (read-only) \??\E: 1-de.exe File opened (read-only) \??\T: 1-de.exe File opened (read-only) \??\W: 1-de.exe File opened (read-only) \??\Z: 1-de.exe File opened (read-only) \??\S: 1-de.exe File opened (read-only) \??\H: 1-de.exe File opened (read-only) \??\I: 1-de.exe File opened (read-only) \??\M: 1-de.exe File opened (read-only) \??\Y: 1-de.exe File opened (read-only) \??\F: 1-de.exe File opened (read-only) \??\L: 1-de.exe File opened (read-only) \??\O: 1-de.exe File opened (read-only) \??\V: 1-de.exe File opened (read-only) \??\X: 1-de.exe File opened (read-only) \??\N: 1-de.exe File opened (read-only) \??\P: 1-de.exe File opened (read-only) \??\U: 1-de.exe - Drops file in Windows directory 18 IoCs
description ioc Process File opened for modification C:\Windows\Logs\WindowsBackup\WBEngine.3.etl wbadmin.exe File opened for modification C:\Windows\Logs\WindowsBackup\WBEngine.2.etl wbadmin.exe File opened for modification C:\Windows\Logs\WindowsBackup\WBEngine.3.etl wbadmin.exe File opened for modification C:\Windows\Logs\WindowsBackup\WBEngine.1.etl wbadmin.exe File opened for modification C:\Windows\Logs\WindowsBackup\WBEngine.1.etl wbadmin.exe File opened for modification C:\Windows\Logs\WindowsBackup\WBEngine.2.etl wbadmin.exe File opened for modification C:\Windows\Logs\WindowsBackup\WBEngine.2.etl wbadmin.exe File opened for modification C:\Windows\Logs\WindowsBackup\WBEngine.1.etl wbadmin.exe File opened for modification C:\Windows\Logs\WindowsBackup\WBEngine.1.etl wbadmin.exe File opened for modification C:\Windows\Logs\WindowsBackup\WBEngine.2.etl wbadmin.exe File opened for modification C:\Windows\Logs\WindowsBackup\WBEngine.1.etl wbadmin.exe File opened for modification C:\Windows\Logs\WindowsBackup\WBEngine.3.etl wbadmin.exe File opened for modification C:\Windows\Logs\WindowsBackup\WBEngine.2.etl wbadmin.exe File opened for modification C:\Windows\Logs\WindowsBackup\WBEngine.3.etl wbadmin.exe File opened for modification C:\Windows\Logs\WindowsBackup\WBEngine.1.etl wbadmin.exe File opened for modification C:\Windows\Logs\WindowsBackup\WBEngine.2.etl wbadmin.exe File opened for modification C:\Windows\Logs\WindowsBackup\WBEngine.3.etl wbadmin.exe File opened for modification C:\Windows\Logs\WindowsBackup\WBEngine.3.etl wbadmin.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Interacts with shadow copies 2 TTPs 3 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
pid Process 320 vssadmin.exe 4496 vssadmin.exe 4108 vssadmin.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeBackupPrivilege 1904 vssvc.exe Token: SeRestorePrivilege 1904 vssvc.exe Token: SeAuditPrivilege 1904 vssvc.exe Token: SeIncreaseQuotaPrivilege 2260 wmic.exe Token: SeSecurityPrivilege 2260 wmic.exe Token: SeTakeOwnershipPrivilege 2260 wmic.exe Token: SeLoadDriverPrivilege 2260 wmic.exe Token: SeSystemProfilePrivilege 2260 wmic.exe Token: SeSystemtimePrivilege 2260 wmic.exe Token: SeProfSingleProcessPrivilege 2260 wmic.exe Token: SeIncBasePriorityPrivilege 2260 wmic.exe Token: SeCreatePagefilePrivilege 2260 wmic.exe Token: SeBackupPrivilege 2260 wmic.exe Token: SeRestorePrivilege 2260 wmic.exe Token: SeShutdownPrivilege 2260 wmic.exe Token: SeDebugPrivilege 2260 wmic.exe Token: SeSystemEnvironmentPrivilege 2260 wmic.exe Token: SeRemoteShutdownPrivilege 2260 wmic.exe Token: SeUndockPrivilege 2260 wmic.exe Token: SeManageVolumePrivilege 2260 wmic.exe Token: 33 2260 wmic.exe Token: 34 2260 wmic.exe Token: 35 2260 wmic.exe Token: 36 2260 wmic.exe Token: SeIncreaseQuotaPrivilege 5056 wmic.exe Token: SeSecurityPrivilege 5056 wmic.exe Token: SeTakeOwnershipPrivilege 5056 wmic.exe Token: SeLoadDriverPrivilege 5056 wmic.exe Token: SeSystemProfilePrivilege 5056 wmic.exe Token: SeSystemtimePrivilege 5056 wmic.exe Token: SeProfSingleProcessPrivilege 5056 wmic.exe Token: SeIncBasePriorityPrivilege 5056 wmic.exe Token: SeCreatePagefilePrivilege 5056 wmic.exe Token: SeBackupPrivilege 5056 wmic.exe Token: SeRestorePrivilege 5056 wmic.exe Token: SeShutdownPrivilege 5056 wmic.exe Token: SeDebugPrivilege 5056 wmic.exe Token: SeSystemEnvironmentPrivilege 5056 wmic.exe Token: SeRemoteShutdownPrivilege 5056 wmic.exe Token: SeUndockPrivilege 5056 wmic.exe Token: SeManageVolumePrivilege 5056 wmic.exe Token: 33 5056 wmic.exe Token: 34 5056 wmic.exe Token: 35 5056 wmic.exe Token: 36 5056 wmic.exe Token: SeIncreaseQuotaPrivilege 3704 wmic.exe Token: SeSecurityPrivilege 3704 wmic.exe Token: SeTakeOwnershipPrivilege 3704 wmic.exe Token: SeLoadDriverPrivilege 3704 wmic.exe Token: SeSystemProfilePrivilege 3704 wmic.exe Token: SeSystemtimePrivilege 3704 wmic.exe Token: SeProfSingleProcessPrivilege 3704 wmic.exe Token: SeIncBasePriorityPrivilege 3704 wmic.exe Token: SeCreatePagefilePrivilege 3704 wmic.exe Token: SeBackupPrivilege 3704 wmic.exe Token: SeRestorePrivilege 3704 wmic.exe Token: SeShutdownPrivilege 3704 wmic.exe Token: SeDebugPrivilege 3704 wmic.exe Token: SeSystemEnvironmentPrivilege 3704 wmic.exe Token: SeRemoteShutdownPrivilege 3704 wmic.exe Token: SeUndockPrivilege 3704 wmic.exe Token: SeManageVolumePrivilege 3704 wmic.exe Token: 33 3704 wmic.exe Token: 34 3704 wmic.exe - Suspicious use of WriteProcessMemory 36 IoCs
description pid Process procid_target PID 888 wrote to memory of 320 888 1-de.exe 81 PID 888 wrote to memory of 320 888 1-de.exe 81 PID 888 wrote to memory of 2664 888 1-de.exe 85 PID 888 wrote to memory of 2664 888 1-de.exe 85 PID 888 wrote to memory of 5064 888 1-de.exe 87 PID 888 wrote to memory of 5064 888 1-de.exe 87 PID 888 wrote to memory of 488 888 1-de.exe 89 PID 888 wrote to memory of 488 888 1-de.exe 89 PID 888 wrote to memory of 5068 888 1-de.exe 91 PID 888 wrote to memory of 5068 888 1-de.exe 91 PID 888 wrote to memory of 2260 888 1-de.exe 93 PID 888 wrote to memory of 2260 888 1-de.exe 93 PID 888 wrote to memory of 4496 888 1-de.exe 95 PID 888 wrote to memory of 4496 888 1-de.exe 95 PID 888 wrote to memory of 4400 888 1-de.exe 97 PID 888 wrote to memory of 4400 888 1-de.exe 97 PID 888 wrote to memory of 3644 888 1-de.exe 99 PID 888 wrote to memory of 3644 888 1-de.exe 99 PID 888 wrote to memory of 1480 888 1-de.exe 101 PID 888 wrote to memory of 1480 888 1-de.exe 101 PID 888 wrote to memory of 4676 888 1-de.exe 103 PID 888 wrote to memory of 4676 888 1-de.exe 103 PID 888 wrote to memory of 5056 888 1-de.exe 105 PID 888 wrote to memory of 5056 888 1-de.exe 105 PID 888 wrote to memory of 4108 888 1-de.exe 107 PID 888 wrote to memory of 4108 888 1-de.exe 107 PID 888 wrote to memory of 4628 888 1-de.exe 109 PID 888 wrote to memory of 4628 888 1-de.exe 109 PID 888 wrote to memory of 232 888 1-de.exe 111 PID 888 wrote to memory of 232 888 1-de.exe 111 PID 888 wrote to memory of 3476 888 1-de.exe 113 PID 888 wrote to memory of 3476 888 1-de.exe 113 PID 888 wrote to memory of 3860 888 1-de.exe 115 PID 888 wrote to memory of 3860 888 1-de.exe 115 PID 888 wrote to memory of 3704 888 1-de.exe 117 PID 888 wrote to memory of 3704 888 1-de.exe 117 - System policy modification 1 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLinkedConnections = "1" 1-de.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\1-de.exe"C:\Users\Admin\AppData\Local\Temp\1-de.exe"1⤵
- Modifies extensions of user files
- Enumerates connected drives
- Suspicious use of WriteProcessMemory
- System policy modification
PID:888 -
C:\Windows\SYSTEM32\vssadmin.exevssadmin.exe Delete Shadows /All /Quiet2⤵
- Interacts with shadow copies
PID:320
-
-
C:\Windows\SYSTEM32\bcdedit.exebcdedit.exe /set {default} recoveryenabled No2⤵
- Modifies boot configuration data using bcdedit
PID:2664
-
-
C:\Windows\SYSTEM32\bcdedit.exebcdedit.exe /set {default} bootstatuspolicy ignoreallfailures2⤵
- Modifies boot configuration data using bcdedit
PID:5064
-
-
C:\Windows\SYSTEM32\wbadmin.exewbadmin DELETE SYSTEMSTATEBACKUP2⤵
- Deletes System State backups
- Drops file in Windows directory
PID:488
-
-
C:\Windows\SYSTEM32\wbadmin.exewbadmin DELETE SYSTEMSTATEBACKUP -deleteOldest2⤵
- Deletes System State backups
- Drops file in Windows directory
PID:5068
-
-
C:\Windows\System32\Wbem\wmic.exewmic.exe SHADOWCOPY /nointeractive2⤵
- Suspicious use of AdjustPrivilegeToken
PID:2260
-
-
C:\Windows\SYSTEM32\vssadmin.exevssadmin.exe Delete Shadows /All /Quiet2⤵
- Interacts with shadow copies
PID:4496
-
-
C:\Windows\SYSTEM32\bcdedit.exebcdedit.exe /set {default} recoveryenabled No2⤵
- Modifies boot configuration data using bcdedit
PID:4400
-
-
C:\Windows\SYSTEM32\bcdedit.exebcdedit.exe /set {default} bootstatuspolicy ignoreallfailures2⤵
- Modifies boot configuration data using bcdedit
PID:3644
-
-
C:\Windows\SYSTEM32\wbadmin.exewbadmin DELETE SYSTEMSTATEBACKUP2⤵
- Deletes System State backups
- Drops file in Windows directory
PID:1480
-
-
C:\Windows\SYSTEM32\wbadmin.exewbadmin DELETE SYSTEMSTATEBACKUP -deleteOldest2⤵
- Deletes System State backups
- Drops file in Windows directory
PID:4676
-
-
C:\Windows\System32\Wbem\wmic.exewmic.exe SHADOWCOPY /nointeractive2⤵
- Suspicious use of AdjustPrivilegeToken
PID:5056
-
-
C:\Windows\SYSTEM32\vssadmin.exevssadmin.exe Delete Shadows /All /Quiet2⤵
- Interacts with shadow copies
PID:4108
-
-
C:\Windows\SYSTEM32\bcdedit.exebcdedit.exe /set {default} recoveryenabled No2⤵
- Modifies boot configuration data using bcdedit
PID:4628
-
-
C:\Windows\SYSTEM32\bcdedit.exebcdedit.exe /set {default} bootstatuspolicy ignoreallfailures2⤵
- Modifies boot configuration data using bcdedit
PID:232
-
-
C:\Windows\SYSTEM32\wbadmin.exewbadmin DELETE SYSTEMSTATEBACKUP2⤵
- Deletes System State backups
- Drops file in Windows directory
PID:3476
-
-
C:\Windows\SYSTEM32\wbadmin.exewbadmin DELETE SYSTEMSTATEBACKUP -deleteOldest2⤵
- Deletes System State backups
- Drops file in Windows directory
PID:3860
-
-
C:\Windows\System32\Wbem\wmic.exewmic.exe SHADOWCOPY /nointeractive2⤵
- Suspicious use of AdjustPrivilegeToken
PID:3704
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1904