Analysis
-
max time kernel
153s -
max time network
157s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
25-06-2022 03:27
Static task
static1
Behavioral task
behavioral1
Sample
3a7fc7f88858839b8eddbbecfdb46a37f220777460fe4a49b14694520591e062.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
3a7fc7f88858839b8eddbbecfdb46a37f220777460fe4a49b14694520591e062.exe
Resource
win10v2004-20220414-en
General
-
Target
3a7fc7f88858839b8eddbbecfdb46a37f220777460fe4a49b14694520591e062.exe
-
Size
164KB
-
MD5
dd8cf215be690e359b576be6ce8778f9
-
SHA1
dd01d0a955ae63b144931dc09da0a6659740ad97
-
SHA256
3a7fc7f88858839b8eddbbecfdb46a37f220777460fe4a49b14694520591e062
-
SHA512
1de47ab238c258756a020a0b53fc3384a3ac80ef976d865a701201437ee861894c8759fecfe39bcc6465d16a5a16e482016347969143bd4b42169f3e053f352d
Malware Config
Extracted
C:\s01r78ku56-readme.txt
sodinokibi
http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/A8FEEBA88674E572
http://decryptor.top/A8FEEBA88674E572
Signatures
-
Sodin,Sodinokibi,REvil
Ransomware with advanced anti-analysis and privilege escalation functionality.
-
Modifies extensions of user files 3 IoCs
Ransomware generally changes the extension on encrypted files.
Processes:
3a7fc7f88858839b8eddbbecfdb46a37f220777460fe4a49b14694520591e062.exedescription ioc process File renamed C:\Users\Admin\Pictures\SaveLock.tif => \??\c:\users\admin\pictures\SaveLock.tif.s01r78ku56 3a7fc7f88858839b8eddbbecfdb46a37f220777460fe4a49b14694520591e062.exe File renamed C:\Users\Admin\Pictures\CompareResize.crw => \??\c:\users\admin\pictures\CompareResize.crw.s01r78ku56 3a7fc7f88858839b8eddbbecfdb46a37f220777460fe4a49b14694520591e062.exe File renamed C:\Users\Admin\Pictures\RemoveSwitch.png => \??\c:\users\admin\pictures\RemoveSwitch.png.s01r78ku56 3a7fc7f88858839b8eddbbecfdb46a37f220777460fe4a49b14694520591e062.exe -
Enumerates connected drives 3 TTPs 25 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
3a7fc7f88858839b8eddbbecfdb46a37f220777460fe4a49b14694520591e062.exedescription ioc process File opened (read-only) \??\A: 3a7fc7f88858839b8eddbbecfdb46a37f220777460fe4a49b14694520591e062.exe File opened (read-only) \??\G: 3a7fc7f88858839b8eddbbecfdb46a37f220777460fe4a49b14694520591e062.exe File opened (read-only) \??\N: 3a7fc7f88858839b8eddbbecfdb46a37f220777460fe4a49b14694520591e062.exe File opened (read-only) \??\R: 3a7fc7f88858839b8eddbbecfdb46a37f220777460fe4a49b14694520591e062.exe File opened (read-only) \??\D: 3a7fc7f88858839b8eddbbecfdb46a37f220777460fe4a49b14694520591e062.exe File opened (read-only) \??\F: 3a7fc7f88858839b8eddbbecfdb46a37f220777460fe4a49b14694520591e062.exe File opened (read-only) \??\L: 3a7fc7f88858839b8eddbbecfdb46a37f220777460fe4a49b14694520591e062.exe File opened (read-only) \??\P: 3a7fc7f88858839b8eddbbecfdb46a37f220777460fe4a49b14694520591e062.exe File opened (read-only) \??\X: 3a7fc7f88858839b8eddbbecfdb46a37f220777460fe4a49b14694520591e062.exe File opened (read-only) \??\Z: 3a7fc7f88858839b8eddbbecfdb46a37f220777460fe4a49b14694520591e062.exe File opened (read-only) \??\U: 3a7fc7f88858839b8eddbbecfdb46a37f220777460fe4a49b14694520591e062.exe File opened (read-only) \??\V: 3a7fc7f88858839b8eddbbecfdb46a37f220777460fe4a49b14694520591e062.exe File opened (read-only) \??\W: 3a7fc7f88858839b8eddbbecfdb46a37f220777460fe4a49b14694520591e062.exe File opened (read-only) \??\B: 3a7fc7f88858839b8eddbbecfdb46a37f220777460fe4a49b14694520591e062.exe File opened (read-only) \??\O: 3a7fc7f88858839b8eddbbecfdb46a37f220777460fe4a49b14694520591e062.exe File opened (read-only) \??\Q: 3a7fc7f88858839b8eddbbecfdb46a37f220777460fe4a49b14694520591e062.exe File opened (read-only) \??\S: 3a7fc7f88858839b8eddbbecfdb46a37f220777460fe4a49b14694520591e062.exe File opened (read-only) \??\T: 3a7fc7f88858839b8eddbbecfdb46a37f220777460fe4a49b14694520591e062.exe File opened (read-only) \??\M: 3a7fc7f88858839b8eddbbecfdb46a37f220777460fe4a49b14694520591e062.exe File opened (read-only) \??\Y: 3a7fc7f88858839b8eddbbecfdb46a37f220777460fe4a49b14694520591e062.exe File opened (read-only) \??\E: 3a7fc7f88858839b8eddbbecfdb46a37f220777460fe4a49b14694520591e062.exe File opened (read-only) \??\H: 3a7fc7f88858839b8eddbbecfdb46a37f220777460fe4a49b14694520591e062.exe File opened (read-only) \??\I: 3a7fc7f88858839b8eddbbecfdb46a37f220777460fe4a49b14694520591e062.exe File opened (read-only) \??\J: 3a7fc7f88858839b8eddbbecfdb46a37f220777460fe4a49b14694520591e062.exe File opened (read-only) \??\K: 3a7fc7f88858839b8eddbbecfdb46a37f220777460fe4a49b14694520591e062.exe -
Sets desktop wallpaper using registry 2 TTPs 1 IoCs
Processes:
3a7fc7f88858839b8eddbbecfdb46a37f220777460fe4a49b14694520591e062.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\w39aoe2o31au.bmp" 3a7fc7f88858839b8eddbbecfdb46a37f220777460fe4a49b14694520591e062.exe -
Drops file in Program Files directory 31 IoCs
Processes:
3a7fc7f88858839b8eddbbecfdb46a37f220777460fe4a49b14694520591e062.exedescription ioc process File opened for modification \??\c:\program files\ApproveRedo.ppt 3a7fc7f88858839b8eddbbecfdb46a37f220777460fe4a49b14694520591e062.exe File opened for modification \??\c:\program files\ExpandGroup.crw 3a7fc7f88858839b8eddbbecfdb46a37f220777460fe4a49b14694520591e062.exe File opened for modification \??\c:\program files\FindConfirm.potm 3a7fc7f88858839b8eddbbecfdb46a37f220777460fe4a49b14694520591e062.exe File opened for modification \??\c:\program files\RestartMerge.reg 3a7fc7f88858839b8eddbbecfdb46a37f220777460fe4a49b14694520591e062.exe File opened for modification \??\c:\program files\RestartReset.wmf 3a7fc7f88858839b8eddbbecfdb46a37f220777460fe4a49b14694520591e062.exe File opened for modification \??\c:\program files\UninstallReset.snd 3a7fc7f88858839b8eddbbecfdb46a37f220777460fe4a49b14694520591e062.exe File created \??\c:\program files\s01r78ku56-readme.txt 3a7fc7f88858839b8eddbbecfdb46a37f220777460fe4a49b14694520591e062.exe File opened for modification \??\c:\program files\CompressShow.mp4 3a7fc7f88858839b8eddbbecfdb46a37f220777460fe4a49b14694520591e062.exe File opened for modification \??\c:\program files\ImportPop.pptm 3a7fc7f88858839b8eddbbecfdb46a37f220777460fe4a49b14694520591e062.exe File opened for modification \??\c:\program files\RegisterResolve.ram 3a7fc7f88858839b8eddbbecfdb46a37f220777460fe4a49b14694520591e062.exe File opened for modification \??\c:\program files\LimitComplete.dotx 3a7fc7f88858839b8eddbbecfdb46a37f220777460fe4a49b14694520591e062.exe File opened for modification \??\c:\program files\MeasureUnregister.emf 3a7fc7f88858839b8eddbbecfdb46a37f220777460fe4a49b14694520591e062.exe File opened for modification \??\c:\program files\NewSave.wvx 3a7fc7f88858839b8eddbbecfdb46a37f220777460fe4a49b14694520591e062.exe File opened for modification \??\c:\program files\RegisterConvertFrom.xltx 3a7fc7f88858839b8eddbbecfdb46a37f220777460fe4a49b14694520591e062.exe File opened for modification \??\c:\program files\DismountConnect.xps 3a7fc7f88858839b8eddbbecfdb46a37f220777460fe4a49b14694520591e062.exe File opened for modification \??\c:\program files\ExpandRestart.odt 3a7fc7f88858839b8eddbbecfdb46a37f220777460fe4a49b14694520591e062.exe File opened for modification \??\c:\program files\SelectEnter.aifc 3a7fc7f88858839b8eddbbecfdb46a37f220777460fe4a49b14694520591e062.exe File opened for modification \??\c:\program files\CheckpointGet.html 3a7fc7f88858839b8eddbbecfdb46a37f220777460fe4a49b14694520591e062.exe File opened for modification \??\c:\program files\ConvertToLimit.mpg 3a7fc7f88858839b8eddbbecfdb46a37f220777460fe4a49b14694520591e062.exe File opened for modification \??\c:\program files\HideEnable.mhtml 3a7fc7f88858839b8eddbbecfdb46a37f220777460fe4a49b14694520591e062.exe File opened for modification \??\c:\program files\ImportRead.xps 3a7fc7f88858839b8eddbbecfdb46a37f220777460fe4a49b14694520591e062.exe File opened for modification \??\c:\program files\ResumePublish.vstx 3a7fc7f88858839b8eddbbecfdb46a37f220777460fe4a49b14694520591e062.exe File opened for modification \??\c:\program files\WatchEnter.bmp 3a7fc7f88858839b8eddbbecfdb46a37f220777460fe4a49b14694520591e062.exe File opened for modification \??\c:\program files\ConvertEnable.dib 3a7fc7f88858839b8eddbbecfdb46a37f220777460fe4a49b14694520591e062.exe File opened for modification \??\c:\program files\FormatProtect.pdf 3a7fc7f88858839b8eddbbecfdb46a37f220777460fe4a49b14694520591e062.exe File opened for modification \??\c:\program files\ProtectPublish.shtml 3a7fc7f88858839b8eddbbecfdb46a37f220777460fe4a49b14694520591e062.exe File opened for modification \??\c:\program files\RestartStep.vbe 3a7fc7f88858839b8eddbbecfdb46a37f220777460fe4a49b14694520591e062.exe File created \??\c:\program files (x86)\s01r78ku56-readme.txt 3a7fc7f88858839b8eddbbecfdb46a37f220777460fe4a49b14694520591e062.exe File opened for modification \??\c:\program files\CompareAssert.vdx 3a7fc7f88858839b8eddbbecfdb46a37f220777460fe4a49b14694520591e062.exe File opened for modification \??\c:\program files\RequestOptimize.WTV 3a7fc7f88858839b8eddbbecfdb46a37f220777460fe4a49b14694520591e062.exe File opened for modification \??\c:\program files\ShowBlock.rm 3a7fc7f88858839b8eddbbecfdb46a37f220777460fe4a49b14694520591e062.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
3a7fc7f88858839b8eddbbecfdb46a37f220777460fe4a49b14694520591e062.exepowershell.exepid process 4164 3a7fc7f88858839b8eddbbecfdb46a37f220777460fe4a49b14694520591e062.exe 4164 3a7fc7f88858839b8eddbbecfdb46a37f220777460fe4a49b14694520591e062.exe 4388 powershell.exe 4388 powershell.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes:
powershell.exevssvc.exedescription pid process Token: SeDebugPrivilege 4388 powershell.exe Token: SeBackupPrivilege 4940 vssvc.exe Token: SeRestorePrivilege 4940 vssvc.exe Token: SeAuditPrivilege 4940 vssvc.exe -
Suspicious use of WriteProcessMemory 2 IoCs
Processes:
3a7fc7f88858839b8eddbbecfdb46a37f220777460fe4a49b14694520591e062.exedescription pid process target process PID 4164 wrote to memory of 4388 4164 3a7fc7f88858839b8eddbbecfdb46a37f220777460fe4a49b14694520591e062.exe powershell.exe PID 4164 wrote to memory of 4388 4164 3a7fc7f88858839b8eddbbecfdb46a37f220777460fe4a49b14694520591e062.exe powershell.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\3a7fc7f88858839b8eddbbecfdb46a37f220777460fe4a49b14694520591e062.exe"C:\Users\Admin\AppData\Local\Temp\3a7fc7f88858839b8eddbbecfdb46a37f220777460fe4a49b14694520591e062.exe"1⤵
- Modifies extensions of user files
- Enumerates connected drives
- Sets desktop wallpaper using registry
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -e RwBlAHQALQBXAG0AaQBPAGIAagBlAGMAdAAgAFcAaQBuADMAMgBfAFMAaABhAGQAbwB3AGMAbwBwAHkAIAB8ACAARgBvAHIARQBhAGMAaAAtAE8AYgBqAGUAYwB0ACAAewAkAF8ALgBEAGUAbABlAHQAZQAoACkAOwB9AA==2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\wbem\unsecapp.exeC:\Windows\system32\wbem\unsecapp.exe -Embedding1⤵
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/4388-130-0x0000000000000000-mapping.dmp
-
memory/4388-131-0x000002461B100000-0x000002461B122000-memory.dmpFilesize
136KB
-
memory/4388-132-0x00007FFD88E70000-0x00007FFD89931000-memory.dmpFilesize
10.8MB
-
memory/4388-133-0x00007FFD88E70000-0x00007FFD89931000-memory.dmpFilesize
10.8MB