sodinokibi | 14c8e3f1f23d16c2c9a4272cd05d00461d27b372cc5f588b4bbfc6102bbed708

General

Target

adb.vbs.exe
Size

116KB
MD5

b86ad4241b01376b3924a380f6f4c934
SHA1

10682d08a18715a79ee23b58fdb6ee44c4e28c61
SHA256

14c8e3f1f23d16c2c9a4272cd05d00461d27b372cc5f588b4bbfc6102bbed708
SHA512

54fd19cfc37255e7ddf3456d1a2989558522cf58e5eee6ca916c19542921fe3ba4e7a431a35e0e1edbfc37c5651d392e7c3c54eb408754c0488021b16fdf92c9
SSDEEP

1536:aTZINbRh0SKws6KTUkmHlntMvfWhbpfCqeICS4AKvQIFlswOmZFS0cnwpIGmQwB:FRix3PWhNlOVFmw5q0cifmQ

Score

10^/10

sodinokibi ransomware

Malware Config

Extracted

Path

C:\Users\835a63va4p-readme.txt

Family

sodinokibi

Ransom Note

---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension 835a63va4p. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] WE ARE READY TO PUBLISH UR DATA TO PUBLIC ACCESS IF YOU NOT CONTACT US (USE TOR BROWSER TO VIEW) http://dnpscnbaix6nkwvystl3yxglz7nteicqrou3t75tpcc5532cztc46qyd.onion/posts/125?s=7ee0235fc7f67403393ad971dea5809e [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practice - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/0F2C8840A1F62CF1 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/0F2C8840A1F62CF1 Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: Nw/pNgtGfOZEqdadVkoaJSxBR3Sb1KzRuC1IU5ZtJ51woDRt2Djk1eIJ0fjFK36D m3wPVZOX+eU0YmFsp++uilXWOBRT+r8OGTPPNqmrJlUgK8+9IyEqItpn/ET7YMSp e5QpzN9aFXLaJwbFHIZeI5+Z/j6RwnDxki6kkrZaxE5zn11S/iMUS6VU+nQkgZz6 +hTESBGBN7HshbKquvw7AS8w8Dm/6QfyIhdqeIEl6f/zd0yd4yRF88TDrT9UmC5Y DcXSfGFCCo9TqAzZviUHVXNgX/YYYE9E5BgKznZPPEeMZgYzU5aLGEdyn1a8AdrH o/zI7eCjdyiRrWHcNeVr+4CjBz+c0WEbC2teXwO784BaLcBJ6Rr7E4vGnglsDRAR 9xxv70TLGnrb6macYiZGqLnSFPQNCuGRK2UQtWydIPU9TTZ9ZIunt7QvQgDQEdaf CjMNSQiwgskV1neAu5seKMsTqTtQeGbMHJnamST5Hydo+f5/QNkZGTNveNKRnGV9 VHqu/m9SudDmrF/mOWmFgtn2Ax3fyAxz5flMEKKIAlkfW81hf2t7DqYH1AeXz9sk XwoRrUn8Nq78D+5U+LjP5H98Ngqg8DAqmoh+/JgKX0Si9+QBH18cr7F4ynAMZnrB d5scdOihIwpsXICYwoACoo+SLKz7+T9khp2laCZkUw+pdhzQ3g2DhHbNy8+tA7Fr ewWy3VFG0KW0RdjnPJ4kQtaEj+noBa8fCUMe3SA/YCXeEti7IN4o0Gxacle+7LIg xSKWtUwg2FQmEzdc8Grwc/SqAW32EkPT+FS82G4z1s6NhSoKlVwgOpAIi1j9Z375 boomlVtK5pwhUkNbmThxlyOr8jz7YaX60FZg9PWehFO7AgKRXDcjekjmrPVNIe+t OMUaLHQWoMArE0urkqjflZEZji1AtW6GTDf1DDi+fV0ygQJMXIDT7N3AI7zs+hvs f+kWW9+gUmQ/02d5F7NSfSdvXtIYv4l7IcgrL3ztQAqMIXPN7T7netmbovQaRSZ/ Ki3H0MBopiOCLyDE9cgE6zRdxpRhIaiV80Pj/g9OmZlQjOixGWPG3wWTYlC4O6nV uimTdzaIRP8dqG7AKgYwhWeH8t6xrGnQu3ocEhc3GLBw0l6ca9DvGbW0mNbJb6ei zG/XECA+Ib6cg+T9Jie0XFwloahkP3VsCXlOWlZUFGdGqbqeFRL50gIOMClwt5T4 TUwTb4Z8kH60lmF0JBWBj/Xq5EzmeWjx06W1Zst1TkjuZTh8NAAeFrebTSJQ2AZh gevL2BoI/9rTsJ7yDNHj28gxSXnRT0W5iCNY+wlT1jbMcMkZdbdMUK53plRYIICU ICsmOgSTLaHu2UL1uwC2fWICpR/fBe52eygtJkXq1mqR0mMCGmeHLQ== ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damage of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!

URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/0F2C8840A1F62CF1

http://decryptor.cc/0F2C8840A1F62CF1

Signatures

Sodin,Sodinokibi,REvil
Ransomware with advanced anti-analysis and privilege escalation functionality.
ransomware sodinokibi

Enumerates connected drives 3 TTPs 25 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

adb.vbs.exe

description	ioc	process
File opened (read-only)	\??\B:	adb.vbs.exe
File opened (read-only)	\??\M:	adb.vbs.exe
File opened (read-only)	\??\N:	adb.vbs.exe
File opened (read-only)	\??\U:	adb.vbs.exe
File opened (read-only)	\??\Y:	adb.vbs.exe
File opened (read-only)	\??\V:	adb.vbs.exe
File opened (read-only)	\??\F:	adb.vbs.exe
File opened (read-only)	\??\G:	adb.vbs.exe
File opened (read-only)	\??\J:	adb.vbs.exe
File opened (read-only)	\??\K:	adb.vbs.exe
File opened (read-only)	\??\L:	adb.vbs.exe
File opened (read-only)	\??\Q:	adb.vbs.exe
File opened (read-only)	\??\H:	adb.vbs.exe
File opened (read-only)	\??\I:	adb.vbs.exe
File opened (read-only)	\??\O:	adb.vbs.exe
File opened (read-only)	\??\R:	adb.vbs.exe
File opened (read-only)	\??\Z:	adb.vbs.exe
File opened (read-only)	\??\W:	adb.vbs.exe
File opened (read-only)	\??\X:	adb.vbs.exe
File opened (read-only)	\??\D:	adb.vbs.exe
File opened (read-only)	\??\A:	adb.vbs.exe
File opened (read-only)	\??\E:	adb.vbs.exe
File opened (read-only)	\??\P:	adb.vbs.exe
File opened (read-only)	\??\S:	adb.vbs.exe
File opened (read-only)	\??\T:	adb.vbs.exe

Sets desktop wallpaper using registry 2 TTPs 1 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

Processes:

adb.vbs.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\93p5.bmp"	adb.vbs.exe

Drops file in Program Files directory 17 IoCs

Processes:

adb.vbs.exe

description	ioc	process
File created	\??\c:\program files (x86)\835a63va4p-readme.txt	adb.vbs.exe
File opened for modification	\??\c:\program files\SelectMove.temp	adb.vbs.exe
File created	\??\c:\program files (x86)\microsoft sql server compact edition\835a63va4p-readme.txt	adb.vbs.exe
File created	\??\c:\program files (x86)\microsoft sql server compact edition\v3.5\835a63va4p-readme.txt	adb.vbs.exe
File created	\??\c:\program files\835a63va4p-readme.txt	adb.vbs.exe
File opened for modification	\??\c:\program files\CompareDebug.bmp	adb.vbs.exe
File opened for modification	\??\c:\program files\InvokeConvertFrom.tif	adb.vbs.exe
File opened for modification	\??\c:\program files\JoinCopy.mp4	adb.vbs.exe
File opened for modification	\??\c:\program files\ResolveFormat.eps	adb.vbs.exe
File opened for modification	\??\c:\program files\UndoUnprotect.3g2	adb.vbs.exe
File opened for modification	\??\c:\program files\BackupNew.shtml	adb.vbs.exe
File opened for modification	\??\c:\program files\WatchSearch.M2TS	adb.vbs.exe
File opened for modification	\??\c:\program files\CopyFind.ttf	adb.vbs.exe
File opened for modification	\??\c:\program files\NewWait.au3	adb.vbs.exe
File opened for modification	\??\c:\program files\RedoWait.ram	adb.vbs.exe
File created	\??\c:\program files (x86)\microsoft sql server compact edition\v3.5\desktop\835a63va4p-readme.txt	adb.vbs.exe
File opened for modification	\??\c:\program files\AssertLock.m4a	adb.vbs.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

adb.vbs.exepowershell.exe

pid process

2392 adb.vbs.exe
2484 powershell.exe

pid	process
2392	adb.vbs.exe
2484	powershell.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

Processes:

adb.vbs.exepowershell.exevssvc.exe

description	pid	process
Token: SeDebugPrivilege	2392	adb.vbs.exe
Token: SeDebugPrivilege	2484	powershell.exe
Token: SeBackupPrivilege	2912	vssvc.exe
Token: SeRestorePrivilege	2912	vssvc.exe
Token: SeAuditPrivilege	2912	vssvc.exe
Token: SeTakeOwnershipPrivilege	2392	adb.vbs.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

adb.vbs.exe

description	pid	process	target process
PID 2392 wrote to memory of 2484	2392	adb.vbs.exe	powershell.exe
PID 2392 wrote to memory of 2484	2392	adb.vbs.exe	powershell.exe
PID 2392 wrote to memory of 2484	2392	adb.vbs.exe	powershell.exe
PID 2392 wrote to memory of 2484	2392	adb.vbs.exe	powershell.exe

C:\Users\Admin\AppData\Local\Temp\adb.vbs.exe
"C:\Users\Admin\AppData\Local\Temp\adb.vbs.exe"
1⤵
- Enumerates connected drives
- Sets desktop wallpaper using registry
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2392

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell -e RwBlAHQALQBXAG0AaQBPAGIAagBlAGMAdAAgAFcAaQBuADMAMgBfAFMAaABhAGQAbwB3AGMAbwBwAHkAIAB8ACAARgBvAHIARQBhAGMAaAAtAE8AYgBqAGUAYwB0ACAAewAkAF8ALgBEAGUAbABlAHQAZQAoACkAOwB9AA==
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2484

C:\Windows\system32\wbem\unsecapp.exe
C:\Windows\system32\wbem\unsecapp.exe -Embedding
1⤵
PID:2308

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2912

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Defacement

1

T1491

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\835a63va4p-readme.txt
Filesize
7KB

MD5
da9bfec83e05180e15101131a214a2e7

SHA1
b6f8b588dc87f84deb0c57b85143deeed5fc9455

SHA256
465f63decac4f1af49739c64f52356613ee12cc6493c09ffac6b0e7f482b59a3

SHA512
bfa0ffd72b0522d44ce9aedda18992925d72d52f80fdc117be2d2b3ce80c7eeee0b1ca73e79ea25500ace2dd20acb205dbe3a7e5a2b5c839da15ae3684d41ee6

Download Submit
memory/2484-58-0x000000001B0E0000-0x000000001B3C2000-memory.dmp

Filesize
2.9MB

Download
memory/2484-59-0x0000000002690000-0x0000000002698000-memory.dmp

Filesize
32KB

Download
memory/2484-60-0x000007FEF5060000-0x000007FEF59FD000-memory.dmp

Filesize
9.6MB

Download
memory/2484-61-0x0000000002750000-0x00000000027D0000-memory.dmp

Filesize
512KB

Download
memory/2484-62-0x0000000002750000-0x00000000027D0000-memory.dmp

Filesize
512KB

Download
memory/2484-63-0x0000000002750000-0x00000000027D0000-memory.dmp

Filesize
512KB

Download
memory/2484-64-0x000007FEF5060000-0x000007FEF59FD000-memory.dmp

Filesize
9.6MB

Download
memory/2484-65-0x0000000002750000-0x00000000027D0000-memory.dmp

Filesize
512KB

Download
memory/2484-66-0x000007FEF5060000-0x000007FEF59FD000-memory.dmp

Filesize
9.6MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads