Analysis
-
max time kernel
122s -
max time network
126s -
platform
windows7_x64 -
resource
win7-20231020-en -
resource tags
arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system -
submitted
20-11-2023 23:03
Static task
static1
Behavioral task
behavioral1
Sample
81689f1be92c8fb7e94fe241441c7eb43cfb77c6d23592b0248566bd709ff2ed.exe
Resource
win7-20231020-en
Behavioral task
behavioral2
Sample
81689f1be92c8fb7e94fe241441c7eb43cfb77c6d23592b0248566bd709ff2ed.exe
Resource
win10v2004-20231025-en
General
-
Target
81689f1be92c8fb7e94fe241441c7eb43cfb77c6d23592b0248566bd709ff2ed.exe
-
Size
115KB
-
MD5
7e18b037a068c56417fb8e56aa7e49e8
-
SHA1
f6739569a24358c8c060d7131be70712f70f36e0
-
SHA256
81689f1be92c8fb7e94fe241441c7eb43cfb77c6d23592b0248566bd709ff2ed
-
SHA512
d6188e5536b6e0b5c49d572e35155d633c11fd30bc8d4bf4ea87fea7196ae2f67bca364a0afaeed8209e5d4b2be0b98d81c49293d3fed95c70c8388b8387899d
-
SSDEEP
1536:AkdeUcaK8Qz4PQIUnq5WMrAmyopACC9ICS4A0vh4NKwTNA28V5/Ogsck:mlnXEXyk7yvh4NKwTNF8V8v
Malware Config
Extracted
C:\Users\bgopoa-readme.txt
sodinokibi
http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/F000715E99199B02
http://decryptor.cc/F000715E99199B02
Signatures
-
Sodin,Sodinokibi,REvil
Ransomware with advanced anti-analysis and privilege escalation functionality.
-
Enumerates connected drives 3 TTPs 25 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
81689f1be92c8fb7e94fe241441c7eb43cfb77c6d23592b0248566bd709ff2ed.exedescription ioc process File opened (read-only) \??\H: 81689f1be92c8fb7e94fe241441c7eb43cfb77c6d23592b0248566bd709ff2ed.exe File opened (read-only) \??\J: 81689f1be92c8fb7e94fe241441c7eb43cfb77c6d23592b0248566bd709ff2ed.exe File opened (read-only) \??\R: 81689f1be92c8fb7e94fe241441c7eb43cfb77c6d23592b0248566bd709ff2ed.exe File opened (read-only) \??\T: 81689f1be92c8fb7e94fe241441c7eb43cfb77c6d23592b0248566bd709ff2ed.exe File opened (read-only) \??\V: 81689f1be92c8fb7e94fe241441c7eb43cfb77c6d23592b0248566bd709ff2ed.exe File opened (read-only) \??\W: 81689f1be92c8fb7e94fe241441c7eb43cfb77c6d23592b0248566bd709ff2ed.exe File opened (read-only) \??\Z: 81689f1be92c8fb7e94fe241441c7eb43cfb77c6d23592b0248566bd709ff2ed.exe File opened (read-only) \??\E: 81689f1be92c8fb7e94fe241441c7eb43cfb77c6d23592b0248566bd709ff2ed.exe File opened (read-only) \??\A: 81689f1be92c8fb7e94fe241441c7eb43cfb77c6d23592b0248566bd709ff2ed.exe File opened (read-only) \??\I: 81689f1be92c8fb7e94fe241441c7eb43cfb77c6d23592b0248566bd709ff2ed.exe File opened (read-only) \??\M: 81689f1be92c8fb7e94fe241441c7eb43cfb77c6d23592b0248566bd709ff2ed.exe File opened (read-only) \??\B: 81689f1be92c8fb7e94fe241441c7eb43cfb77c6d23592b0248566bd709ff2ed.exe File opened (read-only) \??\G: 81689f1be92c8fb7e94fe241441c7eb43cfb77c6d23592b0248566bd709ff2ed.exe File opened (read-only) \??\P: 81689f1be92c8fb7e94fe241441c7eb43cfb77c6d23592b0248566bd709ff2ed.exe File opened (read-only) \??\U: 81689f1be92c8fb7e94fe241441c7eb43cfb77c6d23592b0248566bd709ff2ed.exe File opened (read-only) \??\L: 81689f1be92c8fb7e94fe241441c7eb43cfb77c6d23592b0248566bd709ff2ed.exe File opened (read-only) \??\O: 81689f1be92c8fb7e94fe241441c7eb43cfb77c6d23592b0248566bd709ff2ed.exe File opened (read-only) \??\S: 81689f1be92c8fb7e94fe241441c7eb43cfb77c6d23592b0248566bd709ff2ed.exe File opened (read-only) \??\F: 81689f1be92c8fb7e94fe241441c7eb43cfb77c6d23592b0248566bd709ff2ed.exe File opened (read-only) \??\K: 81689f1be92c8fb7e94fe241441c7eb43cfb77c6d23592b0248566bd709ff2ed.exe File opened (read-only) \??\N: 81689f1be92c8fb7e94fe241441c7eb43cfb77c6d23592b0248566bd709ff2ed.exe File opened (read-only) \??\Q: 81689f1be92c8fb7e94fe241441c7eb43cfb77c6d23592b0248566bd709ff2ed.exe File opened (read-only) \??\X: 81689f1be92c8fb7e94fe241441c7eb43cfb77c6d23592b0248566bd709ff2ed.exe File opened (read-only) \??\Y: 81689f1be92c8fb7e94fe241441c7eb43cfb77c6d23592b0248566bd709ff2ed.exe File opened (read-only) \??\D: 81689f1be92c8fb7e94fe241441c7eb43cfb77c6d23592b0248566bd709ff2ed.exe -
Sets desktop wallpaper using registry 2 TTPs 1 IoCs
Processes:
81689f1be92c8fb7e94fe241441c7eb43cfb77c6d23592b0248566bd709ff2ed.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-1154728922-3261336865-3456416385-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\x2k5705po17.bmp" 81689f1be92c8fb7e94fe241441c7eb43cfb77c6d23592b0248566bd709ff2ed.exe -
Drops file in Program Files directory 36 IoCs
Processes:
81689f1be92c8fb7e94fe241441c7eb43cfb77c6d23592b0248566bd709ff2ed.exedescription ioc process File opened for modification \??\c:\program files\BlockSplit.rmi 81689f1be92c8fb7e94fe241441c7eb43cfb77c6d23592b0248566bd709ff2ed.exe File created \??\c:\program files (x86)\microsoft sql server compact edition\v3.5\desktop\bgopoa-readme.txt 81689f1be92c8fb7e94fe241441c7eb43cfb77c6d23592b0248566bd709ff2ed.exe File opened for modification \??\c:\program files\PublishCheckpoint.ppt 81689f1be92c8fb7e94fe241441c7eb43cfb77c6d23592b0248566bd709ff2ed.exe File opened for modification \??\c:\program files\ResolveUnpublish.shtml 81689f1be92c8fb7e94fe241441c7eb43cfb77c6d23592b0248566bd709ff2ed.exe File opened for modification \??\c:\program files\SuspendRemove.001 81689f1be92c8fb7e94fe241441c7eb43cfb77c6d23592b0248566bd709ff2ed.exe File opened for modification \??\c:\program files\TraceClose.m4a 81689f1be92c8fb7e94fe241441c7eb43cfb77c6d23592b0248566bd709ff2ed.exe File created \??\c:\program files (x86)\microsoft sql server compact edition\bgopoa-readme.txt 81689f1be92c8fb7e94fe241441c7eb43cfb77c6d23592b0248566bd709ff2ed.exe File opened for modification \??\c:\program files\AddJoin.mov 81689f1be92c8fb7e94fe241441c7eb43cfb77c6d23592b0248566bd709ff2ed.exe File opened for modification \??\c:\program files\DebugApprove.avi 81689f1be92c8fb7e94fe241441c7eb43cfb77c6d23592b0248566bd709ff2ed.exe File opened for modification \??\c:\program files\ExpandEdit.odp 81689f1be92c8fb7e94fe241441c7eb43cfb77c6d23592b0248566bd709ff2ed.exe File opened for modification \??\c:\program files\OutWait.ini 81689f1be92c8fb7e94fe241441c7eb43cfb77c6d23592b0248566bd709ff2ed.exe File opened for modification \??\c:\program files\TraceConvertFrom.xps 81689f1be92c8fb7e94fe241441c7eb43cfb77c6d23592b0248566bd709ff2ed.exe File created \??\c:\program files (x86)\bgopoa-readme.txt 81689f1be92c8fb7e94fe241441c7eb43cfb77c6d23592b0248566bd709ff2ed.exe File opened for modification \??\c:\program files\ImportExpand.DVR-MS 81689f1be92c8fb7e94fe241441c7eb43cfb77c6d23592b0248566bd709ff2ed.exe File opened for modification \??\c:\program files\MountReceive.mhtml 81689f1be92c8fb7e94fe241441c7eb43cfb77c6d23592b0248566bd709ff2ed.exe File opened for modification \??\c:\program files\UnregisterMove.vsw 81689f1be92c8fb7e94fe241441c7eb43cfb77c6d23592b0248566bd709ff2ed.exe File opened for modification \??\c:\program files\AddLimit.mpeg 81689f1be92c8fb7e94fe241441c7eb43cfb77c6d23592b0248566bd709ff2ed.exe File opened for modification \??\c:\program files\CloseOut.xlt 81689f1be92c8fb7e94fe241441c7eb43cfb77c6d23592b0248566bd709ff2ed.exe File opened for modification \??\c:\program files\ImportClear.xlt 81689f1be92c8fb7e94fe241441c7eb43cfb77c6d23592b0248566bd709ff2ed.exe File opened for modification \??\c:\program files\TestConvertTo.txt 81689f1be92c8fb7e94fe241441c7eb43cfb77c6d23592b0248566bd709ff2ed.exe File created \??\c:\program files\bgopoa-readme.txt 81689f1be92c8fb7e94fe241441c7eb43cfb77c6d23592b0248566bd709ff2ed.exe File opened for modification \??\c:\program files\ConvertSubmit.xla 81689f1be92c8fb7e94fe241441c7eb43cfb77c6d23592b0248566bd709ff2ed.exe File opened for modification \??\c:\program files\ConvertUnregister.ini 81689f1be92c8fb7e94fe241441c7eb43cfb77c6d23592b0248566bd709ff2ed.exe File opened for modification \??\c:\program files\DismountApprove.jpeg 81689f1be92c8fb7e94fe241441c7eb43cfb77c6d23592b0248566bd709ff2ed.exe File opened for modification \??\c:\program files\ResumeDisable.ods 81689f1be92c8fb7e94fe241441c7eb43cfb77c6d23592b0248566bd709ff2ed.exe File opened for modification \??\c:\program files\SubmitLimit.mp2v 81689f1be92c8fb7e94fe241441c7eb43cfb77c6d23592b0248566bd709ff2ed.exe File opened for modification \??\c:\program files\UpdateApprove.wma 81689f1be92c8fb7e94fe241441c7eb43cfb77c6d23592b0248566bd709ff2ed.exe File opened for modification \??\c:\program files\UseProtect.raw 81689f1be92c8fb7e94fe241441c7eb43cfb77c6d23592b0248566bd709ff2ed.exe File opened for modification \??\c:\program files\ExpandSkip.xlsb 81689f1be92c8fb7e94fe241441c7eb43cfb77c6d23592b0248566bd709ff2ed.exe File opened for modification \??\c:\program files\ReadMove.eps 81689f1be92c8fb7e94fe241441c7eb43cfb77c6d23592b0248566bd709ff2ed.exe File created \??\c:\program files (x86)\microsoft sql server compact edition\v3.5\bgopoa-readme.txt 81689f1be92c8fb7e94fe241441c7eb43cfb77c6d23592b0248566bd709ff2ed.exe File opened for modification \??\c:\program files\DisconnectSet.zip 81689f1be92c8fb7e94fe241441c7eb43cfb77c6d23592b0248566bd709ff2ed.exe File opened for modification \??\c:\program files\ExpandJoin.rar 81689f1be92c8fb7e94fe241441c7eb43cfb77c6d23592b0248566bd709ff2ed.exe File opened for modification \??\c:\program files\MergeWatch.wmx 81689f1be92c8fb7e94fe241441c7eb43cfb77c6d23592b0248566bd709ff2ed.exe File opened for modification \??\c:\program files\PopReset.xhtml 81689f1be92c8fb7e94fe241441c7eb43cfb77c6d23592b0248566bd709ff2ed.exe File opened for modification \??\c:\program files\SubmitMerge.xml 81689f1be92c8fb7e94fe241441c7eb43cfb77c6d23592b0248566bd709ff2ed.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
81689f1be92c8fb7e94fe241441c7eb43cfb77c6d23592b0248566bd709ff2ed.exedescription pid process Token: SeTakeOwnershipPrivilege 2516 81689f1be92c8fb7e94fe241441c7eb43cfb77c6d23592b0248566bd709ff2ed.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\81689f1be92c8fb7e94fe241441c7eb43cfb77c6d23592b0248566bd709ff2ed.exe"C:\Users\Admin\AppData\Local\Temp\81689f1be92c8fb7e94fe241441c7eb43cfb77c6d23592b0248566bd709ff2ed.exe"1⤵
- Enumerates connected drives
- Sets desktop wallpaper using registry
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\bgopoa-readme.txtFilesize
6KB
MD5af1b6835877628c4eb928e2e45ca76ec
SHA175d730c793724dc2c79f32e42cb15f95d52019eb
SHA25631c193e6f7b6530b75f7528bca2366d5e00dcced506995779c73ad150ff7f2ed
SHA51297b35e1d2aa30ed59b71006dc75643a19132f585183384e1ccdc7b9c9dfd8f6772a44cfa15498131402fa983577ac6ca3d67df8624204c7258b7f66aea56fa72