Analysis
-
max time kernel
121s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
18-01-2024 13:42
Behavioral task
behavioral1
Sample
2024-01-18_329b8aaea517a511908683b56446db99_revil.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
2024-01-18_329b8aaea517a511908683b56446db99_revil.exe
Resource
win10v2004-20231215-en
General
-
Target
2024-01-18_329b8aaea517a511908683b56446db99_revil.exe
-
Size
126KB
-
MD5
329b8aaea517a511908683b56446db99
-
SHA1
9abe20a9c460a3e530cb96658541c6d25700a529
-
SHA256
c09c691d40d8b935de4b60c92e1d4fc85f409fb546fd4a5e5b5483ae150fbf20
-
SHA512
172d290abe8fef35e8bea43319dc68092c61389257c73e94fcde68f67f97022c1bbda1fe50cd35775bda6e2473af1bad0e5cdb2ff7060e8365bbbe4765a3b3fa
-
SSDEEP
1536:oxOUyl20w8bVZQ40iMSO1fY+iUyQs2r8t5p1ySotICS4A6QdZls8XzUXiWr4X5Fg:oMhQNDEtb3A2ZHjUyWr4X5FTDUA
Malware Config
Extracted
C:\Users\10w27-readme.txt
http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/C193AA5B7B749436
http://decoder.re/C193AA5B7B749436
Signatures
-
Modifies Windows Firewall 1 TTPs 1 IoCs
-
Enumerates connected drives 3 TTPs 25 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
2024-01-18_329b8aaea517a511908683b56446db99_revil.exedescription ioc process File opened (read-only) \??\N: 2024-01-18_329b8aaea517a511908683b56446db99_revil.exe File opened (read-only) \??\P: 2024-01-18_329b8aaea517a511908683b56446db99_revil.exe File opened (read-only) \??\U: 2024-01-18_329b8aaea517a511908683b56446db99_revil.exe File opened (read-only) \??\Y: 2024-01-18_329b8aaea517a511908683b56446db99_revil.exe File opened (read-only) \??\F: 2024-01-18_329b8aaea517a511908683b56446db99_revil.exe File opened (read-only) \??\D: 2024-01-18_329b8aaea517a511908683b56446db99_revil.exe File opened (read-only) \??\B: 2024-01-18_329b8aaea517a511908683b56446db99_revil.exe File opened (read-only) \??\I: 2024-01-18_329b8aaea517a511908683b56446db99_revil.exe File opened (read-only) \??\M: 2024-01-18_329b8aaea517a511908683b56446db99_revil.exe File opened (read-only) \??\A: 2024-01-18_329b8aaea517a511908683b56446db99_revil.exe File opened (read-only) \??\G: 2024-01-18_329b8aaea517a511908683b56446db99_revil.exe File opened (read-only) \??\K: 2024-01-18_329b8aaea517a511908683b56446db99_revil.exe File opened (read-only) \??\O: 2024-01-18_329b8aaea517a511908683b56446db99_revil.exe File opened (read-only) \??\S: 2024-01-18_329b8aaea517a511908683b56446db99_revil.exe File opened (read-only) \??\W: 2024-01-18_329b8aaea517a511908683b56446db99_revil.exe File opened (read-only) \??\R: 2024-01-18_329b8aaea517a511908683b56446db99_revil.exe File opened (read-only) \??\H: 2024-01-18_329b8aaea517a511908683b56446db99_revil.exe File opened (read-only) \??\Q: 2024-01-18_329b8aaea517a511908683b56446db99_revil.exe File opened (read-only) \??\T: 2024-01-18_329b8aaea517a511908683b56446db99_revil.exe File opened (read-only) \??\X: 2024-01-18_329b8aaea517a511908683b56446db99_revil.exe File opened (read-only) \??\E: 2024-01-18_329b8aaea517a511908683b56446db99_revil.exe File opened (read-only) \??\J: 2024-01-18_329b8aaea517a511908683b56446db99_revil.exe File opened (read-only) \??\L: 2024-01-18_329b8aaea517a511908683b56446db99_revil.exe File opened (read-only) \??\V: 2024-01-18_329b8aaea517a511908683b56446db99_revil.exe File opened (read-only) \??\Z: 2024-01-18_329b8aaea517a511908683b56446db99_revil.exe -
Sets desktop wallpaper using registry 2 TTPs 1 IoCs
Processes:
2024-01-18_329b8aaea517a511908683b56446db99_revil.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1pa6g1.bmp" 2024-01-18_329b8aaea517a511908683b56446db99_revil.exe -
Drops file in Program Files directory 20 IoCs
Processes:
2024-01-18_329b8aaea517a511908683b56446db99_revil.exedescription ioc process File opened for modification \??\c:\program files\ConnectGrant.rar 2024-01-18_329b8aaea517a511908683b56446db99_revil.exe File created \??\c:\program files\10w27-readme.txt 2024-01-18_329b8aaea517a511908683b56446db99_revil.exe File created \??\c:\program files (x86)\tmp 2024-01-18_329b8aaea517a511908683b56446db99_revil.exe File opened for modification \??\c:\program files\UnprotectStart.kix 2024-01-18_329b8aaea517a511908683b56446db99_revil.exe File created \??\c:\program files (x86)\microsoft sql server compact edition\tmp 2024-01-18_329b8aaea517a511908683b56446db99_revil.exe File created \??\c:\program files (x86)\microsoft sql server compact edition\10w27-readme.txt 2024-01-18_329b8aaea517a511908683b56446db99_revil.exe File created \??\c:\program files (x86)\microsoft sql server compact edition\v3.5\tmp 2024-01-18_329b8aaea517a511908683b56446db99_revil.exe File created \??\c:\program files\tmp 2024-01-18_329b8aaea517a511908683b56446db99_revil.exe File opened for modification \??\c:\program files\CompleteRegister.vst 2024-01-18_329b8aaea517a511908683b56446db99_revil.exe File opened for modification \??\c:\program files\ExportSkip.ppt 2024-01-18_329b8aaea517a511908683b56446db99_revil.exe File opened for modification \??\c:\program files\SaveReceive.php 2024-01-18_329b8aaea517a511908683b56446db99_revil.exe File opened for modification \??\c:\program files\UnblockAssert.pcx 2024-01-18_329b8aaea517a511908683b56446db99_revil.exe File created \??\c:\program files (x86)\microsoft sql server compact edition\v3.5\desktop\tmp 2024-01-18_329b8aaea517a511908683b56446db99_revil.exe File created \??\c:\program files (x86)\microsoft sql server compact edition\v3.5\desktop\10w27-readme.txt 2024-01-18_329b8aaea517a511908683b56446db99_revil.exe File created \??\c:\program files (x86)\10w27-readme.txt 2024-01-18_329b8aaea517a511908683b56446db99_revil.exe File opened for modification \??\c:\program files\SearchFormat.doc 2024-01-18_329b8aaea517a511908683b56446db99_revil.exe File opened for modification \??\c:\program files\SearchSave.mpeg 2024-01-18_329b8aaea517a511908683b56446db99_revil.exe File opened for modification \??\c:\program files\SwitchCompare.pptm 2024-01-18_329b8aaea517a511908683b56446db99_revil.exe File opened for modification \??\c:\program files\WaitApprove.vssm 2024-01-18_329b8aaea517a511908683b56446db99_revil.exe File created \??\c:\program files (x86)\microsoft sql server compact edition\v3.5\10w27-readme.txt 2024-01-18_329b8aaea517a511908683b56446db99_revil.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 5 IoCs
Processes:
2024-01-18_329b8aaea517a511908683b56446db99_revil.exepid process 2976 2024-01-18_329b8aaea517a511908683b56446db99_revil.exe 2976 2024-01-18_329b8aaea517a511908683b56446db99_revil.exe 2976 2024-01-18_329b8aaea517a511908683b56446db99_revil.exe 2976 2024-01-18_329b8aaea517a511908683b56446db99_revil.exe 2976 2024-01-18_329b8aaea517a511908683b56446db99_revil.exe -
Suspicious use of AdjustPrivilegeToken 5 IoCs
Processes:
2024-01-18_329b8aaea517a511908683b56446db99_revil.exevssvc.exedescription pid process Token: SeDebugPrivilege 2976 2024-01-18_329b8aaea517a511908683b56446db99_revil.exe Token: SeTakeOwnershipPrivilege 2976 2024-01-18_329b8aaea517a511908683b56446db99_revil.exe Token: SeBackupPrivilege 1980 vssvc.exe Token: SeRestorePrivilege 1980 vssvc.exe Token: SeAuditPrivilege 1980 vssvc.exe -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
2024-01-18_329b8aaea517a511908683b56446db99_revil.exedescription pid process target process PID 2976 wrote to memory of 2700 2976 2024-01-18_329b8aaea517a511908683b56446db99_revil.exe netsh.exe PID 2976 wrote to memory of 2700 2976 2024-01-18_329b8aaea517a511908683b56446db99_revil.exe netsh.exe PID 2976 wrote to memory of 2700 2976 2024-01-18_329b8aaea517a511908683b56446db99_revil.exe netsh.exe PID 2976 wrote to memory of 2700 2976 2024-01-18_329b8aaea517a511908683b56446db99_revil.exe netsh.exe -
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-01-18_329b8aaea517a511908683b56446db99_revil.exe"C:\Users\Admin\AppData\Local\Temp\2024-01-18_329b8aaea517a511908683b56446db99_revil.exe"1⤵
- Enumerates connected drives
- Sets desktop wallpaper using registry
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\netsh.exenetsh advfirewall firewall set rule group="Network Discovery" new enable=Yes2⤵
- Modifies Windows Firewall
-
C:\Windows\system32\wbem\unsecapp.exeC:\Windows\system32\wbem\unsecapp.exe -Embedding1⤵
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\10w27-readme.txtFilesize
6KB
MD5f93b2729ed7d3c4b7a68a961867435b7
SHA159684cc52d8e4ca2248ab56a7eeb456dc4adce36
SHA2565ac150ff05cfa4876b0efe50674dca13a6244b500ff02631c9b3e628e1e83047
SHA512c120dec649cb4686bf537ac1ac74c90dac268b7546e5903530e53fa013c144e95f79c0bb1c46bb4d3fb65616ea1a8709c81758fbe15eff34413593d737bcc4fb