Analysis
-
max time kernel
121s -
max time network
148s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
05-11-2024 12:23
Static task
static1
Behavioral task
behavioral1
Sample
Ransomware Akira.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
Ransomware Akira.exe
Resource
win10v2004-20241007-en
General
-
Target
Ransomware Akira.exe
-
Size
1.0MB
-
MD5
feb81a8d7e0f91d6f74b440cdd3c2f28
-
SHA1
8c479629f45d8d9ea5e6ed48a3eeb9917fb7ad07
-
SHA256
aaa7799edfd86b52438a9e0d71f8069cbcbe1988036b95888fcdc553e729b7b9
-
SHA512
bf83affcd1ea656e05f18e55eb23cce2e2cb33ca6f24f5c22374c6f1d41f6277794c21f926939028326c043798bf34f14194b3ad51cee763b053e7a519199623
-
SSDEEP
12288:Vpp+QIEmDzuImC01vbUE98pik+2i1NkshdMMK+AX99etq2dTd7f:Vpp+Q+u5bUI8pij1NkshdMf99etb5R
Malware Config
Extracted
C:\Program Files (x86)\akira_readme.txt
akira
https://akiral2iz6a7qgd3ayp3l6yub7xx2uep76idk3u2kollpj5z3z636bad.onion
https://akiralkzxzq2dsrzsrvbr2xgbbu2wgsmxryd4csgfameg52n7efvr2id.onion/d/3175904882-XTBIJ
Signatures
-
Akira
Akira is a ransomware first seen in March 2023 and targets several industries, including education, finance, real estate, manufacturing, and consulting.
-
Akira family
-
Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
Processes:
powershell.exedescription pid pid_target process target process Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1648 4536 powershell.exe -
Renames multiple (8430) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell command to delete shadowcopy.
-
Drops startup file 1 IoCs
Processes:
Ransomware Akira.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\akira_readme.txt Ransomware Akira.exe -
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops desktop.ini file(s) 31 IoCs
Processes:
Ransomware Akira.exedescription ioc process File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\DataServices\DESKTOP.INI Ransomware Akira.exe File opened for modification C:\Users\Public\Libraries\desktop.ini Ransomware Akira.exe File opened for modification C:\Program Files (x86)\desktop.ini Ransomware Akira.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini Ransomware Akira.exe File opened for modification C:\Users\Admin\Pictures\Camera Roll\desktop.ini Ransomware Akira.exe File opened for modification C:\Users\Admin\Searches\desktop.ini Ransomware Akira.exe File opened for modification C:\Users\Public\AccountPictures\desktop.ini Ransomware Akira.exe File opened for modification C:\Users\Public\Videos\desktop.ini Ransomware Akira.exe File opened for modification C:\Users\Admin\3D Objects\desktop.ini Ransomware Akira.exe File opened for modification C:\Users\Admin\Favorites\Links\desktop.ini Ransomware Akira.exe File opened for modification C:\Users\Public\desktop.ini Ransomware Akira.exe File opened for modification C:\Users\Public\Downloads\desktop.ini Ransomware Akira.exe File opened for modification C:\Users\Admin\Pictures\desktop.ini Ransomware Akira.exe File opened for modification C:\Users\Admin\Saved Games\desktop.ini Ransomware Akira.exe File opened for modification C:\Users\Public\Desktop\desktop.ini Ransomware Akira.exe File opened for modification C:\Users\Public\Music\desktop.ini Ransomware Akira.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\desktop.ini Ransomware Akira.exe File opened for modification C:\Users\Admin\Pictures\Saved Pictures\desktop.ini Ransomware Akira.exe File opened for modification C:\Users\Public\Documents\desktop.ini Ransomware Akira.exe File opened for modification C:\Users\Public\Pictures\desktop.ini Ransomware Akira.exe File opened for modification C:\Users\Admin\Documents\desktop.ini Ransomware Akira.exe File opened for modification C:\Users\Admin\Favorites\desktop.ini Ransomware Akira.exe File opened for modification C:\Users\Admin\Links\desktop.ini Ransomware Akira.exe File opened for modification C:\Users\Admin\Music\desktop.ini Ransomware Akira.exe File opened for modification C:\Users\Admin\OneDrive\desktop.ini Ransomware Akira.exe File opened for modification C:\Users\Admin\Videos\desktop.ini Ransomware Akira.exe File opened for modification C:\Program Files\desktop.ini Ransomware Akira.exe File opened for modification C:\Users\Admin\Contacts\desktop.ini Ransomware Akira.exe File opened for modification C:\Users\Admin\Desktop\desktop.ini Ransomware Akira.exe File opened for modification C:\Users\Admin\Downloads\desktop.ini Ransomware Akira.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini Ransomware Akira.exe -
Drops file in Program Files directory 64 IoCs
Processes:
Ransomware Akira.exedescription ioc process File opened for modification C:\Program Files\Java\jdk-1.8\jre\lib\deploy\splash_11-lic.gif Ransomware Akira.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.XLS Ransomware Akira.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\VVIEWDWG.DLL Ransomware Akira.exe File created C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\en-us\akira_readme.txt Ransomware Akira.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\osf\moe_status_icons.png Ransomware Akira.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\HxMailSmallTile.scale-125.png Ransomware Akira.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\SecondaryTiles\TrafficHub\contrast-black\SmallTile.scale-200.png Ransomware Akira.exe File opened for modification C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\Functions\Assertions\BeLikeExactly.ps1 Ransomware Akira.exe File opened for modification C:\Program Files\Common Files\System\ado\adojavas.inc Ransomware Akira.exe File opened for modification C:\Program Files\SetCompare.wm Ransomware Akira.exe File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsSoundRecorder_10.1906.1972.0_neutral_split.scale-200_8wekyb3d8bbwe\Assets\VoiceRecorderAppList.contrast-white_scale-200.png Ransomware Akira.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\ru-ru\ui-strings.js Ransomware Akira.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\de-de\ui-strings.js Ransomware Akira.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\images\themes\akira_readme.txt Ransomware Akira.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\OutlookMailWideTile.scale-400.png Ransomware Akira.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\TXP_TicketedEvent_Light.png Ransomware Akira.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\AppxSignature.p7x Ransomware Akira.exe File opened for modification C:\Program Files\Google\Chrome\Application\123.0.6312.123\MEIPreload\manifest.json Ransomware Akira.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTest4-ul-oob.xrm-ms Ransomware Akira.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\offsymb.ttf Ransomware Akira.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\js\nls\sv-se\ui-strings.js Ransomware Akira.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\LogoImages\ExcelLogoSmall.scale-80.png Ransomware Akira.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_10.1906.2182.0_x64__8wekyb3d8bbwe\Assets\AlarmsAppList.contrast-black_scale-200.png Ransomware Akira.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Appstore\Download_on_the_App_Store_Badge_cs_135x40.svg Ransomware Akira.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\es-es\akira_readme.txt Ransomware Akira.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Work\RTL\contrast-black\akira_readme.txt Ransomware Akira.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\uk-UA\InputPersonalization.exe.mui Ransomware Akira.exe File opened for modification C:\Program Files\Java\jre-1.8\legal\jdk\freebxml.md Ransomware Akira.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\plugins\rhp\exportpdfupsell-app-tool-view.js Ransomware Akira.exe File created C:\Program Files\Windows Media Player\es-ES\akira_readme.txt Ransomware Akira.exe File opened for modification C:\Program Files\Java\jre-1.8\lib\sound.properties Ransomware Akira.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019MSDNR_Retail-ppd.xrm-ms Ransomware Akira.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Download_on_the_App_Store_Badge_fr_135x40.svg Ransomware Akira.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\walk-through\js\nls\root\akira_readme.txt Ransomware Akira.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsStore_11910.1002.5.0_x64__8wekyb3d8bbwe\resources.pri Ransomware Akira.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\LogoImages\WinWordLogoSmall.contrast-white_scale-100.png Ransomware Akira.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\FSTOCK.DLL Ransomware Akira.exe File opened for modification C:\Program Files (x86)\Windows Media Player\fr-FR\WMPMediaSharing.dll.mui Ransomware Akira.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\si\LC_MESSAGES\vlc.mo Ransomware Akira.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\DBGHELP.DLL Ransomware Akira.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\Contracts\akira_readme.txt Ransomware Akira.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PROOF\msth8ES.DLL Ransomware Akira.exe File created C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Common.View.UWP\Strings\nb-NO\View3d\akira_readme.txt Ransomware Akira.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.ScreenSketch_10.1907.2471.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\ScreenSketchSplashScreen.scale-100_contrast-white.png Ransomware Akira.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\eml.scale-256.png Ransomware Akira.exe File opened for modification C:\Program Files\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\ja-JP\PSGet.Resource.psd1 Ransomware Akira.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\images\themes\dark\rhp_world_icon_2x.png Ransomware Akira.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_OEM_Perp6-pl.xrm-ms Ransomware Akira.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.ScreenSketch_10.1907.2471.0_x64__8wekyb3d8bbwe\Assets\FileAssociation\FileAssociation.targetsize-40.png Ransomware Akira.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\he-IL\tipresx.dll.mui Ransomware Akira.exe File created C:\Program Files\Common Files\microsoft shared\ink\it-IT\akira_readme.txt Ransomware Akira.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\da-dk\ui-strings.js Ransomware Akira.exe File opened for modification C:\Program Files (x86)\Windows Media Player\fr-FR\setup_wm.exe.mui Ransomware Akira.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\whatsnewsrc\bulletin_board.html Ransomware Akira.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\ReactAssets\assets\RNApp\app\uwp\images\import_google_contacts\googleImportError.png Ransomware Akira.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxGameOverlay_1.46.11001.0_x64__8wekyb3d8bbwe\AppxManifest.xml Ransomware Akira.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\fr-fr\ui-strings.js Ransomware Akira.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\fr-ma\akira_readme.txt Ransomware Akira.exe File created C:\Program Files (x86)\Internet Explorer\images\akira_readme.txt Ransomware Akira.exe File opened for modification C:\Program Files\Microsoft Office\root\rsod\proofing.msi.16.en-us.boot.tree.dat Ransomware Akira.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MixedReality.Portal_2000.19081.1301.0_x64__8wekyb3d8bbwe\Assets\contrast-black\MixedRealityPortalAppList.targetsize-60_altform-unplated_contrast-black.png Ransomware Akira.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\en-gb\locimages\offsymsb.ttf Ransomware Akira.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\HxA-Outlook.scale-400.png Ransomware Akira.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\MLModels\autofill_labeling.ort Ransomware Akira.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
Ransomware Akira.exepowershell.exepid process 1480 Ransomware Akira.exe 1480 Ransomware Akira.exe 1648 powershell.exe 1648 powershell.exe 1480 Ransomware Akira.exe 1480 Ransomware Akira.exe 1480 Ransomware Akira.exe 1480 Ransomware Akira.exe 1480 Ransomware Akira.exe 1480 Ransomware Akira.exe 1480 Ransomware Akira.exe 1480 Ransomware Akira.exe 1480 Ransomware Akira.exe 1480 Ransomware Akira.exe 1480 Ransomware Akira.exe 1480 Ransomware Akira.exe 1480 Ransomware Akira.exe 1480 Ransomware Akira.exe 1480 Ransomware Akira.exe 1480 Ransomware Akira.exe 1480 Ransomware Akira.exe 1480 Ransomware Akira.exe 1480 Ransomware Akira.exe 1480 Ransomware Akira.exe 1480 Ransomware Akira.exe 1480 Ransomware Akira.exe 1480 Ransomware Akira.exe 1480 Ransomware Akira.exe 1480 Ransomware Akira.exe 1480 Ransomware Akira.exe 1480 Ransomware Akira.exe 1480 Ransomware Akira.exe 1480 Ransomware Akira.exe 1480 Ransomware Akira.exe 1480 Ransomware Akira.exe 1480 Ransomware Akira.exe 1480 Ransomware Akira.exe 1480 Ransomware Akira.exe 1480 Ransomware Akira.exe 1480 Ransomware Akira.exe 1480 Ransomware Akira.exe 1480 Ransomware Akira.exe 1480 Ransomware Akira.exe 1480 Ransomware Akira.exe 1480 Ransomware Akira.exe 1480 Ransomware Akira.exe 1480 Ransomware Akira.exe 1480 Ransomware Akira.exe 1480 Ransomware Akira.exe 1480 Ransomware Akira.exe 1480 Ransomware Akira.exe 1480 Ransomware Akira.exe 1480 Ransomware Akira.exe 1480 Ransomware Akira.exe 1480 Ransomware Akira.exe 1480 Ransomware Akira.exe 1480 Ransomware Akira.exe 1480 Ransomware Akira.exe 1480 Ransomware Akira.exe 1480 Ransomware Akira.exe 1480 Ransomware Akira.exe 1480 Ransomware Akira.exe 1480 Ransomware Akira.exe 1480 Ransomware Akira.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes:
powershell.exevssvc.exedescription pid process Token: SeDebugPrivilege 1648 powershell.exe Token: SeBackupPrivilege 2776 vssvc.exe Token: SeRestorePrivilege 2776 vssvc.exe Token: SeAuditPrivilege 2776 vssvc.exe -
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\Ransomware Akira.exe"C:\Users\Admin\AppData\Local\Temp\Ransomware Akira.exe"1⤵
- Drops startup file
- Drops desktop.ini file(s)
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
PID:1480
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -Command "Get-WmiObject Win32_Shadowcopy | Remove-WmiObject"1⤵
- Process spawned unexpected child process
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1648
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2776
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2KB
MD508f762538499795b3fabc40857f2caea
SHA1e9bf41d36e249f29877fe7f5211e3b3197edb5d4
SHA2566dd6401da86a4fa1e8b74802fa9417b573dec2c29beaa8827494702f07024c4b
SHA512e0466a5c878361ed2a3caff2a0df1f22a7772760bc81546a59f9a0e3e7402db4d67a82ceabb378857eea143d9834d6eb7284bbe10027322f648229981ab47b2a
-
Filesize
3KB
MD595940cc0d67efa0b0374d064dac43708
SHA1b0fb2cfa93e9b71a3808613f62160129fe5926ea
SHA2568bfc6049175ba1fefb5e93620fddc14cda5aa5f09877c98ca5c99887ff737499
SHA5125752806adad668a203415f3a1e4b52123424b4722027b706efbabcf3eddeaf92fba07da172b64eb3341962bd2c07af78d51f97c3dbc814b82bae1fbd8ff332b8
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82