sodinokibi | fcb9ba05f921f7af41dba56b278c39715a8631c27048c70d098574e7ec20db22

General

Target

fcb9ba05f921f7af41dba56b278c39715a8631c27048c70d098574e7ec20db22.bin.exe
Size

166KB
MD5

9c21e23a91e0488d8df5e65b5d29a2fe
SHA1

f032814f2e072178a0c20d7500c2e1e4352aca39
SHA256

fcb9ba05f921f7af41dba56b278c39715a8631c27048c70d098574e7ec20db22
SHA512

6a9008181203b1d02e62256c62d41e6788caf16b60977ff796bff8b4c42efc815b092082ee99d92d459c54f3b6e440ecfa16d5bfff9a63aa099f48ba20fc53b1

Score

10^/10

ransomware sodinokibi persistence

Malware Config

Extracted

Path

C:\3z0k6i-readme.txt

Family

sodinokibi

Ransom Note

---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension 3z0k6i. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practice - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/C2A8A4171253212B 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/C2A8A4171253212B Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: o/tihtdrhzaQcaeIWOXXJ6FUxsN026k76mK6Rp0rpNxT3HUtD5cgZSLqaq8znKx9 NjhRsnmeofOKpWWeXeMrZsz1eXm/es8CkKT1+kFZoAY/kXT2Zvs4DvTIBwpw9COy LXVKvcimJT/FAH53GGLFkuozbf/eQ7Z11Ugy7+IP8mhb/Au4rKQjje85lJ+2DDba Ihe0wucShyna4qe8K66vuEzwOTpLuEVc1UChpBqudWDEqU47qmP27rCh0GzFIu79 9Fk3l9p6o6IOtuHlXmJ31HTGVM1IfR5r9wv8tx4tQXuNZoiXvRR/J1KVqs6fAgOT V9wM0DCwGGN3Lm0nrDOKYz49pgXpXxDc9Al8O99PIdjIkbsuxujDWkZj89PObBs+ uJH9r+03/tedlUY8CTFxgIA25e5cLWOl3gwIhMF+G70Ja9D5rLrEx/sBPH5iqnxK Q14t5dNoXSlnMWOqGqzdxdg9R+2gWU2drAkAh5bHdF4eIhegxDJWk37V9UKYVHwe 4mpblY/bc8dF1ohEfKpvlKzEcIZ2MbFOzADQQ05mjjTUdnxbohjRb2MdFelv/by3 bqo1HB/+5p6LNM1qW3h2+Rev1oNhkSqp9qAnkemiAjVB4LvT2evuPSe351whArSw rXF3xoWk3/m+im+YoVixMwb7Yb69DpZnsp9jeNzh78VIf7Ci3pR1W7kL/YNcdwI0 1biTD7uhX6yFGnVkwkJ4X0b7ZsIp/1zlWG3OtYfxV28olaJ7D7/V1pc06yzFx1VQ lpg8QXFsdNC8OVb+loNLRZwXwOXp6rREbUFaQLviXmeiSOV5TRNRBZlhbKxVmKbr c9BWnuB8qC8FawTHB7/+62ix0azjJeIj2SkMWy/w+oAbwCiS/349mFTKDaExckaI kRXaUV3Sc5V2xb4PbcffZ1WDyXCuXMj/d+meHIS4a6qovkFDMVHy1uWz7vBRN8jp oakKJgEk0NRico4Nij7dTd5kj96Va9/WMs7YWqJ1AJMaFCkzWuXJJLR/AO8kB58V thQzvgwOVmLIoJI2fwipnryYdCQ3SdQlmUiYXVts8/kZZe2KOLVEEXlaxolRiwlr RHqu8T8sBb+McM8P8FEfyvCCMhSHkA8UeJBrTSpAnhRPDeXW814qK5W4AWvGgW3Z /vJgxfZzHqVmGtiRRCKZvNvAql5iwm4tufbSYiLN8pIApNzujjWXOikQv/Hkqmi/ HKgcVW6lGf4SaBZGBEPGsFh9uIPIwLZtbZbNhwqLL9oimz1X79eNuzy6/CM1Fhnw wVib1Hx+p8hL5NcIb9wmkqWGoCAJ9zinIPOIRBBqVMI= ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damage of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!

URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/C2A8A4171253212B

http://decryptor.cc/C2A8A4171253212B

Signatures

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

fcb9ba05f921f7af41dba56b278c39715a8631c27048c70d098574e7ec20db22.bin.exe

description	pid	process	target process
PID 1492 wrote to memory of 1016	1492	fcb9ba05f921f7af41dba56b278c39715a8631c27048c70d098574e7ec20db22.bin.exe	powershell.exe
PID 1492 wrote to memory of 1016	1492	fcb9ba05f921f7af41dba56b278c39715a8631c27048c70d098574e7ec20db22.bin.exe	powershell.exe
PID 1492 wrote to memory of 1016	1492	fcb9ba05f921f7af41dba56b278c39715a8631c27048c70d098574e7ec20db22.bin.exe	powershell.exe
PID 1492 wrote to memory of 1016	1492	fcb9ba05f921f7af41dba56b278c39715a8631c27048c70d098574e7ec20db22.bin.exe	powershell.exe

Drops file in Program Files directory 22 IoCs

Processes:

fcb9ba05f921f7af41dba56b278c39715a8631c27048c70d098574e7ec20db22.bin.exe

description	ioc	process
File created	\??\c:\program files (x86)\3z0k6i-readme.txt	fcb9ba05f921f7af41dba56b278c39715a8631c27048c70d098574e7ec20db22.bin.exe
File opened for modification	\??\c:\program files\CompareFind.wmx	fcb9ba05f921f7af41dba56b278c39715a8631c27048c70d098574e7ec20db22.bin.exe
File created	\??\c:\program files\microsoft sql server compact edition\3z0k6i-readme.txt	fcb9ba05f921f7af41dba56b278c39715a8631c27048c70d098574e7ec20db22.bin.exe
File opened for modification	\??\c:\program files\TestMerge.eprtx	fcb9ba05f921f7af41dba56b278c39715a8631c27048c70d098574e7ec20db22.bin.exe
File opened for modification	\??\c:\program files\UnpublishGroup.sql	fcb9ba05f921f7af41dba56b278c39715a8631c27048c70d098574e7ec20db22.bin.exe
File opened for modification	\??\c:\program files\GrantPush.avi	fcb9ba05f921f7af41dba56b278c39715a8631c27048c70d098574e7ec20db22.bin.exe
File opened for modification	\??\c:\program files\ResetShow.dotm	fcb9ba05f921f7af41dba56b278c39715a8631c27048c70d098574e7ec20db22.bin.exe
File opened for modification	\??\c:\program files\UnprotectOut.vstm	fcb9ba05f921f7af41dba56b278c39715a8631c27048c70d098574e7ec20db22.bin.exe
File created	\??\c:\program files\microsoft sql server compact edition\v3.5\3z0k6i-readme.txt	fcb9ba05f921f7af41dba56b278c39715a8631c27048c70d098574e7ec20db22.bin.exe
File opened for modification	\??\c:\program files\ShowRemove.gif	fcb9ba05f921f7af41dba56b278c39715a8631c27048c70d098574e7ec20db22.bin.exe
File created	\??\c:\program files\3z0k6i-readme.txt	fcb9ba05f921f7af41dba56b278c39715a8631c27048c70d098574e7ec20db22.bin.exe
File opened for modification	\??\c:\program files\AssertUnlock.ADTS	fcb9ba05f921f7af41dba56b278c39715a8631c27048c70d098574e7ec20db22.bin.exe
File opened for modification	\??\c:\program files\EnterResize.bmp	fcb9ba05f921f7af41dba56b278c39715a8631c27048c70d098574e7ec20db22.bin.exe
File opened for modification	\??\c:\program files\MoveRedo.wmx	fcb9ba05f921f7af41dba56b278c39715a8631c27048c70d098574e7ec20db22.bin.exe
File opened for modification	\??\c:\program files\PushSelect.tiff	fcb9ba05f921f7af41dba56b278c39715a8631c27048c70d098574e7ec20db22.bin.exe
File opened for modification	\??\c:\program files\WaitShow.ram	fcb9ba05f921f7af41dba56b278c39715a8631c27048c70d098574e7ec20db22.bin.exe
File created	\??\c:\program files\microsoft sql server compact edition\v3.5\desktop\3z0k6i-readme.txt	fcb9ba05f921f7af41dba56b278c39715a8631c27048c70d098574e7ec20db22.bin.exe
File opened for modification	\??\c:\program files\DisconnectPing.txt	fcb9ba05f921f7af41dba56b278c39715a8631c27048c70d098574e7ec20db22.bin.exe
File opened for modification	\??\c:\program files\ResumeDeny.TTS	fcb9ba05f921f7af41dba56b278c39715a8631c27048c70d098574e7ec20db22.bin.exe
File opened for modification	\??\c:\program files\SaveStart.clr	fcb9ba05f921f7af41dba56b278c39715a8631c27048c70d098574e7ec20db22.bin.exe
File opened for modification	\??\c:\program files\SelectClear.dxf	fcb9ba05f921f7af41dba56b278c39715a8631c27048c70d098574e7ec20db22.bin.exe
File opened for modification	\??\c:\program files\StartPublish.potm	fcb9ba05f921f7af41dba56b278c39715a8631c27048c70d098574e7ec20db22.bin.exe

Drops file in System32 directory 1 IoCs

Processes:

fcb9ba05f921f7af41dba56b278c39715a8631c27048c70d098574e7ec20db22.bin.exe

description	ioc	process
File opened for modification	C:\Windows\System32\CatRoot2\dberr.txt	fcb9ba05f921f7af41dba56b278c39715a8631c27048c70d098574e7ec20db22.bin.exe

Sodin,Sodinokibi,REvil
Ransomware with advanced anti-analysis and privilege escalation functionality.
ransomware sodinokibi

Modifies service 2 TTPs 5 IoCs

persistence

Modify Registry

T1112

Modify Existing Service

T1031

Processes:

vssvc.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\Registry Writer	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SwProvider_{b5946137-7b9f-4925-af80-51abd60b20d5}	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\COM+ REGDB Writer	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\ASR Writer	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\Shadow Copy Optimization Writer	vssvc.exe

Enumerates connected drives 3 TTPs

Query Registry
T1012

Peripheral Device Discovery
T1120

System Information Discovery
T1082

Suspicious use of AdjustPrivilegeToken 6 IoCs

Processes:

fcb9ba05f921f7af41dba56b278c39715a8631c27048c70d098574e7ec20db22.bin.exepowershell.exevssvc.exe

description	pid	process
Token: SeDebugPrivilege	1492	fcb9ba05f921f7af41dba56b278c39715a8631c27048c70d098574e7ec20db22.bin.exe
Token: SeDebugPrivilege	1016	powershell.exe
Token: SeBackupPrivilege	1872	vssvc.exe
Token: SeRestorePrivilege	1872	vssvc.exe
Token: SeAuditPrivilege	1872	vssvc.exe
Token: SeTakeOwnershipPrivilege	1492	fcb9ba05f921f7af41dba56b278c39715a8631c27048c70d098574e7ec20db22.bin.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

Processes:

fcb9ba05f921f7af41dba56b278c39715a8631c27048c70d098574e7ec20db22.bin.exepowershell.exe

pid process

1492 fcb9ba05f921f7af41dba56b278c39715a8631c27048c70d098574e7ec20db22.bin.exe
1016 powershell.exe
1016 powershell.exe

pid	process
1492	fcb9ba05f921f7af41dba56b278c39715a8631c27048c70d098574e7ec20db22.bin.exe
1016	powershell.exe
1016	powershell.exe

Sets desktop wallpaper using registry 2 TTPs 1 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

Processes:

fcb9ba05f921f7af41dba56b278c39715a8631c27048c70d098574e7ec20db22.bin.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\9ntzg0687ns.bmp"	fcb9ba05f921f7af41dba56b278c39715a8631c27048c70d098574e7ec20db22.bin.exe

Modifies system certificate store 2 TTPs 10 IoCs

evasion spyware trojan

Install Root Certificate

T1130

Modify Registry

T1112

Processes:

fcb9ba05f921f7af41dba56b278c39715a8631c27048c70d098574e7ec20db22.bin.exe

description	ioc	process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13\Blob = 040000000100000010000000410352dc0ff7501b16f0028eba6f45c50f00000001000000140000005bcaa1c2780f0bcb5a90770451d96f38963f012d0b000000010000001e000000440053005400200052006f006f0074002000430041002000580033000000090000000100000016000000301406082b0601050507030406082b06010505070301140000000100000014000000c4a7b1a47b2c71fadbe14b9075ffc415608589101d00000001000000100000004558d512eecb27464920897de7b66053030000000100000014000000dac9024f54d8f6df94935fb1732638ca6ad77c131900000001000000100000006cf252fec3e8f20996de5d4dd9aef42420000000010000004e0300003082034a30820232a003020102021044afb080d6a327ba893039862ef8406b300d06092a864886f70d0101050500303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f74204341205833301e170d3030303933303231313231395a170d3231303933303134303131355a303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f7420434120583330820122300d06092a864886f70d01010105000382010f003082010a0282010100dfafe99750088357b4cc6265f69082ecc7d32c6b30ca5becd9c37dc740c118148be0e83376492ae33f214993ac4e0eaf3e48cb65eefcd3210f65d22ad9328f8ce5f777b0127bb595c089a3a9baed732e7a0c063283a27e8a1430cd11a0e12a38b9790a31fd50bd8065dfb7516383c8e28861ea4b6181ec526bb9a2e24b1a289f48a39e0cda098e3e172e1edd20df5bc62a8aab2ebd70adc50b1a25907472c57b6aab34d63089ffe568137b540bc8d6aeec5a9c921e3d64b38cc6dfbfc94170ec1672d526ec38553943d0fcfd185c40f197ebd59a9b8d1dbada25b9c6d8dfc115023aabda6ef13e2ef55c089c3cd68369e4109b192ab62957e3e53d9b9ff0025d0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e04160414c4a7b1a47b2c71fadbe14b9075ffc41560858910300d06092a864886f70d01010505000382010100a31a2c9b17005ca91eee2866373abf83c73f4bc309a095205de3d95944d23e0d3ebd8a4ba0741fce10829c741a1d7e981addcb134bb32044e491e9ccfc7da5db6ae5fee6fde04eddb7003ab57049aff2e5eb02f1d1028b19cb943a5e48c4181e58195f1e025af00cf1b1ada9dc59868b6ee991f586cafab96633aa595bcee2a7167347cb2bcc99b03748cfe3564bf5cf0f0c723287c6f044bb53726d43f526489a5267b758abfe67767178db0da256141339243185a2a8025a3047e1dd5007bc02099000eb6463609b16bc88c912e6d27d918bf93d328d65b4e97cb15776eac5b62839bf15651cc8f677966a0a8d770bd8910b048e07db29b60aee9d82353510	fcb9ba05f921f7af41dba56b278c39715a8631c27048c70d098574e7ec20db22.bin.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\B1BC968BD4F49D622AA89A81F2150152A41D829C	fcb9ba05f921f7af41dba56b278c39715a8631c27048c70d098574e7ec20db22.bin.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\SystemCertificates\CA\Certificates\D89E3BD43D5D909B47A18977AA9D5CE36CEE184C\Blob = 030000000100000014000000d89e3bd43d5d909b47a18977aa9d5ce36cee184c190000000100000010000000ea6089055218053dd01e37e1d806eedf040000000100000010000000285ec909c4ab0d2d57f5086b225799aa0f000000010000003000000013baa039635f1c5292a8c2f36aae7e1d25c025202e9092f5b0f53f5f752dfa9c71b3d1b8d9a6358fcee6ec75622fabf91400000001000000140000005379bf5aaa2b4acf5480e1d89bc09df2b20366cb1800000001000000100000002aa1c05e2ae606f198c2c5e937c97aa22000000001000000850500003082058130820469a00302010202103972443af922b751d7d36c10dd313595300d06092a864886f70d01010c0500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3139303331323030303030305a170d3238313233313233353935395a308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f7269747930820222300d06092a864886f70d01010105000382020f003082020a028202010080126517360ec3db08b3d0ac570d76edcd27d34cad508361e2aa204d092d6409dcce899fcc3da9ecf6cfc1dcf1d3b1d67b3728112b47da39c6bc3a19b45fa6bd7d9da36342b676f2a93b2b91f8e26fd0ec162090093ee2e874c918b491d46264db7fa306f188186a90223cbcfe13f087147bf6e41f8ed4e451c61167460851cb8614543fbc33fe7e6c9cff169d18bd518e35a6a766c87267db2166b1d49b7803c0503ae8ccf0dcbc9e4cfeaf0596351f575ab7ffcef93db72cb6f654ddc8e7123a4dae4c8ab75c9ab4b7203dca7f2234ae7e3b68660144e7014e46539b3360f794be5337907343f332c353efdbaafe744e69c76b8c6093dec4c70cdfe132aecc933b517895678bee3d56fe0cd0690f1b0ff325266b336df76e47fa7343e57e0ea566b1297c3284635589c40dc19354301913acd37d37a7eb5d3a6c355cdb41d712daa9490bdfd8808a0993628eb566cf2588cd84b8b13fa4390fd9029eeb124c957cf36b05a95e1683ccb867e2e8139dcc5b82d34cb3ed5bffdee573ac233b2d00bf3555740949d849581a7f9236e651920ef3267d1c4d17bcc9ec4326d0bf415f40a94444f499e757879e501f5754a83efd74632fb1506509e658422e431a4cb4f0254759fa041e93d426464a5081b2debe78b7fc6715e1c957841e0f63d6e962bad65f552eea5cc62808042539b80e2ba9f24c971c073f0d52f5edef2f820f0203010001a381f23081ef301f0603551d23041830168014a0110a233e96f107ece2af29ef82a57fd030a4b4301d0603551d0e041604145379bf5aaa2b4acf5480e1d89bc09df2b20366cb300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff30110603551d20040a300830060604551d200030430603551d1f043c303a3038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c303406082b0601050507010104283026302406082b060105050730018618687474703a2f2f6f6373702e636f6d6f646f63612e636f6d300d06092a864886f70d01010c05000382010100188751dc74213d9c8ae027b733d02eccecf0e6cb5e11de226f9b758e9e72fee4d6feaa1f9c962def034a7eaef48d6f723c433bc03febb8df5caaa9c6aef2fcd8eea37b43f686367c14e0cdf4f73ffedeb8b48af09196fefd43647efdccd201a17d7df81919c9422b13bf588bbaa4a266047688914e0c8914cea24dc932b3bae8141abc71f15bf0410b98000a220310e50cb1f9cd923719ed3bf1e43ab6f945132675afbbaaef3f7b773bd2c402913d1900d3175c39db3f7b180d45cd9385962f5ddf59164f3f51bdd545183fed4a8ee80661742316b50d50732744477f105d892a6b853114c4e8a96a4c80bc6a78cfb87f8e7672990c9dfed7910816a1a35f95	fcb9ba05f921f7af41dba56b278c39715a8631c27048c70d098574e7ec20db22.bin.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25	fcb9ba05f921f7af41dba56b278c39715a8631c27048c70d098574e7ec20db22.bin.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13	fcb9ba05f921f7af41dba56b278c39715a8631c27048c70d098574e7ec20db22.bin.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349	fcb9ba05f921f7af41dba56b278c39715a8631c27048c70d098574e7ec20db22.bin.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 040000000100000010000000497904b0eb8719ac47b0bc11519b74d00f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d578112861900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa2030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491d00000001000000100000002e0d6875874a44c820912e85e964cfdb140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b40b00000001000000180000004300b7004f00b7004d00b7004f00b7004400b7004f00000053000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b06010505070308200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e	fcb9ba05f921f7af41dba56b278c39715a8631c27048c70d098574e7ec20db22.bin.exe
Key created	\REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\SystemCertificates\CA\Certificates\D89E3BD43D5D909B47A18977AA9D5CE36CEE184C	fcb9ba05f921f7af41dba56b278c39715a8631c27048c70d098574e7ec20db22.bin.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25\Blob = 040000000100000010000000d474de575c39b2d39c8583c5c065498a0f0000000100000014000000e35ef08d884f0a0ade2f75e96301ce6230f213a8190000000100000010000000ba4f3972e7aed9dccdc210db59da13c90300000001000000140000005fb7ee0633e259dbad0c4c9ae6d38f1a61c7dc251d00000001000000100000008f76b981d528ad4770088245e2031b630b0000000100000012000000440069006700690043006500720074000000140000000100000014000000b13ec36903f8bf4701d498261a0802ef63642bc35300000001000000230000003021301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703082000000001000000c9030000308203c5308202ada003020102021002ac5c266a0b409b8f0b79f2ae462577300d06092a864886f70d0101050500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c6cce573e6fbd4bbe52d2d32a6dfe5813fc9cd2549b6712ac3d5943467a20a1cb05f69a640b1c4b7b28fd098a4a941593ad3dc94d63cdb7438a44acc4d2582f74aa5531238eef3496d71917e63b6aba65fc3a484f84f6251bef8c5ecdb3892e306e508910cc4284155fbcb5a89157e71e835bf4d72093dbe3a38505b77311b8db3c724459aa7ac6d00145a04b7ba13eb510a984141224e656187814150a6795c89de194a57d52ee65d1c532c7e98cd1a0616a46873d03404135ca171d35a7c55db5e64e13787305604e511b4298012f1793988a202117c2766b788b778f2ca0aa838ab0a64c2bf665d9584c1a1251e875d1a500b2012cc41bb6e0b5138b84bcb0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414b13ec36903f8bf4701d498261a0802ef63642bc3301f0603551d23041830168014b13ec36903f8bf4701d498261a0802ef63642bc3300d06092a864886f70d010105050003820101001c1a0697dcd79c9f3c886606085721db2147f82a67aabf183276401057c18af37ad911658e35fa9efc45b59ed94c314bb891e8432c8eb378cedbe3537971d6e5219401da55879a2464f68a66ccde9c37cda834b1699b23c89e78222b7043e35547316119ef58c5852f4e30f6a0311623c8e7e2651633cbbf1a1ba03df8ca5e8b318b6008892d0c065c52b7c4f90a98d1155f9f12be7c366338bd44a47fe4262b0ac497690de98ce2c01057b8c876129155f24869d8bc2a025b0f44d42031dbf4ba70265d90609ebc4b17092fb4cb1e4368c90727c1d25cf7ea21b968129c3c9cbf9efc805c9b63cdec47aa252767a037f300827d54d7a9f8e92e13a377e81f4a	fcb9ba05f921f7af41dba56b278c39715a8631c27048c70d098574e7ec20db22.bin.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\B1BC968BD4F49D622AA89A81F2150152A41D829C\Blob = 0400000001000000100000003e455215095192e1b75d379fb187298a0f00000001000000140000005a6d07b6371d966a2fb6ba92828ce5512a49513d190000000100000010000000a823b4a20180beb460cab955c24d7e21030000000100000014000000b1bc968bd4f49d622aa89a81f2150152a41d829c1d00000001000000100000006ee7f3b060d10e90a31ba3471b999236140000000100000014000000607b661a450d97ca89502f7d04cd34a8fffcfd4b0b000000010000001600000047006c006f00620061006c005300690067006e0000005300000001000000230000003021301f06092b06010401a032010130123010060a2b0601040182373c0101030200c0090000000100000068000000306606082b0601050507030106082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030806082b06010505070309060a2b0601040182370a030406082b0601050507030606082b0601050507030706082b06010505080202200000000100000079030000308203753082025da003020102020b040000000001154b5ac394300d06092a864886f70d01010505003057310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613110300e060355040b1307526f6f74204341311b301906035504031312476c6f62616c5369676e20526f6f74204341301e170d3938303930313132303030305a170d3238303132383132303030305a3057310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613110300e060355040b1307526f6f74204341311b301906035504031312476c6f62616c5369676e20526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100da0ee6998dcea3e34f8a7efbf18b83256bea481ff12ab0b9951104bdf063d1e26766cf1cddcf1b482bee8d898e9aaf298065abe9c72d12cbab1c4c7007a13d0a30cd158d4ff8ddd48c50151cef50eec42ef7fce952f2917de06dd535308e5e4373f241e9d56ae3b2893a5639386f063c88695b2a4dc5a754b86c89cc9bf93ccae5fd89f5123c927896d6dc746e934461d18dc746b2750e86e8198ad56d6cd5781695a2e9c80a38ebf224134f73549313853a1bbc1e34b58b058cb9778bb1db1f2091ab09536e90ce7b3774b97047912251631679aeb1ae412608c8192bd146aa48d6642ad78334ff2c2ac16c19434a0785e7d37cf62168efeaf2529f7f9390cf0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e04160414607b661a450d97ca89502f7d04cd34a8fffcfd4b300d06092a864886f70d01010505000382010100d673e77c4f76d08dbfecbaa2be34c52832b57cfc6c9c2c2bbd099e53bf6b5eaa1148b6e508a3b3ca3d614dd34609b33ec3a0e363551bf2baefad39e143b938a3e62f8a263befa05056f9c60afd38cdc40b705194979804dfc35f94d515c914419cc45d7564150dff5530ec868fff0def2cb96346f6aafcdfbc69fd2e1248649ae095f0a6ef298f01b115b50c1da5fe692c6924781eb3a71c7162eecac897ac175d8ac2f847866e2ac4563195d06789852bf96ca65d469d0caa82e49951dd70b7db563d61e46ae15cd6f6fe3dde41cc07ae6352bf5353f42be9c7fdb6f7825f85d24118db81b3041cc51fa4806f1520c9de0c880a1dd66655e2fc48c9292669e0	fcb9ba05f921f7af41dba56b278c39715a8631c27048c70d098574e7ec20db22.bin.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

fcb9ba05f921f7af41dba56b278c39715a8631c27048c70d098574e7ec20db22.bin.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\oXnEn2JlQT = "C:\\Users\\Admin\\AppData\\Local\\Temp\\fcb9ba05f921f7af41dba56b278c39715a8631c27048c70d098574e7ec20db22.bin.exe"	fcb9ba05f921f7af41dba56b278c39715a8631c27048c70d098574e7ec20db22.bin.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run	fcb9ba05f921f7af41dba56b278c39715a8631c27048c70d098574e7ec20db22.bin.exe

C:\Users\Admin\AppData\Local\Temp\fcb9ba05f921f7af41dba56b278c39715a8631c27048c70d098574e7ec20db22.bin.exe
"C:\Users\Admin\AppData\Local\Temp\fcb9ba05f921f7af41dba56b278c39715a8631c27048c70d098574e7ec20db22.bin.exe"
1⤵
- Suspicious use of WriteProcessMemory
- Drops file in Program Files directory
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: EnumeratesProcesses
- Sets desktop wallpaper using registry
- Modifies system certificate store
- Adds Run key to start application
PID:1492

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell -e RwBlAHQALQBXAG0AaQBPAGIAagBlAGMAdAAgAFcAaQBuADMAMgBfAFMAaABhAGQAbwB3AGMAbwBwAHkAIAB8ACAARgBvAHIARQBhAGMAaAAtAE8AYgBqAGUAYwB0ACAAewAkAF8ALgBEAGUAbABlAHQAZQAoACkAOwB9AA==
2⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: EnumeratesProcesses
PID:1016