Analysis
- max time kernel
150s - max time network
152s - platform
windows10_x64 - resource
win10 - submitted
20/10/2020, 09:45
Static task
static1
Behavioral task
behavioral1
Sample
e9e5459e32521a8ca1c075a96d3358337919321f5d149fe3a8cc5f6f57b33923.exe
Resource
win7v200722
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
e9e5459e32521a8ca1c075a96d3358337919321f5d149fe3a8cc5f6f57b33923.exe
Resource
win10
windows10_x64
0 signatures
0 seconds
General
- Target e9e5459e32521a8ca1c075a96d3358337919321f5d149fe3a8cc5f6f57b33923.exe
- Size 115KB
- Sample201020-n1981nrlsx
- SHA256 e9e5459e32521a8ca1c075a96d3358337919321f5d149fe3a8cc5f6f57b33923
- MD5 0800618cde0d124c6616ef384fbe1434
- SHA1 9404f15917b9a216242063d1b7759d891bf11314
- SHA512 0dbedc86f146716a394af812e63e6b721c37cf1f49da07ac35d2106495b19a5f473344ab90a026e84441c4d0741c3b21ba1815616886ce692d6b6f03b0a45703
- MD5 SHA1 SHA512
Score
10/10
Malware Config
Extracted
Path
-
C:\How to decrypt gg5a8-readme.txt
-
sodinokibi
Ransom Note
- ---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your computer has extension gg5a8. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/DE0D0DD8C82AA38D 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/DE0D0DD8C82AA38D Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: AlrYNXLghv+DW2gsQK7gyyNCueQqNkGpuwOfBcilgnmTPR4TxXNrnauMGG+Ah/vB Lr2TLOXTOwM1tVtlGWDcpKmb/ZCZ0b49Bn+AM/Z7B8HhyqqeCdL75gVA4M37sWtV XTRDNWWEyMgv+e3jsXTdGL3X6Jag6vpwnZpVwlF7jjbziQaJYW4NMRHtIgaWmpp6 t27/DSsVVp60k6YS9kPYV1yXUgYXF+ehwdiytqMYYYTTrXm3ClhtSujolm9dARrq U7ehLyRuLW3pshu8naBQ9iOZ0kAOZcu/bT4oTYKgnFKjkyI45Oq/Ipn9zxzYyTdF z9EfAUedEq0khdbV39aNeMcwvheruuR8EsNn0cVdIj59OPPJ9ucGuRQ97csJomrS Qh5dRrhUbGrQzSSDf20T4GtL37l9Z3FxahXWEYPMlX8gS38AEd1JFCy+FoPegttY 1hHpK65NPsPaYvmelXf573TqYgudDGP/SFbz2ZJhBtEjKu6Oug0mMhW39SKXn7cW mF1XsCgRl+MUoYOg00acwybuLO5CN2VehqAM2XFpH2R4d1B0JSK3hfujbj8AM+lS ZWJdYdVW+ueGMefs/7UruSX+Rr9jrkWcJtJ4fjFECcYx5Sbgj1WwMGaxDqAyp5MO Hlq0NE+n8XsZGEPKF5pE/daX+c8JwSxbp3wHYGtcCxFjuecjF5ukOB68Gmmyf7Pi 9VuE+gb74Z1zasnr37A05R7IKSSoEPjzbo7cyflGK7pXe3ZeseuBGoqHNyF/Q0PD Sb+dYSMBiiORXLN/jMGPjigMJ1LupueAe5eZG7upl9M2jLUQGeV6YPXavYybEVQI WUh54ICT45Q7Qxum4YFhajkzS32qNVmj4YXeCnoxWaTfQmdLKwDJdsUg4a1Xjw/c P4ngeDgx5L+QQyVkDiy0M1DiocrjLzEefPrFDOv4xA0UlJK7KYR7emOrGm0Ie8gs wa5Dx5VVgVBn6fzCC5OKK/TT360D5c8h4zkIz29TNoh4qG5hteaK+Bht7q5HsMrY noPUCUGdmr+EjMegxYpbRavlJ81GPD9mZSi5NSrJqwhikArFa1X3+6riZeq2ocpR fS7Ka9nME4Zz6tnBePzhyjHt+U2lPmg660awCfVaF2Z2uHyrVLZch1d2QG+h4G/i DTpk3r4qOBLfhTS610kswqnAA7XqKs68QwPgqYemrVCZIsRK6NzHdg9cN38bmL+b Snx3lWEYR/BJyGSZucbzF+jFaIeRGX3dhVpwNOi3XkbYspmcGi1Q4MQjC3jK2I4I VfzGYN4PTGrgBlc6rUg= Extension name: gg5a8 ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs
-
http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/DE0D0DD8C82AA38D
-
http://decryptor.cc/DE0D0DD8C82AA38D
Signatures
- Sodin,Sodinokibi,REvil
Ransomware with advanced anti-analysis and privilege escalation functionality.
- Modifies extensions of user files 15 IoCs
Ransomware generally changes the extension on encrypted files.
description ioc Process File renamed C:\Users\Admin\Pictures\DisconnectWrite.tiff => \??\c:\users\admin\pictures\DisconnectWrite.tiff.gg5a8 e9e5459e32521a8ca1c075a96d3358337919321f5d149fe3a8cc5f6f57b33923.exe File renamed C:\Users\Admin\Pictures\OptimizeBlock.tif => \??\c:\users\admin\pictures\OptimizeBlock.tif.gg5a8 e9e5459e32521a8ca1c075a96d3358337919321f5d149fe3a8cc5f6f57b33923.exe File opened for modification \??\c:\users\admin\pictures\MountEnter.tiff e9e5459e32521a8ca1c075a96d3358337919321f5d149fe3a8cc5f6f57b33923.exe File renamed C:\Users\Admin\Pictures\ResetLimit.crw => \??\c:\users\admin\pictures\ResetLimit.crw.gg5a8 e9e5459e32521a8ca1c075a96d3358337919321f5d149fe3a8cc5f6f57b33923.exe File renamed C:\Users\Admin\Pictures\ConvertFromUninstall.png => \??\c:\users\admin\pictures\ConvertFromUninstall.png.gg5a8 e9e5459e32521a8ca1c075a96d3358337919321f5d149fe3a8cc5f6f57b33923.exe File renamed C:\Users\Admin\Pictures\RenameConfirm.raw => \??\c:\users\admin\pictures\RenameConfirm.raw.gg5a8 e9e5459e32521a8ca1c075a96d3358337919321f5d149fe3a8cc5f6f57b33923.exe File renamed C:\Users\Admin\Pictures\SwitchRequest.raw => \??\c:\users\admin\pictures\SwitchRequest.raw.gg5a8 e9e5459e32521a8ca1c075a96d3358337919321f5d149fe3a8cc5f6f57b33923.exe File renamed C:\Users\Admin\Pictures\ResetImport.png => \??\c:\users\admin\pictures\ResetImport.png.gg5a8 e9e5459e32521a8ca1c075a96d3358337919321f5d149fe3a8cc5f6f57b33923.exe File renamed C:\Users\Admin\Pictures\SuspendInstall.raw => \??\c:\users\admin\pictures\SuspendInstall.raw.gg5a8 e9e5459e32521a8ca1c075a96d3358337919321f5d149fe3a8cc5f6f57b33923.exe File renamed C:\Users\Admin\Pictures\WaitAssert.tif => \??\c:\users\admin\pictures\WaitAssert.tif.gg5a8 e9e5459e32521a8ca1c075a96d3358337919321f5d149fe3a8cc5f6f57b33923.exe File opened for modification \??\c:\users\admin\pictures\DisconnectWrite.tiff e9e5459e32521a8ca1c075a96d3358337919321f5d149fe3a8cc5f6f57b33923.exe File renamed C:\Users\Admin\Pictures\CheckpointSave.crw => \??\c:\users\admin\pictures\CheckpointSave.crw.gg5a8 e9e5459e32521a8ca1c075a96d3358337919321f5d149fe3a8cc5f6f57b33923.exe File renamed C:\Users\Admin\Pictures\MountEnter.tiff => \??\c:\users\admin\pictures\MountEnter.tiff.gg5a8 e9e5459e32521a8ca1c075a96d3358337919321f5d149fe3a8cc5f6f57b33923.exe File renamed C:\Users\Admin\Pictures\DismountJoin.raw => \??\c:\users\admin\pictures\DismountJoin.raw.gg5a8 e9e5459e32521a8ca1c075a96d3358337919321f5d149fe3a8cc5f6f57b33923.exe File renamed C:\Users\Admin\Pictures\FormatPop.png => \??\c:\users\admin\pictures\FormatPop.png.gg5a8 e9e5459e32521a8ca1c075a96d3358337919321f5d149fe3a8cc5f6f57b33923.exe - Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run e9e5459e32521a8ca1c075a96d3358337919321f5d149fe3a8cc5f6f57b33923.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\BV7BRrErOX = "C:\\Users\\Admin\\AppData\\Local\\Temp\\e9e5459e32521a8ca1c075a96d3358337919321f5d149fe3a8cc5f6f57b33923.exe" e9e5459e32521a8ca1c075a96d3358337919321f5d149fe3a8cc5f6f57b33923.exe - Enumerates connected drives 3 TTPs 25 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\I: e9e5459e32521a8ca1c075a96d3358337919321f5d149fe3a8cc5f6f57b33923.exe File opened (read-only) \??\J: e9e5459e32521a8ca1c075a96d3358337919321f5d149fe3a8cc5f6f57b33923.exe File opened (read-only) \??\K: e9e5459e32521a8ca1c075a96d3358337919321f5d149fe3a8cc5f6f57b33923.exe File opened (read-only) \??\M: e9e5459e32521a8ca1c075a96d3358337919321f5d149fe3a8cc5f6f57b33923.exe File opened (read-only) \??\O: e9e5459e32521a8ca1c075a96d3358337919321f5d149fe3a8cc5f6f57b33923.exe File opened (read-only) \??\U: e9e5459e32521a8ca1c075a96d3358337919321f5d149fe3a8cc5f6f57b33923.exe File opened (read-only) \??\W: e9e5459e32521a8ca1c075a96d3358337919321f5d149fe3a8cc5f6f57b33923.exe File opened (read-only) \??\Z: e9e5459e32521a8ca1c075a96d3358337919321f5d149fe3a8cc5f6f57b33923.exe File opened (read-only) \??\D: e9e5459e32521a8ca1c075a96d3358337919321f5d149fe3a8cc5f6f57b33923.exe File opened (read-only) \??\F: e9e5459e32521a8ca1c075a96d3358337919321f5d149fe3a8cc5f6f57b33923.exe File opened (read-only) \??\G: e9e5459e32521a8ca1c075a96d3358337919321f5d149fe3a8cc5f6f57b33923.exe File opened (read-only) \??\H: e9e5459e32521a8ca1c075a96d3358337919321f5d149fe3a8cc5f6f57b33923.exe File opened (read-only) \??\L: e9e5459e32521a8ca1c075a96d3358337919321f5d149fe3a8cc5f6f57b33923.exe File opened (read-only) \??\N: e9e5459e32521a8ca1c075a96d3358337919321f5d149fe3a8cc5f6f57b33923.exe File opened (read-only) \??\P: e9e5459e32521a8ca1c075a96d3358337919321f5d149fe3a8cc5f6f57b33923.exe File opened (read-only) \??\Y: e9e5459e32521a8ca1c075a96d3358337919321f5d149fe3a8cc5f6f57b33923.exe File opened (read-only) \??\B: e9e5459e32521a8ca1c075a96d3358337919321f5d149fe3a8cc5f6f57b33923.exe File opened (read-only) \??\E: e9e5459e32521a8ca1c075a96d3358337919321f5d149fe3a8cc5f6f57b33923.exe File opened (read-only) \??\R: e9e5459e32521a8ca1c075a96d3358337919321f5d149fe3a8cc5f6f57b33923.exe File opened (read-only) \??\T: e9e5459e32521a8ca1c075a96d3358337919321f5d149fe3a8cc5f6f57b33923.exe File opened (read-only) \??\X: e9e5459e32521a8ca1c075a96d3358337919321f5d149fe3a8cc5f6f57b33923.exe File opened (read-only) \??\A: e9e5459e32521a8ca1c075a96d3358337919321f5d149fe3a8cc5f6f57b33923.exe File opened (read-only) \??\Q: e9e5459e32521a8ca1c075a96d3358337919321f5d149fe3a8cc5f6f57b33923.exe File opened (read-only) \??\S: e9e5459e32521a8ca1c075a96d3358337919321f5d149fe3a8cc5f6f57b33923.exe File opened (read-only) \??\V: e9e5459e32521a8ca1c075a96d3358337919321f5d149fe3a8cc5f6f57b33923.exe - Modifies service 2 TTPs 5 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SwProvider_{b5946137-7b9f-4925-af80-51abd60b20d5} vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\Registry Writer vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\COM+ REGDB Writer vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\ASR Writer vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\Shadow Copy Optimization Writer vssvc.exe - Sets desktop wallpaper using registry 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1e6z3g.bmp" e9e5459e32521a8ca1c075a96d3358337919321f5d149fe3a8cc5f6f57b33923.exe - Drops file in Program Files directory 31 IoCs
description ioc Process File opened for modification \??\c:\program files\GroupUpdate.htm e9e5459e32521a8ca1c075a96d3358337919321f5d149fe3a8cc5f6f57b33923.exe File opened for modification \??\c:\program files\RequestApprove.3gp2 e9e5459e32521a8ca1c075a96d3358337919321f5d149fe3a8cc5f6f57b33923.exe File opened for modification \??\c:\program files\WriteDismount.vstm e9e5459e32521a8ca1c075a96d3358337919321f5d149fe3a8cc5f6f57b33923.exe File opened for modification \??\c:\program files\ConfirmDeny.jfif e9e5459e32521a8ca1c075a96d3358337919321f5d149fe3a8cc5f6f57b33923.exe File opened for modification \??\c:\program files\ReceiveDismount.TS e9e5459e32521a8ca1c075a96d3358337919321f5d149fe3a8cc5f6f57b33923.exe File opened for modification \??\c:\program files\UnregisterOpen.mp3 e9e5459e32521a8ca1c075a96d3358337919321f5d149fe3a8cc5f6f57b33923.exe File opened for modification \??\c:\program files\UseSelect.3gp e9e5459e32521a8ca1c075a96d3358337919321f5d149fe3a8cc5f6f57b33923.exe File opened for modification \??\c:\program files\CopyStep.AAC e9e5459e32521a8ca1c075a96d3358337919321f5d149fe3a8cc5f6f57b33923.exe File opened for modification \??\c:\program files\RenameImport.mp2v e9e5459e32521a8ca1c075a96d3358337919321f5d149fe3a8cc5f6f57b33923.exe File opened for modification \??\c:\program files\ResolveRestart.vbe e9e5459e32521a8ca1c075a96d3358337919321f5d149fe3a8cc5f6f57b33923.exe File opened for modification \??\c:\program files\StartExport.pdf e9e5459e32521a8ca1c075a96d3358337919321f5d149fe3a8cc5f6f57b33923.exe File opened for modification \??\c:\program files\UseReset.ps1xml e9e5459e32521a8ca1c075a96d3358337919321f5d149fe3a8cc5f6f57b33923.exe File created \??\c:\program files\How to decrypt gg5a8-readme.txt e9e5459e32521a8ca1c075a96d3358337919321f5d149fe3a8cc5f6f57b33923.exe File opened for modification \??\c:\program files\CompareStep.xla e9e5459e32521a8ca1c075a96d3358337919321f5d149fe3a8cc5f6f57b33923.exe File opened for modification \??\c:\program files\PushStep.potm e9e5459e32521a8ca1c075a96d3358337919321f5d149fe3a8cc5f6f57b33923.exe File opened for modification \??\c:\program files\StartConvertTo.eprtx e9e5459e32521a8ca1c075a96d3358337919321f5d149fe3a8cc5f6f57b33923.exe File opened for modification \??\c:\program files\ConvertFromInstall.vbs e9e5459e32521a8ca1c075a96d3358337919321f5d149fe3a8cc5f6f57b33923.exe File opened for modification \??\c:\program files\OptimizeRegister.tmp e9e5459e32521a8ca1c075a96d3358337919321f5d149fe3a8cc5f6f57b33923.exe File opened for modification \??\c:\program files\PingUnprotect.css e9e5459e32521a8ca1c075a96d3358337919321f5d149fe3a8cc5f6f57b33923.exe File opened for modification \??\c:\program files\RedoComplete.xhtml e9e5459e32521a8ca1c075a96d3358337919321f5d149fe3a8cc5f6f57b33923.exe File created \??\c:\program files (x86)\How to decrypt gg5a8-readme.txt e9e5459e32521a8ca1c075a96d3358337919321f5d149fe3a8cc5f6f57b33923.exe File opened for modification \??\c:\program files\ConvertToUpdate.dib e9e5459e32521a8ca1c075a96d3358337919321f5d149fe3a8cc5f6f57b33923.exe File opened for modification \??\c:\program files\SaveRedo.gif e9e5459e32521a8ca1c075a96d3358337919321f5d149fe3a8cc5f6f57b33923.exe File opened for modification \??\c:\program files\UsePing.htm e9e5459e32521a8ca1c075a96d3358337919321f5d149fe3a8cc5f6f57b33923.exe File opened for modification \??\c:\program files\RestoreFind.3gpp e9e5459e32521a8ca1c075a96d3358337919321f5d149fe3a8cc5f6f57b33923.exe File opened for modification \??\c:\program files\SetEnter.tif e9e5459e32521a8ca1c075a96d3358337919321f5d149fe3a8cc5f6f57b33923.exe File opened for modification \??\c:\program files\BlockEnable.edrwx e9e5459e32521a8ca1c075a96d3358337919321f5d149fe3a8cc5f6f57b33923.exe File opened for modification \??\c:\program files\HideEnable.M2V e9e5459e32521a8ca1c075a96d3358337919321f5d149fe3a8cc5f6f57b33923.exe File opened for modification \??\c:\program files\HideUse.jpg e9e5459e32521a8ca1c075a96d3358337919321f5d149fe3a8cc5f6f57b33923.exe File opened for modification \??\c:\program files\LockRename.jpe e9e5459e32521a8ca1c075a96d3358337919321f5d149fe3a8cc5f6f57b33923.exe File opened for modification \??\c:\program files\SearchConvert.au3 e9e5459e32521a8ca1c075a96d3358337919321f5d149fe3a8cc5f6f57b33923.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\SystemCertificates\CA\Certificates\4C27431717565A3A07F3E6D0032C4258949CF9EC e9e5459e32521a8ca1c075a96d3358337919321f5d149fe3a8cc5f6f57b33923.exe Set value (data) \REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\SystemCertificates\CA\Certificates\4C27431717565A3A07F3E6D0032C4258949CF9EC\Blob = 0300000001000000140000004c27431717565a3a07f3e6d0032c4258949cf9ec140000000100000014000000f5cdd53c0850f96a4f3ab797da5683e669d268f7040000000100000010000000342e1e02d91852d4a66f8a892167c8fa0f0000000100000020000000a2de33490c476d356e2dbc737c2779692249526b65ab8fba9a34280481c8bdfc19000000010000001000000014b989b317682449c76eb3c21dac16e75c000000010000000400000000080000180000000100000010000000a823b4a20180beb460cab955c24d7e212000000001000000510400003082044d30820335a003020102020b040000000001444ef03631300d06092a864886f70d01010b05003057310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613110300e060355040b1307526f6f74204341311b301906035504031312476c6f62616c5369676e20526f6f74204341301e170d3134303232303130303030305a170d3234303232303130303030305a304c310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613122302006035504031319416c70686153534c204341202d20534841323536202d20473230820122300d06092a864886f70d01010105000382010f003082010a0282010100da01ece4ec7360fb7e8f6ab7c617e3926432d4ac00d9a20fb9edee6b8a86ca9267d974d75d47023c8f40d69e6d14cdc3da2939a70f050a68a2661a1ec4b28b7658e5ab5d1d8f40b3398bef1e837d22d0e3a9002eec53cf62198544284cc027cb7b0eec10640010a405cca072be416c315b48e4b1ecb923eb554dd07d624aa5b4a5a45985c52591a6fea6099f06106d8f810c64405e73009ae02e65985410007098c8e1ed345fd89cc70dc0d6235945fcfe557a86ee946022f1aed1e65546f699c51b08745facb064848f89381ca1a790214f026ebde06167d4f842870f0af7c9046d2aa92fef42a5dfdda353db981e81f99a727b5ade4f3e7fa258a0e217ad670203010001a38201233082011f300e0603551d0f0101ff04040302010630120603551d130101ff040830060101ff020100301d0603551d0e04160414f5cdd53c0850f96a4f3ab797da5683e669d268f730450603551d20043e303c303a0604551d20003032303006082b06010505070201162468747470733a2f2f7777772e616c70686173736c2e636f6d2f7265706f7369746f72792f30330603551d1f042c302a3028a026a0248622687474703a2f2f63726c2e676c6f62616c7369676e2e6e65742f726f6f742e63726c303d06082b060105050701010431302f302d06082b060105050730018621687474703a2f2f6f6373702e676c6f62616c7369676e2e636f6d2f726f6f747231301f0603551d23041830168014607b661a450d97ca89502f7d04cd34a8fffcfd4b300d06092a864886f70d01010b050003820101006040681647e7168ddb5ca1562acbf45c9bb01ea24bf5cb023ff80ba1f2a742d4b74cebe36680f32543782e1b1756075218cbd1a8ece6fb733ea4628c80b4d2c51273a3d3fa0238be633d84b899c1f1baf79fc340d1581853c162ddaf18427f344ec543d571b03000c7e390ae3f578697ceea0c128e2270e366a7547f2e28cbd454d0b31e626708f927e1cbe366b8241b896a894465f2d94cd2581c8c4ec095a1d4ef672f3820e82eff9651f0bad83d927047651c9e7372b4600c5ce2d17376e0af4ee2e537a5452f8a233e87c730e631387cf4dd52caf353042557566694e80beee603144eeefd6d94649e5ece79d4b2a6cf40b144a83e87195ee9f821165953 e9e5459e32521a8ca1c075a96d3358337919321f5d149fe3a8cc5f6f57b33923.exe - Suspicious behavior: EnumeratesProcesses 87 IoCs
pid Process 3676 e9e5459e32521a8ca1c075a96d3358337919321f5d149fe3a8cc5f6f57b33923.exe 3676 e9e5459e32521a8ca1c075a96d3358337919321f5d149fe3a8cc5f6f57b33923.exe 1312 powershell.exe 1312 powershell.exe 1312 powershell.exe 3676 e9e5459e32521a8ca1c075a96d3358337919321f5d149fe3a8cc5f6f57b33923.exe 3676 e9e5459e32521a8ca1c075a96d3358337919321f5d149fe3a8cc5f6f57b33923.exe 3676 e9e5459e32521a8ca1c075a96d3358337919321f5d149fe3a8cc5f6f57b33923.exe 3676 e9e5459e32521a8ca1c075a96d3358337919321f5d149fe3a8cc5f6f57b33923.exe 3676 e9e5459e32521a8ca1c075a96d3358337919321f5d149fe3a8cc5f6f57b33923.exe 3676 e9e5459e32521a8ca1c075a96d3358337919321f5d149fe3a8cc5f6f57b33923.exe 3676 e9e5459e32521a8ca1c075a96d3358337919321f5d149fe3a8cc5f6f57b33923.exe 3676 e9e5459e32521a8ca1c075a96d3358337919321f5d149fe3a8cc5f6f57b33923.exe 3676 e9e5459e32521a8ca1c075a96d3358337919321f5d149fe3a8cc5f6f57b33923.exe 3676 e9e5459e32521a8ca1c075a96d3358337919321f5d149fe3a8cc5f6f57b33923.exe 3676 e9e5459e32521a8ca1c075a96d3358337919321f5d149fe3a8cc5f6f57b33923.exe 3676 e9e5459e32521a8ca1c075a96d3358337919321f5d149fe3a8cc5f6f57b33923.exe 3676 e9e5459e32521a8ca1c075a96d3358337919321f5d149fe3a8cc5f6f57b33923.exe 3676 e9e5459e32521a8ca1c075a96d3358337919321f5d149fe3a8cc5f6f57b33923.exe 3676 e9e5459e32521a8ca1c075a96d3358337919321f5d149fe3a8cc5f6f57b33923.exe 3676 e9e5459e32521a8ca1c075a96d3358337919321f5d149fe3a8cc5f6f57b33923.exe 3676 e9e5459e32521a8ca1c075a96d3358337919321f5d149fe3a8cc5f6f57b33923.exe 3676 e9e5459e32521a8ca1c075a96d3358337919321f5d149fe3a8cc5f6f57b33923.exe 3676 e9e5459e32521a8ca1c075a96d3358337919321f5d149fe3a8cc5f6f57b33923.exe 3676 e9e5459e32521a8ca1c075a96d3358337919321f5d149fe3a8cc5f6f57b33923.exe 3676 e9e5459e32521a8ca1c075a96d3358337919321f5d149fe3a8cc5f6f57b33923.exe 3676 e9e5459e32521a8ca1c075a96d3358337919321f5d149fe3a8cc5f6f57b33923.exe 3676 e9e5459e32521a8ca1c075a96d3358337919321f5d149fe3a8cc5f6f57b33923.exe 3676 e9e5459e32521a8ca1c075a96d3358337919321f5d149fe3a8cc5f6f57b33923.exe 3676 e9e5459e32521a8ca1c075a96d3358337919321f5d149fe3a8cc5f6f57b33923.exe 3676 e9e5459e32521a8ca1c075a96d3358337919321f5d149fe3a8cc5f6f57b33923.exe 3676 e9e5459e32521a8ca1c075a96d3358337919321f5d149fe3a8cc5f6f57b33923.exe 3676 e9e5459e32521a8ca1c075a96d3358337919321f5d149fe3a8cc5f6f57b33923.exe 3676 e9e5459e32521a8ca1c075a96d3358337919321f5d149fe3a8cc5f6f57b33923.exe 3676 e9e5459e32521a8ca1c075a96d3358337919321f5d149fe3a8cc5f6f57b33923.exe 3676 e9e5459e32521a8ca1c075a96d3358337919321f5d149fe3a8cc5f6f57b33923.exe 3676 e9e5459e32521a8ca1c075a96d3358337919321f5d149fe3a8cc5f6f57b33923.exe 3676 e9e5459e32521a8ca1c075a96d3358337919321f5d149fe3a8cc5f6f57b33923.exe 3676 e9e5459e32521a8ca1c075a96d3358337919321f5d149fe3a8cc5f6f57b33923.exe 3676 e9e5459e32521a8ca1c075a96d3358337919321f5d149fe3a8cc5f6f57b33923.exe 3676 e9e5459e32521a8ca1c075a96d3358337919321f5d149fe3a8cc5f6f57b33923.exe 3676 e9e5459e32521a8ca1c075a96d3358337919321f5d149fe3a8cc5f6f57b33923.exe 3676 e9e5459e32521a8ca1c075a96d3358337919321f5d149fe3a8cc5f6f57b33923.exe 3676 e9e5459e32521a8ca1c075a96d3358337919321f5d149fe3a8cc5f6f57b33923.exe 3676 e9e5459e32521a8ca1c075a96d3358337919321f5d149fe3a8cc5f6f57b33923.exe 3676 e9e5459e32521a8ca1c075a96d3358337919321f5d149fe3a8cc5f6f57b33923.exe 3676 e9e5459e32521a8ca1c075a96d3358337919321f5d149fe3a8cc5f6f57b33923.exe 3676 e9e5459e32521a8ca1c075a96d3358337919321f5d149fe3a8cc5f6f57b33923.exe 3676 e9e5459e32521a8ca1c075a96d3358337919321f5d149fe3a8cc5f6f57b33923.exe 3676 e9e5459e32521a8ca1c075a96d3358337919321f5d149fe3a8cc5f6f57b33923.exe 3676 e9e5459e32521a8ca1c075a96d3358337919321f5d149fe3a8cc5f6f57b33923.exe 3676 e9e5459e32521a8ca1c075a96d3358337919321f5d149fe3a8cc5f6f57b33923.exe 3676 e9e5459e32521a8ca1c075a96d3358337919321f5d149fe3a8cc5f6f57b33923.exe 3676 e9e5459e32521a8ca1c075a96d3358337919321f5d149fe3a8cc5f6f57b33923.exe 3676 e9e5459e32521a8ca1c075a96d3358337919321f5d149fe3a8cc5f6f57b33923.exe 3676 e9e5459e32521a8ca1c075a96d3358337919321f5d149fe3a8cc5f6f57b33923.exe 3676 e9e5459e32521a8ca1c075a96d3358337919321f5d149fe3a8cc5f6f57b33923.exe 3676 e9e5459e32521a8ca1c075a96d3358337919321f5d149fe3a8cc5f6f57b33923.exe 3676 e9e5459e32521a8ca1c075a96d3358337919321f5d149fe3a8cc5f6f57b33923.exe 3676 e9e5459e32521a8ca1c075a96d3358337919321f5d149fe3a8cc5f6f57b33923.exe 3676 e9e5459e32521a8ca1c075a96d3358337919321f5d149fe3a8cc5f6f57b33923.exe 3676 e9e5459e32521a8ca1c075a96d3358337919321f5d149fe3a8cc5f6f57b33923.exe 3676 e9e5459e32521a8ca1c075a96d3358337919321f5d149fe3a8cc5f6f57b33923.exe 3676 e9e5459e32521a8ca1c075a96d3358337919321f5d149fe3a8cc5f6f57b33923.exe 3676 e9e5459e32521a8ca1c075a96d3358337919321f5d149fe3a8cc5f6f57b33923.exe 3676 e9e5459e32521a8ca1c075a96d3358337919321f5d149fe3a8cc5f6f57b33923.exe 3676 e9e5459e32521a8ca1c075a96d3358337919321f5d149fe3a8cc5f6f57b33923.exe 3676 e9e5459e32521a8ca1c075a96d3358337919321f5d149fe3a8cc5f6f57b33923.exe 3676 e9e5459e32521a8ca1c075a96d3358337919321f5d149fe3a8cc5f6f57b33923.exe 3676 e9e5459e32521a8ca1c075a96d3358337919321f5d149fe3a8cc5f6f57b33923.exe 3676 e9e5459e32521a8ca1c075a96d3358337919321f5d149fe3a8cc5f6f57b33923.exe 3676 e9e5459e32521a8ca1c075a96d3358337919321f5d149fe3a8cc5f6f57b33923.exe 3676 e9e5459e32521a8ca1c075a96d3358337919321f5d149fe3a8cc5f6f57b33923.exe 3676 e9e5459e32521a8ca1c075a96d3358337919321f5d149fe3a8cc5f6f57b33923.exe 3676 e9e5459e32521a8ca1c075a96d3358337919321f5d149fe3a8cc5f6f57b33923.exe 3676 e9e5459e32521a8ca1c075a96d3358337919321f5d149fe3a8cc5f6f57b33923.exe 3676 e9e5459e32521a8ca1c075a96d3358337919321f5d149fe3a8cc5f6f57b33923.exe 3676 e9e5459e32521a8ca1c075a96d3358337919321f5d149fe3a8cc5f6f57b33923.exe 3676 e9e5459e32521a8ca1c075a96d3358337919321f5d149fe3a8cc5f6f57b33923.exe 3676 e9e5459e32521a8ca1c075a96d3358337919321f5d149fe3a8cc5f6f57b33923.exe 3676 e9e5459e32521a8ca1c075a96d3358337919321f5d149fe3a8cc5f6f57b33923.exe 3676 e9e5459e32521a8ca1c075a96d3358337919321f5d149fe3a8cc5f6f57b33923.exe 3676 e9e5459e32521a8ca1c075a96d3358337919321f5d149fe3a8cc5f6f57b33923.exe 3676 e9e5459e32521a8ca1c075a96d3358337919321f5d149fe3a8cc5f6f57b33923.exe 3676 e9e5459e32521a8ca1c075a96d3358337919321f5d149fe3a8cc5f6f57b33923.exe 3676 e9e5459e32521a8ca1c075a96d3358337919321f5d149fe3a8cc5f6f57b33923.exe 3676 e9e5459e32521a8ca1c075a96d3358337919321f5d149fe3a8cc5f6f57b33923.exe - Suspicious use of AdjustPrivilegeToken 6 IoCs
description pid Process Token: SeDebugPrivilege 3676 e9e5459e32521a8ca1c075a96d3358337919321f5d149fe3a8cc5f6f57b33923.exe Token: SeDebugPrivilege 1312 powershell.exe Token: SeBackupPrivilege 2680 vssvc.exe Token: SeRestorePrivilege 2680 vssvc.exe Token: SeAuditPrivilege 2680 vssvc.exe Token: SeTakeOwnershipPrivilege 3676 e9e5459e32521a8ca1c075a96d3358337919321f5d149fe3a8cc5f6f57b33923.exe - Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 3676 wrote to memory of 1312 3676 e9e5459e32521a8ca1c075a96d3358337919321f5d149fe3a8cc5f6f57b33923.exe 75 PID 3676 wrote to memory of 1312 3676 e9e5459e32521a8ca1c075a96d3358337919321f5d149fe3a8cc5f6f57b33923.exe 75
Processes
-
C:\Users\Admin\AppData\Local\Temp\e9e5459e32521a8ca1c075a96d3358337919321f5d149fe3a8cc5f6f57b33923.exe"C:\Users\Admin\AppData\Local\Temp\e9e5459e32521a8ca1c075a96d3358337919321f5d149fe3a8cc5f6f57b33923.exe"1⤵
- Modifies extensions of user files
- Adds Run key to start application
- Enumerates connected drives
- Sets desktop wallpaper using registry
- Drops file in Program Files directory
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3676 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -e RwBlAHQALQBXAG0AaQBPAGIAagBlAGMAdAAgAFcAaQBuADMAMgBfAFMAaABhAGQAbwB3AGMAbwBwAHkAIAB8ACAARgBvAHIARQBhAGMAaAAtAE8AYgBqAGUAYwB0ACAAewAkAF8ALgBEAGUAbABlAHQAZQAoACkAOwB9AA==2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1312
-
-
C:\Windows\system32\wbem\unsecapp.exeC:\Windows\system32\wbem\unsecapp.exe -Embedding1⤵PID:1488
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Modifies service
- Suspicious use of AdjustPrivilegeToken
PID:2680