Analysis
-
max time kernel
148s -
max time network
150s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
02-03-2021 15:27
Static task
static1
Behavioral task
behavioral1
Sample
0cf6b2529f92cb76be812caf661460e08bf65d9582ff5ea2d39206c8ead17b6a.exe
Resource
win7v20201028
Behavioral task
behavioral2
Sample
0cf6b2529f92cb76be812caf661460e08bf65d9582ff5ea2d39206c8ead17b6a.exe
Resource
win10v20201028
General
-
Target
0cf6b2529f92cb76be812caf661460e08bf65d9582ff5ea2d39206c8ead17b6a.exe
-
Size
116KB
-
MD5
157083d3340bd1ccb0ef3753f1491dad
-
SHA1
7f62112b7e3811b4c025f20f656e5930ad30125d
-
SHA256
0cf6b2529f92cb76be812caf661460e08bf65d9582ff5ea2d39206c8ead17b6a
-
SHA512
39ec844c2dcf33862571f8d267b1384dbe5fdb3b8d1de1b615ba85ecd8cf58433147c6c6892a4967a0f0eba045fb187ea0d08055585134d5c3abf5297507421b
Malware Config
Extracted
C:\22lirwk80-README.txt
sodinokibi
http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/D5F776ADDCECC7E7
http://decryptor.cc/D5F776ADDCECC7E7
Signatures
-
Sodin,Sodinokibi,REvil
Ransomware with advanced anti-analysis and privilege escalation functionality.
-
Modifies Installed Components in the registry 2 TTPs
-
Modifies extensions of user files 4 IoCs
Ransomware generally changes the extension on encrypted files.
Processes:
0cf6b2529f92cb76be812caf661460e08bf65d9582ff5ea2d39206c8ead17b6a.exedescription ioc process File opened for modification \??\c:\users\admin\pictures\DisableOut.tiff 0cf6b2529f92cb76be812caf661460e08bf65d9582ff5ea2d39206c8ead17b6a.exe File renamed C:\Users\Admin\Pictures\DisableOut.tiff => \??\c:\users\admin\pictures\DisableOut.tiff.22lirwk80 0cf6b2529f92cb76be812caf661460e08bf65d9582ff5ea2d39206c8ead17b6a.exe File renamed C:\Users\Admin\Pictures\ResolveClear.tif => \??\c:\users\admin\pictures\ResolveClear.tif.22lirwk80 0cf6b2529f92cb76be812caf661460e08bf65d9582ff5ea2d39206c8ead17b6a.exe File renamed C:\Users\Admin\Pictures\WaitCompare.raw => \??\c:\users\admin\pictures\WaitCompare.raw.22lirwk80 0cf6b2529f92cb76be812caf661460e08bf65d9582ff5ea2d39206c8ead17b6a.exe -
Drops startup file 3 IoCs
Processes:
0cf6b2529f92cb76be812caf661460e08bf65d9582ff5ea2d39206c8ead17b6a.exedescription ioc process File opened for modification \??\c:\users\admin\appdata\roaming\microsoft\windows\start menu\programs\startup\desktop.ini 0cf6b2529f92cb76be812caf661460e08bf65d9582ff5ea2d39206c8ead17b6a.exe File created \??\c:\users\admin\appdata\roaming\microsoft\word\startup\22lirwk80-README.txt 0cf6b2529f92cb76be812caf661460e08bf65d9582ff5ea2d39206c8ead17b6a.exe File created \??\c:\users\admin\appdata\roaming\microsoft\windows\start menu\programs\startup\22lirwk80-README.txt 0cf6b2529f92cb76be812caf661460e08bf65d9582ff5ea2d39206c8ead17b6a.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
0cf6b2529f92cb76be812caf661460e08bf65d9582ff5ea2d39206c8ead17b6a.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run 0cf6b2529f92cb76be812caf661460e08bf65d9582ff5ea2d39206c8ead17b6a.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\i1neMACrFU = "C:\\Users\\Admin\\AppData\\Local\\Temp\\0cf6b2529f92cb76be812caf661460e08bf65d9582ff5ea2d39206c8ead17b6a.exe" 0cf6b2529f92cb76be812caf661460e08bf65d9582ff5ea2d39206c8ead17b6a.exe -
Drops desktop.ini file(s) 64 IoCs
Processes:
0cf6b2529f92cb76be812caf661460e08bf65d9582ff5ea2d39206c8ead17b6a.exedescription ioc process File opened for modification \??\c:\users\admin\pictures\camera roll\desktop.ini 0cf6b2529f92cb76be812caf661460e08bf65d9582ff5ea2d39206c8ead17b6a.exe File opened for modification \??\c:\users\admin\appdata\roaming\microsoft\windows\start menu\desktop.ini 0cf6b2529f92cb76be812caf661460e08bf65d9582ff5ea2d39206c8ead17b6a.exe File opened for modification \??\c:\users\admin\appdata\local\microsoft\windows\burn\burn\desktop.ini 0cf6b2529f92cb76be812caf661460e08bf65d9582ff5ea2d39206c8ead17b6a.exe File opened for modification \??\c:\users\admin\appdata\roaming\microsoft\internet explorer\quick launch\user pinned\taskbar\desktop.ini 0cf6b2529f92cb76be812caf661460e08bf65d9582ff5ea2d39206c8ead17b6a.exe File opened for modification \??\c:\users\admin\pictures\desktop.ini 0cf6b2529f92cb76be812caf661460e08bf65d9582ff5ea2d39206c8ead17b6a.exe File opened for modification \??\c:\users\admin\videos\desktop.ini 0cf6b2529f92cb76be812caf661460e08bf65d9582ff5ea2d39206c8ead17b6a.exe File opened for modification \??\c:\users\admin\appdata\local\microsoft\windows\application shortcuts\desktop.ini 0cf6b2529f92cb76be812caf661460e08bf65d9582ff5ea2d39206c8ead17b6a.exe File opened for modification \??\c:\users\admin\appdata\roaming\microsoft\internet explorer\quick launch\desktop.ini 0cf6b2529f92cb76be812caf661460e08bf65d9582ff5ea2d39206c8ead17b6a.exe File opened for modification \??\c:\users\admin\appdata\roaming\microsoft\windows\recent\desktop.ini 0cf6b2529f92cb76be812caf661460e08bf65d9582ff5ea2d39206c8ead17b6a.exe File opened for modification \??\c:\users\admin\downloads\desktop.ini 0cf6b2529f92cb76be812caf661460e08bf65d9582ff5ea2d39206c8ead17b6a.exe File opened for modification \??\c:\users\admin\appdata\local\microsoft\windows\history\desktop.ini 0cf6b2529f92cb76be812caf661460e08bf65d9582ff5ea2d39206c8ead17b6a.exe File opened for modification \??\c:\users\default\appdata\roaming\microsoft\windows\sendto\Desktop.ini 0cf6b2529f92cb76be812caf661460e08bf65d9582ff5ea2d39206c8ead17b6a.exe File opened for modification \??\c:\users\admin\appdata\roaming\microsoft\windows\start menu\programs\accessibility\Desktop.ini 0cf6b2529f92cb76be812caf661460e08bf65d9582ff5ea2d39206c8ead17b6a.exe File opened for modification \??\c:\users\default\appdata\roaming\microsoft\windows\start menu\programs\windows powershell\desktop.ini 0cf6b2529f92cb76be812caf661460e08bf65d9582ff5ea2d39206c8ead17b6a.exe File opened for modification \??\c:\programdata\microsoft\windows\start menu\programs\system tools\Desktop.ini 0cf6b2529f92cb76be812caf661460e08bf65d9582ff5ea2d39206c8ead17b6a.exe File opened for modification \??\c:\users\admin\searches\desktop.ini 0cf6b2529f92cb76be812caf661460e08bf65d9582ff5ea2d39206c8ead17b6a.exe File opened for modification \??\c:\programdata\microsoft\windows\start menu\desktop.ini 0cf6b2529f92cb76be812caf661460e08bf65d9582ff5ea2d39206c8ead17b6a.exe File opened for modification \??\c:\users\admin\pictures\saved pictures\desktop.ini 0cf6b2529f92cb76be812caf661460e08bf65d9582ff5ea2d39206c8ead17b6a.exe File opened for modification \??\c:\programdata\microsoft\windows\start menu\programs\administrative tools\desktop.ini 0cf6b2529f92cb76be812caf661460e08bf65d9582ff5ea2d39206c8ead17b6a.exe File opened for modification \??\c:\programdata\microsoft\windows\start menu\programs\maintenance\Desktop.ini 0cf6b2529f92cb76be812caf661460e08bf65d9582ff5ea2d39206c8ead17b6a.exe File opened for modification \??\c:\programdata\microsoft\windows\start menu\programs\startup\desktop.ini 0cf6b2529f92cb76be812caf661460e08bf65d9582ff5ea2d39206c8ead17b6a.exe File opened for modification \??\c:\users\public\accountpictures\desktop.ini 0cf6b2529f92cb76be812caf661460e08bf65d9582ff5ea2d39206c8ead17b6a.exe File opened for modification \??\c:\users\default\appdata\local\microsoft\windows\winx\group1\desktop.ini 0cf6b2529f92cb76be812caf661460e08bf65d9582ff5ea2d39206c8ead17b6a.exe File opened for modification \??\c:\users\admin\documents\desktop.ini 0cf6b2529f92cb76be812caf661460e08bf65d9582ff5ea2d39206c8ead17b6a.exe File opened for modification \??\c:\users\public\desktop\desktop.ini 0cf6b2529f92cb76be812caf661460e08bf65d9582ff5ea2d39206c8ead17b6a.exe File opened for modification \??\c:\users\public\documents\desktop.ini 0cf6b2529f92cb76be812caf661460e08bf65d9582ff5ea2d39206c8ead17b6a.exe File opened for modification \??\c:\users\public\libraries\desktop.ini 0cf6b2529f92cb76be812caf661460e08bf65d9582ff5ea2d39206c8ead17b6a.exe File opened for modification \??\c:\programdata\microsoft\windows\start menu\programs\accessories\system tools\desktop.ini 0cf6b2529f92cb76be812caf661460e08bf65d9582ff5ea2d39206c8ead17b6a.exe File opened for modification \??\c:\users\default\appdata\roaming\microsoft\internet explorer\quick launch\desktop.ini 0cf6b2529f92cb76be812caf661460e08bf65d9582ff5ea2d39206c8ead17b6a.exe File opened for modification \??\c:\users\public\desktop.ini 0cf6b2529f92cb76be812caf661460e08bf65d9582ff5ea2d39206c8ead17b6a.exe File opened for modification \??\c:\users\admin\appdata\roaming\microsoft\windows\start menu\programs\accessories\Desktop.ini 0cf6b2529f92cb76be812caf661460e08bf65d9582ff5ea2d39206c8ead17b6a.exe File opened for modification \??\c:\users\admin\appdata\roaming\microsoft\windows\start menu\programs\administrative tools\desktop.ini 0cf6b2529f92cb76be812caf661460e08bf65d9582ff5ea2d39206c8ead17b6a.exe File opened for modification \??\c:\users\admin\appdata\roaming\microsoft\windows\start menu\programs\maintenance\Desktop.ini 0cf6b2529f92cb76be812caf661460e08bf65d9582ff5ea2d39206c8ead17b6a.exe File opened for modification \??\c:\users\default\appdata\roaming\microsoft\windows\start menu\programs\accessibility\Desktop.ini 0cf6b2529f92cb76be812caf661460e08bf65d9582ff5ea2d39206c8ead17b6a.exe File opened for modification \??\c:\users\admin\appdata\local\microsoft\windows\winx\group2\desktop.ini 0cf6b2529f92cb76be812caf661460e08bf65d9582ff5ea2d39206c8ead17b6a.exe File opened for modification \??\c:\users\admin\links\desktop.ini 0cf6b2529f92cb76be812caf661460e08bf65d9582ff5ea2d39206c8ead17b6a.exe File opened for modification \??\c:\programdata\microsoft\windows\start menu\programs\accessibility\Desktop.ini 0cf6b2529f92cb76be812caf661460e08bf65d9582ff5ea2d39206c8ead17b6a.exe File opened for modification \??\c:\users\default\appdata\local\microsoft\windows\winx\group2\desktop.ini 0cf6b2529f92cb76be812caf661460e08bf65d9582ff5ea2d39206c8ead17b6a.exe File opened for modification \??\c:\users\admin\appdata\roaming\microsoft\windows\start menu\programs\system tools\Desktop.ini 0cf6b2529f92cb76be812caf661460e08bf65d9582ff5ea2d39206c8ead17b6a.exe File opened for modification \??\c:\users\admin\contacts\desktop.ini 0cf6b2529f92cb76be812caf661460e08bf65d9582ff5ea2d39206c8ead17b6a.exe File opened for modification \??\c:\users\admin\appdata\roaming\microsoft\windows\libraries\desktop.ini 0cf6b2529f92cb76be812caf661460e08bf65d9582ff5ea2d39206c8ead17b6a.exe File opened for modification \??\c:\users\admin\appdata\roaming\microsoft\windows\start menu\programs\desktop.ini 0cf6b2529f92cb76be812caf661460e08bf65d9582ff5ea2d39206c8ead17b6a.exe File opened for modification \??\c:\program files\desktop.ini 0cf6b2529f92cb76be812caf661460e08bf65d9582ff5ea2d39206c8ead17b6a.exe File opened for modification \??\c:\users\public\videos\desktop.ini 0cf6b2529f92cb76be812caf661460e08bf65d9582ff5ea2d39206c8ead17b6a.exe File opened for modification \??\c:\users\default\appdata\roaming\microsoft\windows\start menu\programs\accessories\Desktop.ini 0cf6b2529f92cb76be812caf661460e08bf65d9582ff5ea2d39206c8ead17b6a.exe File opened for modification \??\c:\users\admin\saved games\desktop.ini 0cf6b2529f92cb76be812caf661460e08bf65d9582ff5ea2d39206c8ead17b6a.exe File opened for modification \??\c:\programdata\microsoft\windows\start menu\programs\desktop.ini 0cf6b2529f92cb76be812caf661460e08bf65d9582ff5ea2d39206c8ead17b6a.exe File opened for modification \??\c:\users\admin\appdata\roaming\microsoft\windows\sendto\Desktop.ini 0cf6b2529f92cb76be812caf661460e08bf65d9582ff5ea2d39206c8ead17b6a.exe File opened for modification \??\c:\users\admin\desktop\desktop.ini 0cf6b2529f92cb76be812caf661460e08bf65d9582ff5ea2d39206c8ead17b6a.exe File opened for modification \??\c:\users\admin\appdata\local\microsoft\windows\winx\group1\desktop.ini 0cf6b2529f92cb76be812caf661460e08bf65d9582ff5ea2d39206c8ead17b6a.exe File opened for modification \??\c:\users\public\downloads\desktop.ini 0cf6b2529f92cb76be812caf661460e08bf65d9582ff5ea2d39206c8ead17b6a.exe File opened for modification \??\c:\users\admin\appdata\local\microsoft\windows\winx\group3\desktop.ini 0cf6b2529f92cb76be812caf661460e08bf65d9582ff5ea2d39206c8ead17b6a.exe File opened for modification \??\c:\program files (x86)\desktop.ini 0cf6b2529f92cb76be812caf661460e08bf65d9582ff5ea2d39206c8ead17b6a.exe File opened for modification \??\c:\users\admin\favorites\links\desktop.ini 0cf6b2529f92cb76be812caf661460e08bf65d9582ff5ea2d39206c8ead17b6a.exe File opened for modification \??\c:\programdata\microsoft\windows\start menu\programs\accessories\desktop.ini 0cf6b2529f92cb76be812caf661460e08bf65d9582ff5ea2d39206c8ead17b6a.exe File opened for modification \??\c:\users\admin\appdata\roaming\microsoft\windows\accountpictures\desktop.ini 0cf6b2529f92cb76be812caf661460e08bf65d9582ff5ea2d39206c8ead17b6a.exe File opened for modification \??\c:\users\default\appdata\local\microsoft\windows\winx\group3\desktop.ini 0cf6b2529f92cb76be812caf661460e08bf65d9582ff5ea2d39206c8ead17b6a.exe File opened for modification \??\c:\users\admin\onedrive\desktop.ini 0cf6b2529f92cb76be812caf661460e08bf65d9582ff5ea2d39206c8ead17b6a.exe File opened for modification \??\c:\users\admin\favorites\desktop.ini 0cf6b2529f92cb76be812caf661460e08bf65d9582ff5ea2d39206c8ead17b6a.exe File opened for modification \??\c:\users\admin\music\desktop.ini 0cf6b2529f92cb76be812caf661460e08bf65d9582ff5ea2d39206c8ead17b6a.exe File opened for modification \??\c:\users\public\music\desktop.ini 0cf6b2529f92cb76be812caf661460e08bf65d9582ff5ea2d39206c8ead17b6a.exe File opened for modification \??\c:\users\public\pictures\desktop.ini 0cf6b2529f92cb76be812caf661460e08bf65d9582ff5ea2d39206c8ead17b6a.exe File opened for modification \??\c:\programdata\microsoft\windows\start menu places\desktop.ini 0cf6b2529f92cb76be812caf661460e08bf65d9582ff5ea2d39206c8ead17b6a.exe File opened for modification \??\c:\users\admin\appdata\roaming\microsoft\windows\start menu\programs\windows powershell\desktop.ini 0cf6b2529f92cb76be812caf661460e08bf65d9582ff5ea2d39206c8ead17b6a.exe -
Enumerates connected drives 3 TTPs 25 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
0cf6b2529f92cb76be812caf661460e08bf65d9582ff5ea2d39206c8ead17b6a.exedescription ioc process File opened (read-only) \??\L: 0cf6b2529f92cb76be812caf661460e08bf65d9582ff5ea2d39206c8ead17b6a.exe File opened (read-only) \??\N: 0cf6b2529f92cb76be812caf661460e08bf65d9582ff5ea2d39206c8ead17b6a.exe File opened (read-only) \??\X: 0cf6b2529f92cb76be812caf661460e08bf65d9582ff5ea2d39206c8ead17b6a.exe File opened (read-only) \??\D: 0cf6b2529f92cb76be812caf661460e08bf65d9582ff5ea2d39206c8ead17b6a.exe File opened (read-only) \??\E: 0cf6b2529f92cb76be812caf661460e08bf65d9582ff5ea2d39206c8ead17b6a.exe File opened (read-only) \??\J: 0cf6b2529f92cb76be812caf661460e08bf65d9582ff5ea2d39206c8ead17b6a.exe File opened (read-only) \??\M: 0cf6b2529f92cb76be812caf661460e08bf65d9582ff5ea2d39206c8ead17b6a.exe File opened (read-only) \??\Q: 0cf6b2529f92cb76be812caf661460e08bf65d9582ff5ea2d39206c8ead17b6a.exe File opened (read-only) \??\R: 0cf6b2529f92cb76be812caf661460e08bf65d9582ff5ea2d39206c8ead17b6a.exe File opened (read-only) \??\V: 0cf6b2529f92cb76be812caf661460e08bf65d9582ff5ea2d39206c8ead17b6a.exe File opened (read-only) \??\P: 0cf6b2529f92cb76be812caf661460e08bf65d9582ff5ea2d39206c8ead17b6a.exe File opened (read-only) \??\W: 0cf6b2529f92cb76be812caf661460e08bf65d9582ff5ea2d39206c8ead17b6a.exe File opened (read-only) \??\A: 0cf6b2529f92cb76be812caf661460e08bf65d9582ff5ea2d39206c8ead17b6a.exe File opened (read-only) \??\B: 0cf6b2529f92cb76be812caf661460e08bf65d9582ff5ea2d39206c8ead17b6a.exe File opened (read-only) \??\F: 0cf6b2529f92cb76be812caf661460e08bf65d9582ff5ea2d39206c8ead17b6a.exe File opened (read-only) \??\I: 0cf6b2529f92cb76be812caf661460e08bf65d9582ff5ea2d39206c8ead17b6a.exe File opened (read-only) \??\K: 0cf6b2529f92cb76be812caf661460e08bf65d9582ff5ea2d39206c8ead17b6a.exe File opened (read-only) \??\O: 0cf6b2529f92cb76be812caf661460e08bf65d9582ff5ea2d39206c8ead17b6a.exe File opened (read-only) \??\Y: 0cf6b2529f92cb76be812caf661460e08bf65d9582ff5ea2d39206c8ead17b6a.exe File opened (read-only) \??\G: 0cf6b2529f92cb76be812caf661460e08bf65d9582ff5ea2d39206c8ead17b6a.exe File opened (read-only) \??\H: 0cf6b2529f92cb76be812caf661460e08bf65d9582ff5ea2d39206c8ead17b6a.exe File opened (read-only) \??\S: 0cf6b2529f92cb76be812caf661460e08bf65d9582ff5ea2d39206c8ead17b6a.exe File opened (read-only) \??\T: 0cf6b2529f92cb76be812caf661460e08bf65d9582ff5ea2d39206c8ead17b6a.exe File opened (read-only) \??\U: 0cf6b2529f92cb76be812caf661460e08bf65d9582ff5ea2d39206c8ead17b6a.exe File opened (read-only) \??\Z: 0cf6b2529f92cb76be812caf661460e08bf65d9582ff5ea2d39206c8ead17b6a.exe -
Sets desktop wallpaper using registry 2 TTPs 1 IoCs
Processes:
0cf6b2529f92cb76be812caf661460e08bf65d9582ff5ea2d39206c8ead17b6a.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\8or.bmp" 0cf6b2529f92cb76be812caf661460e08bf65d9582ff5ea2d39206c8ead17b6a.exe -
Drops file in Program Files directory 33 IoCs
Processes:
0cf6b2529f92cb76be812caf661460e08bf65d9582ff5ea2d39206c8ead17b6a.exedescription ioc process File opened for modification \??\c:\program files\UnregisterCopy.3gpp 0cf6b2529f92cb76be812caf661460e08bf65d9582ff5ea2d39206c8ead17b6a.exe File created \??\c:\program files (x86)\22lirwk80-README.txt 0cf6b2529f92cb76be812caf661460e08bf65d9582ff5ea2d39206c8ead17b6a.exe File opened for modification \??\c:\program files\ConvertToTrace.7z 0cf6b2529f92cb76be812caf661460e08bf65d9582ff5ea2d39206c8ead17b6a.exe File opened for modification \??\c:\program files\EnablePop.MTS 0cf6b2529f92cb76be812caf661460e08bf65d9582ff5ea2d39206c8ead17b6a.exe File opened for modification \??\c:\program files\JoinPing.wpl 0cf6b2529f92cb76be812caf661460e08bf65d9582ff5ea2d39206c8ead17b6a.exe File opened for modification \??\c:\program files\RedoUninstall.i64 0cf6b2529f92cb76be812caf661460e08bf65d9582ff5ea2d39206c8ead17b6a.exe File opened for modification \??\c:\program files\RestartWatch.wmv 0cf6b2529f92cb76be812caf661460e08bf65d9582ff5ea2d39206c8ead17b6a.exe File opened for modification \??\c:\program files\desktop.ini 0cf6b2529f92cb76be812caf661460e08bf65d9582ff5ea2d39206c8ead17b6a.exe File opened for modification \??\c:\program files\GetShow.mhtml 0cf6b2529f92cb76be812caf661460e08bf65d9582ff5ea2d39206c8ead17b6a.exe File opened for modification \??\c:\program files\ResetSend.docm 0cf6b2529f92cb76be812caf661460e08bf65d9582ff5ea2d39206c8ead17b6a.exe File opened for modification \??\c:\program files\LimitInstall.shtml 0cf6b2529f92cb76be812caf661460e08bf65d9582ff5ea2d39206c8ead17b6a.exe File opened for modification \??\c:\program files\RemoveRestart.au3 0cf6b2529f92cb76be812caf661460e08bf65d9582ff5ea2d39206c8ead17b6a.exe File opened for modification \??\c:\program files\UndoUnpublish.eps 0cf6b2529f92cb76be812caf661460e08bf65d9582ff5ea2d39206c8ead17b6a.exe File opened for modification \??\c:\program files\UnpublishRegister.wpl 0cf6b2529f92cb76be812caf661460e08bf65d9582ff5ea2d39206c8ead17b6a.exe File opened for modification \??\c:\program files\DismountExit.ttf 0cf6b2529f92cb76be812caf661460e08bf65d9582ff5ea2d39206c8ead17b6a.exe File opened for modification \??\c:\program files\ImportCopy.sql 0cf6b2529f92cb76be812caf661460e08bf65d9582ff5ea2d39206c8ead17b6a.exe File opened for modification \??\c:\program files\OutRedo.TTS 0cf6b2529f92cb76be812caf661460e08bf65d9582ff5ea2d39206c8ead17b6a.exe File opened for modification \??\c:\program files\WaitCompress.rm 0cf6b2529f92cb76be812caf661460e08bf65d9582ff5ea2d39206c8ead17b6a.exe File opened for modification \??\c:\program files\ApproveOut.pot 0cf6b2529f92cb76be812caf661460e08bf65d9582ff5ea2d39206c8ead17b6a.exe File opened for modification \??\c:\program files\ClearRestart.docx 0cf6b2529f92cb76be812caf661460e08bf65d9582ff5ea2d39206c8ead17b6a.exe File opened for modification \??\c:\program files\UnregisterClose.DVR-MS 0cf6b2529f92cb76be812caf661460e08bf65d9582ff5ea2d39206c8ead17b6a.exe File opened for modification \??\c:\program files\DebugRename.aif 0cf6b2529f92cb76be812caf661460e08bf65d9582ff5ea2d39206c8ead17b6a.exe File opened for modification \??\c:\program files\PublishRegister.wav 0cf6b2529f92cb76be812caf661460e08bf65d9582ff5ea2d39206c8ead17b6a.exe File opened for modification \??\c:\program files\WaitTest.ppsm 0cf6b2529f92cb76be812caf661460e08bf65d9582ff5ea2d39206c8ead17b6a.exe File opened for modification \??\c:\program files\ImportLimit.nfo 0cf6b2529f92cb76be812caf661460e08bf65d9582ff5ea2d39206c8ead17b6a.exe File opened for modification \??\c:\program files\OutExit.potm 0cf6b2529f92cb76be812caf661460e08bf65d9582ff5ea2d39206c8ead17b6a.exe File opened for modification \??\c:\program files\PopEnter.jfif 0cf6b2529f92cb76be812caf661460e08bf65d9582ff5ea2d39206c8ead17b6a.exe File opened for modification \??\c:\program files\RequestPush.shtml 0cf6b2529f92cb76be812caf661460e08bf65d9582ff5ea2d39206c8ead17b6a.exe File opened for modification \??\c:\program files\TraceGroup.wm 0cf6b2529f92cb76be812caf661460e08bf65d9582ff5ea2d39206c8ead17b6a.exe File created \??\c:\program files\22lirwk80-README.txt 0cf6b2529f92cb76be812caf661460e08bf65d9582ff5ea2d39206c8ead17b6a.exe File opened for modification \??\c:\program files\ClearExpand.ttc 0cf6b2529f92cb76be812caf661460e08bf65d9582ff5ea2d39206c8ead17b6a.exe File opened for modification \??\c:\program files\DebugEnable.js 0cf6b2529f92cb76be812caf661460e08bf65d9582ff5ea2d39206c8ead17b6a.exe File opened for modification \??\c:\program files (x86)\desktop.ini 0cf6b2529f92cb76be812caf661460e08bf65d9582ff5ea2d39206c8ead17b6a.exe -
Program crash 2 IoCs
Processes:
WerFault.exeWerFault.exepid pid_target process target process 2400 3028 WerFault.exe 4308 2768 WerFault.exe explorer.exe -
Suspicious behavior: EnumeratesProcesses 34 IoCs
Processes:
0cf6b2529f92cb76be812caf661460e08bf65d9582ff5ea2d39206c8ead17b6a.exeWerFault.exeWerFault.exepid process 4692 0cf6b2529f92cb76be812caf661460e08bf65d9582ff5ea2d39206c8ead17b6a.exe 4692 0cf6b2529f92cb76be812caf661460e08bf65d9582ff5ea2d39206c8ead17b6a.exe 4692 0cf6b2529f92cb76be812caf661460e08bf65d9582ff5ea2d39206c8ead17b6a.exe 4692 0cf6b2529f92cb76be812caf661460e08bf65d9582ff5ea2d39206c8ead17b6a.exe 2400 WerFault.exe 2400 WerFault.exe 2400 WerFault.exe 2400 WerFault.exe 2400 WerFault.exe 2400 WerFault.exe 2400 WerFault.exe 2400 WerFault.exe 2400 WerFault.exe 2400 WerFault.exe 2400 WerFault.exe 2400 WerFault.exe 2400 WerFault.exe 2400 WerFault.exe 2400 WerFault.exe 4308 WerFault.exe 4308 WerFault.exe 4308 WerFault.exe 4308 WerFault.exe 4308 WerFault.exe 4308 WerFault.exe 4308 WerFault.exe 4308 WerFault.exe 4308 WerFault.exe 4308 WerFault.exe 4308 WerFault.exe 4308 WerFault.exe 4308 WerFault.exe 4308 WerFault.exe 4308 WerFault.exe -
Suspicious use of AdjustPrivilegeToken 19 IoCs
Processes:
0cf6b2529f92cb76be812caf661460e08bf65d9582ff5ea2d39206c8ead17b6a.exevssvc.exeWerFault.exeexplorer.exeWerFault.exedescription pid process Token: SeDebugPrivilege 4692 0cf6b2529f92cb76be812caf661460e08bf65d9582ff5ea2d39206c8ead17b6a.exe Token: SeTakeOwnershipPrivilege 4692 0cf6b2529f92cb76be812caf661460e08bf65d9582ff5ea2d39206c8ead17b6a.exe Token: SeBackupPrivilege 4024 vssvc.exe Token: SeRestorePrivilege 4024 vssvc.exe Token: SeAuditPrivilege 4024 vssvc.exe Token: SeDebugPrivilege 2400 WerFault.exe Token: SeShutdownPrivilege 2768 explorer.exe Token: SeCreatePagefilePrivilege 2768 explorer.exe Token: SeShutdownPrivilege 2768 explorer.exe Token: SeCreatePagefilePrivilege 2768 explorer.exe Token: SeShutdownPrivilege 2768 explorer.exe Token: SeCreatePagefilePrivilege 2768 explorer.exe Token: SeShutdownPrivilege 2768 explorer.exe Token: SeCreatePagefilePrivilege 2768 explorer.exe Token: SeShutdownPrivilege 2768 explorer.exe Token: SeCreatePagefilePrivilege 2768 explorer.exe Token: SeShutdownPrivilege 2768 explorer.exe Token: SeCreatePagefilePrivilege 2768 explorer.exe Token: SeDebugPrivilege 4308 WerFault.exe -
Suspicious use of FindShellTrayWindow 4 IoCs
Processes:
explorer.exepid process 2768 explorer.exe 2768 explorer.exe 2768 explorer.exe 2768 explorer.exe -
Suspicious use of SendNotifyMessage 8 IoCs
Processes:
explorer.exepid process 2768 explorer.exe 2768 explorer.exe 2768 explorer.exe 2768 explorer.exe 2768 explorer.exe 2768 explorer.exe 2768 explorer.exe 2768 explorer.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\0cf6b2529f92cb76be812caf661460e08bf65d9582ff5ea2d39206c8ead17b6a.exe"C:\Users\Admin\AppData\Local\Temp\0cf6b2529f92cb76be812caf661460e08bf65d9582ff5ea2d39206c8ead17b6a.exe"1⤵
- Modifies extensions of user files
- Drops startup file
- Adds Run key to start application
- Drops desktop.ini file(s)
- Enumerates connected drives
- Sets desktop wallpaper using registry
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4692
-
C:\Windows\system32\wbem\unsecapp.exeC:\Windows\system32\wbem\unsecapp.exe -Embedding1⤵PID:3004
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4024
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 3028 -s 72441⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2400
-
C:\Windows\explorer.exeexplorer.exe1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2768 -
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 2768 -s 20602⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4308
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\$Recycle.Bin\S-1-5-21-1985363256-3005190890-1182679451-1000\desktop.iniMD5
102794107ac08a5075e6b3a479afc40d
SHA184290f75232fc201dc54560eaad4c0877d5d968f
SHA256efec0f4e4f7c9b13c367dec992f0aaf4a1fcf6b8dde90e1b02d86811ed461c1b
SHA5126e385261a3ac26a809be13788d576868509cbe5b303dbbb872875bbe254f170eed99f80b27bc4a4d31913e9ca5e854a5fabcb5ffd3e4a860748cc7b41fd484d1
-
C:\ProgramData\Microsoft\Windows\Caches\{DDF571F2-BE98-426D-8288-1A9A39C3FDA2}.2.ver0x0000000000000001.db.22lirwk80MD5
774674b5ebbaf41445b0918841704e51
SHA194275f5089042673d4dd2883dd37a46d573a9b7f
SHA256cf6e6f84feff750707ece4a40dd07df9b9a0df759170fa4e0b065f7e1d1113bf
SHA512e2f8607bf3eafd3dc835a39682094a41125bfb7e7dcff384b2040a369bb791d3aafac77f8e09184f865e0d8cec40deb0606af420b8c3c369d0c4e4bc357feeca
-
memory/2400-3-0x000001DD66390000-0x000001DD66391000-memory.dmpFilesize
4KB
-
memory/2400-4-0x000001DD66390000-0x000001DD66391000-memory.dmpFilesize
4KB
-
memory/4308-7-0x0000022677380000-0x0000022677381000-memory.dmpFilesize
4KB