sodinokibi | 2df2fab33c1db5b049284a6bd5aa1f58bec4cb370b0663870b6a57ef33b5028c

General

Target

2df2fab33c1db5b049284a6bd5aa1f58bec4cb370b0663870b6a57ef33b5028c.exe
Size

120KB
MD5

56b9c44b62a03b837df7ad35e8ef3dd4
SHA1

75a8ee1cba41ff1e0bc042d54657b3b76b7275ea
SHA256

2df2fab33c1db5b049284a6bd5aa1f58bec4cb370b0663870b6a57ef33b5028c
SHA512

5f34d8615ba06c704ea83ab201b6b3f7a7fc42b20caec40426918ed987507a53be0656447b34ed2fa33bb607ddfa74f533c4d8d6f5c844812c741d63ab7202a6

Score

10^/10

sodinokibi ransomware spyware stealer

Malware Config

Extracted

Path

C:\1jqtbn-readme.txt

Family

sodinokibi

Ransom Note

---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension 1jqtbn. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] Attention!!! [+] Also your private data was downloaded. We will publish it in case you will not get in touch with us asap. [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/A32338138D511302 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decoder.re/A32338138D511302 Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: SivsENOIliB5n6Egzy+ulxt3TZRBIYv8MBu+p+jafZ/3ONuPRz7lWeTE11TEXGGy Riad/cKgYXBBhwGBGoTBccdpEUZhNlSStdSIDSvAb6Ma/Z8Svvi3ZINl/bNodZsQ pkPtoOMBzwEtl6bHTbqlR97Te4CiEj1Ql52RXf6dbwBZV90M0bzsZ/sEopq/c1Ac qe6VEDYNpvDAnf+JUQgIRJjX/hOY/xeuMTyvWW2tTTKxbC5egoXMUb64tQvIeGIg 4gPFVHye6h+KicfDDVRzOa4No/CJth26qoj8va3VQ8A+M6+il1PVx4phVP4Jl+NW b4Fk9iFpMyEg1LvlTHokv3+iF2xBuoVLA0vVdp/vK7OwycvexKHwo33WQLjX90D3 eDVOsiFTjrG4y1DB+WJMnH5VAHUSDa4uHaWpe93GHYAYvYjmJuiM3qzqf72rnp8U naZ9O7QysQlfJArPkv6lGdIQ7oYvSL/3Nmo9ZjeVjNBWbbAbD4Piw9lTh1y1oHaC t2th/VtZ5lfhn8IrfdycTYyDg2UIJJFKvyP/1rIjecbtfvugvQQJrTerYJn8mDaF 07LLyGV3xEZ4FLN/nDLjPHqDzG+acNMYX36v/yYCEAIPPbxjiI3Ax0fzQvxAQ5Dw 5quQx8W/IUu4duD0EWaGRyBGB/wT3qOmO5EM7nBKNSlGtOVKhySatgH9nEzebtxu noPqf23s2HEwRBlTtksNOqq0U/YjLrTbuhvdsxfNnNeHKpfOICNW66YzwL6dqSTI G9xnhDhtgZ/G7scSLPqz0BKhddF4/vFSfjwuFWbvreLkp1+nwX4xM4ceXX9cKb0u 8BX64JeqhCVV5FkgVagKUAzr3YdZbG72ktoHvpYOm62PMIvglknb3L0HuEkoFt6I SOSjrDATn0GLKnUKF6mNnJ71UEOZKdaLYZXfWGdfy7epx7uxl2XOXMUPVgu/78x+ ffwTpQAMZOXstQgWTQveL2ImZfSqp+gui0JR2+Ph0qZpzi2k4iV/RfVLCBfUDdJg uw5VnmWX9TVKeynW5j7DbqKtSwWPwbAyh/8EMX0h2jzqJ1yCl1GY5lnSZ2l21N9v Y0YwPXYtj2SN9a6MopB/sju5Qro2jcBv7ASR8/uZlDkrq5ozv5zxXZbDZc+EOhj3 OUEWlxCK0pZqFCLl1vQakzkd2ZbundTxxV/UUM6bjR+MTQ0ADp+LdjNiQyuQEfUI 5LlXFyLt9wZFTVgKhk9O9ZhNzIp5AMbknZ/LrQ3gqqDVZ4l9MFk5bV8liua+a+q7 +tT+AQe3 ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!

URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/A32338138D511302

http://decoder.re/A32338138D511302

Signatures

Sodin,Sodinokibi,REvil
Ransomware with advanced anti-analysis and privilege escalation functionality.
ransomware sodinokibi

Modifies extensions of user files 3 IoCs

Ransomware generally changes the extension on encrypted files.

ransomware

Processes:

2df2fab33c1db5b049284a6bd5aa1f58bec4cb370b0663870b6a57ef33b5028c.exe

description	ioc	process
File renamed	C:\Users\Admin\Pictures\UnblockEdit.tif => \??\c:\users\admin\pictures\UnblockEdit.tif.1jqtbn	2df2fab33c1db5b049284a6bd5aa1f58bec4cb370b0663870b6a57ef33b5028c.exe
File renamed	C:\Users\Admin\Pictures\NewInstall.tif => \??\c:\users\admin\pictures\NewInstall.tif.1jqtbn	2df2fab33c1db5b049284a6bd5aa1f58bec4cb370b0663870b6a57ef33b5028c.exe
File renamed	C:\Users\Admin\Pictures\SyncComplete.crw => \??\c:\users\admin\pictures\SyncComplete.crw.1jqtbn	2df2fab33c1db5b049284a6bd5aa1f58bec4cb370b0663870b6a57ef33b5028c.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Enumerates connected drives 3 TTPs 25 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

2df2fab33c1db5b049284a6bd5aa1f58bec4cb370b0663870b6a57ef33b5028c.exe

description	ioc	process
File opened (read-only)	\??\A:	2df2fab33c1db5b049284a6bd5aa1f58bec4cb370b0663870b6a57ef33b5028c.exe
File opened (read-only)	\??\G:	2df2fab33c1db5b049284a6bd5aa1f58bec4cb370b0663870b6a57ef33b5028c.exe
File opened (read-only)	\??\I:	2df2fab33c1db5b049284a6bd5aa1f58bec4cb370b0663870b6a57ef33b5028c.exe
File opened (read-only)	\??\K:	2df2fab33c1db5b049284a6bd5aa1f58bec4cb370b0663870b6a57ef33b5028c.exe
File opened (read-only)	\??\N:	2df2fab33c1db5b049284a6bd5aa1f58bec4cb370b0663870b6a57ef33b5028c.exe
File opened (read-only)	\??\P:	2df2fab33c1db5b049284a6bd5aa1f58bec4cb370b0663870b6a57ef33b5028c.exe
File opened (read-only)	\??\U:	2df2fab33c1db5b049284a6bd5aa1f58bec4cb370b0663870b6a57ef33b5028c.exe
File opened (read-only)	\??\V:	2df2fab33c1db5b049284a6bd5aa1f58bec4cb370b0663870b6a57ef33b5028c.exe
File opened (read-only)	\??\W:	2df2fab33c1db5b049284a6bd5aa1f58bec4cb370b0663870b6a57ef33b5028c.exe
File opened (read-only)	\??\Z:	2df2fab33c1db5b049284a6bd5aa1f58bec4cb370b0663870b6a57ef33b5028c.exe
File opened (read-only)	\??\J:	2df2fab33c1db5b049284a6bd5aa1f58bec4cb370b0663870b6a57ef33b5028c.exe
File opened (read-only)	\??\O:	2df2fab33c1db5b049284a6bd5aa1f58bec4cb370b0663870b6a57ef33b5028c.exe
File opened (read-only)	\??\Q:	2df2fab33c1db5b049284a6bd5aa1f58bec4cb370b0663870b6a57ef33b5028c.exe
File opened (read-only)	\??\Y:	2df2fab33c1db5b049284a6bd5aa1f58bec4cb370b0663870b6a57ef33b5028c.exe
File opened (read-only)	\??\D:	2df2fab33c1db5b049284a6bd5aa1f58bec4cb370b0663870b6a57ef33b5028c.exe
File opened (read-only)	\??\B:	2df2fab33c1db5b049284a6bd5aa1f58bec4cb370b0663870b6a57ef33b5028c.exe
File opened (read-only)	\??\F:	2df2fab33c1db5b049284a6bd5aa1f58bec4cb370b0663870b6a57ef33b5028c.exe
File opened (read-only)	\??\H:	2df2fab33c1db5b049284a6bd5aa1f58bec4cb370b0663870b6a57ef33b5028c.exe
File opened (read-only)	\??\L:	2df2fab33c1db5b049284a6bd5aa1f58bec4cb370b0663870b6a57ef33b5028c.exe
File opened (read-only)	\??\T:	2df2fab33c1db5b049284a6bd5aa1f58bec4cb370b0663870b6a57ef33b5028c.exe
File opened (read-only)	\??\X:	2df2fab33c1db5b049284a6bd5aa1f58bec4cb370b0663870b6a57ef33b5028c.exe
File opened (read-only)	\??\E:	2df2fab33c1db5b049284a6bd5aa1f58bec4cb370b0663870b6a57ef33b5028c.exe
File opened (read-only)	\??\M:	2df2fab33c1db5b049284a6bd5aa1f58bec4cb370b0663870b6a57ef33b5028c.exe
File opened (read-only)	\??\R:	2df2fab33c1db5b049284a6bd5aa1f58bec4cb370b0663870b6a57ef33b5028c.exe
File opened (read-only)	\??\S:	2df2fab33c1db5b049284a6bd5aa1f58bec4cb370b0663870b6a57ef33b5028c.exe

Sets desktop wallpaper using registry 2 TTPs 1 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

Processes:

2df2fab33c1db5b049284a6bd5aa1f58bec4cb370b0663870b6a57ef33b5028c.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\c7n5503.bmp"	2df2fab33c1db5b049284a6bd5aa1f58bec4cb370b0663870b6a57ef33b5028c.exe

Drops file in Program Files directory 17 IoCs

Processes:

2df2fab33c1db5b049284a6bd5aa1f58bec4cb370b0663870b6a57ef33b5028c.exe

description	ioc	process
File opened for modification	\??\c:\program files\ResetInstall.emf	2df2fab33c1db5b049284a6bd5aa1f58bec4cb370b0663870b6a57ef33b5028c.exe
File opened for modification	\??\c:\program files\ResolveTest.php	2df2fab33c1db5b049284a6bd5aa1f58bec4cb370b0663870b6a57ef33b5028c.exe
File opened for modification	\??\c:\program files\DebugUnpublish.vbe	2df2fab33c1db5b049284a6bd5aa1f58bec4cb370b0663870b6a57ef33b5028c.exe
File opened for modification	\??\c:\program files\ExportLimit.odt	2df2fab33c1db5b049284a6bd5aa1f58bec4cb370b0663870b6a57ef33b5028c.exe
File opened for modification	\??\c:\program files\RedoPublish.zip	2df2fab33c1db5b049284a6bd5aa1f58bec4cb370b0663870b6a57ef33b5028c.exe
File created	\??\c:\program files (x86)\1jqtbn-readme.txt	2df2fab33c1db5b049284a6bd5aa1f58bec4cb370b0663870b6a57ef33b5028c.exe
File opened for modification	\??\c:\program files\DebugUndo.pptm	2df2fab33c1db5b049284a6bd5aa1f58bec4cb370b0663870b6a57ef33b5028c.exe
File opened for modification	\??\c:\program files\SendConvert.sql	2df2fab33c1db5b049284a6bd5aa1f58bec4cb370b0663870b6a57ef33b5028c.exe
File opened for modification	\??\c:\program files\ResetRemove.001	2df2fab33c1db5b049284a6bd5aa1f58bec4cb370b0663870b6a57ef33b5028c.exe
File opened for modification	\??\c:\program files\CompleteUnpublish.mpe	2df2fab33c1db5b049284a6bd5aa1f58bec4cb370b0663870b6a57ef33b5028c.exe
File opened for modification	\??\c:\program files\NewRedo.mov	2df2fab33c1db5b049284a6bd5aa1f58bec4cb370b0663870b6a57ef33b5028c.exe
File opened for modification	\??\c:\program files\RemoveRevoke.DVR-MS	2df2fab33c1db5b049284a6bd5aa1f58bec4cb370b0663870b6a57ef33b5028c.exe
File opened for modification	\??\c:\program files\PopInstall.M2V	2df2fab33c1db5b049284a6bd5aa1f58bec4cb370b0663870b6a57ef33b5028c.exe
File opened for modification	\??\c:\program files\RepairDismount.potx	2df2fab33c1db5b049284a6bd5aa1f58bec4cb370b0663870b6a57ef33b5028c.exe
File created	\??\c:\program files\1jqtbn-readme.txt	2df2fab33c1db5b049284a6bd5aa1f58bec4cb370b0663870b6a57ef33b5028c.exe
File opened for modification	\??\c:\program files\ConnectUnregister.edrwx	2df2fab33c1db5b049284a6bd5aa1f58bec4cb370b0663870b6a57ef33b5028c.exe
File opened for modification	\??\c:\program files\ExpandOptimize.mhtml	2df2fab33c1db5b049284a6bd5aa1f58bec4cb370b0663870b6a57ef33b5028c.exe

Modifies system certificate store 2 TTPs 5 IoCs

evasion spyware trojan

Install Root Certificate

T1130

Modify Registry

T1112

Processes:

2df2fab33c1db5b049284a6bd5aa1f58bec4cb370b0663870b6a57ef33b5028c.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\47BEABC922EAE80E78783462A79F45C254FDE68B	2df2fab33c1db5b049284a6bd5aa1f58bec4cb370b0663870b6a57ef33b5028c.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\47BEABC922EAE80E78783462A79F45C254FDE68B\Blob = 0f00000001000000200000003560e45b41e46b8f36537025d1d5bc02d9652a10645b0eff69e8b6a52191f335090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b060105050703080b000000010000005200000047006f00200044006100640064007900200052006f006f007400200043006500720074006900660069006300610074006500200041007500740068006f00720069007400790020001320200047003200000053000000010000002500000030233021060b6086480186fd6d0107170330123010060a2b0601040182373c0101030200c062000000010000002000000045140b3247eb9cc8c5b4f0d7b53091f73292089e6e5a63e2749dd3aca9198eda1400000001000000140000003a9a8507106728b6eff6bd05416e20c194da0fde1d000000010000001000000070253fbcbde32a014d38c1993098ad9903000000010000001400000047beabc922eae80e78783462a79f45c254fde68b2000000001000000c9030000308203c5308202ada003020102020100300d06092a864886f70d01010b0500308183310b30090603550406130255533110300e060355040813074172697a6f6e61311330110603550407130a53636f74747364616c65311a3018060355040a1311476f44616464792e636f6d2c20496e632e3131302f06035504031328476f20446164647920526f6f7420436572746966696361746520417574686f72697479202d204732301e170d3039303930313030303030305a170d3337313233313233353935395a308183310b30090603550406130255533110300e060355040813074172697a6f6e61311330110603550407130a53636f74747364616c65311a3018060355040a1311476f44616464792e636f6d2c20496e632e3131302f06035504031328476f20446164647920526f6f7420436572746966696361746520417574686f72697479202d20473230820122300d06092a864886f70d01010105000382010f003082010a0282010100bf716208f1fa5934f71bc918a3f7804958e9228313a6c52043013b84f1e685499f27eaf6841b4ea0b4db7098c73201b1053e074eeef4fa4f2f593022e7ab19566be28007fcf316758039517be5f935b6744ea98d8213e4b63fa90383faa2be8a156a7fde0bc3b6191405caeac3a804943b467c320df3006622c88d696d368c1118b7d3b21c60b438fa028cced3dd4607de0a3eeb5d7cc87cfbb02b53a4926269512505611a44818c2ca9439623dfac3a819a0e29c51ca9e95d1eb69e9e300a39cef18880fb4b5dcc32ec85624325340256270191b43b702a3f6eb1e89c88017d9fd4f9db536d609dbf2ce758abb85f46fccec41b033c09eb49315c6946b3e0470203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e041604143a9a8507106728b6eff6bd05416e20c194da0fde300d06092a864886f70d01010b0500038201010099db5d79d5f99759670361f17e3b0631752da1208e4f6587b4f7a69cbcd8e92fd0db5aeecf748c73b43842da057bf80275b8fda5b1d7aef6d7de13cb53107e8a46d197fab72e2b11ab90b02780f9e89f5ae9379fabe4df6cb385179d3dd9244f799135d65f04eb8083ab9a022db510f4d890c7047340ed7225a0a99fec9eab68129957c68f123a09a4bd44fd061537c19be432a3ed38e8d864f32c7e14fc02ea9fcdff076817db2290382d7a8dd154f169e35f33ca7a3d7b0ae3ca7f5f39e5e275bac5761833ce2cf02f4cadf7b1e7ce4fa8c49b4a5406c57f7dd5080fe21cfe7e17b8ac5ef6d416b243090c4df6a76bb4998465ca7a88e2e244be5cf7ea1cf5	2df2fab33c1db5b049284a6bd5aa1f58bec4cb370b0663870b6a57ef33b5028c.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\47BEABC922EAE80E78783462A79F45C254FDE68B\Blob = 040000000100000010000000803abc22c1e6fb8d9b3b274a321b9a0103000000010000001400000047beabc922eae80e78783462a79f45c254fde68b1d000000010000001000000070253fbcbde32a014d38c1993098ad991400000001000000140000003a9a8507106728b6eff6bd05416e20c194da0fde62000000010000002000000045140b3247eb9cc8c5b4f0d7b53091f73292089e6e5a63e2749dd3aca9198eda53000000010000002500000030233021060b6086480186fd6d0107170330123010060a2b0601040182373c0101030200c00b000000010000005200000047006f00200044006100640064007900200052006f006f007400200043006500720074006900660069006300610074006500200041007500740068006f007200690074007900200013202000470032000000090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b060105050703080f00000001000000200000003560e45b41e46b8f36537025d1d5bc02d9652a10645b0eff69e8b6a52191f3352000000001000000c9030000308203c5308202ada003020102020100300d06092a864886f70d01010b0500308183310b30090603550406130255533110300e060355040813074172697a6f6e61311330110603550407130a53636f74747364616c65311a3018060355040a1311476f44616464792e636f6d2c20496e632e3131302f06035504031328476f20446164647920526f6f7420436572746966696361746520417574686f72697479202d204732301e170d3039303930313030303030305a170d3337313233313233353935395a308183310b30090603550406130255533110300e060355040813074172697a6f6e61311330110603550407130a53636f74747364616c65311a3018060355040a1311476f44616464792e636f6d2c20496e632e3131302f06035504031328476f20446164647920526f6f7420436572746966696361746520417574686f72697479202d20473230820122300d06092a864886f70d01010105000382010f003082010a0282010100bf716208f1fa5934f71bc918a3f7804958e9228313a6c52043013b84f1e685499f27eaf6841b4ea0b4db7098c73201b1053e074eeef4fa4f2f593022e7ab19566be28007fcf316758039517be5f935b6744ea98d8213e4b63fa90383faa2be8a156a7fde0bc3b6191405caeac3a804943b467c320df3006622c88d696d368c1118b7d3b21c60b438fa028cced3dd4607de0a3eeb5d7cc87cfbb02b53a4926269512505611a44818c2ca9439623dfac3a819a0e29c51ca9e95d1eb69e9e300a39cef18880fb4b5dcc32ec85624325340256270191b43b702a3f6eb1e89c88017d9fd4f9db536d609dbf2ce758abb85f46fccec41b033c09eb49315c6946b3e0470203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e041604143a9a8507106728b6eff6bd05416e20c194da0fde300d06092a864886f70d01010b0500038201010099db5d79d5f99759670361f17e3b0631752da1208e4f6587b4f7a69cbcd8e92fd0db5aeecf748c73b43842da057bf80275b8fda5b1d7aef6d7de13cb53107e8a46d197fab72e2b11ab90b02780f9e89f5ae9379fabe4df6cb385179d3dd9244f799135d65f04eb8083ab9a022db510f4d890c7047340ed7225a0a99fec9eab68129957c68f123a09a4bd44fd061537c19be432a3ed38e8d864f32c7e14fc02ea9fcdff076817db2290382d7a8dd154f169e35f33ca7a3d7b0ae3ca7f5f39e5e275bac5761833ce2cf02f4cadf7b1e7ce4fa8c49b4a5406c57f7dd5080fe21cfe7e17b8ac5ef6d416b243090c4df6a76bb4998465ca7a88e2e244be5cf7ea1cf5	2df2fab33c1db5b049284a6bd5aa1f58bec4cb370b0663870b6a57ef33b5028c.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\47BEABC922EAE80E78783462A79F45C254FDE68B\Blob = 19000000010000001000000021d008b47b7a2a81c8435903ded424c90f00000001000000200000003560e45b41e46b8f36537025d1d5bc02d9652a10645b0eff69e8b6a52191f335090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b060105050703080b000000010000005200000047006f00200044006100640064007900200052006f006f007400200043006500720074006900660069006300610074006500200041007500740068006f00720069007400790020001320200047003200000053000000010000002500000030233021060b6086480186fd6d0107170330123010060a2b0601040182373c0101030200c062000000010000002000000045140b3247eb9cc8c5b4f0d7b53091f73292089e6e5a63e2749dd3aca9198eda1400000001000000140000003a9a8507106728b6eff6bd05416e20c194da0fde1d000000010000001000000070253fbcbde32a014d38c1993098ad9903000000010000001400000047beabc922eae80e78783462a79f45c254fde68b040000000100000010000000803abc22c1e6fb8d9b3b274a321b9a012000000001000000c9030000308203c5308202ada003020102020100300d06092a864886f70d01010b0500308183310b30090603550406130255533110300e060355040813074172697a6f6e61311330110603550407130a53636f74747364616c65311a3018060355040a1311476f44616464792e636f6d2c20496e632e3131302f06035504031328476f20446164647920526f6f7420436572746966696361746520417574686f72697479202d204732301e170d3039303930313030303030305a170d3337313233313233353935395a308183310b30090603550406130255533110300e060355040813074172697a6f6e61311330110603550407130a53636f74747364616c65311a3018060355040a1311476f44616464792e636f6d2c20496e632e3131302f06035504031328476f20446164647920526f6f7420436572746966696361746520417574686f72697479202d20473230820122300d06092a864886f70d01010105000382010f003082010a0282010100bf716208f1fa5934f71bc918a3f7804958e9228313a6c52043013b84f1e685499f27eaf6841b4ea0b4db7098c73201b1053e074eeef4fa4f2f593022e7ab19566be28007fcf316758039517be5f935b6744ea98d8213e4b63fa90383faa2be8a156a7fde0bc3b6191405caeac3a804943b467c320df3006622c88d696d368c1118b7d3b21c60b438fa028cced3dd4607de0a3eeb5d7cc87cfbb02b53a4926269512505611a44818c2ca9439623dfac3a819a0e29c51ca9e95d1eb69e9e300a39cef18880fb4b5dcc32ec85624325340256270191b43b702a3f6eb1e89c88017d9fd4f9db536d609dbf2ce758abb85f46fccec41b033c09eb49315c6946b3e0470203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e041604143a9a8507106728b6eff6bd05416e20c194da0fde300d06092a864886f70d01010b0500038201010099db5d79d5f99759670361f17e3b0631752da1208e4f6587b4f7a69cbcd8e92fd0db5aeecf748c73b43842da057bf80275b8fda5b1d7aef6d7de13cb53107e8a46d197fab72e2b11ab90b02780f9e89f5ae9379fabe4df6cb385179d3dd9244f799135d65f04eb8083ab9a022db510f4d890c7047340ed7225a0a99fec9eab68129957c68f123a09a4bd44fd061537c19be432a3ed38e8d864f32c7e14fc02ea9fcdff076817db2290382d7a8dd154f169e35f33ca7a3d7b0ae3ca7f5f39e5e275bac5761833ce2cf02f4cadf7b1e7ce4fa8c49b4a5406c57f7dd5080fe21cfe7e17b8ac5ef6d416b243090c4df6a76bb4998465ca7a88e2e244be5cf7ea1cf5	2df2fab33c1db5b049284a6bd5aa1f58bec4cb370b0663870b6a57ef33b5028c.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\47BEABC922EAE80E78783462A79F45C254FDE68B\Blob = 5c000000010000000400000000080000040000000100000010000000803abc22c1e6fb8d9b3b274a321b9a0103000000010000001400000047beabc922eae80e78783462a79f45c254fde68b1d000000010000001000000070253fbcbde32a014d38c1993098ad991400000001000000140000003a9a8507106728b6eff6bd05416e20c194da0fde62000000010000002000000045140b3247eb9cc8c5b4f0d7b53091f73292089e6e5a63e2749dd3aca9198eda53000000010000002500000030233021060b6086480186fd6d0107170330123010060a2b0601040182373c0101030200c00b000000010000005200000047006f00200044006100640064007900200052006f006f007400200043006500720074006900660069006300610074006500200041007500740068006f007200690074007900200013202000470032000000090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b060105050703080f00000001000000200000003560e45b41e46b8f36537025d1d5bc02d9652a10645b0eff69e8b6a52191f33519000000010000001000000021d008b47b7a2a81c8435903ded424c92000000001000000c9030000308203c5308202ada003020102020100300d06092a864886f70d01010b0500308183310b30090603550406130255533110300e060355040813074172697a6f6e61311330110603550407130a53636f74747364616c65311a3018060355040a1311476f44616464792e636f6d2c20496e632e3131302f06035504031328476f20446164647920526f6f7420436572746966696361746520417574686f72697479202d204732301e170d3039303930313030303030305a170d3337313233313233353935395a308183310b30090603550406130255533110300e060355040813074172697a6f6e61311330110603550407130a53636f74747364616c65311a3018060355040a1311476f44616464792e636f6d2c20496e632e3131302f06035504031328476f20446164647920526f6f7420436572746966696361746520417574686f72697479202d20473230820122300d06092a864886f70d01010105000382010f003082010a0282010100bf716208f1fa5934f71bc918a3f7804958e9228313a6c52043013b84f1e685499f27eaf6841b4ea0b4db7098c73201b1053e074eeef4fa4f2f593022e7ab19566be28007fcf316758039517be5f935b6744ea98d8213e4b63fa90383faa2be8a156a7fde0bc3b6191405caeac3a804943b467c320df3006622c88d696d368c1118b7d3b21c60b438fa028cced3dd4607de0a3eeb5d7cc87cfbb02b53a4926269512505611a44818c2ca9439623dfac3a819a0e29c51ca9e95d1eb69e9e300a39cef18880fb4b5dcc32ec85624325340256270191b43b702a3f6eb1e89c88017d9fd4f9db536d609dbf2ce758abb85f46fccec41b033c09eb49315c6946b3e0470203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e041604143a9a8507106728b6eff6bd05416e20c194da0fde300d06092a864886f70d01010b0500038201010099db5d79d5f99759670361f17e3b0631752da1208e4f6587b4f7a69cbcd8e92fd0db5aeecf748c73b43842da057bf80275b8fda5b1d7aef6d7de13cb53107e8a46d197fab72e2b11ab90b02780f9e89f5ae9379fabe4df6cb385179d3dd9244f799135d65f04eb8083ab9a022db510f4d890c7047340ed7225a0a99fec9eab68129957c68f123a09a4bd44fd061537c19be432a3ed38e8d864f32c7e14fc02ea9fcdff076817db2290382d7a8dd154f169e35f33ca7a3d7b0ae3ca7f5f39e5e275bac5761833ce2cf02f4cadf7b1e7ce4fa8c49b4a5406c57f7dd5080fe21cfe7e17b8ac5ef6d416b243090c4df6a76bb4998465ca7a88e2e244be5cf7ea1cf5	2df2fab33c1db5b049284a6bd5aa1f58bec4cb370b0663870b6a57ef33b5028c.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

2df2fab33c1db5b049284a6bd5aa1f58bec4cb370b0663870b6a57ef33b5028c.exe

pid	process
4692	2df2fab33c1db5b049284a6bd5aa1f58bec4cb370b0663870b6a57ef33b5028c.exe
4692	2df2fab33c1db5b049284a6bd5aa1f58bec4cb370b0663870b6a57ef33b5028c.exe
4692	2df2fab33c1db5b049284a6bd5aa1f58bec4cb370b0663870b6a57ef33b5028c.exe
4692	2df2fab33c1db5b049284a6bd5aa1f58bec4cb370b0663870b6a57ef33b5028c.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

Processes:

2df2fab33c1db5b049284a6bd5aa1f58bec4cb370b0663870b6a57ef33b5028c.exevssvc.exe

description	pid	process
Token: SeDebugPrivilege	4692	2df2fab33c1db5b049284a6bd5aa1f58bec4cb370b0663870b6a57ef33b5028c.exe
Token: SeTakeOwnershipPrivilege	4692	2df2fab33c1db5b049284a6bd5aa1f58bec4cb370b0663870b6a57ef33b5028c.exe
Token: SeBackupPrivilege	4032	vssvc.exe
Token: SeRestorePrivilege	4032	vssvc.exe
Token: SeAuditPrivilege	4032	vssvc.exe

C:\Users\Admin\AppData\Local\Temp\2df2fab33c1db5b049284a6bd5aa1f58bec4cb370b0663870b6a57ef33b5028c.exe
"C:\Users\Admin\AppData\Local\Temp\2df2fab33c1db5b049284a6bd5aa1f58bec4cb370b0663870b6a57ef33b5028c.exe"
1⤵
- Modifies extensions of user files
- Enumerates connected drives
- Sets desktop wallpaper using registry
- Drops file in Program Files directory
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4692