sodinokibi | 2df2fab33c1db5b049284a6bd5aa1f58bec4cb370b0663870b6a57ef33b5028c

General

Target

2df2fab33c1db5b049284a6bd5aa1f58bec4cb370b0663870b6a57ef33b5028c.exe
Size

120KB
MD5

56b9c44b62a03b837df7ad35e8ef3dd4
SHA1

75a8ee1cba41ff1e0bc042d54657b3b76b7275ea
SHA256

2df2fab33c1db5b049284a6bd5aa1f58bec4cb370b0663870b6a57ef33b5028c
SHA512

5f34d8615ba06c704ea83ab201b6b3f7a7fc42b20caec40426918ed987507a53be0656447b34ed2fa33bb607ddfa74f533c4d8d6f5c844812c741d63ab7202a6

Score

10^/10

sodinokibi ransomware spyware stealer

Malware Config

Extracted

Path

C:\26iu1lleyt-readme.txt

Family

sodinokibi

Ransom Note

---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension 26iu1lleyt. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] Attention!!! [+] Also your private data was downloaded. We will publish it in case you will not get in touch with us asap. [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/584BF5555F34A14E 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decoder.re/584BF5555F34A14E Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: /tGLE3ygzj32Z/MXMgJH77GZrpo2TyBTA/R1RomjxICIr+FS1G+tSzxXBBMZoZHD vqY8GGAtCkbz+xh5AU5oX6D83UesQNX29CYBiRlfuy4SPOzSb9LsqJFFnSdglFGb x7xCo2fXrFa0O8FYiFgi7Prbtg0gUQFiyYJnYz20Jxhxrqj+leyrAliXlw17prT8 6o1QVp/JEaVslCjCHzztzr0RO6fcYeEzW5Roqg+UU37yn9WlkW6hFH1Bsf59eEa4 /QtK0U50okmiTLkKuwQdwd+VNWDREV9RdczUuVpAXtnkrbWLDwE6MG4xNxSbZdkX b5+Pq2sSMQ2VQ4SJ7qTkUV6z03K8RdbMmBEQcXYdXNR0YC6VJHJhIyOfQ9SlN9WG BO2l1WfEEfZVwYKa5mSwxkZB40nmnF2w7iIV1liBrFGSVG3tguxIThsK6LpI5GJC NdEMwwATdRZWyZZjbi0L0JR3cA05N+0T9i0cXcAIw0K50JtOQnvi5SZ6nO3EX4PJ HON1c4p/wq9l9ntmx6r/Gjip/ffpHUAiBYJ95JO92nX+1aiL6INEhYXTH3B9Rpj9 rj18pQX2fh1cdwLqH4auXAzFLlGyjtJ5ir+MSw4GgLbQTo6W9b8//OaZ+g6pYPHq dsN5cHGKCmEsCwGpF4Z/UDD+gOPWCQs0kNpuZG1dZvPgjIJqDP1ULrtGPZtW79SS GusiT/a4VtOl/FGlrTYm5ercuHtUmG/nv433+p5VshDGwTkaKybwj9chGEHkNPaX cwSkU+qjnuQjwPE3mcjY+TthMiP5feqNXAxXtubc2iyUwUx98ckaAn6ooASgerA3 0je8lYCSuX0B8ob2SO8KKWSyDJkTsKEOviUMiiuyzuXPjVQPj+vo9LtWDIhD9vNG 9Q9OnXXVPOHFgqhBalH4sX7dwF/38ByFlyw2xtABVWViYRu3htx3U/dj+IXZyHB9 ohJaFWS0fPHpfNgjIdCsTLhcu/JiThYeMVWrMpTVUfn0B5JPiBEszUZkzyFSSr0D z4phbbeFqITKJ44TqPbdPDzaIOKF5eJApbBl2DniDYzWj6vDXF5In1R/acGijiR7 8PWVwlF9Ly227+nAZID0IFuXETF/YdbpSLgJrtmSFA6+Ui57xX+ELvT8W427gWVG DfG9B7Sd9gY/0VsmCv+HJVjQTASqVj3w9nBs5u9XftqcPgOcRUKjNZ/Foytcov76 3nV/FcmoDQVQ8ia6uNG5eIBQAGIek52UFCHWO83Nd7ECwNOx5BH5p/cAI8H2MzIH xdDwRVFxSzjya5Px+1w= ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!

URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/584BF5555F34A14E

http://decoder.re/584BF5555F34A14E

Signatures

Sodin,Sodinokibi,REvil
Ransomware with advanced anti-analysis and privilege escalation functionality.
ransomware sodinokibi

Modifies extensions of user files 4 IoCs

Ransomware generally changes the extension on encrypted files.

ransomware

Processes:

2df2fab33c1db5b049284a6bd5aa1f58bec4cb370b0663870b6a57ef33b5028c.exe

description	ioc	process
File renamed	C:\Users\Admin\Pictures\MergeConvertTo.png => \??\c:\users\admin\pictures\MergeConvertTo.png.26iu1lleyt	2df2fab33c1db5b049284a6bd5aa1f58bec4cb370b0663870b6a57ef33b5028c.exe
File opened for modification	\??\c:\users\admin\pictures\UninstallSet.tiff	2df2fab33c1db5b049284a6bd5aa1f58bec4cb370b0663870b6a57ef33b5028c.exe
File renamed	C:\Users\Admin\Pictures\UninstallSet.tiff => \??\c:\users\admin\pictures\UninstallSet.tiff.26iu1lleyt	2df2fab33c1db5b049284a6bd5aa1f58bec4cb370b0663870b6a57ef33b5028c.exe
File renamed	C:\Users\Admin\Pictures\UpdateResolve.crw => \??\c:\users\admin\pictures\UpdateResolve.crw.26iu1lleyt	2df2fab33c1db5b049284a6bd5aa1f58bec4cb370b0663870b6a57ef33b5028c.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Enumerates connected drives 3 TTPs 25 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

2df2fab33c1db5b049284a6bd5aa1f58bec4cb370b0663870b6a57ef33b5028c.exe

description	ioc	process
File opened (read-only)	\??\H:	2df2fab33c1db5b049284a6bd5aa1f58bec4cb370b0663870b6a57ef33b5028c.exe
File opened (read-only)	\??\J:	2df2fab33c1db5b049284a6bd5aa1f58bec4cb370b0663870b6a57ef33b5028c.exe
File opened (read-only)	\??\P:	2df2fab33c1db5b049284a6bd5aa1f58bec4cb370b0663870b6a57ef33b5028c.exe
File opened (read-only)	\??\R:	2df2fab33c1db5b049284a6bd5aa1f58bec4cb370b0663870b6a57ef33b5028c.exe
File opened (read-only)	\??\S:	2df2fab33c1db5b049284a6bd5aa1f58bec4cb370b0663870b6a57ef33b5028c.exe
File opened (read-only)	\??\W:	2df2fab33c1db5b049284a6bd5aa1f58bec4cb370b0663870b6a57ef33b5028c.exe
File opened (read-only)	\??\A:	2df2fab33c1db5b049284a6bd5aa1f58bec4cb370b0663870b6a57ef33b5028c.exe
File opened (read-only)	\??\B:	2df2fab33c1db5b049284a6bd5aa1f58bec4cb370b0663870b6a57ef33b5028c.exe
File opened (read-only)	\??\X:	2df2fab33c1db5b049284a6bd5aa1f58bec4cb370b0663870b6a57ef33b5028c.exe
File opened (read-only)	\??\Y:	2df2fab33c1db5b049284a6bd5aa1f58bec4cb370b0663870b6a57ef33b5028c.exe
File opened (read-only)	\??\G:	2df2fab33c1db5b049284a6bd5aa1f58bec4cb370b0663870b6a57ef33b5028c.exe
File opened (read-only)	\??\K:	2df2fab33c1db5b049284a6bd5aa1f58bec4cb370b0663870b6a57ef33b5028c.exe
File opened (read-only)	\??\M:	2df2fab33c1db5b049284a6bd5aa1f58bec4cb370b0663870b6a57ef33b5028c.exe
File opened (read-only)	\??\O:	2df2fab33c1db5b049284a6bd5aa1f58bec4cb370b0663870b6a57ef33b5028c.exe
File opened (read-only)	\??\U:	2df2fab33c1db5b049284a6bd5aa1f58bec4cb370b0663870b6a57ef33b5028c.exe
File opened (read-only)	\??\V:	2df2fab33c1db5b049284a6bd5aa1f58bec4cb370b0663870b6a57ef33b5028c.exe
File opened (read-only)	\??\D:	2df2fab33c1db5b049284a6bd5aa1f58bec4cb370b0663870b6a57ef33b5028c.exe
File opened (read-only)	\??\E:	2df2fab33c1db5b049284a6bd5aa1f58bec4cb370b0663870b6a57ef33b5028c.exe
File opened (read-only)	\??\I:	2df2fab33c1db5b049284a6bd5aa1f58bec4cb370b0663870b6a57ef33b5028c.exe
File opened (read-only)	\??\N:	2df2fab33c1db5b049284a6bd5aa1f58bec4cb370b0663870b6a57ef33b5028c.exe
File opened (read-only)	\??\Q:	2df2fab33c1db5b049284a6bd5aa1f58bec4cb370b0663870b6a57ef33b5028c.exe
File opened (read-only)	\??\T:	2df2fab33c1db5b049284a6bd5aa1f58bec4cb370b0663870b6a57ef33b5028c.exe
File opened (read-only)	\??\Z:	2df2fab33c1db5b049284a6bd5aa1f58bec4cb370b0663870b6a57ef33b5028c.exe
File opened (read-only)	\??\F:	2df2fab33c1db5b049284a6bd5aa1f58bec4cb370b0663870b6a57ef33b5028c.exe
File opened (read-only)	\??\L:	2df2fab33c1db5b049284a6bd5aa1f58bec4cb370b0663870b6a57ef33b5028c.exe

Sets desktop wallpaper using registry 2 TTPs 1 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

Processes:

2df2fab33c1db5b049284a6bd5aa1f58bec4cb370b0663870b6a57ef33b5028c.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\f6n34.bmp"	2df2fab33c1db5b049284a6bd5aa1f58bec4cb370b0663870b6a57ef33b5028c.exe

Drops file in Program Files directory 20 IoCs

Processes:

2df2fab33c1db5b049284a6bd5aa1f58bec4cb370b0663870b6a57ef33b5028c.exe

description	ioc	process
File opened for modification	\??\c:\program files\EnableFind.wmf	2df2fab33c1db5b049284a6bd5aa1f58bec4cb370b0663870b6a57ef33b5028c.exe
File opened for modification	\??\c:\program files\PopJoin.avi	2df2fab33c1db5b049284a6bd5aa1f58bec4cb370b0663870b6a57ef33b5028c.exe
File opened for modification	\??\c:\program files\PublishProtect.zip	2df2fab33c1db5b049284a6bd5aa1f58bec4cb370b0663870b6a57ef33b5028c.exe
File opened for modification	\??\c:\program files\RemoveShow.pptx	2df2fab33c1db5b049284a6bd5aa1f58bec4cb370b0663870b6a57ef33b5028c.exe
File opened for modification	\??\c:\program files\UnblockSearch.vdx	2df2fab33c1db5b049284a6bd5aa1f58bec4cb370b0663870b6a57ef33b5028c.exe
File created	\??\c:\program files (x86)\26iu1lleyt-readme.txt	2df2fab33c1db5b049284a6bd5aa1f58bec4cb370b0663870b6a57ef33b5028c.exe
File opened for modification	\??\c:\program files\BlockMove.tmp	2df2fab33c1db5b049284a6bd5aa1f58bec4cb370b0663870b6a57ef33b5028c.exe
File opened for modification	\??\c:\program files\JoinAdd.mht	2df2fab33c1db5b049284a6bd5aa1f58bec4cb370b0663870b6a57ef33b5028c.exe
File opened for modification	\??\c:\program files\NewPop.emz	2df2fab33c1db5b049284a6bd5aa1f58bec4cb370b0663870b6a57ef33b5028c.exe
File opened for modification	\??\c:\program files\ResizeExit.dotx	2df2fab33c1db5b049284a6bd5aa1f58bec4cb370b0663870b6a57ef33b5028c.exe
File opened for modification	\??\c:\program files\SetRedo.vsd	2df2fab33c1db5b049284a6bd5aa1f58bec4cb370b0663870b6a57ef33b5028c.exe
File opened for modification	\??\c:\program files\UnlockEnable.tiff	2df2fab33c1db5b049284a6bd5aa1f58bec4cb370b0663870b6a57ef33b5028c.exe
File created	\??\c:\program files\26iu1lleyt-readme.txt	2df2fab33c1db5b049284a6bd5aa1f58bec4cb370b0663870b6a57ef33b5028c.exe
File opened for modification	\??\c:\program files\DismountComplete.clr	2df2fab33c1db5b049284a6bd5aa1f58bec4cb370b0663870b6a57ef33b5028c.exe
File opened for modification	\??\c:\program files\InvokeClose.TTS	2df2fab33c1db5b049284a6bd5aa1f58bec4cb370b0663870b6a57ef33b5028c.exe
File opened for modification	\??\c:\program files\RevokeUnregister.bmp	2df2fab33c1db5b049284a6bd5aa1f58bec4cb370b0663870b6a57ef33b5028c.exe
File opened for modification	\??\c:\program files\PingNew.jpe	2df2fab33c1db5b049284a6bd5aa1f58bec4cb370b0663870b6a57ef33b5028c.exe
File opened for modification	\??\c:\program files\RedoResolve.jpeg	2df2fab33c1db5b049284a6bd5aa1f58bec4cb370b0663870b6a57ef33b5028c.exe
File opened for modification	\??\c:\program files\ConnectMount.AAC	2df2fab33c1db5b049284a6bd5aa1f58bec4cb370b0663870b6a57ef33b5028c.exe
File opened for modification	\??\c:\program files\InitializeExit.wps	2df2fab33c1db5b049284a6bd5aa1f58bec4cb370b0663870b6a57ef33b5028c.exe

Modifies system certificate store 2 TTPs 5 IoCs

evasion spyware trojan

Install Root Certificate

T1130

Modify Registry

T1112

Processes:

2df2fab33c1db5b049284a6bd5aa1f58bec4cb370b0663870b6a57ef33b5028c.exe

description	ioc	process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\47BEABC922EAE80E78783462A79F45C254FDE68B\Blob = 19000000010000001000000021d008b47b7a2a81c8435903ded424c90f00000001000000200000003560e45b41e46b8f36537025d1d5bc02d9652a10645b0eff69e8b6a52191f335090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b060105050703080b000000010000005200000047006f00200044006100640064007900200052006f006f007400200043006500720074006900660069006300610074006500200041007500740068006f00720069007400790020001320200047003200000053000000010000002500000030233021060b6086480186fd6d0107170330123010060a2b0601040182373c0101030200c062000000010000002000000045140b3247eb9cc8c5b4f0d7b53091f73292089e6e5a63e2749dd3aca9198eda1400000001000000140000003a9a8507106728b6eff6bd05416e20c194da0fde1d000000010000001000000070253fbcbde32a014d38c1993098ad9903000000010000001400000047beabc922eae80e78783462a79f45c254fde68b040000000100000010000000803abc22c1e6fb8d9b3b274a321b9a012000000001000000c9030000308203c5308202ada003020102020100300d06092a864886f70d01010b0500308183310b30090603550406130255533110300e060355040813074172697a6f6e61311330110603550407130a53636f74747364616c65311a3018060355040a1311476f44616464792e636f6d2c20496e632e3131302f06035504031328476f20446164647920526f6f7420436572746966696361746520417574686f72697479202d204732301e170d3039303930313030303030305a170d3337313233313233353935395a308183310b30090603550406130255533110300e060355040813074172697a6f6e61311330110603550407130a53636f74747364616c65311a3018060355040a1311476f44616464792e636f6d2c20496e632e3131302f06035504031328476f20446164647920526f6f7420436572746966696361746520417574686f72697479202d20473230820122300d06092a864886f70d01010105000382010f003082010a0282010100bf716208f1fa5934f71bc918a3f7804958e9228313a6c52043013b84f1e685499f27eaf6841b4ea0b4db7098c73201b1053e074eeef4fa4f2f593022e7ab19566be28007fcf316758039517be5f935b6744ea98d8213e4b63fa90383faa2be8a156a7fde0bc3b6191405caeac3a804943b467c320df3006622c88d696d368c1118b7d3b21c60b438fa028cced3dd4607de0a3eeb5d7cc87cfbb02b53a4926269512505611a44818c2ca9439623dfac3a819a0e29c51ca9e95d1eb69e9e300a39cef18880fb4b5dcc32ec85624325340256270191b43b702a3f6eb1e89c88017d9fd4f9db536d609dbf2ce758abb85f46fccec41b033c09eb49315c6946b3e0470203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e041604143a9a8507106728b6eff6bd05416e20c194da0fde300d06092a864886f70d01010b0500038201010099db5d79d5f99759670361f17e3b0631752da1208e4f6587b4f7a69cbcd8e92fd0db5aeecf748c73b43842da057bf80275b8fda5b1d7aef6d7de13cb53107e8a46d197fab72e2b11ab90b02780f9e89f5ae9379fabe4df6cb385179d3dd9244f799135d65f04eb8083ab9a022db510f4d890c7047340ed7225a0a99fec9eab68129957c68f123a09a4bd44fd061537c19be432a3ed38e8d864f32c7e14fc02ea9fcdff076817db2290382d7a8dd154f169e35f33ca7a3d7b0ae3ca7f5f39e5e275bac5761833ce2cf02f4cadf7b1e7ce4fa8c49b4a5406c57f7dd5080fe21cfe7e17b8ac5ef6d416b243090c4df6a76bb4998465ca7a88e2e244be5cf7ea1cf5	2df2fab33c1db5b049284a6bd5aa1f58bec4cb370b0663870b6a57ef33b5028c.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\47BEABC922EAE80E78783462A79F45C254FDE68B\Blob = 5c000000010000000400000000080000040000000100000010000000803abc22c1e6fb8d9b3b274a321b9a0103000000010000001400000047beabc922eae80e78783462a79f45c254fde68b1d000000010000001000000070253fbcbde32a014d38c1993098ad991400000001000000140000003a9a8507106728b6eff6bd05416e20c194da0fde62000000010000002000000045140b3247eb9cc8c5b4f0d7b53091f73292089e6e5a63e2749dd3aca9198eda53000000010000002500000030233021060b6086480186fd6d0107170330123010060a2b0601040182373c0101030200c00b000000010000005200000047006f00200044006100640064007900200052006f006f007400200043006500720074006900660069006300610074006500200041007500740068006f007200690074007900200013202000470032000000090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b060105050703080f00000001000000200000003560e45b41e46b8f36537025d1d5bc02d9652a10645b0eff69e8b6a52191f33519000000010000001000000021d008b47b7a2a81c8435903ded424c92000000001000000c9030000308203c5308202ada003020102020100300d06092a864886f70d01010b0500308183310b30090603550406130255533110300e060355040813074172697a6f6e61311330110603550407130a53636f74747364616c65311a3018060355040a1311476f44616464792e636f6d2c20496e632e3131302f06035504031328476f20446164647920526f6f7420436572746966696361746520417574686f72697479202d204732301e170d3039303930313030303030305a170d3337313233313233353935395a308183310b30090603550406130255533110300e060355040813074172697a6f6e61311330110603550407130a53636f74747364616c65311a3018060355040a1311476f44616464792e636f6d2c20496e632e3131302f06035504031328476f20446164647920526f6f7420436572746966696361746520417574686f72697479202d20473230820122300d06092a864886f70d01010105000382010f003082010a0282010100bf716208f1fa5934f71bc918a3f7804958e9228313a6c52043013b84f1e685499f27eaf6841b4ea0b4db7098c73201b1053e074eeef4fa4f2f593022e7ab19566be28007fcf316758039517be5f935b6744ea98d8213e4b63fa90383faa2be8a156a7fde0bc3b6191405caeac3a804943b467c320df3006622c88d696d368c1118b7d3b21c60b438fa028cced3dd4607de0a3eeb5d7cc87cfbb02b53a4926269512505611a44818c2ca9439623dfac3a819a0e29c51ca9e95d1eb69e9e300a39cef18880fb4b5dcc32ec85624325340256270191b43b702a3f6eb1e89c88017d9fd4f9db536d609dbf2ce758abb85f46fccec41b033c09eb49315c6946b3e0470203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e041604143a9a8507106728b6eff6bd05416e20c194da0fde300d06092a864886f70d01010b0500038201010099db5d79d5f99759670361f17e3b0631752da1208e4f6587b4f7a69cbcd8e92fd0db5aeecf748c73b43842da057bf80275b8fda5b1d7aef6d7de13cb53107e8a46d197fab72e2b11ab90b02780f9e89f5ae9379fabe4df6cb385179d3dd9244f799135d65f04eb8083ab9a022db510f4d890c7047340ed7225a0a99fec9eab68129957c68f123a09a4bd44fd061537c19be432a3ed38e8d864f32c7e14fc02ea9fcdff076817db2290382d7a8dd154f169e35f33ca7a3d7b0ae3ca7f5f39e5e275bac5761833ce2cf02f4cadf7b1e7ce4fa8c49b4a5406c57f7dd5080fe21cfe7e17b8ac5ef6d416b243090c4df6a76bb4998465ca7a88e2e244be5cf7ea1cf5	2df2fab33c1db5b049284a6bd5aa1f58bec4cb370b0663870b6a57ef33b5028c.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\47BEABC922EAE80E78783462A79F45C254FDE68B	2df2fab33c1db5b049284a6bd5aa1f58bec4cb370b0663870b6a57ef33b5028c.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\47BEABC922EAE80E78783462A79F45C254FDE68B\Blob = 0f00000001000000200000003560e45b41e46b8f36537025d1d5bc02d9652a10645b0eff69e8b6a52191f335090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b060105050703080b000000010000005200000047006f00200044006100640064007900200052006f006f007400200043006500720074006900660069006300610074006500200041007500740068006f00720069007400790020001320200047003200000053000000010000002500000030233021060b6086480186fd6d0107170330123010060a2b0601040182373c0101030200c062000000010000002000000045140b3247eb9cc8c5b4f0d7b53091f73292089e6e5a63e2749dd3aca9198eda1400000001000000140000003a9a8507106728b6eff6bd05416e20c194da0fde1d000000010000001000000070253fbcbde32a014d38c1993098ad9903000000010000001400000047beabc922eae80e78783462a79f45c254fde68b2000000001000000c9030000308203c5308202ada003020102020100300d06092a864886f70d01010b0500308183310b30090603550406130255533110300e060355040813074172697a6f6e61311330110603550407130a53636f74747364616c65311a3018060355040a1311476f44616464792e636f6d2c20496e632e3131302f06035504031328476f20446164647920526f6f7420436572746966696361746520417574686f72697479202d204732301e170d3039303930313030303030305a170d3337313233313233353935395a308183310b30090603550406130255533110300e060355040813074172697a6f6e61311330110603550407130a53636f74747364616c65311a3018060355040a1311476f44616464792e636f6d2c20496e632e3131302f06035504031328476f20446164647920526f6f7420436572746966696361746520417574686f72697479202d20473230820122300d06092a864886f70d01010105000382010f003082010a0282010100bf716208f1fa5934f71bc918a3f7804958e9228313a6c52043013b84f1e685499f27eaf6841b4ea0b4db7098c73201b1053e074eeef4fa4f2f593022e7ab19566be28007fcf316758039517be5f935b6744ea98d8213e4b63fa90383faa2be8a156a7fde0bc3b6191405caeac3a804943b467c320df3006622c88d696d368c1118b7d3b21c60b438fa028cced3dd4607de0a3eeb5d7cc87cfbb02b53a4926269512505611a44818c2ca9439623dfac3a819a0e29c51ca9e95d1eb69e9e300a39cef18880fb4b5dcc32ec85624325340256270191b43b702a3f6eb1e89c88017d9fd4f9db536d609dbf2ce758abb85f46fccec41b033c09eb49315c6946b3e0470203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e041604143a9a8507106728b6eff6bd05416e20c194da0fde300d06092a864886f70d01010b0500038201010099db5d79d5f99759670361f17e3b0631752da1208e4f6587b4f7a69cbcd8e92fd0db5aeecf748c73b43842da057bf80275b8fda5b1d7aef6d7de13cb53107e8a46d197fab72e2b11ab90b02780f9e89f5ae9379fabe4df6cb385179d3dd9244f799135d65f04eb8083ab9a022db510f4d890c7047340ed7225a0a99fec9eab68129957c68f123a09a4bd44fd061537c19be432a3ed38e8d864f32c7e14fc02ea9fcdff076817db2290382d7a8dd154f169e35f33ca7a3d7b0ae3ca7f5f39e5e275bac5761833ce2cf02f4cadf7b1e7ce4fa8c49b4a5406c57f7dd5080fe21cfe7e17b8ac5ef6d416b243090c4df6a76bb4998465ca7a88e2e244be5cf7ea1cf5	2df2fab33c1db5b049284a6bd5aa1f58bec4cb370b0663870b6a57ef33b5028c.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\47BEABC922EAE80E78783462A79F45C254FDE68B\Blob = 040000000100000010000000803abc22c1e6fb8d9b3b274a321b9a0103000000010000001400000047beabc922eae80e78783462a79f45c254fde68b1d000000010000001000000070253fbcbde32a014d38c1993098ad991400000001000000140000003a9a8507106728b6eff6bd05416e20c194da0fde62000000010000002000000045140b3247eb9cc8c5b4f0d7b53091f73292089e6e5a63e2749dd3aca9198eda53000000010000002500000030233021060b6086480186fd6d0107170330123010060a2b0601040182373c0101030200c00b000000010000005200000047006f00200044006100640064007900200052006f006f007400200043006500720074006900660069006300610074006500200041007500740068006f007200690074007900200013202000470032000000090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b060105050703080f00000001000000200000003560e45b41e46b8f36537025d1d5bc02d9652a10645b0eff69e8b6a52191f3352000000001000000c9030000308203c5308202ada003020102020100300d06092a864886f70d01010b0500308183310b30090603550406130255533110300e060355040813074172697a6f6e61311330110603550407130a53636f74747364616c65311a3018060355040a1311476f44616464792e636f6d2c20496e632e3131302f06035504031328476f20446164647920526f6f7420436572746966696361746520417574686f72697479202d204732301e170d3039303930313030303030305a170d3337313233313233353935395a308183310b30090603550406130255533110300e060355040813074172697a6f6e61311330110603550407130a53636f74747364616c65311a3018060355040a1311476f44616464792e636f6d2c20496e632e3131302f06035504031328476f20446164647920526f6f7420436572746966696361746520417574686f72697479202d20473230820122300d06092a864886f70d01010105000382010f003082010a0282010100bf716208f1fa5934f71bc918a3f7804958e9228313a6c52043013b84f1e685499f27eaf6841b4ea0b4db7098c73201b1053e074eeef4fa4f2f593022e7ab19566be28007fcf316758039517be5f935b6744ea98d8213e4b63fa90383faa2be8a156a7fde0bc3b6191405caeac3a804943b467c320df3006622c88d696d368c1118b7d3b21c60b438fa028cced3dd4607de0a3eeb5d7cc87cfbb02b53a4926269512505611a44818c2ca9439623dfac3a819a0e29c51ca9e95d1eb69e9e300a39cef18880fb4b5dcc32ec85624325340256270191b43b702a3f6eb1e89c88017d9fd4f9db536d609dbf2ce758abb85f46fccec41b033c09eb49315c6946b3e0470203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e041604143a9a8507106728b6eff6bd05416e20c194da0fde300d06092a864886f70d01010b0500038201010099db5d79d5f99759670361f17e3b0631752da1208e4f6587b4f7a69cbcd8e92fd0db5aeecf748c73b43842da057bf80275b8fda5b1d7aef6d7de13cb53107e8a46d197fab72e2b11ab90b02780f9e89f5ae9379fabe4df6cb385179d3dd9244f799135d65f04eb8083ab9a022db510f4d890c7047340ed7225a0a99fec9eab68129957c68f123a09a4bd44fd061537c19be432a3ed38e8d864f32c7e14fc02ea9fcdff076817db2290382d7a8dd154f169e35f33ca7a3d7b0ae3ca7f5f39e5e275bac5761833ce2cf02f4cadf7b1e7ce4fa8c49b4a5406c57f7dd5080fe21cfe7e17b8ac5ef6d416b243090c4df6a76bb4998465ca7a88e2e244be5cf7ea1cf5	2df2fab33c1db5b049284a6bd5aa1f58bec4cb370b0663870b6a57ef33b5028c.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

2df2fab33c1db5b049284a6bd5aa1f58bec4cb370b0663870b6a57ef33b5028c.exe

pid	process
496	2df2fab33c1db5b049284a6bd5aa1f58bec4cb370b0663870b6a57ef33b5028c.exe
496	2df2fab33c1db5b049284a6bd5aa1f58bec4cb370b0663870b6a57ef33b5028c.exe
496	2df2fab33c1db5b049284a6bd5aa1f58bec4cb370b0663870b6a57ef33b5028c.exe
496	2df2fab33c1db5b049284a6bd5aa1f58bec4cb370b0663870b6a57ef33b5028c.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

Processes:

2df2fab33c1db5b049284a6bd5aa1f58bec4cb370b0663870b6a57ef33b5028c.exevssvc.exe

description	pid	process
Token: SeDebugPrivilege	496	2df2fab33c1db5b049284a6bd5aa1f58bec4cb370b0663870b6a57ef33b5028c.exe
Token: SeTakeOwnershipPrivilege	496	2df2fab33c1db5b049284a6bd5aa1f58bec4cb370b0663870b6a57ef33b5028c.exe
Token: SeBackupPrivilege	2868	vssvc.exe
Token: SeRestorePrivilege	2868	vssvc.exe
Token: SeAuditPrivilege	2868	vssvc.exe

C:\Users\Admin\AppData\Local\Temp\2df2fab33c1db5b049284a6bd5aa1f58bec4cb370b0663870b6a57ef33b5028c.exe
"C:\Users\Admin\AppData\Local\Temp\2df2fab33c1db5b049284a6bd5aa1f58bec4cb370b0663870b6a57ef33b5028c.exe"
1⤵
- Modifies extensions of user files
- Enumerates connected drives
- Sets desktop wallpaper using registry
- Drops file in Program Files directory
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:496