Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10_x64 -
resource
win10v20210410 -
submitted
03-05-2021 15:45
Static task
static1
Behavioral task
behavioral1
Sample
5467fe3f38ccf0c56c1aba7cbbc56109b747f7a53c333a3f5a1cfe6094e1fa2b.bin.sample.exe
Resource
win7v20210408
Behavioral task
behavioral2
Sample
5467fe3f38ccf0c56c1aba7cbbc56109b747f7a53c333a3f5a1cfe6094e1fa2b.bin.sample.exe
Resource
win10v20210410
General
-
Target
5467fe3f38ccf0c56c1aba7cbbc56109b747f7a53c333a3f5a1cfe6094e1fa2b.bin.sample.exe
-
Size
120KB
-
MD5
7111faa06f6a21e0ea9257bbf316f38a
-
SHA1
3708066334fa05ad5048a4567361686e00c9a5dc
-
SHA256
5467fe3f38ccf0c56c1aba7cbbc56109b747f7a53c333a3f5a1cfe6094e1fa2b
-
SHA512
50e08f0a3f8c47ec0e4a120a4927a0adfbf7592f42ee5a50a55f19b76b74a38edd3ddfb71c73004bff4c3db986008d9290134db07a838fd8a9345291cea559f3
Malware Config
Extracted
C:\o4r3zpc-readme.txt
sodinokibi
http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/B5D63CC5BB219DA3
http://decoder.re/B5D63CC5BB219DA3
Signatures
-
Sodin,Sodinokibi,REvil
Ransomware with advanced anti-analysis and privilege escalation functionality.
-
Modifies extensions of user files 3 IoCs
Ransomware generally changes the extension on encrypted files.
Processes:
5467fe3f38ccf0c56c1aba7cbbc56109b747f7a53c333a3f5a1cfe6094e1fa2b.bin.sample.exedescription ioc process File opened for modification \??\c:\users\admin\pictures\ConvertConnect.tiff 5467fe3f38ccf0c56c1aba7cbbc56109b747f7a53c333a3f5a1cfe6094e1fa2b.bin.sample.exe File renamed C:\Users\Admin\Pictures\ConvertConnect.tiff => \??\c:\users\admin\pictures\ConvertConnect.tiff.o4r3zpc 5467fe3f38ccf0c56c1aba7cbbc56109b747f7a53c333a3f5a1cfe6094e1fa2b.bin.sample.exe File renamed C:\Users\Admin\Pictures\FormatRemove.png => \??\c:\users\admin\pictures\FormatRemove.png.o4r3zpc 5467fe3f38ccf0c56c1aba7cbbc56109b747f7a53c333a3f5a1cfe6094e1fa2b.bin.sample.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
5467fe3f38ccf0c56c1aba7cbbc56109b747f7a53c333a3f5a1cfe6094e1fa2b.bin.sample.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\aDTFUAIa7j = "C:\\Users\\Admin\\AppData\\Local\\Temp\\5467fe3f38ccf0c56c1aba7cbbc56109b747f7a53c333a3f5a1cfe6094e1fa2b.bin.sample.exe" 5467fe3f38ccf0c56c1aba7cbbc56109b747f7a53c333a3f5a1cfe6094e1fa2b.bin.sample.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run 5467fe3f38ccf0c56c1aba7cbbc56109b747f7a53c333a3f5a1cfe6094e1fa2b.bin.sample.exe -
Enumerates connected drives 3 TTPs 25 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
5467fe3f38ccf0c56c1aba7cbbc56109b747f7a53c333a3f5a1cfe6094e1fa2b.bin.sample.exedescription ioc process File opened (read-only) \??\A: 5467fe3f38ccf0c56c1aba7cbbc56109b747f7a53c333a3f5a1cfe6094e1fa2b.bin.sample.exe File opened (read-only) \??\R: 5467fe3f38ccf0c56c1aba7cbbc56109b747f7a53c333a3f5a1cfe6094e1fa2b.bin.sample.exe File opened (read-only) \??\M: 5467fe3f38ccf0c56c1aba7cbbc56109b747f7a53c333a3f5a1cfe6094e1fa2b.bin.sample.exe File opened (read-only) \??\O: 5467fe3f38ccf0c56c1aba7cbbc56109b747f7a53c333a3f5a1cfe6094e1fa2b.bin.sample.exe File opened (read-only) \??\T: 5467fe3f38ccf0c56c1aba7cbbc56109b747f7a53c333a3f5a1cfe6094e1fa2b.bin.sample.exe File opened (read-only) \??\Y: 5467fe3f38ccf0c56c1aba7cbbc56109b747f7a53c333a3f5a1cfe6094e1fa2b.bin.sample.exe File opened (read-only) \??\Z: 5467fe3f38ccf0c56c1aba7cbbc56109b747f7a53c333a3f5a1cfe6094e1fa2b.bin.sample.exe File opened (read-only) \??\B: 5467fe3f38ccf0c56c1aba7cbbc56109b747f7a53c333a3f5a1cfe6094e1fa2b.bin.sample.exe File opened (read-only) \??\G: 5467fe3f38ccf0c56c1aba7cbbc56109b747f7a53c333a3f5a1cfe6094e1fa2b.bin.sample.exe File opened (read-only) \??\I: 5467fe3f38ccf0c56c1aba7cbbc56109b747f7a53c333a3f5a1cfe6094e1fa2b.bin.sample.exe File opened (read-only) \??\P: 5467fe3f38ccf0c56c1aba7cbbc56109b747f7a53c333a3f5a1cfe6094e1fa2b.bin.sample.exe File opened (read-only) \??\S: 5467fe3f38ccf0c56c1aba7cbbc56109b747f7a53c333a3f5a1cfe6094e1fa2b.bin.sample.exe File opened (read-only) \??\U: 5467fe3f38ccf0c56c1aba7cbbc56109b747f7a53c333a3f5a1cfe6094e1fa2b.bin.sample.exe File opened (read-only) \??\D: 5467fe3f38ccf0c56c1aba7cbbc56109b747f7a53c333a3f5a1cfe6094e1fa2b.bin.sample.exe File opened (read-only) \??\H: 5467fe3f38ccf0c56c1aba7cbbc56109b747f7a53c333a3f5a1cfe6094e1fa2b.bin.sample.exe File opened (read-only) \??\J: 5467fe3f38ccf0c56c1aba7cbbc56109b747f7a53c333a3f5a1cfe6094e1fa2b.bin.sample.exe File opened (read-only) \??\K: 5467fe3f38ccf0c56c1aba7cbbc56109b747f7a53c333a3f5a1cfe6094e1fa2b.bin.sample.exe File opened (read-only) \??\N: 5467fe3f38ccf0c56c1aba7cbbc56109b747f7a53c333a3f5a1cfe6094e1fa2b.bin.sample.exe File opened (read-only) \??\Q: 5467fe3f38ccf0c56c1aba7cbbc56109b747f7a53c333a3f5a1cfe6094e1fa2b.bin.sample.exe File opened (read-only) \??\V: 5467fe3f38ccf0c56c1aba7cbbc56109b747f7a53c333a3f5a1cfe6094e1fa2b.bin.sample.exe File opened (read-only) \??\W: 5467fe3f38ccf0c56c1aba7cbbc56109b747f7a53c333a3f5a1cfe6094e1fa2b.bin.sample.exe File opened (read-only) \??\X: 5467fe3f38ccf0c56c1aba7cbbc56109b747f7a53c333a3f5a1cfe6094e1fa2b.bin.sample.exe File opened (read-only) \??\E: 5467fe3f38ccf0c56c1aba7cbbc56109b747f7a53c333a3f5a1cfe6094e1fa2b.bin.sample.exe File opened (read-only) \??\F: 5467fe3f38ccf0c56c1aba7cbbc56109b747f7a53c333a3f5a1cfe6094e1fa2b.bin.sample.exe File opened (read-only) \??\L: 5467fe3f38ccf0c56c1aba7cbbc56109b747f7a53c333a3f5a1cfe6094e1fa2b.bin.sample.exe -
Sets desktop wallpaper using registry 2 TTPs 1 IoCs
Processes:
5467fe3f38ccf0c56c1aba7cbbc56109b747f7a53c333a3f5a1cfe6094e1fa2b.bin.sample.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\501cvr27.bmp" 5467fe3f38ccf0c56c1aba7cbbc56109b747f7a53c333a3f5a1cfe6094e1fa2b.bin.sample.exe -
Drops file in Program Files directory 19 IoCs
Processes:
5467fe3f38ccf0c56c1aba7cbbc56109b747f7a53c333a3f5a1cfe6094e1fa2b.bin.sample.exedescription ioc process File opened for modification \??\c:\program files\MoveConvertTo.crw 5467fe3f38ccf0c56c1aba7cbbc56109b747f7a53c333a3f5a1cfe6094e1fa2b.bin.sample.exe File opened for modification \??\c:\program files\ResetUnpublish.M2TS 5467fe3f38ccf0c56c1aba7cbbc56109b747f7a53c333a3f5a1cfe6094e1fa2b.bin.sample.exe File opened for modification \??\c:\program files\SubmitStop.M2V 5467fe3f38ccf0c56c1aba7cbbc56109b747f7a53c333a3f5a1cfe6094e1fa2b.bin.sample.exe File opened for modification \??\c:\program files\UnpublishRestart.xlsx 5467fe3f38ccf0c56c1aba7cbbc56109b747f7a53c333a3f5a1cfe6094e1fa2b.bin.sample.exe File opened for modification \??\c:\program files\UseGet.mp2 5467fe3f38ccf0c56c1aba7cbbc56109b747f7a53c333a3f5a1cfe6094e1fa2b.bin.sample.exe File opened for modification \??\c:\program files\WaitInvoke.scf 5467fe3f38ccf0c56c1aba7cbbc56109b747f7a53c333a3f5a1cfe6094e1fa2b.bin.sample.exe File opened for modification \??\c:\program files\WatchBlock.mov 5467fe3f38ccf0c56c1aba7cbbc56109b747f7a53c333a3f5a1cfe6094e1fa2b.bin.sample.exe File created \??\c:\program files (x86)\o4r3zpc-readme.txt 5467fe3f38ccf0c56c1aba7cbbc56109b747f7a53c333a3f5a1cfe6094e1fa2b.bin.sample.exe File opened for modification \??\c:\program files\JoinTest.m1v 5467fe3f38ccf0c56c1aba7cbbc56109b747f7a53c333a3f5a1cfe6094e1fa2b.bin.sample.exe File opened for modification \??\c:\program files\MountUndo.php 5467fe3f38ccf0c56c1aba7cbbc56109b747f7a53c333a3f5a1cfe6094e1fa2b.bin.sample.exe File opened for modification \??\c:\program files\ResumeSet.TS 5467fe3f38ccf0c56c1aba7cbbc56109b747f7a53c333a3f5a1cfe6094e1fa2b.bin.sample.exe File opened for modification \??\c:\program files\RepairPop.htm 5467fe3f38ccf0c56c1aba7cbbc56109b747f7a53c333a3f5a1cfe6094e1fa2b.bin.sample.exe File opened for modification \??\c:\program files\SetApprove.inf 5467fe3f38ccf0c56c1aba7cbbc56109b747f7a53c333a3f5a1cfe6094e1fa2b.bin.sample.exe File opened for modification \??\c:\program files\StepCheckpoint.mpg 5467fe3f38ccf0c56c1aba7cbbc56109b747f7a53c333a3f5a1cfe6094e1fa2b.bin.sample.exe File opened for modification \??\c:\program files\SuspendInstall.search-ms 5467fe3f38ccf0c56c1aba7cbbc56109b747f7a53c333a3f5a1cfe6094e1fa2b.bin.sample.exe File created \??\c:\program files\o4r3zpc-readme.txt 5467fe3f38ccf0c56c1aba7cbbc56109b747f7a53c333a3f5a1cfe6094e1fa2b.bin.sample.exe File opened for modification \??\c:\program files\FindUninstall.fon 5467fe3f38ccf0c56c1aba7cbbc56109b747f7a53c333a3f5a1cfe6094e1fa2b.bin.sample.exe File opened for modification \??\c:\program files\OutAssert.ppsx 5467fe3f38ccf0c56c1aba7cbbc56109b747f7a53c333a3f5a1cfe6094e1fa2b.bin.sample.exe File opened for modification \??\c:\program files\OutLock.html 5467fe3f38ccf0c56c1aba7cbbc56109b747f7a53c333a3f5a1cfe6094e1fa2b.bin.sample.exe -
Processes:
5467fe3f38ccf0c56c1aba7cbbc56109b747f7a53c333a3f5a1cfe6094e1fa2b.bin.sample.exedescription ioc process Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\02FAF3E291435468607857694DF5E45B68851868\Blob = 19000000010000001000000045ed9bbc5e43d3b9ecd63c060db78e5c0f000000010000001400000009b9105c5bba24343ca7f341c624e183f6ee7c1b090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00b00000001000000260000005300650063007400690067006f00200028004100640064005400720075007300740029000000620000000100000020000000687fa451382278fff0c8b11f8d43d576671c6eb2bceab413fb83d965d06d2ff2140000000100000014000000adbd987a34b426f7fac42654ef03bde024cb541a1d000000010000001000000006f9583c00a763c23fb9e065a3366d5503000000010000001400000002faf3e291435468607857694df5e45b688518680400000001000000100000001d3554048578b03f42424dbf20730a3f20000000010000003a040000308204363082031ea003020102020101300d06092a864886f70d0101050500306f310b300906035504061302534531143012060355040a130b416464547275737420414231263024060355040b131d41646454727573742045787465726e616c20545450204e6574776f726b312230200603550403131941646454727573742045787465726e616c20434120526f6f74301e170d3030303533303130343833385a170d3230303533303130343833385a306f310b300906035504061302534531143012060355040a130b416464547275737420414231263024060355040b131d41646454727573742045787465726e616c20545450204e6574776f726b312230200603550403131941646454727573742045787465726e616c20434120526f6f7430820122300d06092a864886f70d01010105000382010f003082010a0282010100b7f71a33e6f200042d39e04e5bed1fbc6c0fcdb5fa23b6cede9b113397a4294c7d939fbd4abc93ed031ae38fcfe56d505ad69729945a80b0497adb2e95fdb8cabf37382d1e3e9141ad7056c7f04f3fe8329e74cac89054e9c65f0f789d9a403c0eac61aa5e148f9e87a16a50dcd79a4eaf05b3a671949c71b350600ac7139d38078602a8e9a869261890ab4cb04f23ab3a4f84d8dfce9fe1696fbbd742d76b44e4c7adee6d415f725a710837b37965a459a09437f7002f0dc29272dad03872db14a845c45d2a7db7b4d6c4eeaccd1344b7c92bdd430025fa61b9696a582311b7a7338f567559f5cd29d746b70a2b65b6d3426f15b2b87bfbefe95d53d5345a270203010001a381dc3081d9301d0603551d0e04160414adbd987a34b426f7fac42654ef03bde024cb541a300b0603551d0f040403020106300f0603551d130101ff040530030101ff3081990603551d2304819130818e8014adbd987a34b426f7fac42654ef03bde024cb541aa173a471306f310b300906035504061302534531143012060355040a130b416464547275737420414231263024060355040b131d41646454727573742045787465726e616c20545450204e6574776f726b312230200603550403131941646454727573742045787465726e616c20434120526f6f74820101300d06092a864886f70d01010505000382010100b09be08525c2d623e20f9606929d41989cd9847981d91e5b14072336658fb0d877bbac416c47608351b0f9323de7fcf62613c78016a5bf5afc87cf787989219ae24c070a8635bcf2de51c4d296b7dc7e4eee70fd1c39eb0c0251142d8ebd16e0c1df4675e724adecf442b48593701067ba9d06354a18d32b7acc5142a17a63d1e6bba1c52bc236be130de6bd637e797ba7090d40ab6add8f8ac3f6f68c1a420551d445f59fa76221681520433c99e77cbd24d8a9911773883f561b313818b4710f9acdc80e9e8e2e1be18c9883cb1f31f1444cc604734976600fc7f8bd17806b2ee9cc4c0e5a9a790f200a2ed59e63261e559294d882175a7bd0bcc78f4e8604 5467fe3f38ccf0c56c1aba7cbbc56109b747f7a53c333a3f5a1cfe6094e1fa2b.bin.sample.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\02FAF3E291435468607857694DF5E45B68851868\Blob = 5c0000000100000004000000000800000400000001000000100000001d3554048578b03f42424dbf20730a3f03000000010000001400000002faf3e291435468607857694df5e45b688518681d000000010000001000000006f9583c00a763c23fb9e065a3366d55140000000100000014000000adbd987a34b426f7fac42654ef03bde024cb541a620000000100000020000000687fa451382278fff0c8b11f8d43d576671c6eb2bceab413fb83d965d06d2ff20b00000001000000260000005300650063007400690067006f0020002800410064006400540072007500730074002900000053000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b060105050703080f000000010000001400000009b9105c5bba24343ca7f341c624e183f6ee7c1b19000000010000001000000045ed9bbc5e43d3b9ecd63c060db78e5c20000000010000003a040000308204363082031ea003020102020101300d06092a864886f70d0101050500306f310b300906035504061302534531143012060355040a130b416464547275737420414231263024060355040b131d41646454727573742045787465726e616c20545450204e6574776f726b312230200603550403131941646454727573742045787465726e616c20434120526f6f74301e170d3030303533303130343833385a170d3230303533303130343833385a306f310b300906035504061302534531143012060355040a130b416464547275737420414231263024060355040b131d41646454727573742045787465726e616c20545450204e6574776f726b312230200603550403131941646454727573742045787465726e616c20434120526f6f7430820122300d06092a864886f70d01010105000382010f003082010a0282010100b7f71a33e6f200042d39e04e5bed1fbc6c0fcdb5fa23b6cede9b113397a4294c7d939fbd4abc93ed031ae38fcfe56d505ad69729945a80b0497adb2e95fdb8cabf37382d1e3e9141ad7056c7f04f3fe8329e74cac89054e9c65f0f789d9a403c0eac61aa5e148f9e87a16a50dcd79a4eaf05b3a671949c71b350600ac7139d38078602a8e9a869261890ab4cb04f23ab3a4f84d8dfce9fe1696fbbd742d76b44e4c7adee6d415f725a710837b37965a459a09437f7002f0dc29272dad03872db14a845c45d2a7db7b4d6c4eeaccd1344b7c92bdd430025fa61b9696a582311b7a7338f567559f5cd29d746b70a2b65b6d3426f15b2b87bfbefe95d53d5345a270203010001a381dc3081d9301d0603551d0e04160414adbd987a34b426f7fac42654ef03bde024cb541a300b0603551d0f040403020106300f0603551d130101ff040530030101ff3081990603551d2304819130818e8014adbd987a34b426f7fac42654ef03bde024cb541aa173a471306f310b300906035504061302534531143012060355040a130b416464547275737420414231263024060355040b131d41646454727573742045787465726e616c20545450204e6574776f726b312230200603550403131941646454727573742045787465726e616c20434120526f6f74820101300d06092a864886f70d01010505000382010100b09be08525c2d623e20f9606929d41989cd9847981d91e5b14072336658fb0d877bbac416c47608351b0f9323de7fcf62613c78016a5bf5afc87cf787989219ae24c070a8635bcf2de51c4d296b7dc7e4eee70fd1c39eb0c0251142d8ebd16e0c1df4675e724adecf442b48593701067ba9d06354a18d32b7acc5142a17a63d1e6bba1c52bc236be130de6bd637e797ba7090d40ab6add8f8ac3f6f68c1a420551d445f59fa76221681520433c99e77cbd24d8a9911773883f561b313818b4710f9acdc80e9e8e2e1be18c9883cb1f31f1444cc604734976600fc7f8bd17806b2ee9cc4c0e5a9a790f200a2ed59e63261e559294d882175a7bd0bcc78f4e8604 5467fe3f38ccf0c56c1aba7cbbc56109b747f7a53c333a3f5a1cfe6094e1fa2b.bin.sample.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\02FAF3E291435468607857694DF5E45B68851868 5467fe3f38ccf0c56c1aba7cbbc56109b747f7a53c333a3f5a1cfe6094e1fa2b.bin.sample.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\02FAF3E291435468607857694DF5E45B68851868\Blob = 0f000000010000001400000009b9105c5bba24343ca7f341c624e183f6ee7c1b090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00b00000001000000260000005300650063007400690067006f00200028004100640064005400720075007300740029000000620000000100000020000000687fa451382278fff0c8b11f8d43d576671c6eb2bceab413fb83d965d06d2ff2140000000100000014000000adbd987a34b426f7fac42654ef03bde024cb541a1d000000010000001000000006f9583c00a763c23fb9e065a3366d5503000000010000001400000002faf3e291435468607857694df5e45b6885186820000000010000003a040000308204363082031ea003020102020101300d06092a864886f70d0101050500306f310b300906035504061302534531143012060355040a130b416464547275737420414231263024060355040b131d41646454727573742045787465726e616c20545450204e6574776f726b312230200603550403131941646454727573742045787465726e616c20434120526f6f74301e170d3030303533303130343833385a170d3230303533303130343833385a306f310b300906035504061302534531143012060355040a130b416464547275737420414231263024060355040b131d41646454727573742045787465726e616c20545450204e6574776f726b312230200603550403131941646454727573742045787465726e616c20434120526f6f7430820122300d06092a864886f70d01010105000382010f003082010a0282010100b7f71a33e6f200042d39e04e5bed1fbc6c0fcdb5fa23b6cede9b113397a4294c7d939fbd4abc93ed031ae38fcfe56d505ad69729945a80b0497adb2e95fdb8cabf37382d1e3e9141ad7056c7f04f3fe8329e74cac89054e9c65f0f789d9a403c0eac61aa5e148f9e87a16a50dcd79a4eaf05b3a671949c71b350600ac7139d38078602a8e9a869261890ab4cb04f23ab3a4f84d8dfce9fe1696fbbd742d76b44e4c7adee6d415f725a710837b37965a459a09437f7002f0dc29272dad03872db14a845c45d2a7db7b4d6c4eeaccd1344b7c92bdd430025fa61b9696a582311b7a7338f567559f5cd29d746b70a2b65b6d3426f15b2b87bfbefe95d53d5345a270203010001a381dc3081d9301d0603551d0e04160414adbd987a34b426f7fac42654ef03bde024cb541a300b0603551d0f040403020106300f0603551d130101ff040530030101ff3081990603551d2304819130818e8014adbd987a34b426f7fac42654ef03bde024cb541aa173a471306f310b300906035504061302534531143012060355040a130b416464547275737420414231263024060355040b131d41646454727573742045787465726e616c20545450204e6574776f726b312230200603550403131941646454727573742045787465726e616c20434120526f6f74820101300d06092a864886f70d01010505000382010100b09be08525c2d623e20f9606929d41989cd9847981d91e5b14072336658fb0d877bbac416c47608351b0f9323de7fcf62613c78016a5bf5afc87cf787989219ae24c070a8635bcf2de51c4d296b7dc7e4eee70fd1c39eb0c0251142d8ebd16e0c1df4675e724adecf442b48593701067ba9d06354a18d32b7acc5142a17a63d1e6bba1c52bc236be130de6bd637e797ba7090d40ab6add8f8ac3f6f68c1a420551d445f59fa76221681520433c99e77cbd24d8a9911773883f561b313818b4710f9acdc80e9e8e2e1be18c9883cb1f31f1444cc604734976600fc7f8bd17806b2ee9cc4c0e5a9a790f200a2ed59e63261e559294d882175a7bd0bcc78f4e8604 5467fe3f38ccf0c56c1aba7cbbc56109b747f7a53c333a3f5a1cfe6094e1fa2b.bin.sample.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\02FAF3E291435468607857694DF5E45B68851868\Blob = 0400000001000000100000001d3554048578b03f42424dbf20730a3f03000000010000001400000002faf3e291435468607857694df5e45b688518681d000000010000001000000006f9583c00a763c23fb9e065a3366d55140000000100000014000000adbd987a34b426f7fac42654ef03bde024cb541a620000000100000020000000687fa451382278fff0c8b11f8d43d576671c6eb2bceab413fb83d965d06d2ff20b00000001000000260000005300650063007400690067006f0020002800410064006400540072007500730074002900000053000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b060105050703080f000000010000001400000009b9105c5bba24343ca7f341c624e183f6ee7c1b20000000010000003a040000308204363082031ea003020102020101300d06092a864886f70d0101050500306f310b300906035504061302534531143012060355040a130b416464547275737420414231263024060355040b131d41646454727573742045787465726e616c20545450204e6574776f726b312230200603550403131941646454727573742045787465726e616c20434120526f6f74301e170d3030303533303130343833385a170d3230303533303130343833385a306f310b300906035504061302534531143012060355040a130b416464547275737420414231263024060355040b131d41646454727573742045787465726e616c20545450204e6574776f726b312230200603550403131941646454727573742045787465726e616c20434120526f6f7430820122300d06092a864886f70d01010105000382010f003082010a0282010100b7f71a33e6f200042d39e04e5bed1fbc6c0fcdb5fa23b6cede9b113397a4294c7d939fbd4abc93ed031ae38fcfe56d505ad69729945a80b0497adb2e95fdb8cabf37382d1e3e9141ad7056c7f04f3fe8329e74cac89054e9c65f0f789d9a403c0eac61aa5e148f9e87a16a50dcd79a4eaf05b3a671949c71b350600ac7139d38078602a8e9a869261890ab4cb04f23ab3a4f84d8dfce9fe1696fbbd742d76b44e4c7adee6d415f725a710837b37965a459a09437f7002f0dc29272dad03872db14a845c45d2a7db7b4d6c4eeaccd1344b7c92bdd430025fa61b9696a582311b7a7338f567559f5cd29d746b70a2b65b6d3426f15b2b87bfbefe95d53d5345a270203010001a381dc3081d9301d0603551d0e04160414adbd987a34b426f7fac42654ef03bde024cb541a300b0603551d0f040403020106300f0603551d130101ff040530030101ff3081990603551d2304819130818e8014adbd987a34b426f7fac42654ef03bde024cb541aa173a471306f310b300906035504061302534531143012060355040a130b416464547275737420414231263024060355040b131d41646454727573742045787465726e616c20545450204e6574776f726b312230200603550403131941646454727573742045787465726e616c20434120526f6f74820101300d06092a864886f70d01010505000382010100b09be08525c2d623e20f9606929d41989cd9847981d91e5b14072336658fb0d877bbac416c47608351b0f9323de7fcf62613c78016a5bf5afc87cf787989219ae24c070a8635bcf2de51c4d296b7dc7e4eee70fd1c39eb0c0251142d8ebd16e0c1df4675e724adecf442b48593701067ba9d06354a18d32b7acc5142a17a63d1e6bba1c52bc236be130de6bd637e797ba7090d40ab6add8f8ac3f6f68c1a420551d445f59fa76221681520433c99e77cbd24d8a9911773883f561b313818b4710f9acdc80e9e8e2e1be18c9883cb1f31f1444cc604734976600fc7f8bd17806b2ee9cc4c0e5a9a790f200a2ed59e63261e559294d882175a7bd0bcc78f4e8604 5467fe3f38ccf0c56c1aba7cbbc56109b747f7a53c333a3f5a1cfe6094e1fa2b.bin.sample.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
5467fe3f38ccf0c56c1aba7cbbc56109b747f7a53c333a3f5a1cfe6094e1fa2b.bin.sample.exepid process 508 5467fe3f38ccf0c56c1aba7cbbc56109b747f7a53c333a3f5a1cfe6094e1fa2b.bin.sample.exe 508 5467fe3f38ccf0c56c1aba7cbbc56109b747f7a53c333a3f5a1cfe6094e1fa2b.bin.sample.exe 508 5467fe3f38ccf0c56c1aba7cbbc56109b747f7a53c333a3f5a1cfe6094e1fa2b.bin.sample.exe 508 5467fe3f38ccf0c56c1aba7cbbc56109b747f7a53c333a3f5a1cfe6094e1fa2b.bin.sample.exe -
Suspicious use of AdjustPrivilegeToken 5 IoCs
Processes:
5467fe3f38ccf0c56c1aba7cbbc56109b747f7a53c333a3f5a1cfe6094e1fa2b.bin.sample.exevssvc.exedescription pid process Token: SeDebugPrivilege 508 5467fe3f38ccf0c56c1aba7cbbc56109b747f7a53c333a3f5a1cfe6094e1fa2b.bin.sample.exe Token: SeTakeOwnershipPrivilege 508 5467fe3f38ccf0c56c1aba7cbbc56109b747f7a53c333a3f5a1cfe6094e1fa2b.bin.sample.exe Token: SeBackupPrivilege 3764 vssvc.exe Token: SeRestorePrivilege 3764 vssvc.exe Token: SeAuditPrivilege 3764 vssvc.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\5467fe3f38ccf0c56c1aba7cbbc56109b747f7a53c333a3f5a1cfe6094e1fa2b.bin.sample.exe"C:\Users\Admin\AppData\Local\Temp\5467fe3f38ccf0c56c1aba7cbbc56109b747f7a53c333a3f5a1cfe6094e1fa2b.bin.sample.exe"1⤵
- Modifies extensions of user files
- Adds Run key to start application
- Enumerates connected drives
- Sets desktop wallpaper using registry
- Drops file in Program Files directory
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:508
-
C:\Windows\system32\wbem\unsecapp.exeC:\Windows\system32\wbem\unsecapp.exe -Embedding1⤵PID:2808
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3764