Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10_x64 -
resource
win10v20210410 -
submitted
16-05-2021 03:19
Static task
static1
Behavioral task
behavioral1
Sample
7008e5cfbcec321d0a80bc0d8290ff2099d4268b41d84dd7598628c29e478a1d.exe
Resource
win7v20210410
Behavioral task
behavioral2
Sample
7008e5cfbcec321d0a80bc0d8290ff2099d4268b41d84dd7598628c29e478a1d.exe
Resource
win10v20210410
General
-
Target
7008e5cfbcec321d0a80bc0d8290ff2099d4268b41d84dd7598628c29e478a1d.exe
-
Size
204KB
-
MD5
098deaef208e91da3914ad5ea0afd5a6
-
SHA1
0563789909fbcf0c87afaae912cee3ec46fdf1bf
-
SHA256
7008e5cfbcec321d0a80bc0d8290ff2099d4268b41d84dd7598628c29e478a1d
-
SHA512
834ab00c763d79da0bc4ee05eae1cefca84ba84922fab6224f44fd5f2a76150c76444d48dfd0555e5b2ab8f131ad176139149a6f7f5f4bc1441c7eca93a30779
Malware Config
Extracted
C:\odt\6410gj-readme.txt
sodinokibi
http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/CF61CA59D3BA9E84
http://decryptor.top/CF61CA59D3BA9E84
Extracted
sodinokibi
8
43
logosindustries.com
pisofare.co
gavelmasters.com
patriotcleaning.net
bourchier.org
amelielecompte.wordpress.com
awaitspain.com
wg-heiligenstadt.de
mercadodelrio.com
brannbornfastigheter.se
hypogenforensic.com
vapiano.fr
innersurrection.com
solidhosting.nl
fidelitytitleoregon.com
bcabattoirs.org
smarttourism.academy
csaballoons.com
agenceassemble.fr
letsstopsmoking.co.uk
heimdalbygg.no
biodentify.ai
ziliak.com
catalyseurdetransformation.com
successcolony.com.ng
casinodepositors.com
mundo-pieces-auto.fr
shrinkingplanet.com
pokemonturkiye.com
uci-france.fr
housesofwa.com
kombi-dress.com
signamedia.de
scholarquotes.com
johnsonweekly.com
brownswoodblog.com
parseport.com
bajova.sk
levencovka.ru
line-x.co.uk
ingresosextras.online
nbva.co.uk
entdoctor-durban.com
rattanwarehouse.co.uk
myplaywin3.com
mediabolmong.com
makingmillionaires.net
jalkapuu.net
buonabitare.com
tanatek.com
noda.com.ua
theintellect.edu.pk
vedsegaard.dk
imajyuku-sozoku.com
hospitalitytrainingsolutions.co.uk
palema.gr
ideamode.com
cl0nazepamblog.com
biblica.com
memphishealthandwellness.com
donau-guides.eu
baita.ac
skooppi.fi
veggienessa.com
bmw-i-pure-impulse.com
drbenveniste.com
matthieupetel.fr
morgansconsult.com
perceptdecor.com
arearugcleaningnyc.com
jimprattmediations.com
fsbforsale.com
greeneyetattoo.com
blavait.fr
qandmmusiccenter.com
bluetenreich-brilon.de
terraflair.de
foerderverein-vatterschule.de
kickittickets.com
gardenpartner.pl
ddmgen.com
beauty-traveller.com
betterce.com
piestar.com
neolaiamedispa.com
descargandoprogramas.com
triplettabordeaux.fr
proffteplo.com
goeppinger-teppichreinigung.de
tbalp.co.uk
tzn.nu
airserviceunlimited.com
bodymindchallenger.com
agora-collectivites.com
theboardroomafrica.com
web865.com
leansupremegarcinia.net
acibademmobil.com.tr
parisschool.ru
ilovefullcircle.com
metroton.ru
magrinya.net
ncjc.ca
tchernia-conseil.fr
prometeyagro.com.ua
theatre-embellie.fr
dmlcpa.com
rarefoods.ro
fascaonline.com
cuadc.org
bg.szczecin.pl
mrkluttz.com
eshop.design
yourhappyevents.fr
awag-blog.de
alaskaremote.com
andermattswisswatches.ch
soncini.ch
janellrardon.com
advesa.com
hostaletdelsindians.es
motocrossplace.co.uk
otpusk.zp.ua
breakluckrecords.com
vipcarrental.ae
hm-com.com
goodherbalhealth.com
adterium.com
opt4cdi.com
tilldeeke.de
aberdeenartwalk.org
lmmont.sk
billscars.net
protoplay.ca
framemyballs.com
premiumweb.com.ua:443
pixelhealth.net
aslog.fr
mondolandscapes.com
christopherhannan.com
deduktia.fi
profiz.com
tweedekansenloket.nl
natturestaurante.com.br
angeleyezstripclub.com
alcye.com
jlgraphisme.fr
secrets-clubs.co.uk
endlessrealms.net
thegetawaycollective.com
log-barn.co.uk
autoteamlast.de
bellesiniacademy.org
magnetvisual.com
ruggestar.ch
from02pro.com
bakingismyyoga.com
activeterroristwarningcompany.com
citydogslife.com
babysitting-hk.helpergo.co
moira-cristescu.com
galatee-couture.com
muller.nl
affligemsehondenschool.be
onlinemarketingsurgery.co.uk
90nguyentuan.com
cyberpromote.de
schroederschoembs.com
prodentalblue.com
tetameble.pl
yourcosmicbeing.com
nrgvalue.com
girlish.ae
lifeinbreaths.com
kartuindonesia.com
molade.nl
wyreforest.net
curtsdiscountguns.com
fbmagazine.ru
towelroot.co
direitapernambuco.com
bagaholics.in
the-beauty-guides.com
flossmoordental.com
nykfdyrehospital.dk
cops4causes.org
augen-praxisklinik-rostock.de
barbaramcfadyenjewelry.com
valiant-voice.com
lumturo.academy
zinnystar.com
jag.me
leadforensics.com
egpu.fr
holocine.de
martha-frets-ceramics.nl
leloupblanc.gr
chris-anne.com
bilius.dk
2020hindsight.info
dennisverschuur.com
graygreenbiomedservices.com
bescomedical.de
ncn.nl
dentallabor-luenen.de
marcandy.com
wribrazil.com
ygallerysalonsoho.com:443
weddingceremonieswithtim.com
adabible.org
rsidesigns.com
advanced-removals.co.uk
oro.ae
turing.academy
markseymourphotography.co.uk
rentingwell.com
maryairbnb.wordpress.com
slotenmakerszwijndrecht.nl
zumrutkuyutemel.com
salonlamar.nl
thehovecounsellingpractice.co.uk
techybash.com
oexebusiness.com
napisat-pismo-gubernatoru.ru:443
nauticmarine.dk
axisoflove.org:443
lapponiasafaris.com
geitoniatonaggelon.gr
avisioninthedesert.com
mslp.org
nicksrock.com
mieleshopping.it
agendatwentytwenty.com
jollity.hu
epicjapanart.com
forskolinslimeffect.net
jonnyhooley.com
basindentistry.com
tieronechic.com
aheadloftladders.co.uk
internalresults.com
khtrx.com
explora.nl
tradenavigator.ch
antesacademy.it
advance-refle.com
fotoslubna.com
hinotruckwreckers.com.au
sprintcoach.com
thisprettyhair.com
pinkxgayvideoawards.com
floweringsun.org
juergenblaetz.de
marmarabasin.com
encounter-p.net
fla.se
keuken-prijs.nl
limmortelyouth.com
arazi.eus
rishigangoly.com
factorywizuk.com
husetsanitas.dk
jeanmonti.com
cleanroomequipment.ie
silkeight.com
phukienbepthanhdat.com
concontactodirecto.com
invela.dk
malevannye.ru
jandhpest.com
mazift.dk
tages-geldvergleich.de
iactechnologies.net
skolaprome.eu
chatberlin.de
hartofurniture.com
eastgrinsteadwingchun.com
jaaphoekzema.nl
computer-place.de
designimage.ae
broccolisoep.nl
electricianul.com
lidkopingsnytt.nu
alwaysdc.com
dinedrinkdetroit.com
bookingwheel.com
renehartman.nl
3daywebs.com
energosbit-rp.ru
bumbipdeco.site
orchardbrickwork.com
angelsmirrorus.com
operativadigital.com
santastoy.store
opticahubertruiz.com
dogsunlimitedguide.com
interlinkone.com
lollachiro.com
duthler.nl
placermonticello.com
lexced.com
bulyginnikitav.000webhostapp.com
poems-for-the-soul.ch
billyoart.com
myfbateam.com
parksideseniorliving.net
jobstomoveamerica.org
cac2040.com
lisa-poncon.fr
kompresory-opravy.com
shortysspices.com
mustangmarketinggroup.com
carsten.sparen-it.de
stagefxinc.com
rapid5kloan.org
fi-institutionalfunds.com
elex.is
sololibrerie.it
jobkiwi.com.ng
rizplakatjaya.com
atrgroup.it
riffenmattgarage.ch
toranjtuition.org
dreamvoiceclub.org
agriturismocastagneto.it
animalfood-online.de
speiserei-hannover.de
pureelements.nl
epsondriversforwindows.com
rhino-turf.com
mariamalmahdi.com
apogeeconseils.fr
margaretmcshane.com
ahgarage.com
zaczytana.com
stathmoulis.gr
asiaartgallery.jp
ox-home.com
limounie.com
vdolg24.online
gta-jjb.fr
simpleitsolutions.ch
rivermusic.nl
therapybusinessacademy.com
hawaiisteelbuilding.com
golfclublandgoednieuwkerk.nl
skyboundnutrition.co.uk
redctei.co
trevi-vl.ru
skoczynski.eu
mariajosediazdemera.com
kiraribeaute-nani.com
mangimirossana.it
finsahome.co.uk
vitoriaecoturismo.com.br
gurutechnologies.net
midwestschool.org
coachpreneuracademy.com
nalliasmali.net
billigeflybilletter.dk
carmel-york.com
jayfurnitureco.com
eksperdanismanlik.com
switch-made.com
indiebizadvocates.org
circuit-diagramz.com
artcase.pl
ijsselbeton.nl
glennverschueren.be
voice2biz.com
artvark.nl
bohrlochversicherung.info
springfieldplumbermo.com
bayshoreelite.com
mazzaropi.com.br
birthplacemag.com
masecologicos.com
rino-gmbh.com
t3brothers.com
olry-cloisons.fr
qwikcoach.com
louiedager.com
heuvelland-oaze.nl
amorbellezaysalud.com
johnkoen.com
pankiss.ru
wrinstitute.org
insane.agency
ronielyn.com
strauchs-wanderlust.info
subyard.com
aktivfriskcenter.se
jameswilliamspainting.com
envomask.com
allinonecampaign.com
drnelsonpediatrics.com
skyscanner.ro
mike.matthies.de
richardiv.com
photonag.com
whoopingcrane.com
molinum.pt
paprikapod.com
cp-bap.de
innovationgames-brabant.nl
purepreprod4.com
stabilisateur.fr
so-sage.fr
alabamaroofingllc.com
airvapourbarrier.com
lagschools.ng
bundan.com
jax-interim-and-projectmanagement.com
aquacheck.co.za
littlesaints.academy
auberives-sur-vareze.fr
maxcube24.com.ua
ilveshistoria.com
cssp-mediation.org
slotspinner.com
dcc-eu.com
mneti.ru
craftstone.co.nz
fitnessblenderstory.com
hawthornsretirement.co.uk
keyboardjournal.com
pubcon.com
production-stills.co.uk
drvoip.com
thesilkroadny.com
tecleados.com
kdbrh.com
palmecophilippines.com
eafx.pro
kellengatton.com
parentsandkids.com
reizenmetkinderen.be
groovedealers.ru
jefersonalessandro.com
blueridgeheritage.com
haard-totaal.nl
apmollerpension.com
julielusktherapy.com
rechtenplicht.be
fixx-repair.com
acumenconsultingcompany.com
mayprogulka.ru
diverfiestas.com.es
go.labibini.ch
rtc24.com
o90.dk
nvisionsigns.com
chomiksy.net
the3-week-diet.net
c-sprop.com
domaine-des-pothiers.com
katherinealy.com
efficiencyconsulting.es
rozmata.com
citiscapes-art.com
palmenhaus-erfurt.de
lunoluno.com
fluzfluzrewards.com
smartmind.net
tesisatonarim.com
banksrl.co.za
pharmeko-group.com
watchsale.biz
charlottelhanna.com
creohn.de
pays-saint-flour.fr
sealgrinderpt.com
rs-danmark.dk
narca.net
naukaip.ru
jakubrybak.com
crestgood.com
nevadaruralhousingstudies.org
fire-space.com
teamsegeln.ch
inewsstar.com
adedesign.com
zuerich-umzug.ch
gsconcretecoatings.com
forextimes.ru
latableacrepes-meaux.fr
kosten-vochtbestrijding.be
livelai.com
humanviruses.org
raeoflightmusic.com
altocontatto.net
nepal-pictures.com
suonenjoen.fi
ninjaki.com
hom-frisor.dk
dantreranch.com
datatri.be
stoneridgemontessori.com
xn--80addfr4ahr.dp.ua
utilisacteur.fr
optigas.com
metallbau-hartmann.eu
animation-pro.co.uk
hostingbangladesh.net
catering.com
metcalfe.ca
oscommunity.de
hameghlim.com
cainlaw-okc.com
grancanariaregional.com
triavlete.com
ayudaespiritualtamara.com
racefietsenblog.nl
jglconsultancy.com
comoserescritor.com
singletonfinancial.com
kafkacare.com
aceroprime.com
xrresources.com
bertbutter.nl
legundschiess.de
teethinadaydentalimplants.com
boomerslivinglively.com
slideevents.be
grafikstudio-visuell.de
bonitabeachassociation.com
projektparkiet.pl
kroophold-sjaelland.dk
ronaldhendriks.nl
verbouwingsdouche.nl
acb-gruppe.ch
onesynergyinternational.com
redpebblephotography.com
mamajenedesigns.com
frameshift.it
luvbec.com
n-newmedia.de
dayenne-styling.nl
altitudeboise.com
patassociation.com
pxsrl.it
zealcon.ae
goodboyscustom.com
carolynfriedlander.com
oththukaruva.com
leopoldineroux.com
leatherjees.com
awaisghauri.com
cxcompany.com
happylublog.wordpress.com
physio-lang.de
klapanvent.ru
ciga-france.fr
diakonie-weitramsdorf-sesslach.de
uncensoredhentaigif.com
perfectgrin.com
frankgoll.com
kryptos72.com
bluelakevision.com
site.markkit.com.br
lovetzuchia.com
omegamarbella.com
kristianboennelykke.dk
polynine.com
achetrabalhos.com
kvetymichalovce.sk
janmorgenstern.com
5thactors.com
cmeow.com
iron-mine.ru
sarahspics.co.uk
precisetemp.com
angelika-schwarz.com
sunsolutions.es
gazelle-du-web.com
buzzneakers.com
brinkdoepke.eu
kookooo.com
skidpiping.de
jobscore.com
edvestors.org
premier-iowa.com
nepressurecleaning.com
skinkeeper.li
wasnederland.nl
unboxtherapy.site
justaroundthecornerpetsit.com
kemtron.fr
letterscan.de
advancedeyecare.com
liepertgrafikweb.at
phoenixcrane.com
unislaw-narty.pl
istantidigitali.com
azerbaycanas.com
kausette.com
a-zpaperwork.eu
teutoradio.de
cormanmarketing.com
andreaskildegaard.dk
daveystownhouse.com
tutvracks.com
ivancacu.com
selected-minds.de
kamin-somnium.de
shortsalemap.com
pansionatblago.ru
jdscenter.com
voetbalhoogeveen.nl
nieuwsindeklas.be
11.in.ua
victorvictoria.com
albcleaner.fr
paardcentraal.nl
min-virksomhed.dk
fotoeditores.com
delegationhub.com
cap29010.it
happycatering.de
benchbiz.com
laylavalentine.com
mac-computer-support-hamburg.de
buerocenter-butzbach-werbemittel.de
berdonllp.com
janasfokus.com
lattalvor.com
testitjavertailut.net
stressreliefadvice.com
koncept-m.ru
global-migrate.com
webforsites.com
mariannelemenestrel.com
fta-media.com
photographycreativity.co.uk
mgimalta.com
malzomattalar.com
universelle.fr
cardsandloyalty.com
johnstonmingmanning.com
finnergo.eu
spirello.nl
speakaudible.com
fann.ru
welovecustomers.fr
radishallgood.com
ultimatelifesource.com
mensemetgesigte.co.za
muni.pe
futurenetworking.com
galaniuklaw.com
denhaagfoodie.nl
chainofhopeeurope.eu
nuohous.com
customroasts.com
zorgboerderijravensbosch.nl
hiddensee-buhne11.de
tellthebell.website
mediogiro.com.ar
tramadolhealth.com
mrcar.nl
mesajjongeren.nl
kelsigordon.com
peppergreenfarmcatering.com.au
amyandzac.com
tastevirginia.com
rokthetalk.com
ravage-webzine.nl
mindsparkescape.com
campusce.com
adaduga.info
annenymus.com
taulunkartano.fi
alisodentalcare.com
hnkns.com
bjornvanvulpen.nl
astrographic.com
globalcompliancenews.com
forumsittard.nl
ced-elec.com
omnicademy.com
belinda.af
modamarfil.com
denverwynkoopdentist.com
ownidentity.com
osn.ro
askstaffing.com
fridakids.com
traitware.com
gosouldeep.com
haus-landliebe.de
frimec-international.es
banukumbak.com
cc-experts.de
pajagus.fr
saberconcrete.com
baumfinancialservices.com
yvesdoin-aquarelles.fr
irizar.com
texanscan.org
liveyourheartout.co
boloria.de
bluemarinefoundation.com
bodet150ans.com
dr-vita.de
onlinetvgroup.com
oncarrot.com
bavovrienden.nl
glas-kuck.de
espaciopolitica.com
bringmehope.org
colored-shelves.com
domilivefurniture.com
dibli.store
motocrosshideout.com
ykobbqchicken.ca
publicompserver.de
topautoinsurers.net
pedmanson.com
ramirezprono.com
nourella.com
yayasanprimaunggul.org
outstandingminialbums.com
iexpert99.com
p-ride.live
111firstdelray.com
bubbalucious.com
promus.ca
greatofficespaces.net
akcadagofis.com
sjtpo.org
xn--80abehgab4ak0ddz.xn--p1ai
liverpoolabudhabi.ae
loysonbryan.com
penumbuhrambutkeiskei.com
goddardleadership.org
alpesiberie.com
alene.co
expohomes.com
cmascd.com
test-teleachat.fr
9nar.com
linkbuilding.life
scentedlair.com
hekecrm.com
kenmccallum.com
nationnewsroom.com
handyman-silkeborg.dk
fazagostar.co
newonestop.com
edrickennedymacfoy.com
plbinsurance.com
topvijesti.net
powershell.su
distrifresh.com
cincinnatiphotocompany.org
aciscomputers.com
sbit.ag
thiagoperez.com
triplettagaite.fr
professionetata.com
pazarspor.org.tr
look.academy
sochi-okna23.ru
quitescorting.com
thestudio.academy
the5thquestion.com
smartercashsystem.com
stanleyqualitysystems.com
thegrinningmanmusical.com
ikzoekgod.be
deziplan.ru
ceocenters.com
biketruck.de
thenalpa.com
neonodi.be
devus.de
lyricalduniya.com
itheroes.dk
scietech.academy
vvego.com
netadultere.fr
zdrowieszczecin.pl
pourlabretagne.bzh
beandrivingschool.com.au
campusescalade.com
anchelor.com
reygroup.pt
yuanshenghotel.com
four-ways.com
subquercy.fr
sytzedevries.com
davedavisphotos.com
stage-infirmier.fr
baikalflot.ru
eyedoctordallas.com
sycamoregreenapts.com
wademurray.com
ledyoucan.com
abulanov.com
leijstrom.com
karelinjames.com
soundseeing.net
luvinsburger.fr
silverbird.dk
saboboxtel.uk
the-cupboard.co.uk
elitkeramika-shop.com.ua
bratek-immobilien.de
der-stempelking.de
guohedd.com
solutionshosting.co.uk
richardmaybury.co.uk
medicalsupportco.com
mursall.de
brighthillgroup.com
yournextshoes.com
evsynthacademy.org
manzel.tn
alnectus.com
chatterchatterchatter.com
schlagbohrmaschinetests.com
directique.com
hostastay.com
enactusnhlstenden.com
jmmartinezilustrador.com
wineandgo.hu
dinecorp.com
internestdigital.com
campinglaforetdetesse.com
gaearoyals.com
pro-gamer.pl
atma.nl
mollymccarthydesign.com
queertube.net
ludoil.it
agencewho-aixenprovence.fr
belofloripa.be
rename.kz
christianscholz.de
alattekniksipil.com
eventosvirtualesexitosos.com
gratiocafeblog.wordpress.com
brisbaneosteopathic.com.au
mrmac.com
lsngroupe.com
eurethicsport.eu
ocduiblog.com
ya-elka.ru
dentourage.com
rossomattonecase.it
avis.mantova.it
factoriareloj.com
hutchstyle.co.uk
annida.it
sharonalbrightdds.com
nxtstg.org
rvside.com
nutriwell.com.sg
qrs-international.com
chinowarehousespace.com
nexstagefinancial.com
collegetennis.info
nginx.com
business-basic.de
monstarrsoccer.com
eos-horlogerie.com
karmeliterviertel.com
sellthewrightway.com
craftron.com
xtensifi.com
kryddersnapsen.dk
volta.plus
dierenambulancealkmaar.nl
gbk-tp1.de
rhino-storage.co.uk
block-optic.com
laaisterplakky.nl
anleggsregisteret.no
smartworkplaza.com
aidanpublishing.co.uk
cotton-avenue.co.il
afbudsrejserallinclusive.dk
fysiotherapierijnmond.nl
jacquesgarcianoto.com
imaginekithomes.co.nz
mbuildinghomes.com
vitormmcosta.com
pilotgreen.com
arthakapitalforvaltning.dk
furland.ru
tatyanakopieva.ru
5pointpt.com
avtoboss163.ru:443
devplus.be
supercarhire.co.uk
studionumerik.fr
azloans.com
lesyeuxbleus.net
jlwilsonbooks.com
livedeveloper.com
sambaglow.com
trivselsguide.dk
greenrider.nl
burg-zelem.de
aoyama.ac
digitale-elite.de
richardkershawwines.co.za
1deals.com
imagine-entertainment.com
signededenroth.dk
lookandseen.com
oportowebdesign.com
hensleymarketing.com
grupoexin10.com
andrealuchesi.it
relevantonline.eu
reputation-medical.online
trainiumacademy.com
wirmuessenreden.com
putzen-reinigen.com
licensed-public-adjuster.com
bruut.online
lassocrm.com
fanuli.com.au
rubyaudiology.com
walterman.es
witraz.pl
hepishopping.com
hoteltantra.com
mindfuelers.com
cascinarosa33.it
loparnille.se
hotelturbo.de
metriplica.academy
mahikuchen.com
sshomme.com
werkzeugtrolley.net
paradigmlandscape.com
geoweb.software
mjk.digital
centuryvisionglobal.com
easydental.ae
cymru.futbol
landgoedspica.nl
xn--ziinoapte-6ld.ro
spacebel.be
matteoruzzaofficial.com
oraweb.net
mikegoodfellow.co.uk
auto-opel.ro
boyfriendsgoal.site
bd2fly.com
condormobile.fr
pinthelook.com
clinic-beethovenstrasse-ag.ch
suitesartemis.gr
eatyoveges.com
arabianmice.com
smartspeak.com
gatlinburgcottage.com
k-v-f.de
hotjapaneselesbian.com
sveneulberg.de
satoblog.org
charlesfrancis.photos
g2mediainc.com
stringnosis.academy
dentalcircle.com
akwaba-safaris.com
lgiwines.com
breathebettertolivebetter.com
initconf.com
michaelfiegel.com
tothebackofthemoon.com
miscbo.it
krishnabrawijaya.com
craftingalegacy.com
globalskills.pt
hvitfeldt.dk
wordpress.idium.no
bendel-partner.de
kerstliedjeszingen.nl
o2o-academy.com
alexwenzel.de
enews-qca.com
ufovidmag.com
almamidwifery.com
atelierkomon.com
ebible.co
bcmets.info
cookinn.nl
unexplored.gr
clemenfoto.dk
k-zubki.ru
sber-biznes.com
linearete.com
drbrianhweeks.com
stitch-n-bitch.com
druktemakersheerenveen.nl
agrifarm.dk
sppdstats.com
profibersan.com
dieetuniversiteit.nl
wallflowersandrakes.com
transifer.fr
saint-malo-developpement.fr
martinipstudios.com
latteswithleslie.com
baptistdistinctives.org
blucamp.com
theater-lueneburg.de
levelseven.be
apiarista.de
die-immo-agentur.de
ikadomus.com
elliemaccreative.wordpress.com
thepixelfairy.com
funworx.de
stralsund-ansichten.de
mediahub.co.nz
dnqa.co.uk
alharsunindo.com
lashandbrowenvy.com
glende-pflanzenparadies.de
startuplive.org
focuskontur.com
sachainchiuk.com
zwemofficial.nl
buffdaddyblog.com
primemarineengineering.com
alltagsrassismus-entknoten.de
renderbox.ch
spectamarketingdigital.com.br
worldproskitour.com
endstarvation.com
innervisions-id.com
harleystreetspineclinic.com
brunoimmobilier.com
peninggibadan.co.id
ketomealprep.academy
lovcase.com
rentsportsequip.com
xn--billigafrgpatroner-stb.se
corporacionrr.com
specialtyhomeservicesllc.com
circlecitydj.com
rolleepollee.com
georgemuncey.com
randyabrown.com
michal-s.co.il
m2graph.fr
claudiakilian.de
b3b.ch
kuriero.pro
scotlandsroute66.co.uk
mind2muscle.nl
sweetz.fr
schulz-moelln.de
bridalcave.com
ntinasfiloxenia.gr
spartamovers.com
chorusconsulting.net
acornishstudio.co.uk
etgdogz.de
larchwoodmarketing.com
cesep2019.com
docarefoundation.org
pvandambv.nl
catchup-mag.com
schluesseldienste-hannover.de
fskhjalmar.se
bychowo.pl
amco.net.au
-
net
true
-
pid
8
-
prc
mysql.exe
-
ransom_oneliner
All of your files are encrypted! Find {EXT}-readme.txt and follow instuctions
-
ransom_template
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on you computer has expansion {EXT}. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/{UID} 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.top/{UID} Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: {KEY} Extension name: {EXT} ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
-
sub
43
Signatures
-
Sodin,Sodinokibi,REvil
Ransomware with advanced anti-analysis and privilege escalation functionality.
-
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Modifies extensions of user files 4 IoCs
Ransomware generally changes the extension on encrypted files.
Processes:
7008e5cfbcec321d0a80bc0d8290ff2099d4268b41d84dd7598628c29e478a1d.exedescription ioc process File renamed C:\Users\Admin\Pictures\OutConvertFrom.raw => C:\Users\Admin\Pictures\OutConvertFrom.raw.6410gj 7008e5cfbcec321d0a80bc0d8290ff2099d4268b41d84dd7598628c29e478a1d.exe File renamed C:\Users\Admin\Pictures\SkipDisconnect.crw => C:\Users\Admin\Pictures\SkipDisconnect.crw.6410gj 7008e5cfbcec321d0a80bc0d8290ff2099d4268b41d84dd7598628c29e478a1d.exe File renamed C:\Users\Admin\Pictures\SubmitUnpublish.tif => C:\Users\Admin\Pictures\SubmitUnpublish.tif.6410gj 7008e5cfbcec321d0a80bc0d8290ff2099d4268b41d84dd7598628c29e478a1d.exe File renamed C:\Users\Admin\Pictures\SuspendImport.tif => C:\Users\Admin\Pictures\SuspendImport.tif.6410gj 7008e5cfbcec321d0a80bc0d8290ff2099d4268b41d84dd7598628c29e478a1d.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Enumerates connected drives 3 TTPs 25 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
7008e5cfbcec321d0a80bc0d8290ff2099d4268b41d84dd7598628c29e478a1d.exedescription ioc process File opened (read-only) \??\Y: 7008e5cfbcec321d0a80bc0d8290ff2099d4268b41d84dd7598628c29e478a1d.exe File opened (read-only) \??\Z: 7008e5cfbcec321d0a80bc0d8290ff2099d4268b41d84dd7598628c29e478a1d.exe File opened (read-only) \??\D: 7008e5cfbcec321d0a80bc0d8290ff2099d4268b41d84dd7598628c29e478a1d.exe File opened (read-only) \??\F: 7008e5cfbcec321d0a80bc0d8290ff2099d4268b41d84dd7598628c29e478a1d.exe File opened (read-only) \??\V: 7008e5cfbcec321d0a80bc0d8290ff2099d4268b41d84dd7598628c29e478a1d.exe File opened (read-only) \??\H: 7008e5cfbcec321d0a80bc0d8290ff2099d4268b41d84dd7598628c29e478a1d.exe File opened (read-only) \??\M: 7008e5cfbcec321d0a80bc0d8290ff2099d4268b41d84dd7598628c29e478a1d.exe File opened (read-only) \??\P: 7008e5cfbcec321d0a80bc0d8290ff2099d4268b41d84dd7598628c29e478a1d.exe File opened (read-only) \??\Q: 7008e5cfbcec321d0a80bc0d8290ff2099d4268b41d84dd7598628c29e478a1d.exe File opened (read-only) \??\T: 7008e5cfbcec321d0a80bc0d8290ff2099d4268b41d84dd7598628c29e478a1d.exe File opened (read-only) \??\A: 7008e5cfbcec321d0a80bc0d8290ff2099d4268b41d84dd7598628c29e478a1d.exe File opened (read-only) \??\G: 7008e5cfbcec321d0a80bc0d8290ff2099d4268b41d84dd7598628c29e478a1d.exe File opened (read-only) \??\I: 7008e5cfbcec321d0a80bc0d8290ff2099d4268b41d84dd7598628c29e478a1d.exe File opened (read-only) \??\J: 7008e5cfbcec321d0a80bc0d8290ff2099d4268b41d84dd7598628c29e478a1d.exe File opened (read-only) \??\K: 7008e5cfbcec321d0a80bc0d8290ff2099d4268b41d84dd7598628c29e478a1d.exe File opened (read-only) \??\L: 7008e5cfbcec321d0a80bc0d8290ff2099d4268b41d84dd7598628c29e478a1d.exe File opened (read-only) \??\N: 7008e5cfbcec321d0a80bc0d8290ff2099d4268b41d84dd7598628c29e478a1d.exe File opened (read-only) \??\O: 7008e5cfbcec321d0a80bc0d8290ff2099d4268b41d84dd7598628c29e478a1d.exe File opened (read-only) \??\B: 7008e5cfbcec321d0a80bc0d8290ff2099d4268b41d84dd7598628c29e478a1d.exe File opened (read-only) \??\E: 7008e5cfbcec321d0a80bc0d8290ff2099d4268b41d84dd7598628c29e478a1d.exe File opened (read-only) \??\U: 7008e5cfbcec321d0a80bc0d8290ff2099d4268b41d84dd7598628c29e478a1d.exe File opened (read-only) \??\W: 7008e5cfbcec321d0a80bc0d8290ff2099d4268b41d84dd7598628c29e478a1d.exe File opened (read-only) \??\X: 7008e5cfbcec321d0a80bc0d8290ff2099d4268b41d84dd7598628c29e478a1d.exe File opened (read-only) \??\R: 7008e5cfbcec321d0a80bc0d8290ff2099d4268b41d84dd7598628c29e478a1d.exe File opened (read-only) \??\S: 7008e5cfbcec321d0a80bc0d8290ff2099d4268b41d84dd7598628c29e478a1d.exe -
Sets desktop wallpaper using registry 2 TTPs 1 IoCs
Processes:
7008e5cfbcec321d0a80bc0d8290ff2099d4268b41d84dd7598628c29e478a1d.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\32hh489.bmp" 7008e5cfbcec321d0a80bc0d8290ff2099d4268b41d84dd7598628c29e478a1d.exe -
Drops file in Windows directory 64 IoCs
Processes:
7008e5cfbcec321d0a80bc0d8290ff2099d4268b41d84dd7598628c29e478a1d.exedescription ioc process File opened for modification C:\Windows\WinSxS\Backup\x86_microsoft.windows.c..-controls.resources_6595b64144ccf1df_6.0.15063.0_sv-se_5362d14869363a8e.manifest 7008e5cfbcec321d0a80bc0d8290ff2099d4268b41d84dd7598628c29e478a1d.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-d..opactivitymoderator_31bf3856ad364e35_10.0.15063.0_none_1afe75a2a51438fe_dam.sys_fdd762d9 7008e5cfbcec321d0a80bc0d8290ff2099d4268b41d84dd7598628c29e478a1d.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-font-bitmap-terminal_31bf3856ad364e35_10.0.15063.0_none_2583321dfa2b45c4_cga40737.fon_2c4b9363 7008e5cfbcec321d0a80bc0d8290ff2099d4268b41d84dd7598628c29e478a1d.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-i..er-engine.resources_31bf3856ad364e35_10.0.15063.0_fi-fi_f71c2ad88cd00633_msimsg.dll.mui_72e8994f 7008e5cfbcec321d0a80bc0d8290ff2099d4268b41d84dd7598628c29e478a1d.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-profsvc.resources_31bf3856ad364e35_10.0.15063.0_en-us_77cfed1b3d429e22_profsvc.dll.mui_32482e9e 7008e5cfbcec321d0a80bc0d8290ff2099d4268b41d84dd7598628c29e478a1d.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-w..cture-bsp.resources_31bf3856ad364e35_10.0.15063.0_en-us_def515be9c847815_mswsock.dll.mui_d7c2a730 7008e5cfbcec321d0a80bc0d8290ff2099d4268b41d84dd7598628c29e478a1d.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft.windows.c..-controls.resources_6595b64144ccf1df_5.82.15063.0_ar-sa_c50cf4a0af973ef3.manifest 7008e5cfbcec321d0a80bc0d8290ff2099d4268b41d84dd7598628c29e478a1d.exe File opened for modification C:\Windows\WinSxS\Backup\wow64_microsoft-windows-winsock-helper-tcpip_31bf3856ad364e35_10.0.15063.0_none_e71b894d9eb700bd_wship6.dll_db4127c3 7008e5cfbcec321d0a80bc0d8290ff2099d4268b41d84dd7598628c29e478a1d.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-comdlg32_31bf3856ad364e35_10.0.15063.0_none_c6c4eadade764d0d_comdlg32.dll_b1ffde97 7008e5cfbcec321d0a80bc0d8290ff2099d4268b41d84dd7598628c29e478a1d.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-coreos-minwin_31bf3856ad364e35_10.0.15063.0_none_6797a7fd6731f776_fs_rec.sys_dfd2dd83 7008e5cfbcec321d0a80bc0d8290ff2099d4268b41d84dd7598628c29e478a1d.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-coresystemminpnp_31bf3856ad364e35_10.0.15063.0_none_1b70ea73251f149e_drvcfg.exe_8370a674 7008e5cfbcec321d0a80bc0d8290ff2099d4268b41d84dd7598628c29e478a1d.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-rasrtutils_31bf3856ad364e35_10.0.15063.0_none_1e296d4a23494905_rtutils.dll_243724ab 7008e5cfbcec321d0a80bc0d8290ff2099d4268b41d84dd7598628c29e478a1d.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-s..-netlogon.resources_31bf3856ad364e35_10.0.15063.0_en-us_40d75e23579ee338_netlogon.dll.mui_ecbeb9bd 7008e5cfbcec321d0a80bc0d8290ff2099d4268b41d84dd7598628c29e478a1d.exe File opened for modification C:\Windows\WinSxS\Backup\x86_microsoft.windows.c..-controls.resources_6595b64144ccf1df_6.0.15063.0_es-es_6e122c03212f2631.manifest 7008e5cfbcec321d0a80bc0d8290ff2099d4268b41d84dd7598628c29e478a1d.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-themeservice_31bf3856ad364e35_10.0.15063.0_none_bb1659e5012b4fbe.manifest 7008e5cfbcec321d0a80bc0d8290ff2099d4268b41d84dd7598628c29e478a1d.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-w..eservices.resources_31bf3856ad364e35_10.0.15063.0_en-us_ea6b6d97f2f4c7b4_wiarpc.dll.mui_0c913b87 7008e5cfbcec321d0a80bc0d8290ff2099d4268b41d84dd7598628c29e478a1d.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-w..r-webclnt.resources_31bf3856ad364e35_10.0.15063.0_en-us_507ecdc8096d0ff0.manifest 7008e5cfbcec321d0a80bc0d8290ff2099d4268b41d84dd7598628c29e478a1d.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft.windows.c..-controls.resources_6595b64144ccf1df_6.0.15063.0_sv-se_0bb59a7154ba1188_comctl32.dll.mui_0da4e682 7008e5cfbcec321d0a80bc0d8290ff2099d4268b41d84dd7598628c29e478a1d.exe File opened for modification C:\Windows\WinSxS\Backup\wow64_microsoft-windows-rasrtutils_31bf3856ad364e35_10.0.15063.0_none_287e179c57aa0b00.manifest 7008e5cfbcec321d0a80bc0d8290ff2099d4268b41d84dd7598628c29e478a1d.exe File opened for modification C:\Windows\WinSxS\Backup\x86_microsoft-windows-i..er-engine.resources_31bf3856ad364e35_10.0.15063.0_sr-..-rs_8995d4219afc5913.manifest 7008e5cfbcec321d0a80bc0d8290ff2099d4268b41d84dd7598628c29e478a1d.exe File opened for modification C:\Windows\WinSxS\Backup\x86_microsoft.windows.c..-controls.resources_6595b64144ccf1df_6.0.15063.0_et-ee_67d1f793253502c0.manifest 7008e5cfbcec321d0a80bc0d8290ff2099d4268b41d84dd7598628c29e478a1d.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-b..os-loader.resources_31bf3856ad364e35_10.0.15063.0_en-us_87ac933f1cd28fdb_winload.exe.mui_3bc5b827 7008e5cfbcec321d0a80bc0d8290ff2099d4268b41d84dd7598628c29e478a1d.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-dns-client-minwin_31bf3856ad364e35_10.0.15063.0_none_a69f8cf95bf4534e_dnsapi.dll_c81f5791 7008e5cfbcec321d0a80bc0d8290ff2099d4268b41d84dd7598628c29e478a1d.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-font-bitmap-terminal_31bf3856ad364e35_10.0.15063.0_none_2583321dfa2b45c4_ega40850.fon_5e8f5479 7008e5cfbcec321d0a80bc0d8290ff2099d4268b41d84dd7598628c29e478a1d.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-imm32_31bf3856ad364e35_10.0.15063.0_none_6d69f74fb339b66a.manifest 7008e5cfbcec321d0a80bc0d8290ff2099d4268b41d84dd7598628c29e478a1d.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft.windows.c..-controls.resources_6595b64144ccf1df_5.82.15063.0_es-es_5977f50474c0ba78.manifest 7008e5cfbcec321d0a80bc0d8290ff2099d4268b41d84dd7598628c29e478a1d.exe File opened for modification C:\Windows\WinSxS\Backup\x86_microsoft-windows-i..er-engine.resources_31bf3856ad364e35_10.0.15063.0_en-gb_f48e72a5e408fd69.manifest 7008e5cfbcec321d0a80bc0d8290ff2099d4268b41d84dd7598628c29e478a1d.exe File opened for modification C:\Windows\WinSxS\Backup\x86_microsoft.windows.c..-controls.resources_6595b64144ccf1df_6.0.15063.0_ar-sa_d9a72b9f5c05aaac.manifest 7008e5cfbcec321d0a80bc0d8290ff2099d4268b41d84dd7598628c29e478a1d.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-mpr_31bf3856ad364e35_10.0.15063.0_none_bee9a2ab90c00b09_mpr.dll_e8c35b01 7008e5cfbcec321d0a80bc0d8290ff2099d4268b41d84dd7598628c29e478a1d.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_windows-gaming-xbox..e-service-component_31bf3856ad364e35_10.0.15063.0_none_64798615ecbbbc0e_xblgamesavetask.exe_e6e69c44 7008e5cfbcec321d0a80bc0d8290ff2099d4268b41d84dd7598628c29e478a1d.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-b..iagnostic.resources_31bf3856ad364e35_10.0.15063.0_pt-br_c999671e308ecd5c_memtest.efi.mui_71e15c22 7008e5cfbcec321d0a80bc0d8290ff2099d4268b41d84dd7598628c29e478a1d.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-font-bitmap-system_31bf3856ad364e35_10.0.15063.0_none_946aa6202fade3c5_vgas874.fon_57846913 7008e5cfbcec321d0a80bc0d8290ff2099d4268b41d84dd7598628c29e478a1d.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-rasbase-ndiswan_31bf3856ad364e35_10.0.15063.0_none_044c69fa901981b6.manifest 7008e5cfbcec321d0a80bc0d8290ff2099d4268b41d84dd7598628c29e478a1d.exe File opened for modification C:\Windows\WinSxS\Backup\wow64_microsoft-windows-b..iagnostic.resources_31bf3856ad364e35_10.0.15063.0_de-de_296104f3095d85f3_memtest.exe.mui_77b8cbcc 7008e5cfbcec321d0a80bc0d8290ff2099d4268b41d84dd7598628c29e478a1d.exe File opened for modification C:\Windows\WinSxS\Backup\x86_microsoft.windows.c..-controls.resources_6595b64144ccf1df_5.82.15063.0_sl-si_88a80d10cfcef28d.manifest 7008e5cfbcec321d0a80bc0d8290ff2099d4268b41d84dd7598628c29e478a1d.exe File opened for modification C:\Windows\WinSxS\Backup\x86_microsoft.windows.c..-controls.resources_6595b64144ccf1df_5.82.15063.0_th-th_2b7ff2d3c288b51c.manifest 7008e5cfbcec321d0a80bc0d8290ff2099d4268b41d84dd7598628c29e478a1d.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-sechost_31bf3856ad364e35_10.0.15063.0_none_98d6b61705c4f027_sechost.dll_a7bf8aa9 7008e5cfbcec321d0a80bc0d8290ff2099d4268b41d84dd7598628c29e478a1d.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft.windows.c..-controls.resources_6595b64144ccf1df_5.82.15063.0_et-ee_5337c09478c69707_comctl32.dll.mui_0da4e682 7008e5cfbcec321d0a80bc0d8290ff2099d4268b41d84dd7598628c29e478a1d.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_networking-mpssvc-svc.resources_31bf3856ad364e35_10.0.15063.0_en-us_987c8d6bc746e508_firewallapi.dll.mui_43c7a05b 7008e5cfbcec321d0a80bc0d8290ff2099d4268b41d84dd7598628c29e478a1d.exe File opened for modification C:\Windows\WinSxS\Backup\x86_microsoft-windows-b..ager-pcat.resources_31bf3856ad364e35_10.0.15063.0_sv-se_b993099aee9048c9.manifest 7008e5cfbcec321d0a80bc0d8290ff2099d4268b41d84dd7598628c29e478a1d.exe File opened for modification C:\Windows\WinSxS\Backup\x86_microsoft.windows.c..-controls.resources_6595b64144ccf1df_5.82.15063.0_es-es_a1252bdb893ce37e.manifest 7008e5cfbcec321d0a80bc0d8290ff2099d4268b41d84dd7598628c29e478a1d.exe File opened for modification C:\Windows\WinSxS\Backup\x86_microsoft.windows.c..-controls.resources_6595b64144ccf1df_6.0.15063.0_es-es_6e122c03212f2631_comctl32.dll.mui_0da4e682 7008e5cfbcec321d0a80bc0d8290ff2099d4268b41d84dd7598628c29e478a1d.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-font-bitmap-terminal_31bf3856ad364e35_10.0.15063.0_none_2583321dfa2b45c4_ega40woa.fon_70a9c7e3 7008e5cfbcec321d0a80bc0d8290ff2099d4268b41d84dd7598628c29e478a1d.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-smartcardsubsystem_31bf3856ad364e35_10.0.15063.0_none_291118dda2c1a1ca_scardbi.dll_7b3c4f7a 7008e5cfbcec321d0a80bc0d8290ff2099d4268b41d84dd7598628c29e478a1d.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft.windows.c..-controls.resources_6595b64144ccf1df_5.82.15063.0_sk-sk_41e8b481bab8b6a4.manifest 7008e5cfbcec321d0a80bc0d8290ff2099d4268b41d84dd7598628c29e478a1d.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft.windows.c..-controls.resources_6595b64144ccf1df_6.0.15063.0_ja-jp_5569e07ec9d20ae6_comctl32.dll.mui_0da4e682 7008e5cfbcec321d0a80bc0d8290ff2099d4268b41d84dd7598628c29e478a1d.exe File opened for modification C:\Windows\WinSxS\Backup\x86_microsoft-windows-b..ager-pcat.resources_31bf3856ad364e35_10.0.15063.0_zh-cn_33fd71df8d841cd9.manifest 7008e5cfbcec321d0a80bc0d8290ff2099d4268b41d84dd7598628c29e478a1d.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-b..iagnostic.resources_31bf3856ad364e35_10.0.15063.0_pl-pl_c7457c7a32053978.manifest 7008e5cfbcec321d0a80bc0d8290ff2099d4268b41d84dd7598628c29e478a1d.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.15063.0_de-de_e6faf81d32dd9c12.manifest 7008e5cfbcec321d0a80bc0d8290ff2099d4268b41d84dd7598628c29e478a1d.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.15063.0_lv-lv_06be8d86c3187ada_bootmgfw.efi.mui_a6e78cfa 7008e5cfbcec321d0a80bc0d8290ff2099d4268b41d84dd7598628c29e478a1d.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-security-schannel_31bf3856ad364e35_10.0.15063.0_none_332a24478e119029.manifest 7008e5cfbcec321d0a80bc0d8290ff2099d4268b41d84dd7598628c29e478a1d.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft.windows.c..-controls.resources_6595b64144ccf1df_5.82.15063.0_sv-se_3ec89a49bcc7ced5.manifest 7008e5cfbcec321d0a80bc0d8290ff2099d4268b41d84dd7598628c29e478a1d.exe File opened for modification C:\Windows\WinSxS\Backup\x86_microsoft-windows-b..ager-pcat.resources_31bf3856ad364e35_10.0.15063.0_hu-hu_be6a5a9c7dbb19ea_bootmgr.exe.mui_c434701f 7008e5cfbcec321d0a80bc0d8290ff2099d4268b41d84dd7598628c29e478a1d.exe File opened for modification C:\Windows\WinSxS\Backup\x86_microsoft.windows.c..-controls.resources_6595b64144ccf1df_5.82.15063.0_nb-no_5c26751810f1e40b.manifest 7008e5cfbcec321d0a80bc0d8290ff2099d4268b41d84dd7598628c29e478a1d.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-profsvcext_31bf3856ad364e35_10.0.15063.0_none_353d9277acca1f20_profsvcext.dll_5740fcb8 7008e5cfbcec321d0a80bc0d8290ff2099d4268b41d84dd7598628c29e478a1d.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft.windows.c..-controls.resources_6595b64144ccf1df_5.82.15063.0_ja-jp_887ce05731dfc833.manifest 7008e5cfbcec321d0a80bc0d8290ff2099d4268b41d84dd7598628c29e478a1d.exe File opened for modification C:\Windows\WinSxS\Backup\wow64_microsoft-windows-d..ndowmanager-effects_31bf3856ad364e35_10.0.15063.0_none_0c6c3963abedbb7f.manifest 7008e5cfbcec321d0a80bc0d8290ff2099d4268b41d84dd7598628c29e478a1d.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft.windows.c..-controls.resources_6595b64144ccf1df_5.82.15063.0_bg-bg_6b4cd629a017904a.manifest 7008e5cfbcec321d0a80bc0d8290ff2099d4268b41d84dd7598628c29e478a1d.exe File opened for modification C:\Windows\WinSxS\Backup\x86_microsoft-windows-b..ager-pcat.resources_31bf3856ad364e35_10.0.15063.0_sk-sk_bcb323d2ec813098.manifest 7008e5cfbcec321d0a80bc0d8290ff2099d4268b41d84dd7598628c29e478a1d.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-windowsuiimmersive_31bf3856ad364e35_10.0.15063.0_none_42e3ac5a0cd7f838_windows.ui.immersive.dll_549e9b42 7008e5cfbcec321d0a80bc0d8290ff2099d4268b41d84dd7598628c29e478a1d.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-font-bitmap-fixed_31bf3856ad364e35_10.0.15063.0_none_9023bb87676e429a_85f1255.fon_77ccac39 7008e5cfbcec321d0a80bc0d8290ff2099d4268b41d84dd7598628c29e478a1d.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-kernel32_31bf3856ad364e35_10.0.15063.0_none_a4d1be7a8f1a4216_kernel32.dll_ef9eca7e 7008e5cfbcec321d0a80bc0d8290ff2099d4268b41d84dd7598628c29e478a1d.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-s..ertificates-utility_31bf3856ad364e35_10.0.15063.0_none_9a11856b637894e6.manifest 7008e5cfbcec321d0a80bc0d8290ff2099d4268b41d84dd7598628c29e478a1d.exe File opened for modification C:\Windows\WinSxS\Backup\x86_microsoft.windows.c..-controls.resources_6595b64144ccf1df_5.82.15063.0_pt-pt_a3d7d4e7f5395f54_comctl32.dll.mui_0da4e682 7008e5cfbcec321d0a80bc0d8290ff2099d4268b41d84dd7598628c29e478a1d.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Interacts with shadow copies 2 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
Processes:
vssadmin.exepid process 3736 vssadmin.exe -
Processes:
7008e5cfbcec321d0a80bc0d8290ff2099d4268b41d84dd7598628c29e478a1d.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\SystemCertificates\CA\Certificates\48504E974C0DAC5B5CD476C8202274B24C8C7172 7008e5cfbcec321d0a80bc0d8290ff2099d4268b41d84dd7598628c29e478a1d.exe Set value (data) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\SystemCertificates\CA\Certificates\48504E974C0DAC5B5CD476C8202274B24C8C7172\Blob = 03000000010000001400000048504e974c0dac5b5cd476c8202274b24c8c7172140000000100000014000000142eb317b75856cbae500940e61faf9d8b14c2c6040000000100000010000000312128f5a0ed7ba54b6582928756ba830f00000001000000200000003286ff65a65faf32085eea1388c3738ba7e37873c906cce3c4a28b4cc2a58988190000000100000010000000f044424c506513d62804c04f719403f95c0000000100000004000000000800001800000001000000100000006cf252fec3e8f20996de5d4dd9aef424200000000100000069040000308204653082034da0030201020210400175048314a4c8218c84a90c16cddf300d06092a864886f70d01010b0500303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f74204341205833301e170d3230313030373139323134305a170d3231303932393139323134305a3032310b300906035504061302555331163014060355040a130d4c6574277320456e6372797074310b300906035504031302523330820122300d06092a864886f70d01010105000382010f003082010a0282010100bb021528ccf6a094d30f12ec8d5592c3f882f199a67a4288a75d26aab52bb9c54cb1af8e6bf975c8a3d70f4794145535578c9ea8a23919f5823c42a94e6ef53bc32edb8dc0b05cf35938e7edcf69f05a0b1bbec094242587fa3771b313e71cace19befdbe43b45524596a9c153ce34c852eeb5aeed8fde6070e2a554abb66d0e97a540346b2bd3bc66eb66347cfa6b8b8f572999f830175dba726ffb81c5add286583d17c7e709bbf12bf786dcc1da715dd446e3ccad25c188bc60677566b3f118f7a25ce653ff3a88b647a5ff1318ea9809773f9d53f9cf01e5f5a6701714af63a4ff99b3939ddc53a706fe48851da169ae2575bb13cc5203f5ed51a18bdb150203010001a38201683082016430120603551d130101ff040830060101ff020100300e0603551d0f0101ff040403020186304b06082b06010505070101043f303d303b06082b06010505073002862f687474703a2f2f617070732e6964656e74727573742e636f6d2f726f6f74732f647374726f6f74636178332e703763301f0603551d23041830168014c4a7b1a47b2c71fadbe14b9075ffc4156085891030540603551d20044d304b3008060667810c010201303f060b2b0601040182df130101013030302e06082b060105050702011622687474703a2f2f6370732e726f6f742d78312e6c657473656e63727970742e6f7267303c0603551d1f043530333031a02fa02d862b687474703a2f2f63726c2e6964656e74727573742e636f6d2f445354524f4f544341583343524c2e63726c301d0603551d0e04160414142eb317b75856cbae500940e61faf9d8b14c2c6301d0603551d250416301406082b0601050507030106082b06010505070302300d06092a864886f70d01010b05000382010100d94ce0c9f584883731dbbb13e2b3fc8b6b62126c58b7497e3c02b7a81f2861ebcee02e73ef49077a35841f1dad68f0d8fe56812f6d7f58a66e3536101c73c3e5bd6d5e01d76e72fb2aa0b8d35764e55bc269d4d0b2f77c4bc3178e887273dcfdfc6dbde3c90b8e613a16587d74362b55803dc763be8443c639a10e6b579e3f29c180f6b2bd47cbaa306cb732e159540b1809175e636cfb96673c1c730c938bc611762486de400707e47d2d66b525a39658c8ea80eecf693b96fce68dc033f389f8292d14142d7ef06170955df70be5c0fb24faec8ecb61c8ee637128a82c053b77ef9b5e0364f051d1e485535cb00297d47ec634d2ce1000e4b1df3ac2ea17be 7008e5cfbcec321d0a80bc0d8290ff2099d4268b41d84dd7598628c29e478a1d.exe -
Suspicious behavior: EnumeratesProcesses 12 IoCs
Processes:
7008e5cfbcec321d0a80bc0d8290ff2099d4268b41d84dd7598628c29e478a1d.exepid process 2116 7008e5cfbcec321d0a80bc0d8290ff2099d4268b41d84dd7598628c29e478a1d.exe 2116 7008e5cfbcec321d0a80bc0d8290ff2099d4268b41d84dd7598628c29e478a1d.exe 2116 7008e5cfbcec321d0a80bc0d8290ff2099d4268b41d84dd7598628c29e478a1d.exe 2116 7008e5cfbcec321d0a80bc0d8290ff2099d4268b41d84dd7598628c29e478a1d.exe 2116 7008e5cfbcec321d0a80bc0d8290ff2099d4268b41d84dd7598628c29e478a1d.exe 2116 7008e5cfbcec321d0a80bc0d8290ff2099d4268b41d84dd7598628c29e478a1d.exe 2116 7008e5cfbcec321d0a80bc0d8290ff2099d4268b41d84dd7598628c29e478a1d.exe 2116 7008e5cfbcec321d0a80bc0d8290ff2099d4268b41d84dd7598628c29e478a1d.exe 2116 7008e5cfbcec321d0a80bc0d8290ff2099d4268b41d84dd7598628c29e478a1d.exe 2116 7008e5cfbcec321d0a80bc0d8290ff2099d4268b41d84dd7598628c29e478a1d.exe 2116 7008e5cfbcec321d0a80bc0d8290ff2099d4268b41d84dd7598628c29e478a1d.exe 2116 7008e5cfbcec321d0a80bc0d8290ff2099d4268b41d84dd7598628c29e478a1d.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
vssvc.exedescription pid process Token: SeBackupPrivilege 3960 vssvc.exe Token: SeRestorePrivilege 3960 vssvc.exe Token: SeAuditPrivilege 3960 vssvc.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
7008e5cfbcec321d0a80bc0d8290ff2099d4268b41d84dd7598628c29e478a1d.execmd.exedescription pid process target process PID 2116 wrote to memory of 2624 2116 7008e5cfbcec321d0a80bc0d8290ff2099d4268b41d84dd7598628c29e478a1d.exe cmd.exe PID 2116 wrote to memory of 2624 2116 7008e5cfbcec321d0a80bc0d8290ff2099d4268b41d84dd7598628c29e478a1d.exe cmd.exe PID 2116 wrote to memory of 2624 2116 7008e5cfbcec321d0a80bc0d8290ff2099d4268b41d84dd7598628c29e478a1d.exe cmd.exe PID 2624 wrote to memory of 3736 2624 cmd.exe vssadmin.exe PID 2624 wrote to memory of 3736 2624 cmd.exe vssadmin.exe PID 2624 wrote to memory of 3736 2624 cmd.exe vssadmin.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\7008e5cfbcec321d0a80bc0d8290ff2099d4268b41d84dd7598628c29e478a1d.exe"C:\Users\Admin\AppData\Local\Temp\7008e5cfbcec321d0a80bc0d8290ff2099d4268b41d84dd7598628c29e478a1d.exe"1⤵
- Modifies extensions of user files
- Enumerates connected drives
- Sets desktop wallpaper using registry
- Drops file in Windows directory
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2116 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c vssadmin.exe Delete Shadows /All /Quiet & bcdedit /set {default} recoveryenabled No & bcdedit /set {default} bootstatuspolicy ignoreallfailures2⤵
- Suspicious use of WriteProcessMemory
PID:2624 -
C:\Windows\SysWOW64\vssadmin.exevssadmin.exe Delete Shadows /All /Quiet3⤵
- Interacts with shadow copies
PID:3736
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3960
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2116-115-0x0000000000580000-0x000000000058A000-memory.dmpFilesize
40KB
-
memory/2116-114-0x0000000000400000-0x00000000004C8000-memory.dmpFilesize
800KB
-
memory/2116-116-0x00000000005A0000-0x00000000006EA000-memory.dmpFilesize
1.3MB
-
memory/2116-117-0x00000000005A0000-0x00000000006EA000-memory.dmpFilesize
1.3MB
-
memory/2116-118-0x00000000005A0000-0x00000000006EA000-memory.dmpFilesize
1.3MB
-
memory/2116-119-0x00000000005A0000-0x00000000006EA000-memory.dmpFilesize
1.3MB
-
memory/2624-120-0x0000000000000000-mapping.dmp
-
memory/3736-121-0x0000000000000000-mapping.dmp