Resubmissions
23/08/2021, 11:20
210823-t1dtqdz8re1023/08/2021, 11:07
210823-hc4vgt17ej1015/07/2021, 18:16
210715-yseshdmscj10Analysis
- max time kernel
142s - max time network
155s - platform
windows10_x64 - resource
win10v20210408 - submitted
15/07/2021, 18:16
Static task
static1
Behavioral task
behavioral1
Sample
0e37d9d0a7441a98119eb1361a0605042c4db0e8369b54ba26e6ba08d9b62f1e.exe
Resource
win7v20210410
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
0e37d9d0a7441a98119eb1361a0605042c4db0e8369b54ba26e6ba08d9b62f1e.exe
Resource
win10v20210408
windows10_x64
0 signatures
0 seconds
General
- Target 0e37d9d0a7441a98119eb1361a0605042c4db0e8369b54ba26e6ba08d9b62f1e.exe
- Size 164KB
- Sample210715-yseshdmscj
- SHA256 0e37d9d0a7441a98119eb1361a0605042c4db0e8369b54ba26e6ba08d9b62f1e
- MD5 65ff37973426c09b9ff95f354e62959e
- SHA1 b53bc09cfbd292af7b3609734a99d101bd24d77e
- SHA512 c16a2997db332a9485a4d10e55c02932de06af05b15b92d64191fd3025da4b1d5be3bd630421cec410b5f03e49641ff2bdf4ad7004d70d9e03635c712ccc632c
- MD5 SHA1 SHA512
Score
10/10
Malware Config
Extracted
Path
-
C:\7k8p950bqm_Wannadie.txt
-
sodinokibi
Ransom Note
- ---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your computer has extension 7k8p950bqm. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/731FD902B6FACA31 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.top/731FD902B6FACA31 Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: 3TLM8WOO2iL8Ujqmpx6MaLnAxkZVgitpmKgHwr9ux9G61kETsSpqO5sC3AKH2b97 PKCs7Znpxgi4piz3NSQn2aDlFJ/aTNPGlgSvs0A/yVAR1fWrZeL2xQfysxA7/Smk SJ5eNIxe5dtUZoEJJeIyib/o1+sphkAQqde3MNQbDyWf6r6A5caApeBkAn5ADw3E WuoFtRJEc2wTYmh3yfDxqLoKfOKywIi7lPo2cLXKVIn4o10KBAAGrAzEzgmco8H0 D6X3AgiBXsIZP/483p8asivgxZNKutzOl5LkhRTDyaJ4uRaRm42Ylbtb7RJfq5Hd PlV4Zxl3rFP/2E2AfcIriTYeAEQNaSCt3lzv7d9hD/JwqqU1P6lzE4FiCLX6S9gq sBgJoe4LNY5SQD+eh/Eu3zbTuhuFei6eZZNCQ3qaxiCOuVV67LvuH2ceFy9mZwQQ qqvM/Kygb/wTwUrGJKosmdNQnnJPzgBE1WzPy7tDs9BdmdR2Qw0KAdrbn2286pgd Oar/iNBKPp3zJLY6cV1P62l1lfU1PqE1VmFDbeQkFFvvi3N9Nc5ixiUE5Xq9nf20 grO6yd+3nbFYvEwKIDotIdrk0PtAt0ms9Au53LXJQGlR9YjUZW0tpChlqUFQcp6N +NGBC4K7TUbMs9Hv9I2ITHj7Te3jhijZs2CAXwOjU3gtKeSxCFK/sMKtwzeI/A5l XMWH+iQuqqsULsNIE74Y8LLI0H0I5DBivIV9vCcHsI2x+7kzFHRqtLfjWWPGBRZf k92v/+StkZfufzX77OeUypj1yjXKTNvvWTKEHKWamtaGsKzUFVATNRoeU+/Gzbj8 PdBCEolAirQiNE+wtFnZM3QEmNr3qJAGdCVpy6HOPg4ynnf3dgC/xCAV0upz0etq gTP+qw36nCRKfFxR1tJOuPWFoUVgKcCmyFtiW6Ag2KA43AmOMwGi2j5xpDy2+mln ryDH9LduNy/qG5zpea3vuZVIzUp36J9sA50FXUhdmPJIfPC4ArtFKC44jYtpApiK 0Z5bQLJGD1t2ZVCm5MWEjmCP89UsAGYcyz8KwxU8Na25iHACG03Frzw/9tg/vFJq GLYM+4jU2rB9OpPUbcJlgd8uKcaRZ2XDVmyfLX1PHHfDuaYI7XSFPRDQo/aZfCLg QRRUxg== Extension name: 7k8p950bqm ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs
-
http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/731FD902B6FACA31
-
http://decryptor.top/731FD902B6FACA31
Signatures
- Sodin,Sodinokibi,REvil
Ransomware with advanced anti-analysis and privilege escalation functionality.
- Modifies extensions of user files 14 IoCs
Ransomware generally changes the extension on encrypted files.
description ioc Process File renamed C:\Users\Admin\Pictures\MoveSave.crw => \??\c:\users\admin\pictures\MoveSave.crw.7k8p950bqm 0e37d9d0a7441a98119eb1361a0605042c4db0e8369b54ba26e6ba08d9b62f1e.exe File renamed C:\Users\Admin\Pictures\RenameGroup.raw => \??\c:\users\admin\pictures\RenameGroup.raw.7k8p950bqm 0e37d9d0a7441a98119eb1361a0605042c4db0e8369b54ba26e6ba08d9b62f1e.exe File renamed C:\Users\Admin\Pictures\SearchSelect.tif => \??\c:\users\admin\pictures\SearchSelect.tif.7k8p950bqm 0e37d9d0a7441a98119eb1361a0605042c4db0e8369b54ba26e6ba08d9b62f1e.exe File opened for modification \??\c:\users\admin\pictures\BlockImport.tiff 0e37d9d0a7441a98119eb1361a0605042c4db0e8369b54ba26e6ba08d9b62f1e.exe File renamed C:\Users\Admin\Pictures\UpdateStart.png => \??\c:\users\admin\pictures\UpdateStart.png.7k8p950bqm 0e37d9d0a7441a98119eb1361a0605042c4db0e8369b54ba26e6ba08d9b62f1e.exe File renamed C:\Users\Admin\Pictures\GrantMount.tif => \??\c:\users\admin\pictures\GrantMount.tif.7k8p950bqm 0e37d9d0a7441a98119eb1361a0605042c4db0e8369b54ba26e6ba08d9b62f1e.exe File renamed C:\Users\Admin\Pictures\InstallClear.crw => \??\c:\users\admin\pictures\InstallClear.crw.7k8p950bqm 0e37d9d0a7441a98119eb1361a0605042c4db0e8369b54ba26e6ba08d9b62f1e.exe File renamed C:\Users\Admin\Pictures\ResetGroup.png => \??\c:\users\admin\pictures\ResetGroup.png.7k8p950bqm 0e37d9d0a7441a98119eb1361a0605042c4db0e8369b54ba26e6ba08d9b62f1e.exe File renamed C:\Users\Admin\Pictures\ResetRead.raw => \??\c:\users\admin\pictures\ResetRead.raw.7k8p950bqm 0e37d9d0a7441a98119eb1361a0605042c4db0e8369b54ba26e6ba08d9b62f1e.exe File renamed C:\Users\Admin\Pictures\BlockImport.tiff => \??\c:\users\admin\pictures\BlockImport.tiff.7k8p950bqm 0e37d9d0a7441a98119eb1361a0605042c4db0e8369b54ba26e6ba08d9b62f1e.exe File renamed C:\Users\Admin\Pictures\DebugTrace.tif => \??\c:\users\admin\pictures\DebugTrace.tif.7k8p950bqm 0e37d9d0a7441a98119eb1361a0605042c4db0e8369b54ba26e6ba08d9b62f1e.exe File renamed C:\Users\Admin\Pictures\ImportEnter.raw => \??\c:\users\admin\pictures\ImportEnter.raw.7k8p950bqm 0e37d9d0a7441a98119eb1361a0605042c4db0e8369b54ba26e6ba08d9b62f1e.exe File renamed C:\Users\Admin\Pictures\SetDisconnect.png => \??\c:\users\admin\pictures\SetDisconnect.png.7k8p950bqm 0e37d9d0a7441a98119eb1361a0605042c4db0e8369b54ba26e6ba08d9b62f1e.exe File renamed C:\Users\Admin\Pictures\UseExport.png => \??\c:\users\admin\pictures\UseExport.png.7k8p950bqm 0e37d9d0a7441a98119eb1361a0605042c4db0e8369b54ba26e6ba08d9b62f1e.exe - Enumerates connected drives 3 TTPs 25 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\M: 0e37d9d0a7441a98119eb1361a0605042c4db0e8369b54ba26e6ba08d9b62f1e.exe File opened (read-only) \??\Q: 0e37d9d0a7441a98119eb1361a0605042c4db0e8369b54ba26e6ba08d9b62f1e.exe File opened (read-only) \??\S: 0e37d9d0a7441a98119eb1361a0605042c4db0e8369b54ba26e6ba08d9b62f1e.exe File opened (read-only) \??\W: 0e37d9d0a7441a98119eb1361a0605042c4db0e8369b54ba26e6ba08d9b62f1e.exe File opened (read-only) \??\Y: 0e37d9d0a7441a98119eb1361a0605042c4db0e8369b54ba26e6ba08d9b62f1e.exe File opened (read-only) \??\D: 0e37d9d0a7441a98119eb1361a0605042c4db0e8369b54ba26e6ba08d9b62f1e.exe File opened (read-only) \??\B: 0e37d9d0a7441a98119eb1361a0605042c4db0e8369b54ba26e6ba08d9b62f1e.exe File opened (read-only) \??\G: 0e37d9d0a7441a98119eb1361a0605042c4db0e8369b54ba26e6ba08d9b62f1e.exe File opened (read-only) \??\K: 0e37d9d0a7441a98119eb1361a0605042c4db0e8369b54ba26e6ba08d9b62f1e.exe File opened (read-only) \??\O: 0e37d9d0a7441a98119eb1361a0605042c4db0e8369b54ba26e6ba08d9b62f1e.exe File opened (read-only) \??\R: 0e37d9d0a7441a98119eb1361a0605042c4db0e8369b54ba26e6ba08d9b62f1e.exe File opened (read-only) \??\Z: 0e37d9d0a7441a98119eb1361a0605042c4db0e8369b54ba26e6ba08d9b62f1e.exe File opened (read-only) \??\X: 0e37d9d0a7441a98119eb1361a0605042c4db0e8369b54ba26e6ba08d9b62f1e.exe File opened (read-only) \??\F: 0e37d9d0a7441a98119eb1361a0605042c4db0e8369b54ba26e6ba08d9b62f1e.exe File opened (read-only) \??\I: 0e37d9d0a7441a98119eb1361a0605042c4db0e8369b54ba26e6ba08d9b62f1e.exe File opened (read-only) \??\J: 0e37d9d0a7441a98119eb1361a0605042c4db0e8369b54ba26e6ba08d9b62f1e.exe File opened (read-only) \??\L: 0e37d9d0a7441a98119eb1361a0605042c4db0e8369b54ba26e6ba08d9b62f1e.exe File opened (read-only) \??\N: 0e37d9d0a7441a98119eb1361a0605042c4db0e8369b54ba26e6ba08d9b62f1e.exe File opened (read-only) \??\P: 0e37d9d0a7441a98119eb1361a0605042c4db0e8369b54ba26e6ba08d9b62f1e.exe File opened (read-only) \??\A: 0e37d9d0a7441a98119eb1361a0605042c4db0e8369b54ba26e6ba08d9b62f1e.exe File opened (read-only) \??\E: 0e37d9d0a7441a98119eb1361a0605042c4db0e8369b54ba26e6ba08d9b62f1e.exe File opened (read-only) \??\H: 0e37d9d0a7441a98119eb1361a0605042c4db0e8369b54ba26e6ba08d9b62f1e.exe File opened (read-only) \??\T: 0e37d9d0a7441a98119eb1361a0605042c4db0e8369b54ba26e6ba08d9b62f1e.exe File opened (read-only) \??\U: 0e37d9d0a7441a98119eb1361a0605042c4db0e8369b54ba26e6ba08d9b62f1e.exe File opened (read-only) \??\V: 0e37d9d0a7441a98119eb1361a0605042c4db0e8369b54ba26e6ba08d9b62f1e.exe - Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\System32\CatRoot2\dberr.txt powershell.exe - Sets desktop wallpaper using registry 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ca66xag5.bmp" 0e37d9d0a7441a98119eb1361a0605042c4db0e8369b54ba26e6ba08d9b62f1e.exe - Drops file in Program Files directory 35 IoCs
description ioc Process File opened for modification \??\c:\program files\LockPublish.fon 0e37d9d0a7441a98119eb1361a0605042c4db0e8369b54ba26e6ba08d9b62f1e.exe File opened for modification \??\c:\program files\SwitchBackup.i64 0e37d9d0a7441a98119eb1361a0605042c4db0e8369b54ba26e6ba08d9b62f1e.exe File opened for modification \??\c:\program files\WriteDismount.jpeg 0e37d9d0a7441a98119eb1361a0605042c4db0e8369b54ba26e6ba08d9b62f1e.exe File created \??\c:\program files\7k8p950bqm_Wannadie.txt 0e37d9d0a7441a98119eb1361a0605042c4db0e8369b54ba26e6ba08d9b62f1e.exe File opened for modification \??\c:\program files\CompareRegister.ini 0e37d9d0a7441a98119eb1361a0605042c4db0e8369b54ba26e6ba08d9b62f1e.exe File opened for modification \??\c:\program files\CopyWrite.gif 0e37d9d0a7441a98119eb1361a0605042c4db0e8369b54ba26e6ba08d9b62f1e.exe File opened for modification \??\c:\program files\RestoreConnect.pcx 0e37d9d0a7441a98119eb1361a0605042c4db0e8369b54ba26e6ba08d9b62f1e.exe File opened for modification \??\c:\program files\SplitDisconnect.rtf 0e37d9d0a7441a98119eb1361a0605042c4db0e8369b54ba26e6ba08d9b62f1e.exe File opened for modification \??\c:\program files\ClearConvertTo.temp 0e37d9d0a7441a98119eb1361a0605042c4db0e8369b54ba26e6ba08d9b62f1e.exe File opened for modification \??\c:\program files\WaitUnpublish.txt 0e37d9d0a7441a98119eb1361a0605042c4db0e8369b54ba26e6ba08d9b62f1e.exe File opened for modification \??\c:\program files\CompleteInvoke.mpeg2 0e37d9d0a7441a98119eb1361a0605042c4db0e8369b54ba26e6ba08d9b62f1e.exe File opened for modification \??\c:\program files\ConfirmDisconnect.mp2 0e37d9d0a7441a98119eb1361a0605042c4db0e8369b54ba26e6ba08d9b62f1e.exe File opened for modification \??\c:\program files\DebugWatch.m1v 0e37d9d0a7441a98119eb1361a0605042c4db0e8369b54ba26e6ba08d9b62f1e.exe File opened for modification \??\c:\program files\ReceiveFormat.M2V 0e37d9d0a7441a98119eb1361a0605042c4db0e8369b54ba26e6ba08d9b62f1e.exe File opened for modification \??\c:\program files\RegisterConfirm.M2V 0e37d9d0a7441a98119eb1361a0605042c4db0e8369b54ba26e6ba08d9b62f1e.exe File opened for modification \??\c:\program files\DenyNew.inf 0e37d9d0a7441a98119eb1361a0605042c4db0e8369b54ba26e6ba08d9b62f1e.exe File opened for modification \??\c:\program files\ExpandSend.otf 0e37d9d0a7441a98119eb1361a0605042c4db0e8369b54ba26e6ba08d9b62f1e.exe File opened for modification \??\c:\program files\UnpublishDebug.mid 0e37d9d0a7441a98119eb1361a0605042c4db0e8369b54ba26e6ba08d9b62f1e.exe File opened for modification \??\c:\program files\ClearEnter.MTS 0e37d9d0a7441a98119eb1361a0605042c4db0e8369b54ba26e6ba08d9b62f1e.exe File opened for modification \??\c:\program files\CompressRestart.zip 0e37d9d0a7441a98119eb1361a0605042c4db0e8369b54ba26e6ba08d9b62f1e.exe File opened for modification \??\c:\program files\ReadStop.eprtx 0e37d9d0a7441a98119eb1361a0605042c4db0e8369b54ba26e6ba08d9b62f1e.exe File opened for modification \??\c:\program files\SelectReceive.xlt 0e37d9d0a7441a98119eb1361a0605042c4db0e8369b54ba26e6ba08d9b62f1e.exe File opened for modification \??\c:\program files\SkipStep.dotx 0e37d9d0a7441a98119eb1361a0605042c4db0e8369b54ba26e6ba08d9b62f1e.exe File opened for modification \??\c:\program files\TraceResume.DVR-MS 0e37d9d0a7441a98119eb1361a0605042c4db0e8369b54ba26e6ba08d9b62f1e.exe File opened for modification \??\c:\program files\CheckpointMount.m4v 0e37d9d0a7441a98119eb1361a0605042c4db0e8369b54ba26e6ba08d9b62f1e.exe File opened for modification \??\c:\program files\DismountWatch.xlt 0e37d9d0a7441a98119eb1361a0605042c4db0e8369b54ba26e6ba08d9b62f1e.exe File opened for modification \??\c:\program files\RestartConvertTo.pptm 0e37d9d0a7441a98119eb1361a0605042c4db0e8369b54ba26e6ba08d9b62f1e.exe File opened for modification \??\c:\program files\SplitEnter.7z 0e37d9d0a7441a98119eb1361a0605042c4db0e8369b54ba26e6ba08d9b62f1e.exe File created \??\c:\program files (x86)\7k8p950bqm_Wannadie.txt 0e37d9d0a7441a98119eb1361a0605042c4db0e8369b54ba26e6ba08d9b62f1e.exe File opened for modification \??\c:\program files\CompleteLimit.reg 0e37d9d0a7441a98119eb1361a0605042c4db0e8369b54ba26e6ba08d9b62f1e.exe File opened for modification \??\c:\program files\ConvertEnable.3gp 0e37d9d0a7441a98119eb1361a0605042c4db0e8369b54ba26e6ba08d9b62f1e.exe File opened for modification \??\c:\program files\LimitRemove.png 0e37d9d0a7441a98119eb1361a0605042c4db0e8369b54ba26e6ba08d9b62f1e.exe File opened for modification \??\c:\program files\PingGroup.htm 0e37d9d0a7441a98119eb1361a0605042c4db0e8369b54ba26e6ba08d9b62f1e.exe File opened for modification \??\c:\program files\SearchSync.midi 0e37d9d0a7441a98119eb1361a0605042c4db0e8369b54ba26e6ba08d9b62f1e.exe File opened for modification \??\c:\program files\WatchImport.7z 0e37d9d0a7441a98119eb1361a0605042c4db0e8369b54ba26e6ba08d9b62f1e.exe - Modifies data under HKEY_USERS 42 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople powershell.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000 powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates powershell.exe - Suspicious behavior: EnumeratesProcesses 15 IoCs
pid Process 664 0e37d9d0a7441a98119eb1361a0605042c4db0e8369b54ba26e6ba08d9b62f1e.exe 664 0e37d9d0a7441a98119eb1361a0605042c4db0e8369b54ba26e6ba08d9b62f1e.exe 664 0e37d9d0a7441a98119eb1361a0605042c4db0e8369b54ba26e6ba08d9b62f1e.exe 664 0e37d9d0a7441a98119eb1361a0605042c4db0e8369b54ba26e6ba08d9b62f1e.exe 712 powershell.exe 712 powershell.exe 712 powershell.exe 664 0e37d9d0a7441a98119eb1361a0605042c4db0e8369b54ba26e6ba08d9b62f1e.exe 664 0e37d9d0a7441a98119eb1361a0605042c4db0e8369b54ba26e6ba08d9b62f1e.exe 664 0e37d9d0a7441a98119eb1361a0605042c4db0e8369b54ba26e6ba08d9b62f1e.exe 664 0e37d9d0a7441a98119eb1361a0605042c4db0e8369b54ba26e6ba08d9b62f1e.exe 664 0e37d9d0a7441a98119eb1361a0605042c4db0e8369b54ba26e6ba08d9b62f1e.exe 664 0e37d9d0a7441a98119eb1361a0605042c4db0e8369b54ba26e6ba08d9b62f1e.exe 664 0e37d9d0a7441a98119eb1361a0605042c4db0e8369b54ba26e6ba08d9b62f1e.exe 664 0e37d9d0a7441a98119eb1361a0605042c4db0e8369b54ba26e6ba08d9b62f1e.exe - Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 712 powershell.exe Token: SeBackupPrivilege 2236 vssvc.exe Token: SeRestorePrivilege 2236 vssvc.exe Token: SeAuditPrivilege 2236 vssvc.exe - Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 664 wrote to memory of 712 664 0e37d9d0a7441a98119eb1361a0605042c4db0e8369b54ba26e6ba08d9b62f1e.exe 78 PID 664 wrote to memory of 712 664 0e37d9d0a7441a98119eb1361a0605042c4db0e8369b54ba26e6ba08d9b62f1e.exe 78
Processes
-
C:\Users\Admin\AppData\Local\Temp\0e37d9d0a7441a98119eb1361a0605042c4db0e8369b54ba26e6ba08d9b62f1e.exe"C:\Users\Admin\AppData\Local\Temp\0e37d9d0a7441a98119eb1361a0605042c4db0e8369b54ba26e6ba08d9b62f1e.exe"1⤵
- Modifies extensions of user files
- Enumerates connected drives
- Sets desktop wallpaper using registry
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:664 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -e RwBlAHQALQBXAG0AaQBPAGIAagBlAGMAdAAgAFcAaQBuADMAMgBfAFMAaABhAGQAbwB3AGMAbwBwAHkAIAB8ACAARgBvAHIARQBhAGMAaAAtAE8AYgBqAGUAYwB0ACAAewAkAF8ALgBEAGUAbABlAHQAZQAoACkAOwB9AA==2⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:712
-
-
C:\Windows\system32\wbem\unsecapp.exeC:\Windows\system32\wbem\unsecapp.exe -Embedding1⤵PID:420
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2236