Analysis
-
max time kernel
158s -
max time network
177s -
platform
windows10_x64 -
resource
win10v20210408 -
submitted
26-07-2021 13:00
Static task
static1
Behavioral task
behavioral1
Sample
51f7bcc2da2c7a0704f1f537c42279b0fa3d3a72808bc8938880de88b21945b9.sample.exe
Resource
win7v20210408
Behavioral task
behavioral2
Sample
51f7bcc2da2c7a0704f1f537c42279b0fa3d3a72808bc8938880de88b21945b9.sample.exe
Resource
win10v20210408
General
-
Target
51f7bcc2da2c7a0704f1f537c42279b0fa3d3a72808bc8938880de88b21945b9.sample.exe
-
Size
160KB
-
MD5
4c89514501b718a7b10da559ae819b69
-
SHA1
fec64e1dc251feee03590db4205425d5809febff
-
SHA256
51f7bcc2da2c7a0704f1f537c42279b0fa3d3a72808bc8938880de88b21945b9
-
SHA512
2228bd2b8b66ebe8e3a2b56b624b61a696e87c7bf74225cfc4708c77099721d03d4f257c99e3bed85aaea5e7395aa32c4cbbbb76d8a298baebcb6e6bf0397a3a
Malware Config
Extracted
C:\7m8ue-readme.txt
sodinokibi
http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/17E845FF35FEA3A2
http://decryptor.top/17E845FF35FEA3A2
Signatures
-
Sodin,Sodinokibi,REvil
Ransomware with advanced anti-analysis and privilege escalation functionality.
-
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Modifies extensions of user files 11 IoCs
Ransomware generally changes the extension on encrypted files.
Processes:
51f7bcc2da2c7a0704f1f537c42279b0fa3d3a72808bc8938880de88b21945b9.sample.exedescription ioc process File renamed C:\Users\Admin\Pictures\CheckpointClear.png => \??\c:\users\admin\pictures\CheckpointClear.png.7m8ue 51f7bcc2da2c7a0704f1f537c42279b0fa3d3a72808bc8938880de88b21945b9.sample.exe File renamed C:\Users\Admin\Pictures\DismountFind.png => \??\c:\users\admin\pictures\DismountFind.png.7m8ue 51f7bcc2da2c7a0704f1f537c42279b0fa3d3a72808bc8938880de88b21945b9.sample.exe File renamed C:\Users\Admin\Pictures\HideGrant.raw => \??\c:\users\admin\pictures\HideGrant.raw.7m8ue 51f7bcc2da2c7a0704f1f537c42279b0fa3d3a72808bc8938880de88b21945b9.sample.exe File renamed C:\Users\Admin\Pictures\ResetCompress.png => \??\c:\users\admin\pictures\ResetCompress.png.7m8ue 51f7bcc2da2c7a0704f1f537c42279b0fa3d3a72808bc8938880de88b21945b9.sample.exe File renamed C:\Users\Admin\Pictures\UseOut.tif => \??\c:\users\admin\pictures\UseOut.tif.7m8ue 51f7bcc2da2c7a0704f1f537c42279b0fa3d3a72808bc8938880de88b21945b9.sample.exe File renamed C:\Users\Admin\Pictures\JoinPush.crw => \??\c:\users\admin\pictures\JoinPush.crw.7m8ue 51f7bcc2da2c7a0704f1f537c42279b0fa3d3a72808bc8938880de88b21945b9.sample.exe File renamed C:\Users\Admin\Pictures\DisableRegister.tif => \??\c:\users\admin\pictures\DisableRegister.tif.7m8ue 51f7bcc2da2c7a0704f1f537c42279b0fa3d3a72808bc8938880de88b21945b9.sample.exe File renamed C:\Users\Admin\Pictures\EnterCopy.crw => \??\c:\users\admin\pictures\EnterCopy.crw.7m8ue 51f7bcc2da2c7a0704f1f537c42279b0fa3d3a72808bc8938880de88b21945b9.sample.exe File renamed C:\Users\Admin\Pictures\LimitPing.png => \??\c:\users\admin\pictures\LimitPing.png.7m8ue 51f7bcc2da2c7a0704f1f537c42279b0fa3d3a72808bc8938880de88b21945b9.sample.exe File renamed C:\Users\Admin\Pictures\MoveOpen.raw => \??\c:\users\admin\pictures\MoveOpen.raw.7m8ue 51f7bcc2da2c7a0704f1f537c42279b0fa3d3a72808bc8938880de88b21945b9.sample.exe File renamed C:\Users\Admin\Pictures\ResizeWrite.raw => \??\c:\users\admin\pictures\ResizeWrite.raw.7m8ue 51f7bcc2da2c7a0704f1f537c42279b0fa3d3a72808bc8938880de88b21945b9.sample.exe -
Enumerates connected drives 3 TTPs 25 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
51f7bcc2da2c7a0704f1f537c42279b0fa3d3a72808bc8938880de88b21945b9.sample.exedescription ioc process File opened (read-only) \??\R: 51f7bcc2da2c7a0704f1f537c42279b0fa3d3a72808bc8938880de88b21945b9.sample.exe File opened (read-only) \??\X: 51f7bcc2da2c7a0704f1f537c42279b0fa3d3a72808bc8938880de88b21945b9.sample.exe File opened (read-only) \??\Y: 51f7bcc2da2c7a0704f1f537c42279b0fa3d3a72808bc8938880de88b21945b9.sample.exe File opened (read-only) \??\H: 51f7bcc2da2c7a0704f1f537c42279b0fa3d3a72808bc8938880de88b21945b9.sample.exe File opened (read-only) \??\L: 51f7bcc2da2c7a0704f1f537c42279b0fa3d3a72808bc8938880de88b21945b9.sample.exe File opened (read-only) \??\N: 51f7bcc2da2c7a0704f1f537c42279b0fa3d3a72808bc8938880de88b21945b9.sample.exe File opened (read-only) \??\U: 51f7bcc2da2c7a0704f1f537c42279b0fa3d3a72808bc8938880de88b21945b9.sample.exe File opened (read-only) \??\V: 51f7bcc2da2c7a0704f1f537c42279b0fa3d3a72808bc8938880de88b21945b9.sample.exe File opened (read-only) \??\F: 51f7bcc2da2c7a0704f1f537c42279b0fa3d3a72808bc8938880de88b21945b9.sample.exe File opened (read-only) \??\K: 51f7bcc2da2c7a0704f1f537c42279b0fa3d3a72808bc8938880de88b21945b9.sample.exe File opened (read-only) \??\P: 51f7bcc2da2c7a0704f1f537c42279b0fa3d3a72808bc8938880de88b21945b9.sample.exe File opened (read-only) \??\G: 51f7bcc2da2c7a0704f1f537c42279b0fa3d3a72808bc8938880de88b21945b9.sample.exe File opened (read-only) \??\I: 51f7bcc2da2c7a0704f1f537c42279b0fa3d3a72808bc8938880de88b21945b9.sample.exe File opened (read-only) \??\S: 51f7bcc2da2c7a0704f1f537c42279b0fa3d3a72808bc8938880de88b21945b9.sample.exe File opened (read-only) \??\T: 51f7bcc2da2c7a0704f1f537c42279b0fa3d3a72808bc8938880de88b21945b9.sample.exe File opened (read-only) \??\A: 51f7bcc2da2c7a0704f1f537c42279b0fa3d3a72808bc8938880de88b21945b9.sample.exe File opened (read-only) \??\B: 51f7bcc2da2c7a0704f1f537c42279b0fa3d3a72808bc8938880de88b21945b9.sample.exe File opened (read-only) \??\E: 51f7bcc2da2c7a0704f1f537c42279b0fa3d3a72808bc8938880de88b21945b9.sample.exe File opened (read-only) \??\Q: 51f7bcc2da2c7a0704f1f537c42279b0fa3d3a72808bc8938880de88b21945b9.sample.exe File opened (read-only) \??\W: 51f7bcc2da2c7a0704f1f537c42279b0fa3d3a72808bc8938880de88b21945b9.sample.exe File opened (read-only) \??\Z: 51f7bcc2da2c7a0704f1f537c42279b0fa3d3a72808bc8938880de88b21945b9.sample.exe File opened (read-only) \??\D: 51f7bcc2da2c7a0704f1f537c42279b0fa3d3a72808bc8938880de88b21945b9.sample.exe File opened (read-only) \??\J: 51f7bcc2da2c7a0704f1f537c42279b0fa3d3a72808bc8938880de88b21945b9.sample.exe File opened (read-only) \??\M: 51f7bcc2da2c7a0704f1f537c42279b0fa3d3a72808bc8938880de88b21945b9.sample.exe File opened (read-only) \??\O: 51f7bcc2da2c7a0704f1f537c42279b0fa3d3a72808bc8938880de88b21945b9.sample.exe -
Sets desktop wallpaper using registry 2 TTPs 1 IoCs
Processes:
51f7bcc2da2c7a0704f1f537c42279b0fa3d3a72808bc8938880de88b21945b9.sample.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\6dx37vm.bmp" 51f7bcc2da2c7a0704f1f537c42279b0fa3d3a72808bc8938880de88b21945b9.sample.exe -
Drops file in Program Files directory 25 IoCs
Processes:
51f7bcc2da2c7a0704f1f537c42279b0fa3d3a72808bc8938880de88b21945b9.sample.exedescription ioc process File opened for modification \??\c:\program files\ConvertFromUndo.pptx 51f7bcc2da2c7a0704f1f537c42279b0fa3d3a72808bc8938880de88b21945b9.sample.exe File opened for modification \??\c:\program files\MergeTest.jtx 51f7bcc2da2c7a0704f1f537c42279b0fa3d3a72808bc8938880de88b21945b9.sample.exe File opened for modification \??\c:\program files\OptimizeGroup.mpg 51f7bcc2da2c7a0704f1f537c42279b0fa3d3a72808bc8938880de88b21945b9.sample.exe File opened for modification \??\c:\program files\RemoveOpen.temp 51f7bcc2da2c7a0704f1f537c42279b0fa3d3a72808bc8938880de88b21945b9.sample.exe File opened for modification \??\c:\program files\RestoreRemove.vstx 51f7bcc2da2c7a0704f1f537c42279b0fa3d3a72808bc8938880de88b21945b9.sample.exe File opened for modification \??\c:\program files\SendProtect.pub 51f7bcc2da2c7a0704f1f537c42279b0fa3d3a72808bc8938880de88b21945b9.sample.exe File opened for modification \??\c:\program files\ShowGrant.kix 51f7bcc2da2c7a0704f1f537c42279b0fa3d3a72808bc8938880de88b21945b9.sample.exe File created \??\c:\program files\76e3f01b.lock 51f7bcc2da2c7a0704f1f537c42279b0fa3d3a72808bc8938880de88b21945b9.sample.exe File opened for modification \??\c:\program files\CloseDisable.pcx 51f7bcc2da2c7a0704f1f537c42279b0fa3d3a72808bc8938880de88b21945b9.sample.exe File opened for modification \??\c:\program files\HideSync.m1v 51f7bcc2da2c7a0704f1f537c42279b0fa3d3a72808bc8938880de88b21945b9.sample.exe File opened for modification \??\c:\program files\PopEnable.wma 51f7bcc2da2c7a0704f1f537c42279b0fa3d3a72808bc8938880de88b21945b9.sample.exe File opened for modification \??\c:\program files\SendAdd.rtf 51f7bcc2da2c7a0704f1f537c42279b0fa3d3a72808bc8938880de88b21945b9.sample.exe File opened for modification \??\c:\program files\StopCompress.mht 51f7bcc2da2c7a0704f1f537c42279b0fa3d3a72808bc8938880de88b21945b9.sample.exe File opened for modification \??\c:\program files\SubmitJoin.aiff 51f7bcc2da2c7a0704f1f537c42279b0fa3d3a72808bc8938880de88b21945b9.sample.exe File created \??\c:\program files\7m8ue-readme.txt 51f7bcc2da2c7a0704f1f537c42279b0fa3d3a72808bc8938880de88b21945b9.sample.exe File created \??\c:\program files (x86)\76e3f01b.lock 51f7bcc2da2c7a0704f1f537c42279b0fa3d3a72808bc8938880de88b21945b9.sample.exe File opened for modification \??\c:\program files\UnregisterSave.mp2 51f7bcc2da2c7a0704f1f537c42279b0fa3d3a72808bc8938880de88b21945b9.sample.exe File created \??\c:\program files (x86)\7m8ue-readme.txt 51f7bcc2da2c7a0704f1f537c42279b0fa3d3a72808bc8938880de88b21945b9.sample.exe File opened for modification \??\c:\program files\InvokeRead.rtf 51f7bcc2da2c7a0704f1f537c42279b0fa3d3a72808bc8938880de88b21945b9.sample.exe File opened for modification \??\c:\program files\RedoUnprotect.clr 51f7bcc2da2c7a0704f1f537c42279b0fa3d3a72808bc8938880de88b21945b9.sample.exe File opened for modification \??\c:\program files\ResolveAdd.wma 51f7bcc2da2c7a0704f1f537c42279b0fa3d3a72808bc8938880de88b21945b9.sample.exe File opened for modification \??\c:\program files\SelectUninstall.dib 51f7bcc2da2c7a0704f1f537c42279b0fa3d3a72808bc8938880de88b21945b9.sample.exe File opened for modification \??\c:\program files\UninstallEdit.potm 51f7bcc2da2c7a0704f1f537c42279b0fa3d3a72808bc8938880de88b21945b9.sample.exe File opened for modification \??\c:\program files\UninstallStart.tiff 51f7bcc2da2c7a0704f1f537c42279b0fa3d3a72808bc8938880de88b21945b9.sample.exe File opened for modification \??\c:\program files\EnterAssert.htm 51f7bcc2da2c7a0704f1f537c42279b0fa3d3a72808bc8938880de88b21945b9.sample.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Interacts with shadow copies 2 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
Processes:
vssadmin.exepid process 4256 vssadmin.exe -
Processes:
51f7bcc2da2c7a0704f1f537c42279b0fa3d3a72808bc8938880de88b21945b9.sample.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\02FAF3E291435468607857694DF5E45B68851868 51f7bcc2da2c7a0704f1f537c42279b0fa3d3a72808bc8938880de88b21945b9.sample.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\02FAF3E291435468607857694DF5E45B68851868\Blob = 0f000000010000001400000009b9105c5bba24343ca7f341c624e183f6ee7c1b090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00b00000001000000260000005300650063007400690067006f00200028004100640064005400720075007300740029000000620000000100000020000000687fa451382278fff0c8b11f8d43d576671c6eb2bceab413fb83d965d06d2ff2140000000100000014000000adbd987a34b426f7fac42654ef03bde024cb541a1d000000010000001000000006f9583c00a763c23fb9e065a3366d557e0000000100000008000000000063f58926d70103000000010000001400000002faf3e291435468607857694df5e45b6885186820000000010000003a040000308204363082031ea003020102020101300d06092a864886f70d0101050500306f310b300906035504061302534531143012060355040a130b416464547275737420414231263024060355040b131d41646454727573742045787465726e616c20545450204e6574776f726b312230200603550403131941646454727573742045787465726e616c20434120526f6f74301e170d3030303533303130343833385a170d3230303533303130343833385a306f310b300906035504061302534531143012060355040a130b416464547275737420414231263024060355040b131d41646454727573742045787465726e616c20545450204e6574776f726b312230200603550403131941646454727573742045787465726e616c20434120526f6f7430820122300d06092a864886f70d01010105000382010f003082010a0282010100b7f71a33e6f200042d39e04e5bed1fbc6c0fcdb5fa23b6cede9b113397a4294c7d939fbd4abc93ed031ae38fcfe56d505ad69729945a80b0497adb2e95fdb8cabf37382d1e3e9141ad7056c7f04f3fe8329e74cac89054e9c65f0f789d9a403c0eac61aa5e148f9e87a16a50dcd79a4eaf05b3a671949c71b350600ac7139d38078602a8e9a869261890ab4cb04f23ab3a4f84d8dfce9fe1696fbbd742d76b44e4c7adee6d415f725a710837b37965a459a09437f7002f0dc29272dad03872db14a845c45d2a7db7b4d6c4eeaccd1344b7c92bdd430025fa61b9696a582311b7a7338f567559f5cd29d746b70a2b65b6d3426f15b2b87bfbefe95d53d5345a270203010001a381dc3081d9301d0603551d0e04160414adbd987a34b426f7fac42654ef03bde024cb541a300b0603551d0f040403020106300f0603551d130101ff040530030101ff3081990603551d2304819130818e8014adbd987a34b426f7fac42654ef03bde024cb541aa173a471306f310b300906035504061302534531143012060355040a130b416464547275737420414231263024060355040b131d41646454727573742045787465726e616c20545450204e6574776f726b312230200603550403131941646454727573742045787465726e616c20434120526f6f74820101300d06092a864886f70d01010505000382010100b09be08525c2d623e20f9606929d41989cd9847981d91e5b14072336658fb0d877bbac416c47608351b0f9323de7fcf62613c78016a5bf5afc87cf787989219ae24c070a8635bcf2de51c4d296b7dc7e4eee70fd1c39eb0c0251142d8ebd16e0c1df4675e724adecf442b48593701067ba9d06354a18d32b7acc5142a17a63d1e6bba1c52bc236be130de6bd637e797ba7090d40ab6add8f8ac3f6f68c1a420551d445f59fa76221681520433c99e77cbd24d8a9911773883f561b313818b4710f9acdc80e9e8e2e1be18c9883cb1f31f1444cc604734976600fc7f8bd17806b2ee9cc4c0e5a9a790f200a2ed59e63261e559294d882175a7bd0bcc78f4e8604 51f7bcc2da2c7a0704f1f537c42279b0fa3d3a72808bc8938880de88b21945b9.sample.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\02FAF3E291435468607857694DF5E45B68851868\Blob = 0400000001000000100000001d3554048578b03f42424dbf20730a3f03000000010000001400000002faf3e291435468607857694df5e45b688518687e0000000100000008000000000063f58926d7011d000000010000001000000006f9583c00a763c23fb9e065a3366d55140000000100000014000000adbd987a34b426f7fac42654ef03bde024cb541a620000000100000020000000687fa451382278fff0c8b11f8d43d576671c6eb2bceab413fb83d965d06d2ff20b00000001000000260000005300650063007400690067006f0020002800410064006400540072007500730074002900000053000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b060105050703080f000000010000001400000009b9105c5bba24343ca7f341c624e183f6ee7c1b20000000010000003a040000308204363082031ea003020102020101300d06092a864886f70d0101050500306f310b300906035504061302534531143012060355040a130b416464547275737420414231263024060355040b131d41646454727573742045787465726e616c20545450204e6574776f726b312230200603550403131941646454727573742045787465726e616c20434120526f6f74301e170d3030303533303130343833385a170d3230303533303130343833385a306f310b300906035504061302534531143012060355040a130b416464547275737420414231263024060355040b131d41646454727573742045787465726e616c20545450204e6574776f726b312230200603550403131941646454727573742045787465726e616c20434120526f6f7430820122300d06092a864886f70d01010105000382010f003082010a0282010100b7f71a33e6f200042d39e04e5bed1fbc6c0fcdb5fa23b6cede9b113397a4294c7d939fbd4abc93ed031ae38fcfe56d505ad69729945a80b0497adb2e95fdb8cabf37382d1e3e9141ad7056c7f04f3fe8329e74cac89054e9c65f0f789d9a403c0eac61aa5e148f9e87a16a50dcd79a4eaf05b3a671949c71b350600ac7139d38078602a8e9a869261890ab4cb04f23ab3a4f84d8dfce9fe1696fbbd742d76b44e4c7adee6d415f725a710837b37965a459a09437f7002f0dc29272dad03872db14a845c45d2a7db7b4d6c4eeaccd1344b7c92bdd430025fa61b9696a582311b7a7338f567559f5cd29d746b70a2b65b6d3426f15b2b87bfbefe95d53d5345a270203010001a381dc3081d9301d0603551d0e04160414adbd987a34b426f7fac42654ef03bde024cb541a300b0603551d0f040403020106300f0603551d130101ff040530030101ff3081990603551d2304819130818e8014adbd987a34b426f7fac42654ef03bde024cb541aa173a471306f310b300906035504061302534531143012060355040a130b416464547275737420414231263024060355040b131d41646454727573742045787465726e616c20545450204e6574776f726b312230200603550403131941646454727573742045787465726e616c20434120526f6f74820101300d06092a864886f70d01010505000382010100b09be08525c2d623e20f9606929d41989cd9847981d91e5b14072336658fb0d877bbac416c47608351b0f9323de7fcf62613c78016a5bf5afc87cf787989219ae24c070a8635bcf2de51c4d296b7dc7e4eee70fd1c39eb0c0251142d8ebd16e0c1df4675e724adecf442b48593701067ba9d06354a18d32b7acc5142a17a63d1e6bba1c52bc236be130de6bd637e797ba7090d40ab6add8f8ac3f6f68c1a420551d445f59fa76221681520433c99e77cbd24d8a9911773883f561b313818b4710f9acdc80e9e8e2e1be18c9883cb1f31f1444cc604734976600fc7f8bd17806b2ee9cc4c0e5a9a790f200a2ed59e63261e559294d882175a7bd0bcc78f4e8604 51f7bcc2da2c7a0704f1f537c42279b0fa3d3a72808bc8938880de88b21945b9.sample.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\02FAF3E291435468607857694DF5E45B68851868\Blob = 19000000010000001000000045ed9bbc5e43d3b9ecd63c060db78e5c0f000000010000001400000009b9105c5bba24343ca7f341c624e183f6ee7c1b090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00b00000001000000260000005300650063007400690067006f00200028004100640064005400720075007300740029000000620000000100000020000000687fa451382278fff0c8b11f8d43d576671c6eb2bceab413fb83d965d06d2ff2140000000100000014000000adbd987a34b426f7fac42654ef03bde024cb541a1d000000010000001000000006f9583c00a763c23fb9e065a3366d557e0000000100000008000000000063f58926d70103000000010000001400000002faf3e291435468607857694df5e45b688518680400000001000000100000001d3554048578b03f42424dbf20730a3f20000000010000003a040000308204363082031ea003020102020101300d06092a864886f70d0101050500306f310b300906035504061302534531143012060355040a130b416464547275737420414231263024060355040b131d41646454727573742045787465726e616c20545450204e6574776f726b312230200603550403131941646454727573742045787465726e616c20434120526f6f74301e170d3030303533303130343833385a170d3230303533303130343833385a306f310b300906035504061302534531143012060355040a130b416464547275737420414231263024060355040b131d41646454727573742045787465726e616c20545450204e6574776f726b312230200603550403131941646454727573742045787465726e616c20434120526f6f7430820122300d06092a864886f70d01010105000382010f003082010a0282010100b7f71a33e6f200042d39e04e5bed1fbc6c0fcdb5fa23b6cede9b113397a4294c7d939fbd4abc93ed031ae38fcfe56d505ad69729945a80b0497adb2e95fdb8cabf37382d1e3e9141ad7056c7f04f3fe8329e74cac89054e9c65f0f789d9a403c0eac61aa5e148f9e87a16a50dcd79a4eaf05b3a671949c71b350600ac7139d38078602a8e9a869261890ab4cb04f23ab3a4f84d8dfce9fe1696fbbd742d76b44e4c7adee6d415f725a710837b37965a459a09437f7002f0dc29272dad03872db14a845c45d2a7db7b4d6c4eeaccd1344b7c92bdd430025fa61b9696a582311b7a7338f567559f5cd29d746b70a2b65b6d3426f15b2b87bfbefe95d53d5345a270203010001a381dc3081d9301d0603551d0e04160414adbd987a34b426f7fac42654ef03bde024cb541a300b0603551d0f040403020106300f0603551d130101ff040530030101ff3081990603551d2304819130818e8014adbd987a34b426f7fac42654ef03bde024cb541aa173a471306f310b300906035504061302534531143012060355040a130b416464547275737420414231263024060355040b131d41646454727573742045787465726e616c20545450204e6574776f726b312230200603550403131941646454727573742045787465726e616c20434120526f6f74820101300d06092a864886f70d01010505000382010100b09be08525c2d623e20f9606929d41989cd9847981d91e5b14072336658fb0d877bbac416c47608351b0f9323de7fcf62613c78016a5bf5afc87cf787989219ae24c070a8635bcf2de51c4d296b7dc7e4eee70fd1c39eb0c0251142d8ebd16e0c1df4675e724adecf442b48593701067ba9d06354a18d32b7acc5142a17a63d1e6bba1c52bc236be130de6bd637e797ba7090d40ab6add8f8ac3f6f68c1a420551d445f59fa76221681520433c99e77cbd24d8a9911773883f561b313818b4710f9acdc80e9e8e2e1be18c9883cb1f31f1444cc604734976600fc7f8bd17806b2ee9cc4c0e5a9a790f200a2ed59e63261e559294d882175a7bd0bcc78f4e8604 51f7bcc2da2c7a0704f1f537c42279b0fa3d3a72808bc8938880de88b21945b9.sample.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\02FAF3E291435468607857694DF5E45B68851868\Blob = 5c0000000100000004000000000800000400000001000000100000001d3554048578b03f42424dbf20730a3f03000000010000001400000002faf3e291435468607857694df5e45b688518687e0000000100000008000000000063f58926d7011d000000010000001000000006f9583c00a763c23fb9e065a3366d55140000000100000014000000adbd987a34b426f7fac42654ef03bde024cb541a620000000100000020000000687fa451382278fff0c8b11f8d43d576671c6eb2bceab413fb83d965d06d2ff20b00000001000000260000005300650063007400690067006f0020002800410064006400540072007500730074002900000053000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b060105050703080f000000010000001400000009b9105c5bba24343ca7f341c624e183f6ee7c1b19000000010000001000000045ed9bbc5e43d3b9ecd63c060db78e5c20000000010000003a040000308204363082031ea003020102020101300d06092a864886f70d0101050500306f310b300906035504061302534531143012060355040a130b416464547275737420414231263024060355040b131d41646454727573742045787465726e616c20545450204e6574776f726b312230200603550403131941646454727573742045787465726e616c20434120526f6f74301e170d3030303533303130343833385a170d3230303533303130343833385a306f310b300906035504061302534531143012060355040a130b416464547275737420414231263024060355040b131d41646454727573742045787465726e616c20545450204e6574776f726b312230200603550403131941646454727573742045787465726e616c20434120526f6f7430820122300d06092a864886f70d01010105000382010f003082010a0282010100b7f71a33e6f200042d39e04e5bed1fbc6c0fcdb5fa23b6cede9b113397a4294c7d939fbd4abc93ed031ae38fcfe56d505ad69729945a80b0497adb2e95fdb8cabf37382d1e3e9141ad7056c7f04f3fe8329e74cac89054e9c65f0f789d9a403c0eac61aa5e148f9e87a16a50dcd79a4eaf05b3a671949c71b350600ac7139d38078602a8e9a869261890ab4cb04f23ab3a4f84d8dfce9fe1696fbbd742d76b44e4c7adee6d415f725a710837b37965a459a09437f7002f0dc29272dad03872db14a845c45d2a7db7b4d6c4eeaccd1344b7c92bdd430025fa61b9696a582311b7a7338f567559f5cd29d746b70a2b65b6d3426f15b2b87bfbefe95d53d5345a270203010001a381dc3081d9301d0603551d0e04160414adbd987a34b426f7fac42654ef03bde024cb541a300b0603551d0f040403020106300f0603551d130101ff040530030101ff3081990603551d2304819130818e8014adbd987a34b426f7fac42654ef03bde024cb541aa173a471306f310b300906035504061302534531143012060355040a130b416464547275737420414231263024060355040b131d41646454727573742045787465726e616c20545450204e6574776f726b312230200603550403131941646454727573742045787465726e616c20434120526f6f74820101300d06092a864886f70d01010505000382010100b09be08525c2d623e20f9606929d41989cd9847981d91e5b14072336658fb0d877bbac416c47608351b0f9323de7fcf62613c78016a5bf5afc87cf787989219ae24c070a8635bcf2de51c4d296b7dc7e4eee70fd1c39eb0c0251142d8ebd16e0c1df4675e724adecf442b48593701067ba9d06354a18d32b7acc5142a17a63d1e6bba1c52bc236be130de6bd637e797ba7090d40ab6add8f8ac3f6f68c1a420551d445f59fa76221681520433c99e77cbd24d8a9911773883f561b313818b4710f9acdc80e9e8e2e1be18c9883cb1f31f1444cc604734976600fc7f8bd17806b2ee9cc4c0e5a9a790f200a2ed59e63261e559294d882175a7bd0bcc78f4e8604 51f7bcc2da2c7a0704f1f537c42279b0fa3d3a72808bc8938880de88b21945b9.sample.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
51f7bcc2da2c7a0704f1f537c42279b0fa3d3a72808bc8938880de88b21945b9.sample.exepid process 4648 51f7bcc2da2c7a0704f1f537c42279b0fa3d3a72808bc8938880de88b21945b9.sample.exe 4648 51f7bcc2da2c7a0704f1f537c42279b0fa3d3a72808bc8938880de88b21945b9.sample.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
vssvc.exedescription pid process Token: SeBackupPrivilege 3240 vssvc.exe Token: SeRestorePrivilege 3240 vssvc.exe Token: SeAuditPrivilege 3240 vssvc.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
51f7bcc2da2c7a0704f1f537c42279b0fa3d3a72808bc8938880de88b21945b9.sample.execmd.exedescription pid process target process PID 4648 wrote to memory of 740 4648 51f7bcc2da2c7a0704f1f537c42279b0fa3d3a72808bc8938880de88b21945b9.sample.exe cmd.exe PID 4648 wrote to memory of 740 4648 51f7bcc2da2c7a0704f1f537c42279b0fa3d3a72808bc8938880de88b21945b9.sample.exe cmd.exe PID 4648 wrote to memory of 740 4648 51f7bcc2da2c7a0704f1f537c42279b0fa3d3a72808bc8938880de88b21945b9.sample.exe cmd.exe PID 740 wrote to memory of 4256 740 cmd.exe vssadmin.exe PID 740 wrote to memory of 4256 740 cmd.exe vssadmin.exe PID 740 wrote to memory of 4256 740 cmd.exe vssadmin.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\51f7bcc2da2c7a0704f1f537c42279b0fa3d3a72808bc8938880de88b21945b9.sample.exe"C:\Users\Admin\AppData\Local\Temp\51f7bcc2da2c7a0704f1f537c42279b0fa3d3a72808bc8938880de88b21945b9.sample.exe"1⤵
- Modifies extensions of user files
- Enumerates connected drives
- Sets desktop wallpaper using registry
- Drops file in Program Files directory
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c vssadmin.exe Delete Shadows /All /Quiet & bcdedit /set {default} recoveryenabled No & bcdedit /set {default} bootstatuspolicy ignoreallfailures2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\vssadmin.exevssadmin.exe Delete Shadows /All /Quiet3⤵
- Interacts with shadow copies
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken