sodinokibi | 9ae7ab0afccf76719a56fbf5c016995aa52043b2d4649b4f9f8822d31f5e5296

General

Target

9ae7ab0afccf76719a56fbf5c016995aa52043b2d4649b4f9f8822d31f5e5296.exe
Size

122KB
MD5

05f621411097f5025874ebdf84419bb2
SHA1

72f9bb9085829a6d06d016f0d14daaace19c5422
SHA256

9ae7ab0afccf76719a56fbf5c016995aa52043b2d4649b4f9f8822d31f5e5296
SHA512

34eb2969cfc0f7396b0a471ebbe901e58c827822f5a64efeb9ff3704afef306db29082e231039318adff608f38842fbf9d7afab46b7d39ba9302be2481153714

Score

10^/10

sodinokibi evasion persistence ransomware suricata

Malware Config

Extracted

Path

C:\q8cyt3mz-readme.txt

Family

sodinokibi

Ransom Note

---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension q8cyt3mz. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). CONFIDENTIAL DATA WAS EXFILTRATED! (SCREENSHOTS ON DEMAND) ALL YOUR DATA STORED ON OUR BULLETPROOF FILE SERVERS! IF YOU DECIDE NOT TO PAY, INCIDENT WILL BE REPORT TO THE WORLD NEWS MASS MEDIA. YOUR DATA WILL BE SOLD ON BLACK MARKET! YOU WILL GET CLOUD CREDENTIALS WHERE YOUR DATA STORED AFTER PAYMENT [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practice - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/C86446294DBA3A5C 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decoder.re/C86446294DBA3A5C Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: ym/rNcB5CaN1ruE2SJTRNFMvBpvNIUTdEWT8rVXYMYOwkaIOa0ct46G4xmra1DPL kMWj1aVdA4uNXzZ1RGP5YAA/Kk/5iQ9Zgk/kNLWjg9XANGDC7O5W1BYqYgxFw00Q CsUWG75P5hfj5jC+pfJT8zuzQ2geVM6Zn3JCqLaY7sLFw9AzhNCDUHsuZE+Q5Jdf egd++Fraf7m/cvpsoUFRmDOI3RbRIPozMUXREtjpPJcfXSV5mqBTga8dwIocb1ed XhwBUoDy1x06SEG4gYsbjA7nEbt8zZO2E5Wk5hfWzsfnWF1Pieyvakq1YRlawR+c eWvnpExLMpHSsA8QsqPzLc857xOguKvukNSl1AAXemn44MW0naOtG6udPVaXZDp3 Lqxs5FNRVLyN/fsZ+2k7lczYnBicsYU+hR7WO2r801U/PWs2daqEvlK5q5LGzIiw nwUP5sM5mu/BqYoTpbWRQrcsPNmCXtY7WKl90yWQHmf9nnCiT3e9nmgE657jIpH8 UjHzhc08hyVLiDDmCnQP4b/uGZeRKWqM0tTnYGwv2110lLE5i9QsfBGJmgNIIPoT XrRmMx+hjxjxppouhNYNR8e1KO+YoDwt7cfRL8eIHCmzY46NzlK/KVSbCOTgg+EK Q66Z53acNFSpENRsyIx/BgeV66LWiyjBaQ7Q9ybLOYdhQZsBHQttpvcJncrHm05b MN2SwcJYOso4DKSP4MuEF/nNkXntvRk7W1bK7Wchrq98mcwOUS0mKduWWM97saOa RkgcmoNdewuQ//i5KK9WGx29RAYSb94+iQQBHZOPy/BmBUg2XvMAfSrlKrPIqXS/ NC41vafx6kDFLFEgWn2pDb5ZjedpS3Ca7QW5DHpw78yX1CE3sHOaLxok6Z7K5k1N mPdFKDMJ4lU3MzQSRNzE9rlBdGmoQHI+X5flRM17dRG5CPaAMLKckU+AZwT8IU1r VaTac5Xdkx0+1icAqH+w4HgywEIYAjNw2ABgcXBCGprBnGqccmdAA14WX8pUlh8d GaPMoxblk5M0OITlxwMtySHs0TruCoUM9iBbGgaDjpFtTRF2tND1Mcf6iHvHSWKX IvSsIfxaa/RtOghdmRetlkaWOLf+29XcVXEsANhIL9+hWN/duHESF81geEgF0zHN fN+1xOtSLL1QvzlPWTkAJJOt+bpufi9A7lGAhF1to1bPvNZcjvCjjAOC2Iu5J6r1 iYwyEKI6FQnKEJLqVN5KUthvkEv/B+yyBMSyAcHDfxcNHgZdj0LeOo9MB9UM9WnL lOCkVaNXrxN3cg== ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damage of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!

URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/C86446294DBA3A5C

http://decoder.re/C86446294DBA3A5C

Signatures

Sodin,Sodinokibi,REvil
Ransomware with advanced anti-analysis and privilege escalation functionality.
ransomware sodinokibi
suricata: ET MALWARE Known Sinkhole Response Header
suricata: ET MALWARE Known Sinkhole Response Header
suricata
Modifies Windows Firewall 1 TTPs
evasion

Modify Existing Service
T1031

Modifies extensions of user files 6 IoCs

Ransomware generally changes the extension on encrypted files.

ransomware

Processes:

9ae7ab0afccf76719a56fbf5c016995aa52043b2d4649b4f9f8822d31f5e5296.exe

description	ioc	process
File renamed	C:\Users\Admin\Pictures\ShowStep.tif => \??\c:\users\admin\pictures\ShowStep.tif.q8cyt3mz	9ae7ab0afccf76719a56fbf5c016995aa52043b2d4649b4f9f8822d31f5e5296.exe
File renamed	C:\Users\Admin\Pictures\TestRestore.tif => \??\c:\users\admin\pictures\TestRestore.tif.q8cyt3mz	9ae7ab0afccf76719a56fbf5c016995aa52043b2d4649b4f9f8822d31f5e5296.exe
File renamed	C:\Users\Admin\Pictures\ConvertFromStop.raw => \??\c:\users\admin\pictures\ConvertFromStop.raw.q8cyt3mz	9ae7ab0afccf76719a56fbf5c016995aa52043b2d4649b4f9f8822d31f5e5296.exe
File renamed	C:\Users\Admin\Pictures\DenyRevoke.crw => \??\c:\users\admin\pictures\DenyRevoke.crw.q8cyt3mz	9ae7ab0afccf76719a56fbf5c016995aa52043b2d4649b4f9f8822d31f5e5296.exe
File renamed	C:\Users\Admin\Pictures\ExportWrite.crw => \??\c:\users\admin\pictures\ExportWrite.crw.q8cyt3mz	9ae7ab0afccf76719a56fbf5c016995aa52043b2d4649b4f9f8822d31f5e5296.exe
File renamed	C:\Users\Admin\Pictures\RenameUse.crw => \??\c:\users\admin\pictures\RenameUse.crw.q8cyt3mz	9ae7ab0afccf76719a56fbf5c016995aa52043b2d4649b4f9f8822d31f5e5296.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

9ae7ab0afccf76719a56fbf5c016995aa52043b2d4649b4f9f8822d31f5e5296.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	9ae7ab0afccf76719a56fbf5c016995aa52043b2d4649b4f9f8822d31f5e5296.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\t32mMaunsR = "C:\\Users\\Admin\\AppData\\Local\\Temp\\9ae7ab0afccf76719a56fbf5c016995aa52043b2d4649b4f9f8822d31f5e5296.exe"	9ae7ab0afccf76719a56fbf5c016995aa52043b2d4649b4f9f8822d31f5e5296.exe

Enumerates connected drives 3 TTPs 25 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

9ae7ab0afccf76719a56fbf5c016995aa52043b2d4649b4f9f8822d31f5e5296.exe

description	ioc	process
File opened (read-only)	\??\X:	9ae7ab0afccf76719a56fbf5c016995aa52043b2d4649b4f9f8822d31f5e5296.exe
File opened (read-only)	\??\I:	9ae7ab0afccf76719a56fbf5c016995aa52043b2d4649b4f9f8822d31f5e5296.exe
File opened (read-only)	\??\K:	9ae7ab0afccf76719a56fbf5c016995aa52043b2d4649b4f9f8822d31f5e5296.exe
File opened (read-only)	\??\N:	9ae7ab0afccf76719a56fbf5c016995aa52043b2d4649b4f9f8822d31f5e5296.exe
File opened (read-only)	\??\R:	9ae7ab0afccf76719a56fbf5c016995aa52043b2d4649b4f9f8822d31f5e5296.exe
File opened (read-only)	\??\S:	9ae7ab0afccf76719a56fbf5c016995aa52043b2d4649b4f9f8822d31f5e5296.exe
File opened (read-only)	\??\T:	9ae7ab0afccf76719a56fbf5c016995aa52043b2d4649b4f9f8822d31f5e5296.exe
File opened (read-only)	\??\A:	9ae7ab0afccf76719a56fbf5c016995aa52043b2d4649b4f9f8822d31f5e5296.exe
File opened (read-only)	\??\J:	9ae7ab0afccf76719a56fbf5c016995aa52043b2d4649b4f9f8822d31f5e5296.exe
File opened (read-only)	\??\W:	9ae7ab0afccf76719a56fbf5c016995aa52043b2d4649b4f9f8822d31f5e5296.exe
File opened (read-only)	\??\Z:	9ae7ab0afccf76719a56fbf5c016995aa52043b2d4649b4f9f8822d31f5e5296.exe
File opened (read-only)	\??\E:	9ae7ab0afccf76719a56fbf5c016995aa52043b2d4649b4f9f8822d31f5e5296.exe
File opened (read-only)	\??\G:	9ae7ab0afccf76719a56fbf5c016995aa52043b2d4649b4f9f8822d31f5e5296.exe
File opened (read-only)	\??\H:	9ae7ab0afccf76719a56fbf5c016995aa52043b2d4649b4f9f8822d31f5e5296.exe
File opened (read-only)	\??\Q:	9ae7ab0afccf76719a56fbf5c016995aa52043b2d4649b4f9f8822d31f5e5296.exe
File opened (read-only)	\??\D:	9ae7ab0afccf76719a56fbf5c016995aa52043b2d4649b4f9f8822d31f5e5296.exe
File opened (read-only)	\??\U:	9ae7ab0afccf76719a56fbf5c016995aa52043b2d4649b4f9f8822d31f5e5296.exe
File opened (read-only)	\??\V:	9ae7ab0afccf76719a56fbf5c016995aa52043b2d4649b4f9f8822d31f5e5296.exe
File opened (read-only)	\??\B:	9ae7ab0afccf76719a56fbf5c016995aa52043b2d4649b4f9f8822d31f5e5296.exe
File opened (read-only)	\??\F:	9ae7ab0afccf76719a56fbf5c016995aa52043b2d4649b4f9f8822d31f5e5296.exe
File opened (read-only)	\??\L:	9ae7ab0afccf76719a56fbf5c016995aa52043b2d4649b4f9f8822d31f5e5296.exe
File opened (read-only)	\??\M:	9ae7ab0afccf76719a56fbf5c016995aa52043b2d4649b4f9f8822d31f5e5296.exe
File opened (read-only)	\??\O:	9ae7ab0afccf76719a56fbf5c016995aa52043b2d4649b4f9f8822d31f5e5296.exe
File opened (read-only)	\??\P:	9ae7ab0afccf76719a56fbf5c016995aa52043b2d4649b4f9f8822d31f5e5296.exe
File opened (read-only)	\??\Y:	9ae7ab0afccf76719a56fbf5c016995aa52043b2d4649b4f9f8822d31f5e5296.exe

Sets desktop wallpaper using registry 2 TTPs 1 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

Processes:

9ae7ab0afccf76719a56fbf5c016995aa52043b2d4649b4f9f8822d31f5e5296.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\06b6ezwfjpo.bmp"	9ae7ab0afccf76719a56fbf5c016995aa52043b2d4649b4f9f8822d31f5e5296.exe

Drops file in Program Files directory 34 IoCs

Processes:

9ae7ab0afccf76719a56fbf5c016995aa52043b2d4649b4f9f8822d31f5e5296.exe

description	ioc	process
File opened for modification	\??\c:\program files\SuspendStart.emz	9ae7ab0afccf76719a56fbf5c016995aa52043b2d4649b4f9f8822d31f5e5296.exe
File opened for modification	\??\c:\program files\ConvertProtect.xls	9ae7ab0afccf76719a56fbf5c016995aa52043b2d4649b4f9f8822d31f5e5296.exe
File opened for modification	\??\c:\program files\CopyWatch.emz	9ae7ab0afccf76719a56fbf5c016995aa52043b2d4649b4f9f8822d31f5e5296.exe
File opened for modification	\??\c:\program files\EnterPublish.M2T	9ae7ab0afccf76719a56fbf5c016995aa52043b2d4649b4f9f8822d31f5e5296.exe
File opened for modification	\??\c:\program files\RemoveBackup.jpeg	9ae7ab0afccf76719a56fbf5c016995aa52043b2d4649b4f9f8822d31f5e5296.exe
File opened for modification	\??\c:\program files\SaveRead.xltm	9ae7ab0afccf76719a56fbf5c016995aa52043b2d4649b4f9f8822d31f5e5296.exe
File opened for modification	\??\c:\program files\MergeUndo.vssx	9ae7ab0afccf76719a56fbf5c016995aa52043b2d4649b4f9f8822d31f5e5296.exe
File opened for modification	\??\c:\program files\UpdateRename.html	9ae7ab0afccf76719a56fbf5c016995aa52043b2d4649b4f9f8822d31f5e5296.exe
File opened for modification	\??\c:\program files\RequestUndo.AAC	9ae7ab0afccf76719a56fbf5c016995aa52043b2d4649b4f9f8822d31f5e5296.exe
File opened for modification	\??\c:\program files\RestoreDebug.vstm	9ae7ab0afccf76719a56fbf5c016995aa52043b2d4649b4f9f8822d31f5e5296.exe
File opened for modification	\??\c:\program files\RestoreDisable.vsdm	9ae7ab0afccf76719a56fbf5c016995aa52043b2d4649b4f9f8822d31f5e5296.exe
File created	\??\c:\program files\q8cyt3mz-readme.txt	9ae7ab0afccf76719a56fbf5c016995aa52043b2d4649b4f9f8822d31f5e5296.exe
File created	\??\c:\program files (x86)\q8cyt3mz-readme.txt	9ae7ab0afccf76719a56fbf5c016995aa52043b2d4649b4f9f8822d31f5e5296.exe
File opened for modification	\??\c:\program files\AddClear.docm	9ae7ab0afccf76719a56fbf5c016995aa52043b2d4649b4f9f8822d31f5e5296.exe
File opened for modification	\??\c:\program files\GrantDebug.ttc	9ae7ab0afccf76719a56fbf5c016995aa52043b2d4649b4f9f8822d31f5e5296.exe
File opened for modification	\??\c:\program files\ProtectClear.xps	9ae7ab0afccf76719a56fbf5c016995aa52043b2d4649b4f9f8822d31f5e5296.exe
File created	\??\c:\program files (x86)\tmp	9ae7ab0afccf76719a56fbf5c016995aa52043b2d4649b4f9f8822d31f5e5296.exe
File opened for modification	\??\c:\program files\ConfirmEdit.htm	9ae7ab0afccf76719a56fbf5c016995aa52043b2d4649b4f9f8822d31f5e5296.exe
File opened for modification	\??\c:\program files\DisableDisconnect.7z	9ae7ab0afccf76719a56fbf5c016995aa52043b2d4649b4f9f8822d31f5e5296.exe
File created	\??\c:\program files\tmp	9ae7ab0afccf76719a56fbf5c016995aa52043b2d4649b4f9f8822d31f5e5296.exe
File opened for modification	\??\c:\program files\FormatResolve.jfif	9ae7ab0afccf76719a56fbf5c016995aa52043b2d4649b4f9f8822d31f5e5296.exe
File opened for modification	\??\c:\program files\MergeEnable.css	9ae7ab0afccf76719a56fbf5c016995aa52043b2d4649b4f9f8822d31f5e5296.exe
File opened for modification	\??\c:\program files\SplitCheckpoint.odt	9ae7ab0afccf76719a56fbf5c016995aa52043b2d4649b4f9f8822d31f5e5296.exe
File opened for modification	\??\c:\program files\StartTest.rm	9ae7ab0afccf76719a56fbf5c016995aa52043b2d4649b4f9f8822d31f5e5296.exe
File opened for modification	\??\c:\program files\CopyUninstall.avi	9ae7ab0afccf76719a56fbf5c016995aa52043b2d4649b4f9f8822d31f5e5296.exe
File opened for modification	\??\c:\program files\InitializeRequest.wmx	9ae7ab0afccf76719a56fbf5c016995aa52043b2d4649b4f9f8822d31f5e5296.exe
File opened for modification	\??\c:\program files\CheckpointLimit.bmp	9ae7ab0afccf76719a56fbf5c016995aa52043b2d4649b4f9f8822d31f5e5296.exe
File opened for modification	\??\c:\program files\CloseUnblock.3g2	9ae7ab0afccf76719a56fbf5c016995aa52043b2d4649b4f9f8822d31f5e5296.exe
File opened for modification	\??\c:\program files\UndoUse.dwg	9ae7ab0afccf76719a56fbf5c016995aa52043b2d4649b4f9f8822d31f5e5296.exe
File opened for modification	\??\c:\program files\CompressHide.php	9ae7ab0afccf76719a56fbf5c016995aa52043b2d4649b4f9f8822d31f5e5296.exe
File opened for modification	\??\c:\program files\DismountReceive.contact	9ae7ab0afccf76719a56fbf5c016995aa52043b2d4649b4f9f8822d31f5e5296.exe
File opened for modification	\??\c:\program files\RenameExport.search-ms	9ae7ab0afccf76719a56fbf5c016995aa52043b2d4649b4f9f8822d31f5e5296.exe
File opened for modification	\??\c:\program files\SaveMount.wmv	9ae7ab0afccf76719a56fbf5c016995aa52043b2d4649b4f9f8822d31f5e5296.exe
File opened for modification	\??\c:\program files\SelectClear.midi	9ae7ab0afccf76719a56fbf5c016995aa52043b2d4649b4f9f8822d31f5e5296.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies system certificate store 2 TTPs 9 IoCs

evasion spyware trojan

Install Root Certificate

T1130

Modify Registry

T1112

Processes:

9ae7ab0afccf76719a56fbf5c016995aa52043b2d4649b4f9f8822d31f5e5296.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\SystemCertificates\CA\Certificates\33E4E80807204C2B6182A3A14B591ACD25B5F0DB	9ae7ab0afccf76719a56fbf5c016995aa52043b2d4649b4f9f8822d31f5e5296.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\85A408C09C193E5D51587DCDD61330FD8CDE37BF\Blob = 1900000001000000100000000790dd35d0de1a5516689a62748c58eb0f0000000100000014000000ff99b1116eca7b69f516900dea2d12202453b5110b0000000100000036000000440065007500740073006300680065002000540065006c0065006b006f006d00200052006f006f007400200043004100200032000000620000000100000020000000b6191a50d0c3977f7da99bcdaac86a227daeb9679ec70ba3b0c9d92271c170d3090000000100000020000000301e06082b0601050507030206082b0601050507030406082b0601050507030114000000010000001400000031c3791bbaf553d717e0897a2d176c0ab32b9d331d000000010000001000000048c1184e28125121aeeef1a32ce0d4677e0000000100000008000000000063f58926d70103000000010000001400000085a408c09c193e5d51587dcdd61330fd8cde37bf04000000010000001000000074014a91b108c458ce47cdf0dd1153082000000001000000a30300003082039f30820287a003020102020126300d06092a864886f70d01010505003071310b3009060355040613024445311c301a060355040a131344657574736368652054656c656b6f6d204147311f301d060355040b1316542d54656c655365632054727573742043656e746572312330210603550403131a44657574736368652054656c656b6f6d20526f6f742043412032301e170d3939303730393132313130305a170d3139303730393233353930305a3071310b3009060355040613024445311c301a060355040a131344657574736368652054656c656b6f6d204147311f301d060355040b1316542d54656c655365632054727573742043656e746572312330210603550403131a44657574736368652054656c656b6f6d20526f6f74204341203230820122300d06092a864886f70d01010105000382010f003082010a0282010100ab0ba335e08b2914b11485af3c10e4396f355d4aaeddea618d9549f46f64a31a6066a4a9402284d9d4a5e578930e6801adb94d5c3aced3b8a84240dfcfa3ba82596a921bac1c9ada082b2527f9692347f1e0eb2c7a9bf51302d07e347cc29e3c0059abf5da0cf5323c2bac50dad6c3de8394caa80c99320e0848565b6afbdae1585801495f72413c1506018e5dadaab893b4cd9eeba7e86a2d5234db3aef5c7551dadbf331f9ee719832c45415440cf99b55edaddf1808a0a3868a49ee53058f194cd5de58799bd26a1c42abc5d5a7cf680f96e4e161987661c8917cd63e00e2915087e19d0ae6ad97d21dc63a7dcbbcda0334d58e5b01f56a07b716b66e4a7f0203010001a3423040301d0603551d0e0416041431c3791bbaf553d717e0897a2d176c0ab32b9d33300f0603551d13040830060101ff020105300e0603551d0f0101ff040403020106300d06092a864886f70d01010505000382010100946459ad3964e729eb13fe5ac38b1357c80424f07477c060e367fbe989a683bf96827c6ed4c33def9e806ebb29b4987ab13b54eb3917477e1a8e0bfc1f31593104b2ce17f32cc7623655e222d88955b49848aa64fad61c36d844785a5a233a5797f57a304fae9f6a4c4b2b8ea003e33ee0a9d4d27bd2b3a8e2723cad9eff8059e49b45b4f63bb0cd39199832e5ea216190e431218e34b1f72f354a8510dae78a3721be5963e0f285883153d45414857079f42e067727752f1fb88af9fec5bad836e483ece765b7bf635af346af819437d4418cd623d61ecff5681b4463a25abaa73559a1e570059b0e235799940a6dba3963288692f31884d8fbd1cf05566457	9ae7ab0afccf76719a56fbf5c016995aa52043b2d4649b4f9f8822d31f5e5296.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\85A408C09C193E5D51587DCDD61330FD8CDE37BF\Blob = 0f0000000100000014000000ff99b1116eca7b69f516900dea2d12202453b5110b0000000100000036000000440065007500740073006300680065002000540065006c0065006b006f006d00200052006f006f007400200043004100200032000000620000000100000020000000b6191a50d0c3977f7da99bcdaac86a227daeb9679ec70ba3b0c9d92271c170d3090000000100000020000000301e06082b0601050507030206082b0601050507030406082b0601050507030114000000010000001400000031c3791bbaf553d717e0897a2d176c0ab32b9d331d000000010000001000000048c1184e28125121aeeef1a32ce0d4677e0000000100000008000000000063f58926d70103000000010000001400000085a408c09c193e5d51587dcdd61330fd8cde37bf2000000001000000a30300003082039f30820287a003020102020126300d06092a864886f70d01010505003071310b3009060355040613024445311c301a060355040a131344657574736368652054656c656b6f6d204147311f301d060355040b1316542d54656c655365632054727573742043656e746572312330210603550403131a44657574736368652054656c656b6f6d20526f6f742043412032301e170d3939303730393132313130305a170d3139303730393233353930305a3071310b3009060355040613024445311c301a060355040a131344657574736368652054656c656b6f6d204147311f301d060355040b1316542d54656c655365632054727573742043656e746572312330210603550403131a44657574736368652054656c656b6f6d20526f6f74204341203230820122300d06092a864886f70d01010105000382010f003082010a0282010100ab0ba335e08b2914b11485af3c10e4396f355d4aaeddea618d9549f46f64a31a6066a4a9402284d9d4a5e578930e6801adb94d5c3aced3b8a84240dfcfa3ba82596a921bac1c9ada082b2527f9692347f1e0eb2c7a9bf51302d07e347cc29e3c0059abf5da0cf5323c2bac50dad6c3de8394caa80c99320e0848565b6afbdae1585801495f72413c1506018e5dadaab893b4cd9eeba7e86a2d5234db3aef5c7551dadbf331f9ee719832c45415440cf99b55edaddf1808a0a3868a49ee53058f194cd5de58799bd26a1c42abc5d5a7cf680f96e4e161987661c8917cd63e00e2915087e19d0ae6ad97d21dc63a7dcbbcda0334d58e5b01f56a07b716b66e4a7f0203010001a3423040301d0603551d0e0416041431c3791bbaf553d717e0897a2d176c0ab32b9d33300f0603551d13040830060101ff020105300e0603551d0f0101ff040403020106300d06092a864886f70d01010505000382010100946459ad3964e729eb13fe5ac38b1357c80424f07477c060e367fbe989a683bf96827c6ed4c33def9e806ebb29b4987ab13b54eb3917477e1a8e0bfc1f31593104b2ce17f32cc7623655e222d88955b49848aa64fad61c36d844785a5a233a5797f57a304fae9f6a4c4b2b8ea003e33ee0a9d4d27bd2b3a8e2723cad9eff8059e49b45b4f63bb0cd39199832e5ea216190e431218e34b1f72f354a8510dae78a3721be5963e0f285883153d45414857079f42e067727752f1fb88af9fec5bad836e483ece765b7bf635af346af819437d4418cd623d61ecff5681b4463a25abaa73559a1e570059b0e235799940a6dba3963288692f31884d8fbd1cf05566457	9ae7ab0afccf76719a56fbf5c016995aa52043b2d4649b4f9f8822d31f5e5296.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\85A408C09C193E5D51587DCDD61330FD8CDE37BF\Blob = 04000000010000001000000074014a91b108c458ce47cdf0dd11530803000000010000001400000085a408c09c193e5d51587dcdd61330fd8cde37bf7e0000000100000008000000000063f58926d7011d000000010000001000000048c1184e28125121aeeef1a32ce0d46714000000010000001400000031c3791bbaf553d717e0897a2d176c0ab32b9d33090000000100000020000000301e06082b0601050507030206082b0601050507030406082b06010505070301620000000100000020000000b6191a50d0c3977f7da99bcdaac86a227daeb9679ec70ba3b0c9d92271c170d30b0000000100000036000000440065007500740073006300680065002000540065006c0065006b006f006d00200052006f006f0074002000430041002000320000000f0000000100000014000000ff99b1116eca7b69f516900dea2d12202453b5112000000001000000a30300003082039f30820287a003020102020126300d06092a864886f70d01010505003071310b3009060355040613024445311c301a060355040a131344657574736368652054656c656b6f6d204147311f301d060355040b1316542d54656c655365632054727573742043656e746572312330210603550403131a44657574736368652054656c656b6f6d20526f6f742043412032301e170d3939303730393132313130305a170d3139303730393233353930305a3071310b3009060355040613024445311c301a060355040a131344657574736368652054656c656b6f6d204147311f301d060355040b1316542d54656c655365632054727573742043656e746572312330210603550403131a44657574736368652054656c656b6f6d20526f6f74204341203230820122300d06092a864886f70d01010105000382010f003082010a0282010100ab0ba335e08b2914b11485af3c10e4396f355d4aaeddea618d9549f46f64a31a6066a4a9402284d9d4a5e578930e6801adb94d5c3aced3b8a84240dfcfa3ba82596a921bac1c9ada082b2527f9692347f1e0eb2c7a9bf51302d07e347cc29e3c0059abf5da0cf5323c2bac50dad6c3de8394caa80c99320e0848565b6afbdae1585801495f72413c1506018e5dadaab893b4cd9eeba7e86a2d5234db3aef5c7551dadbf331f9ee719832c45415440cf99b55edaddf1808a0a3868a49ee53058f194cd5de58799bd26a1c42abc5d5a7cf680f96e4e161987661c8917cd63e00e2915087e19d0ae6ad97d21dc63a7dcbbcda0334d58e5b01f56a07b716b66e4a7f0203010001a3423040301d0603551d0e0416041431c3791bbaf553d717e0897a2d176c0ab32b9d33300f0603551d13040830060101ff020105300e0603551d0f0101ff040403020106300d06092a864886f70d01010505000382010100946459ad3964e729eb13fe5ac38b1357c80424f07477c060e367fbe989a683bf96827c6ed4c33def9e806ebb29b4987ab13b54eb3917477e1a8e0bfc1f31593104b2ce17f32cc7623655e222d88955b49848aa64fad61c36d844785a5a233a5797f57a304fae9f6a4c4b2b8ea003e33ee0a9d4d27bd2b3a8e2723cad9eff8059e49b45b4f63bb0cd39199832e5ea216190e431218e34b1f72f354a8510dae78a3721be5963e0f285883153d45414857079f42e067727752f1fb88af9fec5bad836e483ece765b7bf635af346af819437d4418cd623d61ecff5681b4463a25abaa73559a1e570059b0e235799940a6dba3963288692f31884d8fbd1cf05566457	9ae7ab0afccf76719a56fbf5c016995aa52043b2d4649b4f9f8822d31f5e5296.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\85A408C09C193E5D51587DCDD61330FD8CDE37BF\Blob = 5c00000001000000040000000008000004000000010000001000000074014a91b108c458ce47cdf0dd11530803000000010000001400000085a408c09c193e5d51587dcdd61330fd8cde37bf7e0000000100000008000000000063f58926d7011d000000010000001000000048c1184e28125121aeeef1a32ce0d46714000000010000001400000031c3791bbaf553d717e0897a2d176c0ab32b9d33090000000100000020000000301e06082b0601050507030206082b0601050507030406082b06010505070301620000000100000020000000b6191a50d0c3977f7da99bcdaac86a227daeb9679ec70ba3b0c9d92271c170d30b0000000100000036000000440065007500740073006300680065002000540065006c0065006b006f006d00200052006f006f0074002000430041002000320000000f0000000100000014000000ff99b1116eca7b69f516900dea2d12202453b5111900000001000000100000000790dd35d0de1a5516689a62748c58eb2000000001000000a30300003082039f30820287a003020102020126300d06092a864886f70d01010505003071310b3009060355040613024445311c301a060355040a131344657574736368652054656c656b6f6d204147311f301d060355040b1316542d54656c655365632054727573742043656e746572312330210603550403131a44657574736368652054656c656b6f6d20526f6f742043412032301e170d3939303730393132313130305a170d3139303730393233353930305a3071310b3009060355040613024445311c301a060355040a131344657574736368652054656c656b6f6d204147311f301d060355040b1316542d54656c655365632054727573742043656e746572312330210603550403131a44657574736368652054656c656b6f6d20526f6f74204341203230820122300d06092a864886f70d01010105000382010f003082010a0282010100ab0ba335e08b2914b11485af3c10e4396f355d4aaeddea618d9549f46f64a31a6066a4a9402284d9d4a5e578930e6801adb94d5c3aced3b8a84240dfcfa3ba82596a921bac1c9ada082b2527f9692347f1e0eb2c7a9bf51302d07e347cc29e3c0059abf5da0cf5323c2bac50dad6c3de8394caa80c99320e0848565b6afbdae1585801495f72413c1506018e5dadaab893b4cd9eeba7e86a2d5234db3aef5c7551dadbf331f9ee719832c45415440cf99b55edaddf1808a0a3868a49ee53058f194cd5de58799bd26a1c42abc5d5a7cf680f96e4e161987661c8917cd63e00e2915087e19d0ae6ad97d21dc63a7dcbbcda0334d58e5b01f56a07b716b66e4a7f0203010001a3423040301d0603551d0e0416041431c3791bbaf553d717e0897a2d176c0ab32b9d33300f0603551d13040830060101ff020105300e0603551d0f0101ff040403020106300d06092a864886f70d01010505000382010100946459ad3964e729eb13fe5ac38b1357c80424f07477c060e367fbe989a683bf96827c6ed4c33def9e806ebb29b4987ab13b54eb3917477e1a8e0bfc1f31593104b2ce17f32cc7623655e222d88955b49848aa64fad61c36d844785a5a233a5797f57a304fae9f6a4c4b2b8ea003e33ee0a9d4d27bd2b3a8e2723cad9eff8059e49b45b4f63bb0cd39199832e5ea216190e431218e34b1f72f354a8510dae78a3721be5963e0f285883153d45414857079f42e067727752f1fb88af9fec5bad836e483ece765b7bf635af346af819437d4418cd623d61ecff5681b4463a25abaa73559a1e570059b0e235799940a6dba3963288692f31884d8fbd1cf05566457	9ae7ab0afccf76719a56fbf5c016995aa52043b2d4649b4f9f8822d31f5e5296.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\SystemCertificates\CA\Certificates\2F7AA2D86056A8775796F798C481A079E538E004	9ae7ab0afccf76719a56fbf5c016995aa52043b2d4649b4f9f8822d31f5e5296.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\SystemCertificates\CA\Certificates\2F7AA2D86056A8775796F798C481A079E538E004\Blob = 0300000001000000140000002f7aa2d86056a8775796f798c481a079e538e00414000000010000001400000012c9889b2fc9447a7d12f1df4003429892c724d6040000000100000010000000249f06a9652b2112fc4d7368e6372fec0f00000001000000200000008929be84b4db8bea07b5a70b3bc65a39b1e9b28722689c21893afae875b2ed0c190000000100000010000000d0e6e37d30133bf9aa9f1b76135668425c0000000100000004000000000800001800000001000000100000000f3a0527d242de2dc98e5cfcb1e991ee2000000001000000550500003082055130820439a00302010202100c08966535b942a9735265e4f97540bc300d06092a864886f70d01010b05003061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f74204341301e170d3230303731363132323134345a170d3233303533313233353935395a3059310b300906035504061302555331153013060355040a130c446967694365727420496e63313330310603550403132a47656f547275737420544c5320445620525341204d697865642053484132353620323032302043412d3130820122300d06092a864886f70d01010105000382010f003082010a0282010100b3bd41fb6be6dfa251bf541463c675a651eee388a73a78a09b9e5b917ca5a85933fac66c0750339979fa53f1cc16dde5a69961d34da2ef939402e4c4c95f97d11a6e09da34540bb238c6dd4dad717dbade9bedcb49a04bc363a77f3364b7c7ba7673d21b5286ae9c12e4e7a0ab7cf3efaad5da852308682b1c78e69bafb466fe47d5c18b632c5ccc02f211ded0e9a40c8db9f99accebcc83ab5d84e0aaed19df8f3b553a43b65c114e5af431b6eabd646858109966b2bef39f1a858312a8d7025fec271e6fdf8f80c747edde4b33d31f78b4193b8b13d5f35af35373dd9429245b6d5916cf01c92eeb50450e99f9b6de4527a45e306f8fc3cd4767082d3188c90203010001a382020b30820207301d0603551d0e0416041412c9889b2fc9447a7d12f1df4003429892c724d6301f0603551d2304183016801403de503556d14cbb66f0a3e21b1bc397b23dd155300e0603551d0f0101ff040403020186301d0603551d250416301406082b0601050507030106082b0601050507030230120603551d130101ff040830060101ff020100303406082b0601050507010104283026302406082b060105050730018618687474703a2f2f6f6373702e64696769636572742e636f6d307b0603551d1f047430723037a035a0338631687474703a2f2f63726c332e64696769636572742e636f6d2f4469676943657274476c6f62616c526f6f7443412e63726c3037a035a0338631687474703a2f2f63726c342e64696769636572742e636f6d2f4469676943657274476c6f62616c526f6f7443412e63726c3081ce0603551d200481c63081c33081c00604551d20003081b7302806082b06010505070201161c68747470733a2f2f7777772e64696769636572742e636f6d2f43505330818a06082b06010505070202307e0c7c416e7920757365206f66207468697320436572746966696361746520636f6e737469747574657320616363657074616e6365206f66207468652052656c79696e672050617274792041677265656d656e74206c6f63617465642061742068747470733a2f2f7777772e64696769636572742e636f6d2f7270612d7561300d06092a864886f70d01010b050003820101007f4bfc33ba6545c2d8416b8e48ab3c02c8fa11b0e61e714ecc57f7b57473f922b366d3ab97940b27c90eec681a72450ba8875a14c4ba8b178db3b1a576074a0e9852b0f602ab8596ff420ac2f3af50013dc6c7f5834b4ce2c7e300d4df3861f3e914914b7882cca69e7ab2a63afa90f80529512072cc4abd23ec3c6bcb586b2724562ddedc1ebb3bbaa1e7560a02812847f57b2dcb9d13b87959eb40799ae97afc6ef9fa9a410b3b667b87334029f321c619ffc944f5949ff11467e87c13d6bd2313cd2b27d5fe8bba6df3ea58bc17acd14e993c89c12aed7f96c04284c91c31cb3347a1e5f69539909df5aa2b56a10b4df2f54fcd48118e88aec57257a53d12	9ae7ab0afccf76719a56fbf5c016995aa52043b2d4649b4f9f8822d31f5e5296.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\SystemCertificates\CA\Certificates\33E4E80807204C2B6182A3A14B591ACD25B5F0DB\Blob = 03000000010000001400000033e4e80807204c2b6182a3a14b591acd25b5f0db1400000001000000140000008d8c5ec454ad8ae177e99bf99b05e1b8018d61e1040000000100000010000000adab5c4df031fb9299f71ada7e18f6130f00000001000000300000008b612b2190a95b28b866b9be5d0b95f368c17534ab1da61a42dfb32766f9ae2908fe6bfd1669be140eddaf0d33e95235190000000100000010000000fc741b3b78cfb31e075744fe5d0eeb965c000000010000000400000000080000180000000100000010000000ea6089055218053dd01e37e1d806eedf20000000010000001706000030820613308203fba00302010202107d5b5126b476ba11db74160bbc530da7300d06092a864886f70d01010c0500308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f72697479301e170d3138313130323030303030305a170d3330313233313233353935395a30818f310b3009060355040613024742311b30190603550408131247726561746572204d616e636865737465723110300e0603550407130753616c666f726431183016060355040a130f5365637469676f204c696d69746564313730350603550403132e5365637469676f2052534120446f6d61696e2056616c69646174696f6e205365637572652053657276657220434130820122300d06092a864886f70d01010105000382010f003082010a0282010100d67333d6d73c20d000d21745b8d63e07a23fc741ee3230c9b06cfdf49fcb12980f2d3f8d4d010c820f177f622ee9b84879fb16834eadd7322593b707bfb9503fa94cc3402ae939ffd981ca1f163241da8026b9237a87201ee3ff209a3c95446f8775069040b4329316091008233ed2dd870f6f5d51146a0a69c54f017269cfd3934c6d04a0a31b827eb19ab9edc59ec537789f9a0834fb562e58c4090e06645bbc37dcf19f2868a856b092a35c9fbb8898081b241dab3085aeafb02e9e7a9dc1c0421ce202f0eae04ad2ef900eb4c14016f06f85424a64f7a430a0febf2ea3275a8e8b58b8adc319178463ed6f56fd83cb6034c474bee69ddbe1e4e5ca0c5f150203010001a382016e3082016a301f0603551d230418301680145379bf5aaa2b4acf5480e1d89bc09df2b20366cb301d0603551d0e041604148d8c5ec454ad8ae177e99bf99b05e1b8018d61e1300e0603551d0f0101ff04040302018630120603551d130101ff040830060101ff020100301d0603551d250416301406082b0601050507030106082b06010505070302301b0603551d200414301230060604551d20003008060667810c01020130500603551d1f044930473045a043a041863f687474703a2f2f63726c2e7573657274727573742e636f6d2f55534552547275737452534143657274696669636174696f6e417574686f726974792e63726c307606082b06010505070101046a3068303f06082b060105050730028633687474703a2f2f6372742e7573657274727573742e636f6d2f555345525472757374525341416464547275737443412e637274302506082b060105050730018619687474703a2f2f6f6373702e7573657274727573742e636f6d300d06092a864886f70d01010c0500038202010032bf61bd0e48c34fc7ba474df89c781901dc131d806ffcc370b4529a31339a5752fb319e6ba4ef54aa898d401768f811107cd2cab1f15586c7eeb3369186f63951bf46bf0fa0bab4f77e49c42a36179ee468397aaf944e566fb27b3bbf0a86bdcdc5771c03b838b1a21f5f7edb8adc4648b6680acfb2b5b4e234e467a93866095ed2b8fc9d283a174027c2724e29fd213c7ccf13fb962cc53144fd13edd59ba96968777ceee1ffa4f93638085339a284349c19f3be0eacd52437eb23a878d0d3e7ef924764623922efc6f711be2285c6664424268e10328dc893ae079e833e2fd9f9f5468e63bec1e6b4dca6cd21a8860a95d92e85261afdfcb1b657426d95d133f6391406824138f58f58dc805ba4d57d9578fda79bfffdc5a869ab26e7a7a405875ba9b7b8a3200b97a94585ddb38be589378e290dfc0617f638400e42e41206fb7bf3c6116862dfe398f413d8154f8bb169d91060bc642aea31b7e4b5a33a149b26e30b7bfd028eb699c138975936f6a874a286b65eebc664eacfa0a3f96e9eba2d11b6869808582dc9ac2564f25e75b438c1ae7f5a4683ea51cab6f19911356ba56a7bc600b0e7f8be64b2adc8c2f1ace351eaa493e079c8e18140c90a5be1123cc1602ae397c08942ca94cf46981269bb98d0c2d30d724b476ee593c43228638743e4b0323e0ad34bbf239b1429412b9a041f932df1c739483cad5a127f	9ae7ab0afccf76719a56fbf5c016995aa52043b2d4649b4f9f8822d31f5e5296.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\85A408C09C193E5D51587DCDD61330FD8CDE37BF	9ae7ab0afccf76719a56fbf5c016995aa52043b2d4649b4f9f8822d31f5e5296.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

Processes:

9ae7ab0afccf76719a56fbf5c016995aa52043b2d4649b4f9f8822d31f5e5296.exe

pid	process
636	9ae7ab0afccf76719a56fbf5c016995aa52043b2d4649b4f9f8822d31f5e5296.exe
636	9ae7ab0afccf76719a56fbf5c016995aa52043b2d4649b4f9f8822d31f5e5296.exe
636	9ae7ab0afccf76719a56fbf5c016995aa52043b2d4649b4f9f8822d31f5e5296.exe
636	9ae7ab0afccf76719a56fbf5c016995aa52043b2d4649b4f9f8822d31f5e5296.exe
636	9ae7ab0afccf76719a56fbf5c016995aa52043b2d4649b4f9f8822d31f5e5296.exe
636	9ae7ab0afccf76719a56fbf5c016995aa52043b2d4649b4f9f8822d31f5e5296.exe
636	9ae7ab0afccf76719a56fbf5c016995aa52043b2d4649b4f9f8822d31f5e5296.exe
636	9ae7ab0afccf76719a56fbf5c016995aa52043b2d4649b4f9f8822d31f5e5296.exe
636	9ae7ab0afccf76719a56fbf5c016995aa52043b2d4649b4f9f8822d31f5e5296.exe
636	9ae7ab0afccf76719a56fbf5c016995aa52043b2d4649b4f9f8822d31f5e5296.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

Processes:

9ae7ab0afccf76719a56fbf5c016995aa52043b2d4649b4f9f8822d31f5e5296.exevssvc.exe

description	pid	process
Token: SeDebugPrivilege	636	9ae7ab0afccf76719a56fbf5c016995aa52043b2d4649b4f9f8822d31f5e5296.exe
Token: SeTakeOwnershipPrivilege	636	9ae7ab0afccf76719a56fbf5c016995aa52043b2d4649b4f9f8822d31f5e5296.exe
Token: SeBackupPrivilege	1356	vssvc.exe
Token: SeRestorePrivilege	1356	vssvc.exe
Token: SeAuditPrivilege	1356	vssvc.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

9ae7ab0afccf76719a56fbf5c016995aa52043b2d4649b4f9f8822d31f5e5296.exe

description	pid	process	target process
PID 636 wrote to memory of 1948	636	9ae7ab0afccf76719a56fbf5c016995aa52043b2d4649b4f9f8822d31f5e5296.exe	netsh.exe
PID 636 wrote to memory of 1948	636	9ae7ab0afccf76719a56fbf5c016995aa52043b2d4649b4f9f8822d31f5e5296.exe	netsh.exe
PID 636 wrote to memory of 1948	636	9ae7ab0afccf76719a56fbf5c016995aa52043b2d4649b4f9f8822d31f5e5296.exe	netsh.exe

C:\Users\Admin\AppData\Local\Temp\9ae7ab0afccf76719a56fbf5c016995aa52043b2d4649b4f9f8822d31f5e5296.exe
"C:\Users\Admin\AppData\Local\Temp\9ae7ab0afccf76719a56fbf5c016995aa52043b2d4649b4f9f8822d31f5e5296.exe"
1⤵
- Modifies extensions of user files
- Adds Run key to start application
- Enumerates connected drives
- Sets desktop wallpaper using registry
- Drops file in Program Files directory
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:636