Analysis
-
max time kernel
151s -
max time network
161s -
platform
windows10_x64 -
resource
win10v20210408 -
submitted
10-09-2021 11:25
Static task
static1
Behavioral task
behavioral1
Sample
bf091130fc783c47357403716f5c9c217b5ade94f6385df4402e86135ffb8b38.bin.sample.exe
Resource
win7-en
Behavioral task
behavioral2
Sample
bf091130fc783c47357403716f5c9c217b5ade94f6385df4402e86135ffb8b38.bin.sample.exe
Resource
win10v20210408
General
-
Target
bf091130fc783c47357403716f5c9c217b5ade94f6385df4402e86135ffb8b38.bin.sample.exe
-
Size
144KB
-
MD5
6eaaae60fecab071f00a117bf4992165
-
SHA1
3f84dbcedf11fd985c4400ccf7c028eb3c7cfaf8
-
SHA256
bf091130fc783c47357403716f5c9c217b5ade94f6385df4402e86135ffb8b38
-
SHA512
d7768a4cafc855cef3cf41ea5417a2ba9c9847a14fd93d94c3d9c9672f7d2f986cc315cdb753b623aa1101b6da3dce3e839f6b01073b798c0550bcf95a925a1e
Malware Config
Extracted
C:\iy2d2y-readme.txt
sodinokibi
http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/F8645809FC93C123
http://decryptor.top/F8645809FC93C123
Signatures
-
Sodin,Sodinokibi,REvil
Ransomware with advanced anti-analysis and privilege escalation functionality.
-
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Modifies extensions of user files 6 IoCs
Ransomware generally changes the extension on encrypted files.
Processes:
bf091130fc783c47357403716f5c9c217b5ade94f6385df4402e86135ffb8b38.bin.sample.exedescription ioc process File renamed C:\Users\Admin\Pictures\RenameUse.crw => \??\c:\users\admin\pictures\RenameUse.crw.iy2d2y bf091130fc783c47357403716f5c9c217b5ade94f6385df4402e86135ffb8b38.bin.sample.exe File renamed C:\Users\Admin\Pictures\ShowStep.tif => \??\c:\users\admin\pictures\ShowStep.tif.iy2d2y bf091130fc783c47357403716f5c9c217b5ade94f6385df4402e86135ffb8b38.bin.sample.exe File renamed C:\Users\Admin\Pictures\TestRestore.tif => \??\c:\users\admin\pictures\TestRestore.tif.iy2d2y bf091130fc783c47357403716f5c9c217b5ade94f6385df4402e86135ffb8b38.bin.sample.exe File renamed C:\Users\Admin\Pictures\ConvertFromStop.raw => \??\c:\users\admin\pictures\ConvertFromStop.raw.iy2d2y bf091130fc783c47357403716f5c9c217b5ade94f6385df4402e86135ffb8b38.bin.sample.exe File renamed C:\Users\Admin\Pictures\DenyRevoke.crw => \??\c:\users\admin\pictures\DenyRevoke.crw.iy2d2y bf091130fc783c47357403716f5c9c217b5ade94f6385df4402e86135ffb8b38.bin.sample.exe File renamed C:\Users\Admin\Pictures\ExportWrite.crw => \??\c:\users\admin\pictures\ExportWrite.crw.iy2d2y bf091130fc783c47357403716f5c9c217b5ade94f6385df4402e86135ffb8b38.bin.sample.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Enumerates connected drives 3 TTPs 25 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
bf091130fc783c47357403716f5c9c217b5ade94f6385df4402e86135ffb8b38.bin.sample.exedescription ioc process File opened (read-only) \??\Y: bf091130fc783c47357403716f5c9c217b5ade94f6385df4402e86135ffb8b38.bin.sample.exe File opened (read-only) \??\K: bf091130fc783c47357403716f5c9c217b5ade94f6385df4402e86135ffb8b38.bin.sample.exe File opened (read-only) \??\N: bf091130fc783c47357403716f5c9c217b5ade94f6385df4402e86135ffb8b38.bin.sample.exe File opened (read-only) \??\T: bf091130fc783c47357403716f5c9c217b5ade94f6385df4402e86135ffb8b38.bin.sample.exe File opened (read-only) \??\H: bf091130fc783c47357403716f5c9c217b5ade94f6385df4402e86135ffb8b38.bin.sample.exe File opened (read-only) \??\M: bf091130fc783c47357403716f5c9c217b5ade94f6385df4402e86135ffb8b38.bin.sample.exe File opened (read-only) \??\W: bf091130fc783c47357403716f5c9c217b5ade94f6385df4402e86135ffb8b38.bin.sample.exe File opened (read-only) \??\O: bf091130fc783c47357403716f5c9c217b5ade94f6385df4402e86135ffb8b38.bin.sample.exe File opened (read-only) \??\Q: bf091130fc783c47357403716f5c9c217b5ade94f6385df4402e86135ffb8b38.bin.sample.exe File opened (read-only) \??\R: bf091130fc783c47357403716f5c9c217b5ade94f6385df4402e86135ffb8b38.bin.sample.exe File opened (read-only) \??\S: bf091130fc783c47357403716f5c9c217b5ade94f6385df4402e86135ffb8b38.bin.sample.exe File opened (read-only) \??\U: bf091130fc783c47357403716f5c9c217b5ade94f6385df4402e86135ffb8b38.bin.sample.exe File opened (read-only) \??\E: bf091130fc783c47357403716f5c9c217b5ade94f6385df4402e86135ffb8b38.bin.sample.exe File opened (read-only) \??\F: bf091130fc783c47357403716f5c9c217b5ade94f6385df4402e86135ffb8b38.bin.sample.exe File opened (read-only) \??\I: bf091130fc783c47357403716f5c9c217b5ade94f6385df4402e86135ffb8b38.bin.sample.exe File opened (read-only) \??\D: bf091130fc783c47357403716f5c9c217b5ade94f6385df4402e86135ffb8b38.bin.sample.exe File opened (read-only) \??\J: bf091130fc783c47357403716f5c9c217b5ade94f6385df4402e86135ffb8b38.bin.sample.exe File opened (read-only) \??\L: bf091130fc783c47357403716f5c9c217b5ade94f6385df4402e86135ffb8b38.bin.sample.exe File opened (read-only) \??\P: bf091130fc783c47357403716f5c9c217b5ade94f6385df4402e86135ffb8b38.bin.sample.exe File opened (read-only) \??\V: bf091130fc783c47357403716f5c9c217b5ade94f6385df4402e86135ffb8b38.bin.sample.exe File opened (read-only) \??\X: bf091130fc783c47357403716f5c9c217b5ade94f6385df4402e86135ffb8b38.bin.sample.exe File opened (read-only) \??\A: bf091130fc783c47357403716f5c9c217b5ade94f6385df4402e86135ffb8b38.bin.sample.exe File opened (read-only) \??\B: bf091130fc783c47357403716f5c9c217b5ade94f6385df4402e86135ffb8b38.bin.sample.exe File opened (read-only) \??\G: bf091130fc783c47357403716f5c9c217b5ade94f6385df4402e86135ffb8b38.bin.sample.exe File opened (read-only) \??\Z: bf091130fc783c47357403716f5c9c217b5ade94f6385df4402e86135ffb8b38.bin.sample.exe -
Sets desktop wallpaper using registry 2 TTPs 1 IoCs
Processes:
bf091130fc783c47357403716f5c9c217b5ade94f6385df4402e86135ffb8b38.bin.sample.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\wjfy.bmp" bf091130fc783c47357403716f5c9c217b5ade94f6385df4402e86135ffb8b38.bin.sample.exe -
Drops file in Program Files directory 34 IoCs
Processes:
bf091130fc783c47357403716f5c9c217b5ade94f6385df4402e86135ffb8b38.bin.sample.exedescription ioc process File opened for modification \??\c:\program files\AddClear.docm bf091130fc783c47357403716f5c9c217b5ade94f6385df4402e86135ffb8b38.bin.sample.exe File opened for modification \??\c:\program files\FormatResolve.jfif bf091130fc783c47357403716f5c9c217b5ade94f6385df4402e86135ffb8b38.bin.sample.exe File opened for modification \??\c:\program files\RemoveBackup.jpeg bf091130fc783c47357403716f5c9c217b5ade94f6385df4402e86135ffb8b38.bin.sample.exe File opened for modification \??\c:\program files\SaveMount.wmv bf091130fc783c47357403716f5c9c217b5ade94f6385df4402e86135ffb8b38.bin.sample.exe File opened for modification \??\c:\program files\SuspendStart.emz bf091130fc783c47357403716f5c9c217b5ade94f6385df4402e86135ffb8b38.bin.sample.exe File opened for modification \??\c:\program files\ConvertProtect.xls bf091130fc783c47357403716f5c9c217b5ade94f6385df4402e86135ffb8b38.bin.sample.exe File opened for modification \??\c:\program files\MergeUndo.vssx bf091130fc783c47357403716f5c9c217b5ade94f6385df4402e86135ffb8b38.bin.sample.exe File opened for modification \??\c:\program files\ProtectClear.xps bf091130fc783c47357403716f5c9c217b5ade94f6385df4402e86135ffb8b38.bin.sample.exe File created \??\c:\program files (x86)\d60dff40.lock bf091130fc783c47357403716f5c9c217b5ade94f6385df4402e86135ffb8b38.bin.sample.exe File opened for modification \??\c:\program files\DisableDisconnect.7z bf091130fc783c47357403716f5c9c217b5ade94f6385df4402e86135ffb8b38.bin.sample.exe File opened for modification \??\c:\program files\DismountReceive.contact bf091130fc783c47357403716f5c9c217b5ade94f6385df4402e86135ffb8b38.bin.sample.exe File opened for modification \??\c:\program files\CheckpointLimit.bmp bf091130fc783c47357403716f5c9c217b5ade94f6385df4402e86135ffb8b38.bin.sample.exe File opened for modification \??\c:\program files\CompressHide.php bf091130fc783c47357403716f5c9c217b5ade94f6385df4402e86135ffb8b38.bin.sample.exe File opened for modification \??\c:\program files\EnterPublish.M2T bf091130fc783c47357403716f5c9c217b5ade94f6385df4402e86135ffb8b38.bin.sample.exe File opened for modification \??\c:\program files\SaveRead.xltm bf091130fc783c47357403716f5c9c217b5ade94f6385df4402e86135ffb8b38.bin.sample.exe File opened for modification \??\c:\program files\SplitCheckpoint.odt bf091130fc783c47357403716f5c9c217b5ade94f6385df4402e86135ffb8b38.bin.sample.exe File created \??\c:\program files\d60dff40.lock bf091130fc783c47357403716f5c9c217b5ade94f6385df4402e86135ffb8b38.bin.sample.exe File created \??\c:\program files (x86)\iy2d2y-readme.txt bf091130fc783c47357403716f5c9c217b5ade94f6385df4402e86135ffb8b38.bin.sample.exe File opened for modification \??\c:\program files\CopyWatch.emz bf091130fc783c47357403716f5c9c217b5ade94f6385df4402e86135ffb8b38.bin.sample.exe File opened for modification \??\c:\program files\GrantDebug.ttc bf091130fc783c47357403716f5c9c217b5ade94f6385df4402e86135ffb8b38.bin.sample.exe File opened for modification \??\c:\program files\InitializeRequest.wmx bf091130fc783c47357403716f5c9c217b5ade94f6385df4402e86135ffb8b38.bin.sample.exe File opened for modification \??\c:\program files\MergeEnable.css bf091130fc783c47357403716f5c9c217b5ade94f6385df4402e86135ffb8b38.bin.sample.exe File created \??\c:\program files\iy2d2y-readme.txt bf091130fc783c47357403716f5c9c217b5ade94f6385df4402e86135ffb8b38.bin.sample.exe File opened for modification \??\c:\program files\RequestUndo.AAC bf091130fc783c47357403716f5c9c217b5ade94f6385df4402e86135ffb8b38.bin.sample.exe File opened for modification \??\c:\program files\RestoreDebug.vstm bf091130fc783c47357403716f5c9c217b5ade94f6385df4402e86135ffb8b38.bin.sample.exe File opened for modification \??\c:\program files\SelectClear.midi bf091130fc783c47357403716f5c9c217b5ade94f6385df4402e86135ffb8b38.bin.sample.exe File opened for modification \??\c:\program files\CloseUnblock.3g2 bf091130fc783c47357403716f5c9c217b5ade94f6385df4402e86135ffb8b38.bin.sample.exe File opened for modification \??\c:\program files\UpdateRename.html bf091130fc783c47357403716f5c9c217b5ade94f6385df4402e86135ffb8b38.bin.sample.exe File opened for modification \??\c:\program files\ConfirmEdit.htm bf091130fc783c47357403716f5c9c217b5ade94f6385df4402e86135ffb8b38.bin.sample.exe File opened for modification \??\c:\program files\CopyUninstall.avi bf091130fc783c47357403716f5c9c217b5ade94f6385df4402e86135ffb8b38.bin.sample.exe File opened for modification \??\c:\program files\RenameExport.search-ms bf091130fc783c47357403716f5c9c217b5ade94f6385df4402e86135ffb8b38.bin.sample.exe File opened for modification \??\c:\program files\RestoreDisable.vsdm bf091130fc783c47357403716f5c9c217b5ade94f6385df4402e86135ffb8b38.bin.sample.exe File opened for modification \??\c:\program files\StartTest.rm bf091130fc783c47357403716f5c9c217b5ade94f6385df4402e86135ffb8b38.bin.sample.exe File opened for modification \??\c:\program files\UndoUse.dwg bf091130fc783c47357403716f5c9c217b5ade94f6385df4402e86135ffb8b38.bin.sample.exe -
Drops file in Windows directory 64 IoCs
Processes:
bf091130fc783c47357403716f5c9c217b5ade94f6385df4402e86135ffb8b38.bin.sample.exedescription ioc process File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-font-bitmap-terminal_31bf3856ad364e35_10.0.15063.0_none_2583321dfa2b45c4_ega40852.fon_5e9154f7 bf091130fc783c47357403716f5c9c217b5ade94f6385df4402e86135ffb8b38.bin.sample.exe File opened for modification C:\Windows\WinSxS\Backup\wow64_microsoft-windows-i..i_initiator_service_31bf3856ad364e35_10.0.15063.0_none_f5dc2ec982476ba8_iscsidsc.dll_20ed5065 bf091130fc783c47357403716f5c9c217b5ade94f6385df4402e86135ffb8b38.bin.sample.exe File opened for modification C:\Windows\WinSxS\Backup\x86_microsoft-windows-i..er-engine.resources_31bf3856ad364e35_10.0.15063.0_fr-fr_9e9a00a6d22ab935_msimsg.dll.mui_72e8994f bf091130fc783c47357403716f5c9c217b5ade94f6385df4402e86135ffb8b38.bin.sample.exe File opened for modification C:\Windows\WinSxS\Backup\x86_microsoft-windows-shacct-profile_31bf3856ad364e35_10.0.15063.0_none_5f3934b34f0c64f8.manifest bf091130fc783c47357403716f5c9c217b5ade94f6385df4402e86135ffb8b38.bin.sample.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.15063.0_sv-se_7507d03f69e9add9_bootmgfw.efi.mui_a6e78cfa bf091130fc783c47357403716f5c9c217b5ade94f6385df4402e86135ffb8b38.bin.sample.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-font-bitmap-oem_31bf3856ad364e35_10.0.15063.0_none_0e77f624e73557a1_j8514oem.fon_cf1af1d6 bf091130fc783c47357403716f5c9c217b5ade94f6385df4402e86135ffb8b38.bin.sample.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-w..e-ws2ifsl.resources_31bf3856ad364e35_10.0.15063.0_en-us_3ac92db0078e1b3e.manifest bf091130fc783c47357403716f5c9c217b5ade94f6385df4402e86135ffb8b38.bin.sample.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft.windows.c..-controls.resources_6595b64144ccf1df_6.0.15063.0_nl-nl_dfa589a69594078d_comctl32.dll.mui_0da4e682 bf091130fc783c47357403716f5c9c217b5ade94f6385df4402e86135ffb8b38.bin.sample.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_windows-defender-service_31bf3856ad364e35_10.0.15063.0_none_d6b9fc078f9b4d5a.manifest bf091130fc783c47357403716f5c9c217b5ade94f6385df4402e86135ffb8b38.bin.sample.exe File opened for modification C:\Windows\WinSxS\Backup\x86_microsoft.windows.c..-controls.resources_6595b64144ccf1df_5.82.15063.0_fr-fr_43dca1da7c0ef9e0_comctl32.dll.mui_0da4e682 bf091130fc783c47357403716f5c9c217b5ade94f6385df4402e86135ffb8b38.bin.sample.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-atlthunk_31bf3856ad364e35_10.0.15063.0_none_9efa658809ec8a45.manifest bf091130fc783c47357403716f5c9c217b5ade94f6385df4402e86135ffb8b38.bin.sample.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-s..-webauthn.resources_31bf3856ad364e35_10.0.15063.0_en-us_324d9d52150f7e18.manifest bf091130fc783c47357403716f5c9c217b5ade94f6385df4402e86135ffb8b38.bin.sample.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft.windows.c..-controls.resources_6595b64144ccf1df_5.82.15063.0_et-ee_5337c09478c69707.manifest bf091130fc783c47357403716f5c9c217b5ade94f6385df4402e86135ffb8b38.bin.sample.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-rasbase_31bf3856ad364e35_10.0.15063.0_none_1ef4411ab33dfe81.manifest bf091130fc783c47357403716f5c9c217b5ade94f6385df4402e86135ffb8b38.bin.sample.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-user32.resources_31bf3856ad364e35_10.0.15063.0_en-us_4f11d10363ebf375_user32.dll.mui_14652dbb bf091130fc783c47357403716f5c9c217b5ade94f6385df4402e86135ffb8b38.bin.sample.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-appidcore.resources_31bf3856ad364e35_10.0.15063.0_en-us_6a6c9bb281748302.manifest bf091130fc783c47357403716f5c9c217b5ade94f6385df4402e86135ffb8b38.bin.sample.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-eventlog-api_31bf3856ad364e35_10.0.15063.0_none_bd44db559e18ebcf.manifest bf091130fc783c47357403716f5c9c217b5ade94f6385df4402e86135ffb8b38.bin.sample.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-n..-domain-clients-svc_31bf3856ad364e35_10.0.15063.0_none_5522510b24d3f7d4_winipsec.dll_abfff1a2 bf091130fc783c47357403716f5c9c217b5ade94f6385df4402e86135ffb8b38.bin.sample.exe File opened for modification C:\Windows\WinSxS\Backup\wow64_microsoft-windows-usermodensi.resources_31bf3856ad364e35_10.0.15063.0_en-us_57b999b44d02ade0_nsisvc.dll.mui_237a741f bf091130fc783c47357403716f5c9c217b5ade94f6385df4402e86135ffb8b38.bin.sample.exe File opened for modification C:\Windows\WinSxS\Backup\x86_microsoft-windows-b..ager-pcat.resources_31bf3856ad364e35_10.0.15063.0_it-it_6121d09b708d304c_bootmgr.exe.mui_c434701f bf091130fc783c47357403716f5c9c217b5ade94f6385df4402e86135ffb8b38.bin.sample.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.15063.0_fr-ca_2ae4eb43198d1604.manifest bf091130fc783c47357403716f5c9c217b5ade94f6385df4402e86135ffb8b38.bin.sample.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-security-spp_31bf3856ad364e35_10.0.15063.0_none_2b7530b159c1ac4e_sppsvc.exe_fc6922a9 bf091130fc783c47357403716f5c9c217b5ade94f6385df4402e86135ffb8b38.bin.sample.exe File opened for modification C:\Windows\WinSxS\Backup\wow64_microsoft-windows-appidcore_31bf3856ad364e35_10.0.15063.0_none_4a395d1c23946704.manifest bf091130fc783c47357403716f5c9c217b5ade94f6385df4402e86135ffb8b38.bin.sample.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-netio-infrastructure_31bf3856ad364e35_10.0.15063.0_none_67af460eee1c40c7_netio.sys_a06e75d0 bf091130fc783c47357403716f5c9c217b5ade94f6385df4402e86135ffb8b38.bin.sample.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-network-qos-pacer_31bf3856ad364e35_10.0.15063.0_none_fe1c808cb068e532_wshqos.dll_f1749d15 bf091130fc783c47357403716f5c9c217b5ade94f6385df4402e86135ffb8b38.bin.sample.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft.windows.c..-controls.resources_6595b64144ccf1df_6.0.15063.0_lt-lt_9c9ee934ae6a9d99_comctl32.dll.mui_0da4e682 bf091130fc783c47357403716f5c9c217b5ade94f6385df4402e86135ffb8b38.bin.sample.exe File opened for modification C:\Windows\WinSxS\Backup\wow64_microsoft-windows-rasbase.resources_31bf3856ad364e35_10.0.15063.0_en-us_798014d122d0d80d_kmddsp.tsp.mui_80ddeedb bf091130fc783c47357403716f5c9c217b5ade94f6385df4402e86135ffb8b38.bin.sample.exe File opened for modification C:\Windows\WinSxS\Backup\x86_microsoft-windows-duser_31bf3856ad364e35_10.0.15063.0_none_0f69ebfe7cebca2b_duser.dll_a2bd2fa9 bf091130fc783c47357403716f5c9c217b5ade94f6385df4402e86135ffb8b38.bin.sample.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-b..os-loader.resources_31bf3856ad364e35_10.0.15063.0_en-us_87ac933f1cd28fdb_winload.efi.mui_35ee487d bf091130fc783c47357403716f5c9c217b5ade94f6385df4402e86135ffb8b38.bin.sample.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-i..i_initiator_service_31bf3856ad364e35_10.0.15063.0_none_eb8784774de6a9ad_iscsied.dll_e933fb0e bf091130fc783c47357403716f5c9c217b5ade94f6385df4402e86135ffb8b38.bin.sample.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-netbt-minwin_31bf3856ad364e35_10.0.15063.0_none_fcc05a7b10ae7f46.manifest bf091130fc783c47357403716f5c9c217b5ade94f6385df4402e86135ffb8b38.bin.sample.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-m..ntmanager.resources_31bf3856ad364e35_10.0.15063.0_en-us_4e210a027815c2f3_mountmgr.sys.mui_71b54a25 bf091130fc783c47357403716f5c9c217b5ade94f6385df4402e86135ffb8b38.bin.sample.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-s..turalauthentication_31bf3856ad364e35_10.0.15063.0_none_04ced512d82feb94.manifest bf091130fc783c47357403716f5c9c217b5ade94f6385df4402e86135ffb8b38.bin.sample.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-shell32_31bf3856ad364e35_10.0.15063.0_none_7d3d04174acaa727_oemdefaultassociations.xml_e03ae813 bf091130fc783c47357403716f5c9c217b5ade94f6385df4402e86135ffb8b38.bin.sample.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft.windows.c..-controls.resources_6595b64144ccf1df_5.82.15063.0_lt-lt_cfb1e90d16785ae6_comctl32.dll.mui_0da4e682 bf091130fc783c47357403716f5c9c217b5ade94f6385df4402e86135ffb8b38.bin.sample.exe File opened for modification C:\Windows\WinSxS\Backup\x86_microsoft.windows.c..-controls.resources_6595b64144ccf1df_6.0.15063.0_sv-se_5362d14869363a8e.manifest bf091130fc783c47357403716f5c9c217b5ade94f6385df4402e86135ffb8b38.bin.sample.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-font-bitmap-fixed_31bf3856ad364e35_10.0.15063.0_none_9023bb87676e429a_vgafixe.fon_dea8b251 bf091130fc783c47357403716f5c9c217b5ade94f6385df4402e86135ffb8b38.bin.sample.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-font-bitmap-oem_31bf3856ad364e35_10.0.15063.0_none_0e77f624e73557a1_vga775.fon_05cd499c bf091130fc783c47357403716f5c9c217b5ade94f6385df4402e86135ffb8b38.bin.sample.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-g..licy-base.resources_31bf3856ad364e35_10.0.15063.0_en-us_d24874d4a9b4e91a.manifest bf091130fc783c47357403716f5c9c217b5ade94f6385df4402e86135ffb8b38.bin.sample.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft.windows.c..-controls.resources_6595b64144ccf1df_5.82.15063.0_he-il_404f12a54e01d1c8.manifest bf091130fc783c47357403716f5c9c217b5ade94f6385df4402e86135ffb8b38.bin.sample.exe File opened for modification C:\Windows\WinSxS\Backup\wow64_microsoft-windows-smartcardsubsystem_31bf3856ad364e35_10.0.15063.0_none_3365c32fd72263c5_scarddlg.dll_b3dbecec bf091130fc783c47357403716f5c9c217b5ade94f6385df4402e86135ffb8b38.bin.sample.exe File opened for modification C:\Windows\WinSxS\Backup\x86_microsoft.windows.c..-controls.resources_6595b64144ccf1df_5.82.15063.0_sv-se_8675d120d143f7db_comctl32.dll.mui_0da4e682 bf091130fc783c47357403716f5c9c217b5ade94f6385df4402e86135ffb8b38.bin.sample.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-b..iagnostic.resources_31bf3856ad364e35_10.0.15063.0_sv-se_ad1932c30c08d5bf_memtest.efi.mui_71e15c22 bf091130fc783c47357403716f5c9c217b5ade94f6385df4402e86135ffb8b38.bin.sample.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-i..oexistencemigration_31bf3856ad364e35_10.0.15063.0_none_22f6ec0bb529250e.manifest bf091130fc783c47357403716f5c9c217b5ade94f6385df4402e86135ffb8b38.bin.sample.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-null_31bf3856ad364e35_10.0.15063.0_none_ba79c6b653cbc42f.manifest bf091130fc783c47357403716f5c9c217b5ade94f6385df4402e86135ffb8b38.bin.sample.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-b..iagnostic.resources_31bf3856ad364e35_10.0.15063.0_tr-tr_56267d09fac4d7b0_memtest.efi.mui_71e15c22 bf091130fc783c47357403716f5c9c217b5ade94f6385df4402e86135ffb8b38.bin.sample.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft.windows.c..-controls.resources_6595b64144ccf1df_6.0.15063.0_it-it_b3446171d6b6f90b.manifest bf091130fc783c47357403716f5c9c217b5ade94f6385df4402e86135ffb8b38.bin.sample.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-b..iagnostic.resources_31bf3856ad364e35_10.0.15063.0_da-dk_21e0c564d3266f5e.manifest bf091130fc783c47357403716f5c9c217b5ade94f6385df4402e86135ffb8b38.bin.sample.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-shlwapi_31bf3856ad364e35_10.0.15063.0_none_0aed8b3ddd7da4b2.manifest bf091130fc783c47357403716f5c9c217b5ade94f6385df4402e86135ffb8b38.bin.sample.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-shsvcs_31bf3856ad364e35_10.0.15063.0_none_de44366355bc504a.manifest bf091130fc783c47357403716f5c9c217b5ade94f6385df4402e86135ffb8b38.bin.sample.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-font-bitmap-oem_31bf3856ad364e35_10.0.15063.0_none_0e77f624e73557a1_8514oem.fon_c20e1190 bf091130fc783c47357403716f5c9c217b5ade94f6385df4402e86135ffb8b38.bin.sample.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft.windows.c..-controls.resources_6595b64144ccf1df_6.0.15063.0_lv-lv_9d6c57b8ade8de89.manifest bf091130fc783c47357403716f5c9c217b5ade94f6385df4402e86135ffb8b38.bin.sample.exe File opened for modification C:\Windows\WinSxS\Backup\wow64_microsoft-windows-d..ient-core.resources_31bf3856ad364e35_10.0.15063.0_en-us_32ab8a096e6c998f_dnsapi.dll.mui_97465f8a bf091130fc783c47357403716f5c9c217b5ade94f6385df4402e86135ffb8b38.bin.sample.exe File opened for modification C:\Windows\WinSxS\Backup\x86_microsoft.windows.c..-controls.resources_6595b64144ccf1df_5.82.15063.0_sv-se_8675d120d143f7db.manifest bf091130fc783c47357403716f5c9c217b5ade94f6385df4402e86135ffb8b38.bin.sample.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-appidcore.resources_31bf3856ad364e35_10.0.15063.0_en-us_6a6c9bb281748302_srpapi.dll.mui_2693a558 bf091130fc783c47357403716f5c9c217b5ade94f6385df4402e86135ffb8b38.bin.sample.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.15063.0_en-gb_886312f82692f412.manifest bf091130fc783c47357403716f5c9c217b5ade94f6385df4402e86135ffb8b38.bin.sample.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-com-base.resources_31bf3856ad364e35_10.0.15063.0_en-us_c99395587677579e_combase.dll.mui_6db10b33 bf091130fc783c47357403716f5c9c217b5ade94f6385df4402e86135ffb8b38.bin.sample.exe File opened for modification C:\Windows\WinSxS\Backup\wow64_microsoft-windows-gdi32full_31bf3856ad364e35_10.0.15063.0_none_7153f6fb947272a7.manifest bf091130fc783c47357403716f5c9c217b5ade94f6385df4402e86135ffb8b38.bin.sample.exe File opened for modification C:\Windows\WinSxS\Backup\wow64_microsoft-windows-i..i_initiator_service_31bf3856ad364e35_10.0.15063.0_none_f5dc2ec982476ba8_iscsium.dll_edf4260f bf091130fc783c47357403716f5c9c217b5ade94f6385df4402e86135ffb8b38.bin.sample.exe File opened for modification C:\Windows\WinSxS\Backup\x86_microsoft-windows-i..er-engine.resources_31bf3856ad364e35_10.0.15063.0_lt-lt_721c7eb081104341.manifest bf091130fc783c47357403716f5c9c217b5ade94f6385df4402e86135ffb8b38.bin.sample.exe File opened for modification C:\Windows\WinSxS\Backup\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.15063.0_none_8b4e86125c6fbfec.manifest bf091130fc783c47357403716f5c9c217b5ade94f6385df4402e86135ffb8b38.bin.sample.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-coresystemminpnp_31bf3856ad364e35_10.0.15063.0_none_1b70ea73251f149e.manifest bf091130fc783c47357403716f5c9c217b5ade94f6385df4402e86135ffb8b38.bin.sample.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-d..ndowmanager-effects_31bf3856ad364e35_10.0.15063.0_none_02178f11778cf984.manifest bf091130fc783c47357403716f5c9c217b5ade94f6385df4402e86135ffb8b38.bin.sample.exe File opened for modification C:\Windows\WinSxS\Backup\wow64_microsoft-windows-g..licy-base.resources_31bf3856ad364e35_10.0.15063.0_en-us_dc9d1f26de15ab15.manifest bf091130fc783c47357403716f5c9c217b5ade94f6385df4402e86135ffb8b38.bin.sample.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Interacts with shadow copies 2 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
Processes:
vssadmin.exepid process 1204 vssadmin.exe -
Processes:
bf091130fc783c47357403716f5c9c217b5ade94f6385df4402e86135ffb8b38.bin.sample.exedescription ioc process Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\2B8F1B57330DBBA2D07A6C51F70EE90DDAB9AD8E\Blob = 5c000000010000000400000000100000190000000100000010000000ea6089055218053dd01e37e1d806eedf0300000001000000140000002b8f1b57330dbba2d07a6c51f70ee90ddab9ad8e0b00000001000000100000005300650063007400690067006f0000001d0000000100000010000000885010358d29a38f059b028559c95f901400000001000000140000005379bf5aaa2b4acf5480e1d89bc09df2b20366cb620000000100000020000000e793c9b02fd8aa13e21c31228accb08119643b749c898964b1746d46c3d4cbd253000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b060105050703080f000000010000003000000066b764a96581128168cf208e374dda479d54e311f32457f4aee0dbd2a6c8d171d531289e1cd22bfdbbd4cfd9796254830400000001000000100000001bfe69d191b71933a372a80fe155e5b52000000001000000e2050000308205de308203c6a003020102021001fd6d30fca3ca51a81bbc640e35032d300d06092a864886f70d01010c0500308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f72697479301e170d3130303230313030303030305a170d3338303131383233353935395a308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f7269747930820222300d06092a864886f70d01010105000382020f003082020a028202010080126517360ec3db08b3d0ac570d76edcd27d34cad508361e2aa204d092d6409dcce899fcc3da9ecf6cfc1dcf1d3b1d67b3728112b47da39c6bc3a19b45fa6bd7d9da36342b676f2a93b2b91f8e26fd0ec162090093ee2e874c918b491d46264db7fa306f188186a90223cbcfe13f087147bf6e41f8ed4e451c61167460851cb8614543fbc33fe7e6c9cff169d18bd518e35a6a766c87267db2166b1d49b7803c0503ae8ccf0dcbc9e4cfeaf0596351f575ab7ffcef93db72cb6f654ddc8e7123a4dae4c8ab75c9ab4b7203dca7f2234ae7e3b68660144e7014e46539b3360f794be5337907343f332c353efdbaafe744e69c76b8c6093dec4c70cdfe132aecc933b517895678bee3d56fe0cd0690f1b0ff325266b336df76e47fa7343e57e0ea566b1297c3284635589c40dc19354301913acd37d37a7eb5d3a6c355cdb41d712daa9490bdfd8808a0993628eb566cf2588cd84b8b13fa4390fd9029eeb124c957cf36b05a95e1683ccb867e2e8139dcc5b82d34cb3ed5bffdee573ac233b2d00bf3555740949d849581a7f9236e651920ef3267d1c4d17bcc9ec4326d0bf415f40a94444f499e757879e501f5754a83efd74632fb1506509e658422e431a4cb4f0254759fa041e93d426464a5081b2debe78b7fc6715e1c957841e0f63d6e962bad65f552eea5cc62808042539b80e2ba9f24c971c073f0d52f5edef2f820f0203010001a3423040301d0603551d0e041604145379bf5aaa2b4acf5480e1d89bc09df2b20366cb300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff300d06092a864886f70d01010c050003820201005cd47c0dcff7017d4199650c73c5529fcbf8cf99067f1bda43159f9e0255579614f1523c27879428ed1f3a0137a276fc5350c0849bc66b4eba8c214fa28e556291f36915d8bc88e3c4aa0bfdefa8e94b552a06206d55782919ee5f305c4b241155ff249a6e5e2a2bee0b4d9f7ff70138941495430709fb60a9ee1cab128ca09a5ea7986a596d8b3f08fbc8d145af18156490120f73282ec5e2244efc58ecf0f445fe22b3eb2f8ed2d9456105c1976fa876728f8b8c36afbf0d05ce718de6a66f1f6ca67162c5d8d083720cf16711890c9c134c7234dfbcd571dfaa71dde1b96c8c3c125d65dabd5712b6436bffe5de4d661151cf99aeec17b6e871918cde49fedd3571a21527941ccf61e326bb6fa36725215de6dd1d0b2e681b3b82afec836785d4985174b1b9998089ff7f78195c794a602e9240ae4c372a2cc9c762c80e5df7365bcae0252501b4dd1a079c77003fd0dcd5ec3dd4fabb3fcc85d66f7fa92ddfb902f7f5979ab535dac367b0874aa9289e238eff5c276be1b04ff307ee002ed45987cb524195eaf447d7ee6441557c8d590295dd629dc2b9ee5a287484a59bb790c70c07dff589367432d628c1b0b00be09c4cc31cd6fce369b54746812fa282abd3634470c48dff2d33baad8f7bb57088ae3e19cf4028d8fcc890bb5d9922f552e658c51f883143ee881dd7c68e3c436a1da718de7d3d16f162f9ca90a8fd bf091130fc783c47357403716f5c9c217b5ade94f6385df4402e86135ffb8b38.bin.sample.exe Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\SystemCertificates\CA\Certificates\247106A405B288A46E70A0262717162D0903E734 bf091130fc783c47357403716f5c9c217b5ade94f6385df4402e86135ffb8b38.bin.sample.exe Set value (data) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\SystemCertificates\CA\Certificates\247106A405B288A46E70A0262717162D0903E734\Blob = 030000000100000014000000247106a405b288a46e70a0262717162d0903e734140000000100000014000000b390a7d8c9af4ecd613c9f7cad5d7f41fd6930ea0400000001000000100000001a9a69a81f6da92d87f7694e16d8b8790f00000001000000300000009e9609372f45b5101548e8af9a20e0dbf5932dea9b9af86759c2029bc3b53e306e6491f6b15bf00b1e2dee3bb8d43d2219000000010000001000000043e6fa09a3b9d0de6fbe3aacd184c8fd5c000000010000000400000000080000180000000100000010000000ea6089055218053dd01e37e1d806eedf2000000001000000ed050000308205e9308203d1a003020102021005e4dc3b9438ab3b8597cba6a19850e3300d06092a864886f70d01010c0500308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f72697479301e170d3134303931323030303030305a170d3234303931313233353935395a305f310b3009060355040613024652310e300c060355040813055061726973310e300c060355040713055061726973310e300c060355040a130547616e64693120301e0603550403131747616e6469205374616e646172642053534c204341203230820122300d06092a864886f70d01010105000382010f003082010a028201010094042da6799574ffd5003cf5aed894b1297cc08f0b0b89b98283976e3728f5a21acfd2920b9ba8d387947384109fdc35cbc22d92ac21b9cb3bfc40c1c18321f0bff8f69cfa9c8210c0d08e4ee50d4cb0915c90b4a4405116dae484122d055ca11f17192451aa7aeae1071b868d0172f2e7d48323399ee0e14c1f6b22a3b41066b0ed8296d76e6ab4f23fb542fcdd8ab5abba2d1d3a759b31dc3e9dac5bd3410d6cb01bf53af579ea21a2f8f433524b242d1ea499b16d48bcb812fe72707cf7fb0275f48dded6dac0a0321a52df386b2e45383f3f049600fda1f4a2bbd517d6277c1b5859955e8a12fd9cab813e52284851856bf391b2863f29b56e0362eed6050203010001a382017530820171301f0603551d230418301680145379bf5aaa2b4acf5480e1d89bc09df2b20366cb301d0603551d0e04160414b390a7d8c9af4ecd613c9f7cad5d7f41fd6930ea300e0603551d0f0101ff04040302018630120603551d130101ff040830060101ff020100301d0603551d250416301406082b0601050507030106082b0601050507030230220603551d20041b3019300d060b2b06010401b2310102021a3008060667810c01020130500603551d1f044930473045a043a041863f687474703a2f2f63726c2e7573657274727573742e636f6d2f55534552547275737452534143657274696669636174696f6e417574686f726974792e63726c307606082b06010505070101046a3068303f06082b060105050730028633687474703a2f2f6372742e7573657274727573742e636f6d2f555345525472757374525341416464547275737443412e637274302506082b060105050730018619687474703a2f2f6f6373702e7573657274727573742e636f6d300d06092a864886f70d01010c050003820201005867fd72b26ad77c6196197ed94346d1267dc853fa66b06b2da7d3aa56f73a88d03b72c950fdf759b2aa68f58c7303bb956517ce2f1cdd9813a291c9eea1406e3c98d65cf3b2223c2dee1ba4e1de202416f28c1173913af6face240287ca93ecb4b6c81617c572fc2740f613fe93a69d51ef3c2bd877579b8c653a352536b7b58a636f072793b1608d80db96d47a8f2dab1c88c96e7ed6651faf5dca163f2846dca035e5f9e9e5d596880c4fc6b77767488427b61fb068dbacbf77b090b8a2c91c325d02ba2543814247bbd8e18f0c0c465fee46336b031482d37ecd8faf90d68e247d4042b46a6a17c69597e1f238cda7edb4274093df72a9b8c666633738642230a23bf1b9c87bc8fb293aab1a72d206124ef682d4236f3ec393e5d8b6c0dedc2316d61330b7a09a0e2c5506007001cfea391d80db88f7a520b85bfd3126698f2d0a61833a47a613542c1ee3ed44cabc6a1f280e51d9de0e9f75cd0e0395caf9c5a92a2dfe41a4a147ae0dc2f93966334a5be18428596c7d941776e44582ad7020fdd26f63a8d7faa033fa37cbf7b2659eda506f3fe4a7f38e5d58329770232ee7fdc4159b9c278f32ed17ad58813129111a9bd4fc6c9528c74e0507a6fd1dbc19e2e8b7b9118a2d701252858d8c334a0ffc9992e06370daa594476307e758c7315f053d3655fe83b2e8a6add7e9e6027488745cda34db90d26d510a23d623 bf091130fc783c47357403716f5c9c217b5ade94f6385df4402e86135ffb8b38.bin.sample.exe Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\SystemCertificates\CA\Certificates\33E4E80807204C2B6182A3A14B591ACD25B5F0DB bf091130fc783c47357403716f5c9c217b5ade94f6385df4402e86135ffb8b38.bin.sample.exe Set value (data) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\SystemCertificates\CA\Certificates\33E4E80807204C2B6182A3A14B591ACD25B5F0DB\Blob = 03000000010000001400000033e4e80807204c2b6182a3a14b591acd25b5f0db1400000001000000140000008d8c5ec454ad8ae177e99bf99b05e1b8018d61e1040000000100000010000000adab5c4df031fb9299f71ada7e18f6130f00000001000000300000008b612b2190a95b28b866b9be5d0b95f368c17534ab1da61a42dfb32766f9ae2908fe6bfd1669be140eddaf0d33e95235190000000100000010000000fc741b3b78cfb31e075744fe5d0eeb965c000000010000000400000000080000180000000100000010000000ea6089055218053dd01e37e1d806eedf20000000010000001706000030820613308203fba00302010202107d5b5126b476ba11db74160bbc530da7300d06092a864886f70d01010c0500308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f72697479301e170d3138313130323030303030305a170d3330313233313233353935395a30818f310b3009060355040613024742311b30190603550408131247726561746572204d616e636865737465723110300e0603550407130753616c666f726431183016060355040a130f5365637469676f204c696d69746564313730350603550403132e5365637469676f2052534120446f6d61696e2056616c69646174696f6e205365637572652053657276657220434130820122300d06092a864886f70d01010105000382010f003082010a0282010100d67333d6d73c20d000d21745b8d63e07a23fc741ee3230c9b06cfdf49fcb12980f2d3f8d4d010c820f177f622ee9b84879fb16834eadd7322593b707bfb9503fa94cc3402ae939ffd981ca1f163241da8026b9237a87201ee3ff209a3c95446f8775069040b4329316091008233ed2dd870f6f5d51146a0a69c54f017269cfd3934c6d04a0a31b827eb19ab9edc59ec537789f9a0834fb562e58c4090e06645bbc37dcf19f2868a856b092a35c9fbb8898081b241dab3085aeafb02e9e7a9dc1c0421ce202f0eae04ad2ef900eb4c14016f06f85424a64f7a430a0febf2ea3275a8e8b58b8adc319178463ed6f56fd83cb6034c474bee69ddbe1e4e5ca0c5f150203010001a382016e3082016a301f0603551d230418301680145379bf5aaa2b4acf5480e1d89bc09df2b20366cb301d0603551d0e041604148d8c5ec454ad8ae177e99bf99b05e1b8018d61e1300e0603551d0f0101ff04040302018630120603551d130101ff040830060101ff020100301d0603551d250416301406082b0601050507030106082b06010505070302301b0603551d200414301230060604551d20003008060667810c01020130500603551d1f044930473045a043a041863f687474703a2f2f63726c2e7573657274727573742e636f6d2f55534552547275737452534143657274696669636174696f6e417574686f726974792e63726c307606082b06010505070101046a3068303f06082b060105050730028633687474703a2f2f6372742e7573657274727573742e636f6d2f555345525472757374525341416464547275737443412e637274302506082b060105050730018619687474703a2f2f6f6373702e7573657274727573742e636f6d300d06092a864886f70d01010c0500038202010032bf61bd0e48c34fc7ba474df89c781901dc131d806ffcc370b4529a31339a5752fb319e6ba4ef54aa898d401768f811107cd2cab1f15586c7eeb3369186f63951bf46bf0fa0bab4f77e49c42a36179ee468397aaf944e566fb27b3bbf0a86bdcdc5771c03b838b1a21f5f7edb8adc4648b6680acfb2b5b4e234e467a93866095ed2b8fc9d283a174027c2724e29fd213c7ccf13fb962cc53144fd13edd59ba96968777ceee1ffa4f93638085339a284349c19f3be0eacd52437eb23a878d0d3e7ef924764623922efc6f711be2285c6664424268e10328dc893ae079e833e2fd9f9f5468e63bec1e6b4dca6cd21a8860a95d92e85261afdfcb1b657426d95d133f6391406824138f58f58dc805ba4d57d9578fda79bfffdc5a869ab26e7a7a405875ba9b7b8a3200b97a94585ddb38be589378e290dfc0617f638400e42e41206fb7bf3c6116862dfe398f413d8154f8bb169d91060bc642aea31b7e4b5a33a149b26e30b7bfd028eb699c138975936f6a874a286b65eebc664eacfa0a3f96e9eba2d11b6869808582dc9ac2564f25e75b438c1ae7f5a4683ea51cab6f19911356ba56a7bc600b0e7f8be64b2adc8c2f1ace351eaa493e079c8e18140c90a5be1123cc1602ae397c08942ca94cf46981269bb98d0c2d30d724b476ee593c43228638743e4b0323e0ad34bbf239b1429412b9a041f932df1c739483cad5a127f bf091130fc783c47357403716f5c9c217b5ade94f6385df4402e86135ffb8b38.bin.sample.exe Set value (data) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\SystemCertificates\CA\Certificates\D89E3BD43D5D909B47A18977AA9D5CE36CEE184C\Blob = 030000000100000014000000d89e3bd43d5d909b47a18977aa9d5ce36cee184c1400000001000000140000005379bf5aaa2b4acf5480e1d89bc09df2b20366cb040000000100000010000000285ec909c4ab0d2d57f5086b225799aa0f000000010000003000000013baa039635f1c5292a8c2f36aae7e1d25c025202e9092f5b0f53f5f752dfa9c71b3d1b8d9a6358fcee6ec75622fabf9190000000100000010000000ea6089055218053dd01e37e1d806eedf5c0000000100000004000000001000001800000001000000100000002aa1c05e2ae606f198c2c5e937c97aa22000000001000000850500003082058130820469a00302010202103972443af922b751d7d36c10dd313595300d06092a864886f70d01010c0500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3139303331323030303030305a170d3238313233313233353935395a308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f7269747930820222300d06092a864886f70d01010105000382020f003082020a028202010080126517360ec3db08b3d0ac570d76edcd27d34cad508361e2aa204d092d6409dcce899fcc3da9ecf6cfc1dcf1d3b1d67b3728112b47da39c6bc3a19b45fa6bd7d9da36342b676f2a93b2b91f8e26fd0ec162090093ee2e874c918b491d46264db7fa306f188186a90223cbcfe13f087147bf6e41f8ed4e451c61167460851cb8614543fbc33fe7e6c9cff169d18bd518e35a6a766c87267db2166b1d49b7803c0503ae8ccf0dcbc9e4cfeaf0596351f575ab7ffcef93db72cb6f654ddc8e7123a4dae4c8ab75c9ab4b7203dca7f2234ae7e3b68660144e7014e46539b3360f794be5337907343f332c353efdbaafe744e69c76b8c6093dec4c70cdfe132aecc933b517895678bee3d56fe0cd0690f1b0ff325266b336df76e47fa7343e57e0ea566b1297c3284635589c40dc19354301913acd37d37a7eb5d3a6c355cdb41d712daa9490bdfd8808a0993628eb566cf2588cd84b8b13fa4390fd9029eeb124c957cf36b05a95e1683ccb867e2e8139dcc5b82d34cb3ed5bffdee573ac233b2d00bf3555740949d849581a7f9236e651920ef3267d1c4d17bcc9ec4326d0bf415f40a94444f499e757879e501f5754a83efd74632fb1506509e658422e431a4cb4f0254759fa041e93d426464a5081b2debe78b7fc6715e1c957841e0f63d6e962bad65f552eea5cc62808042539b80e2ba9f24c971c073f0d52f5edef2f820f0203010001a381f23081ef301f0603551d23041830168014a0110a233e96f107ece2af29ef82a57fd030a4b4301d0603551d0e041604145379bf5aaa2b4acf5480e1d89bc09df2b20366cb300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff30110603551d20040a300830060604551d200030430603551d1f043c303a3038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c303406082b0601050507010104283026302406082b060105050730018618687474703a2f2f6f6373702e636f6d6f646f63612e636f6d300d06092a864886f70d01010c05000382010100188751dc74213d9c8ae027b733d02eccecf0e6cb5e11de226f9b758e9e72fee4d6feaa1f9c962def034a7eaef48d6f723c433bc03febb8df5caaa9c6aef2fcd8eea37b43f686367c14e0cdf4f73ffedeb8b48af09196fefd43647efdccd201a17d7df81919c9422b13bf588bbaa4a266047688914e0c8914cea24dc932b3bae8141abc71f15bf0410b98000a220310e50cb1f9cd923719ed3bf1e43ab6f945132675afbbaaef3f7b773bd2c402913d1900d3175c39db3f7b180d45cd9385962f5ddf59164f3f51bdd545183fed4a8ee80661742316b50d50732744477f105d892a6b853114c4e8a96a4c80bc6a78cfb87f8e7672990c9dfed7910816a1a35f95 bf091130fc783c47357403716f5c9c217b5ade94f6385df4402e86135ffb8b38.bin.sample.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\2B8F1B57330DBBA2D07A6C51F70EE90DDAB9AD8E bf091130fc783c47357403716f5c9c217b5ade94f6385df4402e86135ffb8b38.bin.sample.exe Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\SystemCertificates\CA\Certificates\D89E3BD43D5D909B47A18977AA9D5CE36CEE184C bf091130fc783c47357403716f5c9c217b5ade94f6385df4402e86135ffb8b38.bin.sample.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\2B8F1B57330DBBA2D07A6C51F70EE90DDAB9AD8E\Blob = 0400000001000000100000001bfe69d191b71933a372a80fe155e5b50f000000010000003000000066b764a96581128168cf208e374dda479d54e311f32457f4aee0dbd2a6c8d171d531289e1cd22bfdbbd4cfd979625483090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0620000000100000020000000e793c9b02fd8aa13e21c31228accb08119643b749c898964b1746d46c3d4cbd21400000001000000140000005379bf5aaa2b4acf5480e1d89bc09df2b20366cb1d0000000100000010000000885010358d29a38f059b028559c95f900b00000001000000100000005300650063007400690067006f0000000300000001000000140000002b8f1b57330dbba2d07a6c51f70ee90ddab9ad8e190000000100000010000000ea6089055218053dd01e37e1d806eedf2000000001000000e2050000308205de308203c6a003020102021001fd6d30fca3ca51a81bbc640e35032d300d06092a864886f70d01010c0500308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f72697479301e170d3130303230313030303030305a170d3338303131383233353935395a308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f7269747930820222300d06092a864886f70d01010105000382020f003082020a028202010080126517360ec3db08b3d0ac570d76edcd27d34cad508361e2aa204d092d6409dcce899fcc3da9ecf6cfc1dcf1d3b1d67b3728112b47da39c6bc3a19b45fa6bd7d9da36342b676f2a93b2b91f8e26fd0ec162090093ee2e874c918b491d46264db7fa306f188186a90223cbcfe13f087147bf6e41f8ed4e451c61167460851cb8614543fbc33fe7e6c9cff169d18bd518e35a6a766c87267db2166b1d49b7803c0503ae8ccf0dcbc9e4cfeaf0596351f575ab7ffcef93db72cb6f654ddc8e7123a4dae4c8ab75c9ab4b7203dca7f2234ae7e3b68660144e7014e46539b3360f794be5337907343f332c353efdbaafe744e69c76b8c6093dec4c70cdfe132aecc933b517895678bee3d56fe0cd0690f1b0ff325266b336df76e47fa7343e57e0ea566b1297c3284635589c40dc19354301913acd37d37a7eb5d3a6c355cdb41d712daa9490bdfd8808a0993628eb566cf2588cd84b8b13fa4390fd9029eeb124c957cf36b05a95e1683ccb867e2e8139dcc5b82d34cb3ed5bffdee573ac233b2d00bf3555740949d849581a7f9236e651920ef3267d1c4d17bcc9ec4326d0bf415f40a94444f499e757879e501f5754a83efd74632fb1506509e658422e431a4cb4f0254759fa041e93d426464a5081b2debe78b7fc6715e1c957841e0f63d6e962bad65f552eea5cc62808042539b80e2ba9f24c971c073f0d52f5edef2f820f0203010001a3423040301d0603551d0e041604145379bf5aaa2b4acf5480e1d89bc09df2b20366cb300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff300d06092a864886f70d01010c050003820201005cd47c0dcff7017d4199650c73c5529fcbf8cf99067f1bda43159f9e0255579614f1523c27879428ed1f3a0137a276fc5350c0849bc66b4eba8c214fa28e556291f36915d8bc88e3c4aa0bfdefa8e94b552a06206d55782919ee5f305c4b241155ff249a6e5e2a2bee0b4d9f7ff70138941495430709fb60a9ee1cab128ca09a5ea7986a596d8b3f08fbc8d145af18156490120f73282ec5e2244efc58ecf0f445fe22b3eb2f8ed2d9456105c1976fa876728f8b8c36afbf0d05ce718de6a66f1f6ca67162c5d8d083720cf16711890c9c134c7234dfbcd571dfaa71dde1b96c8c3c125d65dabd5712b6436bffe5de4d661151cf99aeec17b6e871918cde49fedd3571a21527941ccf61e326bb6fa36725215de6dd1d0b2e681b3b82afec836785d4985174b1b9998089ff7f78195c794a602e9240ae4c372a2cc9c762c80e5df7365bcae0252501b4dd1a079c77003fd0dcd5ec3dd4fabb3fcc85d66f7fa92ddfb902f7f5979ab535dac367b0874aa9289e238eff5c276be1b04ff307ee002ed45987cb524195eaf447d7ee6441557c8d590295dd629dc2b9ee5a287484a59bb790c70c07dff589367432d628c1b0b00be09c4cc31cd6fce369b54746812fa282abd3634470c48dff2d33baad8f7bb57088ae3e19cf4028d8fcc890bb5d9922f552e658c51f883143ee881dd7c68e3c436a1da718de7d3d16f162f9ca90a8fd bf091130fc783c47357403716f5c9c217b5ade94f6385df4402e86135ffb8b38.bin.sample.exe -
Suspicious behavior: EnumeratesProcesses 12 IoCs
Processes:
bf091130fc783c47357403716f5c9c217b5ade94f6385df4402e86135ffb8b38.bin.sample.exepid process 800 bf091130fc783c47357403716f5c9c217b5ade94f6385df4402e86135ffb8b38.bin.sample.exe 800 bf091130fc783c47357403716f5c9c217b5ade94f6385df4402e86135ffb8b38.bin.sample.exe 800 bf091130fc783c47357403716f5c9c217b5ade94f6385df4402e86135ffb8b38.bin.sample.exe 800 bf091130fc783c47357403716f5c9c217b5ade94f6385df4402e86135ffb8b38.bin.sample.exe 800 bf091130fc783c47357403716f5c9c217b5ade94f6385df4402e86135ffb8b38.bin.sample.exe 800 bf091130fc783c47357403716f5c9c217b5ade94f6385df4402e86135ffb8b38.bin.sample.exe 800 bf091130fc783c47357403716f5c9c217b5ade94f6385df4402e86135ffb8b38.bin.sample.exe 800 bf091130fc783c47357403716f5c9c217b5ade94f6385df4402e86135ffb8b38.bin.sample.exe 800 bf091130fc783c47357403716f5c9c217b5ade94f6385df4402e86135ffb8b38.bin.sample.exe 800 bf091130fc783c47357403716f5c9c217b5ade94f6385df4402e86135ffb8b38.bin.sample.exe 800 bf091130fc783c47357403716f5c9c217b5ade94f6385df4402e86135ffb8b38.bin.sample.exe 800 bf091130fc783c47357403716f5c9c217b5ade94f6385df4402e86135ffb8b38.bin.sample.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
vssvc.exedescription pid process Token: SeBackupPrivilege 1452 vssvc.exe Token: SeRestorePrivilege 1452 vssvc.exe Token: SeAuditPrivilege 1452 vssvc.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
bf091130fc783c47357403716f5c9c217b5ade94f6385df4402e86135ffb8b38.bin.sample.execmd.exedescription pid process target process PID 800 wrote to memory of 1036 800 bf091130fc783c47357403716f5c9c217b5ade94f6385df4402e86135ffb8b38.bin.sample.exe cmd.exe PID 800 wrote to memory of 1036 800 bf091130fc783c47357403716f5c9c217b5ade94f6385df4402e86135ffb8b38.bin.sample.exe cmd.exe PID 800 wrote to memory of 1036 800 bf091130fc783c47357403716f5c9c217b5ade94f6385df4402e86135ffb8b38.bin.sample.exe cmd.exe PID 1036 wrote to memory of 1204 1036 cmd.exe vssadmin.exe PID 1036 wrote to memory of 1204 1036 cmd.exe vssadmin.exe PID 1036 wrote to memory of 1204 1036 cmd.exe vssadmin.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\bf091130fc783c47357403716f5c9c217b5ade94f6385df4402e86135ffb8b38.bin.sample.exe"C:\Users\Admin\AppData\Local\Temp\bf091130fc783c47357403716f5c9c217b5ade94f6385df4402e86135ffb8b38.bin.sample.exe"1⤵
- Modifies extensions of user files
- Enumerates connected drives
- Sets desktop wallpaper using registry
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c vssadmin.exe Delete Shadows /All /Quiet & bcdedit /set {default} recoveryenabled No & bcdedit /set {default} bootstatuspolicy ignoreallfailures2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\vssadmin.exevssadmin.exe Delete Shadows /All /Quiet3⤵
- Interacts with shadow copies
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/800-115-0x0000000000FB0000-0x0000000000FD4000-memory.dmpFilesize
144KB
-
memory/800-114-0x0000000000FB0000-0x0000000000FD4000-memory.dmpFilesize
144KB
-
memory/800-117-0x0000000002C10000-0x0000000002C16000-memory.dmpFilesize
24KB
-
memory/800-116-0x0000000002C00000-0x0000000002C01000-memory.dmpFilesize
4KB
-
memory/1036-118-0x0000000000000000-mapping.dmp
-
memory/1204-119-0x0000000000000000-mapping.dmp