Analysis
-
max time kernel
142s -
max time network
72s -
platform
windows7_x64 -
resource
win7-en-20210920 -
submitted
29-09-2021 07:53
Static task
static1
Behavioral task
behavioral1
Sample
9f256973ee6ddcd3d781761480c00220a140fad833dc9a6a085f45c419d1714e.exe
Resource
win7-en-20210920
Behavioral task
behavioral2
Sample
9f256973ee6ddcd3d781761480c00220a140fad833dc9a6a085f45c419d1714e.exe
Resource
win10-en-20210920
General
-
Target
9f256973ee6ddcd3d781761480c00220a140fad833dc9a6a085f45c419d1714e.exe
-
Size
137KB
-
MD5
cefffae5b88b714dd237424055c2ebce
-
SHA1
cf0f8bfc14e862a1c0206939263821ae58a706a7
-
SHA256
9f256973ee6ddcd3d781761480c00220a140fad833dc9a6a085f45c419d1714e
-
SHA512
ce19b93c44ea81ecee3231cbe84a7d8ed7025d57c937e5741908fae492dbe307f486bfe44898084619fb09851ef1871687e0c2a245ee0b1340ba91d8be2937bb
Malware Config
Extracted
C:\zw49tq0jk-readme.txt
sodinokibi
http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/459E374F1DB639C9
http://decoder.re/459E374F1DB639C9
Signatures
-
Sodin,Sodinokibi,REvil
Ransomware with advanced anti-analysis and privilege escalation functionality.
-
Modifies extensions of user files 1 IoCs
Ransomware generally changes the extension on encrypted files.
Processes:
9f256973ee6ddcd3d781761480c00220a140fad833dc9a6a085f45c419d1714e.exedescription ioc process File renamed C:\Users\Admin\Pictures\ShowUnprotect.crw => \??\c:\users\admin\pictures\ShowUnprotect.crw.zw49tq0jk 9f256973ee6ddcd3d781761480c00220a140fad833dc9a6a085f45c419d1714e.exe -
Drops startup file 2 IoCs
Processes:
9f256973ee6ddcd3d781761480c00220a140fad833dc9a6a085f45c419d1714e.exedescription ioc process File created \??\c:\users\admin\appdata\roaming\microsoft\windows\start menu\programs\startup\zw49tq0jk-readme.txt 9f256973ee6ddcd3d781761480c00220a140fad833dc9a6a085f45c419d1714e.exe File opened for modification \??\c:\users\admin\appdata\roaming\microsoft\windows\start menu\programs\startup\desktop.ini 9f256973ee6ddcd3d781761480c00220a140fad833dc9a6a085f45c419d1714e.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops desktop.ini file(s) 64 IoCs
Processes:
9f256973ee6ddcd3d781761480c00220a140fad833dc9a6a085f45c419d1714e.exedescription ioc process File opened for modification \??\c:\users\public\documents\desktop.ini 9f256973ee6ddcd3d781761480c00220a140fad833dc9a6a085f45c419d1714e.exe File opened for modification \??\c:\users\admin\appdata\roaming\microsoft\windows\sendto\Desktop.ini 9f256973ee6ddcd3d781761480c00220a140fad833dc9a6a085f45c419d1714e.exe File opened for modification \??\c:\users\admin\appdata\local\microsoft\windows\temporary internet files\content.ie5\cjqqyv9j\desktop.ini 9f256973ee6ddcd3d781761480c00220a140fad833dc9a6a085f45c419d1714e.exe File opened for modification \??\c:\users\admin\appdata\roaming\microsoft\windows\start menu\programs\maintenance\Desktop.ini 9f256973ee6ddcd3d781761480c00220a140fad833dc9a6a085f45c419d1714e.exe File opened for modification \??\c:\users\default\appdata\roaming\microsoft\windows\sendto\Desktop.ini 9f256973ee6ddcd3d781761480c00220a140fad833dc9a6a085f45c419d1714e.exe File opened for modification \??\c:\users\admin\appdata\roaming\microsoft\windows\start menu\programs\accessories\system tools\Desktop.ini 9f256973ee6ddcd3d781761480c00220a140fad833dc9a6a085f45c419d1714e.exe File opened for modification \??\c:\program files\desktop.ini 9f256973ee6ddcd3d781761480c00220a140fad833dc9a6a085f45c419d1714e.exe File opened for modification \??\c:\users\admin\contacts\desktop.ini 9f256973ee6ddcd3d781761480c00220a140fad833dc9a6a085f45c419d1714e.exe File opened for modification \??\c:\users\admin\saved games\desktop.ini 9f256973ee6ddcd3d781761480c00220a140fad833dc9a6a085f45c419d1714e.exe File opened for modification \??\c:\users\admin\videos\desktop.ini 9f256973ee6ddcd3d781761480c00220a140fad833dc9a6a085f45c419d1714e.exe File opened for modification \??\c:\users\default\appdata\roaming\microsoft\windows\start menu\programs\accessories\Desktop.ini 9f256973ee6ddcd3d781761480c00220a140fad833dc9a6a085f45c419d1714e.exe File opened for modification \??\c:\users\public\pictures\desktop.ini 9f256973ee6ddcd3d781761480c00220a140fad833dc9a6a085f45c419d1714e.exe File opened for modification \??\c:\programdata\microsoft\windows\start menu\programs\games\Desktop.ini 9f256973ee6ddcd3d781761480c00220a140fad833dc9a6a085f45c419d1714e.exe File opened for modification \??\c:\users\admin\appdata\roaming\microsoft\windows\libraries\desktop.ini 9f256973ee6ddcd3d781761480c00220a140fad833dc9a6a085f45c419d1714e.exe File opened for modification \??\c:\users\admin\appdata\local\microsoft\windows\temporary internet files\content.ie5\dlrge7dx\desktop.ini 9f256973ee6ddcd3d781761480c00220a140fad833dc9a6a085f45c419d1714e.exe File opened for modification \??\c:\programdata\microsoft\windows\start menu\programs\accessories\windows powershell\desktop.ini 9f256973ee6ddcd3d781761480c00220a140fad833dc9a6a085f45c419d1714e.exe File opened for modification \??\c:\users\public\desktop.ini 9f256973ee6ddcd3d781761480c00220a140fad833dc9a6a085f45c419d1714e.exe File opened for modification \??\c:\programdata\microsoft\windows\start menu\programs\maintenance\Desktop.ini 9f256973ee6ddcd3d781761480c00220a140fad833dc9a6a085f45c419d1714e.exe File opened for modification \??\c:\programdata\microsoft\windows\start menu\programs\startup\desktop.ini 9f256973ee6ddcd3d781761480c00220a140fad833dc9a6a085f45c419d1714e.exe File opened for modification \??\c:\programdata\microsoft\windows\start menu\programs\accessories\tablet pc\Desktop.ini 9f256973ee6ddcd3d781761480c00220a140fad833dc9a6a085f45c419d1714e.exe File opened for modification \??\c:\users\admin\appdata\local\microsoft\feeds cache\6tggrk3w\desktop.ini 9f256973ee6ddcd3d781761480c00220a140fad833dc9a6a085f45c419d1714e.exe File opened for modification \??\c:\users\admin\appdata\local\microsoft\windows\history\desktop.ini 9f256973ee6ddcd3d781761480c00220a140fad833dc9a6a085f45c419d1714e.exe File opened for modification \??\c:\users\admin\appdata\roaming\microsoft\internet explorer\quick launch\desktop.ini 9f256973ee6ddcd3d781761480c00220a140fad833dc9a6a085f45c419d1714e.exe File opened for modification \??\c:\users\admin\appdata\local\microsoft\windows\history\history.ie5\desktop.ini 9f256973ee6ddcd3d781761480c00220a140fad833dc9a6a085f45c419d1714e.exe File opened for modification \??\c:\users\admin\music\desktop.ini 9f256973ee6ddcd3d781761480c00220a140fad833dc9a6a085f45c419d1714e.exe File opened for modification \??\c:\users\admin\pictures\desktop.ini 9f256973ee6ddcd3d781761480c00220a140fad833dc9a6a085f45c419d1714e.exe File opened for modification \??\c:\programdata\microsoft\windows\start menu\desktop.ini 9f256973ee6ddcd3d781761480c00220a140fad833dc9a6a085f45c419d1714e.exe File opened for modification \??\c:\programdata\microsoft\windows\start menu\programs\accessories\system tools\Desktop.ini 9f256973ee6ddcd3d781761480c00220a140fad833dc9a6a085f45c419d1714e.exe File opened for modification \??\c:\users\public\music\desktop.ini 9f256973ee6ddcd3d781761480c00220a140fad833dc9a6a085f45c419d1714e.exe File opened for modification \??\c:\users\public\pictures\sample pictures\desktop.ini 9f256973ee6ddcd3d781761480c00220a140fad833dc9a6a085f45c419d1714e.exe File opened for modification \??\c:\programdata\microsoft\windows\start menu\programs\administrative tools\desktop.ini 9f256973ee6ddcd3d781761480c00220a140fad833dc9a6a085f45c419d1714e.exe File opened for modification \??\c:\users\admin\appdata\local\microsoft\windows\temporary internet files\desktop.ini 9f256973ee6ddcd3d781761480c00220a140fad833dc9a6a085f45c419d1714e.exe File opened for modification \??\c:\users\public\downloads\desktop.ini 9f256973ee6ddcd3d781761480c00220a140fad833dc9a6a085f45c419d1714e.exe File opened for modification \??\c:\users\admin\favorites\links for united states\desktop.ini 9f256973ee6ddcd3d781761480c00220a140fad833dc9a6a085f45c419d1714e.exe File opened for modification \??\c:\users\admin\appdata\local\microsoft\feeds cache\y8sphbty\desktop.ini 9f256973ee6ddcd3d781761480c00220a140fad833dc9a6a085f45c419d1714e.exe File opened for modification \??\c:\users\admin\appdata\roaming\microsoft\windows\start menu\programs\accessories\accessibility\Desktop.ini 9f256973ee6ddcd3d781761480c00220a140fad833dc9a6a085f45c419d1714e.exe File opened for modification \??\c:\users\admin\appdata\local\microsoft\windows\temporary internet files\content.ie5\yvt3slpf\desktop.ini 9f256973ee6ddcd3d781761480c00220a140fad833dc9a6a085f45c419d1714e.exe File opened for modification \??\c:\users\admin\appdata\local\microsoft\feeds cache\desktop.ini 9f256973ee6ddcd3d781761480c00220a140fad833dc9a6a085f45c419d1714e.exe File opened for modification \??\c:\programdata\microsoft\windows\start menu\programs\accessories\accessibility\Desktop.ini 9f256973ee6ddcd3d781761480c00220a140fad833dc9a6a085f45c419d1714e.exe File opened for modification \??\c:\users\default\appdata\roaming\microsoft\internet explorer\quick launch\desktop.ini 9f256973ee6ddcd3d781761480c00220a140fad833dc9a6a085f45c419d1714e.exe File opened for modification \??\c:\users\admin\appdata\local\microsoft\windows\temporary internet files\content.ie5\t1crgoeb\desktop.ini 9f256973ee6ddcd3d781761480c00220a140fad833dc9a6a085f45c419d1714e.exe File opened for modification \??\c:\users\admin\appdata\roaming\microsoft\windows\start menu\desktop.ini 9f256973ee6ddcd3d781761480c00220a140fad833dc9a6a085f45c419d1714e.exe File opened for modification \??\c:\users\admin\appdata\roaming\microsoft\internet explorer\quick launch\user pinned\taskbar\desktop.ini 9f256973ee6ddcd3d781761480c00220a140fad833dc9a6a085f45c419d1714e.exe File opened for modification \??\c:\$recycle.bin\s-1-5-21-3456797065-1076791440-4146276586-1000\desktop.ini 9f256973ee6ddcd3d781761480c00220a140fad833dc9a6a085f45c419d1714e.exe File opened for modification \??\c:\users\admin\desktop\desktop.ini 9f256973ee6ddcd3d781761480c00220a140fad833dc9a6a085f45c419d1714e.exe File opened for modification \??\c:\users\admin\favorites\desktop.ini 9f256973ee6ddcd3d781761480c00220a140fad833dc9a6a085f45c419d1714e.exe File opened for modification \??\c:\users\admin\appdata\local\microsoft\windows mail\stationery\Desktop.ini 9f256973ee6ddcd3d781761480c00220a140fad833dc9a6a085f45c419d1714e.exe File opened for modification \??\c:\users\public\videos\desktop.ini 9f256973ee6ddcd3d781761480c00220a140fad833dc9a6a085f45c419d1714e.exe File opened for modification \??\c:\programdata\microsoft\windows\start menu\programs\desktop.ini 9f256973ee6ddcd3d781761480c00220a140fad833dc9a6a085f45c419d1714e.exe File opened for modification \??\c:\users\admin\appdata\local\microsoft\windows\burn\burn\desktop.ini 9f256973ee6ddcd3d781761480c00220a140fad833dc9a6a085f45c419d1714e.exe File opened for modification \??\c:\users\default\appdata\roaming\microsoft\windows\start menu\programs\maintenance\Desktop.ini 9f256973ee6ddcd3d781761480c00220a140fad833dc9a6a085f45c419d1714e.exe File opened for modification \??\c:\users\default\appdata\roaming\microsoft\windows\start menu\programs\accessories\system tools\Desktop.ini 9f256973ee6ddcd3d781761480c00220a140fad833dc9a6a085f45c419d1714e.exe File opened for modification \??\c:\users\admin\documents\desktop.ini 9f256973ee6ddcd3d781761480c00220a140fad833dc9a6a085f45c419d1714e.exe File opened for modification \??\c:\users\admin\downloads\desktop.ini 9f256973ee6ddcd3d781761480c00220a140fad833dc9a6a085f45c419d1714e.exe File opened for modification \??\c:\users\admin\favorites\links\desktop.ini 9f256973ee6ddcd3d781761480c00220a140fad833dc9a6a085f45c419d1714e.exe File opened for modification \??\c:\users\public\videos\sample videos\desktop.ini 9f256973ee6ddcd3d781761480c00220a140fad833dc9a6a085f45c419d1714e.exe File opened for modification \??\c:\users\admin\appdata\roaming\microsoft\windows\start menu\programs\accessories\Desktop.ini 9f256973ee6ddcd3d781761480c00220a140fad833dc9a6a085f45c419d1714e.exe File opened for modification \??\c:\programdata\microsoft\windows\ringtones\desktop.ini 9f256973ee6ddcd3d781761480c00220a140fad833dc9a6a085f45c419d1714e.exe File opened for modification \??\c:\users\public\music\sample music\desktop.ini 9f256973ee6ddcd3d781761480c00220a140fad833dc9a6a085f45c419d1714e.exe File opened for modification \??\c:\programdata\microsoft\windows\start menu\programs\accessories\Desktop.ini 9f256973ee6ddcd3d781761480c00220a140fad833dc9a6a085f45c419d1714e.exe File opened for modification \??\c:\users\admin\appdata\local\microsoft\windows\temporary internet files\content.ie5\desktop.ini 9f256973ee6ddcd3d781761480c00220a140fad833dc9a6a085f45c419d1714e.exe File opened for modification \??\c:\users\admin\appdata\roaming\microsoft\windows\start menu\programs\administrative tools\desktop.ini 9f256973ee6ddcd3d781761480c00220a140fad833dc9a6a085f45c419d1714e.exe File opened for modification \??\c:\users\default\appdata\roaming\microsoft\windows\start menu\programs\accessories\accessibility\Desktop.ini 9f256973ee6ddcd3d781761480c00220a140fad833dc9a6a085f45c419d1714e.exe File opened for modification \??\c:\program files (x86)\desktop.ini 9f256973ee6ddcd3d781761480c00220a140fad833dc9a6a085f45c419d1714e.exe -
Enumerates connected drives 3 TTPs 25 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
9f256973ee6ddcd3d781761480c00220a140fad833dc9a6a085f45c419d1714e.exedescription ioc process File opened (read-only) \??\A: 9f256973ee6ddcd3d781761480c00220a140fad833dc9a6a085f45c419d1714e.exe File opened (read-only) \??\G: 9f256973ee6ddcd3d781761480c00220a140fad833dc9a6a085f45c419d1714e.exe File opened (read-only) \??\L: 9f256973ee6ddcd3d781761480c00220a140fad833dc9a6a085f45c419d1714e.exe File opened (read-only) \??\P: 9f256973ee6ddcd3d781761480c00220a140fad833dc9a6a085f45c419d1714e.exe File opened (read-only) \??\U: 9f256973ee6ddcd3d781761480c00220a140fad833dc9a6a085f45c419d1714e.exe File opened (read-only) \??\D: 9f256973ee6ddcd3d781761480c00220a140fad833dc9a6a085f45c419d1714e.exe File opened (read-only) \??\E: 9f256973ee6ddcd3d781761480c00220a140fad833dc9a6a085f45c419d1714e.exe File opened (read-only) \??\F: 9f256973ee6ddcd3d781761480c00220a140fad833dc9a6a085f45c419d1714e.exe File opened (read-only) \??\H: 9f256973ee6ddcd3d781761480c00220a140fad833dc9a6a085f45c419d1714e.exe File opened (read-only) \??\J: 9f256973ee6ddcd3d781761480c00220a140fad833dc9a6a085f45c419d1714e.exe File opened (read-only) \??\Q: 9f256973ee6ddcd3d781761480c00220a140fad833dc9a6a085f45c419d1714e.exe File opened (read-only) \??\Z: 9f256973ee6ddcd3d781761480c00220a140fad833dc9a6a085f45c419d1714e.exe File opened (read-only) \??\V: 9f256973ee6ddcd3d781761480c00220a140fad833dc9a6a085f45c419d1714e.exe File opened (read-only) \??\W: 9f256973ee6ddcd3d781761480c00220a140fad833dc9a6a085f45c419d1714e.exe File opened (read-only) \??\B: 9f256973ee6ddcd3d781761480c00220a140fad833dc9a6a085f45c419d1714e.exe File opened (read-only) \??\I: 9f256973ee6ddcd3d781761480c00220a140fad833dc9a6a085f45c419d1714e.exe File opened (read-only) \??\N: 9f256973ee6ddcd3d781761480c00220a140fad833dc9a6a085f45c419d1714e.exe File opened (read-only) \??\O: 9f256973ee6ddcd3d781761480c00220a140fad833dc9a6a085f45c419d1714e.exe File opened (read-only) \??\R: 9f256973ee6ddcd3d781761480c00220a140fad833dc9a6a085f45c419d1714e.exe File opened (read-only) \??\T: 9f256973ee6ddcd3d781761480c00220a140fad833dc9a6a085f45c419d1714e.exe File opened (read-only) \??\K: 9f256973ee6ddcd3d781761480c00220a140fad833dc9a6a085f45c419d1714e.exe File opened (read-only) \??\M: 9f256973ee6ddcd3d781761480c00220a140fad833dc9a6a085f45c419d1714e.exe File opened (read-only) \??\S: 9f256973ee6ddcd3d781761480c00220a140fad833dc9a6a085f45c419d1714e.exe File opened (read-only) \??\X: 9f256973ee6ddcd3d781761480c00220a140fad833dc9a6a085f45c419d1714e.exe File opened (read-only) \??\Y: 9f256973ee6ddcd3d781761480c00220a140fad833dc9a6a085f45c419d1714e.exe -
Sets desktop wallpaper using registry 2 TTPs 1 IoCs
Processes:
9f256973ee6ddcd3d781761480c00220a140fad833dc9a6a085f45c419d1714e.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3456797065-1076791440-4146276586-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\5l8r3e171m.bmp" 9f256973ee6ddcd3d781761480c00220a140fad833dc9a6a085f45c419d1714e.exe -
Drops file in Program Files directory 27 IoCs
Processes:
9f256973ee6ddcd3d781761480c00220a140fad833dc9a6a085f45c419d1714e.exedescription ioc process File opened for modification \??\c:\program files\desktop.ini 9f256973ee6ddcd3d781761480c00220a140fad833dc9a6a085f45c419d1714e.exe File opened for modification \??\c:\program files\NewLock.MOD 9f256973ee6ddcd3d781761480c00220a140fad833dc9a6a085f45c419d1714e.exe File created \??\c:\program files (x86)\microsoft sql server compact edition\zw49tq0jk-readme.txt 9f256973ee6ddcd3d781761480c00220a140fad833dc9a6a085f45c419d1714e.exe File opened for modification \??\c:\program files (x86)\microsoft sql server compact edition\v3.5\sqlceca35.dll 9f256973ee6ddcd3d781761480c00220a140fad833dc9a6a085f45c419d1714e.exe File opened for modification \??\c:\program files\EditInstall.TS 9f256973ee6ddcd3d781761480c00220a140fad833dc9a6a085f45c419d1714e.exe File opened for modification \??\c:\program files\UpdateMove.jpg 9f256973ee6ddcd3d781761480c00220a140fad833dc9a6a085f45c419d1714e.exe File opened for modification \??\c:\program files\CompleteRequest.mp4 9f256973ee6ddcd3d781761480c00220a140fad833dc9a6a085f45c419d1714e.exe File opened for modification \??\c:\program files (x86)\microsoft sql server compact edition\v3.5\sqlcecompact35.dll 9f256973ee6ddcd3d781761480c00220a140fad833dc9a6a085f45c419d1714e.exe File opened for modification \??\c:\program files (x86)\microsoft sql server compact edition\v3.5\sqlceer35EN.dll 9f256973ee6ddcd3d781761480c00220a140fad833dc9a6a085f45c419d1714e.exe File opened for modification \??\c:\program files (x86)\microsoft sql server compact edition\v3.5\sqlceoledb35.dll 9f256973ee6ddcd3d781761480c00220a140fad833dc9a6a085f45c419d1714e.exe File created \??\c:\program files\zw49tq0jk-readme.txt 9f256973ee6ddcd3d781761480c00220a140fad833dc9a6a085f45c419d1714e.exe File opened for modification \??\c:\program files (x86)\microsoft sql server compact edition\v3.5\sqlcese35.dll 9f256973ee6ddcd3d781761480c00220a140fad833dc9a6a085f45c419d1714e.exe File opened for modification \??\c:\program files\CompareFormat.jpeg 9f256973ee6ddcd3d781761480c00220a140fad833dc9a6a085f45c419d1714e.exe File opened for modification \??\c:\program files\SuspendPing.mpg 9f256973ee6ddcd3d781761480c00220a140fad833dc9a6a085f45c419d1714e.exe File opened for modification \??\c:\program files\GrantInvoke.xml 9f256973ee6ddcd3d781761480c00220a140fad833dc9a6a085f45c419d1714e.exe File opened for modification \??\c:\program files\RedoTrace.ogg 9f256973ee6ddcd3d781761480c00220a140fad833dc9a6a085f45c419d1714e.exe File created \??\c:\program files (x86)\microsoft sql server compact edition\v3.5\desktop\zw49tq0jk-readme.txt 9f256973ee6ddcd3d781761480c00220a140fad833dc9a6a085f45c419d1714e.exe File opened for modification \??\c:\program files (x86)\microsoft sql server compact edition\v3.5\sqlceme35.dll 9f256973ee6ddcd3d781761480c00220a140fad833dc9a6a085f45c419d1714e.exe File opened for modification \??\c:\program files (x86)\microsoft sql server compact edition\v3.5\sqlceqp35.dll 9f256973ee6ddcd3d781761480c00220a140fad833dc9a6a085f45c419d1714e.exe File opened for modification \??\c:\program files\ImportMeasure.ex_ 9f256973ee6ddcd3d781761480c00220a140fad833dc9a6a085f45c419d1714e.exe File opened for modification \??\c:\program files\MountSelect.wm 9f256973ee6ddcd3d781761480c00220a140fad833dc9a6a085f45c419d1714e.exe File opened for modification \??\c:\program files (x86)\desktop.ini 9f256973ee6ddcd3d781761480c00220a140fad833dc9a6a085f45c419d1714e.exe File created \??\c:\program files (x86)\microsoft sql server compact edition\v3.5\zw49tq0jk-readme.txt 9f256973ee6ddcd3d781761480c00220a140fad833dc9a6a085f45c419d1714e.exe File created \??\c:\program files (x86)\zw49tq0jk-readme.txt 9f256973ee6ddcd3d781761480c00220a140fad833dc9a6a085f45c419d1714e.exe File opened for modification \??\c:\program files\ApproveConnect.AAC 9f256973ee6ddcd3d781761480c00220a140fad833dc9a6a085f45c419d1714e.exe File opened for modification \??\c:\program files\RenameDebug.pcx 9f256973ee6ddcd3d781761480c00220a140fad833dc9a6a085f45c419d1714e.exe File opened for modification \??\c:\program files\TestConvertTo.odt 9f256973ee6ddcd3d781761480c00220a140fad833dc9a6a085f45c419d1714e.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 1312 1356 WerFault.exe -
Suspicious behavior: EnumeratesProcesses 7 IoCs
Processes:
WerFault.exe9f256973ee6ddcd3d781761480c00220a140fad833dc9a6a085f45c419d1714e.exepid process 1312 WerFault.exe 1312 WerFault.exe 1312 WerFault.exe 1312 WerFault.exe 1312 WerFault.exe 1540 9f256973ee6ddcd3d781761480c00220a140fad833dc9a6a085f45c419d1714e.exe 1540 9f256973ee6ddcd3d781761480c00220a140fad833dc9a6a085f45c419d1714e.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
WerFault.exepid process 1312 WerFault.exe -
Suspicious use of AdjustPrivilegeToken 9 IoCs
Processes:
9f256973ee6ddcd3d781761480c00220a140fad833dc9a6a085f45c419d1714e.exevssvc.exeWerFault.exevssvc.exedescription pid process Token: SeDebugPrivilege 1540 9f256973ee6ddcd3d781761480c00220a140fad833dc9a6a085f45c419d1714e.exe Token: SeTakeOwnershipPrivilege 1540 9f256973ee6ddcd3d781761480c00220a140fad833dc9a6a085f45c419d1714e.exe Token: SeBackupPrivilege 656 vssvc.exe Token: SeRestorePrivilege 656 vssvc.exe Token: SeAuditPrivilege 656 vssvc.exe Token: SeDebugPrivilege 1312 WerFault.exe Token: SeBackupPrivilege 1452 vssvc.exe Token: SeRestorePrivilege 1452 vssvc.exe Token: SeAuditPrivilege 1452 vssvc.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\9f256973ee6ddcd3d781761480c00220a140fad833dc9a6a085f45c419d1714e.exe"C:\Users\Admin\AppData\Local\Temp\9f256973ee6ddcd3d781761480c00220a140fad833dc9a6a085f45c419d1714e.exe"1⤵
- Modifies extensions of user files
- Drops startup file
- Drops desktop.ini file(s)
- Enumerates connected drives
- Sets desktop wallpaper using registry
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1540
-
C:\Windows\system32\wbem\unsecapp.exeC:\Windows\system32\wbem\unsecapp.exe -Embedding1⤵PID:796
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:656
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 1356 -s 30441⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:1312
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1452
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\$Recycle.Bin\S-1-5-21-3456797065-1076791440-4146276586-1000\desktop.iniMD5
e7b8da82157619f048a7a2196761637d
SHA15af420d9d9c37956f76c3af88d33f6c951e5f9cb
SHA25672dbd2e9d86d07daf9c777baebe2ad8ee92cd631c0aa24339231887fc9d51d3d
SHA5126c5a708a8c897942717d9b53c88de117e20b79aaa786f3104695230f03a466c0f4331b1e267cccdefafbd4d7850de5b83fab5e06c359fcec271da5f54cd93673
-
memory/1312-55-0x000007FEFC391000-0x000007FEFC393000-memory.dmpFilesize
8KB
-
memory/1312-56-0x0000000002380000-0x0000000002381000-memory.dmpFilesize
4KB
-
memory/1540-53-0x0000000075A71000-0x0000000075A73000-memory.dmpFilesize
8KB