sodinokibi | e89d8290e007381dff95c5e7e30a5394a1a541e02dc16aa3265013d77e2eb633

General

Target

e89d8290e007381dff95c5e7e30a5394a1a541e02dc16aa3265013d77e2eb633.exe
Size

796KB
MD5

c9db2dbdc65e75f7774e08d46df50942
SHA1

b717fa5c41ff97ed184aec40e7c6a6e251dae506
SHA256

e89d8290e007381dff95c5e7e30a5394a1a541e02dc16aa3265013d77e2eb633
SHA512

a155299b667d30acc790798f17233bdbd67c7e83e06bfdcfcd7dd408e7b7f135436f338e8f3036965391b38dc29ef7ce0f2ff59323bb994b206970f422bda21f

Score

10^/10

sodinokibi $2a$10$pxbevwk5vrhejlokgec5v.ygqvhcqom9as.cvegiws27ge09s5m4.7180 persistence ransomware

Malware Config

Extracted

Path

C:\i2pn397d-readme.txt

Family

sodinokibi

Ransom Note

---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension i2pn397d. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] Attention!!! [+] Also your private data was downloaded. We will publish it in case you will not get in touch with us asap [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/E9971FE7BE77002B 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decoder.re/E9971FE7BE77002B Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: ub86wf5vPX26He++DsuaxGRiZRbJK9YORKe7aR/OhbA3NUR0KpSWkd5Jt7GIXKz6 /k3xQKMkci7iBnsduRauwavqdL7FiWPOnjdGR1owCLmpGzzZ+W7IBMAcE69d512u jJucZj79fRA5I5PEcKE6LPNJ6S4N51aESWlIWnNCHbYS2wDoZIue7RKYLnZQQ17e 0nz8JCqWsSYfoTYaLcwUo8nwO/SJpXY52L1RUSsTyGpwMCtXr+Pu7K7iqo8vj8iX Qm7sbjMLEDS+10hUygDC5VN8dh3VQ851I6pt3DGjb2DJhiWUBF1lHysF0Pz/vLl5 cI9XbTiUXMMn7DepPSVIZfm8MQIN16WvCUX4Io9N/VvG0sv0oBPwi4jHgK2pBAY/ DJUsRLKhCmvQvD1TT60dqbnsPTQCgI1FX54YSxgGzHuq8f9JiFMjxCt8ItKxoRHh 2fqV+AjmAmcbdCoteyZXkOF94b7YXGvJBI35l6JZVAXv/4XxQuZHXkF5xOOf3DBk vis5AT2LAlsD8GkLyZGMMCnrp9qrVi1ApwlrocjramSq4grgIu4YxtoiKZ+bhrGb AknzUW9ke9DlW2zxtX+tgr6Wml/SHkeqytkUuQbSQgk/KQEESYU5Cw+n+crYnIYD 2/b7mVCKUH1OGatpl7ghFAKAudzZNSGC93T0Hzd0UgXWAmDFzGhAKdZ0FHAAPCUe V8OqeGFjytxlOhxTMTGbJ8l8ygcIuuWLf9CPf6VswRpLGJ0uHZsksVUC5wbOnX0q YZHYaZw4vGpi6DpGdhebFj/D+wvXmOWb67ADOP9UnoMHzVXtqspnM5bkdBT1Uzjk M166K8jX2xq3Bmhc4yD0ckHs4Ow+9j8m55zVHzuIIkyzIC15Rz/bEVwynhMMQlNC 54sfWYrXrsmPPg1W6Dtx1dc/S0HFr0ScmDDTjgszCd0imBMN3h4dyPFdqnSzeYrj RVJ+eZ/bhQLKESko/GJb7KXzZpfz4iASXQ1mUippHjsy8Sc2qtvX2aKUFwiE1n8M n3g5L9THPvalfktmVdQU2R9jtJ63nVDkWMZZ5/ux32lgtKnb7bBThT+Q7dDdO/oL q+hRmf8lQp4lExNLi47CrFHl4mXg5+mwW40S31Netz0IAeHlOubKb9PoXWWlRSb6 RkpgyMLcYhjRhVLpcidukJww8JZ+FawO2PYCM5T7p1VvPHLOo5kDSNCTEAvtiY4a PU5XqZf4JKQPncsAHJLwmavIKKJQvqgLrtCjAX207USEfcpVkwG3XiILGw81Ag5p m/afMcigDDAq1huWIL+Gf9iF5q/BkfEp ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!

URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/E9971FE7BE77002B

http://decoder.re/E9971FE7BE77002B

Extracted

Family

sodinokibi

Botnet

$2a$10$pxbEvwK5VRheJLokgEc5V.YGqVHcQOm9As.CVegiWs27GE09s5M4.

Campaign

7180

C2

innote.fi

operaslovakia.sk

kaliber.co.jp

friendsandbrgrs.com

supportsumba.nl

epwritescom.wordpress.com

harpershologram.wordpress.com

ateliergamila.com

exenberger.at

vibethink.net

run4study.com

4youbeautysalon.com

aco-media.nl

lecantou-coworking.com

shsthepapercut.com

mountsoul.de

admos-gleitlager.de

helikoptervluchtnewyork.nl

fransespiegels.nl

noesis.tech

Attributes

net
false
pid
$2a$10$pxbEvwK5VRheJLokgEc5V.YGqVHcQOm9As.CVegiWs27GE09s5M4.
prc
CarboniteUI

BackupAgent

sql

ocomm

winword

ccSvcHst

firefox

mspub

BackupUpdater

LogmeInBackupService

Microsoft.exchange.store.worker.exe

lmibackupvssservice

powerpnt

thebat

thunderbird

kavfs

klnagent

onenote

excel

wordpad

BackupMaint

ShadowProtectSvc

dbeng50

BackupExtender

dbsnmp

Rtvscan

NSCTOP

mydesktopservice

xfssvccon

SPBBCSvc

outlook

ocssd

ocautoupds

ccSetMgr

kavfswp

agntsvc

AmitiAvSrv

mydesktopqos

DLOAdminSvcu

oracle

sqbcoreservice

visio

msaccess

steam

kavfsscs

TSSchBkpService

Smc

Sage.NA.AT_AU.SysTray

avgadmsv

tbirdconfig

isqlplussvc

infopath

encsvc

synctime

dlomaintsvcu
ransom_oneliner
All of your files are encrypted! Find {EXT}-readme.txt and follow instuctions
ransom_template
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension {EXT}. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] Attention!!! [+] Also your private data was downloaded. We will publish it in case you will not get in touch with us asap [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/{UID} 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decoder.re/{UID} Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: {KEY} ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
sub
7180
svc
mfewc

ds_agent

kaseyaagentendpoint

ds_monitor

huntressagent

ntrtscan

dssvc

kavfs

veeam

backup

kaendchips

sophos

ltservice

memtas

sql

storagecraft

azurea

altivrm

huntressupdater

ltsvcmon

kaseyaagent

teamviewer

bedbg

tmlisten

sppsvc

msdtsserver

mcafee

masvc

auservice

code42service

altiphoneserv

altictproxy

reportserver

vipreaapsvc

ssastelemetry

telemetryserver

amsp

altiftpuploader

threadlocker

sbamsvc

tmbmserver

ofcservice

mbamservice

svc$

mepocs

protectedstorage

viprepplsvc

adsync

altiback

savservice

svcgenerichost

altaro

savadminservice

msseces

klnagent

tmccsf

swi_filter

ssistelemetry

mfevtp

vss

mfemms

psqlwge

ds_notifier

macmnsvc

Signatures

Sodin,Sodinokibi,REvil
Ransomware with advanced anti-analysis and privilege escalation functionality.
ransomware sodinokibi
Sets service image path in registry 2 TTPs
persistence

Registry Run Keys / Startup Folder
T1060

Modify Registry
T1112

Enumerates connected drives 3 TTPs 25 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

e89d8290e007381dff95c5e7e30a5394a1a541e02dc16aa3265013d77e2eb633.exe

description	ioc	process
File opened (read-only)	\??\V:	e89d8290e007381dff95c5e7e30a5394a1a541e02dc16aa3265013d77e2eb633.exe
File opened (read-only)	\??\W:	e89d8290e007381dff95c5e7e30a5394a1a541e02dc16aa3265013d77e2eb633.exe
File opened (read-only)	\??\Y:	e89d8290e007381dff95c5e7e30a5394a1a541e02dc16aa3265013d77e2eb633.exe
File opened (read-only)	\??\D:	e89d8290e007381dff95c5e7e30a5394a1a541e02dc16aa3265013d77e2eb633.exe
File opened (read-only)	\??\F:	e89d8290e007381dff95c5e7e30a5394a1a541e02dc16aa3265013d77e2eb633.exe
File opened (read-only)	\??\G:	e89d8290e007381dff95c5e7e30a5394a1a541e02dc16aa3265013d77e2eb633.exe
File opened (read-only)	\??\I:	e89d8290e007381dff95c5e7e30a5394a1a541e02dc16aa3265013d77e2eb633.exe
File opened (read-only)	\??\R:	e89d8290e007381dff95c5e7e30a5394a1a541e02dc16aa3265013d77e2eb633.exe
File opened (read-only)	\??\Q:	e89d8290e007381dff95c5e7e30a5394a1a541e02dc16aa3265013d77e2eb633.exe
File opened (read-only)	\??\T:	e89d8290e007381dff95c5e7e30a5394a1a541e02dc16aa3265013d77e2eb633.exe
File opened (read-only)	\??\U:	e89d8290e007381dff95c5e7e30a5394a1a541e02dc16aa3265013d77e2eb633.exe
File opened (read-only)	\??\X:	e89d8290e007381dff95c5e7e30a5394a1a541e02dc16aa3265013d77e2eb633.exe
File opened (read-only)	\??\A:	e89d8290e007381dff95c5e7e30a5394a1a541e02dc16aa3265013d77e2eb633.exe
File opened (read-only)	\??\B:	e89d8290e007381dff95c5e7e30a5394a1a541e02dc16aa3265013d77e2eb633.exe
File opened (read-only)	\??\H:	e89d8290e007381dff95c5e7e30a5394a1a541e02dc16aa3265013d77e2eb633.exe
File opened (read-only)	\??\O:	e89d8290e007381dff95c5e7e30a5394a1a541e02dc16aa3265013d77e2eb633.exe
File opened (read-only)	\??\Z:	e89d8290e007381dff95c5e7e30a5394a1a541e02dc16aa3265013d77e2eb633.exe
File opened (read-only)	\??\E:	e89d8290e007381dff95c5e7e30a5394a1a541e02dc16aa3265013d77e2eb633.exe
File opened (read-only)	\??\K:	e89d8290e007381dff95c5e7e30a5394a1a541e02dc16aa3265013d77e2eb633.exe
File opened (read-only)	\??\M:	e89d8290e007381dff95c5e7e30a5394a1a541e02dc16aa3265013d77e2eb633.exe
File opened (read-only)	\??\N:	e89d8290e007381dff95c5e7e30a5394a1a541e02dc16aa3265013d77e2eb633.exe
File opened (read-only)	\??\J:	e89d8290e007381dff95c5e7e30a5394a1a541e02dc16aa3265013d77e2eb633.exe
File opened (read-only)	\??\L:	e89d8290e007381dff95c5e7e30a5394a1a541e02dc16aa3265013d77e2eb633.exe
File opened (read-only)	\??\P:	e89d8290e007381dff95c5e7e30a5394a1a541e02dc16aa3265013d77e2eb633.exe
File opened (read-only)	\??\S:	e89d8290e007381dff95c5e7e30a5394a1a541e02dc16aa3265013d77e2eb633.exe

Sets desktop wallpaper using registry 2 TTPs 1 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

Processes:

e89d8290e007381dff95c5e7e30a5394a1a541e02dc16aa3265013d77e2eb633.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-257790753-2419383948-818201544-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\80pxg0.bmp"	e89d8290e007381dff95c5e7e30a5394a1a541e02dc16aa3265013d77e2eb633.exe

Drops file in Program Files directory 2 IoCs

Processes:

e89d8290e007381dff95c5e7e30a5394a1a541e02dc16aa3265013d77e2eb633.exe

description	ioc	process
File created	\??\c:\program files\i2pn397d-readme.txt	e89d8290e007381dff95c5e7e30a5394a1a541e02dc16aa3265013d77e2eb633.exe
File created	\??\c:\program files (x86)\i2pn397d-readme.txt	e89d8290e007381dff95c5e7e30a5394a1a541e02dc16aa3265013d77e2eb633.exe

Drops file in Windows directory 6 IoCs

Processes:

svchost.exe

description	ioc	process
File opened for modification	C:\Windows\WindowsUpdate.log	svchost.exe
File opened for modification	C:\Windows\SoftwareDistribution\DataStore\Logs\edb.chk	svchost.exe
File opened for modification	C:\Windows\SoftwareDistribution\DataStore\Logs\edb.log	svchost.exe
File opened for modification	C:\Windows\SoftwareDistribution\DataStore\DataStore.edb	svchost.exe
File opened for modification	C:\Windows\SoftwareDistribution\DataStore\DataStore.jfm	svchost.exe
File opened for modification	C:\Windows\SoftwareDistribution\ReportingEvents.log	svchost.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

svchost.exe

description	ioc	process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	svchost.exe

Modifies data under HKEY_USERS 41 IoCs

Processes:

WaaSMedicAgent.exe

description	ioc	process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	WaaSMedicAgent.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

e89d8290e007381dff95c5e7e30a5394a1a541e02dc16aa3265013d77e2eb633.exe

pid	process
3840	e89d8290e007381dff95c5e7e30a5394a1a541e02dc16aa3265013d77e2eb633.exe
3840	e89d8290e007381dff95c5e7e30a5394a1a541e02dc16aa3265013d77e2eb633.exe
3840	e89d8290e007381dff95c5e7e30a5394a1a541e02dc16aa3265013d77e2eb633.exe
3840	e89d8290e007381dff95c5e7e30a5394a1a541e02dc16aa3265013d77e2eb633.exe

Suspicious use of AdjustPrivilegeToken 13 IoCs

Processes:

svchost.exesvchost.exee89d8290e007381dff95c5e7e30a5394a1a541e02dc16aa3265013d77e2eb633.exevssvc.exe

description	pid	process
Token: SeShutdownPrivilege	4548	svchost.exe
Token: SeCreatePagefilePrivilege	4548	svchost.exe
Token: SeShutdownPrivilege	4548	svchost.exe
Token: SeCreatePagefilePrivilege	4548	svchost.exe
Token: SeShutdownPrivilege	4548	svchost.exe
Token: SeCreatePagefilePrivilege	4548	svchost.exe
Token: SeShutdownPrivilege	2152	svchost.exe
Token: SeCreatePagefilePrivilege	2152	svchost.exe
Token: SeDebugPrivilege	3840	e89d8290e007381dff95c5e7e30a5394a1a541e02dc16aa3265013d77e2eb633.exe
Token: SeTakeOwnershipPrivilege	3840	e89d8290e007381dff95c5e7e30a5394a1a541e02dc16aa3265013d77e2eb633.exe
Token: SeBackupPrivilege	2832	vssvc.exe
Token: SeRestorePrivilege	2832	vssvc.exe
Token: SeAuditPrivilege	2832	vssvc.exe

Suspicious use of WriteProcessMemory 2 IoCs

Processes:

svchost.exe

description	pid	process	target process
PID 2152 wrote to memory of 4824	2152	svchost.exe	MoUsoCoreWorker.exe
PID 2152 wrote to memory of 4824	2152	svchost.exe	MoUsoCoreWorker.exe

C:\Users\Admin\AppData\Local\Temp\e89d8290e007381dff95c5e7e30a5394a1a541e02dc16aa3265013d77e2eb633.exe
"C:\Users\Admin\AppData\Local\Temp\e89d8290e007381dff95c5e7e30a5394a1a541e02dc16aa3265013d77e2eb633.exe"
1⤵
- Enumerates connected drives
- Sets desktop wallpaper using registry
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3840

C:\Windows\System32\WaaSMedicAgent.exe
C:\Windows\System32\WaaSMedicAgent.exe f4151fbc070fa1d8c6c00bc40dd8a37f Zj1MYq+FbkGtqDOy19FyVQ.0.1.0.3.0
1⤵
- Modifies data under HKEY_USERS
PID:3580

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s wuauserv
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:4548

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s UsoSvc
1⤵
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2152

C:\Windows\uus\AMD64\MoUsoCoreWorker.exe
C:\Windows\uus\AMD64\MoUsoCoreWorker.exe
2⤵
PID:4824

C:\Windows\system32\wbem\unsecapp.exe
C:\Windows\system32\wbem\unsecapp.exe -Embedding
1⤵
PID:2924

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2832

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

2

T1112

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

3

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Defacement

1

T1491

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3840-151-0x00000000002E0000-0x000000000049F000-memory.dmp

Filesize
1.7MB

Download
memory/3840-150-0x00000000002E0000-0x0000000000301000-memory.dmp

Filesize
132KB

Download
memory/3840-152-0x0000000000950000-0x0000000000951000-memory.dmp

Filesize
4KB

Download
memory/4548-146-0x000001A7ED820000-0x000001A7ED830000-memory.dmp

Filesize
64KB

Download
memory/4548-147-0x000001A7ED8A0000-0x000001A7ED8B0000-memory.dmp

Filesize
64KB

Download
memory/4548-148-0x000001A7EFF80000-0x000001A7EFF84000-memory.dmp

Filesize
16KB

Download
memory/4548-153-0x000001A7F07F0000-0x000001A7F07F4000-memory.dmp

Filesize
16KB

Download
memory/4548-154-0x000001A7F07E0000-0x000001A7F07E1000-memory.dmp

Filesize
4KB

Download
memory/4824-149-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads