Analysis
-
max time kernel
151s -
max time network
154s -
platform
windows10_x64 -
resource
win10-en-20211104 -
submitted
19-11-2021 21:38
Static task
static1
Behavioral task
behavioral1
Sample
745da563270a1280bf3672f59bfc61bec18f2e87f9a3c86b15bab756a297125f.exe
Resource
win7-en-20211104
Behavioral task
behavioral2
Sample
745da563270a1280bf3672f59bfc61bec18f2e87f9a3c86b15bab756a297125f.exe
Resource
win10-en-20211104
General
-
Target
745da563270a1280bf3672f59bfc61bec18f2e87f9a3c86b15bab756a297125f.exe
-
Size
1.9MB
-
MD5
6f0f0f10532bcc6abaf04afd99811e4b
-
SHA1
97f2891294853ccf9693d487f4fe11eea0dcb9d7
-
SHA256
745da563270a1280bf3672f59bfc61bec18f2e87f9a3c86b15bab756a297125f
-
SHA512
41a80f301a47e39c5eda4e444418143a8b320c1876970c2d9054c4d2c6f584e944f2a6bf1fd61c9c2a028a746eaa7b85c907a91aabb3a726e3693d96f90e90c2
Malware Config
Extracted
C:\odt\na36cj-readme.txt
sodinokibi
http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/A6DA3643E50ACB3C
http://decryptor.top/A6DA3643E50ACB3C
Signatures
-
Sodin,Sodinokibi,REvil
Ransomware with advanced anti-analysis and privilege escalation functionality.
-
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Modifies extensions of user files 9 IoCs
Ransomware generally changes the extension on encrypted files.
Processes:
745da563270a1280bf3672f59bfc61bec18f2e87f9a3c86b15bab756a297125f.exedescription ioc process File renamed C:\Users\Admin\Pictures\FormatCopy.raw => C:\Users\Admin\Pictures\FormatCopy.raw.na36cj 745da563270a1280bf3672f59bfc61bec18f2e87f9a3c86b15bab756a297125f.exe File renamed C:\Users\Admin\Pictures\MoveRedo.png => C:\Users\Admin\Pictures\MoveRedo.png.na36cj 745da563270a1280bf3672f59bfc61bec18f2e87f9a3c86b15bab756a297125f.exe File renamed C:\Users\Admin\Pictures\StartBlock.raw => C:\Users\Admin\Pictures\StartBlock.raw.na36cj 745da563270a1280bf3672f59bfc61bec18f2e87f9a3c86b15bab756a297125f.exe File renamed C:\Users\Admin\Pictures\SetResize.raw => C:\Users\Admin\Pictures\SetResize.raw.na36cj 745da563270a1280bf3672f59bfc61bec18f2e87f9a3c86b15bab756a297125f.exe File renamed C:\Users\Admin\Pictures\SyncBlock.raw => C:\Users\Admin\Pictures\SyncBlock.raw.na36cj 745da563270a1280bf3672f59bfc61bec18f2e87f9a3c86b15bab756a297125f.exe File renamed C:\Users\Admin\Pictures\UseBlock.crw => C:\Users\Admin\Pictures\UseBlock.crw.na36cj 745da563270a1280bf3672f59bfc61bec18f2e87f9a3c86b15bab756a297125f.exe File renamed C:\Users\Admin\Pictures\DismountConnect.png => C:\Users\Admin\Pictures\DismountConnect.png.na36cj 745da563270a1280bf3672f59bfc61bec18f2e87f9a3c86b15bab756a297125f.exe File renamed C:\Users\Admin\Pictures\OptimizeOut.png => C:\Users\Admin\Pictures\OptimizeOut.png.na36cj 745da563270a1280bf3672f59bfc61bec18f2e87f9a3c86b15bab756a297125f.exe File renamed C:\Users\Admin\Pictures\UnblockUnprotect.crw => C:\Users\Admin\Pictures\UnblockUnprotect.crw.na36cj 745da563270a1280bf3672f59bfc61bec18f2e87f9a3c86b15bab756a297125f.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Enumerates connected drives 3 TTPs 25 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
745da563270a1280bf3672f59bfc61bec18f2e87f9a3c86b15bab756a297125f.exedescription ioc process File opened (read-only) \??\V: 745da563270a1280bf3672f59bfc61bec18f2e87f9a3c86b15bab756a297125f.exe File opened (read-only) \??\Z: 745da563270a1280bf3672f59bfc61bec18f2e87f9a3c86b15bab756a297125f.exe File opened (read-only) \??\D: 745da563270a1280bf3672f59bfc61bec18f2e87f9a3c86b15bab756a297125f.exe File opened (read-only) \??\H: 745da563270a1280bf3672f59bfc61bec18f2e87f9a3c86b15bab756a297125f.exe File opened (read-only) \??\N: 745da563270a1280bf3672f59bfc61bec18f2e87f9a3c86b15bab756a297125f.exe File opened (read-only) \??\Q: 745da563270a1280bf3672f59bfc61bec18f2e87f9a3c86b15bab756a297125f.exe File opened (read-only) \??\Y: 745da563270a1280bf3672f59bfc61bec18f2e87f9a3c86b15bab756a297125f.exe File opened (read-only) \??\B: 745da563270a1280bf3672f59bfc61bec18f2e87f9a3c86b15bab756a297125f.exe File opened (read-only) \??\M: 745da563270a1280bf3672f59bfc61bec18f2e87f9a3c86b15bab756a297125f.exe File opened (read-only) \??\S: 745da563270a1280bf3672f59bfc61bec18f2e87f9a3c86b15bab756a297125f.exe File opened (read-only) \??\E: 745da563270a1280bf3672f59bfc61bec18f2e87f9a3c86b15bab756a297125f.exe File opened (read-only) \??\F: 745da563270a1280bf3672f59bfc61bec18f2e87f9a3c86b15bab756a297125f.exe File opened (read-only) \??\U: 745da563270a1280bf3672f59bfc61bec18f2e87f9a3c86b15bab756a297125f.exe File opened (read-only) \??\J: 745da563270a1280bf3672f59bfc61bec18f2e87f9a3c86b15bab756a297125f.exe File opened (read-only) \??\K: 745da563270a1280bf3672f59bfc61bec18f2e87f9a3c86b15bab756a297125f.exe File opened (read-only) \??\L: 745da563270a1280bf3672f59bfc61bec18f2e87f9a3c86b15bab756a297125f.exe File opened (read-only) \??\O: 745da563270a1280bf3672f59bfc61bec18f2e87f9a3c86b15bab756a297125f.exe File opened (read-only) \??\P: 745da563270a1280bf3672f59bfc61bec18f2e87f9a3c86b15bab756a297125f.exe File opened (read-only) \??\A: 745da563270a1280bf3672f59bfc61bec18f2e87f9a3c86b15bab756a297125f.exe File opened (read-only) \??\G: 745da563270a1280bf3672f59bfc61bec18f2e87f9a3c86b15bab756a297125f.exe File opened (read-only) \??\I: 745da563270a1280bf3672f59bfc61bec18f2e87f9a3c86b15bab756a297125f.exe File opened (read-only) \??\X: 745da563270a1280bf3672f59bfc61bec18f2e87f9a3c86b15bab756a297125f.exe File opened (read-only) \??\R: 745da563270a1280bf3672f59bfc61bec18f2e87f9a3c86b15bab756a297125f.exe File opened (read-only) \??\T: 745da563270a1280bf3672f59bfc61bec18f2e87f9a3c86b15bab756a297125f.exe File opened (read-only) \??\W: 745da563270a1280bf3672f59bfc61bec18f2e87f9a3c86b15bab756a297125f.exe -
Sets desktop wallpaper using registry 2 TTPs 1 IoCs
Processes:
745da563270a1280bf3672f59bfc61bec18f2e87f9a3c86b15bab756a297125f.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\874g44yh4ca.bmp" 745da563270a1280bf3672f59bfc61bec18f2e87f9a3c86b15bab756a297125f.exe -
Drops file in Windows directory 64 IoCs
Processes:
745da563270a1280bf3672f59bfc61bec18f2e87f9a3c86b15bab756a297125f.exedescription ioc process File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-eventlog.resources_31bf3856ad364e35_10.0.15063.0_fr-fr_519d7baeec96c584_wevtsvc.dll.mui_f41bf7b7 745da563270a1280bf3672f59bfc61bec18f2e87f9a3c86b15bab756a297125f.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-font-bitmap-oem_31bf3856ad364e35_10.0.15063.0_none_0e77f624e73557a1_8514oemr.fon_dbe7e3dc 745da563270a1280bf3672f59bfc61bec18f2e87f9a3c86b15bab756a297125f.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-p..ng-client-overrides_31bf3856ad364e35_10.0.15063.0_none_2aad78202bd046dc_power.settings.display.ppkg_7381929e 745da563270a1280bf3672f59bfc61bec18f2e87f9a3c86b15bab756a297125f.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft.windows.c..-controls.resources_6595b64144ccf1df_6.0.15063.0_et-ee_2024c0bc10b8d9ba_comctl32.dll.mui_0da4e682 745da563270a1280bf3672f59bfc61bec18f2e87f9a3c86b15bab756a297125f.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft.windows.c..-controls.resources_6595b64144ccf1df_6.0.15063.0_ko-kr_f8d3bd33bc42d1fc_comctl32.dll.mui_0da4e682 745da563270a1280bf3672f59bfc61bec18f2e87f9a3c86b15bab756a297125f.exe File opened for modification C:\Windows\WinSxS\Backup\wow64_microsoft-windows-twinapi-appcore_31bf3856ad364e35_10.0.15063.0_none_cf047f912b10e6d0_twinapi.appcore.dll_8d6512dc 745da563270a1280bf3672f59bfc61bec18f2e87f9a3c86b15bab756a297125f.exe File opened for modification C:\Windows\WinSxS\Backup\wow64_microsoft.windows.winhttp.resources_31bf3856ad364e35_6.0.15063.0_de-de_c50ed7ff94ebd690.manifest 745da563270a1280bf3672f59bfc61bec18f2e87f9a3c86b15bab756a297125f.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-comdlg32_31bf3856ad364e35_10.0.15063.0_none_c6c4eadade764d0d_comdlg32.dll_b1ffde97 745da563270a1280bf3672f59bfc61bec18f2e87f9a3c86b15bab756a297125f.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-dns-client-minwin_31bf3856ad364e35_10.0.15063.0_none_a69f8cf95bf4534e.manifest 745da563270a1280bf3672f59bfc61bec18f2e87f9a3c86b15bab756a297125f.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft.windows.c..-controls.resources_6595b64144ccf1df_5.82.15063.0_de-de_b0bbc22785bbbd0e_comctl32.dll.mui_0da4e682 745da563270a1280bf3672f59bfc61bec18f2e87f9a3c86b15bab756a297125f.exe File opened for modification C:\Windows\WinSxS\Backup\wow64_networking-mpssvc-drv.resources_31bf3856ad364e35_10.0.15063.0_fr-fr_0bafa5afe5ef93e0_mpsdrv.sys.mui_b2aea3b6 745da563270a1280bf3672f59bfc61bec18f2e87f9a3c86b15bab756a297125f.exe File opened for modification C:\Windows\WinSxS\Backup\x86_microsoft-windows-b..ager-pcat.resources_31bf3856ad364e35_10.0.15063.0_sk-sk_bcb323d2ec813098_bootmgr.exe.mui_c434701f 745da563270a1280bf3672f59bfc61bec18f2e87f9a3c86b15bab756a297125f.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-r..intmapper.resources_31bf3856ad364e35_10.0.15063.0_en-us_fbaca31b325f23d3_rpcepmap.dll.mui_349798e1 745da563270a1280bf3672f59bfc61bec18f2e87f9a3c86b15bab756a297125f.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-wininit_31bf3856ad364e35_10.0.15063.0_none_420692083d1f600a.manifest 745da563270a1280bf3672f59bfc61bec18f2e87f9a3c86b15bab756a297125f.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-winsock-core_31bf3856ad364e35_10.0.15063.0_none_e8fc1bcb973bd8b8_afd.sys_084af4a8 745da563270a1280bf3672f59bfc61bec18f2e87f9a3c86b15bab756a297125f.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft.windows.winhttp.resources_31bf3856ad364e35_6.0.15063.0_de-de_baba2dad608b1495_winhttp.dll.mui_f661192f 745da563270a1280bf3672f59bfc61bec18f2e87f9a3c86b15bab756a297125f.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_networking-mpssvc-svc.resources_31bf3856ad364e35_10.0.15063.0_fr-fr_3aff604eba3fed0f_mpssvc.dll.mui_4b194b5f 745da563270a1280bf3672f59bfc61bec18f2e87f9a3c86b15bab756a297125f.exe File opened for modification C:\Windows\WinSxS\Backup\x86_hid-user.resources_31bf3856ad364e35_10.0.15063.0_de-de_71a6f7b87cc5aa6a_hidserv.dll.mui_561adfc8 745da563270a1280bf3672f59bfc61bec18f2e87f9a3c86b15bab756a297125f.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-b..iagnostic.resources_31bf3856ad364e35_10.0.15063.0_fi-fi_66e3922ab91bb38c_memtest.efi.mui_71e15c22 745da563270a1280bf3672f59bfc61bec18f2e87f9a3c86b15bab756a297125f.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-font-truetype-ebrima_31bf3856ad364e35_10.0.15063.0_none_df8fa7e794d7be79.manifest 745da563270a1280bf3672f59bfc61bec18f2e87f9a3c86b15bab756a297125f.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-m..ntmanager.resources_31bf3856ad364e35_10.0.15063.0_de-de_a53034098937b72e_mountmgr.sys.mui_71b54a25 745da563270a1280bf3672f59bfc61bec18f2e87f9a3c86b15bab756a297125f.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-rasserver.resources_31bf3856ad364e35_10.0.15063.0_de-de_e3641786062c0973_mprdim.dll.mui_11b5ef08 745da563270a1280bf3672f59bfc61bec18f2e87f9a3c86b15bab756a297125f.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-themeservice_31bf3856ad364e35_10.0.15063.0_none_bb1659e5012b4fbe_themeservice.dll_223a3220 745da563270a1280bf3672f59bfc61bec18f2e87f9a3c86b15bab756a297125f.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-wintrust-dll_31bf3856ad364e35_10.0.15063.0_none_00c212fed2df9e6b_wintrust.dll_abec426a 745da563270a1280bf3672f59bfc61bec18f2e87f9a3c86b15bab756a297125f.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-wmi-core.resources_31bf3856ad364e35_10.0.15063.0_de-de_3cea917b11996ccf_wmiapres.dll.mui_c1b8803f 745da563270a1280bf3672f59bfc61bec18f2e87f9a3c86b15bab756a297125f.exe File opened for modification C:\Windows\WinSxS\Backup\wow64_microsoft-windows-imm32_31bf3856ad364e35_10.0.15063.0_none_77bea1a1e79a7865_imm32.dll_53c2ab30 745da563270a1280bf3672f59bfc61bec18f2e87f9a3c86b15bab756a297125f.exe File opened for modification C:\Windows\WinSxS\Backup\x86_microsoft.windows.c..-controls.resources_6595b64144ccf1df_5.82.15063.0_sl-si_88a80d10cfcef28d.manifest 745da563270a1280bf3672f59bfc61bec18f2e87f9a3c86b15bab756a297125f.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-basesrv_31bf3856ad364e35_10.0.15063.0_none_1ddec40f1c898738_basesrv.dll_8c1ad808 745da563270a1280bf3672f59bfc61bec18f2e87f9a3c86b15bab756a297125f.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-lsa.resources_31bf3856ad364e35_10.0.15063.0_ja-jp_c68bf5c18cb00fef_lsasrv.dll.mui_d47f7e1c 745da563270a1280bf3672f59bfc61bec18f2e87f9a3c86b15bab756a297125f.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-tcpip.resources_31bf3856ad364e35_10.0.15063.0_ja-jp_0c269ac8c338b765.manifest 745da563270a1280bf3672f59bfc61bec18f2e87f9a3c86b15bab756a297125f.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-wbiosrvc.resources_31bf3856ad364e35_10.0.15063.0_ja-jp_2b73c2b7262e9b8a.manifest 745da563270a1280bf3672f59bfc61bec18f2e87f9a3c86b15bab756a297125f.exe File opened for modification C:\Windows\WinSxS\Backup\x86_microsoft-windows-w..r-webclnt.resources_31bf3856ad364e35_10.0.15063.0_fr-fr_96e305274408a6c1.manifest 745da563270a1280bf3672f59bfc61bec18f2e87f9a3c86b15bab756a297125f.exe File opened for modification C:\Windows\WinSxS\Backup\x86_microsoft.windows.c..-controls.resources_6595b64144ccf1df_6.0.15063.0_en-us_6e46cf1f2108348c.manifest 745da563270a1280bf3672f59bfc61bec18f2e87f9a3c86b15bab756a297125f.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-filtermanager-core_31bf3856ad364e35_10.0.15063.0_none_221d4c2b639acaed_fltmgr.sys_c6e91b41 745da563270a1280bf3672f59bfc61bec18f2e87f9a3c86b15bab756a297125f.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-user32.resources_31bf3856ad364e35_10.0.15063.0_de-de_a620fb0a750de7b0_user32.dll.mui_14652dbb 745da563270a1280bf3672f59bfc61bec18f2e87f9a3c86b15bab756a297125f.exe File opened for modification C:\Windows\WinSxS\Backup\x86_microsoft-windows-t..services-publicapis_31bf3856ad364e35_10.0.15063.0_none_7c26291346c6844d_wtsapi32.dll_470d4d41 745da563270a1280bf3672f59bfc61bec18f2e87f9a3c86b15bab756a297125f.exe File opened for modification C:\Windows\WinSxS\Backup\x86_microsoft.windows.c..-controls.resources_6595b64144ccf1df_5.82.15063.0_ja-jp_d02a172e465bf139.manifest 745da563270a1280bf3672f59bfc61bec18f2e87f9a3c86b15bab756a297125f.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-a..llservice.resources_31bf3856ad364e35_10.0.15063.0_de-de_c5f11561ed21f5cb_axinstui.exe.mui_aea34130 745da563270a1280bf3672f59bfc61bec18f2e87f9a3c86b15bab756a297125f.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-b..iagnostic.resources_31bf3856ad364e35_10.0.15063.0_qps-ploc_8699284b0725bbbc.manifest 745da563270a1280bf3672f59bfc61bec18f2e87f9a3c86b15bab756a297125f.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-kernel32_31bf3856ad364e35_10.0.15063.0_none_a4d1be7a8f1a4216_kernel32.dll_ef9eca7e 745da563270a1280bf3672f59bfc61bec18f2e87f9a3c86b15bab756a297125f.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-m..ntmanager.resources_31bf3856ad364e35_10.0.15063.0_fr-fr_f0a3dce56b0ecafa.manifest 745da563270a1280bf3672f59bfc61bec18f2e87f9a3c86b15bab756a297125f.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft.windows.c..-controls.resources_6595b64144ccf1df_6.0.15063.0_da-dk_807d2d131bd7ab27.manifest 745da563270a1280bf3672f59bfc61bec18f2e87f9a3c86b15bab756a297125f.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft.windows.c..-controls.resources_6595b64144ccf1df_6.0.15063.0_hu-hu_108ceb72e3e4e2a9_comctl32.dll.mui_0da4e682 745da563270a1280bf3672f59bfc61bec18f2e87f9a3c86b15bab756a297125f.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft.windows.winhttp.resources_31bf3856ad364e35_6.0.15063.0_en-us_63ab03a64f69205a_winhttp.dll.mui_f661192f 745da563270a1280bf3672f59bfc61bec18f2e87f9a3c86b15bab756a297125f.exe File opened for modification C:\Windows\WinSxS\Backup\wow64_microsoft-windows-com-base_31bf3856ad364e35_10.0.15063.0_none_2956ba0293b4f9a6_combase.dll_a2567a6a 745da563270a1280bf3672f59bfc61bec18f2e87f9a3c86b15bab756a297125f.exe File opened for modification C:\Windows\WinSxS\Backup\x86_microsoft-windows-i..er-engine.resources_31bf3856ad364e35_10.0.15063.0_fr-fr_9e9a00a6d22ab935_msimsg.dll.mui_72e8994f 745da563270a1280bf3672f59bfc61bec18f2e87f9a3c86b15bab756a297125f.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-g..licy-base.resources_31bf3856ad364e35_10.0.15063.0_ja-jp_0118bd0b66fae87a_gpsvc.dll.mui_0c160ac2 745da563270a1280bf3672f59bfc61bec18f2e87f9a3c86b15bab756a297125f.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-offlinefiles-core_31bf3856ad364e35_10.0.15063.0_none_af5c222094b6037e.manifest 745da563270a1280bf3672f59bfc61bec18f2e87f9a3c86b15bab756a297125f.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-rasserver.resources_31bf3856ad364e35_10.0.15063.0_en-us_8c54ed7ef50a1538_mprdim.dll.mui_11b5ef08 745da563270a1280bf3672f59bfc61bec18f2e87f9a3c86b15bab756a297125f.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft.windows.c..-controls.resources_6595b64144ccf1df_6.0.15063.0_nb-no_e1663e689467fdb8_comctl32.dll.mui_0da4e682 745da563270a1280bf3672f59bfc61bec18f2e87f9a3c86b15bab756a297125f.exe File opened for modification C:\Windows\WinSxS\Backup\x86_microsoft.windows.c..-controls.resources_6595b64144ccf1df_5.82.15063.0_sk-sk_8995eb58cf34dfaa_comctl32.dll.mui_0da4e682 745da563270a1280bf3672f59bfc61bec18f2e87f9a3c86b15bab756a297125f.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-b..ore-bootmanager-efi_31bf3856ad364e35_10.0.15063.0_none_9894c210d52e9480_bootmgfw.efi_139dd311 745da563270a1280bf3672f59bfc61bec18f2e87f9a3c86b15bab756a297125f.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-com-base.resources_31bf3856ad364e35_10.0.15063.0_ja-jp_f863dd8f33bd56fe.manifest 745da563270a1280bf3672f59bfc61bec18f2e87f9a3c86b15bab756a297125f.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-kernelbase_31bf3856ad364e35_10.0.15063.0_none_3816518ced62ca02.manifest 745da563270a1280bf3672f59bfc61bec18f2e87f9a3c86b15bab756a297125f.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-pcw_31bf3856ad364e35_10.0.15063.0_none_c1256f978f4f2084.manifest 745da563270a1280bf3672f59bfc61bec18f2e87f9a3c86b15bab756a297125f.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-u..istration.resources_31bf3856ad364e35_10.0.15063.0_de-de_cbe51fcec4ccd94a_dsreg.dll.mui_5d9efc7e 745da563270a1280bf3672f59bfc61bec18f2e87f9a3c86b15bab756a297125f.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-u..istration.resources_31bf3856ad364e35_10.0.15063.0_fr-fr_1758c8aaa6a3ed16.manifest 745da563270a1280bf3672f59bfc61bec18f2e87f9a3c86b15bab756a297125f.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-wmi-core.resources_31bf3856ad364e35_10.0.15063.0_en-us_e5db677400777894_wmiapsrv.exe.mui_b1567840 745da563270a1280bf3672f59bfc61bec18f2e87f9a3c86b15bab756a297125f.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft.windows.c..-controls.resources_6595b64144ccf1df_5.82.15063.0_zh-tw_bd2f3fe4592c7f55.manifest 745da563270a1280bf3672f59bfc61bec18f2e87f9a3c86b15bab756a297125f.exe File opened for modification C:\Windows\WinSxS\Backup\x86_microsoft-windows-w..eservices.resources_31bf3856ad364e35_10.0.15063.0_de-de_e55bfc1b4bb94ab9_wiaservc.dll.mui_54051b53 745da563270a1280bf3672f59bfc61bec18f2e87f9a3c86b15bab756a297125f.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-b..iagnostic.resources_31bf3856ad364e35_10.0.15063.0_cs-cz_84a6e53ddce0735f.manifest 745da563270a1280bf3672f59bfc61bec18f2e87f9a3c86b15bab756a297125f.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-i..er-engine.resources_31bf3856ad364e35_10.0.15063.0_pt-pt_5ab3cf3803b28fdf.manifest 745da563270a1280bf3672f59bfc61bec18f2e87f9a3c86b15bab756a297125f.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-msasn1_31bf3856ad364e35_10.0.15063.0_none_d86def03de301c93.manifest 745da563270a1280bf3672f59bfc61bec18f2e87f9a3c86b15bab756a297125f.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-r..intmapper.resources_31bf3856ad364e35_10.0.15063.0_de-de_52bbcd224381180e_rpcepmap.dll.mui_349798e1 745da563270a1280bf3672f59bfc61bec18f2e87f9a3c86b15bab756a297125f.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Interacts with shadow copies 2 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
Processes:
vssadmin.exepid process 2356 vssadmin.exe -
Processes:
745da563270a1280bf3672f59bfc61bec18f2e87f9a3c86b15bab756a297125f.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\02FAF3E291435468607857694DF5E45B68851868 745da563270a1280bf3672f59bfc61bec18f2e87f9a3c86b15bab756a297125f.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\02FAF3E291435468607857694DF5E45B68851868\Blob = 0f000000010000001400000009b9105c5bba24343ca7f341c624e183f6ee7c1b090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00b00000001000000260000005300650063007400690067006f00200028004100640064005400720075007300740029000000620000000100000020000000687fa451382278fff0c8b11f8d43d576671c6eb2bceab413fb83d965d06d2ff2140000000100000014000000adbd987a34b426f7fac42654ef03bde024cb541a1d000000010000001000000006f9583c00a763c23fb9e065a3366d557e0000000100000008000000000063f58926d70103000000010000001400000002faf3e291435468607857694df5e45b6885186820000000010000003a040000308204363082031ea003020102020101300d06092a864886f70d0101050500306f310b300906035504061302534531143012060355040a130b416464547275737420414231263024060355040b131d41646454727573742045787465726e616c20545450204e6574776f726b312230200603550403131941646454727573742045787465726e616c20434120526f6f74301e170d3030303533303130343833385a170d3230303533303130343833385a306f310b300906035504061302534531143012060355040a130b416464547275737420414231263024060355040b131d41646454727573742045787465726e616c20545450204e6574776f726b312230200603550403131941646454727573742045787465726e616c20434120526f6f7430820122300d06092a864886f70d01010105000382010f003082010a0282010100b7f71a33e6f200042d39e04e5bed1fbc6c0fcdb5fa23b6cede9b113397a4294c7d939fbd4abc93ed031ae38fcfe56d505ad69729945a80b0497adb2e95fdb8cabf37382d1e3e9141ad7056c7f04f3fe8329e74cac89054e9c65f0f789d9a403c0eac61aa5e148f9e87a16a50dcd79a4eaf05b3a671949c71b350600ac7139d38078602a8e9a869261890ab4cb04f23ab3a4f84d8dfce9fe1696fbbd742d76b44e4c7adee6d415f725a710837b37965a459a09437f7002f0dc29272dad03872db14a845c45d2a7db7b4d6c4eeaccd1344b7c92bdd430025fa61b9696a582311b7a7338f567559f5cd29d746b70a2b65b6d3426f15b2b87bfbefe95d53d5345a270203010001a381dc3081d9301d0603551d0e04160414adbd987a34b426f7fac42654ef03bde024cb541a300b0603551d0f040403020106300f0603551d130101ff040530030101ff3081990603551d2304819130818e8014adbd987a34b426f7fac42654ef03bde024cb541aa173a471306f310b300906035504061302534531143012060355040a130b416464547275737420414231263024060355040b131d41646454727573742045787465726e616c20545450204e6574776f726b312230200603550403131941646454727573742045787465726e616c20434120526f6f74820101300d06092a864886f70d01010505000382010100b09be08525c2d623e20f9606929d41989cd9847981d91e5b14072336658fb0d877bbac416c47608351b0f9323de7fcf62613c78016a5bf5afc87cf787989219ae24c070a8635bcf2de51c4d296b7dc7e4eee70fd1c39eb0c0251142d8ebd16e0c1df4675e724adecf442b48593701067ba9d06354a18d32b7acc5142a17a63d1e6bba1c52bc236be130de6bd637e797ba7090d40ab6add8f8ac3f6f68c1a420551d445f59fa76221681520433c99e77cbd24d8a9911773883f561b313818b4710f9acdc80e9e8e2e1be18c9883cb1f31f1444cc604734976600fc7f8bd17806b2ee9cc4c0e5a9a790f200a2ed59e63261e559294d882175a7bd0bcc78f4e8604 745da563270a1280bf3672f59bfc61bec18f2e87f9a3c86b15bab756a297125f.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\02FAF3E291435468607857694DF5E45B68851868\Blob = 0400000001000000100000001d3554048578b03f42424dbf20730a3f03000000010000001400000002faf3e291435468607857694df5e45b688518687e0000000100000008000000000063f58926d7011d000000010000001000000006f9583c00a763c23fb9e065a3366d55140000000100000014000000adbd987a34b426f7fac42654ef03bde024cb541a620000000100000020000000687fa451382278fff0c8b11f8d43d576671c6eb2bceab413fb83d965d06d2ff20b00000001000000260000005300650063007400690067006f0020002800410064006400540072007500730074002900000053000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b060105050703080f000000010000001400000009b9105c5bba24343ca7f341c624e183f6ee7c1b20000000010000003a040000308204363082031ea003020102020101300d06092a864886f70d0101050500306f310b300906035504061302534531143012060355040a130b416464547275737420414231263024060355040b131d41646454727573742045787465726e616c20545450204e6574776f726b312230200603550403131941646454727573742045787465726e616c20434120526f6f74301e170d3030303533303130343833385a170d3230303533303130343833385a306f310b300906035504061302534531143012060355040a130b416464547275737420414231263024060355040b131d41646454727573742045787465726e616c20545450204e6574776f726b312230200603550403131941646454727573742045787465726e616c20434120526f6f7430820122300d06092a864886f70d01010105000382010f003082010a0282010100b7f71a33e6f200042d39e04e5bed1fbc6c0fcdb5fa23b6cede9b113397a4294c7d939fbd4abc93ed031ae38fcfe56d505ad69729945a80b0497adb2e95fdb8cabf37382d1e3e9141ad7056c7f04f3fe8329e74cac89054e9c65f0f789d9a403c0eac61aa5e148f9e87a16a50dcd79a4eaf05b3a671949c71b350600ac7139d38078602a8e9a869261890ab4cb04f23ab3a4f84d8dfce9fe1696fbbd742d76b44e4c7adee6d415f725a710837b37965a459a09437f7002f0dc29272dad03872db14a845c45d2a7db7b4d6c4eeaccd1344b7c92bdd430025fa61b9696a582311b7a7338f567559f5cd29d746b70a2b65b6d3426f15b2b87bfbefe95d53d5345a270203010001a381dc3081d9301d0603551d0e04160414adbd987a34b426f7fac42654ef03bde024cb541a300b0603551d0f040403020106300f0603551d130101ff040530030101ff3081990603551d2304819130818e8014adbd987a34b426f7fac42654ef03bde024cb541aa173a471306f310b300906035504061302534531143012060355040a130b416464547275737420414231263024060355040b131d41646454727573742045787465726e616c20545450204e6574776f726b312230200603550403131941646454727573742045787465726e616c20434120526f6f74820101300d06092a864886f70d01010505000382010100b09be08525c2d623e20f9606929d41989cd9847981d91e5b14072336658fb0d877bbac416c47608351b0f9323de7fcf62613c78016a5bf5afc87cf787989219ae24c070a8635bcf2de51c4d296b7dc7e4eee70fd1c39eb0c0251142d8ebd16e0c1df4675e724adecf442b48593701067ba9d06354a18d32b7acc5142a17a63d1e6bba1c52bc236be130de6bd637e797ba7090d40ab6add8f8ac3f6f68c1a420551d445f59fa76221681520433c99e77cbd24d8a9911773883f561b313818b4710f9acdc80e9e8e2e1be18c9883cb1f31f1444cc604734976600fc7f8bd17806b2ee9cc4c0e5a9a790f200a2ed59e63261e559294d882175a7bd0bcc78f4e8604 745da563270a1280bf3672f59bfc61bec18f2e87f9a3c86b15bab756a297125f.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\02FAF3E291435468607857694DF5E45B68851868\Blob = 19000000010000001000000045ed9bbc5e43d3b9ecd63c060db78e5c0f000000010000001400000009b9105c5bba24343ca7f341c624e183f6ee7c1b090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00b00000001000000260000005300650063007400690067006f00200028004100640064005400720075007300740029000000620000000100000020000000687fa451382278fff0c8b11f8d43d576671c6eb2bceab413fb83d965d06d2ff2140000000100000014000000adbd987a34b426f7fac42654ef03bde024cb541a1d000000010000001000000006f9583c00a763c23fb9e065a3366d557e0000000100000008000000000063f58926d70103000000010000001400000002faf3e291435468607857694df5e45b688518680400000001000000100000001d3554048578b03f42424dbf20730a3f20000000010000003a040000308204363082031ea003020102020101300d06092a864886f70d0101050500306f310b300906035504061302534531143012060355040a130b416464547275737420414231263024060355040b131d41646454727573742045787465726e616c20545450204e6574776f726b312230200603550403131941646454727573742045787465726e616c20434120526f6f74301e170d3030303533303130343833385a170d3230303533303130343833385a306f310b300906035504061302534531143012060355040a130b416464547275737420414231263024060355040b131d41646454727573742045787465726e616c20545450204e6574776f726b312230200603550403131941646454727573742045787465726e616c20434120526f6f7430820122300d06092a864886f70d01010105000382010f003082010a0282010100b7f71a33e6f200042d39e04e5bed1fbc6c0fcdb5fa23b6cede9b113397a4294c7d939fbd4abc93ed031ae38fcfe56d505ad69729945a80b0497adb2e95fdb8cabf37382d1e3e9141ad7056c7f04f3fe8329e74cac89054e9c65f0f789d9a403c0eac61aa5e148f9e87a16a50dcd79a4eaf05b3a671949c71b350600ac7139d38078602a8e9a869261890ab4cb04f23ab3a4f84d8dfce9fe1696fbbd742d76b44e4c7adee6d415f725a710837b37965a459a09437f7002f0dc29272dad03872db14a845c45d2a7db7b4d6c4eeaccd1344b7c92bdd430025fa61b9696a582311b7a7338f567559f5cd29d746b70a2b65b6d3426f15b2b87bfbefe95d53d5345a270203010001a381dc3081d9301d0603551d0e04160414adbd987a34b426f7fac42654ef03bde024cb541a300b0603551d0f040403020106300f0603551d130101ff040530030101ff3081990603551d2304819130818e8014adbd987a34b426f7fac42654ef03bde024cb541aa173a471306f310b300906035504061302534531143012060355040a130b416464547275737420414231263024060355040b131d41646454727573742045787465726e616c20545450204e6574776f726b312230200603550403131941646454727573742045787465726e616c20434120526f6f74820101300d06092a864886f70d01010505000382010100b09be08525c2d623e20f9606929d41989cd9847981d91e5b14072336658fb0d877bbac416c47608351b0f9323de7fcf62613c78016a5bf5afc87cf787989219ae24c070a8635bcf2de51c4d296b7dc7e4eee70fd1c39eb0c0251142d8ebd16e0c1df4675e724adecf442b48593701067ba9d06354a18d32b7acc5142a17a63d1e6bba1c52bc236be130de6bd637e797ba7090d40ab6add8f8ac3f6f68c1a420551d445f59fa76221681520433c99e77cbd24d8a9911773883f561b313818b4710f9acdc80e9e8e2e1be18c9883cb1f31f1444cc604734976600fc7f8bd17806b2ee9cc4c0e5a9a790f200a2ed59e63261e559294d882175a7bd0bcc78f4e8604 745da563270a1280bf3672f59bfc61bec18f2e87f9a3c86b15bab756a297125f.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\02FAF3E291435468607857694DF5E45B68851868\Blob = 5c0000000100000004000000000800000400000001000000100000001d3554048578b03f42424dbf20730a3f03000000010000001400000002faf3e291435468607857694df5e45b688518687e0000000100000008000000000063f58926d7011d000000010000001000000006f9583c00a763c23fb9e065a3366d55140000000100000014000000adbd987a34b426f7fac42654ef03bde024cb541a620000000100000020000000687fa451382278fff0c8b11f8d43d576671c6eb2bceab413fb83d965d06d2ff20b00000001000000260000005300650063007400690067006f0020002800410064006400540072007500730074002900000053000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b060105050703080f000000010000001400000009b9105c5bba24343ca7f341c624e183f6ee7c1b19000000010000001000000045ed9bbc5e43d3b9ecd63c060db78e5c20000000010000003a040000308204363082031ea003020102020101300d06092a864886f70d0101050500306f310b300906035504061302534531143012060355040a130b416464547275737420414231263024060355040b131d41646454727573742045787465726e616c20545450204e6574776f726b312230200603550403131941646454727573742045787465726e616c20434120526f6f74301e170d3030303533303130343833385a170d3230303533303130343833385a306f310b300906035504061302534531143012060355040a130b416464547275737420414231263024060355040b131d41646454727573742045787465726e616c20545450204e6574776f726b312230200603550403131941646454727573742045787465726e616c20434120526f6f7430820122300d06092a864886f70d01010105000382010f003082010a0282010100b7f71a33e6f200042d39e04e5bed1fbc6c0fcdb5fa23b6cede9b113397a4294c7d939fbd4abc93ed031ae38fcfe56d505ad69729945a80b0497adb2e95fdb8cabf37382d1e3e9141ad7056c7f04f3fe8329e74cac89054e9c65f0f789d9a403c0eac61aa5e148f9e87a16a50dcd79a4eaf05b3a671949c71b350600ac7139d38078602a8e9a869261890ab4cb04f23ab3a4f84d8dfce9fe1696fbbd742d76b44e4c7adee6d415f725a710837b37965a459a09437f7002f0dc29272dad03872db14a845c45d2a7db7b4d6c4eeaccd1344b7c92bdd430025fa61b9696a582311b7a7338f567559f5cd29d746b70a2b65b6d3426f15b2b87bfbefe95d53d5345a270203010001a381dc3081d9301d0603551d0e04160414adbd987a34b426f7fac42654ef03bde024cb541a300b0603551d0f040403020106300f0603551d130101ff040530030101ff3081990603551d2304819130818e8014adbd987a34b426f7fac42654ef03bde024cb541aa173a471306f310b300906035504061302534531143012060355040a130b416464547275737420414231263024060355040b131d41646454727573742045787465726e616c20545450204e6574776f726b312230200603550403131941646454727573742045787465726e616c20434120526f6f74820101300d06092a864886f70d01010505000382010100b09be08525c2d623e20f9606929d41989cd9847981d91e5b14072336658fb0d877bbac416c47608351b0f9323de7fcf62613c78016a5bf5afc87cf787989219ae24c070a8635bcf2de51c4d296b7dc7e4eee70fd1c39eb0c0251142d8ebd16e0c1df4675e724adecf442b48593701067ba9d06354a18d32b7acc5142a17a63d1e6bba1c52bc236be130de6bd637e797ba7090d40ab6add8f8ac3f6f68c1a420551d445f59fa76221681520433c99e77cbd24d8a9911773883f561b313818b4710f9acdc80e9e8e2e1be18c9883cb1f31f1444cc604734976600fc7f8bd17806b2ee9cc4c0e5a9a790f200a2ed59e63261e559294d882175a7bd0bcc78f4e8604 745da563270a1280bf3672f59bfc61bec18f2e87f9a3c86b15bab756a297125f.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
745da563270a1280bf3672f59bfc61bec18f2e87f9a3c86b15bab756a297125f.exepid process 2104 745da563270a1280bf3672f59bfc61bec18f2e87f9a3c86b15bab756a297125f.exe 2104 745da563270a1280bf3672f59bfc61bec18f2e87f9a3c86b15bab756a297125f.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
vssvc.exedescription pid process Token: SeBackupPrivilege 3348 vssvc.exe Token: SeRestorePrivilege 3348 vssvc.exe Token: SeAuditPrivilege 3348 vssvc.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
745da563270a1280bf3672f59bfc61bec18f2e87f9a3c86b15bab756a297125f.execmd.exedescription pid process target process PID 2104 wrote to memory of 1600 2104 745da563270a1280bf3672f59bfc61bec18f2e87f9a3c86b15bab756a297125f.exe cmd.exe PID 2104 wrote to memory of 1600 2104 745da563270a1280bf3672f59bfc61bec18f2e87f9a3c86b15bab756a297125f.exe cmd.exe PID 2104 wrote to memory of 1600 2104 745da563270a1280bf3672f59bfc61bec18f2e87f9a3c86b15bab756a297125f.exe cmd.exe PID 1600 wrote to memory of 2356 1600 cmd.exe vssadmin.exe PID 1600 wrote to memory of 2356 1600 cmd.exe vssadmin.exe PID 1600 wrote to memory of 2356 1600 cmd.exe vssadmin.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\745da563270a1280bf3672f59bfc61bec18f2e87f9a3c86b15bab756a297125f.exe"C:\Users\Admin\AppData\Local\Temp\745da563270a1280bf3672f59bfc61bec18f2e87f9a3c86b15bab756a297125f.exe"1⤵
- Modifies extensions of user files
- Enumerates connected drives
- Sets desktop wallpaper using registry
- Drops file in Windows directory
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c vssadmin.exe Delete Shadows /All /Quiet & bcdedit /set {default} recoveryenabled No & bcdedit /set {default} bootstatuspolicy ignoreallfailures2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\vssadmin.exevssadmin.exe Delete Shadows /All /Quiet3⤵
- Interacts with shadow copies
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken