sodinokibi | eeeeb1d683c948d0426e253d708445817ad66460a93ef53668dd67a6f5f223d4

General

Target

eeeeb1d683c948d0426e253d708445817ad66460a93ef53668dd67a6f5f223d4.exe
Size

118KB
MD5

08fad193fc03bad8132bd791155212d2
SHA1

5c56fd5246f3680f4576a9e633fb76acfb15f994
SHA256

eeeeb1d683c948d0426e253d708445817ad66460a93ef53668dd67a6f5f223d4
SHA512

d2e3460998d409a530f5435f9c7693d1aa684b5016b8abcbfd86530cd2ed2fd7849094bf2be865e2f75179f557567265b8ee6091c39d96d7cb8c7b89a9d2835e

Score

10^/10

sodinokibi persistence ransomware spyware stealer

Malware Config

Extracted

Path

C:\930gf01-readme.txt

Family

sodinokibi

Ransom Note

---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension 930gf01. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). In case if you will not contact ,your data will be posted online or sold. Also media will be informed! [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/AED38EC1EAB0B437 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decoder.re/AED38EC1EAB0B437 Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: IYb3tycJlU3tI13LCe3nBWNEsMDDvgO8SyFojojyCg0ko4avLwmBumOlpCy8jzeK Kl9k6IQrKWkOQfi1rgyZuWhwEsJMugDPRR4ZoAIq06eRcfrR5QfpfiVMw/eQL1te KxcDw5BOLbCsT03ktzJWLZ+S5+fPDBukiYbbuJIcDEvtiHz5n3rwbrNxNiXd7kew UCqQpjhmceTh64F0Ae/0mVQbCWuXswGjDdi3iMitCPhmDovRr0zfwS382TIU0EPb q4VRDq9CXDHiCnrbw5pM8uFKFdQzVWQSw4JhqFWJ+BNOiUONfboq002qf0eqXdsq b29S+eVUKgsyv7uW33X6Ip/1VvV9Ld/qc0jR34LSxkiK+zw03yehlYaI6xnV6EFC VA4w0xRensGnJiQw+yXy7OyRdYqQejtDuokBPviOwg/1WE1vliFTxRaE7As7e2xu UkKC2vn8eg1iMlM2CnvCk27SfSfBEOBm7k+LnQsWIunKu56u6P04Ntv4kjDPF11H AzfPoLdks9vJAqPCKN6573EUbo+SqrQmft9S1USAMf0Wb9oOgmGFD8krMVxOnUBE yjbyy1NzOw3Od2c01Wg/xWanDIqjTkSp9hNdUmkkKWcwFOt/QlWU7aMalS7q+gEq ji9NmoZ+wYg8VwznhMFlIDSIbDZ/izR83pQ27Fs8C5hnVBIPbhZIcyETXWHJhRZj lPFAnJnCiVcUeLfcV6wJbdbnHQKRt6mWX3/yPadehfDin1Z4vji3jDA10cw3CjyB wXnjMouOp7ttKbO4XvdOQ7CYdYuzuyIt63kyJoG3+RAZjs0nEYs9IBFaXjJdzbiZ gTlXz/m/w6lxdJ5R+VafGb08dkRO3JBaffqUCYG6Pb6T/lacyJ/0IZw/zgy56HTF s11azeSyE2C0+Q368GFFoew5Y8z/FsDZxlEaChXn9EL1IRD5JVixWEdVqlImmU4f tto1jhe3uPUKwwkHPmSP1m320v8fafCzGSesgxZzcD0tfGvc4VnbF13RMAsP26kX gEBFOeUy915PfO7AtUaboKHuyJ6XAw6qtF+9GRElMTIWk5IGQaKRmv2tjiYJBCqM CZWIzHxKtLZqqo+b73DR8dqTAlQu2P/ZIqjQH9shToLZ0wJJggTU5cNbfccVbuJY ApJ8aX72uUzIP0y3q58gB6y6fjrkt/99KBViQtHAd9f3YTWCsROXwnnMXGwHctMp 4tuD2SyIxtZrAPvhHOqTrl2T5MMiD20opiLaHSY0p0dHnIG7uYYV7veNgHq6u4tn 0XZ3cG5X8BbpNRp7IhMNwFCwkUjL8cQb9gU= ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!

URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/AED38EC1EAB0B437

http://decoder.re/AED38EC1EAB0B437

Signatures

Sodin,Sodinokibi,REvil
Ransomware with advanced anti-analysis and privilege escalation functionality.
ransomware sodinokibi

Modifies extensions of user files 14 IoCs

Ransomware generally changes the extension on encrypted files.

ransomware

Processes:

eeeeb1d683c948d0426e253d708445817ad66460a93ef53668dd67a6f5f223d4.exe

description	ioc	process
File renamed	C:\Users\Admin\Pictures\CompressRestart.tif => \??\c:\users\admin\pictures\CompressRestart.tif.930gf01	eeeeb1d683c948d0426e253d708445817ad66460a93ef53668dd67a6f5f223d4.exe
File renamed	C:\Users\Admin\Pictures\InitializeRepair.tiff => \??\c:\users\admin\pictures\InitializeRepair.tiff.930gf01	eeeeb1d683c948d0426e253d708445817ad66460a93ef53668dd67a6f5f223d4.exe
File renamed	C:\Users\Admin\Pictures\MeasureSelect.raw => \??\c:\users\admin\pictures\MeasureSelect.raw.930gf01	eeeeb1d683c948d0426e253d708445817ad66460a93ef53668dd67a6f5f223d4.exe
File opened for modification	\??\c:\users\admin\pictures\InitializeRepair.tiff	eeeeb1d683c948d0426e253d708445817ad66460a93ef53668dd67a6f5f223d4.exe
File renamed	C:\Users\Admin\Pictures\AssertInstall.tif => \??\c:\users\admin\pictures\AssertInstall.tif.930gf01	eeeeb1d683c948d0426e253d708445817ad66460a93ef53668dd67a6f5f223d4.exe
File renamed	C:\Users\Admin\Pictures\MountRegister.tif => \??\c:\users\admin\pictures\MountRegister.tif.930gf01	eeeeb1d683c948d0426e253d708445817ad66460a93ef53668dd67a6f5f223d4.exe
File renamed	C:\Users\Admin\Pictures\DenyUnregister.raw => \??\c:\users\admin\pictures\DenyUnregister.raw.930gf01	eeeeb1d683c948d0426e253d708445817ad66460a93ef53668dd67a6f5f223d4.exe
File renamed	C:\Users\Admin\Pictures\EnableSuspend.png => \??\c:\users\admin\pictures\EnableSuspend.png.930gf01	eeeeb1d683c948d0426e253d708445817ad66460a93ef53668dd67a6f5f223d4.exe
File renamed	C:\Users\Admin\Pictures\ExpandRegister.png => \??\c:\users\admin\pictures\ExpandRegister.png.930gf01	eeeeb1d683c948d0426e253d708445817ad66460a93ef53668dd67a6f5f223d4.exe
File renamed	C:\Users\Admin\Pictures\DismountSubmit.tiff => \??\c:\users\admin\pictures\DismountSubmit.tiff.930gf01	eeeeb1d683c948d0426e253d708445817ad66460a93ef53668dd67a6f5f223d4.exe
File renamed	C:\Users\Admin\Pictures\DisconnectPop.tif => \??\c:\users\admin\pictures\DisconnectPop.tif.930gf01	eeeeb1d683c948d0426e253d708445817ad66460a93ef53668dd67a6f5f223d4.exe
File renamed	C:\Users\Admin\Pictures\UnregisterMount.crw => \??\c:\users\admin\pictures\UnregisterMount.crw.930gf01	eeeeb1d683c948d0426e253d708445817ad66460a93ef53668dd67a6f5f223d4.exe
File opened for modification	\??\c:\users\admin\pictures\DismountSubmit.tiff	eeeeb1d683c948d0426e253d708445817ad66460a93ef53668dd67a6f5f223d4.exe
File renamed	C:\Users\Admin\Pictures\ReadMount.tif => \??\c:\users\admin\pictures\ReadMount.tif.930gf01	eeeeb1d683c948d0426e253d708445817ad66460a93ef53668dd67a6f5f223d4.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

eeeeb1d683c948d0426e253d708445817ad66460a93ef53668dd67a6f5f223d4.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run	eeeeb1d683c948d0426e253d708445817ad66460a93ef53668dd67a6f5f223d4.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\1E8NAmhfRO = "C:\\Users\\Admin\\AppData\\Local\\Temp\\eeeeb1d683c948d0426e253d708445817ad66460a93ef53668dd67a6f5f223d4.exe"	eeeeb1d683c948d0426e253d708445817ad66460a93ef53668dd67a6f5f223d4.exe

Enumerates connected drives 3 TTPs 25 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

eeeeb1d683c948d0426e253d708445817ad66460a93ef53668dd67a6f5f223d4.exe

description	ioc	process
File opened (read-only)	\??\O:	eeeeb1d683c948d0426e253d708445817ad66460a93ef53668dd67a6f5f223d4.exe
File opened (read-only)	\??\Y:	eeeeb1d683c948d0426e253d708445817ad66460a93ef53668dd67a6f5f223d4.exe
File opened (read-only)	\??\B:	eeeeb1d683c948d0426e253d708445817ad66460a93ef53668dd67a6f5f223d4.exe
File opened (read-only)	\??\G:	eeeeb1d683c948d0426e253d708445817ad66460a93ef53668dd67a6f5f223d4.exe
File opened (read-only)	\??\H:	eeeeb1d683c948d0426e253d708445817ad66460a93ef53668dd67a6f5f223d4.exe
File opened (read-only)	\??\I:	eeeeb1d683c948d0426e253d708445817ad66460a93ef53668dd67a6f5f223d4.exe
File opened (read-only)	\??\M:	eeeeb1d683c948d0426e253d708445817ad66460a93ef53668dd67a6f5f223d4.exe
File opened (read-only)	\??\N:	eeeeb1d683c948d0426e253d708445817ad66460a93ef53668dd67a6f5f223d4.exe
File opened (read-only)	\??\E:	eeeeb1d683c948d0426e253d708445817ad66460a93ef53668dd67a6f5f223d4.exe
File opened (read-only)	\??\J:	eeeeb1d683c948d0426e253d708445817ad66460a93ef53668dd67a6f5f223d4.exe
File opened (read-only)	\??\L:	eeeeb1d683c948d0426e253d708445817ad66460a93ef53668dd67a6f5f223d4.exe
File opened (read-only)	\??\V:	eeeeb1d683c948d0426e253d708445817ad66460a93ef53668dd67a6f5f223d4.exe
File opened (read-only)	\??\A:	eeeeb1d683c948d0426e253d708445817ad66460a93ef53668dd67a6f5f223d4.exe
File opened (read-only)	\??\P:	eeeeb1d683c948d0426e253d708445817ad66460a93ef53668dd67a6f5f223d4.exe
File opened (read-only)	\??\Z:	eeeeb1d683c948d0426e253d708445817ad66460a93ef53668dd67a6f5f223d4.exe
File opened (read-only)	\??\U:	eeeeb1d683c948d0426e253d708445817ad66460a93ef53668dd67a6f5f223d4.exe
File opened (read-only)	\??\W:	eeeeb1d683c948d0426e253d708445817ad66460a93ef53668dd67a6f5f223d4.exe
File opened (read-only)	\??\F:	eeeeb1d683c948d0426e253d708445817ad66460a93ef53668dd67a6f5f223d4.exe
File opened (read-only)	\??\K:	eeeeb1d683c948d0426e253d708445817ad66460a93ef53668dd67a6f5f223d4.exe
File opened (read-only)	\??\Q:	eeeeb1d683c948d0426e253d708445817ad66460a93ef53668dd67a6f5f223d4.exe
File opened (read-only)	\??\R:	eeeeb1d683c948d0426e253d708445817ad66460a93ef53668dd67a6f5f223d4.exe
File opened (read-only)	\??\S:	eeeeb1d683c948d0426e253d708445817ad66460a93ef53668dd67a6f5f223d4.exe
File opened (read-only)	\??\T:	eeeeb1d683c948d0426e253d708445817ad66460a93ef53668dd67a6f5f223d4.exe
File opened (read-only)	\??\X:	eeeeb1d683c948d0426e253d708445817ad66460a93ef53668dd67a6f5f223d4.exe
File opened (read-only)	\??\D:	eeeeb1d683c948d0426e253d708445817ad66460a93ef53668dd67a6f5f223d4.exe

Drops file in System32 directory 1 IoCs

Processes:

eeeeb1d683c948d0426e253d708445817ad66460a93ef53668dd67a6f5f223d4.exe

description	ioc	process
File opened for modification	C:\Windows\System32\CatRoot2\dberr.txt	eeeeb1d683c948d0426e253d708445817ad66460a93ef53668dd67a6f5f223d4.exe

Sets desktop wallpaper using registry 2 TTPs 1 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

Processes:

eeeeb1d683c948d0426e253d708445817ad66460a93ef53668dd67a6f5f223d4.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-2329389628-4064185017-3901522362-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\pzf38jw9d0rn.bmp"	eeeeb1d683c948d0426e253d708445817ad66460a93ef53668dd67a6f5f223d4.exe

Drops file in Program Files directory 35 IoCs

Processes:

eeeeb1d683c948d0426e253d708445817ad66460a93ef53668dd67a6f5f223d4.exe

description	ioc	process
File opened for modification	\??\c:\program files\ResolveSearch.aifc	eeeeb1d683c948d0426e253d708445817ad66460a93ef53668dd67a6f5f223d4.exe
File opened for modification	\??\c:\program files\GrantUnblock.rar	eeeeb1d683c948d0426e253d708445817ad66460a93ef53668dd67a6f5f223d4.exe
File opened for modification	\??\c:\program files\CompressDisconnect.m1v	eeeeb1d683c948d0426e253d708445817ad66460a93ef53668dd67a6f5f223d4.exe
File opened for modification	\??\c:\program files\SplitWrite.ps1xml	eeeeb1d683c948d0426e253d708445817ad66460a93ef53668dd67a6f5f223d4.exe
File opened for modification	\??\c:\program files\UnregisterUnblock.xht	eeeeb1d683c948d0426e253d708445817ad66460a93ef53668dd67a6f5f223d4.exe
File opened for modification	\??\c:\program files\UseUpdate.M2T	eeeeb1d683c948d0426e253d708445817ad66460a93ef53668dd67a6f5f223d4.exe
File opened for modification	\??\c:\program files\ClearResolve.xltx	eeeeb1d683c948d0426e253d708445817ad66460a93ef53668dd67a6f5f223d4.exe
File opened for modification	\??\c:\program files\RedoOpen.tiff	eeeeb1d683c948d0426e253d708445817ad66460a93ef53668dd67a6f5f223d4.exe
File opened for modification	\??\c:\program files\SwitchCompare.iso	eeeeb1d683c948d0426e253d708445817ad66460a93ef53668dd67a6f5f223d4.exe
File created	\??\c:\program files (x86)\microsoft sql server compact edition\930gf01-readme.txt	eeeeb1d683c948d0426e253d708445817ad66460a93ef53668dd67a6f5f223d4.exe
File opened for modification	\??\c:\program files\DisableGrant.xltm	eeeeb1d683c948d0426e253d708445817ad66460a93ef53668dd67a6f5f223d4.exe
File opened for modification	\??\c:\program files\ConfirmSelect.avi	eeeeb1d683c948d0426e253d708445817ad66460a93ef53668dd67a6f5f223d4.exe
File opened for modification	\??\c:\program files\MoveCheckpoint.xla	eeeeb1d683c948d0426e253d708445817ad66460a93ef53668dd67a6f5f223d4.exe
File opened for modification	\??\c:\program files\OutCopy.AAC	eeeeb1d683c948d0426e253d708445817ad66460a93ef53668dd67a6f5f223d4.exe
File opened for modification	\??\c:\program files\PopBackup.txt	eeeeb1d683c948d0426e253d708445817ad66460a93ef53668dd67a6f5f223d4.exe
File opened for modification	\??\c:\program files\PopSelect.xml	eeeeb1d683c948d0426e253d708445817ad66460a93ef53668dd67a6f5f223d4.exe
File opened for modification	\??\c:\program files\ReadRepair.mht	eeeeb1d683c948d0426e253d708445817ad66460a93ef53668dd67a6f5f223d4.exe
File opened for modification	\??\c:\program files\ApproveWait.mp4v	eeeeb1d683c948d0426e253d708445817ad66460a93ef53668dd67a6f5f223d4.exe
File opened for modification	\??\c:\program files\CheckpointBackup.odt	eeeeb1d683c948d0426e253d708445817ad66460a93ef53668dd67a6f5f223d4.exe
File opened for modification	\??\c:\program files\ConvertBackup.ods	eeeeb1d683c948d0426e253d708445817ad66460a93ef53668dd67a6f5f223d4.exe
File opened for modification	\??\c:\program files\FormatClear.bmp	eeeeb1d683c948d0426e253d708445817ad66460a93ef53668dd67a6f5f223d4.exe
File opened for modification	\??\c:\program files\PingUpdate.m4v	eeeeb1d683c948d0426e253d708445817ad66460a93ef53668dd67a6f5f223d4.exe
File opened for modification	\??\c:\program files\RepairShow.wax	eeeeb1d683c948d0426e253d708445817ad66460a93ef53668dd67a6f5f223d4.exe
File opened for modification	\??\c:\program files\ResetEnable.ppsm	eeeeb1d683c948d0426e253d708445817ad66460a93ef53668dd67a6f5f223d4.exe
File opened for modification	\??\c:\program files\BlockCompress.dotx	eeeeb1d683c948d0426e253d708445817ad66460a93ef53668dd67a6f5f223d4.exe
File opened for modification	\??\c:\program files\OpenGrant.DVR-MS	eeeeb1d683c948d0426e253d708445817ad66460a93ef53668dd67a6f5f223d4.exe
File opened for modification	\??\c:\program files\RepairExport.jpg	eeeeb1d683c948d0426e253d708445817ad66460a93ef53668dd67a6f5f223d4.exe
File opened for modification	\??\c:\program files\CompareWatch.vssx	eeeeb1d683c948d0426e253d708445817ad66460a93ef53668dd67a6f5f223d4.exe
File opened for modification	\??\c:\program files\OpenWait.odt	eeeeb1d683c948d0426e253d708445817ad66460a93ef53668dd67a6f5f223d4.exe
File opened for modification	\??\c:\program files\UpdateUnblock.wax	eeeeb1d683c948d0426e253d708445817ad66460a93ef53668dd67a6f5f223d4.exe
File created	\??\c:\program files (x86)\microsoft sql server compact edition\v3.5\930gf01-readme.txt	eeeeb1d683c948d0426e253d708445817ad66460a93ef53668dd67a6f5f223d4.exe
File created	\??\c:\program files (x86)\microsoft sql server compact edition\v3.5\desktop\930gf01-readme.txt	eeeeb1d683c948d0426e253d708445817ad66460a93ef53668dd67a6f5f223d4.exe
File opened for modification	\??\c:\program files\AssertConnect.TTS	eeeeb1d683c948d0426e253d708445817ad66460a93ef53668dd67a6f5f223d4.exe
File opened for modification	\??\c:\program files\TraceUnblock.ADTS	eeeeb1d683c948d0426e253d708445817ad66460a93ef53668dd67a6f5f223d4.exe
File opened for modification	\??\c:\program files\TestUnpublish.emf	eeeeb1d683c948d0426e253d708445817ad66460a93ef53668dd67a6f5f223d4.exe

Modifies system certificate store 2 TTPs 4 IoCs

evasion spyware trojan

Install Root Certificate

T1130

Modify Registry

T1112

Processes:

eeeeb1d683c948d0426e253d708445817ad66460a93ef53668dd67a6f5f223d4.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349	eeeeb1d683c948d0426e253d708445817ad66460a93ef53668dd67a6f5f223d4.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 040000000100000010000000497904b0eb8719ac47b0bc11519b74d00f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d578112861900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa2030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491d00000001000000100000002e0d6875874a44c820912e85e964cfdb140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b40b00000001000000180000004300b7004f00b7004d00b7004f00b7004400b7004f00000053000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b06010505070308200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e	eeeeb1d683c948d0426e253d708445817ad66460a93ef53668dd67a6f5f223d4.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436	eeeeb1d683c948d0426e253d708445817ad66460a93ef53668dd67a6f5f223d4.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436\Blob = 04000000010000001000000079e4a9840d7d3a96d7c04fe2434c892e0f0000000100000014000000b34ddd372ed92e8f2abfbb9e20a9d31f204f194b090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030814000000010000001400000003de503556d14cbb66f0a3e21b1bc397b23dd1550b00000001000000120000004400690067006900430065007200740000001d000000010000001000000059779e39e21a2e3dfced6857ed5c5fd9030000000100000014000000a8985d3a65e5e5c4b2d7d66d40c6dd2fb19c54361900000001000000100000000f3a0527d242de2dc98e5cfcb1e991ee2000000001000000b3030000308203af30820297a0030201020210083be056904246b1a1756ac95991c74a300d06092a864886f70d01010505003061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100e23be11172dea8a4d3a357aa50a28f0b7790c9a2a5ee12ce965b010920cc0193a74e30b753f743c46900579de28d22dd870640008109cece1b83bfdfcd3b7146e2d666c705b37627168f7b9e1e957deeb748a308dad6af7a0c3906657f4a5d1fbc17f8abbeee28d7747f7a78995985686e5c23324bbf4ec0e85a6de370bf7710bffc01f685d9a844105832a97518d5d1a2be47e2276af49a33f84908608bd45fb43a84bfa1aa4a4c7d3ecf4f5f6c765ea04b37919edc22e66dce141a8e6acbfecdb3146417c75b299e32bff2eefad30b42d4abb74132da0cd4eff881d5bb8d583fb51be84928a270da3104ddf7b216f24c0a4e07a8ed4a3d5eb57fa390c3af270203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041403de503556d14cbb66f0a3e21b1bc397b23dd155301f0603551d2304183016801403de503556d14cbb66f0a3e21b1bc397b23dd155300d06092a864886f70d01010505000382010100cb9c37aa4813120afadd449c4f52b0f4dfae04f5797908a32418fc4b2b84c02db9d5c7fef4c11f58cbb86d9c7a74e79829ab11b5e370a0a1cd4c8899938c9170e2ab0f1cbe93a9ff63d5e40760d3a3bf9d5b09f1d58ee353f48e63fa3fa7dbb466df6266d6d16e418df22db5ea774a9f9d58e22b59c04023ed2d2882453e7954922698e08048a837eff0d6796016deace80ecd6eac4417382f49dae1453e2ab93653cf3a5006f72ee8c457496c612118d504ad783c2c3a806ba7ebaf1514e9d889c1b9386ce2916c8aff64b977255730c01b24a3e1dce9df477cb5b424080530ec2dbd0bbf45bf50b9a9f3eb980112adc888c698345f8d0a3cc6e9d595956dde	eeeeb1d683c948d0426e253d708445817ad66460a93ef53668dd67a6f5f223d4.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

eeeeb1d683c948d0426e253d708445817ad66460a93ef53668dd67a6f5f223d4.exe

pid	process
524	eeeeb1d683c948d0426e253d708445817ad66460a93ef53668dd67a6f5f223d4.exe
524	eeeeb1d683c948d0426e253d708445817ad66460a93ef53668dd67a6f5f223d4.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

Processes:

eeeeb1d683c948d0426e253d708445817ad66460a93ef53668dd67a6f5f223d4.exevssvc.exe

description	pid	process
Token: SeDebugPrivilege	524	eeeeb1d683c948d0426e253d708445817ad66460a93ef53668dd67a6f5f223d4.exe
Token: SeTakeOwnershipPrivilege	524	eeeeb1d683c948d0426e253d708445817ad66460a93ef53668dd67a6f5f223d4.exe
Token: SeBackupPrivilege	1604	vssvc.exe
Token: SeRestorePrivilege	1604	vssvc.exe
Token: SeAuditPrivilege	1604	vssvc.exe

C:\Users\Admin\AppData\Local\Temp\eeeeb1d683c948d0426e253d708445817ad66460a93ef53668dd67a6f5f223d4.exe
"C:\Users\Admin\AppData\Local\Temp\eeeeb1d683c948d0426e253d708445817ad66460a93ef53668dd67a6f5f223d4.exe"
1⤵
- Modifies extensions of user files
- Adds Run key to start application
- Enumerates connected drives
- Drops file in System32 directory
- Sets desktop wallpaper using registry
- Drops file in Program Files directory
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:524