Analysis
- max time kernel
149s - max time network
152s - platform
windows10_x64 - resource
win10-en-20211208 - submitted
24/01/2022, 00:48
Static task
static1
Behavioral task
behavioral1
Sample
e5ef61799ae020e426b7e2a4763c053323d2ca12a5d1bd5ed5984e134446eba7.exe
Resource
win7-en-20211208
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
e5ef61799ae020e426b7e2a4763c053323d2ca12a5d1bd5ed5984e134446eba7.exe
Resource
win10-en-20211208
windows10_x64
0 signatures
0 seconds
General
- Target e5ef61799ae020e426b7e2a4763c053323d2ca12a5d1bd5ed5984e134446eba7.exe
- Size 155KB
- Sample220124-a56a7sghfp
- SHA256 e5ef61799ae020e426b7e2a4763c053323d2ca12a5d1bd5ed5984e134446eba7
- MD5 f16a096605b961e772d995b0b6a18782
- SHA1 5c099616f70b8e9d011b1289abdd2058df420a46
- SHA512 8f9d2c70c44a438dd3b6437105e6f3624c1c2fc30961289098afd0f6401e8058d94d4bb57d8ea009662b18a4776498415e9102bbb1555a44f600a85389cc2a42
- MD5 SHA1 SHA512
Score
10/10
Malware Config
Extracted
Path
-
C:\ibmpez3sn-readme.txt
-
sodinokibi
Ransom Note
- ---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on you computer has expansion ibmpez3sn. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/DDB01E03B3E9B61C 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/DDB01E03B3E9B61C Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: s8/B+4VG5mixvbFOPkM7fka84K5PWsU/1aDJ3npWkMmfcDhbl7e6aofwjRcA/GFU k/s7Gj8bSkv8NG9Rkmu5zByt8yzjlla3fr4b5tqV30yk9AkAExatGUn0xlIcPB3B xLRC6g+v9jnKePhnydd/zQCfXgTPNt3ity3Dk+G2NHDcrZKZ6TEmwlz1eWWi9UwJ wdQhsXAhFx1zoxNSZXzgs99BVK9I5A80MTBOdcOdJHbQcSvW4wESa677rpIs+fE6 dNwe6cfbUa42D66Qip5Bkv166GW7vEtGJfcLr6PpmtS4gH4APGmIJ1mpPU/k5qX1 VqD/FVLguzVsxZKHubl2d0Mvhnf35+H1CuB5JHe0uYsBq1QaYnACjFzhQN4jVjLu yJEzoZRIE49vP8knVLDtV/9Rd8JP4JiPr3t8hG4VK5QXqfsgz2YVSU3FxlPvxWZB xNXsXc8xW2fcVhDB4P6QGijOnYKtIcjQ+cNn+/jbYqvgEHKMcOcyfehfVQDDaQxY jKZlH0ZdwXKbgHC29PjYQ0mlLXoyEzOPMpWgd6VENfnKf4XKMW+MbASnTWTX9/TS vw15qDS2ySkVb9RGPOxbd2RXX110r32ciGXrnzFxv1wZxV+xKT3SCw0iRE7zxjUf F3MBWNjlk58wFHWtD+/BteKj5IoRz0i0iX3FYirqfV6iZRXbBbKdTtXyjDs/cd47 DrerILVObWX+AYcVOFE2Egt21sZenxRsgEN2eoTSS5Cif1PRG/v/CASaF1+i84GC dhrilS9BwnbmnzPLHTy9Obs5fTbb29yCAmwpqCNT9D0P1+XD48R6wUxfUExJIPxD AxqaLdpTed5CSkPIEq/Y/8+DCmyg+oPdzUjUSr/Upg96nB5rxlvTv9/52TOn9nlC U+MtmbPNkwY2NP0cjoZcwd81fO5kWk6WvLH4lmifNprp8LLO3uhF12qI6x388USR UJhuXNbOGNsx6ACIWrcWZIG+/9vPDweF+pGWkrrDqq8aiU9eC8Lo3djkccemgugF zl8SFpzY5PXXgPvWnYsttlGQsgQ0tNwe4Z9ylDVbaRWAnsjzW1z1k3pb2SJKRsbs Dt318arOK7+CxhkphPd7lEoOwG/VP0ha3gEzoxVl1LnUwsBpmf9DJuI2FkH5fSiX ugJUuT3hr1vXZ3B303L49M/2sScrMG22Z1wSEilIbAKjvns6+9jpWWGCmr63R5iv xFl2LAHLv9BRwCzeSScf5koGQYwioO9IBaCWTE0oG8F3A5bRCEYZuKC+AohxD19M FFOfIJstyFyg7IJuQSOaOdFJBQD6uw== Extension name: ibmpez3sn ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs
-
http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/DDB01E03B3E9B61C
-
http://decryptor.cc/DDB01E03B3E9B61C
Signatures
- Sodin,Sodinokibi,REvil
Ransomware with advanced anti-analysis and privilege escalation functionality.
- Modifies extensions of user files 3 IoCs
Ransomware generally changes the extension on encrypted files.
description ioc Process File renamed C:\Users\Admin\Pictures\FindConvertTo.crw => \??\c:\users\admin\pictures\FindConvertTo.crw.ibmpez3sn e5ef61799ae020e426b7e2a4763c053323d2ca12a5d1bd5ed5984e134446eba7.exe File renamed C:\Users\Admin\Pictures\JoinConvertFrom.crw => \??\c:\users\admin\pictures\JoinConvertFrom.crw.ibmpez3sn e5ef61799ae020e426b7e2a4763c053323d2ca12a5d1bd5ed5984e134446eba7.exe File renamed C:\Users\Admin\Pictures\UnpublishConvert.tif => \??\c:\users\admin\pictures\UnpublishConvert.tif.ibmpez3sn e5ef61799ae020e426b7e2a4763c053323d2ca12a5d1bd5ed5984e134446eba7.exe - Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run e5ef61799ae020e426b7e2a4763c053323d2ca12a5d1bd5ed5984e134446eba7.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\BV7BRrErOX = "C:\\Users\\Admin\\AppData\\Local\\Temp\\e5ef61799ae020e426b7e2a4763c053323d2ca12a5d1bd5ed5984e134446eba7.exe" e5ef61799ae020e426b7e2a4763c053323d2ca12a5d1bd5ed5984e134446eba7.exe - Enumerates connected drives 3 TTPs 25 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\K: e5ef61799ae020e426b7e2a4763c053323d2ca12a5d1bd5ed5984e134446eba7.exe File opened (read-only) \??\W: e5ef61799ae020e426b7e2a4763c053323d2ca12a5d1bd5ed5984e134446eba7.exe File opened (read-only) \??\X: e5ef61799ae020e426b7e2a4763c053323d2ca12a5d1bd5ed5984e134446eba7.exe File opened (read-only) \??\Y: e5ef61799ae020e426b7e2a4763c053323d2ca12a5d1bd5ed5984e134446eba7.exe File opened (read-only) \??\P: e5ef61799ae020e426b7e2a4763c053323d2ca12a5d1bd5ed5984e134446eba7.exe File opened (read-only) \??\A: e5ef61799ae020e426b7e2a4763c053323d2ca12a5d1bd5ed5984e134446eba7.exe File opened (read-only) \??\B: e5ef61799ae020e426b7e2a4763c053323d2ca12a5d1bd5ed5984e134446eba7.exe File opened (read-only) \??\E: e5ef61799ae020e426b7e2a4763c053323d2ca12a5d1bd5ed5984e134446eba7.exe File opened (read-only) \??\L: e5ef61799ae020e426b7e2a4763c053323d2ca12a5d1bd5ed5984e134446eba7.exe File opened (read-only) \??\M: e5ef61799ae020e426b7e2a4763c053323d2ca12a5d1bd5ed5984e134446eba7.exe File opened (read-only) \??\N: e5ef61799ae020e426b7e2a4763c053323d2ca12a5d1bd5ed5984e134446eba7.exe File opened (read-only) \??\O: e5ef61799ae020e426b7e2a4763c053323d2ca12a5d1bd5ed5984e134446eba7.exe File opened (read-only) \??\R: e5ef61799ae020e426b7e2a4763c053323d2ca12a5d1bd5ed5984e134446eba7.exe File opened (read-only) \??\T: e5ef61799ae020e426b7e2a4763c053323d2ca12a5d1bd5ed5984e134446eba7.exe File opened (read-only) \??\Z: e5ef61799ae020e426b7e2a4763c053323d2ca12a5d1bd5ed5984e134446eba7.exe File opened (read-only) \??\F: e5ef61799ae020e426b7e2a4763c053323d2ca12a5d1bd5ed5984e134446eba7.exe File opened (read-only) \??\H: e5ef61799ae020e426b7e2a4763c053323d2ca12a5d1bd5ed5984e134446eba7.exe File opened (read-only) \??\I: e5ef61799ae020e426b7e2a4763c053323d2ca12a5d1bd5ed5984e134446eba7.exe File opened (read-only) \??\J: e5ef61799ae020e426b7e2a4763c053323d2ca12a5d1bd5ed5984e134446eba7.exe File opened (read-only) \??\Q: e5ef61799ae020e426b7e2a4763c053323d2ca12a5d1bd5ed5984e134446eba7.exe File opened (read-only) \??\V: e5ef61799ae020e426b7e2a4763c053323d2ca12a5d1bd5ed5984e134446eba7.exe File opened (read-only) \??\D: e5ef61799ae020e426b7e2a4763c053323d2ca12a5d1bd5ed5984e134446eba7.exe File opened (read-only) \??\G: e5ef61799ae020e426b7e2a4763c053323d2ca12a5d1bd5ed5984e134446eba7.exe File opened (read-only) \??\S: e5ef61799ae020e426b7e2a4763c053323d2ca12a5d1bd5ed5984e134446eba7.exe File opened (read-only) \??\U: e5ef61799ae020e426b7e2a4763c053323d2ca12a5d1bd5ed5984e134446eba7.exe - Sets desktop wallpaper using registry 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\o53fv6tcs092.bmp" e5ef61799ae020e426b7e2a4763c053323d2ca12a5d1bd5ed5984e134446eba7.exe - Drops file in Program Files directory 20 IoCs
description ioc Process File created \??\c:\program files\ibmpez3sn-readme.txt e5ef61799ae020e426b7e2a4763c053323d2ca12a5d1bd5ed5984e134446eba7.exe File created \??\c:\program files (x86)\ibmpez3sn-readme.txt e5ef61799ae020e426b7e2a4763c053323d2ca12a5d1bd5ed5984e134446eba7.exe File opened for modification \??\c:\program files\GrantNew.DVR-MS e5ef61799ae020e426b7e2a4763c053323d2ca12a5d1bd5ed5984e134446eba7.exe File opened for modification \??\c:\program files\LimitMeasure.docm e5ef61799ae020e426b7e2a4763c053323d2ca12a5d1bd5ed5984e134446eba7.exe File opened for modification \??\c:\program files\PingConnect.3gp e5ef61799ae020e426b7e2a4763c053323d2ca12a5d1bd5ed5984e134446eba7.exe File opened for modification \??\c:\program files\PingUnpublish.xlsm e5ef61799ae020e426b7e2a4763c053323d2ca12a5d1bd5ed5984e134446eba7.exe File opened for modification \??\c:\program files\PublishUnprotect.au3 e5ef61799ae020e426b7e2a4763c053323d2ca12a5d1bd5ed5984e134446eba7.exe File opened for modification \??\c:\program files\SwitchSend.pub e5ef61799ae020e426b7e2a4763c053323d2ca12a5d1bd5ed5984e134446eba7.exe File opened for modification \??\c:\program files\BlockExport.temp e5ef61799ae020e426b7e2a4763c053323d2ca12a5d1bd5ed5984e134446eba7.exe File opened for modification \??\c:\program files\HideStop.csv e5ef61799ae020e426b7e2a4763c053323d2ca12a5d1bd5ed5984e134446eba7.exe File opened for modification \??\c:\program files\InstallReceive.aiff e5ef61799ae020e426b7e2a4763c053323d2ca12a5d1bd5ed5984e134446eba7.exe File opened for modification \??\c:\program files\MergeConvertTo.mpe e5ef61799ae020e426b7e2a4763c053323d2ca12a5d1bd5ed5984e134446eba7.exe File opened for modification \??\c:\program files\SaveRegister.mpg e5ef61799ae020e426b7e2a4763c053323d2ca12a5d1bd5ed5984e134446eba7.exe File opened for modification \??\c:\program files\SetGroup.xlsx e5ef61799ae020e426b7e2a4763c053323d2ca12a5d1bd5ed5984e134446eba7.exe File opened for modification \??\c:\program files\ShowRestore.i64 e5ef61799ae020e426b7e2a4763c053323d2ca12a5d1bd5ed5984e134446eba7.exe File opened for modification \??\c:\program files\SuspendSet.rm e5ef61799ae020e426b7e2a4763c053323d2ca12a5d1bd5ed5984e134446eba7.exe File opened for modification \??\c:\program files\EnterPush.rar e5ef61799ae020e426b7e2a4763c053323d2ca12a5d1bd5ed5984e134446eba7.exe File opened for modification \??\c:\program files\MoveUnprotect.wpl e5ef61799ae020e426b7e2a4763c053323d2ca12a5d1bd5ed5984e134446eba7.exe File opened for modification \??\c:\program files\CompleteUnprotect.vsw e5ef61799ae020e426b7e2a4763c053323d2ca12a5d1bd5ed5984e134446eba7.exe File opened for modification \??\c:\program files\LimitBackup.ADT e5ef61799ae020e426b7e2a4763c053323d2ca12a5d1bd5ed5984e134446eba7.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2356 e5ef61799ae020e426b7e2a4763c053323d2ca12a5d1bd5ed5984e134446eba7.exe 2356 e5ef61799ae020e426b7e2a4763c053323d2ca12a5d1bd5ed5984e134446eba7.exe 1232 powershell.exe 1232 powershell.exe 1232 powershell.exe 2356 e5ef61799ae020e426b7e2a4763c053323d2ca12a5d1bd5ed5984e134446eba7.exe 2356 e5ef61799ae020e426b7e2a4763c053323d2ca12a5d1bd5ed5984e134446eba7.exe 2356 e5ef61799ae020e426b7e2a4763c053323d2ca12a5d1bd5ed5984e134446eba7.exe 2356 e5ef61799ae020e426b7e2a4763c053323d2ca12a5d1bd5ed5984e134446eba7.exe 2356 e5ef61799ae020e426b7e2a4763c053323d2ca12a5d1bd5ed5984e134446eba7.exe 2356 e5ef61799ae020e426b7e2a4763c053323d2ca12a5d1bd5ed5984e134446eba7.exe 2356 e5ef61799ae020e426b7e2a4763c053323d2ca12a5d1bd5ed5984e134446eba7.exe 2356 e5ef61799ae020e426b7e2a4763c053323d2ca12a5d1bd5ed5984e134446eba7.exe 2356 e5ef61799ae020e426b7e2a4763c053323d2ca12a5d1bd5ed5984e134446eba7.exe 2356 e5ef61799ae020e426b7e2a4763c053323d2ca12a5d1bd5ed5984e134446eba7.exe 2356 e5ef61799ae020e426b7e2a4763c053323d2ca12a5d1bd5ed5984e134446eba7.exe 2356 e5ef61799ae020e426b7e2a4763c053323d2ca12a5d1bd5ed5984e134446eba7.exe 2356 e5ef61799ae020e426b7e2a4763c053323d2ca12a5d1bd5ed5984e134446eba7.exe 2356 e5ef61799ae020e426b7e2a4763c053323d2ca12a5d1bd5ed5984e134446eba7.exe 2356 e5ef61799ae020e426b7e2a4763c053323d2ca12a5d1bd5ed5984e134446eba7.exe 2356 e5ef61799ae020e426b7e2a4763c053323d2ca12a5d1bd5ed5984e134446eba7.exe 2356 e5ef61799ae020e426b7e2a4763c053323d2ca12a5d1bd5ed5984e134446eba7.exe 2356 e5ef61799ae020e426b7e2a4763c053323d2ca12a5d1bd5ed5984e134446eba7.exe 2356 e5ef61799ae020e426b7e2a4763c053323d2ca12a5d1bd5ed5984e134446eba7.exe 2356 e5ef61799ae020e426b7e2a4763c053323d2ca12a5d1bd5ed5984e134446eba7.exe 2356 e5ef61799ae020e426b7e2a4763c053323d2ca12a5d1bd5ed5984e134446eba7.exe 2356 e5ef61799ae020e426b7e2a4763c053323d2ca12a5d1bd5ed5984e134446eba7.exe 2356 e5ef61799ae020e426b7e2a4763c053323d2ca12a5d1bd5ed5984e134446eba7.exe 2356 e5ef61799ae020e426b7e2a4763c053323d2ca12a5d1bd5ed5984e134446eba7.exe 2356 e5ef61799ae020e426b7e2a4763c053323d2ca12a5d1bd5ed5984e134446eba7.exe 2356 e5ef61799ae020e426b7e2a4763c053323d2ca12a5d1bd5ed5984e134446eba7.exe 2356 e5ef61799ae020e426b7e2a4763c053323d2ca12a5d1bd5ed5984e134446eba7.exe 2356 e5ef61799ae020e426b7e2a4763c053323d2ca12a5d1bd5ed5984e134446eba7.exe 2356 e5ef61799ae020e426b7e2a4763c053323d2ca12a5d1bd5ed5984e134446eba7.exe 2356 e5ef61799ae020e426b7e2a4763c053323d2ca12a5d1bd5ed5984e134446eba7.exe 2356 e5ef61799ae020e426b7e2a4763c053323d2ca12a5d1bd5ed5984e134446eba7.exe 2356 e5ef61799ae020e426b7e2a4763c053323d2ca12a5d1bd5ed5984e134446eba7.exe 2356 e5ef61799ae020e426b7e2a4763c053323d2ca12a5d1bd5ed5984e134446eba7.exe 2356 e5ef61799ae020e426b7e2a4763c053323d2ca12a5d1bd5ed5984e134446eba7.exe 2356 e5ef61799ae020e426b7e2a4763c053323d2ca12a5d1bd5ed5984e134446eba7.exe 2356 e5ef61799ae020e426b7e2a4763c053323d2ca12a5d1bd5ed5984e134446eba7.exe 2356 e5ef61799ae020e426b7e2a4763c053323d2ca12a5d1bd5ed5984e134446eba7.exe 2356 e5ef61799ae020e426b7e2a4763c053323d2ca12a5d1bd5ed5984e134446eba7.exe 2356 e5ef61799ae020e426b7e2a4763c053323d2ca12a5d1bd5ed5984e134446eba7.exe 2356 e5ef61799ae020e426b7e2a4763c053323d2ca12a5d1bd5ed5984e134446eba7.exe 2356 e5ef61799ae020e426b7e2a4763c053323d2ca12a5d1bd5ed5984e134446eba7.exe 2356 e5ef61799ae020e426b7e2a4763c053323d2ca12a5d1bd5ed5984e134446eba7.exe 2356 e5ef61799ae020e426b7e2a4763c053323d2ca12a5d1bd5ed5984e134446eba7.exe 2356 e5ef61799ae020e426b7e2a4763c053323d2ca12a5d1bd5ed5984e134446eba7.exe 2356 e5ef61799ae020e426b7e2a4763c053323d2ca12a5d1bd5ed5984e134446eba7.exe 2356 e5ef61799ae020e426b7e2a4763c053323d2ca12a5d1bd5ed5984e134446eba7.exe 2356 e5ef61799ae020e426b7e2a4763c053323d2ca12a5d1bd5ed5984e134446eba7.exe 2356 e5ef61799ae020e426b7e2a4763c053323d2ca12a5d1bd5ed5984e134446eba7.exe 2356 e5ef61799ae020e426b7e2a4763c053323d2ca12a5d1bd5ed5984e134446eba7.exe 2356 e5ef61799ae020e426b7e2a4763c053323d2ca12a5d1bd5ed5984e134446eba7.exe 2356 e5ef61799ae020e426b7e2a4763c053323d2ca12a5d1bd5ed5984e134446eba7.exe 2356 e5ef61799ae020e426b7e2a4763c053323d2ca12a5d1bd5ed5984e134446eba7.exe 2356 e5ef61799ae020e426b7e2a4763c053323d2ca12a5d1bd5ed5984e134446eba7.exe 2356 e5ef61799ae020e426b7e2a4763c053323d2ca12a5d1bd5ed5984e134446eba7.exe 2356 e5ef61799ae020e426b7e2a4763c053323d2ca12a5d1bd5ed5984e134446eba7.exe 2356 e5ef61799ae020e426b7e2a4763c053323d2ca12a5d1bd5ed5984e134446eba7.exe 2356 e5ef61799ae020e426b7e2a4763c053323d2ca12a5d1bd5ed5984e134446eba7.exe 2356 e5ef61799ae020e426b7e2a4763c053323d2ca12a5d1bd5ed5984e134446eba7.exe 2356 e5ef61799ae020e426b7e2a4763c053323d2ca12a5d1bd5ed5984e134446eba7.exe - Suspicious use of AdjustPrivilegeToken 6 IoCs
description pid Process Token: SeDebugPrivilege 2356 e5ef61799ae020e426b7e2a4763c053323d2ca12a5d1bd5ed5984e134446eba7.exe Token: SeDebugPrivilege 1232 powershell.exe Token: SeBackupPrivilege 1224 vssvc.exe Token: SeRestorePrivilege 1224 vssvc.exe Token: SeAuditPrivilege 1224 vssvc.exe Token: SeTakeOwnershipPrivilege 2356 e5ef61799ae020e426b7e2a4763c053323d2ca12a5d1bd5ed5984e134446eba7.exe - Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 2356 wrote to memory of 1232 2356 e5ef61799ae020e426b7e2a4763c053323d2ca12a5d1bd5ed5984e134446eba7.exe 73 PID 2356 wrote to memory of 1232 2356 e5ef61799ae020e426b7e2a4763c053323d2ca12a5d1bd5ed5984e134446eba7.exe 73
Processes
-
C:\Users\Admin\AppData\Local\Temp\e5ef61799ae020e426b7e2a4763c053323d2ca12a5d1bd5ed5984e134446eba7.exe"C:\Users\Admin\AppData\Local\Temp\e5ef61799ae020e426b7e2a4763c053323d2ca12a5d1bd5ed5984e134446eba7.exe"1⤵
- Modifies extensions of user files
- Adds Run key to start application
- Enumerates connected drives
- Sets desktop wallpaper using registry
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2356 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -e RwBlAHQALQBXAG0AaQBPAGIAagBlAGMAdAAgAFcAaQBuADMAMgBfAFMAaABhAGQAbwB3AGMAbwBwAHkAIAB8ACAARgBvAHIARQBhAGMAaAAtAE8AYgBqAGUAYwB0ACAAewAkAF8ALgBEAGUAbABlAHQAZQAoACkAOwB9AA==2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1232
-
-
C:\Windows\system32\wbem\unsecapp.exeC:\Windows\system32\wbem\unsecapp.exe -Embedding1⤵PID:3296
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1224