Analysis
- max time kernel
162s - max time network
172s - platform
windows10_x64 - resource
win10-en-20211208 - submitted
24/01/2022, 00:49
Static task
static1
Behavioral task
behavioral1
Sample
e4e37b0aeed1c936b5deff847927f6ac1de71e17588baaf7f193e1ab1ff88e20.exe
Resource
win7-en-20211208
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
e4e37b0aeed1c936b5deff847927f6ac1de71e17588baaf7f193e1ab1ff88e20.exe
Resource
win10-en-20211208
windows10_x64
0 signatures
0 seconds
General
- Target e4e37b0aeed1c936b5deff847927f6ac1de71e17588baaf7f193e1ab1ff88e20.exe
- Size 164KB
- Sample220124-a6d84sghgl
- SHA256 e4e37b0aeed1c936b5deff847927f6ac1de71e17588baaf7f193e1ab1ff88e20
- MD5 75d6a77eaef1bfdf9477aabe6bbc11e2
- SHA1 63a87faa4dfa557dbaa72bfc5222a04328259fa5
- SHA512 73c866bef10f8bcf1d03ee4c8c898dc251217e35e3f1d1cb1b4aad4c9aabf3e93757fb0428b5da61359d6a73a3595aef2891ae88955a6c2be0a70044141a92c1
- MD5 SHA1 SHA512
Score
10/10
Malware Config
Extracted
Path
-
C:\2srre87_Wannadie.txt
-
sodinokibi
Ransom Note
- ---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your computer has extension 2srre87. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/8B5B166F6975878C 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.top/8B5B166F6975878C Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: sojWtOra6kwcS3oTZFY/r1UDLKsMOF4Y3MimsXzCnEW/gCdZrl3e2C/rseDLO6Nl LRUQLehdhZEX60HBN5NjrYQRwbwXhkvxkDwvlLaVnWQ7eiMEAESPKxA3cCHo6Dg1 rj/9BgCjbg1ZBHIY5fFPOLQJ1uc6MgG1nzazXYV0IWogbfXUD9KMN91xKGwaSxsQ ZsFbVQusGgDDpVy8fZzwfjfDzgAF+2OoH4WT7rK53+7saXK4PMo97I/2ZvYzLS/6 aCu/BKo93ARNKvacSJtbxxGu7du86a4TAOPNAqArlYWZG9LtgZhvZrWLJSeH8DZj 1I2T3ImssBfgx3RyxaT78RrJJTK02XEeb5KMwDbCLeTliEy82d3cJZPxtTeGno4J urwT/AM4SFEw4weLnZrvjNap+DHFRLy80D44UE49cSUEbHTelDNgwSBwbgXgy8qX k0QEJGlARVmHeX+IkNEQl9tXKTqHTlpTe8ykykD4Qsr3WV5EdOFs+j3MAtZTkeGG MfPe28nm3TBnizUYFPgtv0kBMJ8o9qMkDD4bFcnTyiTBI3P7twI4PchDDiyUrmg7 F6l69UBKSH3wRRE1/8Dj3BHUi8rsX2VgjysS5CSd9RRhYt+lnT2gN5RE6aFsQ9Dj shWKHX2dleAVakQeuA183VxM2oL+pq0DCswfftMSYXhIcRkQrRwyAShFH+TWcA9B C1xuB9Qcvc/mRwdpjNmUbh1FpzMmz4MfPX2DpComiU4Q37odCEFhJrv2uJq0Z7Ct tiU9zVa8N9jh4QLmUdJv+ENl+N/Kzusc4q8qkuN5r/wLFr9kF9ay1UCJ8Dgqg2VN PlkV1LxEx5+VymQj5Gsyi7z+ImNrYXGQpLTIKj/cv153raogD0Z8OCRGn4jlNySP hg2IZutjuwn1d/gCWurDeUe5yYzg7t4XHviXrWwwyftINA1CEMy0gVCvCa3wRPar ujO61jYeFTsEDoRaTiqyG7SBWeyp+tqvLi4Kl31yAg+IDlOvVyJuqF/IXTcnPdUh hLYFNcz6KxAkxIftiwfr+3xumf5qCHtCX0juia6g2nXIWxbCazkQt9Exjfdp+RmG nYPb2WMt0LMe6q8EkJO2NNFduvO7/A/FDghZwcW9GYKi2lH516vYCRmudCpEOw== Extension name: 2srre87 ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs
-
http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/8B5B166F6975878C
-
http://decryptor.top/8B5B166F6975878C
Signatures
- Sodin,Sodinokibi,REvil
Ransomware with advanced anti-analysis and privilege escalation functionality.
- Modifies extensions of user files 6 IoCs
Ransomware generally changes the extension on encrypted files.
description ioc Process File renamed C:\Users\Admin\Pictures\ReceiveRedo.tif => \??\c:\users\admin\pictures\ReceiveRedo.tif.2srre87 e4e37b0aeed1c936b5deff847927f6ac1de71e17588baaf7f193e1ab1ff88e20.exe File renamed C:\Users\Admin\Pictures\SendUnblock.png => \??\c:\users\admin\pictures\SendUnblock.png.2srre87 e4e37b0aeed1c936b5deff847927f6ac1de71e17588baaf7f193e1ab1ff88e20.exe File renamed C:\Users\Admin\Pictures\ShowDisable.raw => \??\c:\users\admin\pictures\ShowDisable.raw.2srre87 e4e37b0aeed1c936b5deff847927f6ac1de71e17588baaf7f193e1ab1ff88e20.exe File renamed C:\Users\Admin\Pictures\ShowMount.png => \??\c:\users\admin\pictures\ShowMount.png.2srre87 e4e37b0aeed1c936b5deff847927f6ac1de71e17588baaf7f193e1ab1ff88e20.exe File renamed C:\Users\Admin\Pictures\InvokeLimit.crw => \??\c:\users\admin\pictures\InvokeLimit.crw.2srre87 e4e37b0aeed1c936b5deff847927f6ac1de71e17588baaf7f193e1ab1ff88e20.exe File renamed C:\Users\Admin\Pictures\ReceiveExpand.raw => \??\c:\users\admin\pictures\ReceiveExpand.raw.2srre87 e4e37b0aeed1c936b5deff847927f6ac1de71e17588baaf7f193e1ab1ff88e20.exe - Enumerates connected drives 3 TTPs 25 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\F: e4e37b0aeed1c936b5deff847927f6ac1de71e17588baaf7f193e1ab1ff88e20.exe File opened (read-only) \??\T: e4e37b0aeed1c936b5deff847927f6ac1de71e17588baaf7f193e1ab1ff88e20.exe File opened (read-only) \??\Y: e4e37b0aeed1c936b5deff847927f6ac1de71e17588baaf7f193e1ab1ff88e20.exe File opened (read-only) \??\D: e4e37b0aeed1c936b5deff847927f6ac1de71e17588baaf7f193e1ab1ff88e20.exe File opened (read-only) \??\E: e4e37b0aeed1c936b5deff847927f6ac1de71e17588baaf7f193e1ab1ff88e20.exe File opened (read-only) \??\G: e4e37b0aeed1c936b5deff847927f6ac1de71e17588baaf7f193e1ab1ff88e20.exe File opened (read-only) \??\L: e4e37b0aeed1c936b5deff847927f6ac1de71e17588baaf7f193e1ab1ff88e20.exe File opened (read-only) \??\O: e4e37b0aeed1c936b5deff847927f6ac1de71e17588baaf7f193e1ab1ff88e20.exe File opened (read-only) \??\S: e4e37b0aeed1c936b5deff847927f6ac1de71e17588baaf7f193e1ab1ff88e20.exe File opened (read-only) \??\A: e4e37b0aeed1c936b5deff847927f6ac1de71e17588baaf7f193e1ab1ff88e20.exe File opened (read-only) \??\B: e4e37b0aeed1c936b5deff847927f6ac1de71e17588baaf7f193e1ab1ff88e20.exe File opened (read-only) \??\H: e4e37b0aeed1c936b5deff847927f6ac1de71e17588baaf7f193e1ab1ff88e20.exe File opened (read-only) \??\J: e4e37b0aeed1c936b5deff847927f6ac1de71e17588baaf7f193e1ab1ff88e20.exe File opened (read-only) \??\K: e4e37b0aeed1c936b5deff847927f6ac1de71e17588baaf7f193e1ab1ff88e20.exe File opened (read-only) \??\M: e4e37b0aeed1c936b5deff847927f6ac1de71e17588baaf7f193e1ab1ff88e20.exe File opened (read-only) \??\N: e4e37b0aeed1c936b5deff847927f6ac1de71e17588baaf7f193e1ab1ff88e20.exe File opened (read-only) \??\P: e4e37b0aeed1c936b5deff847927f6ac1de71e17588baaf7f193e1ab1ff88e20.exe File opened (read-only) \??\Q: e4e37b0aeed1c936b5deff847927f6ac1de71e17588baaf7f193e1ab1ff88e20.exe File opened (read-only) \??\R: e4e37b0aeed1c936b5deff847927f6ac1de71e17588baaf7f193e1ab1ff88e20.exe File opened (read-only) \??\U: e4e37b0aeed1c936b5deff847927f6ac1de71e17588baaf7f193e1ab1ff88e20.exe File opened (read-only) \??\V: e4e37b0aeed1c936b5deff847927f6ac1de71e17588baaf7f193e1ab1ff88e20.exe File opened (read-only) \??\W: e4e37b0aeed1c936b5deff847927f6ac1de71e17588baaf7f193e1ab1ff88e20.exe File opened (read-only) \??\X: e4e37b0aeed1c936b5deff847927f6ac1de71e17588baaf7f193e1ab1ff88e20.exe File opened (read-only) \??\Z: e4e37b0aeed1c936b5deff847927f6ac1de71e17588baaf7f193e1ab1ff88e20.exe File opened (read-only) \??\I: e4e37b0aeed1c936b5deff847927f6ac1de71e17588baaf7f193e1ab1ff88e20.exe - Sets desktop wallpaper using registry 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\qe5b9.bmp" e4e37b0aeed1c936b5deff847927f6ac1de71e17588baaf7f193e1ab1ff88e20.exe - Drops file in Program Files directory 37 IoCs
description ioc Process File created \??\c:\program files\2srre87_Wannadie.txt e4e37b0aeed1c936b5deff847927f6ac1de71e17588baaf7f193e1ab1ff88e20.exe File opened for modification \??\c:\program files\BlockExpand.wav e4e37b0aeed1c936b5deff847927f6ac1de71e17588baaf7f193e1ab1ff88e20.exe File opened for modification \??\c:\program files\GrantPop.gif e4e37b0aeed1c936b5deff847927f6ac1de71e17588baaf7f193e1ab1ff88e20.exe File opened for modification \??\c:\program files\HideSubmit.mht e4e37b0aeed1c936b5deff847927f6ac1de71e17588baaf7f193e1ab1ff88e20.exe File opened for modification \??\c:\program files\TestMove.ADTS e4e37b0aeed1c936b5deff847927f6ac1de71e17588baaf7f193e1ab1ff88e20.exe File opened for modification \??\c:\program files\WaitPush.wm e4e37b0aeed1c936b5deff847927f6ac1de71e17588baaf7f193e1ab1ff88e20.exe File opened for modification \??\c:\program files\LimitAdd.png e4e37b0aeed1c936b5deff847927f6ac1de71e17588baaf7f193e1ab1ff88e20.exe File opened for modification \??\c:\program files\OutStop.gif e4e37b0aeed1c936b5deff847927f6ac1de71e17588baaf7f193e1ab1ff88e20.exe File opened for modification \??\c:\program files\UnregisterReceive.wmv e4e37b0aeed1c936b5deff847927f6ac1de71e17588baaf7f193e1ab1ff88e20.exe File opened for modification \??\c:\program files\CheckpointDisconnect.mpg e4e37b0aeed1c936b5deff847927f6ac1de71e17588baaf7f193e1ab1ff88e20.exe File opened for modification \??\c:\program files\EnableDeny.mht e4e37b0aeed1c936b5deff847927f6ac1de71e17588baaf7f193e1ab1ff88e20.exe File opened for modification \??\c:\program files\ReadSync.wdp e4e37b0aeed1c936b5deff847927f6ac1de71e17588baaf7f193e1ab1ff88e20.exe File opened for modification \??\c:\program files\SaveConvert.html e4e37b0aeed1c936b5deff847927f6ac1de71e17588baaf7f193e1ab1ff88e20.exe File opened for modification \??\c:\program files\SaveGet.htm e4e37b0aeed1c936b5deff847927f6ac1de71e17588baaf7f193e1ab1ff88e20.exe File opened for modification \??\c:\program files\CheckpointBackup.TTS e4e37b0aeed1c936b5deff847927f6ac1de71e17588baaf7f193e1ab1ff88e20.exe File opened for modification \??\c:\program files\CheckpointRename.asp e4e37b0aeed1c936b5deff847927f6ac1de71e17588baaf7f193e1ab1ff88e20.exe File opened for modification \??\c:\program files\RestartRemove.gif e4e37b0aeed1c936b5deff847927f6ac1de71e17588baaf7f193e1ab1ff88e20.exe File opened for modification \??\c:\program files\CompareUninstall.vstm e4e37b0aeed1c936b5deff847927f6ac1de71e17588baaf7f193e1ab1ff88e20.exe File opened for modification \??\c:\program files\ExportFormat.mp4 e4e37b0aeed1c936b5deff847927f6ac1de71e17588baaf7f193e1ab1ff88e20.exe File opened for modification \??\c:\program files\OpenComplete.mp3 e4e37b0aeed1c936b5deff847927f6ac1de71e17588baaf7f193e1ab1ff88e20.exe File opened for modification \??\c:\program files\PingOptimize.jfif e4e37b0aeed1c936b5deff847927f6ac1de71e17588baaf7f193e1ab1ff88e20.exe File opened for modification \??\c:\program files\SkipUnlock.tif e4e37b0aeed1c936b5deff847927f6ac1de71e17588baaf7f193e1ab1ff88e20.exe File opened for modification \??\c:\program files\CloseClear.3g2 e4e37b0aeed1c936b5deff847927f6ac1de71e17588baaf7f193e1ab1ff88e20.exe File opened for modification \??\c:\program files\EnableGroup.reg e4e37b0aeed1c936b5deff847927f6ac1de71e17588baaf7f193e1ab1ff88e20.exe File opened for modification \??\c:\program files\JoinUse.vsd e4e37b0aeed1c936b5deff847927f6ac1de71e17588baaf7f193e1ab1ff88e20.exe File opened for modification \??\c:\program files\MeasureImport.gif e4e37b0aeed1c936b5deff847927f6ac1de71e17588baaf7f193e1ab1ff88e20.exe File opened for modification \??\c:\program files\RepairConnect.eprtx e4e37b0aeed1c936b5deff847927f6ac1de71e17588baaf7f193e1ab1ff88e20.exe File opened for modification \??\c:\program files\UpdatePublish.txt e4e37b0aeed1c936b5deff847927f6ac1de71e17588baaf7f193e1ab1ff88e20.exe File opened for modification \??\c:\program files\ResizeDismount.ppsm e4e37b0aeed1c936b5deff847927f6ac1de71e17588baaf7f193e1ab1ff88e20.exe File opened for modification \??\c:\program files\StepCheckpoint.docx e4e37b0aeed1c936b5deff847927f6ac1de71e17588baaf7f193e1ab1ff88e20.exe File opened for modification \??\c:\program files\WatchRestore.mhtml e4e37b0aeed1c936b5deff847927f6ac1de71e17588baaf7f193e1ab1ff88e20.exe File created \??\c:\program files (x86)\2srre87_Wannadie.txt e4e37b0aeed1c936b5deff847927f6ac1de71e17588baaf7f193e1ab1ff88e20.exe File opened for modification \??\c:\program files\CloseUse.gif e4e37b0aeed1c936b5deff847927f6ac1de71e17588baaf7f193e1ab1ff88e20.exe File opened for modification \??\c:\program files\CopyClear.ini e4e37b0aeed1c936b5deff847927f6ac1de71e17588baaf7f193e1ab1ff88e20.exe File opened for modification \??\c:\program files\DisconnectShow.ps1xml e4e37b0aeed1c936b5deff847927f6ac1de71e17588baaf7f193e1ab1ff88e20.exe File opened for modification \??\c:\program files\StepTest.potx e4e37b0aeed1c936b5deff847927f6ac1de71e17588baaf7f193e1ab1ff88e20.exe File opened for modification \??\c:\program files\SuspendExpand.TTS e4e37b0aeed1c936b5deff847927f6ac1de71e17588baaf7f193e1ab1ff88e20.exe - Modifies data under HKEY_USERS 42 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs powershell.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000 powershell.exe - Suspicious behavior: EnumeratesProcesses 15 IoCs
pid Process 2684 e4e37b0aeed1c936b5deff847927f6ac1de71e17588baaf7f193e1ab1ff88e20.exe 2684 e4e37b0aeed1c936b5deff847927f6ac1de71e17588baaf7f193e1ab1ff88e20.exe 2684 e4e37b0aeed1c936b5deff847927f6ac1de71e17588baaf7f193e1ab1ff88e20.exe 2684 e4e37b0aeed1c936b5deff847927f6ac1de71e17588baaf7f193e1ab1ff88e20.exe 1480 powershell.exe 1480 powershell.exe 1480 powershell.exe 2684 e4e37b0aeed1c936b5deff847927f6ac1de71e17588baaf7f193e1ab1ff88e20.exe 2684 e4e37b0aeed1c936b5deff847927f6ac1de71e17588baaf7f193e1ab1ff88e20.exe 2684 e4e37b0aeed1c936b5deff847927f6ac1de71e17588baaf7f193e1ab1ff88e20.exe 2684 e4e37b0aeed1c936b5deff847927f6ac1de71e17588baaf7f193e1ab1ff88e20.exe 2684 e4e37b0aeed1c936b5deff847927f6ac1de71e17588baaf7f193e1ab1ff88e20.exe 2684 e4e37b0aeed1c936b5deff847927f6ac1de71e17588baaf7f193e1ab1ff88e20.exe 2684 e4e37b0aeed1c936b5deff847927f6ac1de71e17588baaf7f193e1ab1ff88e20.exe 2684 e4e37b0aeed1c936b5deff847927f6ac1de71e17588baaf7f193e1ab1ff88e20.exe - Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 1480 powershell.exe Token: SeBackupPrivilege 1608 vssvc.exe Token: SeRestorePrivilege 1608 vssvc.exe Token: SeAuditPrivilege 1608 vssvc.exe - Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 2684 wrote to memory of 1480 2684 e4e37b0aeed1c936b5deff847927f6ac1de71e17588baaf7f193e1ab1ff88e20.exe 72 PID 2684 wrote to memory of 1480 2684 e4e37b0aeed1c936b5deff847927f6ac1de71e17588baaf7f193e1ab1ff88e20.exe 72
Processes
-
C:\Users\Admin\AppData\Local\Temp\e4e37b0aeed1c936b5deff847927f6ac1de71e17588baaf7f193e1ab1ff88e20.exe"C:\Users\Admin\AppData\Local\Temp\e4e37b0aeed1c936b5deff847927f6ac1de71e17588baaf7f193e1ab1ff88e20.exe"1⤵
- Modifies extensions of user files
- Enumerates connected drives
- Sets desktop wallpaper using registry
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2684 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -e RwBlAHQALQBXAG0AaQBPAGIAagBlAGMAdAAgAFcAaQBuADMAMgBfAFMAaABhAGQAbwB3AGMAbwBwAHkAIAB8ACAARgBvAHIARQBhAGMAaAAtAE8AYgBqAGUAYwB0ACAAewAkAF8ALgBEAGUAbABlAHQAZQAoACkAOwB9AA==2⤵
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1480
-
-
C:\Windows\system32\wbem\unsecapp.exeC:\Windows\system32\wbem\unsecapp.exe -Embedding1⤵PID:2908
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1608