sodinokibi | fc9f4bf9ae2bcbeed98e723f0c389f372e50c55425b804470c1586330ae6a774

General

Target

fc9f4bf9ae2bcbeed98e723f0c389f372e50c55425b804470c1586330ae6a774.exe
Size

118KB
MD5

77419f3309a2666ed67538c35b5979c3
SHA1

b4214b60fbd54b6bfefe2e60cfb7c389d5170063
SHA256

fc9f4bf9ae2bcbeed98e723f0c389f372e50c55425b804470c1586330ae6a774
SHA512

4a9e2edc1c946bea0a92fb1b39c0360dbb8d312b536ea1bc2fb331886b540ebe3a67edb97f9d5e63191a5108ec0f937f9e47d71ad7f213e23c0449bf05996187

Score

10^/10

sodinokibi persistence ransomware spyware stealer

Malware Config

Extracted

Path

C:\fl2s3-readme.txt

Family

sodinokibi

Ransom Note

---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension fl2s3. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practice - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/55E70FCA7BEE2B70 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decoder.re/55E70FCA7BEE2B70 Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: HmbIXVMX1RFvYOSQw6WIa12nM+48lvL9u8bH2ZFhvTwClqrYOXUE8v5SvDFJ6md2 Ai94NpvkWlnpsvmWefCquPrh5OKVbMioQS4Xu35hylh53CAgaGg2en1ot8bqXtga dP4+V0HzTL403CmRUUq4OYksd3rtO5prFVutSpl0/PCBoY7u1u95wY6EfmX8VJoz u37VSNOQalYUqWTf6ilb4wwvFbBOd53KRREW6QDXfzE7hrzeo+6nn6vFhmrC8Oo+ wrycImrHRmyjRCr/s01RiGHniNBYTzh0m3J7vxrr9ym3wcGao1VwL5dCgN+eD3M7 rwVP1mPtFS3y6nmD6in4JVgfdWxjA4BNwuDgDheM7cMQKlVU6qXm5d7kXtghN3DZ Zgll35zov/bjCsyXGdqzfh33MjNVhp/t7DG29ZoKZRSCNJ7wQX7Zl5+3wI5erdHm yunS4DvwwJICjBJNG2eBN8cNR3/a1O+9kCyhmoepdrZ9mwzuLNLRZuDy3KWqbK5p ztPNshxAoOmLlzna7j8pGgDCb2bnmdEZd9VQe4FqdjbZm2lvPT03SlWSL6MZljfj m6E0XBUrQJNi2MYs/OdmUz5iMyvEMk4nG5S3bEYi4eCC4iMm2lUDW0TfqTy3/Xxa Uxp31uXBfyVZCNKPcAgs2seanURuvdMCi0UcBJjzPzowEG/q3DahvroQBpee95an yvIqS6qdj3s0Di/K0exrODLjdBEUhzzWZ+6ED1wTUvBhcCHO1OA3X8Y//0YEsMp+ k/9dSa1VtpCnxdNA00Nfa+12nAsVLtxh2jMy4eRkCQVuAxUu9UqBB/9wySJg/Fi1 BfVt+WuQt56kxW/jeKjy/sKag0IStcAazONBRZGHtXJLJ2a3d3MhGfwY+4hJqwwA +ghJu27H4/FlhGSrGJFNR8Gw5nhQZT5JgOJvOt/VkrY4Xv9fF3bXbEfKxWNngEvx C/jvtu7D3q5bzIWDMWtrk94i5tfvA/B3JFL6EgPeyT/6QMSy+93NYWSINbhE6LnM rQ1Y5h8hwDgsrP/8dJ23sdrZdLQUWFJkN3a7A0smGbXVf7uTiXcb0gak2MstDm4V BQXHLJvXX1esyNdzx2cKGQ1C+14SA71BGZqci3fjqdqiPd4LKQh+6MsGcsg/2dTU GU+A4c686bezZUsMLLn+wXjutuBQH5v+vD/U5O0dPawm4mX8qK4fphUrYvMt99pL g9n/nbRjXtyiYLhTBJt80FwLkpkmPhJy2EeWJvbUe5NGZIYfhlR4+kPKgKvwTElu sFkGmDHcuJZgaeSZGrjoAvfhq46uYA== ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damage of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!

URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/55E70FCA7BEE2B70

http://decoder.re/55E70FCA7BEE2B70

Signatures

Sodin,Sodinokibi,REvil
Ransomware with advanced anti-analysis and privilege escalation functionality.
ransomware sodinokibi

Modifies extensions of user files 5 IoCs

Ransomware generally changes the extension on encrypted files.

ransomware

Processes:

fc9f4bf9ae2bcbeed98e723f0c389f372e50c55425b804470c1586330ae6a774.exe

description	ioc	process
File renamed	C:\Users\Admin\Pictures\ReadCompress.raw => \??\c:\users\admin\pictures\ReadCompress.raw.fl2s3	fc9f4bf9ae2bcbeed98e723f0c389f372e50c55425b804470c1586330ae6a774.exe
File renamed	C:\Users\Admin\Pictures\ResolveInstall.png => \??\c:\users\admin\pictures\ResolveInstall.png.fl2s3	fc9f4bf9ae2bcbeed98e723f0c389f372e50c55425b804470c1586330ae6a774.exe
File renamed	C:\Users\Admin\Pictures\StartHide.crw => \??\c:\users\admin\pictures\StartHide.crw.fl2s3	fc9f4bf9ae2bcbeed98e723f0c389f372e50c55425b804470c1586330ae6a774.exe
File renamed	C:\Users\Admin\Pictures\MeasureNew.tif => \??\c:\users\admin\pictures\MeasureNew.tif.fl2s3	fc9f4bf9ae2bcbeed98e723f0c389f372e50c55425b804470c1586330ae6a774.exe
File renamed	C:\Users\Admin\Pictures\NewTrace.raw => \??\c:\users\admin\pictures\NewTrace.raw.fl2s3	fc9f4bf9ae2bcbeed98e723f0c389f372e50c55425b804470c1586330ae6a774.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

fc9f4bf9ae2bcbeed98e723f0c389f372e50c55425b804470c1586330ae6a774.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run	fc9f4bf9ae2bcbeed98e723f0c389f372e50c55425b804470c1586330ae6a774.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\1E8NAmhfRO = "C:\\Users\\Admin\\AppData\\Local\\Temp\\fc9f4bf9ae2bcbeed98e723f0c389f372e50c55425b804470c1586330ae6a774.exe"	fc9f4bf9ae2bcbeed98e723f0c389f372e50c55425b804470c1586330ae6a774.exe

Enumerates connected drives 3 TTPs 25 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

fc9f4bf9ae2bcbeed98e723f0c389f372e50c55425b804470c1586330ae6a774.exe

description	ioc	process
File opened (read-only)	\??\S:	fc9f4bf9ae2bcbeed98e723f0c389f372e50c55425b804470c1586330ae6a774.exe
File opened (read-only)	\??\A:	fc9f4bf9ae2bcbeed98e723f0c389f372e50c55425b804470c1586330ae6a774.exe
File opened (read-only)	\??\J:	fc9f4bf9ae2bcbeed98e723f0c389f372e50c55425b804470c1586330ae6a774.exe
File opened (read-only)	\??\P:	fc9f4bf9ae2bcbeed98e723f0c389f372e50c55425b804470c1586330ae6a774.exe
File opened (read-only)	\??\R:	fc9f4bf9ae2bcbeed98e723f0c389f372e50c55425b804470c1586330ae6a774.exe
File opened (read-only)	\??\G:	fc9f4bf9ae2bcbeed98e723f0c389f372e50c55425b804470c1586330ae6a774.exe
File opened (read-only)	\??\H:	fc9f4bf9ae2bcbeed98e723f0c389f372e50c55425b804470c1586330ae6a774.exe
File opened (read-only)	\??\M:	fc9f4bf9ae2bcbeed98e723f0c389f372e50c55425b804470c1586330ae6a774.exe
File opened (read-only)	\??\O:	fc9f4bf9ae2bcbeed98e723f0c389f372e50c55425b804470c1586330ae6a774.exe
File opened (read-only)	\??\T:	fc9f4bf9ae2bcbeed98e723f0c389f372e50c55425b804470c1586330ae6a774.exe
File opened (read-only)	\??\U:	fc9f4bf9ae2bcbeed98e723f0c389f372e50c55425b804470c1586330ae6a774.exe
File opened (read-only)	\??\V:	fc9f4bf9ae2bcbeed98e723f0c389f372e50c55425b804470c1586330ae6a774.exe
File opened (read-only)	\??\Z:	fc9f4bf9ae2bcbeed98e723f0c389f372e50c55425b804470c1586330ae6a774.exe
File opened (read-only)	\??\B:	fc9f4bf9ae2bcbeed98e723f0c389f372e50c55425b804470c1586330ae6a774.exe
File opened (read-only)	\??\E:	fc9f4bf9ae2bcbeed98e723f0c389f372e50c55425b804470c1586330ae6a774.exe
File opened (read-only)	\??\L:	fc9f4bf9ae2bcbeed98e723f0c389f372e50c55425b804470c1586330ae6a774.exe
File opened (read-only)	\??\Q:	fc9f4bf9ae2bcbeed98e723f0c389f372e50c55425b804470c1586330ae6a774.exe
File opened (read-only)	\??\W:	fc9f4bf9ae2bcbeed98e723f0c389f372e50c55425b804470c1586330ae6a774.exe
File opened (read-only)	\??\X:	fc9f4bf9ae2bcbeed98e723f0c389f372e50c55425b804470c1586330ae6a774.exe
File opened (read-only)	\??\Y:	fc9f4bf9ae2bcbeed98e723f0c389f372e50c55425b804470c1586330ae6a774.exe
File opened (read-only)	\??\D:	fc9f4bf9ae2bcbeed98e723f0c389f372e50c55425b804470c1586330ae6a774.exe
File opened (read-only)	\??\F:	fc9f4bf9ae2bcbeed98e723f0c389f372e50c55425b804470c1586330ae6a774.exe
File opened (read-only)	\??\I:	fc9f4bf9ae2bcbeed98e723f0c389f372e50c55425b804470c1586330ae6a774.exe
File opened (read-only)	\??\K:	fc9f4bf9ae2bcbeed98e723f0c389f372e50c55425b804470c1586330ae6a774.exe
File opened (read-only)	\??\N:	fc9f4bf9ae2bcbeed98e723f0c389f372e50c55425b804470c1586330ae6a774.exe

Drops file in System32 directory 1 IoCs

Processes:

fc9f4bf9ae2bcbeed98e723f0c389f372e50c55425b804470c1586330ae6a774.exe

description	ioc	process
File opened for modification	C:\Windows\System32\CatRoot2\dberr.txt	fc9f4bf9ae2bcbeed98e723f0c389f372e50c55425b804470c1586330ae6a774.exe

Sets desktop wallpaper using registry 2 TTPs 1 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

Processes:

fc9f4bf9ae2bcbeed98e723f0c389f372e50c55425b804470c1586330ae6a774.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-2329389628-4064185017-3901522362-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\716hgsrh61f.bmp"	fc9f4bf9ae2bcbeed98e723f0c389f372e50c55425b804470c1586330ae6a774.exe

Drops file in Program Files directory 26 IoCs

Processes:

fc9f4bf9ae2bcbeed98e723f0c389f372e50c55425b804470c1586330ae6a774.exe

description	ioc	process
File opened for modification	\??\c:\program files\DenySend.ttc	fc9f4bf9ae2bcbeed98e723f0c389f372e50c55425b804470c1586330ae6a774.exe
File opened for modification	\??\c:\program files\SplitUnpublish.eprtx	fc9f4bf9ae2bcbeed98e723f0c389f372e50c55425b804470c1586330ae6a774.exe
File created	\??\c:\program files (x86)\microsoft sql server compact edition\fl2s3-readme.txt	fc9f4bf9ae2bcbeed98e723f0c389f372e50c55425b804470c1586330ae6a774.exe
File created	\??\c:\program files (x86)\microsoft sql server compact edition\v3.5\fl2s3-readme.txt	fc9f4bf9ae2bcbeed98e723f0c389f372e50c55425b804470c1586330ae6a774.exe
File opened for modification	\??\c:\program files\BackupConnect.mpeg	fc9f4bf9ae2bcbeed98e723f0c389f372e50c55425b804470c1586330ae6a774.exe
File opened for modification	\??\c:\program files\LockClose.snd	fc9f4bf9ae2bcbeed98e723f0c389f372e50c55425b804470c1586330ae6a774.exe
File opened for modification	\??\c:\program files\StopAssert.inf	fc9f4bf9ae2bcbeed98e723f0c389f372e50c55425b804470c1586330ae6a774.exe
File opened for modification	\??\c:\program files\DismountSync.tif	fc9f4bf9ae2bcbeed98e723f0c389f372e50c55425b804470c1586330ae6a774.exe
File opened for modification	\??\c:\program files\DisableComplete.snd	fc9f4bf9ae2bcbeed98e723f0c389f372e50c55425b804470c1586330ae6a774.exe
File opened for modification	\??\c:\program files\FindAssert.i64	fc9f4bf9ae2bcbeed98e723f0c389f372e50c55425b804470c1586330ae6a774.exe
File opened for modification	\??\c:\program files\LockConnect.WTV	fc9f4bf9ae2bcbeed98e723f0c389f372e50c55425b804470c1586330ae6a774.exe
File opened for modification	\??\c:\program files\ReadStop.xls	fc9f4bf9ae2bcbeed98e723f0c389f372e50c55425b804470c1586330ae6a774.exe
File opened for modification	\??\c:\program files\ReceiveConvertTo.mov	fc9f4bf9ae2bcbeed98e723f0c389f372e50c55425b804470c1586330ae6a774.exe
File opened for modification	\??\c:\program files\RestoreUndo.vstx	fc9f4bf9ae2bcbeed98e723f0c389f372e50c55425b804470c1586330ae6a774.exe
File opened for modification	\??\c:\program files\StopImport.xla	fc9f4bf9ae2bcbeed98e723f0c389f372e50c55425b804470c1586330ae6a774.exe
File opened for modification	\??\c:\program files\DebugCompress.001	fc9f4bf9ae2bcbeed98e723f0c389f372e50c55425b804470c1586330ae6a774.exe
File created	\??\c:\program files (x86)\microsoft sql server compact edition\v3.5\desktop\fl2s3-readme.txt	fc9f4bf9ae2bcbeed98e723f0c389f372e50c55425b804470c1586330ae6a774.exe
File opened for modification	\??\c:\program files\UnlockRepair.au3	fc9f4bf9ae2bcbeed98e723f0c389f372e50c55425b804470c1586330ae6a774.exe
File opened for modification	\??\c:\program files\ConvertFromCompare.AAC	fc9f4bf9ae2bcbeed98e723f0c389f372e50c55425b804470c1586330ae6a774.exe
File opened for modification	\??\c:\program files\InvokeConnect.tmp	fc9f4bf9ae2bcbeed98e723f0c389f372e50c55425b804470c1586330ae6a774.exe
File opened for modification	\??\c:\program files\ReceivePing.DVR-MS	fc9f4bf9ae2bcbeed98e723f0c389f372e50c55425b804470c1586330ae6a774.exe
File opened for modification	\??\c:\program files\SubmitOut.aif	fc9f4bf9ae2bcbeed98e723f0c389f372e50c55425b804470c1586330ae6a774.exe
File opened for modification	\??\c:\program files\SubmitTest.asp	fc9f4bf9ae2bcbeed98e723f0c389f372e50c55425b804470c1586330ae6a774.exe
File opened for modification	\??\c:\program files\SwitchRevoke.cfg	fc9f4bf9ae2bcbeed98e723f0c389f372e50c55425b804470c1586330ae6a774.exe
File opened for modification	\??\c:\program files\SyncImport.pcx	fc9f4bf9ae2bcbeed98e723f0c389f372e50c55425b804470c1586330ae6a774.exe
File opened for modification	\??\c:\program files\AddResolve.i64	fc9f4bf9ae2bcbeed98e723f0c389f372e50c55425b804470c1586330ae6a774.exe

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1596 1372 WerFault.exe

pid	pid_target	process	target process
1596	1372	WerFault.exe

Modifies system certificate store 2 TTPs 2 IoCs

evasion spyware trojan

Install Root Certificate

T1130

Modify Registry

T1112

Processes:

fc9f4bf9ae2bcbeed98e723f0c389f372e50c55425b804470c1586330ae6a774.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349	fc9f4bf9ae2bcbeed98e723f0c389f372e50c55425b804470c1586330ae6a774.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 040000000100000010000000497904b0eb8719ac47b0bc11519b74d00f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d578112861900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa2030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491d00000001000000100000002e0d6875874a44c820912e85e964cfdb140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b40b00000001000000180000004300b7004f00b7004d00b7004f00b7004400b7004f00000053000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b06010505070308200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e	fc9f4bf9ae2bcbeed98e723f0c389f372e50c55425b804470c1586330ae6a774.exe

Suspicious behavior: EnumeratesProcesses 7 IoCs

Processes:

fc9f4bf9ae2bcbeed98e723f0c389f372e50c55425b804470c1586330ae6a774.exeWerFault.exe

pid	process
1292	fc9f4bf9ae2bcbeed98e723f0c389f372e50c55425b804470c1586330ae6a774.exe
1596	WerFault.exe
1596	WerFault.exe
1596	WerFault.exe
1596	WerFault.exe
1596	WerFault.exe
1292	fc9f4bf9ae2bcbeed98e723f0c389f372e50c55425b804470c1586330ae6a774.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

Processes:

fc9f4bf9ae2bcbeed98e723f0c389f372e50c55425b804470c1586330ae6a774.exevssvc.exeWerFault.exe

description	pid	process
Token: SeDebugPrivilege	1292	fc9f4bf9ae2bcbeed98e723f0c389f372e50c55425b804470c1586330ae6a774.exe
Token: SeTakeOwnershipPrivilege	1292	fc9f4bf9ae2bcbeed98e723f0c389f372e50c55425b804470c1586330ae6a774.exe
Token: SeBackupPrivilege	892	vssvc.exe
Token: SeRestorePrivilege	892	vssvc.exe
Token: SeAuditPrivilege	892	vssvc.exe
Token: SeDebugPrivilege	1596	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\fc9f4bf9ae2bcbeed98e723f0c389f372e50c55425b804470c1586330ae6a774.exe
"C:\Users\Admin\AppData\Local\Temp\fc9f4bf9ae2bcbeed98e723f0c389f372e50c55425b804470c1586330ae6a774.exe"
1⤵
- Modifies extensions of user files
- Adds Run key to start application
- Enumerates connected drives
- Drops file in System32 directory
- Sets desktop wallpaper using registry
- Drops file in Program Files directory
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1292

C:\Windows\system32\wbem\unsecapp.exe
C:\Windows\system32\wbem\unsecapp.exe -Embedding
1⤵
PID:1328

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:892

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 1372 -s 3244
1⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1596

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Install Root Certificate

Modify Registry

Credential Access

Credentials in Files

1

T1081

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

1

T1082

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Defacement

1

T1491

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1292-55-0x0000000076641000-0x0000000076643000-memory.dmp

Filesize
8KB

Download
memory/1596-56-0x000007FEFC401000-0x000007FEFC403000-memory.dmp

Filesize
8KB

Download
memory/1596-57-0x00000000000D0000-0x0000000000372000-memory.dmp

Filesize
2.6MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads